instar 1.3.735 → 1.3.736

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.735",
+  "version": "1.3.736",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/skills/spec-converge/SKILL.md

@@ -91,7 +91,8 @@ The skill spawns reviewers in parallel:
 - **Security.** Attack surfaces, leaks, privilege escalation, auth on endpoints, prompt injection vectors, rotation races.
 - **Scalability/performance.** Hot-path cost, concurrent writes, memory churn, fail-open semantics, hook latency.
 - **Adversarial.** Misbehaving-session scenarios — bad-entry poisoning, self-reinforcing loops, stale claims, authority ambiguity, kind gaming.
-- **Integration/deployment.** Migration, backup/restore, multi-machine, config knobs, dashboard surface, rollback. **Multi-machine posture (Cross-Machine Coherence — mandatory check):** every feature/state surface the spec introduces must declare its posture when the agent runs on more than one machine — replicated (named replication path) / proxied-on-read (named merged read) / machine-local BY DESIGN (with the reason). A spec whose features silently assume a single machine is a MATERIAL finding: ~20 features shipped machine-blind before this check existed (2026-06-12 audit, topic 13481; MULTI-MACHINE-SEAMLESSNESS-SPEC is the cleanup bill). Probe specifically: user-facing notices (one-voice gating?), durable state (strands on topic transfer?), generated URLs (survive machine boundaries?).
+- **Integration/deployment.** Migration, backup/restore, multi-machine, config knobs, dashboard surface, rollback. **Multi-machine posture (Cross-Machine Coherence — mandatory check):** every feature/state surface the spec introduces must declare its posture when the agent runs on more than one machine — replicated (named replication path) / proxied-on-read (named merged read) / machine-local BY DESIGN (with the reason). A spec whose features silently assume a single machine is a MATERIAL finding: ~20 features shipped machine-blind before this check existed (2026-06-12 audit, topic 13481; MULTI-MACHINE-SEAMLESSNESS-SPEC is the cleanup bill). Probe specifically: user-facing notices (one-voice gating?), durable state (strands on topic transfer?), generated URLs (survive machine boundaries?). **Standard A — reject an UNDEFENDED machine-local (default is `unified`):** a *declared* posture is no longer enough — the DEFAULT posture is `unified`, and an undefended `machine-local` is itself a **MATERIAL FINDING** (this is the upgrade from "accepts a declaration" to "requires the correct default"; the tiered-intelligence consult-memory shipped machine-local-by-design and survived seven rounds because the check only tested for an *answer*). A machine-local surface is allowed ONLY with a `machine-local-justification: <key>` marker — one labeled `key: value` line per machine-local surface inside the spec's `## Multi-machine posture` section — whose `<key>` is drawn from a **CLOSED taxonomy**: `physical-credential-locality` (a login / key / token / service-binding that physically lives on one disk — e.g. a Claude OAuth login, a browser profile's cookies, a Telegram bot token + the forum/topic ids it namespaces), `hardware-bound-resource` (bound to specific physical hardware), or `operator-ratified-exception` (the operator explicitly ratified it — this key MUST cite a machine-verifiable, existence-checkable artifact ref: a commit SHA, a registry key, or a resolvable URL, NEVER a bare topic+date). Other locality reasons (availability, privacy/data-residency, cost/latency, an intentional per-machine cache) are DENIED by default — each is either not a real locality *requirement* or must be routed through `operator-ratified-exception`; a fourth key is a constitution-bound operator decision, never an author's convenience. The check is **BIDIRECTIONAL**: an *infeasible* `unified` (a surface that is inherently credential/hardware-bound but declared — or left to default — `unified`) is EQUALLY a MATERIAL FINDING, because "just claim unified" would otherwise be the trivial dodge (and invites an unsafe attempt to replicate a credential). The reviewer INDEPENDENTLY CONTESTS correctness in BOTH directions: a marker whose key is *present* but substantively *wrong* is still a finding — the marker's PRESENCE never satisfies the CORRECTNESS check (this spec's own first draft mislabeled its per-machine hub `hardware-bound-resource`; the correct key was `physical-credential-locality`, and this rule is what catches it). `operator-ratified-exception` is the escape hatch — treat each use as worth surfacing for operator visibility so the hatch can't quietly become the path of least resistance. (Signal vs. Authority: the `machine-local-justification` marker is the cheap deterministic signal; THIS reviewer holds the semantic authority. The purely-deterministic marker LINT lands with the registry ship, hard-sequenced — until then this reviewer + the per-spec `POST /spec/conformance-check` gate surface a missing/wrong marker; do NOT claim a no-LLM deterministic parse exists yet.)
