instar 1.3.764 → 1.3.766

package/scripts/model-registry-freshness.manifest.json

@@ -91,6 +91,14 @@
       "file": "src/core/ModelTierEscalation.ts",
       "regex": "'claude-code':\\s*\\{\\s*default:\\s*'([^']+)',\\s*escalated:\\s*'([^']+)'",
       "note": "DEFAULT_TIER_ESCALATION.frameworks['claude-code'] default + escalated ids."
+    },
+    {
+      "id": "claude-clean-door-reviewer-default",
+      "door": "claude-code",
+      "tier": "capable",
+      "file": "src/core/crossModelReviewer.ts",
+      "regex": "CLAUDE_REVIEWER_DEFAULT_MODEL\\s*=\\s*'((?:claude|gpt|gemini)-[^']+)'",
+      "note": "CLAUDE_REVIEWER_DEFAULT_MODEL — the Anthropic clean-door reviewer pin (REVIEWER-DOOR-REWIRING §1.3). Extraction matches a frontier CONSTANT (not a capable:'…' tier decl), so the non-vacuity test (tests/unit/model-registry-freshness-reviewer-pin.test.ts) rots this constant and asserts the strict lint fails — closing the vacuous-tooth risk."
     }
   ],
   "$flaggedStaleNote": "Both prior flagged pins RESOLVED (operator-confirmed 2026-07-03): gemini capable swapped gemini-2.5-pro -> gemini-3.1-pro-preview (pin + topModels updated in the same change); codex capable stays gpt-5.5 (GA flagship — gpt-5.6-sol is preview-only/gov-gated/unreachable, NOT pinned). Nothing pending confirmation.",

package/skills/spec-converge/SKILL.md

@@ -115,12 +115,14 @@ The external "cross-model" pass is a set of independent non-Claude reads that si
      --spec <spec-path> --family gemini-cli \
      --context docs/foo.md --context docs/bar.md
    ```
-   Each emits a JSON `ReviewerResult` on stdout: `{ status, framework?, model?, verdict?, findings?, reason?, flag }`. Fold each `findings` into the round alongside the internal reviewers'. `status:'degraded'` (framework present but the call failed — timeout / error / rate-limited) is a *partial* cross-model pass for the round: fold in whatever came back and record the `degraded` flag — it does **not** collapse to `unavailable`. (Omitting `--family` keeps the old single-pass first-match behavior for existing callers.)
+   Each emits a JSON `ReviewerResult` on stdout: `{ status, framework?, model?, verdict?, findings?, reason?, flag, crossFamily }`. Fold each `findings` into the round alongside the internal reviewers'. `status:'degraded'` (framework present but the call failed — timeout / error / rate-limited) is a *partial* cross-model pass for the round: fold in whatever came back and record the `degraded` flag — it does **not** collapse to `unavailable`. (Omitting `--family` keeps the old single-pass first-match behavior for existing callers.)
+
+**Anthropic clean-door reviewer (`--family claude-code`) — a clean-door SECOND READ, NOT a cross-model opinion (REVIEWER-DOOR-REWIRING).** A third family reads the spec through the clean `claude -p` door on the strongest model (`claude-fable-5`), off the measured-penalized `opus × coding-harness` pair. It is **config-gated** (`specConverge.reviewers.anthropic.enabled` — omitted ⇒ live on a development agent, DARK on the fleet) and its result carries `crossFamily: false`, so it books into its OWN disclosure field **`clean-door-anthropic-review: claude-code:<model>`** — NEVER the `cross-model-review:` flag. A claude-only round therefore aggregates to `degraded-all-rounds`/`unavailable` exactly as before; the clean-door read can never launder a cross-model pass. Run it (when enabled) exactly like the others: `--family claude-code`. **D7 per-round-model disclosure:** the six INTERNAL reviewers run on the authoring session's model (opus, or `claude-fable-5` under tier-escalation — a quota-refused escalation silently drops them to opus-via-harness); record the ACTUAL per-round session/subagent model in the iteration log so a silent drop to opus is VISIBLE, not assumed.
 
