instar 1.3.712 → 1.3.714

package/.claude/skills/autonomous/SKILL.md

@@ -104,6 +104,11 @@ Write this content:
      when set, the stop-hook RUNS it on a met:true verdict and only allows the exit if it ALSO
      passes (fail/timeout → keep working). This sentinel is the PostUpdateMigrator marker that
      re-deploys this SKILL.md to existing agents. Spec: autonomous-completion-real-checks.md -->
+<!-- SCOPE_ACCRETION — scope-accretion completion discipline: register the run server-side
+     (POST /autonomous/register) and record the returned run_id in the frontmatter; the server
+     then holds completion while deliverables THIS run creates sit unbuilt, uncorroborated, and
+     unratified. This sentinel is the PostUpdateMigrator marker that re-deploys this SKILL.md to
+     existing agents. Spec: autonomous-scope-accretion-completion.md -->
 
 ```markdown
 ---
@@ -124,6 +129,7 @@ completion_mode: condition         # "condition" (default) | "promise-fallback"
 promise_fallback_reason: ""         # one line, REQUIRED iff completion_mode == promise-fallback
 completion_promise: "ALL_TASKS_COMPLETE"   # retained as the fallback token
 hard_blocker_nonce: "{a random per-run token — get via: openssl rand -hex 8}"
+run_id: "{the runId returned by POST /autonomous/register — see step 2b-2 below}"
 # OPTIONAL real-check (ACT-152): a command that must exit 0 before the run may stop. When set, a
 # met:true verdict RUNS it and gates the exit on it (fail/timeout → keep working). Omit if the
 # goal isn't checkable by a single command. work_dir is captured by setup so a relative command
@@ -171,6 +177,27 @@ echo $CLAUDE_CODE_SESSION_ID
 ```
 Then include the output in the `session_id:` field. This ensures session isolation works.
 
+**2b-2. Register the run server-side (SCOPE_ACCRETION — MANDATORY when a report topic exists).**
+The server takes the start snapshot (config, condition, declared deliverables, git base-root
+SHAs), mints the `runId`, and from then on the completion judge structurally HOLDS "done" while
+deliverables this run itself creates (specs, audits, runbooks, scripts) sit unbuilt without
+corroboration (a merged PR / a converged report) or explicit operator ratification:
+
+```bash
+PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))")
+AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))")
+jq -nc --arg t "TOPIC_ID" --arg c "YOUR completion_condition text" --arg w "$(pwd)" \
+  --arg s "STARTED_AT_ISO" --arg e "END_AT_ISO" --arg sid "$CLAUDE_CODE_SESSION_ID" \
+  '{topicId:$t,condition:$c,workDir:$w,startedAt:$s,endAt:$e,sessionId:$sid,declaredDeliverables:[]}' \
+  | curl -s -H "Authorization: Bearer $AUTH" -H 'Content-Type: application/json' \
+    --data-binary @- "http://localhost:${PORT}/autonomous/register"
+```
+
+Write the returned `runId` into the state file's `run_id:` frontmatter field. If the mission is
+GENUINELY draft-only (the operator asked for drafts, not builds), list those exact repo-relative
+paths in `declaredDeliverables` — that list is operator-visible at setup and immutable mid-run.
+If the server is unreachable, leave `run_id` empty and continue — the gate degrades honestly.
+
 **WHY NOT bash script?** Running `bash setup-autonomous.sh` creates a subprocess that does NOT inherit `CLAUDE_CODE_SESSION_ID`. The state file ends up with an empty session_id, which causes the hook to leak into all sessions. Always write the state file from within Claude Code's context.
 
