instar 1.3.707 → 1.3.709

package/dist/providers/adapters/anthropic-headless/control/authCredentialInjection.js

@@ -8,6 +8,7 @@
 import { CapabilityFlag } from '../../../capabilities.js';
 import { AuthError } from '../../../errors.js';
 import { ANTHROPIC_HEADLESS_ID, mapApiError } from '../errors.js';
+import { ANTHROPIC_MODELS } from '../../../../core/models.js';
 class AnthropicHeadlessAuthCredentialInjection {
     _config;
     capability = CapabilityFlag.AuthCredentialInjection;
@@ -38,6 +39,19 @@ class AnthropicHeadlessAuthCredentialInjection {
         }
         return 'unknown credential kind';
     }
+    /**
+     * RULE 3.1 RATIONALE (state-detection: credential-validity probe)
+     * - Criticality: minor-degradation. A wrong verdict surfaces as a loud
+     *   AuthError (or a later loud auth failure downstream) — never silent
+     *   corruption; the probe is a pre-check convenience, not the authority.
+     * - Frequency: per-enrollment / per-verification event (rare).
+     * - Stability: very-stable — official public Messages-API HTTP status
+     *   semantics (401/403 for bad credentials), not a scraped surface.
+     * - Fallback: every downstream call with the credential fails loudly on
+     *   its own; mapApiError classifies non-ok statuses.
+     * - → Verdict: deterministic, exempt-from-canary (stable public API
+     *   contract + loud failure path). Registry row: 06-state-detector-registry.md.
+     */
     async probe(credential) {
         const validation = this.validate(credential);
         if (validation) {
@@ -60,7 +74,10 @@ class AnthropicHeadlessAuthCredentialInjection {
             method: 'POST',
             headers,
             body: JSON.stringify({
-                model: 'claude-haiku-4-5',
+                // Config-overridable (risk item #7); default sourced from the
+                // models.ts tier map, not a string literal — the probe only needs
+                // the cheapest valid model on the account.
+                model: this._config.credentialProbeModel?.trim() || ANTHROPIC_MODELS.haiku,
                 max_tokens: 4,
                 messages: [{ role: 'user', content: 'ping' }],
             }),

package/dist/providers/adapters/anthropic-headless/control/authCredentialInjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"authCredentialInjection.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/anthropic-headless/control/authCredentialInjection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,wCAAwC;IAGf;IAFpB,UAAU,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAE7D,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE,SAAS,CAAC,UAA8B;QACtC,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAwB,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,UAA8B;QACrC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,qDAAqD,CAAC;QAC/D,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,qFAAqF,CAAC;QAC/F,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/C,OAAO,uDAAuD,CAAC;YACjE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,OAAO,sCAAsC,CAAC;YAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAA8B;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,oBAAoB,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,qBAAqB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,mBAAmB,EAAE,YAAY;SAClC,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,kBAAkB;gBACzB,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;aAC9C,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAA+B;IAE/B,OAAO,IAAI,wCAAwC,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"authCredentialInjection.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/anthropic-headless/control/authCredentialInjection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,MAAM,wCAAwC;IAGf;IAFpB,UAAU,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAE7D,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE,SAAS,CAAC,UAA8B;QACtC,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAwB,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,UAA8B;QACrC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,qDAAqD,CAAC;QAC/D,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,qFAAqF,CAAC;QAC/F,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/C,OAAO,uDAAuD,CAAC;YACjE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,OAAO,sCAAsC,CAAC;YAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,UAA8B;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,oBAAoB,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,qBAAqB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,mBAAmB,EAAE,YAAY;SAClC,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,8DAA8D;gBAC9D,kEAAkE;gBAClE,2CAA2C;gBAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,KAAK;gBAC1E,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;aAC9C,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAA+B;IAE/B,OAAO,IAAI,wCAAwC,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.707",
+  "version": "1.3.709",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-02T05:36:09.449Z",
-  "instarVersion": "1.3.707",
+  "generatedAt": "2026-07-02T08:48:48.771Z",
+  "instarVersion": "1.3.709",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/llmBenchCoverage.ts

