instar 1.3.802 → 1.3.803

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-10T10:30:16.122Z",
-  "instarVersion": "1.3.802",
+  "generatedAt": "2026-07-10T20:50:06.698Z",
+  "instarVersion": "1.3.803",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1562,7 +1562,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "edf52d24d575e7dd9b2f77507d8e170f328ade6f6340409a00efa92afbb53411",
+      "contentHash": "713f6e606525e07399b0bb42f4d9c9e3695289e45485c4b73e9d1a8907032a9f",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -928,7 +928,7 @@ ${SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION(port)}
 - See current routing: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/intelligence/routing"\` → \`{ defaultFramework, components: [{ component, category, framework, available }], coverage }\`. On a Codex-active agent, sentinel/gate/reflector resolve to \`codex-cli\`; \`job\` (cost-bearing background work, e.g. CartographerSweep) stays on the agent default.
 - Override in \`.instar/config.json\` → \`sessions.componentFrameworks\`, e.g. \`{ "categories": { "sentinel": "codex-cli", "gate": "codex-cli" }, "overrides": { "CoherenceReviewer": "claude-code" }, "fallback": "default" }\` — an explicitly-set block is used verbatim (the default no longer applies). Categories: \`sentinel | gate | job | reflector | other\`. Resolution: \`overrides[name] → categories[category] → default\`. Frameworks: \`claude-code | codex-cli | gemini-cli | pi-cli\`. **Rollback lever:** set \`componentFrameworks\` to \`{}\` (explicit empty) to force everything back to the default framework with no swap — today's pre-default behavior.
 - Each framework gets its own circuit breaker (a Claude trip can't pause Codex). If a routed framework's CLI is missing it degrades to the default and reports it. A gating call's failure-swap is bounded by a per-attempt timeout (default 5s, \`intelligence.swapAttemptTimeoutMs\`) so a slow provider is abandoned at the cap, not waited on in full. Routes INTERNAL component calls only — spawned interactive sessions stay governed by \`topicFrameworks\`.
-- **Non-gating calls also get a bounded swap now** (\`intelligence.nonGatingFailureSwap\`, default ON): a non-gating internal call (e.g. \`TopicIntentExtractor\`) that suffers an INVOCATION-level primary failure (the CLI spawn/timeout/empty-output errored with ZERO tokens) gets ONE bounded, herd-safe swap onto the next active off-Claude framework instead of hard-erroring — tighter than the gating swap: at most one step, NEVER onto \`claude-code\`/the default framework (non-gating background traffic must never herd onto the Claude tail), and NEVER on a content/parse error that already burned tokens (the caller fail-opens that). Disable with \`intelligence.nonGatingFailureSwap.enabled: false\`. Proactive: "why did my background classifier's error rate drop / does a non-gating call fall back too?" → this bounded swap. (Spec: \`docs/specs/nongating-failure-swap.md\`.)
+- **Non-gating calls also get a bounded swap now** (\`intelligence.nonGatingFailureSwap\`, default ON): a non-gating internal call (e.g. \`TopicIntentExtractor\`) that suffers an INVOCATION-level primary failure (the CLI spawn/timeout/empty-output errored with ZERO tokens) gets ONE bounded, herd-safe swap onto the next active off-Claude framework instead of hard-erroring — tighter than the gating swap in reach (at most one step, NEVER onto \`claude-code\`/the default framework), but with its own longer attempt timeout (\`intelligence.nonGatingSwapTimeoutMs\`, default 15000ms) so cold-start providers can answer. Safety-gating swaps still use \`intelligence.swapAttemptTimeoutMs\` (default 5000ms). Disable with \`intelligence.nonGatingFailureSwap.enabled: false\`. Proactive: "why did my background classifier's error rate drop / does a non-gating call fall back too?" → this bounded swap. (Spec: \`docs/specs/nongating-failure-swap.md\`.)
 - **When to use** (PROACTIVE): when the user is hitting rate limits and asks how to spread load, or says "run my sentinels on Codex" / "move the background checks off Claude" → point them at \`sessions.componentFrameworks\` and \`GET /intelligence/routing\`. Restart sessions to apply (config is read into the router at the call path, but a file edit needs the server to pick it up). (Spec: \`docs/specs/per-component-framework-routing.md\`.)
 
