session-orchestrator 3.17.0 → 3.19.0

package/scripts/lib/ecosystem-wizard/config-writer.mjs

@@ -5,6 +5,10 @@
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import {
+  findSessionConfigBlock,
+  SESSION_CONFIG_HEADING,
+} from '../config/section-extractor.mjs';
 
 // ---------------------------------------------------------------------------
 // Validation
@@ -75,18 +79,14 @@ export function validateEcosystemPolicy(policy) {
 // ---------------------------------------------------------------------------
 
 /**
- * Returns whether the Session Config section in `text` already contains an
+ * Returns whether the Session Config section already contains an
  * ecosystem-health key.
- * @param {string} text
- * @param {RegExpMatchArray|null} startMatch
+ * @param {ReturnType<typeof findSessionConfigBlock>} block
  * @returns {boolean}
  */
-function _ecosystemBlockPresent(text, startMatch) {
-  if (!startMatch || startMatch.index === undefined) return false;
-  const afterBlock = text.slice(startMatch.index + startMatch[0].length);
-  const nextHeadingMatch = afterBlock.match(/^## /m);
-  const blockContent = nextHeadingMatch ? afterBlock.slice(0, nextHeadingMatch.index) : afterBlock;
-  return /^\s*ecosystem-health\s*:/m.test(blockContent);
+function _ecosystemBlockPresent(block) {
+  if (!block) return false;
+  return /^\s*ecosystem-health\s*:/m.test(block.body);
 }
 
 /**
@@ -104,23 +104,21 @@ function _replaceEcosystemBlock(text, snippetLines) {
  * Inserts a new ecosystem-health snippet into `text` within the Session Config
  * section, or appends a new section when none exists.
  * @param {string} text
- * @param {RegExpMatchArray|null} startMatch
+ * @param {ReturnType<typeof findSessionConfigBlock>} block
  * @param {string[]} snippetLines
  * @returns {string}
  */
-function _insertEcosystemBlock(text, startMatch, snippetLines) {
+function _insertEcosystemBlock(text, block, snippetLines) {
   const snippet = '\n' + snippetLines.join('\n');
-  if (!startMatch || startMatch.index === undefined) {
-    return text + '\n## Session Config\n' + snippet + '\n';
-  }
-  const afterStartIdx = startMatch.index + startMatch[0].length;
-  const afterBlock = text.slice(afterStartIdx);
-  const nextHeadingMatch = afterBlock.match(/^## /m);
-  if (nextHeadingMatch && nextHeadingMatch.index !== undefined) {
-    const insertAt = afterStartIdx + nextHeadingMatch.index;
-    return text.slice(0, insertAt) + snippet + '\n' + text.slice(insertAt);
+  if (!block) {
+    // The one site in this repo that WRITES the heading. It takes the literal
+    // from the SSOT so a producer/comparator drift cannot open the same
+    // silent-fallback hole the predicate exists to close (#968).
+    return text + '\n' + SESSION_CONFIG_HEADING + '\n' + snippet + '\n';
   }
-  return text + snippet + '\n';
+  // `bodyEnd` is the offset of the next `## ` heading, or EOF — i.e. exactly
+  // the end of the Session Config section, which is where the snippet goes.
+  return text.slice(0, block.bodyEnd) + snippet + '\n' + text.slice(block.bodyEnd);
 }
 
 /**
@@ -211,10 +209,14 @@ export function writeSessionConfigBlock(configFilePath, config, dryRun, overwrit
     return 'error';
   }
 
-  const startMatch = text.match(/^## Session Config[ \t]*(?:\r?\n|$)/m);
+  // Heading + body span from the SSOT (#968) — the previous local regex
+  // `/^## Session Config[ \t]*(?:\r?\n|$)/m` accepted a trailing-whitespace
+  // heading the runtime parser rejects, so the wizard would write a well-formed
+  // ecosystem-health block into a section `parseSessionConfig` never reads.
+  const block = findSessionConfigBlock(text);
   const snippetLines = _buildEcosystemSnippetLines(config);
 
-  if (_ecosystemBlockPresent(text, startMatch)) {
+  if (_ecosystemBlockPresent(block)) {
     if (!overwrite) return 'skipped';
     // Replace the existing ecosystem-health block with the new snippet.
     // The block spans from "ecosystem-health:" to the next top-level key or heading.
@@ -230,7 +232,7 @@ export function writeSessionConfigBlock(configFilePath, config, dryRun, overwrit
   }
 
