instar 1.3.968 → 1.3.970

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-25T18:43:56.892Z",
-  "instarVersion": "1.3.968",
+  "generatedAt": "2026-07-25T21:42:13.777Z",
+  "instarVersion": "1.3.970",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -154,7 +154,7 @@
       "type": "job",
       "domain": "monitoring",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:reflection-trigger": {
@@ -162,7 +162,7 @@
       "type": "job",
       "domain": "evolution",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:relationship-maintenance": {
@@ -170,7 +170,7 @@
       "type": "job",
       "domain": "relationships",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:feedback-retry": {
@@ -178,7 +178,7 @@
       "type": "job",
       "domain": "feedback",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:insight-harvest": {
@@ -186,7 +186,7 @@
       "type": "job",
       "domain": "evolution",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:evolution-overdue-check": {
@@ -194,7 +194,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:project-map-refresh": {
@@ -202,7 +202,7 @@
       "type": "job",
       "domain": "mapping",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:coherence-audit": {
@@ -210,7 +210,7 @@
       "type": "job",
       "domain": "coherence",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:templates-drift-verifier": {
@@ -218,7 +218,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:degradation-digest": {
@@ -226,7 +226,7 @@
       "type": "job",
       "domain": "monitoring",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:state-integrity-check": {
@@ -234,7 +234,7 @@
       "type": "job",
       "domain": "monitoring",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:memory-hygiene": {
@@ -242,7 +242,7 @@
       "type": "job",
       "domain": "memory",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:guardian-pulse": {
@@ -250,7 +250,7 @@
       "type": "job",
       "domain": "monitoring",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:session-continuity-check": {
@@ -258,7 +258,7 @@
       "type": "job",
       "domain": "sessions",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:memory-export": {
@@ -266,7 +266,7 @@
       "type": "job",
       "domain": "memory",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:git-sync": {
@@ -274,7 +274,7 @@
       "type": "job",
       "domain": "coordination",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:capability-audit": {
@@ -282,7 +282,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:identity-review": {
@@ -290,7 +290,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:evolution-proposal-evaluate": {
@@ -298,7 +298,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:evolution-proposal-implement": {
@@ -306,7 +306,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:commitment-detection": {
@@ -314,7 +314,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:dashboard-link-refresh": {
@@ -322,7 +322,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:overseer-guardian": {
@@ -330,7 +330,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:overseer-learning": {
@@ -338,7 +338,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:overseer-maintenance": {
@@ -346,7 +346,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:overseer-infrastructure": {
@@ -354,7 +354,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "job:overseer-development": {
@@ -362,7 +362,7 @@
       "type": "job",
       "domain": "general",
       "sourcePath": "src/commands/init.ts",
-      "contentHash": "7d9f15a3af92fd19211fc184aeb433369a89be42367e1ee1688bb4a1dabda245",
+      "contentHash": "bd7066e7558b197e3bc8b3dd75794bd3799c6fc0b3438dcb58d1a38086ea575f",
       "since": "2025-01-01"
     },
     "skill:autonomous": {

package/src/scaffold/templates/jobs/instar/evolution-overdue-check.md

@@ -16,14 +16,18 @@ toolAllowlist: "*"
 unrestrictedTools: true
 mcpAccess: none
 ---
-Check for overdue commitments: curl -s http://localhost:${INSTAR_PORT:-4042}/evolution/actions/overdue
+AUTH="${INSTAR_AUTH_TOKEN:-$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)}"
+AGENT_ID="${INSTAR_AGENT_ID:-$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('projectName',''))" 2>/dev/null)}"
+PORT="${INSTAR_PORT:-4042}"
+
+Check for overdue commitments: curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution/actions/overdue
 
