instar 1.3.776 → 1.3.778

package/src/data/llmBenchCoverage.ts

@@ -685,6 +685,180 @@ export const LLM_ROUTING_NATURE: Readonly<Record<string, RoutingNature>> = {
   'correction-learning': { nature: 'D', chain: 'SORT' },
 };
 
+// ───────────────────────────────────────────────────────────────────────────
+// S4 FD5b — INJECTION-EXPOSURE static map (docs/specs/nature-axis-routing.md
+// FD5(b) §283-294, semantic-drift row detail §370-384).
+//
+// The `injectionExposure` axis of the per-component routing classification — the
+// PARALLEL exhaustive map the FD5 door-availability walk consults to decide
+// whether a candidate position on a NON-injection-safe door (a door whose
+// ChainPosition carries `injectionSafe: false`, e.g. groq-api/gpt-oss-120B) is
+// eligible for THIS component. It is enforced STATICALLY (not a per-call caller
+// flag) exactly like the nature map: one forgotten callsite must not be able to
+// silently route an injection-exposed call onto a non-injection door.
+//
+// POLARITY — FAIL-SAFE (spec §286): the map DEFAULTS to `exposed: true`. A
+// component is `exposed: false` ONLY when explicitly audited as carrying NO
+// untrusted / injection-bearing content, and that argument is required in the row
+// (`reason`, pinned shrink-only in the ratchet). `resolveInjectionExposure`
+// treats a missing/unknown component as EXPOSED (fail-closed skip) — the safe
+// direction. A per-call `attribution.injectionExposed: true` may only TIGHTEN
+// (mark an otherwise-trusted call exposed), never relax a statically-exposed
+// component (composed in IntelligenceRouter.isComponentInjectionExposed).
+//
+// THE CLASSIFICATION IS THE SAME PREDICATE AS `LLM_UNTRUSTED_INPUT` above — a
+// component carries injection-bearing content iff it judges untrusted content —
+// so this map's `exposed` is authored to MIRROR that reviewed axis, and the
+// ratchet (tests/unit/nature-routing-injection-exposure-ratchet.test.ts)
+// CROSS-CHECKS the two so they can never silently diverge (a callsite that
+// becomes `untrustedInput: true` must also become `exposed: true`, or CI fails).
+// This is the FD5b arm of the FD7 semantic-drift guard that is honoured TODAY;
+// the prompt-anchor fingerprint LINT (spec §376-384) is the separate FD7
+// semantic-drift increment.
+//
+// R8 (spec §308-310): the input-classifier-nature components (InputClassifier,
+// MessageSentinel, TaskClassifier) are injection-exposed and MUST be
+// `exposed: true` — the ratchet pins this so a future edit can't relax them.
+//
+// EACH ROW carries the spec's INPUT-SHAPE DECLARATION (§371: "can user / model /
+// tool content enter this call?"). It is load-bearing here: the ratchet enforces
+// `exposed ⟺ (userContent || modelContent || toolContent)` — an exposed:false row
+// declares all three false (nothing untrusted can enter), an exposed:true row
+// declares at least the channel(s) through which untrusted content arrives.
+// ───────────────────────────────────────────────────────────────────────────
+
+/** Can content of each provenance enter this LLM call (spec §371 input-shape declaration)?
+ *  - userContent  → the prompt embeds human/user-authored content (inbound messages, conversation);
+ *  - modelContent → the prompt embeds model/agent-generated content (assistant turns, session output, summaries);
+ *  - toolContent  → the prompt embeds tool output / file / peer-agent / process content. */
+export interface InjectionInputShape {
+  readonly userContent: boolean;
+  readonly modelContent: boolean;
+  readonly toolContent: boolean;
+}
+
+/** One component's static injection-exposure classification (FD5b).