 **Topic Profile (per-topic model, thinking, framework pins)** — Every conversation topic can carry a durable profile pinning its BASELINE model (an explicit id OR a tier — never both), thinking depth (\`off\`/\`low\`/\`medium\`/\`high\`/\`max\`), and framework (\`claude-code\`/\`codex-cli\`/…). Pins survive restarts and follow the topic. **The conversational surface is PRIMARY** (PROACTIVE — these are the triggers): when the user says "use codex here", "pin this topic to Fable", or "set high thinking on this topic", that IS the request — propose the change back in plain words, confirm, and the pin is durable from then on. NEVER instruct the user to type \`/topic\`; the \`/topic\` command exists only as a power-user convenience.

package/upgrades/1.3.803.md

@@ -0,0 +1,24 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Non-gating provider failure-swaps now use `intelligence.nonGatingSwapTimeoutMs`, defaulting to 15000ms, instead of inheriting the global safety-gating `intelligence.swapAttemptTimeoutMs` default of 5000ms. Safety-gating swaps keep the existing 5s fail-closed bound. This lets cold-start providers such as `pi-cli` serve advisory/background swaps without making gates wait longer.
+
+## What to Tell Your User
+
+Background internal LLM calls that fail over to another provider are more patient now. If a provider needs a cold start, Instar gives that non-gating swap up to 15 seconds by default, while safety gates still keep their fast 5-second timeout. You can tune the non-gating value with the intelligence non-gating swap timeout setting.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|---|---|
+| Longer non-gating swap timeout | Set `intelligence.nonGatingSwapTimeoutMs` to tune how long advisory/background provider swaps can wait. |
+
+## Evidence
+
+- Unit: non-gating 6s swap succeeds with a 15s cap; gating 6s swap still times out at 5s; ConfigDefaults seeds the new value without overwriting operator overrides.
+- Integration: production-shaped router wiring passes the 15s non-gating cap and serves a 6s target.
+- E2E: AgentServer lifecycle wiring passes `timeoutMs: 15000` through the live non-gating swap path.

package/upgrades/side-effects/1.3.802.md

@@ -0,0 +1,31 @@
+# Side-Effects Review — v1.3.802 (version-named pairing)
+
+This is the version-named pairing for the v1.3.802 release, completing the
+rename step the release cut is expected to perform alongside the
+`NEXT.md → 1.3.802.md` guide rename (see `scripts/pre-push-gate.js` check 5:
+"the fragment/NEXT.md -> <version>.md rename pairs with an artifact rename").
+The release flow did not perform the artifact half of the pairing, which makes
+check 5 false-positive on every docs-only push from a clean post-release tree
+— the same recurrence previously repaired for v1.3.492
+(`upgrades/side-effects/1.3.492.md`).
+
+The actual side-effects reviews for everything shipped in the
+v1.3.800–v1.3.802 window are:
+
+- `upgrades/side-effects/attention-single-topic-routing.md`
+  (#1417, v1.3.800 — single-alerts-topic routing; every alert lands in the
+  ONE Attention hub by default)
+- `upgrades/side-effects/self-action-governor.md`
+  (#1418, v1.3.801 — SelfActionGovernor unified self-action backpressure
+  chokepoint, observe-only fleet-wide)
+- `upgrades/side-effects/session-listing-hygiene.md`
+  (#1419, v1.3.802 — bounded finished-session retention, active-by-default
+  `GET /sessions`, genuine cross-machine duplicate flag)
+
+Those artifacts are left in place under their slug names because each release
+guide's Evidence section cites them by those paths. This file exists so the
+repo state matches the gate's documented post-release expectation. The
+underlying gap (release automation never renames artifacts) remains logged in
+the framework-issues ledger under dedupKey
+`pre-push-gate-versioned-artifact-fallback`; this is its second observed
+recurrence after v1.3.492.