 Two structural guards on the pass:
 
 - **Fail-loud model canary.** Model selection is dynamic (the `'capable'` tier resolved per framework — never a pinned name), and a tier word that falls through resolution (`'capable'` is not a model) is caught by `isConcreteReviewerModel` BEFORE the provider is invoked: the round degrades loudly with reason `model-resolution-canary` instead of silently selecting a dead reviewer.
-- **Trusted-provider allowlist.** `--family` only accepts frameworks on `TRUSTED_REVIEWER_FRAMEWORKS` (`codex-cli`, `gemini-cli` — first-party OAuth CLI adapters). The full spec text is handed to the reviewer, so it must NEVER be sent to a custom/base-URL endpoint; **pi-cli is deliberately excluded** from cross-model review for this reason (its provider may be a custom endpoint). An untrusted family is refused with `reason: 'untrusted-framework'`.
+- **Trusted-provider allowlist.** `--family` only accepts frameworks on `TRUSTED_REVIEWER_FRAMEWORKS` (`codex-cli`, `gemini-cli`, `claude-code` — first-party OAuth CLI adapters). The full spec text is handed to the reviewer, so it must NEVER be sent to a custom/base-URL endpoint; **pi-cli is deliberately excluded** from cross-model review for this reason (its provider may be a custom endpoint). An untrusted family is refused with `reason: 'untrusted-framework'`; a trusted-but-config-disabled family (the `claude-code` clean-door family on the fleet) is refused with `reason: 'no-supported-framework'` (trusted-egress ≠ enabled). The `claude-code` clean-door call is additionally hardened to codex-door parity for the untrusted spec text (empty allowed-tools, `--strict-mcp-config`, neutral scratch cwd, stdin prompt, env allowlist) — a spec under review is untrusted inbound text.
 
 The detection + invocation + parsing live in the unit-tested `src/core/crossModelReviewer.ts` module (built to `dist/core/crossModelReviewer.js`); the script is a thin file-I/O wrapper. codex and gemini are the supported frameworks in an extensible registry (`SUPPORTED_REVIEWER_FRAMEWORKS`) — further first-party CLIs plug in there with **no skill change**.
 

package/skills/spec-converge/scripts/cross-model-review.mjs

@@ -125,9 +125,33 @@ function readRepoFile(rel) {
   return fs.readFileSync(abs, 'utf-8');
 }
 
+/**
+ * Read the minimal reviewer config the module needs (REVIEWER-DOOR-REWIRING
+ * §1.5): the developmentAgent gate flag + the `specConverge.reviewers` block, so
+ * the Anthropic clean-door family resolves live-on-dev / dark-fleet. Best-effort:
+ * a missing/unparseable `.instar/config.json` ⇒ `{}` ⇒ fleet-dark (byte-identical
+ * `[codex, gemini]`). `.instar/config.json` is machine-local (no config
+ * replication in instar) — enabling the family is a per-machine edit.
+ */
+function loadReviewerConfig() {
+  try {
+    const cfgPath = path.join(ROOT, '.instar', 'config.json');
+    if (!fs.existsSync(cfgPath)) return {};
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
+    const out = {};
+    if (typeof cfg.developmentAgent === 'boolean') out.developmentAgent = cfg.developmentAgent;
+    if (cfg.specConverge && typeof cfg.specConverge === 'object') out.specConverge = cfg.specConverge;
+    return out;
+  } catch {
+    return {};
+  }
+}
+
 async function main() {
   const { spec, context, detectOnly, hashOnly, family, stateDir, timeoutMs } = parseArgs();
   const mod = await loadModule();
+  // Config-gate the Anthropic clean-door family (§1.5). Absent config ⇒ fleet-dark.
+  const reviewerConfig = loadReviewerConfig();
 
   // ── --hash-only: the delta-gating hash of the spec's reviewable body ──
   if (hashOnly) {
@@ -139,9 +163,9 @@ async function main() {
 