   // Insert path: append ecosystem-health block to Session Config section
-  const newText = _insertEcosystemBlock(text, startMatch, snippetLines);
+  const newText = _insertEcosystemBlock(text, block, snippetLines);
   if (!dryRun) {
     try { writeFileSync(configFilePath, newText, 'utf8'); } catch { return 'error'; }
   }

package/scripts/lib/ecosystem-wizard/wizard-prompt.mjs

@@ -72,7 +72,7 @@ async function _promptInteractiveAnswers(existingConfig, ciProvider, packageMana
     : `CI pipeline identifiers (format "id" or "id:label", comma-separated, blank to skip):\n> `;
   const labelsPrompt = currentLabels
     ? `Critical issue labels [current: ${currentLabels}]:\n> `
-    : `Critical issue labels (comma-separated, e.g. "priority:critical,severity:blocker", blank to skip):\n> `;
+    : `Critical issue labels (comma-separated, e.g. "priority::critical,severity:blocker", blank to skip):\n> `;
 
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   const ask = (q) => new Promise((resolve) => rl.question(q, resolve));

package/scripts/lib/eval/engine.mjs

@@ -34,6 +34,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+import { resolvePluginRoot } from '../common.mjs';
 import { readJsonlFile } from '../io.mjs';
 import { buildRunId, CURRENT_STANDARD_VERSION, VALID_MODEL_SOURCES } from './schema.mjs';
 import { resolveSession, computeWindow, findPeerOverlap } from './session-resolve.mjs';
@@ -41,8 +42,33 @@ import { resolveSession, computeWindow, findPeerOverlap } from './session-resolv
 /** The rubric version this engine scores against. */
 export const RUBRIC_VERSION = 'rubric-v1';
 
-/** Default rubric location (created in W3; absent until then ⇒ rubric_sha256 null). */
-export const DEFAULT_RUBRIC_PATH = 'skills/eval/rubric-v1.md';
+/** Rubric location relative to the plugin root. */
+export const RUBRIC_RELATIVE_PATH = 'skills/eval/rubric-v1.md';
+
+/**
+ * Default rubric location, resolved against the PLUGIN root rather than the
+ * caller's cwd (#927).
+ *
+ * The previous cwd-relative literal only ever resolved when `/eval` happened to
+ * run from the plugin checkout itself. In a consumer repo — the normal install
+ * shape — it pointed at a non-existent `<consumer>/skills/eval/rubric-v1.md`,
+ * `computeRubricHash` returned null, and `validateEvalRecord` then rejected the
+ * record on `provenance.rubric_sha256` (schema.mjs), so the run produced no
+ * output at all.
+ *
+ * Resolution is best-effort by design: `resolvePluginRoot` THROWS when it cannot
+ * locate a plugin root, and this constant is evaluated at module load. A throw
+ * here would make the module unimportable, so we degrade to the relative literal
+ * — preserving the previous behaviour instead of turning a degraded path into a
+ * hard import failure.
+ */
+export const DEFAULT_RUBRIC_PATH = (() => {
+  try {
+    return path.join(resolvePluginRoot(import.meta.url), RUBRIC_RELATIVE_PATH);
+  } catch {
+    return RUBRIC_RELATIVE_PATH;
+  }
+})();
 
 /** Ordered rubric-v1 dimension ids — the canonical scoring order. */
 export const RUBRIC_DIMENSION_IDS = Object.freeze([
@@ -372,13 +398,29 @@ function extractKpis(record) {
 // Provenance / harness / model helpers
 // ---------------------------------------------------------------------------
 