@@ -0,0 +1,97 @@
+/**
+ * LLM Benchmark Coverage Map — INSTAR-Bench v2 ratchet #2.
+ *
+ * Every LLM-driven component (a key of COMPONENT_CATEGORY in
+ * src/core/componentCategories.ts) must map to exactly one of:
+ *   - { task: '<bench-task-id>' } — covered by an INSTAR-Bench v2 task
+ *     (task definitions live in the bench harness:
+ *     research/llm-pathway-bench/instar-bench-v2/tasks/ on the benching
+ *     agent; the id here is the durable contract),
+ *   - { pending: '<wave>' } — authoring queued; the pending set is PINNED
+ *     shrink-only in tests/unit/llm-bench-coverage-ratchet.test.ts (you can
+ *     graduate an entry to covered, you cannot add one without editing the
+ *     pinned test — a visible, reviewed act),
+ *   - { exempt: '<argued reason>' } — a real argument why benching this
+ *     component is not meaningful (also pinned shrink-only).
+ *
+ * WHY (operator directive 2026-07-02, topic 29723 + INSTAR-BENCH-V2-SPEC §6):
+ * adding an LLM callsite without benchmark coverage must fail the build —
+ * an unbenched decision-maker is an unmeasured one, and routing defaults are
+ * benchmark-derived. Structure > Willpower.
+ *
+ * Companion ratchet: the wiring test (componentCategories-evaluate-coverage)
+ * keeps COMPONENT_CATEGORY exhaustive over .evaluate() callsites; THIS map +
+ * its test keep bench coverage exhaustive over COMPONENT_CATEGORY.
+ */
+
+export type BenchCoverage =
+  | { task: string }
+  | { pending: 'wave-2' | 'wave-3' }
+  | { exempt: string };
+
+export const LLM_BENCH_COVERAGE: Readonly<Record<string, BenchCoverage>> = {
+  // ── Covered by the critical set (Wave 1 — authored 2026-07-02) ──
+  MessageSentinel: { task: 'sentinel-classify' },
+  MessagingToneGate: { task: 'tone-gate' },
+  // CompletionEvaluator has TWO judged surfaces; both benched.
+  CompletionEvaluator: { task: 'completion-judge+p13-stop-judge' },
+  ExternalOperationGate: { task: 'external-op-gate' },
+  LLMSanitizer: { task: 'injection-sanitizer' },
+  WarrantsReplyGate: { task: 'warrants-reply' },
+  InputClassifier: { task: 'input-classifier' },
+  Usher: { task: 'usher' },
+  'correction-learning': { task: 'correction-distiller' },
+  CoherenceReviewer: { task: 'gate-triage' },
+
+  // ── Argued exemptions (pinned; each must carry a real reason) ──
+  InteractivePoolCanaryJudge: {
+    exempt:
+      'judges a FIXED known-answer canary probe — the canary is its own benchmark; a bench task would re-test the same constant',
+  },
+
+  // ── Wave 2 (sentinels/gates/extractors still to author) ──
+  InputDetector: { pending: 'wave-2' },
+  InputGuard: { pending: 'wave-2' },
+  SessionActivitySentinel: { pending: 'wave-2' },
+  StallTriageNurse: { pending: 'wave-2' },
+  CommitmentSentinel: { pending: 'wave-2' },
+  PresenceProxy: { pending: 'wave-2' },
+  PromiseBeacon: { pending: 'wave-2' },
+  ProjectDriftChecker: { pending: 'wave-2' },
+  TemporalCoherenceChecker: { pending: 'wave-2' },
+  SessionWatchdog: { pending: 'wave-2' },
+  ResumeQueueDrainer: { pending: 'wave-2' },
+  TopicIntentArcCheck: { pending: 'wave-2' },
+  SlackAdapter: { pending: 'wave-2' },
+  TelegramAdapter: { pending: 'wave-2' },
+  PromptGate: { pending: 'wave-2' },
+  AutoApprover: { pending: 'wave-2' },
+  IntegrationGate: { pending: 'wave-2' },
+  UnjustifiedStopGate: { pending: 'wave-2' },
+  CoherenceGate: { pending: 'wave-2' },
+  OverrideDetector: { pending: 'wave-2' },
+  TaskClassifier: { pending: 'wave-2' },
+  ResumeValidator: { pending: 'wave-2' },
+  SessionSummarySentinel: { pending: 'wave-2' },
+  TopicIntentExtractor: { pending: 'wave-2' },
+
+  // ── Wave 3 (reflectors + background/job tasks) ──
+  JobReflector: { pending: 'wave-3' },
+  crossModelReviewer: { pending: 'wave-3' },
+  SelfKnowledgeTree: { pending: 'wave-3' },
+  TreeTriage: { pending: 'wave-3' },
+  TopicSummarizer: { pending: 'wave-3' },
+  ContextualEvaluator: { pending: 'wave-3' },
+  RelationshipManager: { pending: 'wave-3' },
+  StandardsConformanceReviewer: { pending: 'wave-3' },
+  DiscoveryEvaluator: { pending: 'wave-3' },
+  PipeSessionSpawner: { pending: 'wave-3' },
+  CartographerSweep: { pending: 'wave-3' },
+  StandardsCoverageEnrichment: { pending: 'wave-3' },
+  PreCompactionFlush: { pending: 'wave-3' },
+  TreeSynthesis: { pending: 'wave-3' },
+  LLMConflictResolver: { pending: 'wave-3' },
+  openConversationBrief: { pending: 'wave-3' },
+  'a2a-checkin': { pending: 'wave-3' },
+  'mentor-stage-b': { pending: 'wave-3' },
+};

