instar 1.3.763 → 1.3.765

package/upgrades/1.3.765.md

@@ -0,0 +1,63 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added a third **spec-converge external reviewer family**: the strongest Anthropic model
+(`claude-fable-5`) now reads a spec through the clean `claude -p` door — off the measured-penalized
+`opus × coding-harness` pair (INSTAR-Bench v2: Opus-4.8-via-Claude-Code 81.7% vs clean-API 99.1%, a
+17.4-point door penalty). This is **inc1** of REVIEWER-DOOR-REWIRING, and ships **dark on the fleet /
+live on a development agent** (the `specConverge.reviewers.anthropic.enabled` developmentAgent gate —
+absent config keeps today's exact `[codex, gemini]` behavior byte-for-byte).
+
+The reviewer is a **clean-door second read, NOT a cross-model opinion** — it carries `crossFamily:
+false` and books into its own `clean-door-anthropic-review` disclosure field, so a claude-only round
+can never launder the `cross-model-review` flag. Because a spec under review is untrusted ~60KB text,
+the call is **hardened to codex-door parity**: empty allowed-tools (`--allowedTools ''`, an allow-list
+not a denylist), `--strict-mcp-config`, a neutral scratch cwd, the prompt via stdin (never argv), an
+env allowlist that strips agent secrets (`INSTAR_AUTH_TOKEN`), and a runtime fail-closed preflight
+that degrades (never runs unhardened) if the installed CLI lacks the flags. The model argument is the
+CONCRETE frontier pin — never the tier word `'capable'`, which resolves to opus.
+
+## What to Tell Your User
+
+Nothing proactive — this is instar-developing-agent tooling that ships off on the fleet. If a user
+asks why a spec-converge run now shows a "clean-door Anthropic review" line, or whether the strongest
+Claude model reviews specs: on a development agent the spec is now also read by Fable 5 (the strongest
+Claude model) through a clean door (separate from the six in-session reviewers), disclosed on its own line and never
+counted as a cross-model opinion. It is dogfooded on the development agent first, before any wider
+rollout; the "clean door" claim is scoped to *off the measured-penalized coding-harness door*, not
+bench-verified-clean (that direct bench is a tracked follow-up).
+
+## Summary of New Capabilities
+
+- **`--family claude-code` clean-door reviewer** in spec-converge — config-gated
+  (`specConverge.reviewers.anthropic.enabled`, dev-on / fleet-dark); an optional
+  `specConverge.reviewers.anthropic.model` override is validated against the frontier accept-set
+  (a non-frontier concrete id like `claude-opus-4-8` is rejected, never silently honored).
+- **Cross-model honesty guard** — `crossFamily` is threaded onto the reviewer registry,
+  `ReviewerResult`, and `CrossModelDetectionResult` (fail-closed on an unknown id); the aggregate
+  flag, both detection paths, and the 7-day externals-mandatory baseline all filter on
+  `crossFamily: true`, so the claude family can never masquerade as cross-model.
+- **Inbound-safety hardening** for reviewing untrusted spec text (empty allowed-tools,
+  strict-mcp-config, neutral cwd, stdin prompt, env allowlist), verified by a STATE-level
+  zero-tool-execution test against the real Claude CLI.
+- No behavior change while the family stays dark (the fleet default); this only makes the reviewer
+  reachable on a development agent.
+
+## Evidence
+
+- `tests/unit/crossModelReviewer-clean-door.test.ts` — detection (static presence reasons only),
+  model resolution (default pin, tier-word + non-frontier-override rejection), the §5 lockdown
+  battery (a–e), the required-`crossFamily`-field guard, per-family concrete-pin model-arg, and the
+  config-gate default (fleet-absent = exactly `[codex, gemini]`).
+- `tests/unit/claude-reviewer-inbound-safety.test.ts` — hardened argv/env asserted deterministically
+  + a live-claude-gated STATE test proving a benign tool-invoking payload creates ZERO files.
+- `tests/unit/model-registry-freshness-reviewer-pin.test.ts` — the freshness-lint tooth on the
+  reviewer pin is NOT vacuous (a rotted constant fails the strict lint).
+- `tests/integration/clean-door-reviewer-driver.test.ts` — the driver `--family`/`--detect-only`
+  paths: clean-door flag shape, trusted-but-disabled refusal, family-present-only-when-enabled.
+- `tests/unit/PostUpdateMigrator-anthropicReviewerDisclosure.test.ts` — the SKILL.md content
+  migration reaches already-installed agents (idempotent, fingerprint-guarded).