 For each overdue action:
 1. Assess: Can this be completed now? Is it still relevant?
 2. If actionable, attempt to complete it or advance it
-3. If no longer relevant, cancel it: curl -s -X PATCH http://localhost:${INSTAR_PORT:-4042}/evolution/actions/ACT-XXX -H 'Content-Type: application/json' -d '{"status":"cancelled","resolution":"No longer relevant because..."}'
+3. If no longer relevant, cancel it: curl -s -X PATCH -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution/actions/ACT-XXX -H 'Content-Type: application/json' -d '{"status":"cancelled","resolution":"No longer relevant because..."}'
 4. If blocked, escalate to the user via Telegram (if configured)
 
-Also check pending actions (curl -s http://localhost:${INSTAR_PORT:-4042}/evolution/actions?status=pending) for items that have been pending more than 48 hours without a due date — these are forgotten commitments.
+Also check pending actions (curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" "http://localhost:$PORT/evolution/actions?status=pending") for items that have been pending more than 48 hours without a due date — these are forgotten commitments.
 
 If no overdue or stale items, exit silently.

package/src/scaffold/templates/jobs/instar/evolution-proposal-evaluate.md

@@ -16,16 +16,20 @@ toolAllowlist: "*"
 unrestrictedTools: true
 mcpAccess: none
 ---
-Review pending evolution proposals: curl -s http://localhost:${INSTAR_PORT:-4042}/evolution/proposals?status=proposed
+AUTH="${INSTAR_AUTH_TOKEN:-$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)}"
+AGENT_ID="${INSTAR_AGENT_ID:-$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('projectName',''))" 2>/dev/null)}"
+PORT="${INSTAR_PORT:-4042}"
+
+Review pending evolution proposals: curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" "http://localhost:$PORT/evolution/proposals?status=proposed"
 
 For each proposal:
 1. Read the title, description, type, and source
 2. Evaluate: Is this a genuine improvement? Is the effort worth the impact? Does it align with our goals?
-3. If approved, update status: curl -s -X PATCH http://localhost:${INSTAR_PORT:-4042}/evolution/proposals/EVO-XXX -H 'Content-Type: application/json' -d '{"status":"approved"}'
+3. If approved, update status: curl -s -X PATCH -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution/proposals/EVO-XXX -H 'Content-Type: application/json' -d '{"status":"approved"}'
 4. If rejected or deferred, update with reason.
 
 Do NOT implement approved proposals — that's handled by the paired evolution-proposal-implement job.
 
-Also check the dashboard: curl -s http://localhost:${INSTAR_PORT:-4042}/evolution — report any highlights to the user if they seem important.
+Also check the dashboard: curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution — report any highlights to the user if they seem important.
 
 If no proposals need attention, exit silently.

package/src/scaffold/templates/jobs/instar/evolution-proposal-implement.md

@@ -15,11 +15,15 @@ gate: "curl -sf -H \"Authorization: Bearer $INSTAR_AUTH_TOKEN\" -H \"X-Instar-Ag
 toolAllowlist: "*"
 unrestrictedTools: true
 ---
-Implement approved evolution proposals: curl -s http://localhost:${INSTAR_PORT:-4042}/evolution/proposals?status=approved
+AUTH="${INSTAR_AUTH_TOKEN:-$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)}"
+AGENT_ID="${INSTAR_AGENT_ID:-$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('projectName',''))" 2>/dev/null)}"
+PORT="${INSTAR_PORT:-4042}"
+
+Implement approved evolution proposals: curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" "http://localhost:$PORT/evolution/proposals?status=approved"
 
 For each approved proposal:
 1. Read the full description and understand what needs to be built
 2. Implement it: create the skill/hook/job/config change described
-3. After implementation, mark complete: curl -s -X PATCH http://localhost:${INSTAR_PORT:-4042}/evolution/proposals/EVO-XXX -H 'Content-Type: application/json' -d '{"status":"implemented","resolution":"What was done"}'
+3. After implementation, mark complete: curl -s -X PATCH -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution/proposals/EVO-XXX -H 'Content-Type: application/json' -d '{"status":"implemented","resolution":"What was done"}'
 
 If no approved proposals exist, exit silently.

package/src/scaffold/templates/jobs/instar/identity-review.md

@@ -17,7 +17,7 @@ mcpAccess: none
 ---
 Identity review — check your identity coherence and growth.
 
