instar 1.3.764 → 1.3.765

package/skills/spec-converge/scripts/cross-model-review.mjs

@@ -125,9 +125,33 @@ function readRepoFile(rel) {
   return fs.readFileSync(abs, 'utf-8');
 }
 
+/**
+ * Read the minimal reviewer config the module needs (REVIEWER-DOOR-REWIRING
+ * §1.5): the developmentAgent gate flag + the `specConverge.reviewers` block, so
+ * the Anthropic clean-door family resolves live-on-dev / dark-fleet. Best-effort:
+ * a missing/unparseable `.instar/config.json` ⇒ `{}` ⇒ fleet-dark (byte-identical
+ * `[codex, gemini]`). `.instar/config.json` is machine-local (no config
+ * replication in instar) — enabling the family is a per-machine edit.
+ */
+function loadReviewerConfig() {
+  try {
+    const cfgPath = path.join(ROOT, '.instar', 'config.json');
+    if (!fs.existsSync(cfgPath)) return {};
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
+    const out = {};
+    if (typeof cfg.developmentAgent === 'boolean') out.developmentAgent = cfg.developmentAgent;
+    if (cfg.specConverge && typeof cfg.specConverge === 'object') out.specConverge = cfg.specConverge;
+    return out;
+  } catch {
+    return {};
+  }
+}
+
 async function main() {
   const { spec, context, detectOnly, hashOnly, family, stateDir, timeoutMs } = parseArgs();
   const mod = await loadModule();
+  // Config-gate the Anthropic clean-door family (§1.5). Absent config ⇒ fleet-dark.
+  const reviewerConfig = loadReviewerConfig();
 
   // ── --hash-only: the delta-gating hash of the spec's reviewable body ──
   if (hashOnly) {
@@ -139,9 +163,9 @@ async function main() {
 
   // ── --detect-only: report ALL available families (Piece 3) ──
   if (detectOnly) {
-    const all = mod.detectAllCrossModelReviewers();
+    const all = mod.detectAllCrossModelReviewers({}, reviewerConfig);
     // Back-compat: keep the old single-framework fields (first-match shape).
-    const first = mod.detectCrossModelReviewer();
+    const first = mod.detectCrossModelReviewer({}, reviewerConfig);
     const report = {
       available: all.length > 0,
       frameworks: all,
@@ -152,10 +176,11 @@ async function main() {
     // Record the activation observation into the durable standing-framework
     // baseline when a state dir was provided. A record failure is surfaced in
     // the JSON (fail-loud), never silently swallowed — a missing baseline
-    // would quietly weaken the externals-mandatory check.
+    // would quietly weaken the externals-mandatory check. Iterate the ACTIVE
+    // set so a config-disabled claude family is not recorded as present.
     if (stateDir) {
       const frameworks = {};
-      for (const entry of mod.SUPPORTED_REVIEWER_FRAMEWORKS) {
+      for (const entry of mod.resolveActiveReviewerFrameworks(reviewerConfig)) {
         frameworks[entry.id] = all.some((d) => d.framework === entry.id);
       }
       try {
@@ -186,7 +211,10 @@ async function main() {
       );
       process.exit(0);
     }
-    familyEntry = mod.SUPPORTED_REVIEWER_FRAMEWORKS.find((f) => f.id === family) ?? null;
+    // Config gate (§1.5): a trusted-but-disabled family (the claude clean-door
+    // family on the fleet) is refused here — trusted-egress ≠ enabled.
+    const active = mod.resolveActiveReviewerFrameworks(reviewerConfig);
+    familyEntry = active.find((f) => f.id === family) ?? null;
     if (!familyEntry) {
       process.stdout.write(
         JSON.stringify({
@@ -199,7 +227,7 @@ async function main() {
     }
   }
 
-  const detection = familyEntry ? familyEntry.detect() : mod.detectCrossModelReviewer();
+  const detection = familyEntry ? familyEntry.detect() : mod.detectCrossModelReviewer({}, reviewerConfig);
 
