instar 1.3.769 → 1.3.770

package/dist/core/slackRefreshBinding.d.ts

@@ -78,4 +78,24 @@ export declare function parseSlackConversationKey(key: string): string | null;
  * Slack↔numeric bridging (PresenceProxy, resume heartbeat).
  */
 export { candidateIdForRoutingKey as slackRoutingKeySyntheticId } from './conversationIdentity.js';
+/**
+ * slack-respawn-bind-token fix: resolve the `bootstrapConversationIds` for a Slack
+ * session RESPAWN (the /sessions/refresh, quota-swap, restart, restart-all paths, all
+ * funneling through SessionRefresh → slackRespawner) from its `routingKey`.
+ *
+ * A FRESH Slack spawn passes `bootstrapConversationIds: [conversationId]` so the session
+ * mints `INSTAR_BIND_TOKEN` + `INSTAR_CONVERSATION_ID` (durable-conversation-identity §7)
+ * and can open durable state (a commitment) bound to its minted conversation id. The
+ * respawn path previously OMITTED it, so a refreshed/quota-swapped Slack session came up
+ * token-less and its durable binds were refused (fail-closed) → the follow-through fell
+ * back to a fragile session-local timer that dies on the next restart (the live-proven
+ * S7 gap). This restores parity. `mintForInbound` is an idempotent get-or-create, so it
+ * returns the SAME id the fresh dispatch resolved for this key.
+ *
+ * Fail-toward-respawn: any resolution error → `undefined` (the prior token-less
+ * behavior), NEVER throws — a refresh must never be blocked by id resolution.
+ */
+export declare function slackRespawnBootstrapIds(routingKey: string, mintForInbound: (key: string) => {
+    id: number | null;
+}): number[] | undefined;
 //# sourceMappingURL=slackRefreshBinding.d.ts.map

package/dist/core/slackRefreshBinding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slackRefreshBinding.d.ts","sourceRoot":"","sources":["../../src/core/slackRefreshBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;qEACiE;IACjE,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzD;;;oCAGgC;IAChC,gCAAgC,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACtE;;;+BAG2B;IAC3B,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KACtD,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,eAAO,MAAM,6BAA6B,WAAW,CAAC;AAEtD,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpE;AAED;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,wBAAwB,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"slackRefreshBinding.d.ts","sourceRoot":"","sources":["../../src/core/slackRefreshBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;qEACiE;IACjE,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzD;;;oCAGgC;IAChC,gCAAgC,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACtE;;;+BAG2B;IAC3B,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KACtD,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,eAAO,MAAM,6BAA6B,WAAW,CAAC;AAEtD,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpE;AAED;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,wBAAwB,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEnG;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK;IAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrD,MAAM,EAAE,GAAG,SAAS,CAYtB"}

package/dist/core/slackRefreshBinding.js

@@ -43,4 +43,35 @@ export function parseSlackConversationKey(key) {
  * Slack↔numeric bridging (PresenceProxy, resume heartbeat).
  */
 export { candidateIdForRoutingKey as slackRoutingKeySyntheticId } from './conversationIdentity.js';
+/**
+ * slack-respawn-bind-token fix: resolve the `bootstrapConversationIds` for a Slack
+ * session RESPAWN (the /sessions/refresh, quota-swap, restart, restart-all paths, all
+ * funneling through SessionRefresh → slackRespawner) from its `routingKey`.
+ *
+ * A FRESH Slack spawn passes `bootstrapConversationIds: [conversationId]` so the session
+ * mints `INSTAR_BIND_TOKEN` + `INSTAR_CONVERSATION_ID` (durable-conversation-identity §7)
+ * and can open durable state (a commitment) bound to its minted conversation id. The
+ * respawn path previously OMITTED it, so a refreshed/quota-swapped Slack session came up
+ * token-less and its durable binds were refused (fail-closed) → the follow-through fell
+ * back to a fragile session-local timer that dies on the next restart (the live-proven
+ * S7 gap). This restores parity. `mintForInbound` is an idempotent get-or-create, so it
+ * returns the SAME id the fresh dispatch resolved for this key.
+ *
+ * Fail-toward-respawn: any resolution error → `undefined` (the prior token-less
+ * behavior), NEVER throws — a refresh must never be blocked by id resolution.
+ */
+export function slackRespawnBootstrapIds(routingKey, mintForInbound) {
+    try {
+        const id = mintForInbound(routingKey).id;
+        return typeof id === 'number' ? [id] : undefined;
+    }
+    catch {
+        /* @silent-fallback-ok: fail-toward-respawn — id resolution must NEVER block a Slack
+           session refresh/quota-swap/restart; a resolution error degrades to `undefined`
+           (the prior token-less behavior), exactly the safe direction. The absence of a bind
+           token only means this respawned session can't open durable state until its next
+           clean spawn — never a lost refresh. */
+        return undefined;
+    }
+}
 //# sourceMappingURL=slackRefreshBinding.js.map