 **SESSION ISOLATION**: The stop hook checks `session_id` — it only blocks the session that activated autonomous mode. Other sessions on the same machine pass through unaffected.
@@ -207,6 +234,28 @@ The stop hook will catch every attempt to exit and feed your task list back. Eac
 5. Move to next task
 6. Send progress reports at the configured interval
 
+### Scope Accretion — work YOU create joins YOUR completion bar (Layer A duty)
+
+The completion bar is NOT frozen at session start. When you discover new in-scope work and
+draft it (a spec, an audit, a runbook, a script), that artifact joins your bar: the server's
+git-truth sweep sees it regardless of HOW it was written (Write tool, Bash heredoc, `tee`, a
+subagent), and the judge will HOLD "done" until it is built+corroborated (merged PR / converged
+report), was declared at setup, or the operator ratifies deferring it. "The documented stretch
+(out of completion condition)" is the exact anti-pattern this closes — Deferral = Deletion.
+
+**Your recording duty (Layer A):** the moment you create a deliverable, append to the state
+file's task list:
+
+```
+- [ ] ACCRETED(<ISO date>): <repo-relative path> — build/converge/deliver, or obtain operator ratification
+```
+
+This is a willpower-assist for the honest case and carries zero safety weight — the server-side
+sweep is the enforcement. If deferral is genuinely right, ASK the operator in the topic (say
+"ratify deferral of <paths>?"); a server-authored enumeration message will list the exact set,
+and only the verified operator's reply binds it. The operator can also ratify from the dashboard
+(PIN-gated).
+
 ### The Defer-to-Future-Self Trap
 
 **This is the #1 failure mode.** It looks like:

package/.claude/skills/autonomous/hooks/autonomous-stop-hook.sh

@@ -44,6 +44,13 @@ for _arg in "$@"; do [[ "$_arg" == "--codex" ]] && IS_CODEX=1; done
 # verification_command on a met:true verdict and gates the exit on it; fail/timeout/breaker-open →
 # keep working, the safe direction). This sentinel is the PostUpdateMigrator marker that re-deploys
 # this hook to existing agents that carry COMPLETION_DISCIPLINE but not REALCHECK_VERIFY.
+# hook-capability: SCOPE_ACCRETION — scope-accretion completion discipline (spec:
+# autonomous-scope-accretion-completion.md). Layer B evasion-vocabulary scan (advisory
+# scopeAccretionSuspected signal, fenced/quoted-region excluded), topicId/runId/sessionId echoed
+# to the evaluate-completion chokepoint (the server computes the LOAD-BEARING git-truth sweep +
+# ratification state there), and run_end_call fired on EVERY terminal exit surface (R40/R44) so
+# no exit is silent. This sentinel is the PostUpdateMigrator marker that re-deploys this hook to
+# existing agents that carry REALCHECK_VERIFY but not SCOPE_ACCRETION.
 # emit — human-facing approve/status text. In codex mode the Stop hook's STDOUT must be
 # ONLY valid decision-JSON (the `{"decision":"block",...}` case far below) or empty:
 # codex rejects ANY other stdout as "invalid stop hook JSON output" and reports the stop
@@ -239,6 +246,11 @@ WORK_DIR=$(fm_get_raw work_dir)
 # marker (mirrors the completion_promise exact-match guard). Absent on older
 # state files → the marker branch self-disables for that run (no false exit).
 HARD_BLOCKER_NONCE=$(fm_get hard_blocker_nonce)
+# SCOPE_ACCRETION — the server-minted run id written by setup at registration
+# (POST /autonomous/register). Echoed on evaluate-completion + run-end calls so
+# the server can verify the (topicId, runId) pair against its OWN registration
+# record. Absent on older/unregistered runs → the server degrades honestly.
+RUN_ID=$(fm_get run_id)
 