+ *  `exposed` DEFAULTS true (fail-safe); `exposed:false` REQUIRES an argued `reason`
+ *  and an all-false `inputShape` (audited: no untrusted content can enter). */
+export interface InjectionExposure {
+  readonly exposed: boolean;
+  readonly inputShape: InjectionInputShape;
+  /** Required argument WHY the component carries no untrusted content (exposed:false only). */
+  readonly reason?: string;
+}
+
+const EXPOSED_USER: InjectionInputShape = { userContent: true, modelContent: false, toolContent: false };
+const EXPOSED_MODEL: InjectionInputShape = { userContent: false, modelContent: true, toolContent: false };
+const EXPOSED_TOOL: InjectionInputShape = { userContent: false, modelContent: false, toolContent: true };
+const EXPOSED_USER_MODEL: InjectionInputShape = { userContent: true, modelContent: true, toolContent: false };
+const EXPOSED_USER_TOOL: InjectionInputShape = { userContent: true, modelContent: false, toolContent: true };
+const EXPOSED_MODEL_TOOL: InjectionInputShape = { userContent: false, modelContent: true, toolContent: true };
+const EXPOSED_ALL: InjectionInputShape = { userContent: true, modelContent: true, toolContent: true };
+const NOT_EXPOSED: InjectionInputShape = { userContent: false, modelContent: false, toolContent: false };
+
+/** Sugar for the fail-safe default: an exposed row carrying its untrusted input-shape. */
+const exposed = (inputShape: InjectionInputShape): InjectionExposure => ({ exposed: true, inputShape });
+/** Sugar for the audited safe row: not exposed, all channels closed, with the argued reason. */
+const notExposed = (reason: string): InjectionExposure => ({ exposed: false, inputShape: NOT_EXPOSED, reason });
+
+export const LLM_ROUTING_INJECTION_EXPOSURE: Readonly<Record<string, InjectionExposure>> = {
+  // ── Sentinels ──
+  ExternalHogClassifier: exposed(EXPOSED_TOOL), // attacker-controllable process name + argv
+  InputGuard: exposed(EXPOSED_USER),
+  SessionActivitySentinel: exposed(EXPOSED_MODEL), // session tmux output
+  StallTriageNurse: exposed(EXPOSED_MODEL), // session output
+  CommitmentSentinel: exposed(EXPOSED_USER_MODEL), // both sides of a conversation
+  PresenceProxy: exposed(EXPOSED_MODEL), // session-stall over session output
+  MessageSentinel: exposed(EXPOSED_USER), // inbound user message (R8 input-classifier — must stay exposed)
+  ProjectDriftChecker: exposed(EXPOSED_MODEL_TOOL), // session work + files
+  TemporalCoherenceChecker: exposed(EXPOSED_USER_MODEL),
+  CompletionEvaluator: exposed(EXPOSED_MODEL_TOOL), // asserted work over session output/transcript
+  SessionWatchdog: exposed(EXPOSED_MODEL), // stuck-judge over session output
+  ResumeQueueDrainer: exposed(EXPOSED_MODEL_TOOL), // session state before a resume
+  TopicIntentArcCheck: exposed(EXPOSED_USER_MODEL),
+  SlackAdapter: exposed(EXPOSED_MODEL), // stall-confirm over session output
+  InputClassifier: exposed(EXPOSED_USER), // inbound user message (R8 input-classifier — must stay exposed)
+  SessionSummarySentinel: exposed(EXPOSED_MODEL), // summarizes tmux output
+  TelegramAdapter: exposed(EXPOSED_MODEL), // stall-confirm over session output
+
+  // ── Gates ──
+  PromptGate: exposed(EXPOSED_USER_TOOL), // injection detection over inbound content
+  ExternalOperationGate: exposed(EXPOSED_USER_TOOL), // in-content "user already approved" claims
+  WarrantsReplyGate: exposed(EXPOSED_USER),
+  UnjustifiedStopGate: exposed(EXPOSED_MODEL), // stop justification over session state
+  MessagingToneGate: exposed(EXPOSED_ALL), // reviews an outbound draft quoting user/tool content
+  MoveIntentClassifier: exposed(EXPOSED_USER), // inbound user message + conversation
+  HubIntentClassifier: exposed(EXPOSED_USER), // inbound hub message
+  ProfileIntentClassifier: exposed(EXPOSED_USER), // inbound user message + conversation
+  CoherenceReviewer: exposed(EXPOSED_ALL), // reviews outbound coherence (draft + context)
+  LLMSanitizer: exposed(EXPOSED_USER_TOOL), // definitionally judges untrusted inbound content
+  OverrideDetector: exposed(EXPOSED_USER),
