session-orchestrator 3.20.0 → 3.22.0

package/scripts/lib/validate/check-owner-leakage.mjs

@@ -9,11 +9,14 @@
  * `canonicalizeLine()` collapses every known textual encoding of a path
  * (URL-percent, dash-as-separator, backslash, double-slash, `\uXXXX`/`%uXXXX`
  * escapes, HTML/numeric entities, unicode homoglyph slashes/dashes, case)
- * into ONE canonical slash-form, and the owner-secret patterns are matched
- * ONCE against that canonical form (plus the raw line, for belt-and-braces).
- * A novel encoding of the same path normalizes to the same canonical string,
- * so it is caught structurally — no new regex required. Err toward
- * over-matching: this is a security guard, a false-positive is cheap, a
+ * into ONE canonical slash-form. CP1 is matched against that canonical form;
+ * the four DOT-anchored host/IP rules (CP2, CP3, CP7, CP8) are matched against
+ * the raw line AND the canonical form (#1080). The remaining rules stay RAW by
+ * measurement, not oversight — see the `canon` comment in the line loop for why
+ * the slash-anchored (CP4, CP10) and slug-anchored (CP6) rules must not be
+ * canonicalized. A novel encoding of the same path normalizes to the same
+ * canonical string, so it is caught structurally — no new regex required. Err
+ * toward over-matching: this is a security guard, a false-positive is cheap, a
  * false-negative ships a leak to the public mirror.
  *
  * Usage: check-owner-leakage.mjs <plugin-root>
@@ -65,6 +68,13 @@
  *      (a real string-literal events.gotzendorfer.at elsewhere in that file still FAILs)
  *   6. tests/scripts/export-hw-learnings.test.mjs — exempt from P8 ONLY: the RFC1918
  *      IPs there are the redaction subject of the anonymizeString suite, not leaks.
+ *   7. The public-site URL in the three PUBLISHED site pages (site/index.html,
+ *      site/impressum/index.html, site/datenschutz/index.html) — the domain is a
+ *      legally mandated publication (Impressum, §5 ECG) plus the JSON-LD
+ *      publisher/author identity and the rel="author" footer link. Like every
+ *      exclusion above it is LINE-SCOPED and reached only via isAllowlisted(), which
+ *      only CP3 and CP7 consult — CP1/CP2/CP4/CP5/CP6/CP8/CP10/CP11 still fail on
+ *      these files, on the very same line. (#1076)
  *
  * Exit codes:
  *   0 — all checks passed
@@ -434,6 +444,41 @@ const CP6_INPROCESS_PATTERNS = PRIVATE_SLUGS
 /** CP7: catch-all gotzendorfer.at (must not match allowlist) */
 const CP7 = /gotzendorfer\.at/;
 