   // Unavailable → print the unavailable flag, exit 0. Never block.
   if (!detection.available) {
@@ -227,9 +255,11 @@ async function main() {
         promptText: assembled.promptText,
         timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : mod.REVIEW_TIMEOUT_MS,
         detectionOverride: detection,
+        reviewerConfig,
       })
     : await mod.runCrossModelReview({
         assembled,
+        config: reviewerConfig,
         ...(Number.isFinite(timeoutMs) ? { timeoutMs } : {}),
       });
 

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-04T22:57:22.237Z",
-  "instarVersion": "1.3.764",
+  "generatedAt": "2026-07-04T23:42:04.602Z",
+  "instarVersion": "1.3.765",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1562,7 +1562,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.765.md

@@ -0,0 +1,63 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added a third **spec-converge external reviewer family**: the strongest Anthropic model
+(`claude-fable-5`) now reads a spec through the clean `claude -p` door — off the measured-penalized
+`opus × coding-harness` pair (INSTAR-Bench v2: Opus-4.8-via-Claude-Code 81.7% vs clean-API 99.1%, a
+17.4-point door penalty). This is **inc1** of REVIEWER-DOOR-REWIRING, and ships **dark on the fleet /
+live on a development agent** (the `specConverge.reviewers.anthropic.enabled` developmentAgent gate —
+absent config keeps today's exact `[codex, gemini]` behavior byte-for-byte).
+
+The reviewer is a **clean-door second read, NOT a cross-model opinion** — it carries `crossFamily:
+false` and books into its own `clean-door-anthropic-review` disclosure field, so a claude-only round
+can never launder the `cross-model-review` flag. Because a spec under review is untrusted ~60KB text,
+the call is **hardened to codex-door parity**: empty allowed-tools (`--allowedTools ''`, an allow-list
+not a denylist), `--strict-mcp-config`, a neutral scratch cwd, the prompt via stdin (never argv), an
+env allowlist that strips agent secrets (`INSTAR_AUTH_TOKEN`), and a runtime fail-closed preflight
+that degrades (never runs unhardened) if the installed CLI lacks the flags. The model argument is the
+CONCRETE frontier pin — never the tier word `'capable'`, which resolves to opus.
+
+## What to Tell Your User
+
+Nothing proactive — this is instar-developing-agent tooling that ships off on the fleet. If a user
+asks why a spec-converge run now shows a "clean-door Anthropic review" line, or whether the strongest
+Claude model reviews specs: on a development agent the spec is now also read by Fable 5 (the strongest
+Claude model) through a clean door (separate from the six in-session reviewers), disclosed on its own line and never
+counted as a cross-model opinion. It is dogfooded on the development agent first, before any wider
+rollout; the "clean door" claim is scoped to *off the measured-penalized coding-harness door*, not
+bench-verified-clean (that direct bench is a tracked follow-up).
+
+## Summary of New Capabilities
+
+- **`--family claude-code` clean-door reviewer** in spec-converge — config-gated
+  (`specConverge.reviewers.anthropic.enabled`, dev-on / fleet-dark); an optional
+  `specConverge.reviewers.anthropic.model` override is validated against the frontier accept-set
+  (a non-frontier concrete id like `claude-opus-4-8` is rejected, never silently honored).
+- **Cross-model honesty guard** — `crossFamily` is threaded onto the reviewer registry,
+  `ReviewerResult`, and `CrossModelDetectionResult` (fail-closed on an unknown id); the aggregate
+  flag, both detection paths, and the 7-day externals-mandatory baseline all filter on
+  `crossFamily: true`, so the claude family can never masquerade as cross-model.
+- **Inbound-safety hardening** for reviewing untrusted spec text (empty allowed-tools,
+  strict-mcp-config, neutral cwd, stdin prompt, env allowlist), verified by a STATE-level
+  zero-tool-execution test against the real Claude CLI.
+- No behavior change while the family stays dark (the fleet default); this only makes the reviewer
+  reachable on a development agent.
+
+## Evidence
+
+- `tests/unit/crossModelReviewer-clean-door.test.ts` — detection (static presence reasons only),
+  model resolution (default pin, tier-word + non-frontier-override rejection), the §5 lockdown
+  battery (a–e), the required-`crossFamily`-field guard, per-family concrete-pin model-arg, and the
+  config-gate default (fleet-absent = exactly `[codex, gemini]`).
+- `tests/unit/claude-reviewer-inbound-safety.test.ts` — hardened argv/env asserted deterministically
+  + a live-claude-gated STATE test proving a benign tool-invoking payload creates ZERO files.
+- `tests/unit/model-registry-freshness-reviewer-pin.test.ts` — the freshness-lint tooth on the
+  reviewer pin is NOT vacuous (a rotted constant fails the strict lint).
+- `tests/integration/clean-door-reviewer-driver.test.ts` — the driver `--family`/`--detect-only`
+  paths: clean-door flag shape, trusted-but-disabled refusal, family-present-only-when-enabled.
+- `tests/unit/PostUpdateMigrator-anthropicReviewerDisclosure.test.ts` — the SKILL.md content
+  migration reaches already-installed agents (idempotent, fingerprint-guarded).