-/** sha256 hex of the rubric file, or null when the file does not exist yet. */
+/**
+ * sha256 hex of the rubric file, or null when it cannot be read.
+ *
+ * A null return is NOT benign: `validateEvalRecord` requires a non-empty
+ * `provenance.rubric_sha256`, so a miss here aborts the whole append downstream.
+ * The downstream WARNs name the validation failure but never the path that was
+ * tried, which is the one fact needed to diagnose it — so name it here (#927).
+ */
 function computeRubricHash(rubricPath) {
   try {
-    if (!rubricPath || !existsSync(rubricPath)) return null;
+    if (!rubricPath || !existsSync(rubricPath)) {
+      process.stderr.write(
+        `[eval-engine] WARN: rubric not found at '${rubricPath ?? '<unset>'}' — ` +
+        'provenance.rubric_sha256 will be null and the record will fail validation.\n',
+      );
+      return null;
+    }
     const buf = readFileSync(rubricPath);
     return createHash('sha256').update(buf).digest('hex');
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `[eval-engine] WARN: could not hash rubric at '${rubricPath}': ${err?.message ?? String(err)}\n`,
+    );
     return null;
   }
 }

package/scripts/lib/events.mjs

@@ -12,17 +12,61 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { SO_PROJECT_DIR, SO_SHARED_DIR } from './platform.mjs';
+import { readLock } from './session-lock.mjs';
 
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
 
 /**
- * Returns the absolute path to .orchestrator/metrics/events.jsonl in the project root.
+ * Returns the absolute path to `.orchestrator/metrics/events.jsonl` under `repoRoot`.
+ *
+ * `repoRoot` defaults to the module-level `SO_PROJECT_DIR` constant, so the
+ * zero-arg call is unchanged for every existing caller (#941). Pass an explicit
+ * `repoRoot` when the destination must be pinned to a tree other than the
+ * CWD/env-resolved project — e.g. a unit test running the gate against a tmp
+ * repo, which must NOT append synthetic records to the real fleet telemetry.
+ *
+ * @param {string} [repoRoot=SO_PROJECT_DIR] — project root the events log lives under.
  * @returns {string}
  */
-export function eventsFilePath() {
-  return path.join(SO_PROJECT_DIR, SO_SHARED_DIR, 'metrics', 'events.jsonl');
+export function eventsFilePath(repoRoot = SO_PROJECT_DIR) {
+  return path.join(repoRoot, SO_SHARED_DIR, 'metrics', 'events.jsonl');
+}
+
+/**
+ * Session attribution for gate/lifecycle telemetry (#928a, hoisted here #941).
+ *
+ * The natural shared home the two former call-site copies (`quality-gate.mjs`,
+ * `run-quality-gate.mjs`) both named. Emits BOTH the UUID `session_id` and the
+ * `semantic_session_id`, mirroring the field shape of
+ * `orchestrator.session.lock.acquired` so gate events join against the same keys
+ * existing consumers already read (see `session-close-backfill.mjs`).
+ *
+ * Without a lock (CI runs have none) BOTH keys are OMITTED rather than filled
+ * with a placeholder: a fabricated id would silently collide across every
+ * unattributed run and read as a real session; an empty string would satisfy a
+ * truthiness check while attributing to nothing. An absent key is the only
+ * honest encoding of "not attributable".
+ *
+ * @param {string} [repoRoot] — repo whose `session.lock` is read for attribution.
+ * @returns {{session_id?: string, semantic_session_id?: string}}
+ */
+export function sessionAttribution(repoRoot) {
+  try {
+    const lock = readLock({ repoRoot });
+    if (!lock) return {};
+    const out = {};
+    if (typeof lock.session_id === 'string' && lock.session_id.trim()) {
+      out.session_id = lock.session_id;
+    }
+    if (typeof lock.semantic_session_id === 'string' && lock.semantic_session_id.trim()) {
+      out.semantic_session_id = lock.semantic_session_id;
+    }
+    return out;
+  } catch {
+    return {};
+  }
 }
 
 /**
@@ -43,6 +87,11 @@ export function eventsFilePath() {
  *   Used by `scripts/emit-event.mjs --file` so shell callers (e.g.
  *   compute-grounding-injection.sh) can target a pre-resolved EVENTS_JSONL path
  *   without depending on platform.mjs CWD/env resolution (#611).
+ * @param {string} [opts.repoRoot] — pin the destination to `<repoRoot>/.orchestrator/
+ *   metrics/events.jsonl` instead of the module-level `SO_PROJECT_DIR` default
+ *   (#941). Ignored when `opts.filePath` is given (explicit path wins). This is
+ *   the clean interface replacing the hand-built `join(repoRoot, …)` recipes that
+ *   used to open-code this destination at each call-site.
  * @returns {Promise<void>}
  */
 export async function emitEvent(type, payload = {}, opts = {}) {
@@ -50,10 +99,13 @@ export async function emitEvent(type, payload = {}, opts = {}) {
   const record = { timestamp: new Date().toISOString(), event: type, ...payload };
   const line = JSON.stringify(record) + '\n';
 
