session-orchestrator 3.23.0 → 3.24.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Loop engineering for AI coding agents — turn ad-hoc sessions into a repeatable research → plan → wave-execute → close loop with verification gates. Runs on Claude Code, Codex CLI, Cursor, and Pi.",
-    "version": "3.23.0"
+    "version": "3.24.0"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "session-orchestrator",
-  "version": "3.23.0",
+  "version": "3.24.0",
   "description": "Loop engineering for AI coding agents — turn ad-hoc sessions into a repeatable research → plan → wave-execute → close loop with verification gates. Runs on Claude Code, Codex CLI, Cursor, and Pi.",
   "author": {
     "name": "Bernhard Goetzendorfer",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "3.23.0+codex.20260828183221",
+  "version": "3.24.0+codex.20260902192928",
   "description": "Loop engineering for AI coding agents — turn ad-hoc sessions into a repeatable research → plan → wave-execute → close loop with verification gates. Runs on Claude Code, Codex CLI, Cursor, and Pi.",
   "keywords": [
     "session",

package/.cursor/skills/remote-offload/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: remote-offload
+description: Use when local resource pressure would shrink or coordinator-direct a wave, a wave plan carries heavy build/test/audit roles (test, ui, perf), or the operator says offload, remote host, or auslagern — reference for routing that wave role to a declared SSH-reachable host instead of reducing agent count
+disable-model-invocation: true
+---
+
+# remote-offload
+
+Canonical skill: `skills/remote-offload/SKILL.md`
+
+Read that file and follow it exactly. Resolve relative links against `skills/remote-offload/`, not this wrapper.
+
+Cursor has no Skill tool. Treat "invoke the remote-offload skill" as: Read `skills/remote-offload/SKILL.md`.