package/upgrades/1.3.708.md

@@ -0,0 +1,54 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The last hardcoded-model callsites from the LLM Routing Registry audit ("Risk
+items" #3/#5/#6/#7) are now overridable configuration with behavior-preserving
+inline defaults — with nothing set, every callsite behaves byte-for-byte as
+before, and nothing is written to any config file (absence IS the default; no
+migration needed).
+
+- `DispatchExecutor.runAgentic`'s spawned dispatch session model:
+  `intelligence.pinnedModels.dispatchAgentic` (default 'haiku', unchanged).
+- The anthropic-headless credential-probe validation ping:
+  `intelligence.pinnedModels.anthropicCredentialProbe` (default now sourced
+  from `ANTHROPIC_MODELS.haiku` in the central tier map instead of a
+  free-floating `'claude-haiku-4-5'` literal, so a future model bump cannot
+  silently miss it).
+- The setup wizard's narrative models (codex + gemini drivers): env-var
+  overrides `INSTAR_WIZARD_CODEX_MODEL` / `INSTAR_WIZARD_GEMINI_MODEL` — env
+  not config, because the wizard runs before `.instar/config.json` exists.
+  `setup.ts`'s duplicate `WIZARD_CODEX_MODEL` const collapsed into a single
+  source of truth in `setup-wizard/model-constants.ts` (re-exported, canary
+  contract preserved).
+- Honest audit correction: risk item #4 (mentor loop → 'opus') needed no code
+  change — it was already config-driven via `mentor.autonomousFix.model`; a
+  canary test now pins that fact.
+
+15 new unit tests cover both sides of every boundary (absent ⇒ shipped
+default, present ⇒ override wins, whitespace ⇒ absent) plus wiring canaries
+asserting `server.ts` threads both config keys. This is step one of the
+INSTAR-Bench v2 program (operator-approved 2026-07-02): before benchmark
+results can drive model routing, every model choice must be reachable by
+configuration rather than buried in code.
+
+## What to Tell Your User
+
+Nothing proactively — this changes no behavior on its own. If your operator
+asks: a handful of my internal helpers (the background dispatch runner, my
+setup wizard's text generator, and the tiny "does this credential work?"
+check) had their AI model choice typed directly into my code; those choices
+are now ordinary settings, with the old models still used unless someone
+deliberately changes them.
+
+## Summary of New Capabilities
+
+- New config block `intelligence.pinnedModels` (`dispatchAgentic`,
+  `anthropicCredentialProbe`) — inline-defaulted, absent means today's
+  behavior exactly.
+- New env overrides `INSTAR_WIZARD_CODEX_MODEL` / `INSTAR_WIZARD_GEMINI_MODEL`
+  for the pre-config setup wizard.
+- New adapter config field `credentialProbeModel` on anthropic-headless.