package/upgrades/side-effects/non-gating-swap-timeout.md

@@ -0,0 +1,103 @@
+# Side-Effects Review — Non-gating swap timeout
+
+**Version / slug:** `non-gating-swap-timeout`
+**Date:** `2026-07-10`
+**Author:** `instar-codey`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+`src/core/IntelligenceRouter.ts` now resolves non-gating failure-swap attempt caps from `nonGatingSwapTimeoutMs` instead of the global safety-gating `swapAttemptTimeoutMs`. `src/commands/server.ts` wires the new value from `config.intelligence?.nonGatingSwapTimeoutMs ?? 15000`, and `src/config/ConfigDefaults.ts` seeds that default through normal add-missing init/migration. The associated type, generated awareness text, and unit/integration/e2e tests were updated.
+
+## Decision-point inventory
+
+- `IntelligenceRouter.evaluate` gating/deferrable failure-swap loop — pass-through — still uses `swapAttemptTimeoutMs` and is intentionally unchanged.
+- `IntelligenceRouter.tryNonGatingSwap` — modified — chooses the timeout cap for non-gating swap attempts.
+- `ConfigDefaults.applyDefaults` migration path — pass-through — add-missing default seeding for the new config field.
+
+---
+
+## 1. Over-block
+
+No new block/allow surface. This change does not reject calls, messages, jobs, or operator actions. It lengthens only the timeout for non-gating swap attempts, so the over-block risk is not a false rejection; the relevant risk is extra wait time on advisory/background calls.
+
+---
+
+## 2. Under-block
+
+This does not change safety-gating fail-closed behavior. A non-gating call can now wait up to 15s for a cold-start provider before falling through, so a genuinely stuck non-gating provider may occupy its attempt for longer than before. The attempt remains bounded, still respects maxAttempts, still excludes Claude/default targets, and still reports timeout degradation.
+
+---
+
+## 3. Level-of-abstraction fit
+
+The router is the right layer because it already owns provider failure-swap attempt timing and timeout propagation to providers. ConfigDefaults is the right layer for the default because the task requires existing agents to receive the knob through add-missing migration while preserving operator overrides.
+
+---
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface.
+
+This is a timeout policy split inside an existing retry mechanism. It does not add a detector or an authority, and it does not make a semantic decision about user intent or message meaning.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** The non-gating helper now has its own global fallback cap. Per-target framework caps still shadow it when configured for a target, preserving the existing specificity order.
+- **Double-fire:** No new reporter path is added. Existing timeout degradation reasons continue to fire when an attempt times out.
+- **Races:** No shared mutable state is added. The cap is read from router options and applied per call.
+- **Feedback loops:** Longer non-gating waits can reduce heuristic fallback churn but do not change retry counts, scheduler cadence, or provider circuit-breaker rules.
+
+---
+
+## 6. External surfaces
+
+Operators get a new config knob: `intelligence.nonGatingSwapTimeoutMs`, default 15000. Existing config migration adds the missing value and preserves explicit overrides. Existing agent awareness text now mentions the knob. No Telegram, Slack, GitHub, Cloudflare, dashboard UI, persistent database schema, or URL surface changes. No operator-facing action is added.
+
+---
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+---
+
+## 7. Multi-machine posture
+
+Machine-local by design. This is per-agent runtime configuration read from that agent's local `.instar/config.json`. On multi-machine setups, each machine may tune the timeout to its own provider startup behavior. It emits no user-facing notices directly, holds no new durable state beyond config defaults, and generates no URLs.
+
+---
+
+## 8. Rollback cost
+
+Hot-fix release: revert the router option, config default, server wiring, awareness text, and tests. No data migration or agent state repair is needed. Existing configs that received `nonGatingSwapTimeoutMs: 15000` would carry an unused field after rollback, which is harmless.
+
+---
+
+## Conclusion
+
+Clear to ship. The change fixes the observed cold-start timeout without slowing safety gates. The main side effect is intentional: non-gating internal calls may wait longer before falling back to heuristics, but the wait remains bounded and scoped away from the gating fail-closed path.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** not required
+**Independent read of the artifact:** not required
+
+---
+
+## Evidence pointers
+
+- `instar dev:claim-check src/core/IntelligenceRouter.ts src/core/types.ts src/config/ConfigDefaults.ts src/commands/server.ts src/core/PostUpdateMigrator.ts src/scaffold/templates.ts`
+- `npm test -- tests/unit/nongating-failure-swap.test.ts tests/unit/ConfigDefaults.test.ts tests/unit/PostUpdateMigrator-nonGatingFailureSwap.test.ts tests/integration/nongating-failure-swap-routing.test.ts tests/e2e/nongating-failure-swap-lifecycle.test.ts`
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered controller addition — not applicable.