package/upgrades/side-effects/actionclaim-config-shape-fix.eli16.md

@@ -0,0 +1,50 @@
+# ELI16 — Why the "I'll do that in 5 minutes" tracker couldn't be turned on
+
+## The one-sentence version
+
+There's a safety feature that watches for promises the agent makes ("I'll restart it", "I'll post
+that in about 5 minutes") and quietly writes them down so they survive a restart — and it turned out
+you literally could not switch it on. This change fixes the switch.
+
+## What was broken
+
+Think of the config file as a form. Most settings live in labeled boxes you can fill in. The switch
+for this promise-tracker was written as "fill in the box `messaging → actionClaim → enabled`."
+
+The problem: `messaging` isn't a box that holds other boxes. It's a **list** — one row per chat
+platform (Telegram, Slack, WhatsApp). You can't write "actionClaim" *inside a list*; there's nowhere
+to put it. So when the program looked for `messaging → actionClaim → enabled`, it always found
+nothing, and "nothing" means "off." No matter what you did, the feature stayed off.
+
+Why nobody noticed for so long: every automated test filled the form out the *wrong* way — it made
+`messaging` a box instead of a list, so in the tests the switch worked fine. But no real install
+looks like that. Real installs always use the list. So the tests were green while the real thing was
+un-turn-on-able. Two sibling features have the same quirk, but they default to **on**, so nobody ever
+had to find the switch — this promise-tracker is the first one that defaults to **off** and actually
+needs its switch to work.
+
+## What this change does
+
+It moves the switch to a box that actually exists: a **top-level `actionClaim`** setting, right
+alongside the other real settings — not buried inside the platform list. The old (broken) location
+is still honored if anyone used it, so nothing that already worked breaks.
+
+Two places read that switch: the live server route that receives the promise, and a small "when a
+turn finishes" hook script. Both now look in the new top-level spot first, and both are careful never
+to trip over the list.
+
+## Why it's safe
+
+- The feature is *signal-only*: it just writes a note; it never blocks or changes a message. So there
+  is no risk of it wrongly rejecting something.
+- It still ships **off by default** — this change only makes the "on" switch reachable, it doesn't
+  turn anything on.
+- Old configs keep working (the old location is a fallback), so it's backwards compatible.
+- If it's ever wrong, the fix is a plain code revert — there's no saved data to clean up.
+
+## How we know it works now
+
+A new test fills the form out the **real** way — `messaging` as a list — and flips the new top-level
+switch, then checks that a promise like "I'll restart the server now" actually gets written down. It
+fails without the fix and passes with it. Older tests (the ones using the box shape) still pass, so
+the backwards-compatibility promise holds.

package/upgrades/side-effects/actionclaim-config-shape-fix.md

@@ -0,0 +1,149 @@
+# Side-Effects Review — Action-Claim sentinel enablable on array-shaped `messaging`
+
+**Version / slug:** `actionclaim-config-shape-fix`
+**Date:** `2026-07-04`
+**Author:** `Echo`
+**Second-pass reviewer:** `not required (Tier-1)`
+
+## Summary of the change
+
+The Action-Claim Follow-Through Sentinel (including the Slack-followthrough lane from #1361)
+gated on the config path `messaging.actionClaim.enabled`. On every real install `messaging` is a
+JSON **array** of adapter configs, so `messaging.actionClaim.*` is unreachable — `LiveConfig`'s
+`getNestedValue` walks `messaging`, gets the array, evaluates `array['actionClaim']` → `undefined`,
+and returns the `false` default. Because this sentinel defaults OFF, the master gate could never be
+set true: the feature was **structurally un-enablable in production**. CI never caught it because
+every test wrote an object-shaped `messaging`, which no real install uses. Fix: read the config from
+a reachable **top-level `actionClaim`** block (canonical), honoring the legacy object-shaped
+`messaging.actionClaim` as a back-compat fallback. Files: `src/server/routes.ts` (the
+`/action-claim/observe` reads, via a small `acGet` live-read helper), `src/core/PostUpdateMigrator.ts`
+(the generated Stop hook's raw-file resolution + the CLAUDE-template enable-key text),
+`src/scaffold/templates.ts` (the scaffold CLAUDE-template enable-key text), plus tests.
+
+## Decision-point inventory
+
+- `POST /action-claim/observe` config reads (`src/server/routes.ts`) — **modify** — master `enabled`,
+  `slack.enabled` dev-gate value, `slack.dryRun`, `perTopicCap`, `expiresHours` now resolve
+  top-level-first via `acGet`.