package/CHANGELOG.md

@@ -7,6 +7,284 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.24.0] - 2026-09-02
+
+Five commits since v3.23.0 (4 `feat`, 1 `docs`; 152 files, +14,596/−942), no
+`BREAKING CHANGE:` footer and no `!` subject.
+
+One `docs` commit (`c3ab4801`) adds ADR-0013, naming the ownership-check-before-deregister
+ordering that closed Wave 4 of the previous session. One `feat` commit (`a019d5a4`, deep
+session, 5 waves, 37 agents + 3 reviewers + 3 panel) closes the GH#67 peer-filter class
+across every affected site, plus #1170, #1176, #1177, #1166, #1167, #1174, #1180 and #1175.
+One `feat` commit (`936dae8a`) closes a Fleet-Mining v2 instrument audit across 18 repos
+(1,587 learnings, 144k events, 347 telemetry records) with five repairs to the fleet's own
+measurement instruments (#1189, #1190, #1191, #1192, #1193).
+
+Two further `feat` commits (`2ccea0f2`, `3b352d78`) are Waves 2 and 3 of a new session (11
+agents each; Opus for guards/identity/protocol, Sonnet for consolidation/polish). The
+through-line: identity and scope boundaries are now drawn at the PROCESS, not the working
+copy — a peer session's manifest in the same checkout is `foreign`, a dispatched subagent's
+raw session id belongs to its coordinator, and four duplicated helper implementations
+collapse to one canonical each.
+
+### Added
+
+- **`orchestrator.reconcile.completed` (#1192).** Wrapper around `runReconcile` covering all
+  three return paths (empty corpus, normal, engine-error) with `trigger`
+  (`skill|session-end|phase-skip|unknown`), `targets` (allowlisted `repo-local|baseline`),
+  counters including measured zeros, `duration_ms`, and `aborted`+`reason` on the catch path.
+  Skipped with a stderr WARN when no `repoRoot` is passed, so test runs never write the fleet
+  ledger. First live record: `eligible 102 / proposals 10 / rejected 154 / capped 72 /
+  already_materialized 20`.
+- **`docs/audits/2026-09-02-fleet-instruments.md`** — the public scrubbed extract of the
+  Fleet-Mining v2 instrument audit: 18 repos, 1,587 learnings, 143,967 events, 347 telemetry
+  records (6 `anon_id`), 13 instrument verdicts and 12 orchestrator candidates (K1–K12).
+- **A new blocking validator catches dead script paths cited in skill/command/agent prose
+  (#1176).** `scripts/lib/validate/check-skill-script-paths.mjs` scans `skills/`, `commands/`
+  and `agents/` for `scripts/**.mjs` citations that neither exist nor carry a same-line/
+  line-above `<!-- path-check: planned #<iid> | historical | example -->` marker; fenced code
+  blocks are skipped as illustrative shape, not a claim. Measured 2026-09-02 @ `c3ab480`: 237
+  distinct citations, 7 dead, 4 of the 7 inside fences.
+- **`events.jsonl` records are now schema-versioned and validated before they are written
+  (#1177).** `emitEvent()` stamps every record `schema_version: 1` (never overwriting a
+  caller-supplied value) and runs `validateEventRecord()` BEFORE the append and BEFORE any
+  webhook POST — an invalid record throws `EventValidationError` and produces neither.
+  `scripts/emit-event.mjs` maps that to exit `1` (I/O failures keep exit `2`);
+  `scripts/lib/tmux-layout/telemetry.mjs` stamps + validates synchronously and drops invalid
+  lines. The read path stays lenient — the 33k+ pre-#1177 records without the field remain
+  valid.
+- **A canonical reader collapses `sessions.jsonl`'s append-only duplication (#1167).**
+  `scripts/lib/sessions-canonical.mjs` applies newest-wins per `session_id`, drops any record a
+  later `supersedes` pointer refutes, and narrowly collapses the systemic double-stub class
+  (two `abandoned` records sharing an exact `started_at`/`completed_at` pair, one synthetic).
+  The startup/CLI backfill path (`scripts/backfill-abandoned-sessions.mjs`) now also emits
+  `orchestrator.session.backfill_completed` per record — previously only the SessionEnd hook
+  did — and stamps `raw_session_id`; `hooks/on-session-end.mjs`'s backfill gained a second
+  UUID→semantic bridge via the `session.ended` event for sessions that lost the
+  lock-acquire race.
+- **A vault-scoped lock protects the shared live-status board's read-modify-write (#1180).**
+  `scripts/lib/vault-status/board-lock.mjs` wraps `sweepBoard()`'s merge in a cross-repo mutex
+  (mtime-based staleness — the vault dir can be synced cross-host, so a recorded pid isn't
+  probeable); fail-open on acquire timeout or fs-error (one stderr WARN, then runs unlocked)