 # ── COMPLETION_DISCIPLINE — off-switch + judge curl budget (read at the chokepoint) ──
 # Autonomous Completion Discipline (spec: AUTONOMOUS-COMPLETION-DISCIPLINE.md).
@@ -281,7 +293,13 @@ try:
     rcbt = rc.get('failBreakerThreshold', 3)
     rcbw = rc.get('failWindowMs', 600000)
     rcbc = rc.get('failCooldownMs', 600000)
-    print('%s %d %d %d %d %d %d %s %d %d %d %d %d %d' % (
+    # SCOPE_ACCRETION — Layer B advisory scan gate. NOTE: the LOAD-BEARING gate
+    # is snapshotted SERVER-SIDE at registration (this local read only gates the
+    # hook's ADVISORY scopeAccretionSuspected field, keeping the judge prompt
+    # byte-identical when the feature is off).
+    sa = a.get('scopeAccretion') or {}
+    sae = sa.get('enabled', True)
+    print('%s %d %d %d %d %d %d %s %d %d %d %d %d %d %s' % (
         '1' if en else '0', jt,
         int(bt) if str(bt).isdigit() else 3,
         int(bw) if str(bw).isdigit() else 600000,
@@ -294,12 +312,14 @@ try:
         int(rcbt) if str(rcbt).isdigit() else 3,
         int(rcbw) if str(rcbw).isdigit() else 600000,
         int(rcbc) if str(rcbc).isdigit() else 600000,
+        '1' if sae else '0',
     ))
 except Exception:
-    print('1 35000 3 600000 600000 500 1048576 1 120000 2000 65536 3 600000 600000')
-" 2>/dev/null || echo "1 35000 3 600000 600000 500 1048576 1 120000 2000 65536 3 600000 600000")
-read -r CD_ENABLED JUDGE_TIMEOUT_MS CD_BREAKER_THRESHOLD CD_BREAKER_WINDOW_MS CD_BREAKER_COOLDOWN_MS CD_MARKER_MAX_CHARS CD_LOG_ROTATE_BYTES RC_ENABLED RC_TIMEOUT_MS RC_MAX_CHARS RC_CAPTURE_BYTES RC_BREAKER_THRESHOLD RC_BREAKER_WINDOW_MS RC_BREAKER_COOLDOWN_MS <<< "$CD_CFG"
+    print('1 35000 3 600000 600000 500 1048576 1 120000 2000 65536 3 600000 600000 1')
+" 2>/dev/null || echo "1 35000 3 600000 600000 500 1048576 1 120000 2000 65536 3 600000 600000 1")
+read -r CD_ENABLED JUDGE_TIMEOUT_MS CD_BREAKER_THRESHOLD CD_BREAKER_WINDOW_MS CD_BREAKER_COOLDOWN_MS CD_MARKER_MAX_CHARS CD_LOG_ROTATE_BYTES RC_ENABLED RC_TIMEOUT_MS RC_MAX_CHARS RC_CAPTURE_BYTES RC_BREAKER_THRESHOLD RC_BREAKER_WINDOW_MS RC_BREAKER_COOLDOWN_MS SA_ENABLED <<< "$CD_CFG"
 [[ "$CD_ENABLED" =~ ^[01]$ ]] || CD_ENABLED=1
+[[ "${SA_ENABLED:-}" =~ ^[01]$ ]] || SA_ENABLED=1
 [[ "$JUDGE_TIMEOUT_MS" =~ ^[0-9]+$ ]] || JUDGE_TIMEOUT_MS=35000
 # curl -m takes SECONDS; convert ms→s (ceil), floor 5s.
 JUDGE_TIMEOUT_S=$(( (JUDGE_TIMEOUT_MS + 999) / 1000 ))
@@ -343,6 +363,29 @@ notify_terminal_stop() {
   printf '%s\n' "$msg" | "$script" "$REPORT_TOPIC" >/dev/null 2>&1 || true
 }
 