   // ── --detect-only: report ALL available families (Piece 3) ──
   if (detectOnly) {
-    const all = mod.detectAllCrossModelReviewers();
+    const all = mod.detectAllCrossModelReviewers({}, reviewerConfig);
     // Back-compat: keep the old single-framework fields (first-match shape).
-    const first = mod.detectCrossModelReviewer();
+    const first = mod.detectCrossModelReviewer({}, reviewerConfig);
     const report = {
       available: all.length > 0,
       frameworks: all,
@@ -152,10 +176,11 @@ async function main() {
     // Record the activation observation into the durable standing-framework
     // baseline when a state dir was provided. A record failure is surfaced in
     // the JSON (fail-loud), never silently swallowed — a missing baseline
-    // would quietly weaken the externals-mandatory check.
+    // would quietly weaken the externals-mandatory check. Iterate the ACTIVE
+    // set so a config-disabled claude family is not recorded as present.
     if (stateDir) {
       const frameworks = {};
-      for (const entry of mod.SUPPORTED_REVIEWER_FRAMEWORKS) {
+      for (const entry of mod.resolveActiveReviewerFrameworks(reviewerConfig)) {
         frameworks[entry.id] = all.some((d) => d.framework === entry.id);
       }
       try {
@@ -186,7 +211,10 @@ async function main() {
       );
       process.exit(0);
     }
-    familyEntry = mod.SUPPORTED_REVIEWER_FRAMEWORKS.find((f) => f.id === family) ?? null;
+    // Config gate (§1.5): a trusted-but-disabled family (the claude clean-door
+    // family on the fleet) is refused here — trusted-egress ≠ enabled.
+    const active = mod.resolveActiveReviewerFrameworks(reviewerConfig);
+    familyEntry = active.find((f) => f.id === family) ?? null;
     if (!familyEntry) {
       process.stdout.write(
         JSON.stringify({
@@ -199,7 +227,7 @@ async function main() {
     }
   }
 
-  const detection = familyEntry ? familyEntry.detect() : mod.detectCrossModelReviewer();
+  const detection = familyEntry ? familyEntry.detect() : mod.detectCrossModelReviewer({}, reviewerConfig);
 
   // Unavailable → print the unavailable flag, exit 0. Never block.
   if (!detection.available) {
@@ -227,9 +255,11 @@ async function main() {
         promptText: assembled.promptText,
         timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : mod.REVIEW_TIMEOUT_MS,
         detectionOverride: detection,
+        reviewerConfig,
       })
     : await mod.runCrossModelReview({
         assembled,
+        config: reviewerConfig,
         ...(Number.isFinite(timeoutMs) ? { timeoutMs } : {}),
       });
 

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-04T22:57:22.237Z",
-  "instarVersion": "1.3.764",
+  "generatedAt": "2026-07-04T23:55:08.310Z",
+  "instarVersion": "1.3.766",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1562,7 +1562,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "50b8f7db5235fe798e3a2f18cd9dc0f60cef0e167521ee43a362a915ff611657",
+      "contentHash": "de95f71c64d605e358e30e39626a1c25ccfc1eabf480623febc3e2c7dbab948e",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.765.md