+/**
+ * GLOBAL twins of the two allowlist-consulting domain rules, used to count
+ * OCCURRENCES in the raw vs the canonical form of a line (#1080 Finding A).
+ *
+ * Why an occurrence COUNT and not simply a second `.test()` on the canonical
+ * form: CP3 and CP7 are the only rules whose verdict is filtered by
+ * isAllowlisted(), and that allowlist matches a LINE FORM — the sanctioned
+ * Impressum/author URL, and the exact events doc-comment contract line.
+ * Canonicalization folds every `-` run to `/`, which mangles precisely that
+ * prose: ` *   - No literal ...` canonicalizes to ` *   / No literal ...`. So
+ * re-running isAllowlisted() against the canonical form would fail to recognise
+ * its own sanctioned line and turn this gate — and with it .husky/pre-commit —
+ * permanently red on a clean tree. Measured, not reasoned: that exact exclusion
+ * regex returns true on the raw line and false on its canonical form.
+ *
+ * The occurrence count separates the two cases without touching the allowlist:
+ * when the canonical form carries MORE domain tokens than the raw line, the
+ * surplus was produced by DECODING an escape, and a decoded token can never be
+ * the sanctioned publication the allowlist covers — so it bypasses the allowlist.
+ * When the counts are equal, the rule behaves exactly as it always did and
+ * consults the allowlist on the raw line.
+ */
+const CP3_G = /\bevents\.gotzendorfer\.at\b/g;
+const CP7_G = /gotzendorfer\.at/g;
+
+/**
+ * Count matches of a GLOBAL regex in `s` (0 when none).
+ * @param {RegExp} re a regex carrying the `g` flag
+ * @param {string} s
+ * @returns {number}
+ */
+function countMatches(re, s) {
+  return (s.match(re) || []).length;
+}
+
 /**
  * CP8: full RFC1918 private dotted-quad — internal-IP leak.
  * Matches only literal 4-octet private IPs (10.x.x.x, 192.168.x.x, 172.16-31.x.x).
@@ -511,6 +556,29 @@ function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+// DELIBERATE DUPLICATE — do not replace the function below with an import from
+// `scripts/lib/redact-spans.mjs`. This scanner is a documented STANDALONE
+// SINGLE-FILE vendoring target (`.claude/rules/security.md` § "Owner-Privacy
+// Pre-Commit Hook": consumer repos copy exactly this ONE file into their tree as
+// a pre-commit stage). A static import resolves in-tree but throws
+// ERR_MODULE_NOT_FOUND in every vendored copy — under the husky stage that means
+// empty stdout + exit 1 on a CLEAN tree, i.e. every commit blocked. Not
+// hypothetical: `tests/husky/pre-commit-owner-leakage.test.mjs` cpSync()s this
+// single file into a tmp repo, and the static-import variant turned all three of
+// its cases red (#974).
+//
+// The dynamic-import degrade used by getConfidentialNamePatterns() is NOT
+// available here. That helper degrades to `[]` — CP11 goes inert, CP1–CP10 keep
+// running, nothing leaks. A failed REDACTION has the opposite failure direction:
+// it prints confidential names verbatim into a PUBLIC GitHub-Actions log, which
+// is precisely the exposure this function exists to prevent (Fix 1 below). The
+// redaction sink must be unconditionally present, so it lives inline.
+//
+// `scripts/lib/redact-spans.mjs` is the shared primitive for IN-TREE consumers
+// (e.g. `scripts/lib/secret-masker.mjs`); this copy serves the vendored path.
+// The two are pinned byte-for-byte against each other by the drift guard in
+// `tests/lib/redact-spans.test.mjs` — change one and that suite goes red until
+// both agree again.
 /**
  * Redact every confidential-name span from `line`, ORDER-INDEPENDENTLY (Fix 1 + Fix 2).
  *
@@ -622,7 +690,47 @@ async function getConfidentialNamePatterns() {
 // ---------------------------------------------------------------------------
 // Text-scan extension allowlist (spec A.2)
 // ---------------------------------------------------------------------------
-const TEXT_EXTS = new Set(['.md', '.mjs', '.js', '.ts', '.json', '.yml', '.yaml', '.sh', '.txt']);
+// '.html' (#1076): the site/ tree is PUBLICLY SHIPPED (vercel.json outputDirectory:
+// "site"), so it is the highest-consequence class to scan, yet it was ungated here and
+// therefore invisible to all eleven CP rules.
+//
+// CORRECTION (#1080 Finding A). An earlier revision of this comment justified '.html'
+// partly by claiming its addition "revives canonicalizeLine()'s HTML-entity decoding,
+// which was dead in practice". That was true of exactly ONE of the eleven rules.
+// matchOwnerPath() (CP1) was the SOLE consumer of the canonical form — CP2-CP8, CP10
+// and CP11 each tested the RAW line — so an entity-encoded private host inside an href
+// (a link the BROWSER resolves and the scanner did not) still reported nothing. The
+// per-line canonical re-test in the scan loop below is what actually closes that, and
+// only for the four dot-anchored rules; see the `canon` comment there for why the rest
+// stay raw.
+//
+// '.xml', '.svg', '.css' (#1080 Finding B): the PUBLICLY-SHIPPED sentence above is true
+// VERBATIM of site/sitemap.xml and site/favicon.svg — same directory, same publication,
+// same consequence — which the '.html' addition walked past. Measured with one identical
+// planted defect per class before adding: the .html and .txt copies FAILed, the .xml and
+// .svg copies reported nothing. Cost is zero: the five tracked files in these classes
+// (assets/icon.svg, assets/og-card.svg, site/favicon.svg, site/sitemap.xml,
+// templates/static-html/styles.css) carry no hits — 1542 -> 1547 scanned, 0 findings.
+// `.jsonl` closes a gap this very wave opened: the harvested golden-record fixture at
+// tests/lib/vault-mirror/fixtures/golden-sessions.jsonl is tracked production data that
+// `.json` does not match, so the scanner would have skipped it for good. Measured before
+// adding: all 7 tracked `.jsonl` files pass (1525 -> 1532 scanned, 0 findings).
+const TEXT_EXTS = new Set([
+  '.md',
+  '.mjs',
+  '.js',
+  '.ts',
+  '.json',
+  '.jsonl',
+  '.yml',
+  '.yaml',
+  '.sh',
+  '.txt',
+  '.html',
+  '.xml',
+  '.svg',
+  '.css',
+]);
 