+- **Self-Heal Before Notify (Standard B — escalation-gate review-check).** A spec that adds a **monitor / watcher / recurring-or-automated notice source** which raises operator notices MUST place its operator-facing attention-raise DOWNSTREAM of a `selfHealAttempted && selfHealExhausted` signal — the escalation path is UNREACHABLE on first detection. A first-detection escalation on a `recoverable` degradation is a **MATERIAL FINDING**. (Scope: a one-shot conversational reply is NOT a watcher and pays no self-heal cost.) The watcher MUST DECLARE, and the reviewer INDEPENDENTLY CONTESTS: (a) its self-heal step + `remediation-actions` — the concrete operations it invokes (re-register / restart / re-deliver); a no-op that merely flips `selfHealAttempted = true` to unlock escalation is a MATERIAL FINDING, and each side-effecting action MUST carry an idempotency guard + a compensation/rollback (a heal retried over a half-completed action is how these loops corrupt state); (b) that step's P19 brakes (per *No Unbounded Loops*) — `max-attempts`, `max-wall-clock`, `backoff`, `dedupe-key`, `breaker` (INCLUDING flapping: N heals of the same break within a window auto-reclassify to critical and escalate — a structural backstop a `recoverable` label can NEVER waive, per *Distrust Temporary Success*), `max-notification-latency` (an explicit duration WITH units, e.g. `120s`, and ≤ the constitutional ceiling at the registry key `standards.selfHealBeforeNotify.recoverableLatencyCeiling` — a recoverable watcher MUST tell the operator even while self-heal is still running once this ceiling passes; a missing/unitless value is a MATERIAL FINDING and a missing ceiling fails CLOSED = escalate-sooner), `audit-location` (a scrubbed, metadata-only trail — never raw secrets); (c) the severity `class` of each degradation — an **irreversible / data-loss / security** class escalates IMMEDIATELY (on the SAME detection tick, no heal-gate delay interposed) and self-heals CONCURRENTLY (notify-and-heal), while everything else is `recoverable`; a critical degradation MISLABELED `recoverable` to unlock the heal-first path is a MATERIAL FINDING (presence of a class field never satisfies the CORRECTNESS check — symmetric to Standard A's marker-correctness rule). Composes with *No Silent Degradation*: routing to self-heal is NEVER swallowing — every detection + heal attempt is audited, the audit trail IS the report, and the operator is the last resort, not the silent-drop alternative. The FIRST runtime application MUST extract the pattern into a reusable `SelfHealGate` — a THIN declaration + assertion layer over Instar's EXISTING in-process P19 breaker primitives (CrashLoopPauser and the breakers already threaded through the monitors), NEVER a new external workflow engine — plus a shared conformance fixture that exercises the stateful paths (unreachable-before-exhaustion, observable remediation evidence, flapping auto-escalation, and the latency backstop firing mid-heal). That runtime application is a downstream build task registered under Close the Loop, deliberately outside this review-check's own boundary — this bullet ships the review lens + the pattern, the code application follows.
 - **Decision-Completeness.** (Autonomy Principle 2 — `docs/specs/AUTONOMY-PRINCIPLES-ENFORCEMENT-SPEC.md` Piece 2.) Enumerates every point where the building agent would have to **stop mid-run and ask the user**. Each must be either **frontloaded** into a `## Frontloaded Decisions` section or explicitly tagged **cheap-to-change-after** because the work ships behind a named dark/dry-run/read-only phase. The reviewer **CONTESTS every cheap tag** — it independently asserts reversibility, and a closed non-cheap taxonomy overrides any tag: anything touching **durable external side-effects, money, identity, or a published/user-visible interface is NEVER cheap**, regardless of a "ships dark" label. A contested tag the reviewer rejects is a **material finding that blocks convergence**. Prompt: `templates/reviewer-decision-completeness.md`. Applies to ALL specs through this skill (D7) — no size gate, no per-spec override (D11; the rejected `disposition: override` escape hatch would reopen the exact skip-hatch Principle 2 closes).
 - **Lessons-aware.** Loads the canonical Instar Design Principles + Lessons Learned index (`docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md`) plus the running agent's local `.instar/memory/feedback_*.md` entries, then checks the spec for (a) direct contradictions of documented principles/lessons, (b) applicable lessons the spec fails to engage with, (c) behavioral lessons violated by agent-facing surfaces the spec proposes, and **(d) FOUNDATION/SUBSYSTEM AUDIT — the design the spec TESTS, EXTENDS, or BUILDS ON, not just the spec's own surface: does that foundation violate a known standard or repeat a known mistake?** The audit MUST reach one layer below the spec boundary. A spec can be internally clean while faithfully testing or extending a flawed foundation — e.g. a test-harness spec that correctly proves a permission gate which *itself* holds brittle blocking authority in violation of Signal-vs-Authority, or an extension spec built on a subsystem with an unaddressed gap. Taking the underlying subsystem "as given" is exactly how a standards violation survives review: the spec passes, the foundation's flaw is never weighed. When the foundation is flawed, the finding is "this spec is sound but the subsystem it depends on violates standard X / repeats mistake Y — surface it before building on/around it." Catches the "Phase 2" anti-pattern, the spec-converge-pre-auth-circular failure mode (see `feedback_spec_converge_pre_auth_circular`), and the foundation-not-audited gap (the Slack-permission-gate brittle-enum-as-authority that the harness convergence cleared because it audited only the harness, 2026-06-09).
 