+  since a board update is best-effort telemetry. `.gitignore` gained `state.lock` and
+  `rules.lock`.
+- **A GitLab Project Access Token recipe for the schema-drift CI job (#1175).**
+  `docs/ci-setup.md` documents Option A (Project Access Token, recommended) and Option B
+  (personal PAT) for `SCHEMA_DRIFT_TOKEN`. Activation is blocked on the documented
+  vendor-ahead drift tracked in #531: the token is provisioned but the CI/CD variable is not
+  yet set upstream.
+- **A `remote-hosts:` config block routes wave work to another machine over SSH (#1160).**
+  `scripts/lib/config/remote-hosts.mjs` adds the block (opt-in template + reference doc) and
+  an `ssh:<alias>` channel in `agent-mapping`; the wave-resource gate adds an `offload`
+  decision AFTER the HR-004 heavy-repo cap, gated on an injected readiness witness
+  (`remoteReady` map or async `probeFn`) — the gate never probes the network itself, so with
+  no witness the decision stays local. `dispatchRemote()`/`remoteDoctor()`/
+  `remoteReadyProbe()` wrap the host-side `offload` CLI (prompt travels on stdin, never argv;
+  exit codes 1–8 mapped to typed refusal reasons; an empty returned patch counts as failure,
+  not success). Emits `orchestrator.remote_dispatch.completed` on every attempt AND every
+  refusal (`ok:false`, `exit_code: null`) — the payload carries the configured alias, never a
+  hostname or IP. `skills/remote-offload/SKILL.md` documents the channel generically for any
+  consuming repo (skill count measured 48 → 49); wave-3 added the fourth wave-executor
+  dispatch branch (`ssh:<alias>` via `dispatchRemote()`) to `wave-loop.md` alongside the
+  existing three.
+- **A Peer-Scope-Union protocol lets two coordinator sessions in the same working copy share
+  scope without racing (#1195).** `skills/_shared/parallel-aware-auq.md` documents the
+  four-step handshake plus a message template; `skills/wave-executor/wave-loop.md` §
+  Scope Manifest 3.1a adds a `peer-session-<id>` record (rolled over each wave, cleared at
+  session-end) that is included in the disjoint check but excluded from the coordinator's own
+  file-scope union; a new branch in the `parallel-sessions.md` decision tree routes to it; and
+  `hooks/post-bash-write-verify.mjs` now partitions a peer's writes from genuine scope
+  violations instead of flagging both alike.
+- **Session-start now writes its own identity before anything can read it wrong (#1199).**
+  Phase 1.05 adds a self-report block (`session_id: null` before Phase 1.2 resolves it) so
+  downstream consumers see an explicit unresolved state instead of inferring one.
+- **`/evolve` and the auto-dialectic nudge now emit their own completion events (#1200).**
+  `orchestrator.evolve.completed` and `dialectic.completed` are emitted via `emit-event.mjs`
+  from inside the skill; `decideAndRecordAutoDialectic()` emits `dialectic.nudge_decided`
+  mechanically rather than leaving the decision only in skill prose, consumed by
+  `phase-3-6-tail.md`.
+
+### Changed
+
+- **BREAKING (behavior): `discovery-validator.enabled` defaults to `false` again (#1191).**
+  Reverts the #690 flip of 2026-06-25. Fleet measurement (2026-09-02, 18 repos): 6,946
+  `discovery_validator_violation` events had accumulated in repos that never declared the
+  block, and a scope-adjusted n=60 sample put real precision at 0/60 — the hook was scanning
+  the MAIN transcript on `SubagentStop`, not the subagent's own. It now reads the subagent
+  transcript (`agent_transcript_path` when the harness sends it, else
+  `<dir>/<base>/subagents/agent-<agent_id>.jsonl` — no fallback to the main transcript), and
+  the violation event now carries `agent_id`. Repos that relied on the silent default lose the
+  signal until they set `enabled: true` explicitly.
+- **Scope enforcement now treats every identity as process-local, including your own
+  (#1194).** `enforce-scope.mjs` reads session ids via a new `readProcessLocalSessionIds()`
+  instead of `readOwnSessionIds()` — a peer's manifest sitting in the SAME working copy now
+  classifies as `foreign`, not `own`. Two existing tests had asserted the inverted behaviour
+  and were rewritten with a named ceiling (a harness with no session id, e.g. bare
+  Codex/Cursor, resolves to `unknown` → enforce, never skip); `scope-collision-guard.md` and
+  `state-ownership.md` were updated to match.