package/dist/core/slackRefreshBinding.js.map

@@ -1 +1 @@
-{"version":3,"file":"slackRefreshBinding.js","sourceRoot":"","sources":["../../src/core/slackRefreshBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgDH,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAEtD,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,6BAA6B,GAAG,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,6BAA6B,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,wBAAwB,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"slackRefreshBinding.js","sourceRoot":"","sources":["../../src/core/slackRefreshBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgDH,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAEtD,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,6BAA6B,GAAG,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,6BAA6B,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,wBAAwB,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEnG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,cAAsD;IAEtD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP;;;;iDAIyC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.769",
+  "version": "1.3.770",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-05T02:48:30.887Z",
-  "instarVersion": "1.3.769",
+  "generatedAt": "2026-07-05T03:36:48.298Z",
+  "instarVersion": "1.3.770",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.770.md

@@ -0,0 +1,40 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed the final live-proven S7 gap: a Slack session that gets **respawned** (via `/sessions/refresh`,
+a quota-swap, a restart, or restart-all — all funnel through `SessionRefresh` → `slackRespawner`) now
+re-mints its conversation bind token. A **fresh** Slack spawn passes `bootstrapConversationIds` so the
+session gets `INSTAR_BIND_TOKEN` + `INSTAR_CONVERSATION_ID` and can open durable state (a commitment)
+bound to its minted conversation id; the respawn path **omitted** it, so a refreshed/quota-swapped Slack
+session came up token-less, its durable binds were refused (fail-closed), and the follow-through fell
+back to a fragile session-local timer that dies on the next restart. The respawn now resolves the
+conversation id from the routing key (idempotent get-or-create) and passes it, restoring parity with the
+fresh spawn. Telegram was unaffected (it has a `telegramTopicId` fallback; Slack had none).
+
+## What to Tell Your User
+
+Nothing proactive — this is an internal robustness fix. If a user ever asks why a Slack promise didn't
+survive a session swap or restart, the answer is that a restarted Slack session used to lose the small
+security key it needs to save a durable, restart-proof promise, so it fell back to a flimsy timer; now
+a restarted Slack session keeps that key, so the durable follow-through survives restarts.
+
+## Summary of New Capabilities
+
+- A refreshed / quota-swapped / restarted Slack session now registers durable, restart-surviving
+  follow-through (a commitment bound to the Slack conversation), matching a fresh spawn.
+- Fail-open: if the conversation-id lookup errors, the respawn proceeds (prior token-less behavior),
+  never blocked.
+- No config, no persistent state, no Telegram change.
+
+## Evidence
+
+- `tests/unit/slack-respawn-bootstrap-ids.test.ts` — 4 cases (id → `[id]`, full `channel:thread` key,
+  `null` → `undefined`, throwing registry → `undefined` / no rethrow).
+- Existing `tests/unit/sessionRefresh-slack.test.ts` (22) stay green; `tsc` clean.
+- Live proof it closes: `docs/investigations/s7-slack-delivery-repro-2026-07-04.md` §9 — Round-1
+  (already-running session) durable bind refused; Round-2 (fresh session) durable `CMT-1922` bound to
+  the minted id. This fix makes the respawn path behave like Round-2.