+# SCOPE_ACCRETION — run-end reporting (R44): EVERY terminal exit surface calls
+# POST /autonomous/:topic/run-end so the server runs the non-blocking advisory
+# sweep and, when unbuilt accreted work remains, enumerates it LOUDLY (R40 —
+# the silent clock-out is structurally closed; the emergency-stop lever buys a
+# faster exit, never a quieter one). Best-effort + `-m`-bounded: a delivery
+# failure NEVER blocks or delays the exit (the R28b daily sweep is the backstop).
+run_end_call() {
+  local reason="$1"
+  [[ -z "$REPORT_TOPIC" ]] && return 0
+  # Test seam: record the would-be call instead of hitting the server.
+  if [[ -n "${INSTAR_HOOK_RUNEND_RECORD:-}" ]]; then
+    printf '{"topic":"%s","reason":"%s","runId":"%s"}\n' "$REPORT_TOPIC" "$reason" "${RUN_ID:-}" \
+      >> "$INSTAR_HOOK_RUNEND_RECORD" 2>/dev/null || true
+    return 0
+  fi
+  local re_port re_auth
+  re_port=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
+  re_auth=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  jq -nc --arg r "$reason" --arg id "${RUN_ID:-}" '{reason:$r} + (if $id != "" then {runId:$id} else {} end)' 2>/dev/null \
+    | curl -s -m 8 -H "Authorization: Bearer $re_auth" -H 'Content-Type: application/json' \
+      --data-binary @- "http://localhost:${re_port}/autonomous/${REPORT_TOPIC}/run-end" >/dev/null 2>&1 || true
+}
+
 # Validate recorded session_id is a real UUID. Claude sometimes writes a custom
 # string instead of $CLAUDE_CODE_SESSION_ID; non-UUID values are treated as
 # empty so the session-match backstop self-bootstraps from the real UUID.
@@ -441,6 +484,7 @@ if [[ "$GOAL_MODE" == "native" ]]; then
   }
   if [[ -f ".instar/autonomous-emergency-stop" ]]; then
     notify_terminal_stop "🛑 My autonomous run on \"$(goal_snippet)\" was stopped (emergency stop)."
+    run_end_call "emergency-stop (native-goal)"
     native_goal_clear; rm -f "$STATE_FILE"
     echo "[autonomous] emergency stop — native /goal cleared" >&2; exit 0
   fi
@@ -448,6 +492,7 @@ if [[ "$GOAL_MODE" == "native" ]]; then
     NG_START=$(date -u -j -f "%Y-%m-%dT%H:%M:%SZ" "$STARTED_AT" +%s 2>/dev/null || date -d "$STARTED_AT" +%s 2>/dev/null || echo 0)
     if [[ "$NG_START" =~ ^[0-9]+$ ]] && [[ $NG_START -gt 0 ]] && [[ $(( $(date +%s) - NG_START )) -ge $DURATION_SECONDS ]]; then
       notify_terminal_stop "⏰ My autonomous run on \"$(goal_snippet)\" hit its time limit and stopped. Ask me and I'll pick up where I left off."
+      run_end_call "duration-expiry (native-goal)"
       native_goal_clear; rm -f "$STATE_FILE"
       echo "[autonomous] duration expired — native /goal cleared" >&2; exit 0
     fi
@@ -461,6 +506,7 @@ fi
 # Validate iteration
 if [[ ! "$ITERATION" =~ ^[0-9]+$ ]]; then
   echo "⚠️  Autonomous mode: State file corrupted (bad iteration)" >&2
+  run_end_call "state-corrupt (bad iteration)"
   rm -f "$STATE_FILE"
   exit 0
 fi
@@ -478,6 +524,7 @@ if [[ "$DURATION_SECONDS" =~ ^[0-9]+$ ]] && [[ $DURATION_SECONDS -gt 0 ]]; then
       emit "⏰ Autonomous mode: Duration expired ($ELAPSED seconds elapsed)."
       emit "   Session is free to exit."
       notify_terminal_stop "⏰ My autonomous run on \"$(goal_snippet)\" just hit its time limit and stopped. Ask me and I'll pick up where I left off."
+      run_end_call "duration-expiry"
       rm -f "$STATE_FILE"
       exit 0
     fi
@@ -492,6 +539,10 @@ fi
 if [[ -f ".instar/autonomous-emergency-stop" ]]; then
   emit "🛑 Autonomous mode: Emergency stop detected."
   notify_terminal_stop "🛑 My autonomous run on \"$(goal_snippet)\" was stopped (emergency stop)."
+  # SCOPE_ACCRETION: the emergency-stop file is a run-end surface a session could
+  # `touch` itself — so it fires run-end IDENTICALLY (R44): the one-step bypass
+  # is thereby exactly as LOUD as the two-step (spec §6).
+  run_end_call "emergency-stop"
   rm -f "$STATE_FILE"
   # NOTE: the emergency flag is left in place so OTHER topics' hooks also see it
   # and clear their own per-topic files; stop-all clears the flag when complete.
@@ -576,15 +627,38 @@ if [[ "$CD_ENABLED" == "1" ]] && [[ -n "$CD_JUDGE_TAIL" ]]; then
   done
 fi
 
