# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: patch -->

## What Changed

feat(permissions): Slack org permissions **Phase 3** — relationship-aware anomaly detection + a step-up ladder (the relationship second factor on the permission gate). **Observe-only / dark, opt-in.**

- `RelationshipBehaviorStore` — durable, per-principal behavioral baseline recording **SHAPE only** (action labels, tier/hour-of-day counts, coarse message-length stats) — **never message content**.
- `RelationshipAnomalyScorer` (a real `AnomalyScorer`) — scores how far a request deviates from the principal's baseline via 5 deterministic weighted signals (out-of-character action, tier escalation, off-cadence hour, sudden urgency, length-style deviation); confidence scales with baseline depth.
- Step-up ladder: a would-be-allowed FLOOR action that scores anomalous → a `step-up` verdict (out-of-band verification). **OBSERVE-ONLY** (enforce=false → logged to the decision ledger, never live-challenged). Anomaly can ONLY raise a would-allow to step-up — a refuse stays a refuse; the deterministic floor is untouched.
- New/thin baseline → conservative (no spurious step-up; no authority-by-suspicion). Optional LLM style-check is off by default + strictly add-only (fail-closed). `GET /permissions/baselines` read-only inspection.

## What to Tell Your User

Nothing changes by default — observe-only and dark. When enabled, it's the "is this really you?" second factor: if a high-authority account suddenly makes an out-of-character high-risk request (off your usual cadence, an unusually sensitive action, a mismatched style), the agent flags it for step-up verification instead of just trusting it — your compromised-CEO scenario. For now it only *logs* what it would do (so we can measure accuracy before turning it on), it can only ever ask for *more* verification (never less), and it only learns the SHAPE of interactions, never the content of your messages.

## Summary of New Capabilities

- **`slack.permissionGate.relationshipAnomaly: { enabled, useLlmStyleCheck, stepUpThreshold }`** (opt-in, observe-only) — turns on relationship-aware anomaly scoring + the step-up ladder for the Slack permission gate. Off by default (Null scorer = no anomaly, no step-up).
- **`GET /permissions/baselines`** — read-only inspection of the per-principal behavioral baselines (SHAPE only; operator/internal).

## Evidence

- 19 unit (store durability/privacy, 5-signal scoring, no-baseline conservatism, confidence scaling, LLM fail-closed/match/mismatch, gate composition incl. spoofed-CEO→step-up + member-floor-stays-refuse + new-owner-no-spurious-step-up, observer dark-default-records-nothing) + 3 integration (baselines route). `tsc --noEmit` clean; lint clean (incl. no-silent-llm-fallback ratchet); build clean.
- Side-effects review (`upgrades/side-effects/slack-relationship-stepup.md`) + an independent adversarial Phase-5 second-pass (baseline-poisoning / never-lower / no-leak).
