session-orchestrator 3.20.0 → 3.22.0

package/scripts/lib/ci-status-banner.mjs

@@ -7,12 +7,22 @@
  * no-op condition (no VCS, CLI missing, timeout, parse failure).
  *
  * Supports GitLab (via glab) and GitHub (via gh).
- * VCS is auto-detected from git remote origin URL per gitlab-ops canonical logic.
+ * VCS is auto-detected from the repo's git remotes via
+ * `vcs-repo-spec.mjs`'s `detectVcsFamily` — NOT from a hard-coded `origin`
+ * lookup, which left the banner structurally dark in every repo whose remotes
+ * are named `gitlab`/`github` (#1039).
  */
 
 import { execFile as _execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { resolveRepoSpec, resolveRepoHost } from './vcs-repo-spec.mjs';
+import {
+  resolveRepoSpec,
+  resolveRepoHost,
+  resolveGitlabProjectTarget,
+  redactUrlCredentials,
+  detectVcsFamily,
+  isQueryFailure,
+} from './vcs-repo-spec.mjs';
 
 const execFileAsync = promisify(_execFile);
 
@@ -38,24 +48,130 @@ async function execWithTimeout(cmd, args, opts = {}) {
 }
 
 /**
- * Detect VCS from git remote URL.
- * Returns 'github' | 'gitlab'. Throws if git is unavailable or no origin.
+ * The one failure this probe can produce that the frozen
+ * `REMOTE_RESOLUTION_REASONS` set has no member for: the async timeout race
+ * every subprocess here runs under has no counterpart in the SYNCHRONOUS
+ * `vcs-repo-spec.mjs` core (it uses `execFileSync`, which cannot time out).
+ *
+ * Deliberately NOT a query-failure for warning purposes — a timeout stays
+ * SILENT, matching how `checkCiStatus`'s outer catch has always treated one
+ * (`msg === 'timeout'` → silent `null`). Warning on a hung `git` but not on a
+ * hung `glab` would be an inconsistency inside a single banner, and a hang is
+ * not a fact an operator can act on the way "git is not installed" is.
+ */
+const PROBE_TIMEOUT = 'probe-timeout';
+
+/**
+ * The ONE `isQueryFailure` member this banner deliberately keeps silent.
+ *
+ * `vcs-repo-spec.mjs` classifies `not-a-git-repo` as a query failure, and that
+ * is correct IN ITS DOMAIN: a remote-resolution helper genuinely could not
+ * enumerate remotes. For THIS consumer the same fact is a benign absence —
+ * session-start Phase 4 asking a non-repo directory about its CI has a complete
+ * and unsurprising answer ("there is no CI here"), and an operator cannot act on
+ * being told their directory is not a git repo. Warning would print on every
+ * such session-start and train exactly the reflex that makes the
+ * `git-unavailable` / `git-error` lines worthless.
+ *
+ * Expressed as a SUBTRACTION from `isQueryFailure` rather than as a hard-coded
+ * warn-list, so a reason added to the frozen set upstream is warned by default
+ * (fail-toward-visible) instead of silently inheriting the benign path.
+ *
+ * @type {ReadonlySet<string>}
+ */
+const SILENT_QUERY_FAILURES = new Set(['not-a-git-repo']);
+
+/**
+ * Classify a rejected ASYNC `execFile` into a `REMOTE_RESOLUTION_REASONS`
+ * member.
+ *
+ * This cannot reuse `vcs-repo-spec.mjs`'s own (unexported) `classifyGitFailure`
+ * because that one reads an `execFileSync` result, where the spawn errno lands
+ * in `err.code` and the child's exit status in `err.status`. Async `execFile`
+ * folds BOTH into `err.code`, discriminated only by TYPE: the string `'ENOENT'`
+ * when the binary is not on PATH, the number `128` when git ran and rejected
+ * the path as a work tree. Same taxonomy, different carrier.
+ *
+ * @param {unknown} err
+ * @returns {'git-unavailable'|'not-a-git-repo'|'git-error'}
+ */
+function classifyGitProbeFailure(err) {
+  const code = err && typeof err === 'object' ? /** @type {any} */ (err).code : undefined;
+  if (code === 'ENOENT') return 'git-unavailable';
+  // `git remote -v` exits 128 for "not a git repository" — and, unlike the
+  // `remote get-url origin` call this replaced, NOT for "no such remote":
+  // a repo with zero remotes exits 0 with empty stdout. That is exactly the