package/upgrades/1.3.709.md

@@ -0,0 +1,42 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+INSTAR-Bench v2 ratchet #2 (spec §6; operator directive 2026-07-02, topic
+29723): a new coverage ledger (`src/data/llmBenchCoverage.ts`) maps every LLM
+component in `COMPONENT_CATEGORY` to its benchmark status — covered by a
+named bench task (the 10 Wave-1 critical gates/sentinels), pending (42,
+pinned shrink-only), or exempt (1, argued). A CI test
+(`llm-bench-coverage-ratchet.test.ts`) fails the build when a new LLM
+component ships without a coverage decision, when the pending/exempt sets
+GROW (graduating shrinks them; adding requires editing the pinned baseline in
+the test — a visible, reviewed act), when an exemption's argument is lazy, or
+when a Wave-1 critical component slides back to uncovered.
+
+Together with the existing attribution ratchet + category-map wiring test,
+the chain is closed: every LLM callsite must be attributed → categorized/
+routed deliberately → benchmark-covered. No runtime surface; build-time only.
+
+## What to Tell Your User
+
+Nothing proactively — no behavior changes. If asked: every one of my internal
+AI helpers is now tracked against a benchmark coverage ledger, so any new
+helper added to my infrastructure must ship with quality measurements (or a
+written argument why not) before the build goes green. It keeps my model
+choices grounded in measured results instead of guesses.
+
+## Summary of New Capabilities
+
+None user-facing. New build-time guarantee: `src/data/llmBenchCoverage.ts`
+(the coverage ledger) + `llm-bench-coverage-ratchet.test.ts` (the CI ratchet).
+The ledger is importable by future tooling (e.g. the bench runner's coverage
+report) but nothing at runtime consumes it yet.
+
+## Evidence
+
+6 new tests green (completeness, no-dangling, shrink-only pins ×2, argued
+exemptions, Wave-1 regression pin); `tsc --noEmit` clean; full unit suite
+green at push.

package/upgrades/config-driven-pinned-models.eli16.md

@@ -0,0 +1,18 @@
+# The last few "model choices burned into the code" are now settings
+
+Instar makes hundreds of small AI calls a day — checking messages, validating credentials, running its setup wizard, executing background dispatch steps. For almost all of them, WHICH model gets used is a setting an operator can change. But an audit this week found a handful of stragglers where the model name was typed directly into the code: the background dispatch runner always spawned "haiku", the setup wizard always asked "gpt-5.3-codex" (or "gemini-2.5-flash") to write its intro text, and the credential checker always pinged Anthropic with a hard-typed "claude-haiku-4-5". If benchmarking ever showed a better/cheaper model for one of these jobs, changing it meant editing source code and shipping a release — for what should be a one-line setting.
+
+This change makes those last callsites configurable, with one iron rule: **if you change nothing, nothing changes.** Every one of them keeps exactly its old model as the built-in default. The new settings don't even get written into config files — absence IS the default, so no existing agent's config is touched on update, and there is nothing to migrate.
+
+The specifics, in plain terms:
+
+- The background dispatch runner's model can now be set in config (`intelligence.pinnedModels.dispatchAgentic`). Unset, it's "haiku" like always.
+- The credential checker's tiny "does this key work?" ping model is configurable too (`intelligence.pinnedModels.anthropicCredentialProbe`) — and its default now comes from the central model list instead of a lone typed-out string, so a future Claude model bump can't silently miss it.
+- The setup wizard is special: it runs BEFORE the config file exists (creating that file is its whole job), so a config setting could never reach it. Its override is an environment variable instead (`INSTAR_WIZARD_CODEX_MODEL` / `INSTAR_WIZARD_GEMINI_MODEL`), which is the only kind of setting that CAN reach it.
+- One honest discovery: the mentor loop — listed in the audit as hardcoded to "opus" — turned out to already be configurable (`mentor.autonomousFix.model`); the audit row was wrong. A test now pins that so the record stays honest.
+
+Also cleaned up: the wizard's codex model name was typed in TWO places that could drift apart; now there's one source of truth that the other re-exports.
+
+Safety story: this adds no new decision-making, no gating, no blocking — it only lets an operator choose the model for five existing, unchanged jobs. Fifteen new tests prove both directions on every surface: leave it unset and you get byte-for-byte the old behavior; set it and your value wins; set it to whitespace and it's treated as unset. The existing wizard canary tests (which pin the "-m model" discipline on every codex spawn) pass unmodified. Rollback is deleting a config line.
+
+Why now: this is step one of the INSTAR-Bench v2 program (operator-approved 2026-07-02) — before benchmark results can drive model routing, every model choice has to be reachable by configuration rather than buried in code.