+- **`memory.propose`'s lock check is now a raw→semantic lookup, not a trust boundary
+  (#1188).** The lock is consulted only to translate the caller's raw id into its semantic
+  session id, authorised by a process-local match against the RAW id — measured: a dispatched
+  subagent carries the COORDINATOR's raw UUID in `CLAUDE_CODE_SESSION_ID`, never its own.
+  `sessions-canonical.mjs` and the backfill path now distinguish silent `ENOENT` from loud
+  `EACCES`/`EISDIR` in two separate ledger readers instead of treating every read failure the
+  same.
+- **Four duplicated helper implementations collapse to one each.**
+  `scripts/lib/validate/markdown-fences.mjs` (#1181) replaces 4 line-start-only fence
+  scanners with one line-start-AND-end-anchored automaton shared by all 4 callers
+  (`validate-plugin` output byte-identical before/after, 203/0). `expandTilde` (#1182)
+  replaces 8 copies of home-directory expansion with the existing `common.mjs`
+  implementation — one of the deleted copies (`gitlab-portfolio/cli.mjs`) mis-expanded
+  `~user` (a different user's home, not the caller's). `hooks/_lib/subagent-paths.mjs`
+  (#1196) replaces 4 divergent sidecar-path derivations with one carrying the strictest rules
+  from any of them (agent-id length `{1,64}`, `'unknown'` rejected,
+  `agent_transcript_path` confined inside the transcript directory).
+  `hooks/_lib/atomic-json.mjs` (#1197) replaces 4 byte-identical copies with one whose
+  read-modify-write default only replaces a genuinely MISSING file (`ENOENT`) — an
+  unparsable or unreadable file is no longer silently overwritten with the default.
+- **A block-header matcher gained an indent+inline-value form, additively (#1185).**
+  `matchBlockHeaderDetailed` is now shared so `health-endpoints.mjs` no longer maintains its
+  own `HEADER_RE`.
+- **Five readers now go through the canonical `sessions.jsonl` collapse instead of counting
+  raw lines (#1186).** `telemetry/sync.mjs` and `build-live-signals.mjs` (wave 2), plus
+  `site-numbers.mjs` and `vault-mirror.mjs --kind session` (wave 3), now read
+  newest-per-`session_id`; on this repo the session count measured 289 lines → 278 sessions
+  (11 duplicate lines collapsed). Two tests pinning the old raw-line count were removed as no
+  longer testing real behaviour.
+- **Wave-completion refusals are now named events, not silent skips (#1201).**
+  `KNOWN_TRIGGERS` plus three explicit wrapper functions (`runReconcileFromSkill`/
+  `AtSessionEnd`/`FromPhaseSkip`) replace an implicit trigger string — an unrecognised
+  trigger now throws instead of silently defaulting. `emitFinalWaveCompleted` emits
+  `orchestrator.wave.final_refused` for all six refusal paths instead of leaving them
+  unrecorded — closing the same class of instrument gap named in
+  `.claude/rules/host-resources.md` § HR-105.
+
+### Fixed
+
+- **`orchestrator.agent.stopped` carried `agent: ""` in 86.7% of fleet records (#1190).**
+  89,991 of 103,763 historical records carried an empty `agent` because
+  `input?.agent_type ?? 'unknown'` never fires on an empty string — the harness's actual
+  shape. `agent` is now omitted when empty (never `'unknown'`, never a fabricated `0`/`false`).
+  Seven optional sidecar-derived fields were added — `agent_id`, `transcript_found`,
+  `tool_use_id`, `agent_type_meta`, `duration_ms` + `duration_source` (`meta-birthtime`), and
+  `status` (`done|partial|blocked|failed|no-tests-needed`, from the last line-anchored
+  `STATUS:` marker in the final 64 KiB of the agent transcript) — each independently omitted
+  when unmeasured, each wrapped in its own try/catch, with a charset guard on `agent_id`
+  before path interpolation. `CURRENT_SCHEMA_VERSION` is unchanged (additive). Measured
+  `status` coverage: 61.7% (71 done / 3 partial / 46 absent) over 120 completed sidecars.
+- **`commands[]` was empty in every usage ping (#1189).** `classifyInvocationName` routes
+  plugin-prefixed command names (`session-orchestrator:session`) into `commands[]` under the
+  bare name — the prefix is required, so a bare foreign name never becomes one of our
+  commands — and `.command`-field names are prefixed before classification, since that field
+  is itself the "this is one of ours" provenance signal a bare `.skill` arrival lacks.
+- **The final `orchestrator.wave.completed` of every session was never emitted (#1193).**