+  // split that makes `no-remotes` (benign absence) reportable at all.
+  if (code === 128) return 'not-a-git-repo';
+  return 'git-error';
+}
+
+/**
+ * Detect the repo's VCS family from its git remotes.
+ *
+ * **Never throws.** Returns a discriminated result carrying a reason from
+ * `vcs-repo-spec.mjs`'s frozen `REMOTE_RESOLUTION_REASONS` (plus
+ * {@link PROBE_TIMEOUT}), so the caller can separate "I could not ask"
+ * (`isQueryFailure` → WARN) from "I asked; this repo has no VCS remote"
+ * (benign, silent). This is the `mirror-issues-banner.mjs` shape — a third
+ * state beyond `value | null` — applied to the last unmigrated path in this
+ * module (#1039).
+ *
+ * What it replaces, and why both halves were defects:
+ *   1. `git remote get-url origin` — a hard-coded remote NAME. In a repo whose
+ *      remotes are `gitlab` + `github` (no `origin`) the call failed, the
+ *      caller swallowed it to `null`, and the banner was structurally dark:
+ *      it could never report, not even on a red pipeline.
+ *   2. `remoteUrl.includes('github.com') ? 'github' : 'gitlab'` — a substring
+ *      test that classifies GitHub Enterprise (`git@github.example.com:o/r`)
+ *      as gitlab and then drives `glab` at a GitHub instance.
+ * `detectVcsFamily` fixes both: preference-ordered remote selection, and
+ * host-prefix classification (`github.*` / `gitlab.*`) ahead of remote-name.
+ *
+ * The `git remote -v` spawn stays HERE rather than inside `detectVcsFamily`
+ * because this module owes every subprocess a timeout race — the shared core
+ * is synchronous by design. So the output is captured once and handed to the
+ * shared classifier through its `gitRun` seam: one spawn, one taxonomy, no
+ * second copy of the parsing or the credential strip.
  *
  * @param {string} repoRoot
  * @param {{ execFile?: Function, timeoutMs?: number }} deps
- * @returns {Promise<'github'|'gitlab'>}
+ * @returns {Promise<{ ok: true, vcs: 'github'|'gitlab' }
+ *   | { ok: false, reason: string, stderr?: string }>}
  */
 async function detectVcs(repoRoot, deps = {}) {
   // Use the smaller of 2000ms or the caller-supplied timeout so that a short
   // test-level timeout is still respected here.
   const gitTimeout = Math.min(2000, deps.timeoutMs ?? 2000);
-  const result = await execWithTimeout(
-    'git',
-    ['remote', 'get-url', 'origin'],
-    { cwd: repoRoot, timeoutMs: gitTimeout, execFile: deps.execFile },
-  );
-  const remoteUrl = result.stdout.trim();
-  return remoteUrl.includes('github.com') ? 'github' : 'gitlab';
+
+  let stdout;
+  try {
+    const result = await execWithTimeout(
+      'git',
+      ['remote', '-v'],
+      { cwd: repoRoot, timeoutMs: gitTimeout, execFile: deps.execFile },
+    );
+    stdout = String(result?.stdout ?? '');
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err ?? '');
+    if (msg === 'timeout') return { ok: false, reason: PROBE_TIMEOUT };
+    const stderr = err && typeof err === 'object' ? String(/** @type {any} */ (err).stderr ?? '') : '';
+    return { ok: false, reason: classifyGitProbeFailure(err), stderr };
+  }
+
+  // Replay the captured output through the shared core's `gitRun` seam. The
+  // arg guard is insurance, not decoration: `detectVcsFamily` asks only for
+  // `remote -v` today, and if it ever grows a second query the guard turns a
+  // silently-wrong answer (built from the WRONG command's output) into a
+  // reported `git-error`.
+  const replayGitRun = (args) =>
+    Array.isArray(args) && args.at(-2) === 'remote' && args.at(-1) === '-v'
+      ? { ok: true, stdout, stderr: '', status: 0 }
+      : { ok: false, stdout: '', stderr: `unsupported git query in ci-status probe: ${String(args)}`, status: 1 };
+
+  const family = detectVcsFamily({ repoRoot, gitRun: replayGitRun });
+  if (!family.ok) return { ok: false, reason: family.reason, stderr: family.stderr };
+  return { ok: true, vcs: family.vcs };
 }
 