package/upgrades/llm-bench-coverage-ratchet.eli16.md

@@ -0,0 +1,11 @@
+# New AI decision-makers now have to bring a test report card
+
+Instar has about fifty little AI helpers inside it — one classifies your messages, one reviews outgoing replies, one judges whether an autonomous work session really finished, and so on. We just started benchmarking these helpers properly: for each one, a battery of hard test cases that tells us which AI model does that specific job well, fast, and cheap. Those measurements are what our model-routing choices will be based on going forward.
+
+But a benchmark only stays trustworthy if it stays complete. The failure mode is silent: someone adds a NEW AI helper next month, nobody writes test cases for it, and suddenly there's an unmeasured decision-maker running in production whose model was picked by vibes. Six months later there are ten of those and the benchmark is a museum piece.
+
+This change makes that impossible — not by policy, by build failure. There's now a coverage ledger listing every AI helper and its benchmark status: covered (with the name of its test battery), queued for authoring (an explicitly pinned to-do list), or exempt (with a written argument why testing it makes no sense — and "n/a" is literally rejected as too short). A test in the build system cross-checks that ledger against the master list of AI helpers. Add a new helper without deciding its benchmark story, and the build goes red with instructions telling you exactly what to do.
+
+The teeth are in the details: the "queued" list can only shrink. You can graduate an entry to covered, but adding a new name to the queue requires editing the pinned list inside the test itself — a change any reviewer will see and question. Same for exemptions. So the lazy path (quietly park it in the queue forever) is exactly as visible as the honest path (write the test cases). Ten of the most critical helpers — the message classifier, the outbound-message gate, the completion judge, the injection screener, and their peers — are additionally pinned as "may never slide back": once covered, always covered.
+
+This is the second ratchet of its kind. The first (already live) forces every new AI call site to register in the routing map so we know which provider runs it. Together they close the loop: every AI decision-maker in instar must be routed deliberately AND measured before it ships. Nothing changes at runtime — this is purely a build-time guarantee, and it costs nothing unless someone tries to skip the homework.