+  TaskClassifier: exposed(EXPOSED_USER), // classifies a user task (R8 input-classifier — must stay exposed)
+
+  // ── Reflectors ──
+  JobReflector: exposed(EXPOSED_MODEL_TOOL),
+  crossModelReviewer: exposed(EXPOSED_TOOL), // reviews a spec document (file)
+  SelfKnowledgeTree: exposed(EXPOSED_MODEL_TOOL), // extracts over transcripts
+  TreeTriage: exposed(EXPOSED_TOOL),
+  TopicSummarizer: exposed(EXPOSED_USER_MODEL),
+  ContextualEvaluator: exposed(EXPOSED_USER_MODEL),
+  RelationshipManager: exposed(EXPOSED_USER_MODEL), // extracts relationship facts from conversation
+  StandardsConformanceReviewer: exposed(EXPOSED_TOOL), // artifact-vs-standard over files
+  DiscoveryEvaluator: exposed(EXPOSED_MODEL_TOOL), // subagent output
+  Usher: exposed(EXPOSED_USER), // routes an inbound turn
+  TopicIntentExtractor: exposed(EXPOSED_USER),
+  PreCompactionFlush: exposed(EXPOSED_MODEL_TOOL), // durable facts from a transcript
+  TreeSynthesis: exposed(EXPOSED_TOOL),
+  LLMConflictResolver: exposed(EXPOSED_TOOL), // divergent peer state = untrusted peer data
+  openConversationBrief: exposed(EXPOSED_TOOL), // A2A peer content
+  'a2a-checkin': exposed(EXPOSED_TOOL), // A2A peer-authored threads
+  'correction-learning': exposed(EXPOSED_USER_MODEL),
+  'mentor-stage-b': exposed(EXPOSED_MODEL_TOOL), // mentor signals over mentee output
+  ResumeValidator: exposed(EXPOSED_TOOL), // matches a resume UUID against topic/session state
+
+  // ── Jobs ──
+  PipeSessionSpawner: exposed(EXPOSED_USER_TOOL), // spawns from (possibly user-authored) task descriptions
+  CartographerSweep: exposed(EXPOSED_TOOL), // authors summaries over untrusted CODE
+  StandardsCoverageEnrichment: exposed(EXPOSED_TOOL),
+
+  // ── Argued NOT-EXPOSED (pinned shrink-only) — no live LLM callsite carrying untrusted content.
+  //    This set mirrors LLM_UNTRUSTED_INPUT's argued-false set exactly (cross-checked by the ratchet). ──
+  PromiseBeacon: notExposed(
+    'no live LLM prompt — generateStatusLine/classifyProgress hooks are unwired at the construction site; no untrusted content can enter (matches its untrustedInput/bench-coverage exemption)',
+  ),
+  InteractivePoolCanaryJudge: notExposed(
+    'judges a FIXED known-answer canary probe — the input is a constant, not external content; a planted instruction cannot reach it',
+  ),
+  AutoApprover: notExposed(
+    'mechanical key injection + audit logging, no LLM prompt of its own; the upstream untrusted-judging callsite is InputClassifier.classify()',
+  ),
+  IntegrationGate: notExposed(
+    'no LLM prompt of its own — delegates to JobReflector.reflect(); zero LLM-provider callsites of its own that see untrusted content',
+  ),
+  CoherenceGate: notExposed(
+    'no callsite carries attribution CoherenceGate — all LLM calls flow through CoherenceReviewer.callApi(), classified exposed there',
+  ),
+  InputDetector: notExposed(
+    'attribution-manifest alias only (a legacy prompt-pattern matcher); the live matcher calls with attribution PromptGate, classified exposed there',
+  ),
+};
+
+/**
+ * FD5b — resolve a component's STATIC injection exposure (fail-safe). Strips a
+ * trailing "/segment" operation suffix + a leading "server:" prefix (mirroring
+ * componentCategories.categoryForComponent) then looks the base up in the
+ * exhaustive map. A missing/unknown component resolves EXPOSED (fail-closed): the
+ * safe direction — an unclassified call is treated as if it could carry an
+ * injection, so it is never routed onto a non-injection-safe door. Pure.
+ */
+export function resolveInjectionExposure(component: string | undefined): boolean {
+  if (!component) return true; // fail-closed: no attribution ⇒ assume exposed
+  const base = component.split('/')[0].replace(/^server:/, '').trim();
+  const row = LLM_ROUTING_INJECTION_EXPOSURE[base];
+  if (!row) return true; // unknown component ⇒ exposed (fail-safe skip)
+  return row.exposed;
+}
+
 /* ────────────────────────────────────────────────────────────────────────────
  * S4 Increment A2 — nature-axis routing: door taxonomy, label registry, chains.