-AUTH=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null)
+AUTH="${INSTAR_AUTH_TOKEN:-$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)}"
 AGENT_ID="${INSTAR_AGENT_ID:-$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('projectName',''))" 2>/dev/null)}"
 
 1. **Check soul.md drift**: curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:${INSTAR_PORT:-4042}/identity/soul/drift

package/src/scaffold/templates/jobs/instar/insight-harvest.md

@@ -14,7 +14,11 @@ toolAllowlist: "*"
 unrestrictedTools: true
 mcpAccess: none
 ---
-Harvest and synthesize learnings: curl -s http://localhost:${INSTAR_PORT:-4042}/evolution/learnings?applied=false
+AUTH="${INSTAR_AUTH_TOKEN:-$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)}"
+AGENT_ID="${INSTAR_AGENT_ID:-$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('projectName',''))" 2>/dev/null)}"
+PORT="${INSTAR_PORT:-4042}"
+
+Harvest and synthesize learnings: curl -s -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" "http://localhost:$PORT/evolution/learnings?applied=false"
 
 Review unapplied learnings and look for:
 1. **Patterns**: Multiple learnings pointing to the same conclusion
@@ -22,10 +26,10 @@ Review unapplied learnings and look for:
 3. **Cross-domain connections**: Insights from one area that apply to another
 
 For each actionable pattern found, create an evolution proposal:
-curl -s -X POST http://localhost:${INSTAR_PORT:-4042}/evolution/proposals -H 'Content-Type: application/json' -d '{"title":"...","source":"insight-harvest from LRN-XXX","description":"...","type":"...","impact":"...","effort":"..."}'
+curl -s -X POST -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution/proposals -H 'Content-Type: application/json' -d '{"title":"...","source":"insight-harvest from LRN-XXX","description":"...","type":"...","impact":"...","effort":"..."}'
 
 Then mark the relevant learnings as applied:
-curl -s -X PATCH http://localhost:${INSTAR_PORT:-4042}/evolution/learnings/LRN-XXX/apply -H 'Content-Type: application/json' -d '{"appliedTo":"EVO-XXX"}'
+curl -s -X PATCH -H "Authorization: Bearer $AUTH" -H "X-Instar-AgentId: $AGENT_ID" http://localhost:$PORT/evolution/learnings/LRN-XXX/apply -H 'Content-Type: application/json' -d '{"appliedTo":"EVO-XXX"}'
 
 Also update MEMORY.md with any patterns worth preserving long-term.
 

package/src/scaffold/templates/jobs/instar/reflection-trigger.md

@@ -22,7 +22,9 @@ fi
 
 # Extract recent session activity and key events (filter out noise, keep significant events)
 echo "=== RECENT ACTIVITY (Last 4 Hours) ==="
-tail -500 "$RECENT_LOGS" 2>/dev/null | jq -r 'select(.type != "job-start" and .type != "job-queued") | "(.timestamp) [(.type)] (.message // .title // .session_name // .slug // "")"' 2>/dev/null | tail -100
+tail -500 "$RECENT_LOGS" 2>/dev/null | jq -r 'select(.type | IN("job_triggered","job_gate_skip","job_skipped") | not) | "\(.timestamp) [\(.type)] \(.summary // .metadata.slug // "")"' | tail -100
+echo "--- volume summary (noise types excluded above) ---"
+tail -500 "$RECENT_LOGS" 2>/dev/null | jq -r '.type' 2>/dev/null | sort | uniq -c | sort -rn
 
 echo ""
 echo "=== YOUR TASK ==="
@@ -36,6 +38,6 @@ echo ""
 echo "If you find genuine learnings:"
 echo "1. Update .instar/MEMORY.md with the insight (append to the file)"
 echo "2. Be specific: include what was learned, why it matters, and how it should guide future work"
-echo "3. Signal completion: curl -s -X POST http://localhost:${INSTAR_PORT:-4042}/reflection/record -H 'Content-Type: application/json' -d '{"type":"quick"}'"
+echo "3. Signal completion: curl -s -X POST -H \"Authorization: Bearer \$INSTAR_AUTH_TOKEN\" -H \"X-Instar-AgentId: \$INSTAR_AGENT_ID\" http://localhost:${INSTAR_PORT:-4042}/reflection/record -H 'Content-Type: application/json' -d '{\"type\":\"quick\"}'"
 echo ""
 echo "If nothing significant, do nothing. Silence means continuity is working as expected."