 /**
@@ -76,42 +192,19 @@ async function getHeadSha(repoRoot, deps = {}) {
 }
 
 /**
- * Get GitLab project ID via glab.
- *
- * #872: pins to `deps.repoSpec` via `-R` when resolved (host-pinning —
- * `glab repo view` otherwise falls back to the ambient `GITLAB_HOST`).
- *
- * @param {string} repoRoot
- * @param {{ execFile?: Function, timeoutMs?: number, repoSpec?: string }} deps
- * @returns {Promise<number>}
- */
-async function getGlabProjectId(repoRoot, deps = {}) {
-  const args = ['repo', 'view', '--output', 'json'];
-  if (deps.repoSpec) args.push('-R', deps.repoSpec);
-  const result = await execWithTimeout(
-    'glab',
-    args,
-    { cwd: repoRoot, timeoutMs: deps.timeoutMs ?? DEFAULT_TIMEOUT_MS, execFile: deps.execFile },
-  );
-  const parsed = JSON.parse(result.stdout);
-  return parsed.id;
-}
-
-/**
- * Run `glab api <path>` and return parsed JSON.
+ * Run a host-pinned `glab api <path>` request and return parsed JSON.
  *
- * #872: `glab api` has no repo/`-R` concept — it accepts only `--hostname`
- * to pin which GitLab instance the request targets. Pinned via
- * `deps.repoHost` when resolved.
+ * GitLab's API accepts neither a remote URL nor `-R`; callers provide the host
+ * proven by `resolveGitlabProjectTarget` so this helper cannot fall back to
+ * ambient `GITLAB_HOST` configuration.
  *
  * @param {string} apiPath
  * @param {string} repoRoot
- * @param {{ execFile?: Function, timeoutMs?: number, repoHost?: string }} deps
+ * @param {{ execFile?: Function, timeoutMs?: number, repoHost: string }} deps
  * @returns {Promise<unknown>}
  */
 async function glabApi(apiPath, repoRoot, deps = {}) {
-  const args = ['api', apiPath];
-  if (deps.repoHost) args.push('--hostname', deps.repoHost);
+  const args = ['api', apiPath, '--hostname', deps.repoHost];
   const result = await execWithTimeout(
     'glab',
     args,
@@ -161,17 +254,32 @@ function ageDaysFrom(isoDate, now) {
  *
  * @param {string} repoRoot
  * @param {number} now
- * @param {{ execFile?: Function, timeoutMs?: number, repoSpec?: string, repoHost?: string }} deps
+ * @param {{
+ *   execFile?: Function,
+ *   timeoutMs?: number,
+ *   gitlabProject?: { host: string, encodedProjectPath: string },
+ * }} deps
  * @returns {Promise<object|null>}
  */
 async function checkGitlab(repoRoot, now, deps = {}) {
-  const projectId = await getGlabProjectId(repoRoot, deps);
-  const currentSha = await getHeadSha(repoRoot, deps);
+  const project = deps.gitlabProject;
+  if (
+    !project ||
+    typeof project.host !== 'string' ||
+    typeof project.encodedProjectPath !== 'string' ||
+    project.host === '' ||
+    project.encodedProjectPath === ''
+  ) {
+    return null;
+  }
 
