[HOLD: awaiting operator ratification] docs(constitution): umbrella standard — The User Experience Is the Product

[EchoOfDawn]

What

Adds one top-level constitutional standard to docs/STANDARDS-REGISTRY.md:

The User Experience Is the Product — Reachability, Responsiveness, and Coherence Are Sacred.

It synthesizes the 2026-06-25 user-reachability postmortem (docs/incidents/2026-06-25-user-reachability-postmortem.md) into the constitution as the outward-facing complement to "Structure beats Willpower."

The blindspot it names

Every guard Instar had built points inward — what the agent emits, its sessions staying alive, it not quitting, it working on the right project, the machine not melting down. None guarded the thing the user actually experiences: can I reach a live agent, will it hear me, will it answer in reasonable time? On 2026-06-25 the safety mechanisms themselves became the outage (inbound queue ate messages, tone gate blocked every reply, fork-bomb floor starved the channel, "don't stop early" sheltered a runaway). The missing rule: when internal caution and the user's reach conflict, the user wins.

The 7 sub-standards (its teeth)

1. State Convergence · 2. Enforced Termination · 3. Inbound Delivery Is Sacred · 4. Guards Degrade, Not Outage · 5. User-Facing Priority Lane · 6. Degradation Is an Event · 7. Blast-Radius Before, Verify After.

Status of the teeth

• Publish v0.1.12 to npm with security changes #4 (Guards Degrade, Not Outage) shipped its first teeth on 2026-06-26 — PRs fix(config): loadConfig must carry sessions.frameworkDefaultModels (pi-cli was silently unavailable) #1276 (fast engine restored), test(llm): pin per-framework circuit-breaker isolation + clarify OPEN log wording #1277 (per-framework breaker isolation), fix(messaging): tone gate degrades to deterministic floor on LLM outage (F4) #1279 (tone gate degrades to deterministic leak floor; clean SENDS, leak HOLDS). Spec: docs/specs/tone-gate-graceful-degradation.md.
• Intelligent self-update: npm update lifecycle management #1/Intelligence dispatch system: broadcast guidance to agents #2/Feedback endpoint security: Phase 2 — registration + proof-of-work #3/fix: setup wizard config format, CLAUDECODE env var, and missing Telegram relay #5/fix(session): unset CLAUDECODE via tmux -e flag (no bash intermediary) #6/feat(scheduler): IntegrationGate — enforce learning after job completion #7 are tracked as the F-series fixes from the postmortem (not yet built).

Per How a new standard joins this registry, this PR is the agent-proposes half of the loop — it awaits operator ratification. The honest test is that each tooth is real, not that listing it here makes it so.

Docs-only change (1 file, +14 lines).

🤖 Generated with Claude Code

Update — three teeth are already real (2026-06-26)

The standard isn't just prose; its sub-standards are being built as structural guards:

• Publish v0.1.12 to npm with security changes #4 Guards Degrade, Not Outage — MERGED (fix(messaging): tone gate degrades to deterministic floor on LLM outage (F4) #1279, the tone-gate degrade-to-floor).
• Intelligence dispatch system: broadcast guidance to agents #2 Enforced Termination — MERGED (feat(enforced-termination): external hard-stop for runaway autonomous runs (F2) #1281, the external runaway hard-stop).
• Feedback endpoint security: Phase 2 — registration + proof-of-work #3 Inbound Delivery Is Sacred — landing (feat(inbound-delivery): inbound-queue loss notices reach the originating topic (F3) #1282, inbound-loss notices route to the originating topic, never silent).

#1/#5/#6/#7 remain as tracked F-series builds. So this is a constitution entry whose teeth are already going in, not a wish.

Status refresh (2026-06-26, later)

Four teeth now MERGED to main: #2 Enforced Termination (#1281), #3 Inbound Delivery Is Sacred (#1282), #4 Guards Degrade, Not Outage (#1279), #6 Degradation Is an Event (#1283). #5 User-Facing Priority Lane — spec converged (branch echo/spawn-priority-lane), awaiting operator approval to build. #1 State Convergence — the fix (OwnershipReconciler Case A) already exists, gated in dry-run; awaiting an operator graduation decision. #7 Blast-Radius/Verify-After — the capstone principle, ratified with this standard. This branch has been updated to current main so its cited guards resolve (dangling-ref ratchet green).

ELI16

Think of all my safety systems as guard rails. Before this, every single guard rail was pointed at ME — making sure I don't say the wrong thing, don't crash the machine, don't quit too early, don't work on the wrong project. Not one of them was pointed at YOU — at whether you can actually reach me, get heard, and get an answer back in reasonable time.

On the bad night that gap bit hard: my own safety systems ganged up and became the outage. The system that holds incoming messages held yours. The system that checks my replies blocked all of them. The system that stops the machine overloading starved your channel. Each one did its narrow job perfectly, and added up they left me technically flawless and completely unreachable — and nobody noticed, because no rule said your getting through even mattered.

This standard adds that missing rule, as the top-level law: when my internal caution and your ability to reach me ever conflict, YOU win. A guard is never allowed to quietly cut you off — if it can't do its job, it has to fail in the direction that still serves you, and say out loud that it degraded. It has seven specific "teeth" (one per way I failed you that night), four of which are already built and merged. This PR is me proposing the law; ratifying it is your call.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
instar	Ready	Preview, Comment	Jun 26, 2026 10:54am