+# SCOPE_ACCRETION — Layer B evasion-vocabulary scan (advisory, spec §2.7).
+# Scans the SAME already-extracted CD_JUDGE_TAIL window (no second transcript
+# read) for accretion-evasion vocabulary, with a fenced/quoted-region exclusion
+# that is NEW bash logic (the milestone/injection scans above are plain
+# substring matches): text inside ``` fences and `>`-quoted lines is stripped
+# BEFORE matching, so quoting this rule or a doc that names the anti-pattern
+# can never trip the signal. Advisory by construction — false negatives are
+# harmless (the server-side git-truth sweep is the defense, Layer 0).
+CD_SCOPE_SUSPECTED="false"
+if [[ "$CD_ENABLED" == "1" ]] && [[ "$SA_ENABLED" == "1" ]] && [[ -n "$CD_JUDGE_TAIL" ]]; then
+  CD_TAIL_SCOPE=$(printf '%s\n' "$CD_JUDGE_TAIL" \
+    | awk 'BEGIN{f=0} /^[[:space:]]*```/{f=1-f; next} f==0 && $0 !~ /^[[:space:]]*>/{print}' 2>/dev/null \
+    | tr '[:upper:]' '[:lower:]' || echo "")
+  for _sa in \
+    "documented stretch" "filed for a future session" "out of completion condition" \
+    "out of the completion condition" "drafts for later" "deferred as a follow-up spec"; do
+    if [[ "$CD_TAIL_SCOPE" == *"$_sa"* ]]; then CD_SCOPE_SUSPECTED="true"; break; fi
+  done
+fi
+
 # Assemble the signals JSON the judge payload carries (spec §2b.4 surface 1).
 # completionConditionMet is set false here and overwritten true only inside the
 # met-condition branch (the judge there is the completion judge, not this).
 build_signals_json() {
   local stop_kind="${1:-}" cond_met="${2:-false}"
-  local sk=""
+  local sk="" sa=""
   [[ "$stop_kind" == "hard-blocker" ]] && sk=',"stopKind":"hard-blocker"'
-  printf '{"completionConditionMet":%s,"uncheckedTaskCount":%s,"taskStructure":"%s","milestoneRationalizationDetected":%s,"injectionSuspected":%s%s}' \
-    "$cond_met" "$CD_UNCHECKED_COUNT" "$CD_TASK_STRUCTURE" "$CD_MILESTONE_DETECTED" "$CD_INJECTION_SUSPECTED" "$sk"
+  # SCOPE_ACCRETION — the advisory Layer-B boolean is included ONLY when the
+  # feature is on, so a disabled agent's judge prompt stays byte-identical.
+  [[ "$SA_ENABLED" == "1" ]] && sa=",\"scopeAccretionSuspected\":${CD_SCOPE_SUSPECTED:-false}"
+  printf '{"completionConditionMet":%s,"uncheckedTaskCount":%s,"taskStructure":"%s","milestoneRationalizationDetected":%s,"injectionSuspected":%s%s%s}' \
+    "$cond_met" "$CD_UNCHECKED_COUNT" "$CD_TASK_STRUCTURE" "$CD_MILESTONE_DETECTED" "$CD_INJECTION_SUSPECTED" "$sa" "$sk"
 }
 