  *

package/upgrades/1.3.777.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Builds FD5b of the (still-dark) nature-axis router (spec: docs/specs/nature-axis-routing.md): the injection-exposure classification and the route gate that keeps an injection-exposed internal check off a non-injection-safe model door.
+
+- **`LLM_ROUTING_INJECTION_EXPOSURE`** (src/data/llmBenchCoverage.ts): a new exhaustive static map — one row per known LLM component, each declaring `exposed` (defaults true / fail-safe) plus an input-shape declaration (can user / model / tool content enter). A component is `exposed:false` only when explicitly audited as carrying no untrusted content, with a written reason. `resolveInjectionExposure()` returns EXPOSED for any unknown component (fail-closed).
+- **The route gate** (src/core/IntelligenceRouter.ts): resolveRoute now skips any door marked `injectionSafe:false` when the component is exposed. A tightening-only per-call `attribution.injectionExposed` flag can raise exposure but can never relax a statically-exposed component.
+- A new ratchet test enforces the map is exhaustive over the component registry (both directions), fail-safe, cross-checked against the reviewed untrusted-input classification, and pins the input-classifier components as exposed. A new resolver-test block covers the gate and the fresh-per-call injection-cache isolation.
+
+NO-OP in this increment: the only non-injection door in the shipped chains is also a metered door, which is already skipped until the later paid-door increment — so over the real chains the gate changes nothing. Dev-gated / dark: the whole nature block runs only when sessions.natureRouting is enabled; unset/off is byte-identical to before (asserted). This is the classification + gate only — NOT the metered-door Increment B, and NOT the go-live flip.
+
+## What to Tell Your User
+
+This is internal plumbing for how I choose which model runs my own background checks — nothing to turn on, and nothing about our conversations changes. In plain terms: I gave each of my internal checks a label saying whether it reads content that could contain hidden instructions from an outside source, and I added a rule so a check that does can never be sent to a cheaper model that a test showed is easier to trick. The routing feature is still off by default, so today this is invisible — it just means the unsafe path is sealed shut in advance, and it defaults to the cautious choice whenever it isn't sure.
+
+## Summary of New Capabilities
+
+- **Injection-exposure map**: a build-enforced, exhaustive table classifying each internal AI check by whether it handles untrusted content, defaulting to the cautious "exposed" when unsure.
+- **Route injection gate**: the model router refuses to place an untrusted-content check onto a model door proven easier to fool, evaluated fresh on every call.
+
+## Evidence
+
+- tests/unit/nature-routing-injection-exposure-ratchet.test.ts (11 tests) and the new FD5b block in tests/unit/nature-routing-resolver.test.ts — green, covering exhaustiveness both directions, fail-safe resolve, the pinned not-exposed set, input-shape coherence, the untrusted-input cross-check, R8, the gate (exposed skips / trusted keeps / critical-gate fail-closed), and injection-cache isolation.
+- `npx tsc --noEmit` clean; the FD4 nature-chains build-lint clean; the sibling untrusted-input / bench-coverage / routing-nature ratchets green; the pre-existing byte-identical-when-off block and A1's degrade-clamp assertion untouched and green.

package/upgrades/1.3.778.md

@@ -0,0 +1,47 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added the observe-only ("shadow") phase of the Turn-End Self-Deferral Guard: a meaning-based judge on
+the turn-end surface that records when a turn-ending message hands the operator a decision about work
+the agent could do within its own means (the "you deferred again" pattern that slipped every existing
+guard on 2026-07-04). It folds one new allow-class rule (`U_SELF_DEFERRAL`) plus four fields into the
+SINGLE existing `UnjustifiedStopGate` turn-end call — no new LLM call, no new hook, no new route. The
+judge receives the recent user turns (a bounded, fail-open transcript tail-read) so it can distinguish a
+genuine operator decision from a self-deferral. Verdicts are recorded to the existing `StopGateDb`
+(new columns + a real `ALTER TABLE` migration and age-based retention, both of which did not previously
+exist). It BLOCKS NOTHING — it only records, to produce the telemetry needed to later decide whether the
+blocking phase (deferred) is worth building. Dev-agent-gated (on for a development agent, dark on the
+fleet).
+
+## What to Tell Your User
+
+Nothing proactive — this is an internal, observe-only telemetry feature that changes no behavior. If a
+user asks whether the agent has a check for handing work back to them that it could do itself, the
+answer is: yes, a quiet watch-only version now records those moments so we can measure how often it
+happens and how accurately it is detected, before ever deciding whether the agent should actively step
+in. It never blocks or delays a message.