 // Dotfiles to include (checked by basename, BEFORE the extension gate —
 // extname('.env.example') is '.example' (truthy), so an extension-first check
@@ -723,16 +831,33 @@ function isAllowlisted(relPath, line) {
     '.claude-plugin/plugin.json',
     '.claude-plugin/marketplace.json',
     '.codex-plugin/plugin.json',
+    // A.4 exclusion 7 (#1076): the three PUBLISHED static pages (vercel.json
+    // outputDirectory: "site"). Rule-based, never file-based — membership here only
+    // buys the line-form test below, and isAllowlisted() is consulted by CP3 and CP7
+    // ONLY. A SELF_EXCLUSIONS entry would instead have switched off all eleven rules
+    // for these files; that broad form is deliberately NOT used.
+    'site/index.html',
+    'site/impressum/index.html',
+    'site/datenschutz/index.html',
   ]);
   const inAllowlistedFile = ALLOWLISTED_URL_PATHS.has(norm);
 
   if (inAllowlistedFile) {
     // Check that the only gotzendorfer.at occurrences on this line are sanctioned URLs or emails
     const SANCTIONED_URL = /https?:\/\/gotzendorfer\.at\b/g;
+    // The published site uses the www. host throughout, which SANCTIONED_URL cannot
+    // match — it requires the bare domain IMMEDIATELY after the scheme. Without this
+    // second form the three site entries above would exclude NOTHING and the gate
+    // (including .husky/pre-commit) would be permanently red. The two forms are
+    // DISJOINT: the www. prefix is mandatory here and impossible there, so no line
+    // can be counted twice (README.md stays at 1 token / 1 sanctioned match).
+    const SANCTIONED_PUBLIC_SITE = /(?:https?:\/\/)?www\.gotzendorfer\.at\b/g;
     const allGotzOnLine = [...line.matchAll(/gotzendorfer\.at/g)];
     const sanctionedUrlMatches = [...line.matchAll(SANCTIONED_URL)];
+    const sanctionedSiteMatches = [...line.matchAll(SANCTIONED_PUBLIC_SITE)];
     const emailMatches = [...line.matchAll(SANCTIONED_EMAILS)];
-    const totalSanctioned = sanctionedUrlMatches.length + emailMatches.length;
+    const totalSanctioned =
+      sanctionedUrlMatches.length + sanctionedSiteMatches.length + emailMatches.length;
     if (allGotzOnLine.length > 0 && allGotzOnLine.length === totalSanctioned) {
       return true;
     }
@@ -839,6 +964,33 @@ for (const filePath of scanFiles) {
   lines.forEach((line, idx) => {
     const lineNum = idx + 1;
 
+    // The canonical form of this line, computed ONCE (#1080 Finding A). Until now
+    // matchOwnerPath (CP1) was the ONLY consumer of canonicalizeLine; every other rule
+    // tested the raw line, so an entity-encoded private host inside an href resolved in
+    // the browser and reported nothing here. The four DOT-anchored rules (CP2, CP3, CP7,
+    // CP8) are re-tested against it below.
+    //
+    // Why exactly those four, and not every rule — the discriminator is which character
+    // the rule ANCHORS on, and it was measured, not assumed:
+    //   - Canonicalization can FABRICATE a '/' out of any benign hyphen run
+    //     (`@goetzendorfer-team` -> `@goetzendorfer/team`, `~-Projects-Bernhard` ->
+    //     `~/Projects/Bernhard`; both flip false -> true under canon). So the
+    //     SLASH-anchored rules CP4 and CP10 would gain folding artifacts, and stay raw.
+    //   - It can never fabricate a '.' from a separator: `gitlab-gotzendorfer-at`
+    //     canonicalizes to `gitlab/gotzendorfer/at`, dot-free. A '.' appears in the
+    //     canonical form ONLY by decoding an escape — which is the evasion itself. So for
+    //     the DOT-anchored rules (CP2, CP3, CP7, CP8) every canonical-only hit is a
+    //     decoded evasion by construction, and the false-positive surface is empty.
+    //   - CP6 stays raw for the mirror-image reason: it anchors on `\b`-delimited slug
+    //     literals, and the dash folding SHREDS five of the seven slugs
+    //     (`mail-assistant` -> `mail/assistant`, which `\bmail-assistant\b` no longer
+    //     matches), so a canonical test there is a no-op at best.
+    //   - CP5 anchors on an identifier and CP11 on host-local names; neither is a path or
+    //     host spelling, so neither is re-tested.
+    // Repo-wide cost of the four, measured over 1547 tracked files before landing: 0 new
+    // findings.
+    const canon = canonicalizeLine(line);
+
     // CP1: personal home path — CANONICALIZED match (#661). One structural rule
     // replaces the slash-form (P1, #631) + dash-encoded (P9, #634) treadmill and
     // catches percent/unicode/backslash/homoglyph encodings of the same path.
@@ -847,14 +999,22 @@ for (const filePath of scanFiles) {
       violations.push({ relPath, lineNum, pattern: ownerPathHit, lineContent: line.trim() });
     }
 