package/upgrades/1.3.969.md

@@ -0,0 +1,35 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Five built-in job templates authenticated their `gate:` line but not their prompt bodies, so all 12 body calls to authenticated endpoints returned `401 Missing or invalid Authorization header` at runtime. The affected jobs — `evolution-proposal-evaluate`, `evolution-proposal-implement`, `evolution-overdue-check`, `insight-harvest`, `reflection-trigger` — woke on schedule, passed their gate, read nothing, and exited "silently". A silently-failing job and a healthy quiet job are indistinguishable, which is why this survived.
+
+Each body now resolves the canonical env-first `AUTH` / `AGENT_ID` / `PORT` block and passes `Authorization: Bearer $AUTH` + `X-Instar-AgentId: $AGENT_ID` on every non-public call.
+
+Two same-class defects found while in the files were fixed in the same change:
+
+- `identity-review.md` defined `AUTH` by reading `.instar/config.json` only. On an agent whose stored token has drifted from the live server token, that read is rejected — confirmed on the dev agent, where the 16-char config value returns `Invalid auth token` and the 36-char `$INSTAR_AUTH_TOKEN` succeeds. It now prefers the environment value.
+- `reflection-trigger.md` emitted its instruction through a double-quoted `echo` whose inner double quotes were consumed by the shell, rendering `-d '{type:quick}'` — invalid JSON — in addition to carrying no auth. Both fixed; the token name is left unexpanded so no secret enters the transcript.
+
+A new CI lint (`tests/unit/job-template-auth-lint.test.ts`) scans every shipped template for curl calls to non-public endpoints missing an `Authorization` header, and for templates that use `$AUTH` without defining it. Its public-endpoint exemptions mirror `authMiddleware()` and a drift guard asserts each exempted path still appears there.
+
+The fix is applied to the **source** templates, not deployed copies: `installBuiltinJobs()` unconditionally overwrites every deployed template on each update run (`InstallBuiltinJobs.ts:127`, reached from `PostUpdateMigrator.ts:4046`), so a hand-patched deployed copy would have been silently reverted at the next update. No separate migration is required — existing agents receive the fix through the normal update path.
+
+## What to Tell Your User
+
+Some scheduled jobs that have always been silent will start producing output — that is the repair working, not a new fault. If a user asks why their proposal-review or insight-harvest job has suddenly become active after months of quiet, the honest answer is that it was never running its body successfully; it was being refused at the door and exiting without saying so.
+
+## Summary of New Capabilities
+
+No new user-facing capability. Five existing scheduled jobs go from silently non-functional to functional, and a build-time lint prevents the class from returning.
+
+## Evidence
+
+- Run against the six pre-fix files extracted from `HEAD`, the lint reports exactly 12 unauthenticated calls — `evolution-overdue-check` 3, `evolution-proposal-evaluate` 3, `evolution-proposal-implement` 2, `insight-harvest` 3, `reflection-trigger` 1 — matching an independently-derived census. Against the fixed files: 0.
+- Live: an unauthenticated call to `/evolution/proposals?status=approved` returns `{"error":"Missing or invalid Authorization header"}`; the fixed template's resolved command returns the real proposal list. Same confirmed for `/evolution/learnings?applied=false` and `/evolution/actions/overdue`.
+- Executing the original `reflection-trigger.md` echo renders `-d '{type:quick}'`; the fixed line renders `-d '{"type":"quick"}'`.
+- The lint's first draft falsely flagged three healthy templates (`initiative-digest-review`, `mentor-onboarding`, `org-intent-drift-audit`) that define `AUTH` inside backticks; the detector was corrected and the false positive pinned by a regression test.
+- `tests/unit/job-template-auth-lint.test.ts` (9 tests) green; template-family tests (`refresh-jobs`, `default-jobs-valid`, `PostUpdateMigrator-templateResolution`) green.