package/upgrades/side-effects/config-driven-pinned-models.md

@@ -0,0 +1,63 @@
+# Side-Effects Review — Config-driven pinned-model callsites (routing-registry risk items #3/#5/#6/#7)
+
+**Version / slug:** `config-driven-pinned-models`
+**Date:** `2026-07-02`
+**Author:** `Instar Agent (echo)`
+**Second-pass reviewer:** `not required` (no gate/sentinel/lifecycle surface — pure config plumbing with behavior-preserving defaults)
+
+## Summary of the change
+
+Migrates the hardcoded-model callsites catalogued as "Risk items" #3, #5, #6, #7 in the LLM Routing Registry audit (2026-07-01, operator-directed) to overridable configuration with **behavior-preserving inline defaults** — with no config/env set, every callsite behaves byte-for-byte as before. Files touched: `src/core/types.ts` (new `intelligence.pinnedModels` block, inline-defaulted per the documented codexExecJson/swapAttemptTimeoutMs precedent), `src/core/DispatchExecutor.ts` (optional `agenticModel` ctor option, default 'haiku'), `src/commands/server.ts` (threads `pinnedModels.dispatchAgentic` + `pinnedModels.anthropicCredentialProbe` into the two construction sites), `src/commands/setup-wizard/model-constants.ts` (env-overridable resolvers `INSTAR_WIZARD_CODEX_MODEL` / `INSTAR_WIZARD_GEMINI_MODEL` — env not config because the wizard runs before `.instar/config.json` exists), `src/commands/setup.ts` (duplicate const replaced with import/re-export from model-constants — single source of truth), `src/providers/adapters/anthropic-headless/config.ts` + `control/authCredentialInjection.ts` (new `credentialProbeModel` field; default now sourced from `ANTHROPIC_MODELS.haiku` in `src/core/models.ts` instead of a free-floating string literal), and `tests/unit/pinned-model-callsites.test.ts` (15 new tests).
+
+**Honest scope note:** risk item #4 (mentor loop → opus) required NO code change — it was already config-driven via `mentor.autonomousFix.model` (default 'opus'); the registry row was imprecise. A canary test now pins that fact.
+
+## Decision-point inventory
+
+No decision point is added, modified, or removed. Model *selection inputs* to five existing callsites become configurable; the callsites' logic, gating, and control flow are untouched. All five are pass-through surfaces:
+
+- `DispatchExecutor.runAgentic` — pass-through — spawned-session model tier now `options.agenticModel ?? 'haiku'`.
+- `setup-wizard codex narrative spawn` — pass-through — model const now env-resolvable, default unchanged.
+- `setup-wizard gemini narrative spawn` — pass-through — same.
+- `anthropic-headless credential probe` — pass-through — ping model now `config.credentialProbeModel ?? ANTHROPIC_MODELS.haiku`.
+- `server.ts boot wiring` — pass-through — threads the two config keys when present; spreads nothing when absent.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. (No input is ever rejected by this change; a nonsense model value in config flows to the underlying spawn/API call, which fails with that layer's existing error surface — same as a nonsense value in any other model config key like `subscriptionPath.model`.)
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable. One adjacent honest note: this change does NOT validate configured model ids against a known-models list. That is deliberate and consistent with every existing model config key (`sessions.frameworkDefaultModels`, `subscriptionPath.model`, `mentor.autonomousFix.model` — none validate); inventing validation only here would be a new inconsistent behavior surface.
+
+## 3. Level-of-abstraction fit
+
+Right layer. The change follows the established three-layer pattern already used by every other model-selection surface: config type (`types.ts`) → boot threading (`server.ts`) → inline default at the consumption site. The wizard deviation (env var instead of config key) is a deliberate fit-to-layer choice: the wizard runs pre-config by definition, so a config key would be unreadable at its runtime — an env var is the only honest override surface there, and the config docblock documents the split. The credential-probe default moving to `ANTHROPIC_MODELS.haiku` removes a string literal that could silently drift from the tier map (registry risk item #8's concern).
+
+## 4. Signal vs authority compliance
+
+Compliant — trivially. No signal is produced, no authority is held, no brittle check is added anywhere. (Reference: docs/signal-vs-authority.md.)
+
+## 5. Interactions
+
+- **Tier maps / escalation:** `dispatchAgentic` feeds `SessionManager.spawnSession({model})` exactly as the literal did; tier escalation and topic-profile resolution operate on spawned *conversation* sessions, not this job-slugged dispatch session — no new interaction.
+- **componentFrameworks routing:** untouched — these callsites were router-bypasses before and remain framework-pinned; only the *model value* became configurable. (Making them router-routed was considered and rejected for this change: dispatch/wizard/probe are structurally tied to their frameworks. The v2 bench routing pass may revisit.)
+- **Canary tests:** `setup-codex-model-canary.test.ts` still passes unmodified — the const-shape contract (`-m WIZARD_CODEX_MODEL` on every codex spawn; pinned to a subscription-supported model) is preserved by computing the const through the resolver at module load.
+- **No double-fire / shadow / race surface:** nothing fires.
+
+## 6. External surfaces
+
+None. No user-visible output changes, no API shape changes, no cross-agent surface. The probe ping still sends 4 max_tokens to the same endpoint with the same default model id.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local BY DESIGN.** `intelligence.pinnedModels` lives in `.instar/config.json`, which deliberately does not sync across machines (same posture as every other `intelligence.*` key — each machine's operator tunes its own routing). The wizard env vars are process-local by nature. No durable state, no user-facing notices, no generated URLs.
+
+## 8. Rollback cost
+
+Trivial. Remove the config key / env var → shipped defaults apply immediately (next boot for config, next wizard run for env). Reverting the commit restores literals with zero data migration — no persisted state depends on the new keys (inline-defaulted precisely so absence is the default state; nothing was added to ConfigDefaults/migrateConfig, so no migration parity work is owed).
+
+## Test evidence
+
+`tests/unit/pinned-model-callsites.test.ts` — 15 tests: both sides of every boundary (absent ⇒ shipped default, present ⇒ override wins, whitespace ⇒ absent) for all three migrated surfaces, wiring canaries asserting server.ts actually threads both config keys, and the mentor already-config-driven canary. Plus `setup-codex-model-canary.test.ts` (5 tests) unmodified and green. `npx tsc --noEmit` clean.