package/upgrades/side-effects/reviewer-door-rewiring-inc1.md

@@ -0,0 +1,198 @@
+# Side-Effects Review — Reviewer-Door Rewiring inc1 (Anthropic clean-door reviewer family)
+
+**Version / slug:** `reviewer-door-rewiring-inc1`
+**Date:** `2026-07-04`
+**Author:** `echo (build hand)`
+**Second-pass reviewer:** `not required (Tier-1: dark-on-fleet, config-reversible, no durable state / external side-effects; PR is the review surface)`
+
+## Summary of the change
+
+inc1 of REVIEWER-DOOR-REWIRING adds a third spec-converge external reviewer family — the strongest
+Anthropic model (`claude-fable-5`) read through the clean `claude -p` door, off the measured-penalized
+`opus × coding-harness` pair. It ships **dark on the fleet / live on a development agent** via the
+`specConverge.reviewers.anthropic.enabled` developmentAgent gate; absent config keeps today's exact
+`[codex, gemini]` behavior byte-for-byte. The family is a clean-door SECOND READ (`crossFamily: false`)
+that books into its own `clean-door-anthropic-review` disclosure field and can never launder the
+`cross-model-review` flag. Files touched: `src/core/crossModelReviewer.ts` (detection, model
+resolution, registry entry, config gate, crossFamily plumbing, baseline-predicate swap, aggregate
+filter, hardening preflight), `src/core/ClaudeCliIntelligenceProvider.ts` (reviewer-hardening
+invocation + exported arg/env builders), `src/core/types.ts` (`IntelligenceOptions.reviewerHardening`),
+`scripts/model-registry-freshness.manifest.json` (reviewer pin), `skills/spec-converge/scripts/cross-model-review.mjs`
+(config gate), `skills/spec-converge/SKILL.md` (family + D7 disclosure), `src/core/PostUpdateMigrator.ts`
+(SKILL.md content migration), `docs/LLM-ROUTING-REGISTRY.md` (stale `report`→`strict` line), plus five
+test files + the converged spec docs.
+
+## Decision-point inventory
+
+- `SUPPORTED_REVIEWER_FRAMEWORKS` — **modify** — one new `claude-code` entry with REQUIRED `crossFamily: false`; codex remains the preference leader; existing ordering unchanged.
+- `TRUSTED_REVIEWER_FRAMEWORKS` — **modify** — gains `claude-code`, COUPLED ATOMICALLY with the §5.4 baseline-predicate swap (`isTrustedReviewerFramework` → `isCrossFamilyReviewerFramework`).
+- `ReviewerResult` / `CrossModelDetectionResult` — **modify** — gain a `crossFamily` field (populated from the registry; existing families byte-identical).
+- `aggregateRoundOutcomes` / `detectCrossModelReviewer` / `detectAllCrossModelReviewers` / `wasNonClaudeFrameworkActiveWithin` — **modify** — gain `crossFamily` filtering (behavior for existing families byte-identical).
+- `IntelligenceOptions.reviewerHardening` — **add** — the claude-provider inbound-safety lockdown option (other providers ignore it).
+- `specConverge.reviewers.anthropic.{enabled,model}` config block — **add** — the developmentAgent gate + optional frontier-validated model override.
+- No block/allow gate, no HTTP route, no scheduler job, no watcher is introduced or modified.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+No user-message block/allow surface — over-block not applicable. The one rejection path is the config
+model-override validator: a concrete-but-non-frontier id (e.g. `claude-opus-4-8`) is rejected with
+`override-not-frontier`. This is *intended* (it prevents re-pinning the reviewer to the penalized opus
+door); a legitimate frontier id (`claude-fable-5`) is accepted, and the default pin needs no override.
+The `--family claude-code` refusal on the fleet (`no-supported-framework`) is intended dark-gating,
+not over-block.
+
+---
+
+## 2. Under-block
+
+**What illegitimate inputs does this change let through that it shouldn't?**
+
+The load-bearing under-block risk is the untrusted spec text reaching a tool/MCP execution path via the
+`claude -p --setting-sources user` door (which loads user hooks + MCP servers and inherits full env).
+§1.4 hardening closes this: empty allowed-tools + `--strict-mcp-config` + neutral scratch cwd + stdin