+
+## Summary of New Capabilities
+
+- A turn-end judge that classifies self-deferral (agent hands the operator agent-ownable work) and
+  records it, with recent-user-turn context, on every finished turn.
+- Recording rides the existing stop-gate call (zero new LLM calls); it blocks nothing and changes no
+  message.
+- New `StopGateDb` columns with a built idempotent column migration (existing agents gain the columns on
+  update) and real age-based retention.
+- Dev-agent gated (`monitoring.selfDeferralGuard`); off-state is byte-for-byte the prior behavior.
+- The enforce/blocking phase is deliberately DEFERRED behind separately-gated preconditions (spec §10).
+
+## Evidence
+
+- Spec: `docs/specs/turn-end-self-deferral-guard.md` (v4, Phase A CONVERGED — 4 review rounds; operator
+  approved the observe-only build, topic 29836, 2026-07-05).
+- 55 tests across 5 new suites + updated rule-count assertions: `tests/unit/self-deferral-guard.test.ts`
+  (14), `tests/unit/stopGateDb-self-deferral-migration.test.ts` (6),
+  `tests/unit/stopGateTranscriptTail.test.ts` (13), `tests/integration/self-deferral-guard-route.test.ts`
+  (2), `tests/e2e/self-deferral-guard-feature-alive.test.ts` (2), `tests/unit/UnjustifiedStopGate.test.ts`
+  (regression). `tsc --noEmit` clean.

package/upgrades/side-effects/nature-axis-routing-fd5b-injection-exposure.md

@@ -0,0 +1,62 @@
+# Side-Effects Review — FD5b: injection-exposure static map + route-resolution injection gate
+
+**Version / slug:** `nature-axis-routing-fd5b-injection-exposure`
+**Date:** `2026-07-05`
+**Author:** `echo (build hand, topic 29723 routing follow-through)`
+**Second-pass reviewer:** `not required (Tier 1 — deterministic static classification + a pure candidate-eligibility filter, dark/dev-gated, byte-identical no-op in Increment A; same surface + precedent as A2.1 FD4-lints #1388)`
+
+## Summary of the change
+
+Builds FD5b of `docs/specs/nature-axis-routing.md` (§283-294): the exhaustive, fail-safe **injection-exposure** classification the nature router consults, plus the resolve-time gate that keeps an injection-exposed component off a non-injection-safe door. Files touched:
+
+- `src/data/llmBenchCoverage.ts` — new `LLM_ROUTING_INJECTION_EXPOSURE` map (exhaustive over `COMPONENT_CATEGORY`, `exposed` defaults true / fail-safe, each row carries the spec §371 input-shape declaration), `InjectionExposure`/`InjectionInputShape` types, and the pure `resolveInjectionExposure(component)` fail-closed resolver.
+- `src/core/IntelligenceRouter.ts` — a new `isInjectionExposed` dep threaded into `resolveRoute`'s availability walk (skips a `injectionSafe:false` position when the component is exposed, reason `injectionUnsafe`), and the exported `isComponentInjectionExposed(component, perCallExposed?)` composer (static OR tighten-only per-call flag), wired at the class caller.
+- `src/core/types.ts` — an OPT-IN, tightening-only `attribution.injectionExposed?: boolean`.
+- Tests — NEW `tests/unit/nature-routing-injection-exposure-ratchet.test.ts` (exhaustiveness both directions, fail-safe resolve, pinned NOT-EXPOSED set + reasons, input-shape coherence, cross-check vs `LLM_UNTRUSTED_INPUT`, R8 pin) and a NEW FD5b block appended to `tests/unit/nature-routing-resolver.test.ts` (the gate + injection-cache isolation). The pre-existing byte-identical block (`nature-routing-resolver.test.ts:261-296`) and A1's clamp assertion (`:161-162`) are UNTOUCHED and green.
+
+## Decision-point inventory
+
+- `FD5b injection gate (resolveRoute availability walk)` — add — a PURE candidate-eligibility filter: an injection-exposed component skips a `injectionSafe:false` door. NO-OP in Increment A (the only such door, `groq-api`, is also metered → already skipped one line above).