package/skills/spec-converge/templates/reviewer-integration.md

@@ -19,17 +19,19 @@ Specifically check:
 
 3. **Auto-update path** — when a user pulls a new version of instar, what automatically propagates? What needs manual intervention?
 
-4. **Multi-machine** — if instar agents are paired across machines, does the new state stay coherent across both, or does each machine develop its own divergent view?
+4. **Multi-machine — Standard A: reject an UNDEFENDED machine-local (default is `unified`).** For EVERY state surface the spec introduces, the DEFAULT posture is `unified` across the agent's machines. A *declaration* of "machine-local BY DESIGN" is NOT sufficient — an undefended `machine-local` is a **MATERIAL FINDING**. A machine-local surface is allowed ONLY with a `machine-local-justification: <key>` marker (one labeled `key: value` line per surface, in the spec's `## Multi-machine posture` section) whose `<key>` is from the **CLOSED taxonomy**: `physical-credential-locality` (a login / key / token / service-binding that physically lives on one disk), `hardware-bound-resource` (bound to specific hardware), or `operator-ratified-exception` (operator-ratified, and MUST cite a machine-verifiable, existence-checkable ref — a commit SHA, registry key, or resolvable URL, never a bare topic+date). Other reasons (availability, privacy/data-residency, cost/latency, per-machine cache) are DENIED by default. The check is **BIDIRECTIONAL**: an *infeasible* `unified` (a credential/hardware-bound surface declared or defaulted `unified`) is EQUALLY a MATERIAL FINDING. CONTEST the justification INDEPENDENTLY in both directions — a marker whose key is present but substantively WRONG is still a finding; the marker's PRESENCE never satisfies the CORRECTNESS check. (Absence of any posture declaration defaults to `unified`-required.)
 