+- Generated `action-claim-followthrough.js` Stop hook (`PostUpdateMigrator.getActionClaimFollowthroughHook`)
+  — **modify** — the raw-file `enabled` resolution reads top-level `cfg.actionClaim` and Array-guards
+  the legacy `cfg.messaging.actionClaim` fallback.
+- The `messaging.actionClaim.slack.enabled` dev-gate (`resolveDevAgentGate`) — **pass-through** — value
+  now sourced via `acGet` but the `undefined → live-on-dev, dark-fleet` semantics are unchanged.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. The change only affects whether a
+signal-only, never-blocking sentinel can be turned ON. An explicit top-level `actionClaim.enabled:false`
+correctly keeps it off (covered by a test).
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable. The sentinel remains dark by default (absent
+config → `false`); the fix does not change detection precision, only config reachability.
+
+## 3. Level-of-abstraction fit
+
+Right layer. This is a config-resolution fix at the exact read sites that were broken; it introduces
+no new authority and reuses the existing `LiveConfig` getter and the raw-file read in the generated
+hook. It does not re-implement config parsing — it adds a top-level-first fallback around the
+existing getters.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface. It changes config reachability for a signal-only
+  sentinel (the Stop hook always `exit(0)`; the observe route never blocks a message). No brittle
+  logic gains blocking authority.
+
+## 5. Interactions
+
+- **Shadowing:** none. The `acGet` helper reads top-level first, then falls back to the old
+  `messaging.actionClaim` path with the same default — a superset of prior behavior. Object-shaped
+  configs (existing tests) resolve identically via the fallback.
+- **Double-fire:** none. Single read path per field; no new emitter.
+- **Races:** none. Reads are per-request via `LiveConfig` (live, no shared mutable state added).
+- **Feedback loops:** none.
+
+## 6. External surfaces
+
+- **Other agents / install base:** the generated Stop hook is regenerated on every migration
+  (`instar/` hooks are always-overwritten), so existing agents pick up the array-safe resolution on
+  their next update — no per-agent config migration required (a fresh top-level `actionClaim` enable
+  is purely additive).
+- **External systems:** none changed. Slack/Telegram delivery paths untouched.
+- **Persistent state:** none. No new ledger/column/file.
+- **Operator surface:** no operator-facing action added — enabling is a config edit (dev-first soak),
+  same as before, now at a reachable key. "No operator-facing actions" — the CLAUDE-template text was
+  corrected so agents point operators at the reachable `actionClaim.enabled` key.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable. No dashboard renderer, approval page, or grant/secret form is
+touched.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN.** Config (`.instar/config.json`) is per-machine, and the Action-Claim
+sentinel already runs per-machine on the machine that owns the responding session (it registers under
+that session's own bind token — slack-followthrough-generalization §4.5). This change only alters
+*where in the local config file* the enable flag is read; it introduces no cross-machine state, no
+user-facing notice, no durable state, and no URLs. Enabling it on one machine does not and should not
+implicitly enable it on another — each machine's config is authoritative for its own sessions.
+
+## 8. Rollback cost
+
+Pure code change — revert and ship as a patch. No persistent state, no data migration, no user-visible
+regression during the rollback window. The generated hook is regenerated on the next migration in
+either direction. A deployed agent that had set top-level `actionClaim.enabled:true` would, on
+rollback, simply return to un-enablable (the pre-fix state) — no cleanup needed.
+
+## Conclusion
+
+The review confirms a low-risk, additive config-resolution fix that makes a previously un-enablable
+default-off sentinel actually turnable-on on real (array-`messaging`) installs, with the legacy
+object-shape fully back-compatible. It adds the missing test coverage (array-shaped `messaging`) that
+would have caught the original bug. Clear to ship. Follow-up worth tracking: the sibling default-ON
+`messaging.*` sentinels (`toneGate`, `outboundAdvisory`) share the same latent unreachability but are
+masked by their on-by-default posture — noted here, not fixed in this change (out of scope).
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** not required (Tier-1)
+**Independent read of the artifact: n/a**
+
+---
+
+## Evidence pointers
+
+- `tests/integration/action-claim-config-shape.test.ts` — array-shaped `messaging` + top-level
+  `actionClaim`: enablement, tuning-knob read, explicit-false off-switch, object-shape back-compat.
+- `tests/unit/action-claim-hook-slack.test.ts` — hook-body array-safe resolution assertion.