+  Fleet-wide: 1,018 `started` vs. 722 `completed`, a gap of exactly 296 — one per wave run.
+  `hooks/on-session-end.mjs` now emits it at SessionEnd, idempotent via a
+  `last_wave_completed` high-water mark written monotonically by both emitters, gated on
+  ownership of `current-session.json` via the RAW stdin session id (not the resolved one), and
+  skipped on `reason: clear`. `hooks/post-tool-batch-wave-signal.mjs` gained the same
+  raw-stdin-id ownership check, so it can no longer write wave keys into a peer session's
+  record either.
+- **`orchestrator.session.stopped.duration_ms` was a literal `0` in 8,127 of 8,127 fleet
+  records.** The harness never sends `start_ms`, so the old expression fell back to a
+  fabricated zero — indistinguishable from a real instant turn. It is now derived from an
+  OWNED `.orchestrator/session.lock` (`duration_source: 'session-lock'`, session-elapsed
+  measured at turn end) or omitted entirely, never `0`.
+- **`resolveSession()`'s ownership predicate was self-fulfilling** when the stdin `session_id`
+  was absent or non-UUID: it fell back to the recorded id and then compared the fallback
+  against itself. Fixed at the root (`rawStdinId !== null && rawStdinId === recordedId`) in
+  `hooks/on-session-end.mjs` for `duration_ms`, `semantic_session_id` and the new wave-completed
+  emit, plus the sibling site `resolveSessionId()` in `hooks/on-stop.mjs`.
+- **A live local `session.lock` no longer hides a same-working-copy registry peer (GH#67).**
+  Registry-sourced entries in `scripts/lib/session-discovery.mjs` / `peer-discovery.mjs` now
+  carry additive `registryOnly` / `lockSuperseded` / `lockOwnerId` annotations instead of
+  being filtered out — `lockSuperseded: true` is a HINT (the lock is advisory, so the entry
+  may still be a live session that lost the acquire race), never a verdict. Only
+  PROMOTION_OFFER decisions downgrade such a peer to advisory; peer-count and display
+  consumers keep it. Lock-sourced sessions carry none of the three fields, so their shape
+  stays byte-identical to pre-GH#67.
+- **Worktree-promotion teardown is now mechanical, not skill prose (#1170).**
+  `enterWorktree()` takes an optional `rawSessionId`; when given, it calls `leaveSourceRoot()`
+  on the OLD root after the destination provably exists and records the outcome on
+  `result.left`. Before #1170, four promotion call sites relied on coordinator prose to
+  release the source root — measured zero `deregisterSelf`/`release(` call sites across the
+  affected skill docs, so the abandoned registry entry advertised a phantom peer for up to an
+  hour.
+- **`memory.propose` filed wave-N+1 proposals into the wave-N quota bucket (#1166).**
+  `scripts/memory-propose.mjs` now resolves the RUNNING wave from `<state-dir>/wave-scope.json`
+  first (when present and unbound or bound to this session), falling back to `STATE.md
+  current-wave + 1` only when no usable manifest exists — `current-wave` itself always
+  records the JUST-COMPLETED wave.
+- **`health-endpoints` silently dropped the wizard's own nested-block output (#1174).** The
+  key was read off the flat KV map via `_coerceList`, which bails to `null` on any `{` and
+  cannot see a nested YAML block at all. `scripts/lib/config/health-endpoints.mjs` now parses
+  it content-scoped, accepting inline object arrays, the nested block form (top-level or
+  under `ecosystem-health:`), and a bare URL list; `ecosystem-health`'s own valueless
+  block-header form is now read as a fallback when the scalar key is absent.
+- **`emitEvent()`'s automatic session/semantic-session fill now requires a process-local
+  witness (#1177).** `CLAUDE_CODE_SESSION_ID` (or the hook-input session id) must exactly
+  equal the lock's raw `session_id` before `session_id`/`semantic_session_id` are
+  auto-filled — STATE.md is never treated as a witness. `wave` is filled the same way, only
+  from a `wave-scope.json` manifest bound to this same session, and is coerced to an integer.
+  See `docs/events-schema.md` § Correlation keys.
+- **The memory banner's "sessions ever" stat now counts distinct sessions, not JSONL lines
+  (#1167).** `sessions.jsonl` is append-only, so one physical session can occupy two lines;
+  on this repo the stat drops from 286 lines to 275 sessions. Five readers now go through
+  the canonical collapse: cold-start detection, the memory banner, harness-audit Category 1,
+  evolve's autopilot-effectiveness/verdict, and autopilot's id-set guard.