-    // CP2: private GitLab host
-    if (CP2.test(line)) {
+    // CP2: private GitLab host — raw OR canonical (#1080). ONE `if` per rule, so a
+    // line matching BOTH forms still reports exactly ONE violation. (The pre-existing
+    // 'CP2: private GitLab host' scan row, which expects fails: 2 for the CP2+CP7 pair,
+    // is the standing guard against a double-count regression here.) CP2 consults no
+    // allowlist, so the raw/canonical split CP3 and CP7 need does not arise.
+    if (CP2.test(line) || CP2.test(canon)) {
       violations.push({ relPath, lineNum, pattern: 'CP2 (gitlab.gotzendorfer.at)', lineContent: line.trim() });
     }
 
-    // CP3: private events domain — check exclusion 6 first
-    if (CP3.test(line)) {
-      if (!isAllowlisted(relPath, line)) {
+    // CP3: private events domain — the raw form consults the exclusion allowlist
+    // exactly as before; a DECODED surplus occurrence (canonical count > raw count)
+    // bypasses it, because an encoded spelling is never the sanctioned publication.
+    // See CP3_G / CP7_G for why this is a count and not isAllowlisted(relPath, canon).
+    const cp3Decoded = countMatches(CP3_G, canon) > countMatches(CP3_G, line);
+    if (CP3.test(line) || cp3Decoded) {
+      if (cp3Decoded || !isAllowlisted(relPath, line)) {
         violations.push({ relPath, lineNum, pattern: 'CP3 (events.gotzendorfer.at)', lineContent: line.trim() });
       }
     }
@@ -879,15 +1039,23 @@ for (const filePath of scanFiles) {
       }
     }
 
-    // CP7: catch-all gotzendorfer.at — check exclusion allowlist
-    if (CP7.test(line)) {
-      if (!isAllowlisted(relPath, line)) {
+    // CP7: catch-all gotzendorfer.at — same split as CP3: the raw form consults the
+    // exclusion allowlist, a decoded surplus occurrence bypasses it. This is the arm
+    // that catches the sharpest shape of #1080 Finding A — a WORKING link on a published
+    // page, `<a href="https://gitlab&#46;gotzendorfer&#46;at/...">`, which the browser
+    // resolves and the raw-only rule read as ordinary text.
+    const cp7Decoded = countMatches(CP7_G, canon) > countMatches(CP7_G, line);
+    if (CP7.test(line) || cp7Decoded) {
+      if (cp7Decoded || !isAllowlisted(relPath, line)) {
         violations.push({ relPath, lineNum, pattern: 'CP7 (gotzendorfer.at catch-all)', lineContent: line.trim() });
       }
     }
 