+  const currentSha = await getHeadSha(repoRoot, deps);
+  const apiDeps = { ...deps, repoHost: project.host };
+  const projectPath = `projects/${project.encodedProjectPath}`;
   const pipelines = await glabApi(
-    `projects/${projectId}/pipelines?order_by=updated_at&sort=desc&per_page=15`,
+    `${projectPath}/pipelines?order_by=updated_at&sort=desc&per_page=15`,
     repoRoot,
-    deps,
+    apiDeps,
   );
 
   if (!Array.isArray(pipelines)) return null;
@@ -201,9 +309,9 @@ async function checkGitlab(repoRoot, now, deps = {}) {
     let allowFailureJobs;
     try {
       const jobs = await glabApi(
-        `projects/${projectId}/pipelines/${currentPipeline.id}/jobs`,
+        `${projectPath}/pipelines/${currentPipeline.id}/jobs`,
         repoRoot,
-        deps,
+        apiDeps,
       );
       if (Array.isArray(jobs)) {
         const softFailed = jobs
@@ -268,9 +376,9 @@ async function checkGitlab(repoRoot, now, deps = {}) {
     let failingJobName;
     try {
       const jobs = await glabApi(
-        `projects/${projectId}/pipelines/${currentPipeline.id}/jobs`,
+        `${projectPath}/pipelines/${currentPipeline.id}/jobs`,
         repoRoot,
-        deps,
+        apiDeps,
       );
       if (Array.isArray(jobs)) {
         const failedJob = jobs.find((j) => j.status === 'failed');
@@ -308,9 +416,25 @@ async function checkGitlab(repoRoot, now, deps = {}) {
 /**
  * GitHub CI status check (v1 — red/green only; lastGreen not implemented).
  *
- * #872: pins the `gh repo view` lookup to `deps.repoSpec` via `-R` when
- * resolved (host-pinning — `gh repo view` otherwise falls back to the
- * ambient `GH_HOST`).
+ * #872/#1022: pins the `gh repo view` lookup to `deps.repoSpec` when resolved
+ * (host-pinning — `gh repo view` otherwise falls back to the ambient
+ * `GH_HOST`). The spec is passed POSITIONALLY, not via `-R`: `gh repo view`
+ * takes `[<repository>]` as a positional argument and has no `-R`/`--repo`
+ * flag at all, so `-R` made gh exit 1 with `unknown shorthand flag: 'R'` —
+ * an error `checkCiStatus`'s outer catch swallowed to `null`, leaving the
+ * Phase 4 banner silently dead on EVERY GitHub repo (#1022). The
+ * `[HOST/]OWNER/REPO` shape `resolveRepoSpec({ vcs: 'github' })` returns is
+ * exactly the positional's documented input format.
+ *
+ * GitLab CI differs deliberately: it derives a host-pinned API target from
+ * the selected remote, while GitHub still needs this lookup because its API
+ * path requires `nameWithOwner`. Do not unify these call sites.
+ *
+ * `nameWithOwner` is NOT derivable from `deps.repoSpec`, so this lookup
+ * cannot be dropped: the spec carries a HOST prefix the `repos/<owner>/<repo>`
+ * API path must not contain, it is `undefined` whenever no remote resolves
+ * (cross-family guard, unsafe-argv guard), and `normalizeGithubSpec` falls
+ * back to the raw URL on an unrecognised remote shape.
  *
  * @param {string} repoRoot
  * @param {{ execFile?: Function, timeoutMs?: number, repoSpec?: string, repoHost?: string }} deps
@@ -318,8 +442,9 @@ async function checkGitlab(repoRoot, now, deps = {}) {
  */
 async function checkGithub(repoRoot, deps = {}) {
   // Resolve owner/repo from gh to keep the API path generic.
-  const repoViewArgs = ['repo', 'view', '--json', 'nameWithOwner'];
-  if (deps.repoSpec) repoViewArgs.push('-R', deps.repoSpec);
+  const repoViewArgs = ['repo', 'view'];
+  if (deps.repoSpec) repoViewArgs.push(deps.repoSpec);
+  repoViewArgs.push('--json', 'nameWithOwner');
   const repoViewResult = await execWithTimeout(
     'gh',
     repoViewArgs,
@@ -387,11 +512,17 @@ async function checkGithub(repoRoot, deps = {}) {
  * Checks CI status for the current HEAD commit.
  *
  * Returns `null` (silent no-op) when:
- *   - Not in a VCS repo (no git origin)
+ *   - The repo has no usable VCS remote (not a git repo, no remotes at all,
+ *     or >= 2 remotes with no preference match) — a benign, measured absence
  *   - Required CLI (glab / gh) not in PATH
  *   - Any CLI invocation times out
  *   - JSON parse failure on CLI output
  *
+ * Also returns `null`, but with a `console.warn` trace, when the VCS-detection
+ * QUERY ITSELF failed (`git` not on PATH, `git remote -v` erroring) or when a
+ * present CLI rejected its invocation. `null` alone cannot express "could not
+ * read" — see the outer catch and Step 1 for why the warn channel carries it.
+ *
  * @param {{
  *   repoRoot?: string,
  *   vcs?: 'gitlab'|'github',
@@ -402,10 +533,11 @@ async function checkGithub(repoRoot, deps = {}) {
  *   execFile?: Function,
  *   resolveRepoSpec?: (opts: { repoRoot: string, vcs: 'gitlab'|'github' }) => string|undefined,
  *   resolveRepoHost?: (opts: { repoRoot: string, vcs: 'gitlab'|'github' }) => string|undefined,
- * }} deps  Dependency-injection seam for testing. `resolveRepoSpec`/
- *   `resolveRepoHost` default to the real `vcs-repo-spec.mjs` exports
- *   (#872 host-pinning — see that module for the `-R` vs `--hostname`
- *   contract).
+ *   resolveGitlabProjectTarget?: (opts: { repoRoot: string }) =>
+ *     { host: string, encodedProjectPath: string }|undefined,
+ * }} deps  Dependency-injection seam for testing. GitLab defaults to
+ *   `resolveGitlabProjectTarget`, which proves host and project path from one
+ *   sanitized remote; GitHub retains the #872 spec/host resolvers.
  * @returns {Promise<null | {
  *   status: 'green'|'red'|'unknown',
  *   ok: boolean,
@@ -434,6 +566,7 @@ export async function checkCiStatus(opts = {}, deps = {}) {
 