+- **`check-skill-script-paths` no longer goes blind past an unbalanced code fence (#1176).**
+  An unclosed/unbalanced fence now reports as its own `unbalanced-fence` finding instead of
+  silently absorbing the rest of the file as "inside a fence"; a fence opened inside a
+  blockquote is now recognised as a fence too.
+- **`sessions-canonical.mjs`'s `supersedes` collapse now requires an attestable join key
+  (#1167).** A `supersedes` pointer on an abandoned record is honoured only when it can be
+  matched to the record it claims to supersede; rule ordering was fixed so a superseded
+  record's synthetic double-stub twin is collapsed too. A new `keepUnidentified` option lets
+  callers retain records the canonicalizer could not confidently classify instead of
+  dropping them.
+- **`memory.propose` no longer trusts an unbound `wave-scope.json` (#1177).** A manifest
+  without a `semantic_session` binding is a peer's or a stale artefact, not this session's
+  own — it is now ignored with a stderr note instead of adopted; an unreadable/malformed
+  manifest also WARNs on stderr before falling back to `current-wave + 1`, rather than
+  failing silently.
+- **The vault-status board lock's stale-override is now surfaced, not silent (#1180).**
+  `onLockOutcome` reports a `staleOverride` reason when the lock was force-acquired past a
+  stale holder, and `sweepBoard()`'s board event now records it too — distinguishing "the
+  mutex worked as designed" from "a slow host looked like a crash".
+- **`check-hooks-emit-event-guard` and `check-validator-registration` both went live in
+  `validate-plugin` (#1183, #1184).** `check-hooks-emit-event-guard.mjs` (#1183) parses hooks
+  via `@babel/parser` (AST, not regex) to catch a hook that mutates state without emitting a
+  corresponding event; 5 pre-existing sites are grandfathered into an explicit WARN baseline
+  with a reason and stale-detection instead of silently passing. `check-validator-registration.mjs`
+  (#1184) confirms every validator module is actually wired into `validate-plugin.mjs`
+  (measured 33 of 33 wired, using comment-stripped source so a commented-out registration
+  doesn't count as live).
+- **`check-skill-script-paths`'s new `--strict-sh` mode found its own premise refuted
+  (#1187).** Extending the dead-path scan to shell-script citations, only 1 of 27 `.sh`
+  references sits inside the tool's own scan directories (`skills/`, `commands/`, `agents/`)
+  — the other 26 are in `docs/`, alongside 7 dead `.mjs` citations inside `docs/adr/` the same
+  run surfaced. Shipped as a WARN-only opt-in flag; the `docs/` sweep is a follow-up.
+- **The discovery-validator's dedupe key, gate-summary skip, and masking order all landed
+  together (#1198).** A dedupe key (`session_id`, `agent_id`, `sha256(claim)`) collapses
+  repeated flags of the identical claim; gate-summary recap lines (the coordinator's own
+  restatement of a subagent's findings, not a fresh claim) are now skipped entirely; claim
+  masking now runs before every pattern is checked, not a subset. Measured against the
+  flagged corpus: 186 of 400 flagged claims were false positives. Two claims from this
+  session's own discovery briefing were checked against the fix and refuted.
+- **A pre-push scratch-vs-publish check now reads the two arguments git already passes it.**
+  `.husky/pre-push` had never read `$1` (remote name/URL) or `$2` (remote URL) — confirmed by
+  `rg -n '\$1|\$2' .husky/pre-push` finding only a local function's own arguments — so every
+  push ran the full quality gate regardless of destination. It now skips the gate for a raw,
+  unconfigured scratch URL (e.g. the remote-offload sync target) while continuing to gate
+  real publish remotes; a named ceiling covers a real but unlisted third publish host, which
+  still reads as scratch.
+- **`check-untracked-test-deps` misclassified `.git` as an untracked file inside a linked
+  worktree.** In a normal checkout `.git` is a directory and was already excluded; in a
+  `git worktree add` checkout `.git` is a FILE containing `gitdir: <path>`, which satisfied
+  the same `isFile()` check the untracked-candidate branch uses. `.git` is now explicitly
+  exempted regardless of which shape it takes — measured 62 of 62 tests passing across the 5
+  affected test files inside a linked worktree checkout.
+
 ## [3.23.0] - 2026-08-28
 
