instar 1.3.759 → 1.3.761

package/dist/core/PostUpdateMigrator.js

@@ -136,6 +136,22 @@ A durable per-agent registry mapping each Playwright browser **profile** (a phys
 - **At-rest honesty**: the registry file is plaintext machine-local; it lists account identities + vault key NAMES, so filesystem access to the machine reveals the agent's access *map* — never the credentials (same posture as SelfKnowledgeTree/operationalFacts and the relationships store).
 `;
 }
+/**
+ * CLAUDE.md awareness block for the Doorway/Model Knowledge Registry + the `GET /doorways`
+ * read + the dark scan job (docs/specs/DOORWAY-MODEL-KNOWLEDGE-REGISTRY-SPEC.md §Agent
+ * Awareness). A POINTER, not an inlined door/model table (avoid CLAUDE.md bloat). The unique
+ * heading substring `Doorway/Model Knowledge Registry` is the content-sniff marker used by
+ * migrateClaudeMd (Migration Parity).
+ */
+export function DOORWAY_REGISTRY_CLAUDEMD_SECTION(port) {
+    return `\n### Doorway/Model Knowledge Registry — what models can I reach? (\`GET /doorways\`)
+
+A durable map from each of my **doorways** (the ways I reach LLMs — Claude Code, Codex, Gemini, a paid API key, …) to the top **models** that door can currently reach — so "what models can I actually reach right now?" is a READ, not a guess. Two layers: a git-tracked **canonical** manifest (the reviewed model list per door, with pricing) and a machine-local **live scan-state** (this machine's freshly-probed reachability per door). The canonical layer is ALWAYS authoritative for routing; the live scan-state is observability only, never a routing input.
+- Read the merged map: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/doorways\` → \`{ scanState, lastScanAt, doorways:[{ doorId, topModels:[{ id, role, frontier, pricing, verifiedAt }], reachable, probeStatus, lastScannedAt }] }\`. **Two honest states:** \`200\` with \`scanState:"never-run"\` (registry present, no scan yet — live fields are \`reachable:null\`/\`probeStatus:"never-scanned"\` until a scan runs), then \`200\` merged once a scan has run; \`503\` with \`code:"registry-unavailable-no-instar-source"\` (a pure end-user install carries no manifest) or \`code:"registry-corrupt"\` (manifest present but unparseable). It NEVER fabricates an empty map.
+- **Keeping the map current** is a recurring \`doorway-scan\` job that re-probes each door and surfaces ONE plain-English heads-up only when something changes. It ships **OFF by default** (dark for the fleet; the job manifest is \`enabled:false\`) — enable it per maintainer agent via the \`doorway-scan\` job manifest (free-probes spends zero metered budget; metered probes are manual-only + budget-fail-closed). The \`maintenance.doorwayScan\` config block (\`scope\`/\`cadence\`/\`digestTopicId\`/\`budgetCapUsd\`) tunes it; an explicit \`maintenance.doorwayScan.enabled:false\` is a master kill-switch (deny-wins).
+- **When to use** (PROACTIVE — this is the trigger): user asks "what models can I reach?" / "is my model map current?" / "which doorways are live?" → read \`GET /doorways\`, don't guess. A \`503 registry-unavailable-no-instar-source\` just means this is a pure end-user install with no source registry.
+`;
+}
 /**
  * CLAUDE.md note for the second wedge-signature family (2026-06-05 EXO
  * incident) + the API fresh-respawn lever. Appended to NEW installs as part of
@@ -752,6 +768,7 @@ export class PostUpdateMigrator {
         this.migrateTestAsSelfSkill(result);
         this.migrateInstarDevBuildLocationRegrounding(result);
         this.migrateInstarDevInternalOnlyReleaseNoteLane(result);
+        this.migrateClassClosureTemplateSelfActionClause(result);
         this.migrateSpecConvergeFoundationAudit(result);
         this.migrateAutonomousStopHookTopicKeyed(result);
         this.migrateSelfKnowledgeTree(result);
@@ -2926,6 +2943,49 @@ export class PostUpdateMigrator {
             result.errors.push(`skills/instar-dev/SKILL.md migration: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    /**
+     * Extend the deployed instar-dev side-effects template's "Class-Closure
+     * Declaration" trigger note with the self-action clause (docs/specs/
+     * self-action-convergence.md → E5): the declaration is REQUIRED not only when
+     * FIXING an agent-authored-artifact defect but also when ADDING/modifying a
+     * self-triggered controller (the `unbounded-self-action` class). New agents get
+     * it via installBuiltinSkills (install-if-missing); EXISTING agents only get
+     * updated CONTENT here (Migration Parity → "updating existing skill content").
+     *
+     * Same shape as migrateMultiMachinePostureReviewDimension: re-copy the bundled
+     * template only when the installed copy lacks the self-action MARKER and still
+     * looks stock (fingerprint guard). A customized template is left untouched.
+     * Idempotent: the marker check short-circuits on every later run.
+     */
+    migrateClassClosureTemplateSelfActionClause(result) {
+        const MARKER = 'unbounded-self-action';
+        const FINGERPRINT = 'Class-Closure Declaration';
+        const rel = ['skills', 'instar-dev', 'templates', 'side-effects-artifact.md'];
+        const label = 'instar-dev side-effects template (Class-Closure self-action clause)';
+        try {
+            const installed = path.join(this.config.projectDir, '.claude', ...rel);
+            if (!fs.existsSync(installed))
+                return; // fresh installs get the bundled copy
+            const current = fs.readFileSync(installed, 'utf8');
+            if (current.includes(MARKER))
+                return; // already updated — idempotent
+            if (!current.includes(FINGERPRINT)) {
+                result.skipped.push(`${label}: no Class-Closure section (older template) — left untouched`);
+                return;
+            }
+            const bundled = path.join(__dirname, '..', '..', ...rel);
+            if (!fs.existsSync(bundled))
+                return;
+            const next = fs.readFileSync(bundled, 'utf8');
+            if (next.includes(MARKER)) {
+                fs.writeFileSync(installed, next);
+                result.upgraded.push(label);
+            }
+        }
+        catch (err) {
+            result.errors.push(`${label}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     /**
      * Update the deployed spec-converge skill so existing agents get the
      * Lessons-aware reviewer's clause (d) FOUNDATION/SUBSYSTEM AUDIT — the review
@@ -4404,6 +4464,15 @@ setTimeout(() => process.exit(0), 2000);
             patched = true;
             result.upgraded.push('CLAUDE.md: added Machine Load Assessment section');
         }
+        // Doorway/Model Knowledge Registry (DOORWAY-MODEL-KNOWLEDGE-REGISTRY-SPEC.md §Agent
+        // Awareness) — Agent Awareness Standard + Migration Parity: existing agents learn the
+        // registry + GET /doorways + the dark doorway-scan job via this appended section. Same
+        // text as generateClaudeMd. Content-sniff on the unique heading keeps it idempotent.
+        if (!content.includes('Doorway/Model Knowledge Registry')) {
+            content += DOORWAY_REGISTRY_CLAUDEMD_SECTION(port);
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Doorway/Model Knowledge Registry section');
+        }
         // The Agent Carries the Loop (agent-owned-followthrough C1+C2) — agent
         // awareness for the owner⟂blockedOn commitment model + the probe + that the
         // user is never status-pinged for an agent-owned commitment. Content-sniffed.