-  // Ensure the destination directory exists before appending. The default
-  // resolution is unchanged for 2-arg callers — only an explicit opts.filePath
-  // overrides it (#611, additive).
-  const filePath = opts.filePath ?? eventsFilePath();
+  // Ensure the destination directory exists before appending. Resolution order:
+  //   1. explicit opts.filePath (a pre-resolved path — #611)
+  //   2. opts.repoRoot → <repoRoot>/.orchestrator/metrics/events.jsonl (#941)
+  //   3. the SO_PROJECT_DIR default (unchanged for 2-arg callers)
+  // eventsFilePath(undefined) falls through to its SO_PROJECT_DIR default param,
+  // so a caller passing neither behaves EXACTLY as before (additive).
+  const filePath = opts.filePath ?? eventsFilePath(opts.repoRoot);
   await fs.mkdir(path.dirname(filePath), { recursive: true });
   await fs.appendFile(filePath, line, 'utf8');
 

package/scripts/lib/gates/gate-full.mjs

@@ -40,11 +40,14 @@ const tcErrorCount =
     : 0;
 
 // --- Test ---
+// NOTE: `testFailed`, NOT `failed` — a local `failed` is already bound near the
+// bottom of this file and drives `process.exit(failed ? 2 : 0)`. Shadowing it
+// would corrupt the gate's exit code.
 const testResult = runCheck(testCmd);
-const { passed: testPassed, total: testTotal } =
+const { passed: testPassed, failed: testFailed, total: testTotal } =
   testResult.status !== 'skip'
     ? extractTestCounts(testResult.output)
-    : { passed: 0, total: 0 };
+    : { passed: 0, failed: 0, total: 0 };
 
 // --- Lint ---
 const lintResult = runCheck(lintCmd);
@@ -70,7 +73,16 @@ const output = {
   variant: 'full-gate',
   duration_seconds: durationSeconds,
   typecheck: { status: tcResult.status, error_count: tcErrorCount },
-  test: { status: testResult.status, total: testTotal, passed: testPassed },
+  // `failed` is published explicitly (#967 item 1) rather than left to be
+  // re-derived as `total - passed` downstream: the derivation and the parse can
+  // disagree, and only an explicit third number lets a consumer check
+  // `passed + failed === total` as a real producer/consumer drift guard.
+  test: {
+    status: testResult.status,
+    total: testTotal,
+    passed: testPassed,
+    failed: testFailed,
+  },
   lint: { status: lintResult.status, warnings: lintWarnings },
   debug_artifacts: debugArtifacts,
   stubbed,

