instar 1.3.778 → 1.3.779

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.778",
+  "version": "1.3.779",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-05T19:17:42.966Z",
-  "instarVersion": "1.3.778",
+  "generatedAt": "2026-07-05T19:32:09.472Z",
+  "instarVersion": "1.3.779",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "cb70a8db8fd86ce888abf8d2c25ab6980b81c5f831ece31163d685108df005dc",
+      "contentHash": "1c360814d5b4976b26dce17142525ad2619cea43cbba1228b4748b4bb9bed350",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.779.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+Added a READ-ONLY "routing map" surface (Surface 3 of the routing control-room; FD11 readable canary, docs/specs/nature-axis-routing.md).
+
+- New pure composer `src/core/natureRoutingMap.ts` (`buildNatureRoutingMap` / `traceComponent`) that reads the shipped static routing maps (`NATURE_ROUTING_DEFAULT_CHAINS`, `LLM_ROUTING_NATURE`, `ROUTING_LABEL_TO_MODEL_ID`, `NATURE_ROUTING_CRITICAL_GATES`, `LLM_UNTRUSTED_INPUT`, door taxonomy) and composes them into a display structure. Zero writes, mutates no config, changes no routing behavior.
+- New Bearer-auth sibling route `GET /intelligence/routing/chains` — for every `knownComponents()` entry: its nature/chain, the ordered door+model fallback list (each label mapped to its concrete model id), and per-position/per-component flags (door class, injection-safe, money-gated, metered-skipped-in-Increment-A, critical-gate, untrusted-input). Optional `?trace=<component>` drills into one job-kind. Same 503-when-no-IntelligenceRouter shape as the legacy `GET /intelligence/routing`, which is left untouched.
+- New "Routing Map" dashboard tab that renders the map as two tables (the four lanes + a by-job-kind breakdown). Read-only, no controls beyond Refresh.
+- Tests: `tests/unit/nature-routing-map.test.ts` (composition + purity) and `tests/integration/intelligence-routing-chains-route.test.ts` (alive 200-not-503, `?trace`, 503-when-no-router, legacy route unchanged).
+
+Read-only and reversible: no behavior change, no money, no PIN. The write/adjust/go-live controls (Surfaces 1/2, money/PIN-gated) are out of scope.
+
+## What to Tell Your User
+
+- **See where your AI work is routed**: "There's a new Routing Map page in your dashboard. It shows, for every background AI job I run, which model provider it uses and its full ordered backup list if the first one is unavailable — plus a note on any that are paid or reserved. It's read-only: it just shows the map, it doesn't change anything."
+
+## Summary of New Capabilities
+
+A new read-only observability surface for the internal LLM routing map — one API route (`GET /intelligence/routing/chains`) and one dashboard tab ("Routing Map"). It lets an operator see, for every internal AI job-kind, which door + model it uses and its full ordered fallback list, without changing any routing behavior.