+prompt + env allowlist, plus a fail-closed runtime preflight (`hardening-unsupported` → degrade, never
+run unhardened). Verified by a STATE-level zero-tool-execution test against the real Claude CLI (a
+benign tool-invoking payload creates NO file). The cross-model-honesty under-block (a claude-only run
+masquerading as cross-model) is closed structurally by `crossFamily`-keyed filtering, fail-closed on an
+unknown id, unit-locked.
+
+---
+
+## 3. Level-of-abstraction fit
+
+**Is the change at the right layer?**
+
+Yes. The reviewer family is a registry entry in the existing `SUPPORTED_REVIEWER_FRAMEWORKS` seam (the
+established extension point); the hardening is invocation options on the existing
+`ClaudeCliIntelligenceProvider` (no new adapter class, no `IntelligenceFramework` union change); the gate
+rides the standard `resolveDevAgentGate` funnel; the anti-rot pin rides the existing freshness-lint
+manifest. No new subsystem, no new abstraction — the change reuses every existing seam.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Does anything here gain blocking authority it shouldn't?**
+
+No. Every reviewer (internal, external, clean-door) remains a SIGNAL into convergence synthesis; no
+pass gains blocking authority; a degraded/unavailable family degrades loudly and convergence proceeds.
+The config gate governs *availability of a signal source*, not any authority. The `crossFamily` guard
+is a classification of what a signal COUNTS AS, not a block. The hardening preflight degrades (a signal
+outcome), never blocks.
+
+---
+
+## 5. Interactions
+
+**What existing features does this change interact with, and how?**
+
+- **Freshness lint** (`scripts/lint-model-registry-freshness.mjs`) — the new `claude-clean-door-reviewer-default`
+  pin is checked under strict enforcement; verified green + non-vacuity-tested.
+- **subscription pool / circuit breaker / spawn cap** — the claude reviewer rides `buildIntelligenceProvider`,
+  so it inherits the spawn-cap funnel + per-framework breaker; quota pressure surfaces as `degraded:
+  rate-limited`. Quota-correlation honesty: the claude family draws on the SAME Anthropic pool as the
+  authoring session (called out in the spec, degrades loudly).
+- **7-day externals-mandatory baseline** — the predicate swap keeps the mandatory check keyed on
+  cross-model families only; a claude-only activation never satisfies it (unit-locked).
+- **PostUpdateMigrator** — the SKILL.md content migration reaches already-installed agents.
+
+---
+
+## 6. External surfaces
+
+**Does this change touch any external service, network call, filesystem path outside the project, or spawn?**
+
+- **Egress:** the claude reviewer sends the spec text to Anthropic (or the operator's OWN configured
+  `ANTHROPIC_BASE_URL` proxy) — the SAME destination the authoring session already uses. ZERO new
+  egress destinations. No third-party aggregator (OpenRouter declined, §2).
+- **Spawn:** one `claude -p` one-shot per round per available family (≤10 rounds), run in a neutral
+  mkdtemp scratch cwd with an allowlist env. The `--help` preflight is a cheap one-shot, cached
+  per-process.
+- **Filesystem:** the reviewer pin adds a row to the in-repo freshness manifest. No paths outside the
+  project are written; the scratch cwd is under `os.tmpdir()`.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No new operator-facing surface (no HTTP route, no dashboard tab, no user-facing config the operator
+edits conversationally). The `specConverge.reviewers.*` config is instar-developing-agent tooling set
+per-machine by a maintainer, documented in the spec + SKILL.md + the release fragment. Not applicable
+beyond that.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+- **Reviewer availability (which families detect on this machine)** — machine-local BY DESIGN.
+  machine-local-justification: physical-credential-locality — each family's door is a per-disk CLI