   const resolveRepoSpecDep = deps.resolveRepoSpec ?? resolveRepoSpec;
   const resolveRepoHostDep = deps.resolveRepoHost ?? resolveRepoHost;
+  const resolveGitlabProjectTargetDep = deps.resolveGitlabProjectTarget ?? resolveGitlabProjectTarget;
 
   const depsWithExec = { execFile: execFileDep, timeoutMs };
 
@@ -441,30 +574,59 @@ export async function checkCiStatus(opts = {}, deps = {}) {
     // Step 1: detect VCS (or use forced value).
     let vcs = forcedVcs;
     if (!vcs) {
-      try {
-        vcs = await detectVcs(repoRoot, depsWithExec);
-      } catch {
-        // No git remote → not in a VCS repo → silent no-op.
+      const detected = await detectVcs(repoRoot, depsWithExec);
+      if (!detected.ok) {
+        // The two-state `null` return is fixed by 13 sibling banners, so the
+        // third state lives in the WARN channel: an ABSENCE (`no-remotes`,
+        // `no-matching-remote`, `unsafe-value`) is a real, benign answer and
+        // stays silent — warning there would train operators to ignore this
+        // line, which is the more expensive error. A QUERY FAILURE
+        // (`git-unavailable`, `git-error`) means the question could not be
+        // asked at all, and that is precisely the state that was
+        // indistinguishable from "nothing to report" before #1039.
+        // `not-a-git-repo` is the one query failure this banner reads as an
+        // absence — see {@link SILENT_QUERY_FAILURES}.
+        if (isQueryFailure(detected.reason) && !SILENT_QUERY_FAILURES.has(detected.reason)) {
+          const detail = detected.stderr
+            ? ` — ${redactUrlCredentials(detected.stderr).trim()}`
+            : '';
+          console.warn(
+            `WARN ci-status-banner: VCS detection failed (${detected.reason}), banner suppressed — ` +
+              `CI state is UNKNOWN, not "green".${detail}`,
+          );
+        }
         return null;
       }
+      vcs = detected.vcs;
     }
 