package/upgrades/side-effects/slack-respawn-bind-token.eli16.md

@@ -0,0 +1,46 @@
+# ELI16 — when a Slack session restarts, it now keeps its "durable-memory key"
+
+## The story
+
+There's a safety feature: when you ask the agent (over Slack) to do something later — "post a note in
+5 minutes" — it writes that promise down as a **durable commitment** so it survives even if the agent's
+session restarts. To write it down, the session needs a small **security key** (a bind token) that
+proves it's allowed to save state for *that specific Slack conversation*. The key is handed to the
+session the moment it starts up.
+
+The bug: a Slack session gets restarted fairly often — when the agent swaps to a different account to
+avoid a rate limit, when it's refreshed, or after a crash. Every time a *fresh* session starts for a
+Slack channel, it correctly gets the key. But every time a session was *restarted*, the code forgot to
+hand it the key again. So a restarted Slack session came up **without** its key, couldn't write down the
+durable promise (the save was refused for safety), and fell back to a flimsy in-memory timer instead —
+one that vanishes if the session restarts again. That's exactly the failure we've been chasing: a Slack
+promise that quietly loses its restart-proof backup after the session gets swapped.
+
+We proved this live earlier today, as a real Slack user: a message to an *already-restarted* session →
+the durable save was refused → timer fallback ("if my session had died, this note would not have been
+delivered"); a message to a *fresh* session → durable save worked. Same code, one path missing the key.
+
+## What this change does
+
+It makes the restart path hand the session its key again — the same way the fresh-start path already
+does. When a Slack session restarts, the code now looks up which Slack conversation it belongs to (a
+cheap, repeatable lookup that returns the same id every time) and gives the new session a key scoped to
+that conversation. So a restarted Slack session can write down durable, restart-proof promises again,
+just like a fresh one.
+
+## Why it's safe
+
+- It only *restores* a capability that was accidentally dropped; it adds no new powers. The security
+  gate that checks the key is unchanged — this just makes sure the rightful session actually gets its
+  own key.
+- If the lookup ever fails, it quietly falls back to the old (keyless) behavior instead of crashing —
+  a restart must never be blocked.
+- Telegram was never affected (it had a different fallback); this only fixes the Slack restart path.
+- It's a plain code change with no saved data, so rolling it back is trivial.
+
+## How we know it works
+
+Four small tests check the key-lookup helper: it returns the right conversation id, it passes the full
+channel/thread key through, it returns "no key" when there's no id, and — importantly — it never throws
+even if the lookup blows up (so a refresh can't be blocked). The 22 existing Slack-refresh tests all
+still pass.