 # ── COMPLETION_DISCIPLINE — circuit-breaker + verdict cache (in the backoff sidecar) ──
@@ -1203,6 +1277,8 @@ if [[ "$CD_ENABLED" == "1" ]] && [[ -n "$HARD_BLOCKER_NONCE" ]] && [[ "$HARD_BLO
         # (c) ONE plain-English notify-on-stop.
         notify_terminal_stop "🚧 My autonomous run on \"$(goal_snippet)\" stopped on a hard blocker I can't resolve myself. What I'd need: ${HB_NEEDED}. I've queued it for your attention."
         emit "🚧 Autonomous mode: hard blocker (external) — exit allowed. needed: ${HB_NEEDED}"
+        # SCOPE_ACCRETION (R40/R44): the hard-blocker exit is a run-end surface.
+        run_end_call "hard-blocker"
         # (d) Remove state; allow exit (write once — state removal prevents re-append).
         rm -f "$STATE_FILE" "$CD_BACKOFF_STATE" 2>/dev/null || true
         exit 0
@@ -1236,6 +1312,13 @@ fi
 EVAL_REASON=""
 if [[ "${CD_BLOCK_TERMINAL:-}" != "true" ]] && [[ -n "$COMPLETION_CONDITION" ]] && [[ -n "$TRANSCRIPT_PATH" ]] && [[ -f "$TRANSCRIPT_PATH" ]]; then
   EVAL_MET=""
+  # Test seam (SCOPE_ACCRETION): record the signals + identity fields the judge
+  # payload would carry, WITHOUT a network call (mirrors INSTAR_HOOK_ATTENTION_RECORD).
+  if [[ -n "${INSTAR_HOOK_SIGNALS_RECORD:-}" ]] && [[ "$CD_ENABLED" == "1" ]]; then
+    printf '{"signals":%s,"topicId":"%s","runId":"%s"}\n' \
+      "$(build_signals_json "" "false")" "${REPORT_TOPIC:-}" "${RUN_ID:-}" \
+      >> "$INSTAR_HOOK_SIGNALS_RECORD" 2>/dev/null || true
+  fi
   # Decide whether to fire the judge at all (CD cost-discipline gate).
   CD_MIGHT_BE_DONE="true"
   if [[ "$CD_ENABLED" == "1" ]] && [[ -z "${INSTAR_HOOK_EVAL_OVERRIDE:-}" ]]; then
@@ -1267,12 +1350,17 @@ if [[ "${CD_BLOCK_TERMINAL:-}" != "true" ]] && [[ -n "$COMPLETION_CONDITION" ]]
       | tail -c 8000 || echo "")
     EVAL_PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
     EVAL_AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+    # SCOPE_ACCRETION — echo topicId/runId/sessionId so the server resolves the
+    # run against its OWN registration record (R35 arming; R36 registered-
+    # condition authority; §6 runId pair check). Empty fields are omitted.
+    CD_IDS=$(jq -nc --arg topic "${REPORT_TOPIC:-}" --arg rid "${RUN_ID:-}" --arg sid "${HOOK_SESSION:-}" \
+      '(if $topic != "" then {topicId:$topic} else {} end) + (if $rid != "" then {runId:$rid} else {} end) + (if $sid != "" then {sessionId:$sid} else {} end)' 2>/dev/null || echo '{}')
     if [[ "$CD_ENABLED" == "1" ]]; then
       # Fold the milestone/buildable-work scrutiny into the completion judge (single call).
       CD_SIG=$(build_signals_json "" "false")
-      EVAL_BODY=$(jq -nc --arg c "$COMPLETION_CONDITION" --arg t "$EVAL_TAIL" --argjson sig "$CD_SIG" '{condition:$c,transcriptTail:$t,signals:$sig}')
+      EVAL_BODY=$(jq -nc --arg c "$COMPLETION_CONDITION" --arg t "$EVAL_TAIL" --argjson sig "$CD_SIG" --argjson ids "$CD_IDS" '{condition:$c,transcriptTail:$t,signals:$sig} + $ids')
     else
-      EVAL_BODY=$(jq -nc --arg c "$COMPLETION_CONDITION" --arg t "$EVAL_TAIL" '{condition:$c,transcriptTail:$t}')
+      EVAL_BODY=$(jq -nc --arg c "$COMPLETION_CONDITION" --arg t "$EVAL_TAIL" --argjson ids "$CD_IDS" '{condition:$c,transcriptTail:$t} + $ids')
     fi
     EVAL_RESP=$(printf '%s' "$EVAL_BODY" \
       | curl -s -m "$JUDGE_TIMEOUT_S" -H "Authorization: Bearer $EVAL_AUTH" -H 'Content-Type: application/json' \
@@ -1302,6 +1390,7 @@ if [[ "${CD_BLOCK_TERMINAL:-}" != "true" ]] && [[ -n "$COMPLETION_CONDITION" ]]
       if realcheck_gate; then
         emit "✅ Autonomous mode: completion condition met (independent evaluator): ${EVAL_REASON}"
         notify_terminal_stop "✅ My autonomous run on \"$(goal_snippet)\" finished — the goal was met."
+        run_end_call "met"
         rm -f "$STATE_FILE" "$CD_BACKOFF_STATE" 2>/dev/null || true
         exit 0
       fi
@@ -1311,6 +1400,7 @@ if [[ "${CD_BLOCK_TERMINAL:-}" != "true" ]] && [[ -n "$COMPLETION_CONDITION" ]]
       if realcheck_gate; then
         emit "✅ Autonomous mode: completion condition met (independent evaluator): ${EVAL_REASON}"
         notify_terminal_stop "✅ My autonomous run on \"$(goal_snippet)\" finished — the goal was met."
+        run_end_call "met"
         rm -f "$STATE_FILE"
         exit 0
       fi
@@ -1343,6 +1433,7 @@ if [[ "${CD_BLOCK_TERMINAL:-}" != "true" ]] && [[ -n "$TRANSCRIPT_PATH" ]] && [[
             emit "✅ Autonomous mode: Completion promise detected — <promise>$COMPLETION_PROMISE</promise>"
             emit "   Session is free to exit. Good work!"
             notify_terminal_stop "✅ My autonomous run on \"$(goal_snippet)\" finished — all the work is done."
+            run_end_call "met (promise)"
             rm -f "$STATE_FILE"
             exit 0
           fi
@@ -1507,11 +1598,13 @@ except Exception:
     if [[ ! -f "$STATE_FILE" ]]; then
       rm -f "$BACKOFF_STATE" 2>/dev/null || true
       echo "[autonomous] state file removed during idle backoff — allowing exit" >&2
+      run_end_call "stopped (state file removed during backoff)"
       exit 0
     fi
     if [[ -f ".instar/autonomous-emergency-stop" ]]; then
       emit "🛑 Autonomous mode: Emergency stop detected (during idle backoff)."
       notify_terminal_stop "🛑 My autonomous run on \"$(goal_snippet)\" was stopped (emergency stop)."
+      run_end_call "emergency-stop (during backoff)"
       rm -f "$STATE_FILE" "$BACKOFF_STATE" 2>/dev/null || true
       exit 0
     fi
@@ -1528,6 +1621,7 @@ NEXT_ITERATION=$((ITERATION + 1))
 PROMPT_TEXT=$(awk '/^---$/{i++; next} i>=2' "$STATE_FILE")
 if [[ -z "$PROMPT_TEXT" ]]; then
   echo "⚠️  Autonomous mode: State file has no task content" >&2
+  run_end_call "state-corrupt (no task content)"
   rm -f "$STATE_FILE"
   exit 0
 fi

