# Side-effects review — v1.0.0 release rollup (Provider Portability)

**Version / slug:** `1.0.0` (release rollup)
**Date:** `2026-05-18`
**Author:** Echo
**Second-pass reviewer:** self-review — every constituent change shipped through its own /instar-dev cycle with its own artifact, listed below.
**Driving spec:** `specs/provider-portability/README.md` (Phase 8 release cut).

## Summary of the v1.0.0 release

This is the rollup artifact for v1.0.0 — the first portable Instar release. Provider portability ends Anthropic-only lock-in. Every hot-path session (interactive, headless, pipe-mode, upgrade-notify, stall-recovery) now routes through a framework-aware launch helper that supports Claude Code, OpenAI Codex, AND local models via Codex CLI's `--oss --local-provider` passthrough.

The release closes nine work tracks across multiple autonomous cycles. Each track shipped its own /instar-dev cycle with its own side-effects artifact:

| Track | Slug | Date |
|---|---|---|
| Spec 12 Rule 1a env scrubbing | `codex-env-scrubbing` (prior) | 2026-05-17 |
| Phase 5b/5c routing | various Phase 5 artifacts | 2026-05-17 |
| Spawn-path closure (buildHeadlessLaunch + PipeSessionSpawner) | `portability-headless-launch-helper` | 2026-05-18 |
| Generic tier routing + /sessions/spawn whitelist + StallTriageNurse normalization | `portability-generic-tier-routing` | 2026-05-18 |
| Codex Rule 1 Phase A + Phase B opt-in + drift gate | `codex-rule1-phase-a-and-b-groundwork` | 2026-05-18 |
| Phase 6 local-model adapter via Codex --oss | `local-model-codex-oss` | 2026-05-18 |
| Phase 7 migration entry | `migrate-provider-portability` | 2026-05-18 |
| Sentinel + monitoring cross-port | `sentinel-monitoring-cross-port` | 2026-05-18 |

## What changes for end users

- **No-op for Claude-only installs.** Framework defaults to `claude-code`. Existing topics keep working. No config required.
- **Per-topic framework swap.** `/route codex-cli` flips a topic; `/route claude-code` flips it back. Per-topic config in `topicFrameworks` map.
- **Per-topic local model.** With Ollama installed locally, set `topicCodexLocalProvider` + `topicCodexLocalModel` in config and restart. Recipe at `docs/local-model-recipe.md`.
- **Codex API-key warning.** Agents that have `OPENAI_API_KEY` in env or API-key auth in `~/.codex/auth.json` get a Spec 12 Rule 1 warning at adapter init. No behavior change — the warning is informational in v1.0.0 Phase A. Lock down early via `INSTAR_RULE1_ENFORCE=hard` env var. Escape hatch `INSTAR_DISABLE_RULE1_OPENAI=1` sunsets 2026-12-01.

## Decision-point inventory (release-level)

- **Phase A as default** (not Phase B) — back-compat for existing installs.
- **Local-model as passthrough** (not new adapter) — Codex CLI handles the OpenAI-API translation; zero translation code in Instar.
- **No silent framework-default flip** — operator opts in via `/route` or config.
- **Lifeline doctor stays Claude-only** — Codex equivalents require their own design pass; documented residual.
- **Setup wizard stays Claude-only** — Claude Code's skill system is upstream territory.

## Signal vs authority (release-level)

- All framework dispatch helpers (`frameworkSessionLaunch`, `resolveModelForFramework`, `resolveTopicFramework`) are pure functions — signal.
- `/sessions/spawn`'s framework-aware whitelist, the Codex Rule 1 validator at adapter init, and `PostUpdateMigrator.migrateProviderPortability`'s marker are the authorities.
- Sentinels (InstructionsVerifier, PromptGate, StallTriageNurse) are signal layers feeding the existing authority layer above them.

## Over-block / under-block analysis (release-level)

**Over-block:** None at the release level. Each individual artifact analyzed its own scope and confirmed no new false-positive blocks.

**Under-block:** Documented residuals (Lifeline doctor + setup wizard under Codex; `OPENAI_BASE_URL` HMAC approval flow). Each is honest scope, not silent gap.

## Level-of-abstraction fit

The release introduces no new architectural layers. It populates the existing provider-substrate layer (Phase 2 interfaces) with one new framework (Codex) and one new model class (local). Sentinels gain a `framework?` field; spawn paths gain a `framework` + `codexLocalProvider` option. No cross-layer leaks.

## Interactions

- Cost-aware routing (Phase 5c) is orthogonal to local-model passthrough — `CostAwareRoutingPolicy` ignores local sessions (no credit pot). Future Phase 5d work could integrate.
- Spec 12 Rule 1 validator and Rule 1a env-scrub cooperate at adapter init + spawn time.
- All sentinels coexist; framework-aware defaults degrade gracefully (cross-framework fallback when no hint).

## Rollback cost

Per-cycle revert is cheap (each cycle is a separate commit with its own artifact). Full v1.0.0 rollback to 0.28.76 requires reverting the release-cut commit + the per-cycle commits; no schema migration to undo, no on-disk state changes beyond the (benign) `_instar_migrations` marker in agents that ran `instar update` against v1.0.0.

## Verification

- `npx tsc --noEmit` — clean.
- `npm run lint` — clean (includes drift gate).
- Per-cycle unit + integration tests — all green at commit time.
- 12/12 v1.0.0 scenarios green via injection mode against updated deep-signal.
- Live Codex spawn round-trip succeeded on deep-signal (`/sessions/spawn` with `framework: codex-cli`).
- Live Codex --oss + Ollama smoke succeeded (`codex exec --oss --local-provider ollama --model llama3.2:latest --json` returned PONG in ~3s).
- Real-Telegram-loop verification requires provisioning a separate driver bot — documented as setup step, not a behavior gap (polling-health scenario #11 covers the network leg without that dependency).