+- `LLM_ROUTING_INJECTION_EXPOSURE static classification` — add — build-time DATA (a signal), ratchet-enforced exhaustive + fail-safe; the router consults it, it holds no runtime authority of its own.
+- `attribution.injectionExposed per-call flag` — add — tightening-only; can raise exposure, can NEVER relax a statically-exposed component.
+- `sessions.natureRouting enable/dryRun gate` — pass-through — the whole nature block (and therefore the injection gate) still runs ONLY when enabled.
+
+## 1. Over-block
+
+**What legitimate inputs does this reject that it shouldn't?** In Increment A: none observable. The gate only removes a `injectionSafe:false` position for an exposed component, and the sole such position in the shipped chains (`groq-api/gpt-oss-120B`) is already unconditionally skipped as a metered door — so the resolved route is byte-identical (asserted: "the real default chains are UNAFFECTED"). The fail-safe default (unknown → exposed) could in principle skip a non-injection door for an unclassified component, but the exhaustiveness ratchet guarantees every real component is classified, so "unknown" never occurs for a shipped callsite; the fail-safe only governs a genuinely unregistered label, where skipping the non-injection door is the intended safe direction.
+
+## 2. Under-block
+
+**What failure modes does this still miss?** The classification is static build-time judgment — a callsite whose prompt SILENTLY starts carrying untrusted content while its row stays `exposed:false` is a semantic-drift miss. FD5b mitigates this TODAY via the ratchet cross-check against `LLM_UNTRUSTED_INPUT` (a component that becomes `untrustedInput:true` must also become `exposed:true`, or CI fails) and the input-shape coherence invariant. The full FD7 semantic-drift guard — the prompt-anchor fingerprint LINT (spec §376-384) that re-touches a row when its prompt source changes — is a SEPARATE increment the spec itself defers ("deferred to its own A/B-gated increments"); it is NOT built here. The FD4.2 R-rule lints (R4/R5/R7 injection-exposed-JUDGE bans, R8 Flash-Lite pin as a LINT) are the next increment and are not built here either.
+
+## 3. Level-of-abstraction fit
+
+Correct altitude. The classification lives beside its sibling axes (`LLM_UNTRUSTED_INPUT`, `LLM_ROUTING_NATURE`) in the same data module and rides the same exhaustive-ratchet pattern. The gate is a pure predicate consulted by the existing `resolveRoute` fold (the spec's own framing: "the safety/injection/allowlist/R-rule checks are candidate-eligibility FILTERS … each a pure predicate"), injected as a dep so exposure is evaluated fresh per call — not a new engine, not a new config surface. A smarter gate does not already own this; injection-exposure is intrinsic to routing and has no other home.
+
+## 4. Signal vs authority compliance
+
+Compliant. The injection-exposure map is deterministic build-time DATA (a signal, like the nature map), enforced by an exhaustive ratchet — it is not a brittle runtime check with blocking authority. The gate DOES exercise authority (it removes a candidate door), but only ever in the SAFE direction (toward a more-careful door / fail-closed for a critical gate), on a MODEL-ROUTING decision — it never blocks a user message, never reads or credits a principal identity, never grants anything. The per-call flag can only tighten, never relax, so a forgotten callsite cannot open a non-injection door. `docs/signal-vs-authority.md` satisfied.
+
+## 5. Interactions
+
+Interacts with `resolveRoute` (one skip predicate in the availability loop, placed AFTER the metered skip so the metered `groq-api` is already excluded → guaranteed no-op) and the class `evaluate()` caller (composes the per-call tighten). It does NOT shadow the FD4 harness-door clamp (orthogonal: FD4 governs the claude-code door, FD5b governs `injectionSafe:false` doors) and does not double-fire. Existing resolver tests (all exposed:true real components on default chains) are unaffected because no non-metered default door is a non-injection door. The A1 `clampClaudeCliSwapModel` degrade clamp is untouched (its assertion stays green).
+
+## 6. External surfaces
+
+No external surface. No new HTTP route, CLI command, MCP tool, Telegram/Slack path, or network egress. `attribution.injectionExposed` is an additive optional field — every existing caller is byte-identical (omitted ⇒ static map authoritative).
