instar 1.3.815 → 1.3.816

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.815",
+  "version": "1.3.816",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-11T04:54:52.556Z",
-  "instarVersion": "1.3.815",
+  "generatedAt": "2026-07-11T05:06:27.692Z",
+  "instarVersion": "1.3.816",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1562,7 +1562,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "93f638d73e5fd2f3b55f893c91ad3358c2124721ca6c7222841d3e3b67260de7",
+      "contentHash": "9eaf18f016eee4b02c4ec3e946c783be1ef91e9425d747171e00bf2c0f1847e0",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.816.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The external-operation PreToolUse hook now fast-paths only explicitly read-only MCP actions. Unrecognized action verbs are classified as `modify` and sent to the existing gate for the authoritative decision instead of silently bypassing evaluation.
+
+## What to Tell Your User
+
+Novel or unusually named external-service actions now receive the same safety evaluation as recognized writes and modifications. Familiar read-only actions remain fast and unchanged.
+
+## Summary of New Capabilities
+
+- Explicit read-only verb allowlist for MCP action classification.
+- Unknown verbs route to the gate as `modify` rather than inheriting read safety.
+- Existing delete, write, and modify prefixes retain their established classifications.
+- Fresh installs, upgrades, and Codex hook installs share the corrected canonical hook source.
+
+## Evidence
+
+Real generated-hook tests prove seven bypass-class verbs attempt a gate call as `modify`, four representative read verbs make zero gate calls, and delete/send/update retain their original classifications. Adjacent installer, Codex wiring, and server-side fail-safe tests pass.

package/upgrades/side-effects/external-operation-unknown-verbs.md

@@ -0,0 +1,85 @@
+# Side-Effects Review — Unknown external-operation verbs reach the gate
+
+**Version / slug:** `external-operation-unknown-verbs`
+**Date:** `2026-07-10`
+**Author:** `instar-codey`
+**Second-pass reviewer:** `framework_guard_review`
+
+## Summary of the change
+
+`PostUpdateMigrator.getExternalOperationGateHook()` now defaults unmatched MCP action verbs to `modify` and grants the zero-round-trip read fast path only to an explicit, narrow allowlist. The same generated source reaches fresh installs, always-overwrite migrations, and Codex hook installs. Runtime tests execute the generated hook against a real gate endpoint and lock both sides of the boundary.
+
+## Decision-point inventory
+
+- Hook mutability detector — modify — unknown verbs emit `modify`; explicit reads emit `read`; known destructive prefixes retain their categories.
+- Read fast path — constrain — only the explicit read vocabulary exits before the API.
+- External Operation Gate authority — pass-through — continues to decide allow, plan, alternative, or block for every non-read classification.
+
+## 1. Over-block
+
+A novel but genuinely read-only MCP action whose first verb is absent from the allowlist incurs one gate round-trip and may receive the gate's normal approval workflow. The hook itself does not block it. This conservative cost is intentional: adding an ambiguous verb to the read fast path would recreate the safety bypass.
+
+## 2. Under-block
+
+The hook still relies on action-name vocabulary; a deliberately misleading connector action could avoid every known mutation token. Connector naming is not a semantic proof system. Compound names that begin with a read verb but contain a known mutating token are explicitly routed to the gate. The gate-unreachable and malformed-input fail-open postures remain byte-unchanged per task scope; this change closes classification bypass while preserving availability policy.
+
+## 3. Level-of-abstraction fit
+
+The hook remains a low-context detector. It classifies obvious verbs and routes uncertainty toward `ExternalOperationGate`, the existing context-rich authority. It does not add a second blocking decision. The inline vocabulary is necessary because the deployed hook is standalone; a lockstep comment points future editors at the server-side `computeRiskLevel` twin.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] The hook produces a conservative mutability signal consumed by the existing External Operation Gate authority.
+
+Unknown verbs are not hard-failed. They become `modify`, reach `/operations/evaluate`, and receive the gate's normal policy/LLM decision. The only local bypass is the enumerated unambiguous-read fast path.
+
+## 5. Interactions
+
+- **Shadowing:** explicit reads still exit before gate evaluation; all other actions reach the same existing gate.
+- **Double-fire:** each hook invocation makes at most one evaluation request; no new retry or secondary authority exists.
+- **Races:** classification is pure per invocation and introduces zero shared state.
+- **Feedback loops:** the change adds zero scheduling, retries, or self-triggered actions.
+- **Deployment:** `migrateHooks()` always overwrites the built-in hook and init consumes `getHookContent`; Codex registration points at that same deployed file. The repository's local `.instar/hooks` runtime copy remains machinery-owned and is not hand-synchronized.
+
+## 6. External surfaces
+
+Unrecognized external-service action names now become visible to the operation gate and its existing audit/approval surfaces. Explicit reads and gate response formats remain unchanged. The change adds zero routes, configuration keys, credentials, persistent schemas, or operator forms.
+
+## 6b. Operator-surface quality
+
+Operator surface unchanged; this criterion is not applicable.
+
+## 7. Multi-machine posture
+
+**Machine-local by design:** each machine evaluates its local session's external tool call against its local gate and trust state. Deployment is fleet-wide through the normal update path, but runtime decisions remain machine-local security events. The change emits zero direct user notices, holds zero new durable state, leaves topic transfer unchanged, and generates zero URLs.
+
+## 8. Rollback cost
+
+Pure generated-hook and test rollback: revert and ship a patch. The next migration re-stamps the prior hook. There is no data migration or state repair; rollback would restore the unknown-verb bypass until the subsequent fix deploys.
+
+## Conclusion
+
+The hook now fails toward the authority rather than pre-judging unfamiliar vocabulary as safe. Independent review caught and corrected two boundary defects before commit: `purge` remains an existing delete classification, and compound read-prefixed mutators are excluded from the fast path by full-token inspection. The gate-unreachable posture is untouched and all three deployment consumers remain single-sourced. Clear to ship after revised concurrence and CI.
+
+## Second-pass review
+
+**Reviewer:** framework_guard_review
+**Independent read of the artifact:** concur
+
+The first review raised two boundary concerns: preserve `purge` as delete, and prevent read-prefixed compound mutators from bypassing evaluation. Both were corrected. Revised review confirms explicit read-leading verbs bypass only when every tail token is non-mutating; unknown standalone and adversarial compound verbs reach the authority, deployment stays single-sourced, and the reviewer's focused suite passed 14/14.
+
+## Evidence pointers
+
+- `tests/unit/hook-installation.test.ts`
+- `tests/unit/ExternalOperationGate.test.ts`
+- `tests/unit/installCodexHooks.test.ts`
+- `tests/unit/codex-hooks-wiring.test.ts`
+
+## Class-Closure Declaration
+
+- `defectClass`: `novel` — proposed registry id `unknown-classification-fail-open`.
+- `closure`: `gap`.
+- `gap`: `ACT-001` tracks operator confirmation/refinement and class-wide recurrence standardization.
+- `novelClass`: nearest existing class is `prompt-parser-contract-drift`; that class covers rendered prompt/parser contract mismatch, while this class covers unmatched runtime classifier input inheriting privileged-safe authority.