 Two commits today (1 `feat`, 1 `fix`; 64 files, +4,971/−184) close Waves 3 and 4 of the

package/README.md

@@ -1,9 +1,9 @@
 # Session Orchestrator
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.23.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-3.24.0-blue.svg)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/session-orchestrator.svg)](https://www.npmjs.com/package/session-orchestrator)
-[![Tests](https://img.shields.io/badge/tests-12%2C000%2B-brightgreen.svg)](docs/telemetry/telemetry-claims.md)
+[![Tests](https://img.shields.io/badge/tests-15%2C000%2B-brightgreen.svg)](docs/telemetry/telemetry-claims.md)
 
 Loop engineering for AI coding agents — turn ad-hoc sessions into a repeatable research → plan → wave-execute → close loop with verification gates. Runs on **Claude Code, Codex CLI, Cursor, and [Pi](docs/pi-setup.md)**.
 
@@ -72,11 +72,11 @@ Everything else is opt-in. See [`docs/session-config-template.md`](docs/session-
 
 ## What you get
 
-- **48 skills** for the session lifecycle (start, plan, execute, close, evolve), discovery, vault sync, MCP authoring, debugging, brainstorming, plan grilling, persona panels, cross-repo dispatch, learning→rule reconciliation, session-process eval, audits, and more
+- **49 skills** for the session lifecycle (start, plan, execute, close, evolve), discovery, vault sync, MCP authoring, debugging, brainstorming, plan grilling, persona panels, cross-repo dispatch, learning→rule reconciliation, session-process eval, audits, and more
 - **28 slash commands** (`/session`, `/go`, `/close`, `/discovery`, `/plan`, `/grill`, `/evolve`, `/autopilot`, `/dispatcher`, `/reconcile`, `/eval`, `/test`, `/debug`, …)
 - **15 typed subagents** (code-implementer, test-writer, security-reviewer, session-reviewer, qa-strategist, architect-reviewer, …)
 - **10 hook event types** enforcing scope, blocking destructive commands, gating templates-first, capturing telemetry — full on Claude Code; experimental, post-hoc, or bridged on the other platforms ([Platform support](#platform-support))
-- **10,000+ vitest tests** run on every commit ([telemetry methodology](docs/telemetry/telemetry-claims.md))
+- **15,000+ vitest tests** run on every commit ([telemetry methodology](docs/telemetry/telemetry-claims.md))
 
 Full component inventory: [`docs/components.md`](docs/components.md).
 
@@ -133,19 +133,21 @@ The system is markdown-driven config plus a thin Node runtime — skills, comman
 - **Cross-session learning is opt-in and inspectable.** Every session writes a record; after 5+ sessions `/evolve analyze` extracts confidence-scored patterns you can read and prune. Nothing is hidden.
 - **VCS dual support, no lock-in.** Auto-detects GitLab or GitHub from your remote and drives the full lifecycle for both.
 
-## Recent highlights (v3.23.0)
+## Recent highlights (v3.24.0)
 
-Every release is additive and backward-compatible. Highlights of the v3.23.0 line: the first shaped by three external bug reports on the public mirror (Kanevry#64, #65, #66), all three reproduced, fixed and live-verified:
+Every release is additive and backward-compatible. Highlights of the v3.24.0 line: parallel-session identity moves from repo-scoped to process-local, remote work gets a declared host channel, and four duplicated-copy classes collapse to one module each:
 