package/.claude/skills/autonomous/scripts/setup-autonomous.sh

@@ -18,6 +18,9 @@ COMPLETION_CONDITION=""   # verifiable end-state; an independent judge decides "
 REPORT_INTERVAL="30m"
 VERIFICATION_COMMAND=""   # opt-in real check (ACT-152): the stop-hook RUNS this on a met:true verdict and gates the exit on exit-0.
 VERIFICATION_CWD=""       # directory the verification command runs in (resolves verification_cwd → work_dir → agent home).
+DECLARED_DELIVERABLES=""  # SCOPE_ACCRETION: comma-separated repo-relative paths the run is EXPECTED to
+                          # produce as drafts (the escape for genuinely draft-only missions — operator-
+                          # confirmed at setup). Recorded server-side at registration; immutable mid-run.
 
 while [[ $# -gt 0 ]]; do
   case $1 in
@@ -61,6 +64,10 @@ while [[ $# -gt 0 ]]; do
       VERIFICATION_CWD="$2"
       shift 2
       ;;
+    --declared-deliverables)
+      DECLARED_DELIVERABLES="$2"
+      shift 2
+      ;;
     --report-interval)
       REPORT_INTERVAL="$2"
       shift 2
@@ -186,6 +193,46 @@ if [[ -n "$VERIFICATION_CWD" ]]; then
 $VERIFICATION_FIELDS"
 fi
 