package/upgrades/eli16/routing-map-surface.md

@@ -0,0 +1,41 @@
+# Routing Map surface — Plain-English Overview
+
+> The one-line version: a new read-only dashboard page (and the API behind it) that shows, for every internal AI job the agent runs, which "door" and model it uses and its full ordered fallback list — a map you can read, that changes nothing.
+
+## The problem in one breath
+
+Instar routes its background AI work (sentinels, gates, summarizers) across several "doors" — Claude Code, Codex, Gemini, and some paid API doors — each with an ordered fallback list. That routing map already exists in code as static data, but there was no way to actually SEE it: an operator diagnosing an unexpected route had to piece it together from source files and live config. This adds a single readable surface for "which door + model does each job-kind use, and what does it fall back to?"
+
+## What already exists
+
+- **The four routing lanes ("chains")** — `FAST`, `SORT`, `JUDGE`, `WRITE`, each an ordered list of `{door, model}` positions with flags (money-gated, injection-safe, metered). Pure static data in `src/data/llmBenchCoverage.ts`.
+- **The job-kind → lane registry** — a map from each internal component (MessagingToneGate, PresenceProxy, …) to its nature + lane.
+- **The label → concrete-model-id registry** — resolves a benchmark label like `gpt-5.5` to the real model id.
+- **The legacy route `GET /intelligence/routing`** — already shows the live "which framework does each component use" view (a different, narrower question). We do NOT touch it.
+- **The `LLM Activity` dashboard tab** — the existing pattern for a read-only observability tab. We mirror it exactly.
+
+## What this adds
+
+One new read-only API route and one new read-only dashboard tab. The route (`GET /intelligence/routing/chains`) composes the existing static maps into a single structure: every known job-kind, its lane, and its full ordered door+model fallback list, each position annotated (metered/skipped-now, money-gated, unsafe-for-untrusted-input, critical-gate). The dashboard "Routing Map" tab renders that as two clear tables. Nothing is added to the routing logic — the page only DISPLAYS the maps the router already uses.
+
+## The new pieces
+
+- **`buildNatureRoutingMap()`** (a new pure module, `src/core/natureRoutingMap.ts`) — reads the shipped static maps and composes the display structure. It is side-effect-free: it performs zero writes, mutates no config, and changes no routing behavior. It is NOT allowed to select a route, adjust a cap, toggle anything, or touch money/PIN surfaces — it only describes.
+- **`GET /intelligence/routing/chains`** — a Bearer-auth sibling of the existing routing route. Same 503-when-no-router shape. Optional `?trace=<component>` drills into one job-kind. Pure reads.
+- **The "Routing Map" dashboard tab** — a read-only page, no inputs, no buttons that change state, just a Refresh.
+
+## The safeguards
+
+**Prevents any behavior change.** The whole feature is a read of static data plus a live read-only annotation (each component's currently-enforced framework). It never writes, never routes, never flips a flag. The legacy route is left byte-for-byte unchanged, verified by test.
+
+**Prevents scope creep into money/PIN territory.** This is explicitly Surface 3 (the read-only map) of a larger "control room". The write/adjust/go-live controls (Surfaces 1/2, money- and PIN-gated) are out of scope and untouched.
+
+**Prevents a broken map from misleading.** The page states plainly that it shows the shipped map, not live actuation (nature routing is dev-gated / dry-run), and that metered doors are skipped for now — so an operator never mistakes the map for "what ran".
+
+## What ships when
+
+All of it in one PR: the pure module, the route, the dashboard tab, and the tests (unit for the composer, integration/alive for the route returning 200 not 503). It is dark/reversible in the sense that it adds a surface only — removing it is a straight revert with no persistent state.
+
+## What you actually need to decide
+
+Ship a read-only routing-map page + API that displays the existing routing map without changing any routing behavior — yes/no?