-5. **Backup/restore** — is new persistent state included in the backup manifest? If a user runs a snapshot/restore cycle, does the state survive?
+5. **Self-Heal Before Notify — Standard B (escalation-gate).** If the spec adds a **monitor / watcher / recurring-or-automated notice source** that raises operator notices, its operator-facing raise MUST be DOWNSTREAM of `selfHealAttempted && selfHealExhausted` — UNREACHABLE on first detection. A first-detection escalation on a `recoverable` degradation is a **MATERIAL FINDING** (a one-shot conversational reply is out of scope). The watcher MUST declare, and you CONTEST: its self-heal step + `remediation-actions` (concrete operations — a no-op flag-flip is a finding; each side-effecting action needs an idempotency guard + compensation); its P19 brakes — `max-attempts`, `max-wall-clock`, `backoff`, `dedupe-key`, `breaker` (incl. flapping auto-escalation), `max-notification-latency` (explicit units, ≤ `standards.selfHealBeforeNotify.recoverableLatencyCeiling`), `audit-location` (scrubbed); and the severity `class` of each degradation (an irreversible/data-loss/security class escalates IMMEDIATELY and heals concurrently; a critical-as-`recoverable` mislabel is a MATERIAL FINDING). This composes with *No Silent Degradation* — routing to self-heal is auditing, never swallowing.
 
-6. **Rollback** — if the feature is reverted, what happens to state files, config entries, and background jobs? Is cleanup provided?
+6. **Backup/restore** — is new persistent state included in the backup manifest? If a user runs a snapshot/restore cycle, does the state survive?
 
-7. **Dashboard / observability** — is there a UI surface where users can see what's happening? A feature affecting every session should be visible somewhere.
+7. **Rollback** — if the feature is reverted, what happens to state files, config entries, and background jobs? Is cleanup provided?
 
-8. **Config knob** — is there a way to disable the feature if it turns out to be harmful? Default on or off?
+8. **Dashboard / observability** — is there a UI surface where users can see what's happening? A feature affecting every session should be visible somewhere.
 
-9. **Anything else** about deployment, operations, or integration that might surprise in production.
+9. **Config knob** — is there a way to disable the feature if it turns out to be harmful? Default on or off?
+
+10. **Anything else** about deployment, operations, or integration that might surprise in production.
 
 Produce a SHORT report (under 400 words):
 

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-03T20:54:46.753Z",
-  "instarVersion": "1.3.735",
+  "generatedAt": "2026-07-03T21:33:39.596Z",
+  "instarVersion": "1.3.736",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1562,7 +1562,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "57d09bfcdaad6aa9e466cfadf972a7fd27f55d5011fac7f82495ee44856f42c7",
+      "contentHash": "73d28859114fc58c042a25f2cb15703265118eb07a46cc26f333a43653658b1a",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.736.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Enforcement machinery for three operator-ratified constitutional standards, per
+`docs/specs/three-standards-enforcement.md` (converged). This ships the STRUCTURE that makes
+each standard stick — the standard TEXTS ship separately under the already-granted ratification.
+
+- **Standard A — reject an undefended machine-local.** The `/spec-converge` integration reviewer
+  is upgraded from "a cross-machine posture is *declared*" to "the default posture is `unified`;
+  an undefended `machine-local` is a MATERIAL FINDING." A machine-local surface is now allowed
+  only with a `machine-local-justification: <key>` marker drawn from a CLOSED taxonomy
+  (`physical-credential-locality` / `hardware-bound-resource` / `operator-ratified-exception`),
+  and the check is bidirectional (an infeasible `unified` is equally a finding). The marker is the
+  cheap deterministic signal; the LLM reviewer holds the semantic authority (Signal vs. Authority).
+- **Standard B — self-heal before notify.** A new `/spec-converge` review-check that flags any
+  monitor/watcher/recurring-notice-source whose operator-facing escalation is reachable on first
+  detection. A watcher must declare its self-heal step, its `remediation-actions`, its P19 brakes
+  (including flapping detection and a `max-notification-latency`), and a contested severity class.
+- **Standard C — alerts-topic routing default.** A table-driven routing CONTRACT test at the
+  Telegram adapter boundary proving a topic-less non-critical notice routes to the one hub topic by
+  default, HIGH/URGENT keep their own topic, an existing-owning-topic send mints no new topic, and
+  an unresolvable hub falls back safely — plus a guard that the hub id is never a baked-in constant.
+- **Migration Parity.** `migrateThreeStandardsReviewChecks` re-copies the two upgraded spec-converge
+  skill files to already-installed agents, mirroring the existing multi-machine-posture migration.
+
+Honest framing: the purely-deterministic marker/field lints for A and B are hard-sequenced to land
+WITH each standard's registry guard, not in this change; until then A/B enforcement is the per-spec
+conformance-check gate plus the LLM review-lens (a semantic audit), never a no-LLM guarantee.
+
+## What to Tell Your User
+
+Nothing changes in how you talk to me day to day. This is internal development plumbing: when I
+design a new capability, my own spec-review now pushes back harder on two mistakes it used to let
+slide — quietly assuming a feature only ever runs on one of your machines, and building a watchdog
+that pings you the instant it sees a problem instead of trying to fix it first and telling you only
+when it genuinely cannot. It also adds a test proving stray housekeeping notices land in your one
+alerts topic instead of spawning a new topic each time. You do not need to do anything.
+
+## Summary of New Capabilities
+
+No new user-facing capability. Internal enforcement only: stronger spec-review checks for
+cross-machine posture and self-heal-before-notify, an idempotent migration so existing agents
+receive the upgraded checks, and a routing contract test for topic-less notices.
+
+## Evidence
+
+- `npx vitest run tests/unit/PostUpdateMigrator-threeStandardsReviewChecks.test.ts` — 7 passed
+  (content-presence of the A/B review-lenses in the shipped prompts + migration idempotency and
+  fingerprint-guard).
+- `npx vitest run tests/integration/notification-flood-burst-invariant.test.ts` — 12 passed
+  (5 new Standard C routing-contract cases + 7 existing burst-bound cases).
+- `npx tsc --noEmit` — clean.
+- Side-effects review: `upgrades/side-effects/three-standards-enforcement.md`.