+# ── SCOPE_ACCRETION — server-side run registration (spec: autonomous-scope-
+# accretion-completion.md R30). The SERVER mints the runId, snapshots the
+# scopeAccretion config + the sweep base roots with their start-SHAs, and clamps
+# endAt — so mid-run edits to config/state-file change nothing the completion
+# chokepoint reads. The runId is written into the frontmatter so the stop hook
+# can echo it on every evaluate-completion / run-end call. Best-effort: an
+# unreachable server leaves run_id empty (the gate degrades honestly server-side;
+# the run still starts — registration is a discipline layer, not a start gate).
+RUN_ID=""
+if [[ -n "$REPORT_TOPIC" ]]; then
+  REG_PORT=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('port',4040))" 2>/dev/null || echo 4040)
+  REG_AUTH=$(python3 -c "import json;print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null || echo "")
+  # Comma-separated → JSON array (empty string → []).
+  REG_DECLARED=$(printf '%s' "$DECLARED_DELIVERABLES" | python3 -c "import sys,json
+print(json.dumps([p.strip() for p in sys.stdin.read().split(',') if p.strip()]))" 2>/dev/null || echo '[]')
+  REG_END_AT="$END_AT"
+  [[ "$REG_END_AT" == "unknown" || "$REG_END_AT" == "unlimited" ]] && REG_END_AT=""
+  REG_RESP=$(jq -nc \
+    --arg t "$REPORT_TOPIC" --arg c "$COMPLETION_CONDITION" --arg w "$WORK_DIR" \
+    --arg s "$STARTED_AT" --arg e "$REG_END_AT" --arg sid "${CLAUDE_CODE_SESSION_ID:-}" \
+    --argjson d "$REG_DECLARED" \
+    '{topicId:$t,condition:$c,workDir:$w,declaredDeliverables:$d,startedAt:$s}
+     + (if $e != "" then {endAt:$e} else {} end)
+     + (if $sid != "" then {sessionId:$sid} else {} end)' 2>/dev/null \
+    | curl -s -m 8 -H "Authorization: Bearer $REG_AUTH" -H 'Content-Type: application/json' \
+      --data-binary @- "http://localhost:${REG_PORT}/autonomous/register" 2>/dev/null || echo "")
+  RUN_ID=$(printf '%s' "$REG_RESP" | python3 -c "import sys,json
+try: print(json.load(sys.stdin).get('runId',''))
+except Exception: print('')" 2>/dev/null || echo "")
+  if [[ -n "$RUN_ID" ]]; then
+    echo "  Scope-accretion: run registered server-side (runId $RUN_ID)"
+  else
+    echo "  Scope-accretion: server registration unavailable — accretion gate degrades honestly (run still bounded by duration)"
+  fi
+fi
+if [[ -n "$RUN_ID" ]]; then
+  VERIFICATION_FIELDS="run_id: \"$RUN_ID\"
+$VERIFICATION_FIELDS"
+fi
+
 cat > "$STATE_PATH" <<EOF
 ---
 active: true

package/dist/commands/init.js

@@ -4170,6 +4170,15 @@ process.stdin.on('end', async () => {
       event: input.hook_event || (input.tool_name ? 'PostToolUse' : 'Unknown'),
       session_id: input.session_id || '',
       tool_name: input.tool_name || '',
+      // green-pr-automerge Layer 2: forward the session cwd so the server can
+      // resolve the ending session's branch (without it, Layer 2 ships inert).
+      // (Reconciled with the PostUpdateMigrator copy — keep BOTH in sync.)
+      cwd: input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd() || '',
+      // scope-accretion ADVISORY ledger (spec autonomous-scope-accretion-
+      // completion.md R18): forward the Write/Edit file path for attribution
+      // detail. Optional + designed-benign: the receiver stores extra fields
+      // as-is and a payload without it remains valid.
+      file_path: (input.tool_input && (input.tool_input.file_path || input.tool_input.path)) || '',
     });
 
     const url = new URL(serverUrl + '/hooks/events?instar_sid=' + instarSid);