-    // Step 1b (#872): resolve the -R/--hostname host-pinning spec ONCE per
-    // checkCiStatus call — a bare glab/gh spawn falls back to the ambient
-    // GITLAB_HOST/GH_HOST env var, which can silently target the wrong
-    // instance on a multi-instance host. `cwd: repoRoot` alone does not fix
-    // this (ambient env still wins over cwd).
-    const repoSpec = resolveRepoSpecDep({ repoRoot, vcs });
-    const repoHost = resolveRepoHostDep({ repoRoot, vcs });
-    const depsWithPinning = { ...depsWithExec, repoSpec, repoHost };
-
-    // Step 2: dispatch to VCS-specific implementation.
+    // Step 1b: GitLab's API target must be proven before its first glab spawn.
+    // A missing target is never permission to fall back to ambient
+    // GITLAB_HOST/repository configuration. GitHub retains its distinct
+    // repository lookup because its API path requires `nameWithOwner`.
+    //
+    // It is also not an ABSENCE: detectVcs just proved a GitLab remote exists,
+    // so `!gitlabProject` means "remote present, its form was rejected" — a
+    // QUERY FAILURE by the same rule the block above states. Returning null
+    // silently put this repo back in the pre-#1039 state where "CI green" and
+    // "could not ask" look identical. Reachable inputs measured 2026-08-21:
+    // `git://` scheme, a doubled slash in the path, a query string.
     if (vcs === 'gitlab') {
-      return await checkGitlab(repoRoot, now, depsWithPinning);
+      const gitlabProject = resolveGitlabProjectTargetDep({ repoRoot });
+      if (!gitlabProject) {
+        console.warn(
+          'WARN ci-status-banner: a GitLab remote was detected but its host/project path ' +
+            'could not be derived, banner suppressed — CI state is UNKNOWN, not "green".',
+        );
+        return null;
+      }
+      return await checkGitlab(repoRoot, now, { ...depsWithExec, gitlabProject });
     }
 
     if (vcs === 'github') {
-      return await checkGithub(repoRoot, depsWithPinning);
+      const repoSpec = resolveRepoSpecDep({ repoRoot, vcs });
+      const repoHost = resolveRepoHostDep({ repoRoot, vcs });
+      return await checkGithub(repoRoot, { ...depsWithExec, repoSpec, repoHost });
     }
 
     // Unknown VCS value — silent no-op.
@@ -482,7 +644,35 @@ export async function checkCiStatus(opts = {}, deps = {}) {
       return null;
     }
 
-    // Unexpected errors → also silent null to keep the banner non-blocking.
+    // Everything else means the CLI was PRESENT but the invocation failed —
+    // non-zero exit, rejected flag, unparseable output. Returning a bare null
+    // here makes that state indistinguishable from "CLI not installed", which
+    // is exactly how #1022 (`gh repo view -R` → `unknown shorthand flag: 'R'`)
+    // stayed invisible on every GitHub repo. THIS module keeps the two-state
+    // contract (null ⇒ silent no-op) for backwards compatibility with the
+    // Phase-4 callers already written against it, so leave a stderr trace
+    // instead: non-blocking, but the next defect of this class is no longer
+    // silent. Credentials redacted defense-in-depth (#907) — the message can
+    // quote the failed argv, which carries the repo spec.
+    //
+    // DIRECTION FOR NEW BANNERS — do not copy this shape. The
+    // absence-preserving form is `scripts/lib/mirror-issues-banner.mjs`: a
+    // THIRD return state `{ severity, message, degraded }` whose `degraded`
+    // is a member of the closed `DEGRADED_REASONS` enum exported there, so
+    // "could not read" stays distinguishable from "read, and clean".
+    //
+    // The REMOTE probe (`detectVcs`) has since been pulled onto that shape
+    // (#1039): it returns a reason from the frozen `REMOTE_RESOLUTION_REASONS`
+    // set and Step 1 branches on `isQueryFailure` — absence silent, query
+    // failure warned. This outer catch is what remains unmigrated: it still
+    // collapses every CLI-side failure onto `null`, which a caller reads as
+    // all-clear, and it cannot be widened without changing a return contract
+    // 13 sibling banners share. Same verdict, stated caller-side, in
+    // `skills/session-start/SKILL.md` § Phase 4 (the mirror-issues
+    // paragraph): "Do not reproduce it."
+    console.warn(
+      `WARN ci-status-banner: CI status check failed, banner suppressed — ${redactUrlCredentials(msg)}`,
+    );
     return null;
   }
 }

package/scripts/lib/config/dispatcher-autonomy-capture.mjs

@@ -43,13 +43,36 @@ import { hasBlockHeader } from './block-header.mjs';
 const ALLOWED_AUTONOMY = ['off', 'advisory', 'autonomous-gated'];
 const DEFAULT_CONFIDENCE_FLOOR = 0.5;
 