-    // CP8: full RFC1918 private dotted-quad — internal IP leak (redaction-test fixtures exempt)
-    if (CP8.test(line) && !CP8_ALLOWLIST.has(relPath)) {
+    // CP8: full RFC1918 private dotted-quad — internal IP leak (redaction-test fixtures
+    // exempt). Raw OR canonical: `10&#46;11&#46;12&#46;13` decodes to a literal quad.
+    // The allowlist here is PATH-scoped, not line-scoped, so it needs no raw/canonical
+    // split — it applies identically to both forms.
+    if ((CP8.test(line) || CP8.test(canon)) && !CP8_ALLOWLIST.has(relPath)) {
       violations.push({ relPath, lineNum, pattern: 'CP8 (RFC1918 private IP)', lineContent: line.trim() });
     }
 

package/scripts/lib/validate/check-rules.mjs

@@ -30,6 +30,51 @@
 //           parse error as always-on with empty meta, so the skipped file is
 //           exactly the one that loads everywhere and clears every gate. See
 //           the inline rationale at the parse site below.
+//       (e) HARNESS-PARITY (#1108): a rule that expresses a path restriction
+//           must express it in `paths:`, because `paths:` is the ONLY key
+//           Claude Code's own rule loader reads. Its documentation
+//           (code.claude.com/docs/en/memory § "Path-specific rules") is
+//           explicit: rules are scoped "using YAML frontmatter with the
+//           `paths` field", and "rules without a `paths` field are loaded
+//           unconditionally and apply to all files". `globs:` is the CURSOR
+//           field name. A `globs:`-only rule is therefore scoped for
+//           rule-loader.mjs (#795 alias) and for Cursor, yet ALWAYS-ON for
+//           Claude Code — the rule *looks* scoped everywhere it is inspected
+//           and is silently loaded everywhere it is used.
+//           Measured 2026-08-22 before the fix: 16 of 31 rule files carried
+//           `globs:` and 0 carried `paths:`, so all 31 loaded unconditionally
+//           — 186,993 bytes ≈ 46,700 tokens per dispatch, 72,195 of them
+//           unwanted (testing.md alone is 36,431 bytes and carries
+//           `tier: wave-only`, i.e. is explicitly meant to be conditional).
+//           This check is the recurrence guard for that fix, not the fix.
+//           It is formulated as a PARITY check rather than a presence check,
+//           which folds two defects into one invariant: the rule must load in
+//           the SAME contexts under Claude Code's loader (which reads
+//           `paths:`, treating absence as always-on) as under rule-loader.mjs
+//           (which reads `globs:` and falls back to `paths:` — #795, globs
+//           wins). Two ways to violate it:
+//             - `globs:` present and non-empty, `paths:` ABSENT → always-on
+//               in Claude Code.
+//             - both present with DIFFERENT pattern sets → Claude Code scopes
+//               on one list, rule-loader.mjs and Cursor on the other.
+//           Order and duplicates are irrelevant (a glob list is matched
+//           any-of), so the comparison is over the sorted unique set.
+//           NOT flagged: `paths:` alone. It is the form the native
+//           documentation prescribes and the form the primary downstream
+//           consumer uses exclusively (projects-baseline: 26 rule files, all
+//           `paths:`, 0 `globs:` — rule-loader.mjs module doc). The
+//           `globs:`-is-canonical preference for VENDORED rules is a separate,
+//           warn-level concern already owned by
+//           scripts/lib/validate-vendored-rules.mjs (~:289, issue #742) and is
+//           deliberately not duplicated here.
+//           NOT flagged either: an EMPTY `globs: []`. That shape is already
+//           owned — with an accurate, opposite message — by the dedicated
+//           empty-globs branches below (#880 QA Defect 1 / #892), and firing
+//           a second, contradictory-sounding finding ("never loads" beside
+//           "always-on in Claude Code") on one file is exactly the confusion
+//           those fixes went out of their way to remove. The parity check
+//           therefore requires a NON-EMPTY `globs:` list; populating it is the
+//           prescribed remedy for `globs: []`, at which point parity binds.
 //
 // (2) HANDWRITTEN rules (no `auto-generated: true` — #880 FA5, WARN-only,
 //     NEVER affects the exit code). The auto-generated brandmauer above only
@@ -70,9 +115,10 @@
 //
 // Usage: check-rules.mjs <plugin-root>
 // Outputs lines of the form "  PASS: ..." / "  FAIL: ..." / "  WARN: ...".
-// Exit 0 = all AUTO-GENERATED invariants satisfied (WARN lines from the
-// handwritten check NEVER affect the exit code); exit 1 = at least one
-// auto-generated FAIL.
+// Exit 0 = all AUTO-GENERATED invariants plus the two cohort-independent
+// invariants (d) frontmatter-parses and (e) harness-parity are satisfied (WARN
+// lines from the handwritten check NEVER affect the exit code); exit 1 = at
+// least one FAIL.
 