+- Existing `tests/integration/action-claim-route.test.ts` (14) + `tests/e2e/action-claim-lifecycle.test.ts`
+  (4) + `tests/unit/generated-hooks-parse.test.ts` (25) + `tests/unit/migrate-actionclaim-slack-devgate.test.ts`
+  (5) all stay green; `tsc --noEmit` clean.
+- `docs/investigations/s7-slack-delivery-repro-2026-07-04.md` — the S7 keystone investigation that
+  surfaced this bug (the merged #1361 fix could not be turned on).
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `config-unreachable-on-shape` (`novel`; nearestExistingClass:
+  `feature-un-enablable`; includes: a config gate whose dot-path is unreachable given the container's
+  real runtime shape, e.g. a key nested under an array-valued parent; excludes: a feature disabled by a
+  correctly-read explicit flag). Enters `status: "unconfirmed"` pending operator confirmation, so this
+  fix carries `closure: gap` (below), not `closure: guard`.
+- **`closure`** — `gap` — the class-level guard (a lint that flags a `messaging.<x>` dot-path read when
+  `messaging` is array-shaped in the shipped config, or a shape-fuzzing test harness for config gates)
+  is out of scope for this fix.
+- **`guardEvidence`** — n/a for `closure: gap`.
+- **`gap`** — tracked as a standards-gap follow-up: "config-gate shape-reachability lint/fuzz — a
+  default-off feature gated on an unreachable dot-path is un-enablable; add a guard that fails when a
+  gate reads `messaging.<child>.*` given `messaging` ships as an array." (This change ships the direct
+  regression test for THIS feature; the class-level guard is the tracked gap.)

package/upgrades/side-effects/reviewer-door-rewiring-inc1.md

@@ -0,0 +1,198 @@
+# Side-Effects Review — Reviewer-Door Rewiring inc1 (Anthropic clean-door reviewer family)
+
+**Version / slug:** `reviewer-door-rewiring-inc1`
+**Date:** `2026-07-04`
+**Author:** `echo (build hand)`
+**Second-pass reviewer:** `not required (Tier-1: dark-on-fleet, config-reversible, no durable state / external side-effects; PR is the review surface)`
+
+## Summary of the change
+
+inc1 of REVIEWER-DOOR-REWIRING adds a third spec-converge external reviewer family — the strongest
+Anthropic model (`claude-fable-5`) read through the clean `claude -p` door, off the measured-penalized
+`opus × coding-harness` pair. It ships **dark on the fleet / live on a development agent** via the
+`specConverge.reviewers.anthropic.enabled` developmentAgent gate; absent config keeps today's exact
+`[codex, gemini]` behavior byte-for-byte. The family is a clean-door SECOND READ (`crossFamily: false`)
+that books into its own `clean-door-anthropic-review` disclosure field and can never launder the
+`cross-model-review` flag. Files touched: `src/core/crossModelReviewer.ts` (detection, model
+resolution, registry entry, config gate, crossFamily plumbing, baseline-predicate swap, aggregate
+filter, hardening preflight), `src/core/ClaudeCliIntelligenceProvider.ts` (reviewer-hardening
+invocation + exported arg/env builders), `src/core/types.ts` (`IntelligenceOptions.reviewerHardening`),
+`scripts/model-registry-freshness.manifest.json` (reviewer pin), `skills/spec-converge/scripts/cross-model-review.mjs`
+(config gate), `skills/spec-converge/SKILL.md` (family + D7 disclosure), `src/core/PostUpdateMigrator.ts`
+(SKILL.md content migration), `docs/LLM-ROUTING-REGISTRY.md` (stale `report`→`strict` line), plus five
+test files + the converged spec docs.
+
+## Decision-point inventory
+
+- `SUPPORTED_REVIEWER_FRAMEWORKS` — **modify** — one new `claude-code` entry with REQUIRED `crossFamily: false`; codex remains the preference leader; existing ordering unchanged.
+- `TRUSTED_REVIEWER_FRAMEWORKS` — **modify** — gains `claude-code`, COUPLED ATOMICALLY with the §5.4 baseline-predicate swap (`isTrustedReviewerFramework` → `isCrossFamilyReviewerFramework`).
+- `ReviewerResult` / `CrossModelDetectionResult` — **modify** — gain a `crossFamily` field (populated from the registry; existing families byte-identical).
+- `aggregateRoundOutcomes` / `detectCrossModelReviewer` / `detectAllCrossModelReviewers` / `wasNonClaudeFrameworkActiveWithin` — **modify** — gain `crossFamily` filtering (behavior for existing families byte-identical).