+/**
+ * The display-only tail of an option LABEL, stripped before the enum match.
+ *
+ * The label and the stored value were the SAME string, which made the label
+ * unchangeable: both consumers (`skills/session-start/SKILL.md` Phase 1.1 and
+ * `skills/bootstrap/SKILL.md` Phase 3.5.1) hand the SELECTED LABEL straight to
+ * writeDispatcherAutonomyBlock(), and coerceAutonomy() falls back to 'off' on
+ * any value outside the enum. Putting AUQ-003's `(Recommended)` marker into the
+ * label would therefore have written `autonomy: off` for an operator who picked
+ * `advisory` — a silent downgrade, fail-closed and therefore invisible.
+ *
+ * Measured before this split (renderDispatcherAutonomyBlock, 2026-08-22):
+ *   'advisory'                => autonomy: advisory
+ *   'Advisory (surface only)' => autonomy: off      ← the downgrade
+ *
+ * Anchored at the end, so it can only ever strip a suffix. The enum values
+ * themselves are untouched and stay greppable.
+ */
+const RECOMMENDED_SUFFIX = /\s*\((?:Recommended|Empfohlen|Default)\)\s*$/u;
+
 /**
  * Coordinator-facing AUQ question definition for the one-time capture.
  * Mirrors the shape of `getInterviewQuestions()` entries in owner-interview.mjs:
  *   { question, header, options: [{ label, description }], multiSelect }
  *
- * Option labels match the ALLOWED_AUTONOMY enum so the selected label maps
- * directly to the `autonomy` value passed to writeDispatcherAutonomyBlock().
+ * Each label BEGINS with its ALLOWED_AUTONOMY value; option 1 additionally
+ * carries the `(Recommended)` marker AUQ-003 puts in the label. `coerceAutonomy()`
+ * strips that marker, so the selected label still maps to the enum value written
+ * by writeDispatcherAutonomyBlock() — see the comment on RECOMMENDED_SUFFIX for
+ * why the two halves must not be the same string.
  * Option 1 (`off`) is the recommended, fail-closed default.
  *
  * @returns {{ question: string, header: string, options: Array<{ label: string, description: string }>, multiSelect: boolean }}
@@ -57,23 +80,23 @@ const DEFAULT_CONFIDENCE_FLOOR = 0.5;
 export function getDispatcherAutonomyQuestion() {
   return {
     question:
-      'Cross-repo dispatcher autonomy: how should this repo participate when the free-repo dispatcher routes work to it?',
-    header: 'Dispatcher Autonomy (one-time)',
+      'When /dispatcher looks across your repos for the next one to work on, how may it treat this repo?',
+    header: 'Dispatcher',
     options: [
       {
-        label: 'off',
+        label: 'off (Recommended)',
         description:
-          '(Recommended) Fail-closed. The dispatcher never routes work to this repo automatically. No behaviour change.',
+          'Nothing changes: this repo is never offered and never started for you. Safe default — you keep picking the work.',
       },
       {
         label: 'advisory',
         description:
-          'The dispatcher surfaces ranked free-repo candidates for operator review — no automated dispatch.',
+          'This repo may appear in the ranked suggestions, so you can compare it against the others. You still start each session.',
       },
       {
         label: 'autonomous-gated',
         description:
-          'A deterministic confidence gate is checked first; only dispatches that clear the confidence-floor route automatically.',
+          'Work may start here without asking, but only when the ranking beats the confidence floor written next to this setting.',
       },
     ],
     multiSelect: false,
@@ -128,7 +151,7 @@ export function isDispatcherAutonomyBlockPresent(claudeMdContent) {
  */
 function coerceAutonomy(value) {
   if (value === null || value === undefined) return 'off';
-  const normalized = String(value).toLowerCase().trim();
+  const normalized = String(value).toLowerCase().replace(RECOMMENDED_SUFFIX, '').trim();
   return ALLOWED_AUTONOMY.includes(normalized) ? normalized : 'off';
 }
 