package/upgrades/1.3.970.md

@@ -0,0 +1,33 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Follow-up to the built-in job-template auth fix. That change repaired the shipped `.md` templates; this repairs the **canonical source that generates them**. `src/scaffold/templates/jobs/instar/*.md` are produced from `getDefaultJobs()` in `src/commands/init.ts` via `scripts/regen-default-job-templates.mjs`, so the earlier fix was applied to generated output while the generator's input stayed broken — a regen would have silently reverted it (confirmed with the generator's `--dry-run`, which lists all five previously-fixed templates as regeneration targets).
+
+- **13 unauthenticated calls** in canonical job definitions now carry `Authorization: Bearer $AUTH` + `X-Instar-AgentId`. Twelve mirror the prior fix; the thirteenth — `feedback-retry` → `POST /feedback/retry` — was found by the new guard and confirmed live as a 401.
+- **12 config-only token reads** (`AUTH=$(python3 … config.json …)`) replaced with the env-first `${INSTAR_AUTH_TOKEN:-…}` form, across `reflection-trigger`, `memory-export`, `capability-audit`, `identity-review`, `commitment-detection`, and six CLAUDE.md-template instruction blocks. A config-only read is rejected outright on an agent whose stored token has drifted from the running server's.
+- **The reflection activity digest** (ACT-620) fixed in both callsites, and it was worse than reported: in the `.md` the jq program is a **compile error** (interpolation backslashes lost), silenced by `2>/dev/null`, so every reflection ran on an empty digest. The filter excluded `job-start`/`job-queued`, which never occur — real types are `job_triggered` / `job_gate_skip` / `job_skipped` — and the text slot read `.message`/`.title`/`.session_name`/`.slug`, none of which exist; the real keys are `.summary` and `.metadata.slug`. Now filters the real noise types, reads the real keys, and prints a type-count summary so job volume is visible without consuming the 100-line budget.
+- **The auth lint now covers the canonical source**, by resolving `getDefaultJobs(4042)` and linting the real `gate` + `execute.value` strings rather than regexing file text.
+
+## What to Tell Your User
+
+Reflection runs have been producing an empty activity digest — every reflection was working from a blank page, and the failure was silenced. Reflections will now see real recent activity. As with the prior fix, jobs that were quiet because they were failing will start producing output; that is the repair, not a new fault.
+
+## Summary of New Capabilities
+
+No new user-facing capability. Thirteen job bodies go from silently 401-ing to functional, reflection digests go from empty to populated, and the build-time guard now covers the source that generates the shipped templates.
+
+## Evidence
+
+- Guard proven to bite: with `init.ts` reverted to `origin/main`, the canonical-source test fails listing 13 unauthenticated calls (`reflection-trigger`, `feedback-retry`, `insight-harvest`, `evolution-overdue-check`, `evolution-proposal-evaluate`, `evolution-proposal-implement`); the config-only-token test fails with 12. Both pass on the fixed tree.
+- The guard's own first version passed **vacuously** — it regexed raw `init.ts`, whose bodies carry `localhost:\${INSTAR_PORT:-${port}}`, which its pattern never matched. Rewritten to lint resolved job objects, with a sample-size assertion so an empty resolution can never read as clean. The rewrite then found the `feedback-retry` defect.
+- Live: unauthenticated `POST /feedback/retry` returns `{"error":"Missing or invalid Authorization header"}`; authenticated returns `{"ok":true,"retried":0,"succeeded":0}`.
+- Shipped jq confirmed a compile error against a real activity log; corrected jq emits real `scheduler_start`/`scheduler_stop` rows with summaries plus `462 job_triggered / 33 job_gate_skip / 3 scheduler_start / 2 scheduler_stop`.
+- Real log census: keys are `type`, `timestamp`, `summary`, `metadata`, `sessionId`; types are `job_triggered`, `job_gate_skip`, `job_skipped`, `scheduler_start`, `scheduler_stop`.
+- Generated bash for the reflection echo extracted from the resolved job object and executed: renders `-d '{"type":"quick"}'` with `$INSTAR_AUTH_TOKEN` left unexpanded.
+- `tsc --noEmit` clean; auth lint (11 tests), `default-jobs-valid`, `refresh-jobs` green.
+
+Remaining general byte-parity between generated templates and their generator source is tracked as ACT-1263 <!-- tracked: ACT-1263 --> rather than folded in — reconciling all 14 generated templates is a distinct change with its own review surface.