package/upgrades/side-effects/three-standards-enforcement.md

@@ -0,0 +1,131 @@
+# Side-Effects Review — Enforcement of the three ratified standards (A/B/C)
+
+**Version / slug:** `three-standards-enforcement`
+**Date:** `2026-07-03`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+Turns three operator-ratified constitutional standards into structure rather than reviewer willpower, per `docs/specs/three-standards-enforcement.md` (converged; this PR ships the enforcement MACHINERY only — the standard TEXTS ship separately under the already-granted ratification). Files touched: `skills/spec-converge/SKILL.md` and `skills/spec-converge/templates/reviewer-integration.md` (Standard A — the cross-machine review-check is upgraded from "a posture is *declared*" to "the default posture is `unified`; an undefended `machine-local` is a MATERIAL FINDING" over a closed 3-key justification taxonomy with a `machine-local-justification:` marker convention, bidirectional; Standard B — a self-heal-before-notify escalation-gate review-check requiring a watcher's operator-raise to be downstream of `selfHealAttempted && selfHealExhausted`, with declared `remediation-actions` + P19 brakes + `max-notification-latency` + severity class); `src/core/PostUpdateMigrator.ts` (a new idempotent `migrateThreeStandardsReviewChecks` so EXISTING agents receive the upgraded skill content — Migration Parity case 5b); `tests/integration/notification-flood-burst-invariant.test.ts` (Standard C — a table-driven routing CONTRACT test at the adapter/funnel boundary proving topic-less non-critical notices route to the ONE hub topic by default while HIGH/URGENT keep their own topic); and a new unit test `tests/unit/PostUpdateMigrator-threeStandardsReviewChecks.test.ts`. Decision points: the `/spec-converge` integration-reviewer verdict surface (A, B) — a review LENS on a smart reviewer, not a new blocking gate; and the Telegram topic-less-notice routing default (C) — a verification + test over machinery that already exists (the Agent-Health hub lane), no new block.
+
+## Decision-point inventory
+
+- `skills/spec-converge integration reviewer (A)` — modify — upgrades the cross-machine coherence review-check to reject an undefended machine-local (default `unified`), bidirectional, over a closed taxonomy. Semantic authority stays with the existing LLM reviewer; the `machine-local-justification` marker is the cheap deterministic signal.
+- `skills/spec-converge integration reviewer (B)` — add — a self-heal-before-notify review-check binding monitors/watchers/recurring notice sources.
+- `PostUpdateMigrator.migrateThreeStandardsReviewChecks` — add — idempotent, fingerprint-guarded re-copy of the two upgraded skill files to already-installed agents.
+- `TelegramAdapter topic-less-notice routing (C)` — pass-through — verified-already-correct default (Agent-Health hub lane routes housekeeping notices to one hub from the first item; HIGH/URGENT carve-out preserved); this PR proves the rule with a contract test, it introduces no new routing code.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+A/B are review-LENSES on the `/spec-converge` LLM reviewer — they raise MATERIAL FINDINGS for a human/operator to weigh, they do not hard-block a build. A false positive (e.g. a genuinely-correct `machine-local` surface the reviewer contests) surfaces as a finding the author defends with a taxonomy-keyed `machine-local-justification:` marker; it never silently rejects work. C's contract test asserts existing routing behavior; it rejects no runtime input (a topic-less notice still routes to the hub, HIGH/URGENT still get their own topic).
+
+---
