instar 1.3.703 → 1.3.704

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.703",
+  "version": "1.3.704",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-30T10:53:21.745Z",
-  "instarVersion": "1.3.703",
+  "generatedAt": "2026-07-02T01:48:54.107Z",
+  "instarVersion": "1.3.704",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.704.md

@@ -0,0 +1,48 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Ratifies six constitutional standards into `docs/STANDARDS-REGISTRY.md`, earned from the
+2026-07-01 silent-Telegram-message-loss postmortem (operator-ratified, topic 29836):
+
+- **A Refusal Stays a Refusal — conservation of negative outcomes** (Building): a terminal
+  refusal/rejection/drop must stay distinguishable from success at every boundary; ack
+  vocabularies name what was actually promised; a refusal affecting the verified operator
+  is always loud.
+- **Cross-Store Coherence Is an Invariant** (Building): any two stores answering the same
+  question carry a declared, machine-checked agreement invariant.
+- **Test Identity Never Enters Production State** (Building): live tests run in throwaway
+  agent homes; fixture writes into real stores are refused structurally; durable-state
+  touches open teardown obligations at write time.
+- **A Dark Feature Guards Nothing** (Shipping): a load-bearing path depending on a
+  dark/disabled feature forces a decision — graduate it or record accepted manual fallback;
+  postmortems must ask which dark features would have prevented the incident.
+- **Runtime End-to-End Proof — the canary standard** (Building): every critical
+  user-visible outcome gets a synthetic full-path probe on a cadence; component liveness is
+  never accepted as proof of outcome.
+- **Session Input Is a Principal** (Substrate): extends Know Your Principal to session
+  input channels — synthetic typers must be structurally distinguishable from the driver.
+
+Also adds the postmortem the entries cite:
+`docs/postmortems/2026-07-01-silent-telegram-message-loss.md`. Docs-only; no runtime change.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- Registry amendment follows the documented amendment loop (agent proposes with the story,
+  operator ratifies — ratification 2026-07-01, topic 29836, decisions recorded per entry).
+- Each entry names its enforcement arms honestly: live guards on the originating fleet
+  (coherence audit, delivery canary, fixture-write guard) plus tracked upstream filings
+  (fb-1e751537-655, fb-b15ac10b-85c, fb-dd043916-28f) for the structural layers; the
+  conformance-coverage audit will classify the not-yet-landed guards as gaps by design.
+- Side-effects artifact: `upgrades/side-effects/postmortem-standards-s1-s6.md`.

package/upgrades/side-effects/postmortem-standards-s1-s6.md

@@ -0,0 +1,46 @@
+# Side-Effects Review — Six constitutional standards from the 2026-07-01 silent-message-loss postmortem
+
+**Version / slug:** `postmortem-standards-s1-s6`
+**Date:** `2026-07-01`
+**Author:** `Echo (agent), operator-ratified by Justin (topic 29836)`
+**Second-pass reviewer:** `not required (docs-only constitutional amendment; each entry operator-ratified verbatim by decision scope)`
+
+## Summary of the change
+
+Docs-only. Adds six operator-ratified standards to `docs/STANDARDS-REGISTRY.md`, each with its earned-from story per the registry's amendment loop ("proposed by the agent with its story, ratified by the operator" — ratification recorded 2026-07-01, topic 29836): **A Refusal Stays a Refusal** (Building), **Cross-Store Coherence Is an Invariant** (Building), **Test Identity Never Enters Production State** (Building), **A Dark Feature Guards Nothing** (Shipping), **Runtime End-to-End Proof** (Building), **Session Input Is a Principal** (Substrate, extends Know Your Principal). Also adds the in-repo postmortem the entries cite (`docs/postmortems/2026-07-01-silent-telegram-message-loss.md`). No source, config, template, hook, or test files are touched.
+
+## Decision-point inventory
+
+No runtime decision point is added, modified, removed, or passed through. The change is constitutional text. Two READ consumers gain input: the Standards-Conformance Gate and the conformance-coverage audit read this registry — both are signal-only surfaces (findings feed reviewers; nothing blocks). The new entries will be classified by the coverage audit as `spec-only`/`documented-only` until their named guards land upstream (the U1/U2/G3 tracked filings) — that classification is the honest, intended state and is exactly the gap-surfacing that audit exists to do.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. (The conformance gate that reads this registry is signal-only by the Signal vs. Authority standard; a new standard cannot block a spec.)
+
+---
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable. The standards' enforcement arms (test ratchet on ack-mappings, registry-level fixture validation, dark-but-load-bearing classification, canary coverage tracking) land in tracked upstream work (fb-1e751537-655, fb-b15ac10b-85c, fb-dd043916-28f); until then the entries are deliberately prose-with-named-guards, and the coverage audit will report them as gaps rather than silently claiming enforcement.
+
+---
+
+## 3. Level of abstraction
+
+Correct level: these are constitutional standards (family-level rules with earned-from stories), not operational runbooks. Each entry names its operational machinery in **Applied through** rather than embedding procedure. S6 extends an existing standard (Know Your Principal) rather than duplicating it; S2/S5 cross-reference their sibling standards (Verify the State Not Its Symbol; The User Experience Is the Product) rather than restating them.
+
+## 4. Signal vs. authority
+
+Compliant. The registry is read by signal-only surfaces (spec-converge conformance check, coverage audit). Nothing in this change grants any gate blocking authority.
+
+## 5. Interactions with adjacent systems
+
+- The Standards-Conformance Gate will start checking future specs against six more rules — intended effect; signal-only.
+- The conformance-coverage audit (`/conformance/coverage`) will list six new standards, initially as documented-only gaps — intended gap-surfacing.
+- The registry's own "Two layers" and amendment-loop sections are untouched; the entries follow the existing family structure (Substrate / Building / Shipping).
+
+## 6. Rollback cost
+
+Trivial: `git revert` of one commit removes both files cleanly. No config, no state, no migration, no deployed-agent impact.