package/upgrades/side-effects/llm-bench-coverage-ratchet.md

@@ -0,0 +1,41 @@
+# Side-Effects Review — LLM benchmark-coverage ratchet (INSTAR-Bench v2 §6, ratchet #2)
+
+**Version / slug:** `llm-bench-coverage-ratchet`
+**Date:** `2026-07-02`
+**Author:** `Instar Agent (echo)`
+**Second-pass reviewer:** `not required` (build-time test + data map only; zero runtime surface)
+
+## Summary of the change
+
+Adds `src/data/llmBenchCoverage.ts` — a coverage ledger mapping every LLM component (every key of `COMPONENT_CATEGORY`) to its INSTAR-Bench v2 status: `{task}` covered (10 Wave-1 critical components), `{pending}` queued (42, pinned), or `{exempt}` argued (1) — and `tests/unit/llm-bench-coverage-ratchet.test.ts`, which fails CI when a new LLM component ships without a coverage decision, when the pending/exempt sets grow (shrink-only pins), when an exemption's argument is lazy (<40 chars), or when a Wave-1 critical component slides back to uncovered. Operator directive 2026-07-02 (topic 29723) + INSTAR-BENCH-V2-SPEC §6. No runtime code is touched.
+
+## Decision-point inventory
+
+None at runtime. The only "decision" is a CI pass/fail on repository content — a build-time ratchet identical in class to the existing `llm-attribution-ratchet`.
+
+## 1. Over-block
+The ratchet can block a COMMIT (not a message/action): a developer adding an LLM component who genuinely cannot author bench cases yet must add the component to the pending baseline inside the test — a deliberate, visible act. That is the intended cost, not an over-block; there is no path it rejects that it shouldn't (an argued exemption is always available).
+
+## 2. Under-block
+Honest limits: (a) the ratchet keys off `COMPONENT_CATEGORY` — an LLM callsite that dodges the category map would also dodge this map, but the companion evaluate-coverage wiring test + attribution lint close that hole upstream; (b) it cannot verify the bench task file CONTENT (those live in the bench harness on the benching agent) — the task id is a contract, and a wrong/empty id would surface at the next bench run, not in CI. Accepted for v1 of the ratchet; noted in the map docblock.
+
+## 3. Level-of-abstraction fit
+Right layer: repository data + unit test, the established ratchet pattern (`llm-attribution-ratchet`, `WIRING_EXCLUSIONS` pins). Extends the existing chain (callsite → category map → THIS → bench coverage) rather than inventing a parallel mechanism.
+
+## 4. Signal vs authority compliance
+Compliant. No runtime authority; a CI test is deterministic, cheap, and its "block" is a build failure with instructions. (docs/signal-vs-authority.md concerns runtime decision points; none added.)
+
+## 5. Interactions
+Complements `llm-attribution-ratchet` (attribution presence), `componentCategories` wiring test (map exhaustiveness), and the LLM Routing Registry doc. No double-fire: each guards a different link of the chain. No runtime interaction possible.
+
+## 6. External surfaces
+None. Not user-visible; no API, no message, no config.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+Not applicable — repository content evaluated in CI; identical on every machine by construction (git).
+
+## 8. Rollback cost
+Delete the test + map (one revert). No state, no migration, no fleet impact — the ratchet only ever constrained future commits.
+
+## Test evidence
+`llm-bench-coverage-ratchet.test.ts`: 6 tests — completeness over COMPONENT_CATEGORY, no dangling entries, pending pinned shrink-only, exemptions pinned + argued, non-empty task ids, Wave-1 regression pin. All green; `tsc --noEmit` clean.