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+The deterministic marker LINT (A) and the self-heal field-schema LINT (B) are HARD-SEQUENCED to land WITH the registry ship (each standard's registered guard), NOT in this PR — so until they land, A/B enforcement is the per-spec `POST /spec/conformance-check` gate + the LLM review-lens (a semantic AUDIT), never a no-LLM deterministic guarantee. This is stated honestly in the spec and PR body; the review-check text does not claim the deterministic floor exists yet. C's contract test covers the enumerated routing cases (topic-less→hub, HIGH/URGENT→own, existing-owning-topic→that topic, unresolvable-hub→safe fallback) but cannot enumerate every future notice source — the funnel-level `createForumTopic` budget backstop (existing) remains the catch-all.
+
+---
+
+## 3. Level-of-abstraction fit
+
+**Is this at the right layer?**
+
+Yes. A/B are prompt/skill-level review LENSES fed by a cheap deterministic marker convention — the constitutional *Signal vs. Authority* / *Body and the Mind* split: the marker (body) signals, the full-context reviewer (mind) holds authority. Neither is a brittle detector with blocking authority. C's change is a TEST over the existing `TelegramAdapter` Agent-Health hub lane + `AttentionTopicGuard` funnel — it USES the existing routing primitive rather than re-implementing one, and the migration reuses the exact `migrateMultiMachinePostureReviewDimension` pattern rather than inventing a new one.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+**Does this change hold blocking authority with brittle logic?**
+
+- [x] No — this change produces a signal consumed by an existing smart gate.
+
+The `machine-local-justification` marker and the declared self-heal fields are cheap deterministic SIGNALS; the `/spec-converge` LLM integration reviewer holds the semantic authority and contests correctness bidirectionally. No new brittle string-matcher gains blocking authority. The migration is a mechanical file re-copy (no decision logic). The Standard C contract test is a test, not a gate.
+
+---
+
+## 5. Interactions
+
+**Does this interact with existing checks, recovery paths, or infrastructure?**
+
+- **Shadowing:** the A upgrade EXTENDS the existing multi-machine posture check (same integration reviewer bullet) rather than shadowing it; both coexist. The B check is a new bullet in the same reviewer.
+- **Double-fire:** `migrateThreeStandardsReviewChecks` is fingerprint-guarded + marker-idempotent, so it re-copies each file at most once; it never fights `migrateMultiMachinePostureReviewDimension` (different marker string, and once one runs the file carries both bodies from the bundled source).
+- **Races:** none — migration is a synchronous one-shot file write with an installed-copy existence check.
+- **Feedback loops:** none.
+
+---
+
+## 6. External surfaces
+
+**Does this change anything visible outside the immediate code path?**
+
+- Other agents on the install base: YES — the upgraded spec-converge review-checks reach existing agents via the new migration (that is the intended Migration-Parity effect). New agents get them via `installBuiltinSkills`.
+- External systems: none. No Telegram/Slack/GitHub/Cloudflare behavior changes — C is verification of existing routing.
+- Persistent state: none new.
+- **Operator surface (Mobile-Complete):** No operator-facing actions added — the change is reviewer-prompt content + a migration + tests. Not applicable.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface — not applicable. No dashboard renderer/markup, approval page, or grant/revoke/secret-drop form is touched.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN — with the reason, and it is the correct posture here (the standard applied to itself).**
+
+- The A/B review-check upgrades live in `/spec-converge` SKILL.md + template — **replicated** via git like all skills (machine-agnostic content); existing agents pick up the CHANGED content on their machine via `migrateThreeStandardsReviewChecks` (replication of the file is not the same as an already-running agent adopting it — the migration is the adoption path).