package/scripts/lib/gates/gate-helpers.mjs

@@ -133,18 +133,61 @@ export function extractCount(output, pattern) {
 }
 
 /**
- * Parse vitest-style output for pass/fail/total counts.
+ * Matches a runner summary line that reports TEST-CASE counts.
  *
- * Looks for patterns like "42 passed", "3 failed".
+ * Deliberately anchored on `Tests` + a word boundary so it matches vitest's
+ * `      Tests  12904 passed | 11 skipped (12915)` and jest's
+ * `Tests:       1 failed, 4 passed, 5 total`, but NOT vitest's preceding
+ * `  Test Files  550 passed (550)` line ("Test" is not followed by "s").
+ */
+const TEST_SUMMARY_LINE = /^\s*Tests\b/;
+
+/**
+ * Parse test-runner output for pass/fail/total TEST-CASE counts.
  *
- * @param {string} output
- * @returns {{ passed: number, failed: number, total: number }}
+ * ## Which line is parsed
+ *
+ * Real vitest prints TWO `<N> passed` summary lines, files first:
+ *
+ * ```
+ *  Test Files  550 passed (550)
+ *       Tests  12904 passed | 11 skipped (12915)
+ * ```
+ *
+ * A naive whole-output scan hits the FILE count (550) and publishes it as the
+ * test count — the number then rides `gate-full.mjs`'s `test.passed` into the
+ * `orchestrator.quality_gate.*` event stream looking authoritative. So: when a
+ * `Tests`-anchored summary line exists, ONLY that line is parsed (the LAST one,
+ * which is the final summary after any rerun). Terse or non-vitest output with
+ * no such line falls back to scanning the whole string, which preserves the
+ * bare `"42 passed"` / `"10 passed, 5 failed"` forms.
+ *
+ * ## What `total` means — passed + failed, NOT vitest's parenthesised number
+ *
+ * `total` is `passed + failed` and deliberately EXCLUDES skipped/todo tests.
+ * This is load-bearing, not an oversight: `scripts/run-quality-gate.mjs`
+ * reconstructs the third number from the published envelope as
+ * `failed = total - passed`. Adopting vitest's parenthesised total (12915,
+ * which counts the 11 skipped) would make that derivation report 11 phantom
+ * FAILURES. `total` therefore answers "how many test cases produced a verdict",
+ * and `total - passed === failed` holds by construction for every consumer.
+ *
+ * Skipped is not returned: neither call site (`gate-full.mjs`,
+ * `quality-gate.mjs`) consumes it, and its only use would be to rebuild the
+ * parenthesised total — precisely the number the downstream derivation must not
+ * see. Add it together with a consumer, never ahead of one.
+ *
+ * @param {string} output - Captured test-runner stdout/stderr (or a tail of it).
+ * @returns {{ passed: number, failed: number, total: number }} `total === passed + failed`.
  */
 export function extractTestCounts(output) {
   if (!output) return { passed: 0, failed: 0, total: 0 };
 
-  const passMatch = output.match(/(\d+)\s+passed/);
-  const failMatch = output.match(/(\d+)\s+failed/);
+  const summaryLines = output.split('\n').filter((line) => TEST_SUMMARY_LINE.test(line));
+  const scope = summaryLines.length > 0 ? summaryLines[summaryLines.length - 1] : output;
+
+  const passMatch = scope.match(/(\d+)\s+passed/);
+  const failMatch = scope.match(/(\d+)\s+failed/);
 
   const passed = passMatch ? parseInt(passMatch[1], 10) : 0;
   const failed = failMatch ? parseInt(failMatch[1], 10) : 0;
@@ -153,6 +196,89 @@ export function extractTestCounts(output) {
   return { passed, failed, total };
 }
 