@@ -0,0 +1,63 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added a third **spec-converge external reviewer family**: the strongest Anthropic model
+(`claude-fable-5`) now reads a spec through the clean `claude -p` door — off the measured-penalized
+`opus × coding-harness` pair (INSTAR-Bench v2: Opus-4.8-via-Claude-Code 81.7% vs clean-API 99.1%, a
+17.4-point door penalty). This is **inc1** of REVIEWER-DOOR-REWIRING, and ships **dark on the fleet /
+live on a development agent** (the `specConverge.reviewers.anthropic.enabled` developmentAgent gate —
+absent config keeps today's exact `[codex, gemini]` behavior byte-for-byte).
+
+The reviewer is a **clean-door second read, NOT a cross-model opinion** — it carries `crossFamily:
+false` and books into its own `clean-door-anthropic-review` disclosure field, so a claude-only round
+can never launder the `cross-model-review` flag. Because a spec under review is untrusted ~60KB text,
+the call is **hardened to codex-door parity**: empty allowed-tools (`--allowedTools ''`, an allow-list
+not a denylist), `--strict-mcp-config`, a neutral scratch cwd, the prompt via stdin (never argv), an
+env allowlist that strips agent secrets (`INSTAR_AUTH_TOKEN`), and a runtime fail-closed preflight
+that degrades (never runs unhardened) if the installed CLI lacks the flags. The model argument is the
+CONCRETE frontier pin — never the tier word `'capable'`, which resolves to opus.
+
+## What to Tell Your User
+
+Nothing proactive — this is instar-developing-agent tooling that ships off on the fleet. If a user
+asks why a spec-converge run now shows a "clean-door Anthropic review" line, or whether the strongest
+Claude model reviews specs: on a development agent the spec is now also read by Fable 5 (the strongest
+Claude model) through a clean door (separate from the six in-session reviewers), disclosed on its own line and never
+counted as a cross-model opinion. It is dogfooded on the development agent first, before any wider
+rollout; the "clean door" claim is scoped to *off the measured-penalized coding-harness door*, not
+bench-verified-clean (that direct bench is a tracked follow-up).
+
+## Summary of New Capabilities
+
+- **`--family claude-code` clean-door reviewer** in spec-converge — config-gated
+  (`specConverge.reviewers.anthropic.enabled`, dev-on / fleet-dark); an optional
+  `specConverge.reviewers.anthropic.model` override is validated against the frontier accept-set
+  (a non-frontier concrete id like `claude-opus-4-8` is rejected, never silently honored).
+- **Cross-model honesty guard** — `crossFamily` is threaded onto the reviewer registry,
+  `ReviewerResult`, and `CrossModelDetectionResult` (fail-closed on an unknown id); the aggregate
+  flag, both detection paths, and the 7-day externals-mandatory baseline all filter on
+  `crossFamily: true`, so the claude family can never masquerade as cross-model.
+- **Inbound-safety hardening** for reviewing untrusted spec text (empty allowed-tools,
+  strict-mcp-config, neutral cwd, stdin prompt, env allowlist), verified by a STATE-level
+  zero-tool-execution test against the real Claude CLI.
+- No behavior change while the family stays dark (the fleet default); this only makes the reviewer
+  reachable on a development agent.
+
+## Evidence
+
+- `tests/unit/crossModelReviewer-clean-door.test.ts` — detection (static presence reasons only),
+  model resolution (default pin, tier-word + non-frontier-override rejection), the §5 lockdown
+  battery (a–e), the required-`crossFamily`-field guard, per-family concrete-pin model-arg, and the
+  config-gate default (fleet-absent = exactly `[codex, gemini]`).
+- `tests/unit/claude-reviewer-inbound-safety.test.ts` — hardened argv/env asserted deterministically
+  + a live-claude-gated STATE test proving a benign tool-invoking payload creates ZERO files.
+- `tests/unit/model-registry-freshness-reviewer-pin.test.ts` — the freshness-lint tooth on the
+  reviewer pin is NOT vacuous (a rotted constant fails the strict lint).
+- `tests/integration/clean-door-reviewer-driver.test.ts` — the driver `--family`/`--detect-only`
+  paths: clean-door flag shape, trusted-but-disabled refusal, family-present-only-when-enabled.
+- `tests/unit/PostUpdateMigrator-anthropicReviewerDisclosure.test.ts` — the SKILL.md content
+  migration reaches already-installed agents (idempotent, fingerprint-guarded).

package/upgrades/1.3.766.md

@@ -0,0 +1,37 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added a CI lint (`scripts/lint-no-unreachable-messaging-gate.js`, wired into the `lint` chain) that
+fails the build if any source reads a **default-OFF** config gate at a `messaging.<child>.*`
+dot-path. On a real install `messaging` is a JSON **array** of adapter configs, so
+`messaging.<child>.*` resolves `undefined` → the `false` default → the feature is structurally
+un-enablable. This is the class-level guard for the PR #1379 bug (the Action-Claim / Slack-followthrough
+sentinel that couldn't be turned on). It flags only the concrete `.get('messaging.*', false)` shape,
+exempts default-`true` gates, and supports an inline `// lint-allow-messaging-gate: <reason>`
+suppression. Zero current offenders — a pure forward guard.
+
+## What to Tell Your User
+
+Nothing proactive — this is an internal build-time safety check. It only matters to developers: it
+stops a whole class of "the on-switch was written in a place the program can't read" mistakes from
+ever landing again, which is the exact bug that made the promise follow-through tracker impossible to
+turn on earlier. It is the automated backstop so a human doesn't have to remember that quirk.
+
+## Summary of New Capabilities
+
+- CI now refuses a default-off config gate placed at an unreachable position under the messaging list.
+- Points the author at the fix (move the switch to a reachable top-level setting) with a precise
+  file:line, or lets them suppress a deliberate exception visibly.
+- No runtime effect; a build-time guard only.
+
+## Evidence
+
+- `tests/unit/lint-no-unreachable-messaging-gate.test.ts` — 8 cases: flags the #1379 shape (generic +
+  plain, both quote styles); exempts default-true, non-messaging, and top-level `actionClaim`; honors
+  same-line and preceding-line suppression; the exported regex matches the incident line.
+- `node scripts/lint-no-unreachable-messaging-gate.js` → `clean` on current `main` (0 offenders).
+- Side-effects review: `upgrades/side-effects/lint-unreachable-messaging-gate.md`.