+- `IntelligenceOptions.reviewerHardening` — **add** — the claude-provider inbound-safety lockdown option (other providers ignore it).
+- `specConverge.reviewers.anthropic.{enabled,model}` config block — **add** — the developmentAgent gate + optional frontier-validated model override.
+- No block/allow gate, no HTTP route, no scheduler job, no watcher is introduced or modified.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+No user-message block/allow surface — over-block not applicable. The one rejection path is the config
+model-override validator: a concrete-but-non-frontier id (e.g. `claude-opus-4-8`) is rejected with
+`override-not-frontier`. This is *intended* (it prevents re-pinning the reviewer to the penalized opus
+door); a legitimate frontier id (`claude-fable-5`) is accepted, and the default pin needs no override.
+The `--family claude-code` refusal on the fleet (`no-supported-framework`) is intended dark-gating,
+not over-block.
+
+---
+
+## 2. Under-block
+
+**What illegitimate inputs does this change let through that it shouldn't?**
+
+The load-bearing under-block risk is the untrusted spec text reaching a tool/MCP execution path via the
+`claude -p --setting-sources user` door (which loads user hooks + MCP servers and inherits full env).
+§1.4 hardening closes this: empty allowed-tools + `--strict-mcp-config` + neutral scratch cwd + stdin
+prompt + env allowlist, plus a fail-closed runtime preflight (`hardening-unsupported` → degrade, never
+run unhardened). Verified by a STATE-level zero-tool-execution test against the real Claude CLI (a
+benign tool-invoking payload creates NO file). The cross-model-honesty under-block (a claude-only run
+masquerading as cross-model) is closed structurally by `crossFamily`-keyed filtering, fail-closed on an
+unknown id, unit-locked.
+
+---
+
+## 3. Level-of-abstraction fit
+
+**Is the change at the right layer?**
+
+Yes. The reviewer family is a registry entry in the existing `SUPPORTED_REVIEWER_FRAMEWORKS` seam (the
+established extension point); the hardening is invocation options on the existing
+`ClaudeCliIntelligenceProvider` (no new adapter class, no `IntelligenceFramework` union change); the gate
+rides the standard `resolveDevAgentGate` funnel; the anti-rot pin rides the existing freshness-lint
+manifest. No new subsystem, no new abstraction — the change reuses every existing seam.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Does anything here gain blocking authority it shouldn't?**
+
+No. Every reviewer (internal, external, clean-door) remains a SIGNAL into convergence synthesis; no
+pass gains blocking authority; a degraded/unavailable family degrades loudly and convergence proceeds.
+The config gate governs *availability of a signal source*, not any authority. The `crossFamily` guard
+is a classification of what a signal COUNTS AS, not a block. The hardening preflight degrades (a signal
+outcome), never blocks.
+
+---
+
+## 5. Interactions
+
+**What existing features does this change interact with, and how?**
+
+- **Freshness lint** (`scripts/lint-model-registry-freshness.mjs`) — the new `claude-clean-door-reviewer-default`
+  pin is checked under strict enforcement; verified green + non-vacuity-tested.
+- **subscription pool / circuit breaker / spawn cap** — the claude reviewer rides `buildIntelligenceProvider`,
+  so it inherits the spawn-cap funnel + per-framework breaker; quota pressure surfaces as `degraded:
+  rate-limited`. Quota-correlation honesty: the claude family draws on the SAME Anthropic pool as the
+  authoring session (called out in the spec, degrades loudly).
+- **7-day externals-mandatory baseline** — the predicate swap keeps the mandatory check keyed on
+  cross-model families only; a claude-only activation never satisfies it (unit-locked).
+- **PostUpdateMigrator** — the SKILL.md content migration reaches already-installed agents.
+
+---
+
+## 6. External surfaces
+
+**Does this change touch any external service, network call, filesystem path outside the project, or spawn?**
+
+- **Egress:** the claude reviewer sends the spec text to Anthropic (or the operator's OWN configured
+  `ANTHROPIC_BASE_URL` proxy) — the SAME destination the authoring session already uses. ZERO new
+  egress destinations. No third-party aggregator (OpenRouter declined, §2).
+- **Spawn:** one `claude -p` one-shot per round per available family (≤10 rounds), run in a neutral
+  mkdtemp scratch cwd with an allowlist env. The `--help` preflight is a cheap one-shot, cached
+  per-process.