+/**
+ * Admit a suite-count triple, or refuse to claim a measurement.
+ *
+ * ## Why this exists (#967 item 2)
+ *
+ * Two functions used to write the `counts` field of the SAME
+ * `orchestrator.quality_gate.*` event under DIFFERENT admission policies:
+ * `suiteCountsFromGateStdout` (`scripts/run-quality-gate.mjs`) rejected
+ * inconsistent triples, while `suiteCountsFromOutput` (`scripts/lib/quality-gate.mjs`)
+ * admitted `passed > total` and a negative `passed`. A consumer therefore had to
+ * know two policies to read one field. This is the single shared policy; both
+ * callers keep only their own input adapter.
+ *
+ * ## Absent-not-null
+ *
+ * Returns `null` — NEVER a zero triple — for any unmeasured or inconsistent
+ * input. `{passed: 0, failed: 0, total: 0}` would be indistinguishable from a
+ * real all-skipped run and would publish a phantom measurement. Callers spread
+ * the result so the field is OMITTED rather than zero-filled:
+ *
+ * ```js
+ * const counts = admitSuiteCounts(raw);
+ * await emitEvent(name, { ...(counts ? { counts } : {}) });
+ * ```
+ *
+ * ## ONE channel for "the gate did not run" — a NULL `raw` (#969 MED-2)
+ *
+ * This function used to take a second `opts.measured` channel: `false` was an
+ * unconditional refusal, meant to carry the caller's positional evidence that no
+ * test gate ran. It was dead. Both adapters ALREADY convert that evidence to a
+ * null `raw` before the policy sees it (`suiteCountsFromOutput` returns
+ * `admitSuiteCounts(null)` for a null/empty output; the CLI's
+ * `suiteCountsFromGateStdout` returns `null` from its own envelope checks and
+ * never passed the opt at all), so no production path could ever reach here with
+ * a non-null triple AND `measured: false` — only test rows exercised the flag.
+ *
+ * Keeping both was the real cost: "the gate did not run" was expressible two
+ * ways and checked in two places, so a future caller could pass a real triple
+ * with `measured: false`, or a STALE triple with `measured: true`, and the two
+ * channels would disagree with the unverifiable boolean silently winning. A
+ * null `raw` is the channel that survives because the policy must reject
+ * non-objects anyway — it is structural, not an extra parameter, and it is
+ * expressible by every caller including the one that never opted in.
+ *
+ * ## What stays with the CALLER (deliberately not absorbed)
+ *
+ * This function sees a candidate triple and nothing else. It performs no I/O and
+ * reads no files. The following are per-caller INPUT ADAPTERS and must not
+ * migrate here: JSON-envelope parsing; the `test`-object-vs-status-string
+ * variant discrimination (non-full-gate variants emit a bare status string);
+ * `test.status ∈ {pass, fail}`; the `parsed.stubbed?.test` short-circuit; the
+ * raw-text tail parse ({@link extractTestCounts}); and the positional evidence
+ * that the test gate ran at all — which each caller expresses by handing over
+ * `null` rather than a triple.
+ *
+ * `failed` is accepted when the caller parsed one and DERIVED as `total - passed`
+ * when it did not, so both the parsed-`failed` path and the derived-`failed` path
+ * land on one consistency check (`passed + failed === total`).
+ *
+ * @param {{passed?: unknown, failed?: unknown, total?: unknown}|null|undefined} raw
+ *   `null`/`undefined` is the caller's evidence that there is no measurement to
+ *   admit (gate skipped, stub command, fail-fast before the test step, or no
+ *   parseable count in the output).
+ * @returns {{passed: number, failed: number, total: number}|null}
+ */
+export function admitSuiteCounts(raw) {
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return null;
+
+  const { passed, total } = raw;
+  if (!Number.isFinite(passed) || !Number.isFinite(total)) return null;
+
+  const failed = Number.isFinite(raw.failed) ? raw.failed : total - passed;
+
+  if (total <= 0) return null;
+  if (passed < 0 || failed < 0) return null;
+  // Redundant given the sum check below while `failed >= 0`, but kept explicit:
+  // it is the check the looser of the two former policies was missing.
+  if (passed > total) return null;
+  if (passed + failed !== total) return null;
+
+  return { passed, failed, total };
+}
+
 /**
  * Scan changed files (since `ref`) for debug artifacts: `console.log`, `debugger`, `TODO`, `FIXME`.
  *

package/scripts/lib/gitlab-ops/stale-mr-sweep.mjs

@@ -23,6 +23,7 @@ import { execFile as execFileCb } from 'node:child_process';
 import { promisify } from 'node:util';
 
 import { detectVcsForRepo, discoverVaultRepos } from '../gitlab-portfolio/vcs-detect.mjs';
+import { resolveRepoSpec } from '../vcs-repo-spec.mjs';
 
 const realExecFile = promisify(execFileCb);
 