package/upgrades/side-effects/slack-respawn-bind-token.md

@@ -0,0 +1,121 @@
+# Side-Effects Review — Slack session respawn re-mints the conversation bind token
+
+**Version / slug:** `slack-respawn-bind-token`
+**Date:** `2026-07-04`
+**Author:** `Echo`
+**Second-pass reviewer:** `not required (Tier-1)`
+
+## Summary of the change
+
+A FRESH Slack channel spawn passes `bootstrapConversationIds: [conversationId]` to
+`spawnInteractiveSession`, so the session mints `INSTAR_BIND_TOKEN` + `INSTAR_CONVERSATION_ID`
+(durable-conversation-identity §7) and can open durable state — a commitment bound to its minted
+(negative) conversation id. The Slack session **respawn** closure (`slackRespawner` in
+`src/commands/server.ts`, used by `/sessions/refresh`, quota-swap, restart, and restart-all — all
+funnel through `SessionRefresh` → `slackRespawner`) **omitted** `bootstrapConversationIds`. So a
+refreshed/quota-swapped Slack session came up **token-less** (and without `INSTAR_CONVERSATION_ID`),
+its durable commitment binds were **refused fail-closed**, and the follow-through fell back to a
+fragile session-local timer that dies on the next restart. This is the live-proven S7 gap (Round-1 of
+the 2026-07-04 test-as-self proof: an already-running/refreshed Slack session couldn't register a
+durable commitment; a fresh spawn — Round-2 — could, registering `CMT-1922` bound to `-1734007126`).
+Telegram's respawn is unaffected because it passes `telegramTopicId`, which the bind-token env
+resolver uses as a fallback; Slack has no such fallback. Fix: the respawn closure resolves the
+conversation id from the routing key (`conversationRegistry.mintForInbound(routingKey).id`, idempotent
+get-or-create → the SAME id the fresh dispatch resolves) via a new unit-tested helper
+`slackRespawnBootstrapIds` and passes it as `bootstrapConversationIds` — restoring parity with the
+fresh spawn. Files: `src/commands/server.ts` (closure + import), `src/core/slackRefreshBinding.ts`
+(helper), + test.
+
+## Decision-point inventory
+
+- `slackRespawner` closure spawn options (`src/commands/server.ts`) — **modify** — now passes
+  `bootstrapConversationIds` resolved from the routing key.
+- `slackRespawnBootstrapIds` (`src/core/slackRefreshBinding.ts`) — **add** — the pure, tested resolver.
+
+## 1. Over-block / 2. Under-block
+
+No block/allow surface. This RESTORES a capability (durable bind on a respawned Slack session) that was
+mistakenly dropped. Over/under-block not applicable.
+
+## 3. Level-of-abstraction fit
+
+Right layer — the fix is a one-option addition at the respawn spawn site, mirroring the fresh-spawn
+site exactly; the resolution is a tiny pure helper in the existing `slackRefreshBinding` module. No new
+machinery, no new authority.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — no runtime block/allow surface. The bind token it restores is enforced by the EXISTING §7
+  `conversationBindGate` (unchanged); this change only ensures the legitimately-authorized session
+  actually receives its own token on respawn.
+
+## 5. Interactions
+
+- **Shadowing:** none — additive spawn option, mirroring the fresh path.
+- **Double-fire:** none. `mintForInbound` is idempotent (get-or-create), so re-resolving on respawn
+  returns the same id the fresh dispatch used; no duplicate conversation is minted.
+- **Races:** none new — the respawn already spawned a session; this only adds one option to that call.
+- **Feedback loops:** none.
+- **Fail posture:** `slackRespawnBootstrapIds` FAILS TOWARD RESPAWN — any resolution error → `undefined`
+  (the prior token-less behavior), never throws, so a refresh can never be blocked by id resolution.
+
+## 6. External surfaces
+
+- **Install base / agents:** ships with the server; a refreshed Slack session now carries its bind
+  token. No config migration. No behavior change for a session that already had the token (fresh
+  spawns) or for Telegram (unaffected — separate fallback).
+- **External systems:** Slack unchanged (same channel session, same delivery). No new API.
+- **Persistent state:** none — `INSTAR_BIND_TOKEN` lives only in the tmux `-e` env at spawn (stateless,
+  self-authenticating). This change sets it correctly on respawn; nothing is persisted.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN** — `machine-local-justification: physical-credential-locality`. A Slack
+session is a tmux process on the machine that owns the Slack connection; its bind token is minted into
+that process's env at spawn on that machine (the token is a per-session, per-machine credential — the
+§7 secret is machine-local plaintext, same posture as authToken). The respawn happens on the owning
+machine. There is no cross-machine state, notice, durable record, or URL introduced; the fix only
+corrects a spawn-option omission on the local respawn path.
+
+## 8. Rollback cost
+
+Pure code change — revert the closure option, the helper, the import, and the test. No persistent
+state; a rollback returns to the (buggy) token-less respawn. Zero-cost back-out.
+
+## Conclusion
+
+Closes the final live-proven S7 gap: a refreshed/quota-swapped Slack session now re-mints its
+conversation bind token, so durable, restart-surviving follow-through works even after a session
+churn — matching the fresh-spawn path that the 2026-07-04 test-as-self proof showed already works.
+Minimal, parity-restoring, fail-open, unit-tested. Clear to ship.
+
+## Second-pass review (if required)
+
+**Reviewer:** not required (Tier-1)
+
+## Evidence pointers
+
+- `tests/unit/slack-respawn-bootstrap-ids.test.ts` — 4 cases: resolves id → `[id]`, passes the full
+  `channel:thread` routing key, `null` id → `undefined`, throwing registry → `undefined` (fails toward
+  respawn).
+- Existing `tests/unit/sessionRefresh-slack.test.ts` (22) stay green; `tsc` clean.
+- Live proof: `docs/investigations/s7-slack-delivery-repro-2026-07-04.md` §9 (Round-1 refused vs
+  Round-2 durable `CMT-1922`).
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `spawn-option-asymmetry` (`novel`; nearestExistingClass: `feature-un-enablable`;
+  includes: a spawn/respawn path that omits an option the parallel fresh-spawn path passes, silently
+  degrading a capability; excludes: an intentionally-different respawn option). Enters
+  `status:"unconfirmed"`, so this fix carries `closure: gap`.
+- **`closure`** — `gap` — a class-level guard (a lint/test asserting respawn spawn-option parity with
+  the fresh-spawn site) is out of scope for this fix.
+- **`guardEvidence`** — n/a for `closure: gap`.
+- **`gap`** — tracked follow-up: "respawn/fresh-spawn option-parity guard — assert the Slack (and other
+  platform) respawn paths pass the same identity/bind options as their fresh-spawn counterparts."