package/upgrades/side-effects/lint-unreachable-messaging-gate.eli16.md

@@ -0,0 +1,42 @@
+# ELI16 — a guard so the "un-turn-on-able switch" bug can't come back
+
+## The story so far
+
+Earlier today we found a safety feature whose on-switch was written in a spot the program could never
+read: the config's "messaging" section is a *list* of chat platforms, but the switch was addressed as
+if it were a labeled box inside that list. Lists don't have named boxes, so the program always found
+"nothing," and "nothing" means off. The feature was impossible to turn on, and every test had used a
+fake box-shaped config so nobody noticed. We fixed that specific feature (PR #1379). This change makes
+sure the *whole class* of that mistake can't happen again.
+
+## What this adds
+
+A tiny automated check (a "lint") that runs whenever the code is built or someone tries to commit. It
+scans the code for the exact broken shape: reading an **off-by-default** switch from a
+`messaging.<something>` address. Because "messaging" is a list, any such address is unreadable, and an
+off-by-default switch there can never be turned on — so the check fails the build and points at the
+line, telling the author to move the switch to a spot that actually works (a top-level setting).
+
+## Why it's careful (not annoying)
+
+- It only flags the genuinely-broken case: **off-by-default** switches. Switches that default to *on*
+  are left alone, because "unreadable" just means they quietly stay on — no harm.
+- It only looks at the one common way switches are read (`.get("messaging.x.enabled", false)`), so it
+  won't cry wolf on unrelated code.
+- If there's ever a real reason to keep such a line, an author can add a short "allow this on purpose"
+  comment and the check steps aside — but that choice is now visible in the code instead of silent.
+- Right now there are **zero** offending lines (the earlier fix removed the last one), so turning this
+  check on breaks nothing today — it's purely a guard for the future.
+
+## How we know it works
+
+Eight small tests feed the checker example lines: it correctly flags the exact bug shape (in a few
+spellings), correctly ignores the safe cases (default-on switches, top-level switches, non-messaging
+switches), and correctly honors the "allow this on purpose" comment. So the guard catches the mistake
+without blocking legitimate code.
+
+## The bigger idea
+
+This is the "Structure beats Willpower" principle in one line: instead of hoping future authors
+*remember* that "messaging" is a list and won't hold a switch, the build now *refuses* the mistake
+automatically. A guard that a human missed once shouldn't rely on a human not missing it again.