+
+## 6b. Operator-surface quality
+
+No operator-facing surface added or changed. The `injectionUnsafe` skip reason is an internal code comment/marker for the future FD5 structured-reason-code surface; nothing is emitted to a user yet. No secrets, tokens, or file paths surface anywhere.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local by design, and correctly so. The injection-exposure map is static source data compiled into every machine identically; `resolveInjectionExposure` is a pure per-call function over that data with no persisted or replicated state. Each machine resolves the identical verdict for the same component independently — there is no cross-machine state to strand, replicate, or coalesce. A per-call `attribution.injectionExposed` is scoped to the single call on the machine serving it. No lease, ledger, or notice interaction.
+
+## 8. Rollback cost
+
+Low and clean. Revert the PR: the map + resolver + gate predicate + the optional type field drop out; `resolveRoute` returns to the pre-FD5b availability walk (which, in Increment A, produced identical routes). No migration, no persisted state, no config schema change, no data-format change. Because the gate only runs when `natureRouting.enabled` AND is a no-op over the shipped chains, a rollback is invisible to every fleet agent (feature dark) and to any dev agent in dryRun.
+
+## Conclusion
+
+FD5b ships the fail-safe injection-exposure classification and the resolve-time gate that structurally seals an injection-exposed call off a non-injection door — a no-op in Increment A (the one non-injection door is also metered), byte-identical when the feature is off, and dark/dev-gated. The classification is exhaustive and cross-checked against the reviewed `LLM_UNTRUSTED_INPUT` axis so it cannot silently diverge; the prompt-anchor fingerprint LINT (FD7 semantic-drift) and the FD4.2 R-rule lints are the tracked next increments, not built here.

package/upgrades/side-effects/self-deferral-guard-shadow.eli16.md

@@ -0,0 +1,48 @@
+# ELI16 — a quiet watcher that notices when I try to hand you back work I could do myself
+
+## The problem this fixes
+
+There's a specific way I let you down that nothing was catching. At the end of a turn I'd sometimes
+write something like "I've stopped here — want me to line that up, or would you rather steer me
+elsewhere?" — handing YOU a decision about work that I could actually just do myself. It sounds polite
+and reasonable, so none of the existing guards flagged it: it wasn't a routed message, it didn't match
+any banned phrase, and it ended with a real-sounding question that the meaning-based rules are told to
+let through. The one check smart enough to catch it (a meaning-based judge) wasn't watching the
+turn-end surface at all, and outside an autonomous run there was no always-on "could you do this
+yourself?" check anywhere.
+
+## What this change adds (and, just as important, what it does NOT do)
+
+It puts a meaning-based judge on the turn-end surface that, on every finished turn, quietly asks: "did
+this message hand the operator a decision about work the agent could do within its own means?" It reads
+a little recent conversation (your last few messages) so it can tell a genuine "your call" (taste,
+priority, a credential only you have) apart from me punting work I should just do. It writes down what
+it saw.
+
+Crucially, in this phase it **blocks nothing**. It never stops a message, never delays a turn, never
+changes what I say. It only records — so we can measure how often it fires and how accurate it is
+before ever deciding whether to let it actively intervene. That "actively stop me" version is a
+separate, deliberately-deferred piece of work with its own hard design questions (chiefly: how to make
+it impossible for me to quietly switch off or game, and how to guarantee it never wrongly blocks you).
+
+## Why it's safe
+
+- **It cannot wedge a turn.** It rides the single check that already runs at every turn-end (no new
+  model call, no second judge), it only adds fields on the "allow" path, and it never touches the
+  blocking logic. Every message still ends exactly as it would have.
+- **The context read can't hang me.** Reading your recent turns is a bounded, fail-open tail-read: it
+  scans at most a small slice from the end of the transcript, caps each turn's length, and on anything
+  weird (missing file, giant line, bad data) it simply proceeds with no context instead of erroring.
+- **It's off on the fleet by default.** It only turns on for a development agent (me), so it soaks on
+  one agent first. When off, nothing is recorded and the base behavior is byte-for-byte unchanged —
+  I even proved the shared judge prompt is untouched when the feature is off.
+- **It's reversible.** No blocking, and the only new state is extra columns in an existing local
+  telemetry database (with a real prune so it can't grow forever) — turning the flag off stops it cold.
+
+## How we know it works
+
+Fifty-five tests across five new suites: the classifier catches a real self-deferral and correctly lets
+a genuine "your call" through; the tricky case (a design-question shape that's actually me punting
+doable work) resolves the right way; the existing rules' verdicts are proven unchanged by the prompt
+edit; the database migration adds its columns idempotently on an old database and prunes old rows; and
+the transcript reader stays bounded and never throws on bad input.