package/upgrades/side-effects/routing-map-surface.md

@@ -0,0 +1,117 @@
+# Side-Effects Review — Read-only Routing Map surface (Surface 3)
+
+**Version / slug:** `routing-map-surface`
+**Date:** `2026-07-05`
+**Author:** `Echo (instar-dev build hand)`
+**Second-pass reviewer:** `not required (Tier 1, read-only surface)`
+
+## Summary of the change
+
+Adds a READ-ONLY "routing map" surface: a Bearer-auth API route `GET /intelligence/routing/chains` and a "Routing Map" dashboard tab. For every known internal job-kind (`knownComponents()`), it shows its nature/lane (`LLM_ROUTING_NATURE`), the ordered `NATURE_ROUTING_DEFAULT_CHAINS` fallback positions resolved to concrete model ids (`ROUTING_LABEL_TO_MODEL_ID`), and per-position/per-component flags (door class, per-position injection-safe, money-gated, metered-skipped-in-Increment-A, critical-gate, per-component untrusted-input, and the FD5b `LLM_ROUTING_INJECTION_EXPOSURE` classification — exposed + user/model/tool channels — surfaced now that it is on the rebased base). Files touched: new `src/core/natureRoutingMap.ts` (pure composer), `src/server/routes.ts` (one new sibling route + import), `dashboard/index.html` (nav button + panel + registry entry + `loadRoutingMap()`), and two new tests. It aligns with the spec's FD11 "readable canary" (`docs/specs/nature-axis-routing.md` §475). It composes existing static maps only — it changes NO routing behavior.
+
+## Decision-point inventory
+
+The change adds NO decision point. It is pure display of existing routing decisions.
+
+- `resolveRoute` / selection logic — pass-through (NOT touched; the map imports only the static data maps + `resolvePositionModelId`-equivalent label resolution).
+- `GET /intelligence/routing` (legacy category→framework view) — pass-through (untouched; a sibling route was added instead of extending it, to keep it byte-identical).
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. The route only returns data; it never rejects any input except an unknown `?trace=` name (a 404, correct).
+
+---
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct layer: an observability read surface, mirroring the existing `GET /intelligence/routing` + `LLM Activity` tab pattern. The composition logic lives in a pure `src/core/natureRoutingMap.ts` module (not in the route handler) so it is unit-testable in isolation and reusable; the route is a thin adapter that adds the one live read-only annotation (each component's currently-enforced legacy framework via `IntelligenceRouter.for`). It re-uses the shipped static maps rather than re-deriving routing — no parallel implementation of routing logic.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** docs/signal-vs-authority.md
+
+- [x] No — this change has no block/allow surface.
+
+It is a pure read. It holds zero authority: it cannot route, gate, block, or mutate anything. It only reads and formats existing data.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** none. The new route path (`/intelligence/routing/chains`) is distinct from the legacy `/intelligence/routing`; Express matches the exact path, no overlap. The 503-when-no-router guard mirrors the legacy route.
+- **Double-fire:** none — read-only, idempotent, no events emitted.
+- **Races:** none — reads shared IMMUTABLE static config maps (`NATURE_ROUTING_DEFAULT_CHAINS` etc.) and returns; writes nothing, holds no state.
+- **Feedback loops:** none — it does not feed any system; nothing consumes its output except a human reading the dashboard.
+
+Verified: an integration test asserts the legacy `GET /intelligence/routing` still returns its own shape (no `chains` key) and is not broken by the sibling.
+
+---
+
+## 6. External surfaces
+
+- **Other agents / install base:** none — a new read route + a new dashboard tab, both additive.
+- **External systems:** none — no Telegram/Slack/GitHub/Cloudflare calls; zero egress.
+- **Persistent state:** none — the composer and route write nothing to disk, config, ledgers, or memory. Purity is asserted by test (repeated calls deep-equal; the shared static input map is unchanged after a build).
+- **Operator surface (Mobile-Complete):** the new dashboard tab IS the operator surface, and it is fully phone-reachable via the standard dashboard (PIN-gated) — no API-only action. There is no operator ACTION here (nothing to do but read/refresh), so Mobile-Complete is trivially satisfied.
+- **Timing/runtime:** none.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+This change touches an operator surface (`dashboard/index.html`), so the operator-surface quality review is required.
+
+1. **Leads with the primary action?** Yes. The tab's purpose is to READ the routing map; on arrival it shows the four lanes and the by-job-kind table immediately (the loader fires on tab activation). There is no primary "action" to lead with beyond the content itself; a single Refresh button sits top-right, matching the sibling `LLM Activity` tab.
+2. **Zero raw internals as primary content?** The subject matter here IS technical identifiers (door names and model ids) — that is the whole point of a routing map, exactly as the `LLM Activity` tab shows provider + model names. They are presented in labeled table columns and plain-language flag chips ("metered · skipped now", "money-gated", "unsafe for untrusted input", "no-Claude"), NOT as raw JSON blobs, UUIDs, or hashes. A plain-English intro paragraph frames the page in non-engineer language. There are no inputs asking the operator to paste raw text (verified: the surface has no `<input>`/`<textarea>`; the raw-input lint passes).
+3. **Destructive actions de-emphasized?** No destructive actions exist on this surface (read-only) — nothing to revoke/delete/stop.
+4. **Plain language + phone width?** The lane cards use an auto-fit responsive grid (`minmax(240px,1fr)`) that stacks at phone width; the by-job-kind table lives in an `overflow-x:auto` container (matching the `LLM Activity` table pattern) so it scrolls inside its own box rather than breaking the page. Labels read plainly ("Job-kind", "Lane", "Enforced now", "Critical gate", "Untrusted input", "Fallback order").
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN — pure per-machine observability.** The routing map is composed from static code-shipped data (identical on every machine of the same version) plus each machine's own live enforced-framework read. There is no durable state to strand on a topic transfer, no user-facing notice (so no one-voice gating needed), and no generated URL (so nothing to survive a machine boundary). An operator viewing the tab on any machine sees that machine's map; since the static data is version-pinned, the map is the same across machines at the same version (a version-skew would show honestly via the machine's own model ids). No pool-wide merge is warranted — "which doors does THIS machine's build route to" is a per-machine truth.
+
+---
+
+## 8. Rollback cost
+
+- **Hot-fix release:** pure additive code change — revert the route + module + dashboard additions and ship as the next patch.
+- **Data migration:** none — no persistent state introduced.
+- **Agent state repair:** none — no existing agents need notification or reset; the surface simply disappears on revert.
+- **User visibility:** none beyond the tab vanishing; no regression to any existing behavior during the rollback window (the legacy route and all routing logic are untouched).
+
+---
+
+## Conclusion
+
+This review produced no design changes. The feature is a pure, additive, read-only observability surface that displays the existing routing map without altering any routing behavior, holding any authority, or writing any state. It is clear to ship. Scope was deliberately confined to Surface 3 (the read-only map); the money/PIN-gated write controls (Surfaces 1/2) are explicitly out of scope and untouched.
+
+---
+
+## Second-pass review (if required)
+
+Not required — Tier 1, read-only surface, no block/allow authority, no persistent state.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/nature-routing-map.test.ts` — composer resolves known components to expected ordered chains + model ids + flags; purity assertion (repeated calls deep-equal, static input unmutated).
+- `tests/integration/intelligence-routing-chains-route.test.ts` — alive test (200 + full map, not 503); `?trace` + 404; 503 when no router; legacy route unchanged; deterministic across calls.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered controller — not applicable. This change adds no loop/monitor/sentinel/reaper/scheduler/recovery path; it is a passive read surface.