package/upgrades/side-effects/lint-unreachable-messaging-gate.md

@@ -0,0 +1,107 @@
+# Side-Effects Review — lint: ban default-off config gate at an unreachable messaging.* path
+
+**Version / slug:** `lint-unreachable-messaging-gate`
+**Date:** `2026-07-04`
+**Author:** `Echo`
+**Second-pass reviewer:** `not required (Tier-1)`
+
+## Summary of the change
+
+Adds `scripts/lint-no-unreachable-messaging-gate.js` (wired into the `lint` chain in `package.json`)
+and its unit test. The lint fails CI if any source file reads a **default-OFF** config gate at a
+`messaging.<child>.*` dot-path — the exact shape of the PR #1379 bug: on a real install `messaging`
+is a JSON **array**, so `messaging.<child>.*` resolves `undefined` → the `false` default → the
+feature is structurally un-enablable. It flags only the concrete `.get('messaging.*', false)`
+LiveConfig gate-read shape, exempts default-`true` gates (unreachable just leaves them on), and
+supports an inline `// lint-allow-messaging-gate: <reason>` suppression. Currently 0 offenders on
+`main` (PR #1379 removed the last one) — this is a pure forward guard.
+
+## Decision-point inventory
+
+- `scripts/lint-no-unreachable-messaging-gate.js` — **add** — a new CI lint gate.
+- `package.json` `lint` script — **modify** — append the new lint to the chain.
+- `tests/unit/lint-no-unreachable-messaging-gate.test.ts` — **add** — detector unit tests.
+
+## 1. Over-block
+
+The regex targets `.get('messaging.<...>', false)` specifically. A legitimate default-OFF gate that
+genuinely must live under `messaging` (none known) would be flagged — but the correct answer is to
+move it to a reachable top-level key (the whole point), and the inline suppression exists for a
+deliberate exception. Default-`true` gates and non-`messaging` paths are not flagged.
+
+## 2. Under-block
+
+It only catches the `.get(path, false)` shape. A default-off gate read via a cast
+(`(cfg as {...}).messaging?.x`) or a raw-file read (`cfg.messaging.x.enabled` in a generated hook)
+is not caught — a known, accepted limitation (the `.get` gate is the primary and highest-frequency
+pattern; the two others are rarer and harder to lint without false positives). Documented in the
+lint header.
+
+## 3. Level-of-abstraction fit
+
+Right layer: a build-time lint (cheap, deterministic, CI-enforced) is exactly the "Structure beats
+Willpower" guard for a class that a human/CI missed once (object-shaped-messaging tests hid it). It
+does not add runtime behavior or authority.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no runtime block/allow surface. It is a build-time CI lint. Its "authority"
+  is failing a build on a precise, suppressible pattern — not gating any live message or action.
+
+## 5. Interactions
+
+- **Shadowing:** none — it's an independent step appended to the end of the `lint` chain.
+- **Double-fire:** none.
+- **Races:** none — pure file scan at build time.
+- **Feedback loops:** none.
+
+## 6. External surfaces
+
+- **Install base / agents:** none at runtime — a CI/dev-time lint only.
+- **External systems / persistent state:** none.
+- **Operator surface:** no operator-facing action.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN** — a build-time lint runs in CI / on a developer's checkout; it has no
+runtime, no cross-machine state, no notices, no URLs. It is identical everywhere it runs by
+construction.
+
+## 8. Rollback cost
+
+Pure additive tooling — revert the script + the one-line `package.json` edit + the test. No
+persistent state, no runtime effect, no user-visible change. Zero-cost back-out.
+
+## Conclusion
+
+A small, precise, suppressible CI lint that would have caught the PR #1379 un-enablable bug at the
+read site (`.get('messaging.actionClaim.enabled', false)`). 0 current offenders, so it is a pure
+forward guard closing the class the operator's live-enable attempt surfaced. Clear to ship.
+
+## Second-pass review (if required)
+
+**Reviewer:** not required (Tier-1)
+
+## Evidence pointers
+
+- `tests/unit/lint-no-unreachable-messaging-gate.test.ts` — 8 cases: flags the #1379 shape (generic +
+  plain + both quote styles), exempts default-true and non-messaging and top-level `actionClaim`,
+  honors same-line and preceding-line suppression, regex matches the incident line.
+- `node scripts/lint-no-unreachable-messaging-gate.js` → `clean` (0 offenders on current `main`).
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `config-unreachable-on-shape` (the class named in the PR #1379 side-effects
+  artifact; the guard the operator asked be built to close it).
+- **`closure`** — `guard` — this lint IS the class-level guard: it structurally fails CI when a
+  default-off config gate is read at an unreachable `messaging.<child>.*` dot-path.
+- **`guardEvidence`** — `{ enforcementType: lint, citation: scripts/lint-no-unreachable-messaging-gate.js
+  (wired into package.json `lint`, run by .husky/pre-commit + CI), howCaught: it flags
+  `.get('messaging.<child>.*', false)` — the exact read shape of the #1379 master gate — so the
+  un-enablable gate can never re-land }`.