-- **Codex CLI mints UUIDv7 session ids; every reader accepted only v4 (#66 / #1091)** — each SessionStart minted a fresh v4, so a resumed or compacted thread read its own lock as a foreign session. `parseSessionId` now accepts RFC 9562 versions 1–8 and the stop/end hooks apply the writer's rule, so one id owns the lock from start through release. The `UUID_V4_RE` alias is gone: zero importers, and a name that said v4 while matching v1–8.
-- **Every `/close` wrote 0 of 5 recommendation fields (#65 / #1036)** — the documented Phase 3.7a call passed `undefined` where a repo root is required, and the fail-open catch hid it on every run. The snippet binds the root; the catch now names the cause. A second defect found while verifying the fix: backticks in a comment inside a `node -e "…"` string made bash execute `undefined` on each close.
-- **Codex copies a marketplace plugin and starts the MCP child with no plugin-root variable (#64)** — measured: the copy lives under `~/.codex/plugins/cache/<marketplace>/session-orchestrator/<version>/`, and from a non-git cwd the launcher resolved to `/scripts/mcp-server.sh`. `.mcp.json` and `plugin-root.mjs` gained a cache-scan tier with a name-matched `package.json`, and `.mcp.json` now mirrors the module's tier order under two drift tests. Existing installs need a reinstall — Codex snapshots `.mcp.json` at install time.
-- **Worktree-Auto-Promotion is a process boundary, not a live migration (#1069, ADR-0013)** — the source session deregisters and releases its lock before the new worktree's session acquires (`leaveSourceRoot()`), which removes the phantom peer that stayed visible for up to 60 minutes. Because the new session's id never equals the worktree suffix, Phase 4a cleanup keys on a promotion marker written at creation time; the review panel found that key dead before any user did.
-- **The host registry contributed nothing to session numbering (#1066)** — the census projected only raw UUIDs, which the n-increment discards. It now counts `semantic_session_id`, so two sessions on one host cannot mint the same label. The semantic id stays a best-effort label; ownership remains the raw id plus owner proof.
-- **The mode selector scored a field no record carries (#1071)** — `completion_rate` sits under `effectiveness` in all 281 ledger records; the flat read was always `undefined`, so the high-completion bonus was unreachable and the fixtures pinned a shape production never writes. Fixed with a nested-first read and a divisor test for the 99 records that carry no rate at all.
-- **Semgrep regained two rules a path filter had dropped (#1129)** — re-aimed at this repo's real trust boundary (hook stdin, child-process stdout), taint-mode; the first true positives were three unguarded `JSON.parse` calls on `glab`/`gh` output in the CI banner. A proposed spread-sink was refused with a measurement: object spread cannot pollute a prototype.
+- **Parallel-session identity moves from repo-scoped to process-local (#1194 / #1188)** — `enforce-scope` now reads only process-local session ids (`readProcessLocalSessionIds`), so a peer's manifest in the same working copy is treated as foreign, not as your own; `memory-propose` authorizes off a process-local match of the raw session id rather than trusting the lock file alone. A peer's declared scope also gets its own place in the wave manifest now, as a `peer-session-<id>` record instead of a silent gap (#1195).
+- **Remote-offload: declare hosts, route heavy roles to a ready host instead of halving the wave (#1160)** — a `remote-hosts:` config block, an `ssh:<alias>` dispatch channel, and an offload decision wired into the resource gate right after the HR-004 cap (readiness is injected, never measured inside the gate itself). `skills/remote-offload/SKILL.md` is now the generic entry point, with adapters around the `offload` CLI.
+- **Four copy-classes collapsed to one module each (#1181 / #1182 / #1196 / #1197)** — atomic-JSON handling, subagent sidecar-path derivation, `expandHome`, and markdown-fence parsing each had 4–8 divergent copies; consolidating `atomic-json.mjs` also closed a data-loss path where a read-modify-write default silently replaced an unparsable or unreadable file.
+- **Refusals are now events, not silence (#1200 / #1201)** — `emitFinalWaveCompleted` writes `orchestrator.wave.final_refused` for six refusal paths, evolve and dialectic completions emit their own events, and reconcile's trigger set now lives in code (`KNOWN_TRIGGERS`) instead of being asserted in prose.
+- **Canonical session counting, fleet-wide (#1186)** — `site-numbers` and `vault-mirror --kind session` now count the same way everywhere: 289 raw lines in this repo's own ledger collapsed to 278 real sessions once double-counts were removed.
+- **Discovery-validator false positives cut — 186 of 400 measured hits were the harness's own gate-summary lines (#1198)** — a dedupe key and a gate-summary skip removed the noise; two brief claims about the masking order were also measured and refuted along the way.
+- **Three new mechanical guards land in `validate-plugin` (#1183 / #1184 / #1187)** — `emitEvent` try/catch coverage, validator-registration parity (every check actually wired in), and dead `.sh` citations in docs.
+- **The pre-push gate distinguishes a publish push from a scratch push; linked-worktree gates run green (15,829/0 on the remote host)** — a `.git` file (not a directory) in a linked worktree was previously misread as an untracked candidate, flagging 13 tracked files as missing.
+- **The AUQ clarity guard's delivery is proven live, not asserted (#1122)** — `check-auq-clarity` is wired into `validate-plugin` and blocks on the two hard hurdles at a measured 0% false-positive rate; its own wiring closes with a fake-regression proof, not a claim.
 
-Previous line (v3.22.0): instruments that confidently measured the wrong quantity — the 99%-firing resource warning, the AUQ audit, and the lock-release identity split.
+Previous line (v3.23.0): three external bug reports fixed end-to-end (Codex session-id versions, missing `/close` fields, plugin-root resolution), the worktree-promotion process boundary, and three measurement fixes (host-registry numbering, the mode-selector's mis-shaped read, two regained Semgrep rules).
 
 Full version history: [CHANGELOG.md](CHANGELOG.md).
 

package/agents/db-specialist.md

@@ -93,7 +93,6 @@ Append a fenced ```json block at the end of your response per `agents/schemas/db
 ```
 
 Required: `status`, `task_id`, `files_changed`, `blockers`. Optional: `verdict`. **Emit `verdict` alongside `status` (status→verdict mapping: done→PROCEED, partial→PROCEED_WITH_FOLLOWUPS, blocked→BLOCKED). `status` is deprecated and will be removed in v4.0 (#472).** The coordinator parses the LAST fenced ```json block.
-```
 
 ## Edge Cases