+- **Filesystem:** the reviewer pin adds a row to the in-repo freshness manifest. No paths outside the
+  project are written; the scratch cwd is under `os.tmpdir()`.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No new operator-facing surface (no HTTP route, no dashboard tab, no user-facing config the operator
+edits conversationally). The `specConverge.reviewers.*` config is instar-developing-agent tooling set
+per-machine by a maintainer, documented in the spec + SKILL.md + the release fragment. Not applicable
+beyond that.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+- **Reviewer availability (which families detect on this machine)** — machine-local BY DESIGN.
+  machine-local-justification: physical-credential-locality — each family's door is a per-disk CLI
+  login (claude OAuth config-home, `~/.codex/auth.json`, `~/.gemini/oauth_creds.json`); reachability
+  cannot replicate without replicating credentials, which is forbidden.
+- **Config (`specConverge.reviewers.*`)** — machine-local.
+  machine-local-justification: physical-credential-locality — `.instar/config.json` has no replication
+  path in instar (not one of the stateSync stores), and the config selects which per-disk CLI door
+  (a machine-local credentialed login) the reviewer uses. Enabling the family on more than one machine
+  is a per-machine edit.
+- **`state/framework-activation-history.jsonl`** — existing surface, unchanged; already machine-local
+  for the same reason (it records THIS machine's detections).
+  machine-local-justification: physical-credential-locality — a record of per-disk login availability.
+- Convergence runs on one machine per run; no cross-machine notice, URL, or durable-topic surface is
+  added. No `unified` surface is infeasible-and-claimed (bidirectional check clear).
+
+---
+
+## 8. Rollback cost
+
+**How hard is it to undo this change if it goes wrong?**
+
+Trivial. The family ships dark on the fleet (absent config = byte-identical `[codex, gemini]`). Rollback
+is a config flip (`specConverge.reviewers.anthropic.enabled: false`) or a revert of a docs/constants-only
+change. No data migration, no durable state, no external side-effects. The freshness manifest `enforcement`
+has its own documented `strict`→`report` rollback. The SKILL.md migration is idempotent + fingerprint-guarded
+(a customized skill is never touched).
+
+---
+
+## Conclusion
+
+**Ship / hold / needs second pass:** Ship (Tier-1). The change is dark-on-fleet, fully config-reversible,
+adds no durable state or new external destination, and the two load-bearing risks (untrusted-text tool
+execution; cross-model-flag laundering) are closed structurally and verified by tests — including a live
+STATE-level zero-tool-execution proof against the real Claude CLI. Operator approval of the converged
+spec (`approved: true`) is deliberately left to the operator per the run mandate.
+
+---
+
+## Second-pass review (if required)
+
+Not required — Tier-1 (dark-on-fleet, config-reversible, no durable/external side-effects). The PR is the
+review surface. Note for the operator: this increment implements a CONVERGED-but-not-yet-approved spec;
+if a Tier-2 re-land is desired post-approval, the trace can be re-cut with `--spec` + the approved tag.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/crossModelReviewer-clean-door.test.ts` (28 tests) — detection, model resolution, §5
+  lockdown battery (a–e), required-crossFamily-field guard, per-family concrete-pin model-arg, config gate.
+- `tests/unit/claude-reviewer-inbound-safety.test.ts` (7 tests, incl. live STATE) — hardened argv/env +
+  zero-tool-execution against the real Claude CLI.
+- `tests/unit/model-registry-freshness-reviewer-pin.test.ts` (3 tests) — non-vacuity of the reviewer pin.
+- `tests/integration/clean-door-reviewer-driver.test.ts` (7 tests) — driver `--family`/`--detect-only` paths.
+- `tests/unit/PostUpdateMigrator-anthropicReviewerDisclosure.test.ts` (4 tests) — SKILL.md content migration.
+- `node scripts/lint-model-registry-freshness.mjs` → PASS (strict). `node cross-model-review.mjs --detect-only`
+  → `[codex, gemini]` (fleet-absent config, dark).
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+This change closes ONE instance of a class (a per-provider clean-door reviewer). The generalization —
+a structured `{ provider, door, signalKind }` reviewer descriptor replacing the `crossFamily` boolean —
+is tracked as a deferral (spec §8.5) for when a future reviewer breaks the binary Claude/non-Claude
+taxonomy or the one-door-per-framework assumption. The paid-Gemini-key door + the direct `claude -p`
+bench are tracked deferrals (spec §8.1/§8.3), registered as an evolution action at merge.