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -132,6 +178,69 @@ function hasFrontmatterKey(contents, key) {
   return Boolean(keyMatch && keyMatch[1] && keyMatch[1].trim() !== '');
 }
 
+// ---------------------------------------------------------------------------
+// Per-key list access for the harness-parity check (#1108).
+//
+// `parseGlobsFrontmatter()` deliberately COLLAPSES `globs:` and `paths:` into
+// one value ("callers never see which key produced the value" — rule-loader.mjs
+// module doc, #795 precedence). The parity check needs both lists separately,
+// and re-deriving list parsing here would be a second frontmatter parser — the
+// exact drift class that produced #840. So instead of re-parsing, the OTHER key
+// is MASKED to a name the parser ignores (any key that is neither globs/paths
+// nor in SCALAR_META_KEYS is dropped without error, and its indented `  - x`
+// continuation lines are skipped as "another block's continuation"), and the
+// SAME parser then returns the surviving key's list verbatim — flow style,
+// block style, quote stripping and provenance-header tolerance included.
+//
+// Masking cannot make a parseable file unparseable: it renames a key, so the
+// line keeps its colon. Callers reach this only for files that already parsed.
+// ---------------------------------------------------------------------------
+const MASKED_KEY_PREFIX = 'x-check-rules-masked-';
+
+/**
+ * Returns the value of exactly ONE of the two scope keys, ignoring the other —
+ * `null` when that key is absent, `[]` when present but empty.
+ *
+ * @param {string} contents - raw file contents (must already parse)
+ * @param {'globs'|'paths'} key - the key whose list to return
+ * @returns {string[] | null}
+ */
+function scopeKeyValue(contents, key) {
+  const other = key === 'globs' ? 'paths' : 'globs';
+  const masked = contents.replace(
+    new RegExp(`^${other}:`, 'gm'),
+    `${MASKED_KEY_PREFIX}${other}:`,
+  );
+  return parseGlobsFrontmatter(masked).globs;
+}
+
+/** Sorted, de-duplicated copy — glob lists are matched any-of, so neither
+ * order nor repetition changes which files a rule applies to. */
+function normalizePatterns(list) {
+  return [...new Set(list)].sort();
+}
+
+/**
+ * Harness-parity verdict for one rule file (#1108) — see module doc (e).
+ *
+ * @param {string} contents - raw file contents (must already parse)
+ * @returns {{ ok: true } | { ok: false, kind: 'missing-paths'|'divergent', globs: string[], paths: string[] | null }}
+ */
+function checkHarnessParity(contents) {
+  const globs = scopeKeyValue(contents, 'globs');
+  // Only a NON-EMPTY globs list expresses a path restriction. Absent globs →
+  // whatever `paths:` says is what every loader sees. Empty globs → owned by
+  // the dedicated empty-globs branches, which prescribe populating it.
+  if (!Array.isArray(globs) || globs.length === 0) return { ok: true };
+
+  const paths = scopeKeyValue(contents, 'paths');
+  if (paths === null) return { ok: false, kind: 'missing-paths', globs, paths };
+
+  const same =
+    JSON.stringify(normalizePatterns(globs)) === JSON.stringify(normalizePatterns(paths));
+  return same ? { ok: true } : { ok: false, kind: 'divergent', globs, paths };
+}
+
 // ============================================================================
 // Check: .claude/rules/ rule invariants
 // ============================================================================
@@ -207,17 +316,44 @@ for (const name of mdFiles.sort()) {
   const { globs, meta } = parsed;
   const rel = `.claude/rules/${name}`;
 