package/upgrades/side-effects/evo007-canonical-source-auth.eli16.md

@@ -0,0 +1,47 @@
+# Fixing the thing that generates the job instructions — Plain-English Overview
+
+> The one-line version: last change fixed the printout; this one fixes the printer, because the printer would have re-printed the broken version.
+
+## The problem in one breath
+
+The previous fix repaired six job instruction files. It turns out those files are **generated** from a master list elsewhere in the code — and that master list was never fixed. Anyone regenerating the files would have quietly undone the repair, and everything would still *look* fine.
+
+That is the same trap this whole family of bugs keeps setting: a change that looks exactly like a real fix until something routine wipes it.
+
+## What already exists
+
+- **The master list** — one place in the code that defines every built-in scheduled job: when it runs, what it checks, and the instructions it follows.
+- **The generator** — a small script that turns that master list into the individual instruction files that ship to your agent.
+- **The build-time check from last time** — scans the *generated* files for jobs that call a locked door without a key.
+
+## What this adds
+
+**The check now also reads the master list**, not just the files it produces. That's the actual fix: the previous check guarded the output while the input stayed broken.
+
+Along with that:
+
+- **Thirteen jobs** in the master list now carry the key. Twelve were already known. The thirteenth — a job that retries failed feedback delivery — was found *by the new check*, not by me, and confirmed broken.
+- **Twelve places** were reading the key from a stored copy on disk instead of the live one. On a machine where the stored copy has gone out of date, that copy is rejected. They now prefer the live one.
+- **The reflection job's activity summary was completely empty** — and worse than reported. Its filter looked for two event types that never occur, and it read four field names that don't exist. On top of that, the version in the shipped file had lost some punctuation, which made it not just wrong but a **syntax error** — silenced, so it failed invisibly. Every reflection has been running on a blank page. Now it filters the event types that actually occur, reads the fields that actually exist, and adds a short count summary so the reflection can see how busy things were.
+
+## The safeguards
+
+**The check was caught lying, and fixed.** Its first version passed cleanly against the broken master list — not because the list was fine, but because its pattern didn't match the way text is written there. A check that passes for the wrong reason is worse than no check, because it hands you confidence you didn't earn. It now reads the *actual resolved jobs* rather than pattern-matching source text, and it refuses to report "clean" if it somehow finds no jobs to inspect.
+
+**It immediately proved itself.** The rewritten check found a broken job I didn't know about. That's the difference between a check that describes a fix and one that does work.
+
+**It was proven against the broken version first.** Turn the fix off, and the check reports all thirteen problems. Turn it on, and it reports none.
+
+**Documentation examples aren't punished.** The master list file also contains example commands written for humans to read. Those are deliberately not treated as real jobs, so the check doesn't flag prose.
+
+## What ships when
+
+All together — the master-list fixes, the reflection digest repair, and the widened check.
+
+## What's deliberately left for later
+
+The generated files and the master list have drifted apart over time in other, harmless-looking ways. The **key-and-lock** problem is now closed on both sides, but a full reconciliation of all fourteen generated files is a separate job with its own review. It's written down and tracked rather than quietly forgotten.
+
+## If it goes wrong
+
+Undo the change and ship a patch. Nothing is stored, nothing is migrated. Worst case is a return to quiet jobs that don't do anything — the same benign fallback as before.