@@ -94,22 +95,31 @@ export function filterStaleMRs(mrs, opts = {}) {
  *   2. `detectVcsForRepo({ repo })` if `opts.repo` is provided
  *   3. 'gitlab' (cross-project default per CLAUDE.md / AGENTS.md Session Config `vcs: gitlab`) —
  *      only reached when neither vcs nor repo is provided, i.e. the caller
- *      intends "the repo at `repoRoot`", and glab/gh both auto-detect the
- *      remote from the local git checkout when no --repo flag is given.
+ *      intends "the repo at `repoRoot`".
+ *
+ * `--repo` host-pinning (#872): a bare `glab`/`gh` spawn (no `--repo`) falls
+ * back to the ambient `GITLAB_HOST`/`GH_HOST` env var to pick a host, which
+ * can silently target the WRONG instance on a multi-instance host — `cwd:
+ * repoRoot` alone does not fix this (ambient env still wins over cwd). When
+ * `opts.repo` is not explicitly provided, this function auto-detects a
+ * `--repo` spec via `resolveRepoSpecFn` (default: the real `resolveRepoSpec`
+ * from `vcs-repo-spec.mjs`, which shells out to `git remote get-url`).
+ * Explicit `opts.repo` always wins over the auto-detected spec.
  *
  * Never throws: CLI failure (missing binary, non-zero exit, timeout) and
  * malformed JSON output both resolve to a graceful `{ ok: false, error, stale: [], total: 0 }`
  * result plus a diagnostic line on stderr — never an unhandled rejection.
  *
  * @param {object} [opts]
- * @param {string} [opts.repoRoot=process.cwd()] - cwd for the CLI invocation (used for local-checkout auto-detection by glab/gh)
- * @param {string} [opts.repo] - explicit "owner/repo" or GitLab path identifier; when set, passed via `--repo`
+ * @param {string} [opts.repoRoot=process.cwd()] - cwd for the CLI invocation (also passed to resolveRepoSpecFn for remote auto-detection)
+ * @param {string} [opts.repo] - explicit "owner/repo" or GitLab path identifier; when set, passed via `--repo` and skips auto-detection
  * @param {'gitlab'|'github'} [opts.vcs] - explicit VCS override (skips detectVcsForRepo)
  * @param {number} [opts.thresholdDays=14]
  * @param {'created'|'updated'} [opts.field='updated']
  * @param {Function} [opts.exec] - injectable execFile-like function `(cmd, args, options) => Promise<{stdout, stderr}>`; defaults to the real promisified execFile
  * @param {number} [opts.now=Date.now()]
  * @param {number} [opts.timeoutMs=8000]
+ * @param {(o: { repoRoot: string, vcs: 'gitlab'|'github' }) => string|undefined} [opts.resolveRepoSpecFn] - injectable `--repo` auto-detector; defaults to the real `resolveRepoSpec`
  * @returns {Promise<
  *   { ok: true, repo: string, vcs: 'gitlab'|'github', total: number, stale: Array<object> } |
  *   { ok: false, error: string, repo: string|null, vcs: 'gitlab'|'github'|null, total: 0, stale: [] }
@@ -125,6 +135,7 @@ export async function findStaleMRs(opts = {}) {
     exec = realExecFile,
     now = Date.now(),
     timeoutMs = DEFAULT_TIMEOUT_MS,
+    resolveRepoSpecFn = resolveRepoSpec,
   } = opts;
 
   const resolvedVcs = vcsOverride ?? (repo ? detectVcsForRepo({ repo }) : 'gitlab');
@@ -144,11 +155,15 @@ export async function findStaleMRs(opts = {}) {
     cmd = 'gh';
     args = ['pr', 'list', '--state', 'open', '--json', GH_PR_JSON_FIELDS];
   }
-  if (repo) {
-    args.push('--repo', repo);
+
+  // #872: explicit repo always wins; otherwise auto-detect a --repo spec
+  // from the local git remotes (host-pinning — see docblock above).
+  const effectiveRepo = repo ?? resolveRepoSpecFn({ repoRoot, vcs: resolvedVcs });
+  if (effectiveRepo) {
+    args.push('--repo', effectiveRepo);
   }
 
-  const repoLabel = repo ?? repoRoot;
+  const repoLabel = effectiveRepo ?? repoRoot;
 
   let stdout;
   try {
@@ -209,6 +224,7 @@ export async function findStaleMRs(opts = {}) {
  * @param {number} [opts.now=Date.now()]
  * @param {number} [opts.timeoutMs=8000]
  * @param {typeof discoverVaultRepos} [opts.discoverRepos] - injectable for tests
+ * @param {(o: { repoRoot: string, vcs: 'gitlab'|'github' }) => string|undefined} [opts.resolveRepoSpecFn] - passed through to each per-repo `findStaleMRs` call; unused in practice since discovered repos always carry an explicit `repo`
  * @returns {Promise<Array<{ slug: string } & Awaited<ReturnType<typeof findStaleMRs>>>>}
  */
 export async function findStaleMRsMultiRepo(opts = {}) {
@@ -220,6 +236,7 @@ export async function findStaleMRsMultiRepo(opts = {}) {
     now = Date.now(),
     timeoutMs = DEFAULT_TIMEOUT_MS,
     discoverRepos = discoverVaultRepos,
+    resolveRepoSpecFn = resolveRepoSpec,
   } = opts;
 
   const repos = await discoverRepos({ vaultDir });
@@ -227,7 +244,7 @@ export async function findStaleMRsMultiRepo(opts = {}) {
 
   const results = await Promise.all(
     repos.map((r) =>
-      findStaleMRs({ repo: r.repo, vcs: r.vcs, thresholdDays, field, exec, now, timeoutMs }),
+      findStaleMRs({ repo: r.repo, vcs: r.vcs, thresholdDays, field, exec, now, timeoutMs, resolveRepoSpecFn }),
     ),
   );
 