package/scripts/lib/config/vault-integration.mjs

@@ -192,9 +192,20 @@ function _parseInlineObject(raw) {
  */
 export function _parseResourceThresholds(kv) {
   return {
+    // Memory thresholds are denominated in the signal `evaluate()` actually
+    // judges on — memory_pressure > ram_available > ram_free, in that order
+    // (#1089). They are NOT compared against Darwin's `os.freemem()` unless
+    // nothing better is published, which on Darwin never happens.
     'ram-free-min-gb': _coerceInteger(kv, 'ram-free-min-gb', 4),
     'ram-free-critical-gb': _coerceInteger(kv, 'ram-free-critical-gb', 2),
-    'cpu-load-max-pct': _coerceInteger(kv, 'cpu-load-max-pct', 80),
+    // 80 → 90 (#1089). At 80 this fired on 15.6% of 1477 measured session
+    // starts, largely on the decaying tail of the coordinator's own gate run;
+    // at 90 it fires on 12.8%, and under the two-signal rule it no longer caps
+    // anything on its own. Both numbers are measurements, not preferences.
+    'cpu-load-max-pct': _coerceInteger(kv, 'cpu-load-max-pct', 90),
+    // Unchanged at 5 — but now compared against LIVE PEER SESSIONS rather than
+    // the Claude process count. Same number, different denominator: measured
+    // firing rate drops from 93.6% to 4.2% (median processes:sessions = 6.0).
     'concurrent-sessions-warn': _coerceInteger(kv, 'concurrent-sessions-warn', 5),
     'ssh-no-docker': _coerceBoolean(kv, 'ssh-no-docker', true),
   };

package/scripts/lib/dispatcher/rank.mjs

@@ -34,7 +34,7 @@ import path from 'node:path';
 
 import { scanBacklog } from '../backlog-scan.mjs';
 import { checkCiStatus as realCheckCiStatus } from '../ci-status-banner.mjs';
-import { probe as realProbe, evaluate as realEvaluate } from '../resource-probe.mjs';
+import { probe as realProbe, evaluate as realEvaluate, DEFAULT_RESOURCE_THRESHOLDS as CANONICAL_RESOURCE_THRESHOLDS } from '../resource-probe.mjs';
 import { isRealSession } from '../session-schema/filters.mjs';
 
 /** Staleness cap (days). Beyond this, additional age does not raise the score. */
@@ -49,12 +49,9 @@ const MS_PER_DAY = 86_400_000;
  * Used by the default `resourceVerdict` dep so ranking works standalone
  * without a parsed Session Config in hand.
  */
-const DEFAULT_RESOURCE_THRESHOLDS = {
-  'ram-free-min-gb': 4,
-  'ram-free-critical-gb': 2,
-  'cpu-load-max-pct': 80,
-  'concurrent-sessions-warn': 5,
-};
+// #1089: re-exported from the single canonical definition rather than a third
+// hand-maintained copy — the three copies had already drifted apart.
+const DEFAULT_RESOURCE_THRESHOLDS = { ...CANONICAL_RESOURCE_THRESHOLDS };
 
 // ---------------------------------------------------------------------------
 // PURE core

package/scripts/lib/gates/gate-full.mjs

@@ -36,7 +36,7 @@ const startTime = Date.now();
 const tcResult = runCheck(typecheckCmd);
 const tcErrorCount =
   tcResult.status === 'fail'
-    ? extractCount(tcResult.output, /error TS\d+/)
+    ? extractCount(tcResult.fullOutput ?? tcResult.output, /error TS\d+/)
     : 0;
 
 // --- Test ---
@@ -46,14 +46,14 @@ const tcErrorCount =
 const testResult = runCheck(testCmd);
 const { passed: testPassed, failed: testFailed, total: testTotal } =
   testResult.status !== 'skip'
-    ? extractTestCounts(testResult.output)
+    ? extractTestCounts(testResult.fullOutput ?? testResult.output)
     : { passed: 0, failed: 0, total: 0 };
 
 // --- Lint ---
 const lintResult = runCheck(lintCmd);
 const lintWarnings =
   lintResult.status !== 'skip'
-    ? extractCount(lintResult.output, /warning/i)
+    ? extractCount(lintResult.fullOutput ?? lintResult.output, /warning/i)
     : 0;
 
 // --- Debug artifacts ---