+  // (e) HARNESS-PARITY (#1108) — cohort-independent, like the parse check
+  // above: `paths:` is the only scope key Claude Code's own loader reads, so a
+  // `globs:`-only or divergently-scoped rule loads differently there than it
+  // does under rule-loader.mjs. Emitted here, in file order, and recorded on
+  // the entry so the cohort branches below suppress their PASS line — a file
+  // must never both PASS and FAIL.
+  const parity = checkHarnessParity(contents);
+  if (!parity.ok && parity.kind === 'missing-paths') {
+    fail(
+      `${rel} — declares globs: (${parity.globs.length} pattern(s)) but no paths: — Claude Code's native rule ` +
+        'loader reads ONLY the `paths` frontmatter field and treats a rule without it as unconditional ' +
+        '("rules without a paths field are loaded unconditionally and apply to all files" — ' +
+        'code.claude.com/docs/en/memory § Path-specific rules). `globs:` is the Cursor field name, so this rule ' +
+        'is scoped for rule-loader.mjs and Cursor but loads ALWAYS-ON in Claude Code — a silent instruction-budget ' +
+        'failure (#1108). Add a paths: key carrying the same patterns as globs: (keep globs: — it stays the ' +
+        'canonical form for vendored rules, validate-vendored-rules.mjs #742).',
+    );
+  } else if (!parity.ok && parity.kind === 'divergent') {
+    fail(
+      `${rel} — globs: and paths: declare DIFFERENT pattern sets (globs: ${JSON.stringify(parity.globs)} vs ` +
+        `paths: ${JSON.stringify(parity.paths)}) — Claude Code's native loader scopes on paths:, while ` +
+        'rule-loader.mjs and Cursor scope on globs: (globs: wins silently when both are present, #795). The rule ' +
+        'therefore loads in different contexts on different harnesses (#1108). Make the two lists carry the same ' +
+        'patterns — order and duplicates are irrelevant.',
+    );
+  }
+
   if (meta['auto-generated'] === true) {
-    autoGeneratedEntries.push({ rel, globs, meta });
+    autoGeneratedEntries.push({ rel, globs, meta, parityOk: parity.ok });
   } else {
-    handwrittenEntries.push({ rel, globs, meta, contents });
+    handwrittenEntries.push({ rel, globs, meta, contents, parityOk: parity.ok });
   }
 }
 
 // ---------------------------------------------------------------------------
 // Auto-generated branch (FA4 #697) — UNCHANGED behaviour, hard-fail.
 // ---------------------------------------------------------------------------
-for (const { rel, globs, meta } of autoGeneratedEntries) {
+for (const { rel, globs, meta, parityOk } of autoGeneratedEntries) {
   // (a) never-always-on: must have at least one activation axis.
   // globs is one of: null (no frontmatter / no globs key), [] (key present
   // but EMPTY — the #892 QA-Defect special case, see module doc), or a
@@ -264,9 +400,11 @@ for (const { rel, globs, meta } of autoGeneratedEntries) {
   // an empty globs array, which is dead-not-passing regardless of host-class)
   // AND learning-key AND expires-at. When any failed, the FAIL line(s) above
   // already emitted.
+  // `parityOk` joins the conjunction for the same reason `hasEmptyGlobs` does:
+  // its FAIL already emitted above, and a file must never both PASS and FAIL.
   const lkOk = Object.prototype.hasOwnProperty.call(meta, 'learning-key');
   const eaOk = Object.prototype.hasOwnProperty.call(meta, 'expires-at');
-  if (!hasEmptyGlobs && (hasGlobs || hasHostClass) && lkOk && eaOk) {
+  if (!hasEmptyGlobs && (hasGlobs || hasHostClass) && lkOk && eaOk && parityOk) {
     pass(`${rel} — auto-generated rule satisfies all invariants`);
   }
 }
@@ -283,7 +421,7 @@ console.log(
   '--- Check: .claude/rules/ handwritten-rule activation + review-date (warn mode, #880) ---',
 );
 
-for (const { rel, globs, meta, contents } of handwrittenEntries) {
+for (const { rel, globs, meta, contents, parityOk } of handwrittenEntries) {
   // `globs` (the merged globs/paths value from parseGlobsFrontmatter — #795
   // alias, `globs:` wins when both are present) is one of:
   //   - null                     → neither key present
@@ -333,7 +471,13 @@ for (const { rel, globs, meta, contents } of handwrittenEntries) {
     );
   }
 
-  if (!hasEmptyGlobs && hasAxis && hasReviewDate) {
+  // `parityOk` joins the conjunction for the same reason `hasEmptyGlobs` does
+  // (#1108): its FAIL already emitted in the parse loop, and a file must never
+  // both PASS and FAIL. This is the one place a handwritten rule's PASS is
+  // withheld for a HARD-fail reason — the parity invariant is cohort-
+  // independent by construction, so it is not part of this branch's
+  // deliberately warn-only posture.
+  if (!hasEmptyGlobs && hasAxis && hasReviewDate && parityOk) {
     pass(`${rel} — handwritten rule has an activation axis and a review-date`);
   }
 }