@@ -362,6 +379,7 @@ export async function main(argv, deps = {}) {
     repoRoot = process.cwd(),
     discoverRepos = discoverVaultRepos,
     homedir = () => process.env.HOME ?? '',
+    resolveRepoSpecFn = resolveRepoSpec,
   } = deps;
 
   const flags = parseArgs(argv);
@@ -386,6 +404,7 @@ export async function main(argv, deps = {}) {
       exec,
       now,
       discoverRepos,
+      resolveRepoSpecFn,
     });
 
     if (flags.json) {
@@ -410,6 +429,7 @@ export async function main(argv, deps = {}) {
     field: flags.field,
     exec,
     now,
+    resolveRepoSpecFn,
   });
 
   if (!result.ok) {

package/scripts/lib/gitlab-portfolio/aggregator.mjs

@@ -12,6 +12,8 @@
 
 import { spawn as _spawn } from 'node:child_process';
 
+import { normalizeLabel, normalizedLabelSet } from '../label-scope.mjs';
+
 /** Default timeout per repo CLI invocation (ms). */
 export const DEFAULT_TIMEOUT_MS = 15_000;
 
@@ -332,7 +334,11 @@ export function summarizeRepo(issues, opts) {
 
   const nowMs = now instanceof Date ? now.getTime() : Date.now();
   const staleThresholdMs = staleDays * 86_400_000;
-  const criticalSet = new Set(Array.isArray(criticalLabels) ? criticalLabels : []);
+  // Scope-tolerant matching: defaults use the canonical scoped spelling
+  // (`priority::critical`), but issues labelled before the migration still
+  // carry `priority:critical`. Normalising both sides keeps those counted —
+  // see scripts/lib/label-scope.mjs.
+  const criticalSet = normalizedLabelSet(criticalLabels);
 
   let criticalCount = 0;
   let staleCount = 0;
@@ -341,7 +347,7 @@ export function summarizeRepo(issues, opts) {
 
   for (const issue of issues) {
     // Critical
-    if (issue.labels.some((l) => criticalSet.has(l))) {
+    if (issue.labels.some((l) => criticalSet.has(normalizeLabel(l)))) {
       criticalCount++;
     }
 

package/scripts/lib/gitlab-portfolio/cli.mjs

@@ -289,7 +289,7 @@ EXIT CODES
 
   // ── Fetch issues in parallel ───────────────────────────────────────────────
   const staleDays = portfolioConfig['stale-days'] ?? 30;
-  const criticalLabels = portfolioConfig['critical-labels'] ?? ['priority:critical', 'priority:high'];
+  const criticalLabels = portfolioConfig['critical-labels'] ?? ['priority::critical', 'priority::high'];
   const mode = portfolioConfig.mode ?? 'warn';
 
   let resultsMap;

package/scripts/lib/handover-gate.mjs

@@ -104,8 +104,12 @@ function coerceOriginIssue(v) {
 }
 
 /**
- * Coerce a priority field: lowercase, trim, strip a leading `priority:` label,
- * validate against the closed enum. Anything invalid → null.
+ * Coerce a priority field: lowercase, trim, strip a leading `priority::` (the
+ * canonical scoped form) or legacy `priority:` label prefix, validate against
+ * the closed enum. Anything invalid → null.
+ *
+ * Both spellings are accepted on INPUT because the label-data migration to the
+ * scoped form trails the producer migration — see `scripts/lib/label-scope.mjs`.
  *
  * @param {unknown} v
  * @returns {'critical'|'high'|'medium'|'low'|null}
@@ -113,7 +117,7 @@ function coerceOriginIssue(v) {
 function coercePriority(v) {
   if (v === null || v === undefined) return null;
   let s = String(v).trim().toLowerCase();
-  if (s.startsWith('priority:')) s = s.slice('priority:'.length).trim();
+  s = s.replace(/^priority::?/, '').trim();
   return VALID_PRIORITIES.has(s) ? /** @type {any} */ (s) : null;
 }