+  login (claude OAuth config-home, `~/.codex/auth.json`, `~/.gemini/oauth_creds.json`); reachability
+  cannot replicate without replicating credentials, which is forbidden.
+- **Config (`specConverge.reviewers.*`)** — machine-local.
+  machine-local-justification: physical-credential-locality — `.instar/config.json` has no replication
+  path in instar (not one of the stateSync stores), and the config selects which per-disk CLI door
+  (a machine-local credentialed login) the reviewer uses. Enabling the family on more than one machine
+  is a per-machine edit.
+- **`state/framework-activation-history.jsonl`** — existing surface, unchanged; already machine-local
+  for the same reason (it records THIS machine's detections).
+  machine-local-justification: physical-credential-locality — a record of per-disk login availability.
+- Convergence runs on one machine per run; no cross-machine notice, URL, or durable-topic surface is
+  added. No `unified` surface is infeasible-and-claimed (bidirectional check clear).
+
+---
+
+## 8. Rollback cost
+
+**How hard is it to undo this change if it goes wrong?**
+
+Trivial. The family ships dark on the fleet (absent config = byte-identical `[codex, gemini]`). Rollback
+is a config flip (`specConverge.reviewers.anthropic.enabled: false`) or a revert of a docs/constants-only
+change. No data migration, no durable state, no external side-effects. The freshness manifest `enforcement`
+has its own documented `strict`→`report` rollback. The SKILL.md migration is idempotent + fingerprint-guarded
+(a customized skill is never touched).
+
+---
+
+## Conclusion
+
+**Ship / hold / needs second pass:** Ship (Tier-1). The change is dark-on-fleet, fully config-reversible,
+adds no durable state or new external destination, and the two load-bearing risks (untrusted-text tool
+execution; cross-model-flag laundering) are closed structurally and verified by tests — including a live
+STATE-level zero-tool-execution proof against the real Claude CLI. Operator approval of the converged
+spec (`approved: true`) is deliberately left to the operator per the run mandate.
+
+---
+
+## Second-pass review (if required)
+
+Not required — Tier-1 (dark-on-fleet, config-reversible, no durable/external side-effects). The PR is the
+review surface. Note for the operator: this increment implements a CONVERGED-but-not-yet-approved spec;
+if a Tier-2 re-land is desired post-approval, the trace can be re-cut with `--spec` + the approved tag.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/crossModelReviewer-clean-door.test.ts` (28 tests) — detection, model resolution, §5
+  lockdown battery (a–e), required-crossFamily-field guard, per-family concrete-pin model-arg, config gate.
+- `tests/unit/claude-reviewer-inbound-safety.test.ts` (7 tests, incl. live STATE) — hardened argv/env +
+  zero-tool-execution against the real Claude CLI.
+- `tests/unit/model-registry-freshness-reviewer-pin.test.ts` (3 tests) — non-vacuity of the reviewer pin.
+- `tests/integration/clean-door-reviewer-driver.test.ts` (7 tests) — driver `--family`/`--detect-only` paths.
+- `tests/unit/PostUpdateMigrator-anthropicReviewerDisclosure.test.ts` (4 tests) — SKILL.md content migration.
+- `node scripts/lint-model-registry-freshness.mjs` → PASS (strict). `node cross-model-review.mjs --detect-only`
+  → `[codex, gemini]` (fleet-absent config, dark).
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+This change closes ONE instance of a class (a per-provider clean-door reviewer). The generalization —
+a structured `{ provider, door, signalKind }` reviewer descriptor replacing the `crossFamily` boolean —
+is tracked as a deferral (spec §8.5) for when a future reviewer breaks the binary Claude/non-Claude
+taxonomy or the one-door-per-framework assumption. The paid-Gemini-key door + the direct `claude -p`
+bench are tracked deferrals (spec §8.1/§8.3), registered as an evolution action at merge.