+- B's pattern is documentation + a per-watcher code shape; no new cross-machine state.
+- C's hub TOPIC is legitimately **machine-local** under `machine-local-justification: physical-credential-locality` — a Telegram forum + its topic ids are namespaced by the machine's bot token + forum binding, a per-disk service credential (NOT hardware-bound — this is the exact taxonomy-key correction the spec makes against its own first draft). The contract test asserts the hub id resolves from config/state and is NEVER a baked-in universal `7848` constant. The operator's CRITICAL-alert VIEW stays pool-unified via `GET /attention?scope=pool` (the acute miss-risk is closed); the residual Telegram-push gap is a registered Close-the-Loop follow-up, not built here.
+- Emits user-facing notices? C's hub routing is one-voice by construction (one hub topic). Durable state stranding on topic transfer? None new. Generated URLs? None.
+
+---
+
+## 8. Rollback cost
+
+**If this turns out wrong in production, what's the back-out?**
+
+Pure code + prompt + test change — revert the commit and ship a patch. No persistent state, no data migration to unwind. The `migrateThreeStandardsReviewChecks` migration is idempotent and only re-copies bundled skill content over a stock installed copy; a revert restores the prior bundled content and the next update re-syncs installed copies. No user-visible regression during the rollback window (the review-check is a spec-review-time lens; C is verification of unchanged runtime routing).
+
+---
+
+## Conclusion
+
+The review confirms the change is a Signal-vs-Authority-compliant enforcement layer: A/B add review LENSES fed by cheap deterministic markers (semantic authority stays with the existing LLM reviewer), C proves an existing routing default with a table-driven contract test, and Migration Parity is satisfied by an idempotent migration that mirrors the established `migrateMultiMachinePostureReviewDimension` pattern. The purely-deterministic marker/field LINTS are honestly deferred to the registry ship (hard-sequenced) and the PR says so. Clear to ship.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** not required
+
+Not a block/allow decision on messaging/dispatch, not a session-lifecycle change, not a coherence/idempotency/trust gate, and not a sentinel/guard/gate/watchdog runtime change — it is reviewer-prompt content + a migration + tests. Second-pass not required.
+
+---
+
+## Evidence pointers
+
+- `npx vitest run tests/unit/PostUpdateMigrator-threeStandardsReviewChecks.test.ts` → 7 passed (content-presence of A/B lenses + migration idempotency/fingerprint-guard).
+- `npx vitest run tests/integration/notification-flood-burst-invariant.test.ts` → 12 passed (5 new Standard C routing-contract cases + 7 existing burst-bound cases).
+- `npx tsc --noEmit` → clean.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `structure-not-willpower-review-gap` (nearest existing: a review expectation that lived in prose/reviewer-habit where structure was required; the tiered-intelligence machine-local-memory slip surviving seven rounds is the motivating instance).
+- **`closure`** — `guard` for the migration + tests; the purely-deterministic marker/field LINT is a tracked `gap` hard-sequenced to the registry ship (per the spec's Rollout).
+- **`guardEvidence`** — enforcementType `gate` (the `/spec-converge` integration reviewer now instructs "undefended machine-local = MATERIAL FINDING", citation `skills/spec-converge/SKILL.md` + `skills/spec-converge/templates/reviewer-integration.md`; howCaught: the reviewer is now told to raise the exact machine-local-by-design declaration that previously passed) plus `lint`-graded migration/content tests (`tests/unit/PostUpdateMigrator-threeStandardsReviewChecks.test.ts`).
+- **`gap`** — the deterministic marker lint (A) + self-heal field-schema lint (B) land with the standards' registry guard; tracked in the spec's Close-the-Loop registration.