session-orchestrator 4.0.0 → 4.1.0

package/scripts/lib/plugin-update-banner.mjs

@@ -346,7 +346,8 @@ function resolvePlatformFromEnv(env) {
  * @param {"claude"|"codex"|"cursor"|"pi"} [opts.platform]  The harness driving
  *   this session, when the caller already knows it (the SessionStart hook
  *   computes this once and could pass it straight through). Falls back to
- *   {@link resolvePlatformFromEnv} on `opts.env` when omitted — never throws,
+ *   {@link resolvePlatformFromEnv} on `opts.env` when omitted OR when the value
+ *   is not one of the four keys above — never throws,
  *   never leaves the instruction generic just because the caller didn't wire
  *   the parameter through yet.
  * @returns {Promise<{severity: 'warn', message: string, installed: string, latest: string}|null>}
@@ -391,8 +392,15 @@ export async function checkPluginUpdate({
     return null;
   }
 
+  // Allowlist, not "any non-empty string": only a value this table actually has
+  // a recipe for may pre-empt env resolution — a typo or a future harness name
+  // (`'CLAUDE'`, `'clade'`) falls through to the env signal instead of silently
+  // degrading to the generic instruction. `Object.hasOwn`, never `in`: `in`
+  // would accept prototype keys (`'toString'`) as platforms.
   const resolvedPlatform =
-    typeof platform === 'string' && platform.length > 0 ? platform : resolvePlatformFromEnv(env);
+    typeof platform === 'string' && Object.hasOwn(PLATFORM_UPDATE_INSTRUCTIONS, platform)
+      ? platform
+      : resolvePlatformFromEnv(env);
   const instruction = PLATFORM_UPDATE_INSTRUCTIONS[resolvedPlatform] ?? GENERIC_UPDATE_INSTRUCTION;
 
   return {

package/scripts/lib/project-hygiene.mjs

@@ -44,6 +44,8 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import yaml from 'js-yaml';
+import { tokenizeCommand, splitChainSegments, resolveSegmentVerb } from './command-blocker.mjs';
 
 /** Commits past the newest tag before release hygiene is worth mentioning. */
 export const DEFAULT_RELEASE_DRIFT_COMMITS = 50;
@@ -408,8 +410,8 @@ export function checkStaleArtifacts(repoRoot, ageDays = DEFAULT_ARTIFACT_AGE_DAY
 /**
  * H4 — CI configuration hygiene.
  *
- * Measured 5/6. Reports only what is decidable by presence, never by parsing
- * pipeline semantics. The dependency-audit gap is the load-bearing one: three
+ * Measured 5/6. Checks locally declared executable commands without evaluating
+ * pipeline conditions or external includes. The dependency-audit gap is the load-bearing one: three
  * of the tested repos carried known-vulnerable dependencies that no pipeline
  * would ever surface.
  *
@@ -438,19 +440,21 @@ export function checkCiConfig(repoRoot) {
     return findings;
   }
 
-  let ciText = '';
-  if (hasGitlab) ciText += safeRead(gitlabCi);
+  const ciConfigs = [];
+  if (hasGitlab) ciConfigs.push({ text: safeRead(gitlabCi), platform: 'gitlab' });
   if (hasGithub) {
     try {
       for (const f of readdirSync(ghWorkflows)) {
-        if (f.endsWith('.yml') || f.endsWith('.yaml')) ciText += safeRead(join(ghWorkflows, f));
+        if (f.endsWith('.yml') || f.endsWith('.yaml')) {
+          ciConfigs.push({ text: safeRead(join(ghWorkflows, f)), platform: 'github' });
+        }
       }
     } catch {
       /* unreadable workflows dir — fall through with what we have */
     }
   }
 
-  if (ciText && !/\b(npm|pnpm|yarn) audit\b|pip-audit|cargo audit|osv-scanner|dependency.?check/i.test(ciText)) {
+  if (ciConfigs.some(({ text }) => text) && !ciConfigs.some(hasAuditStep)) {
     findings.push({
       check: 'ci-audit-job',
       fixable: true,
@@ -461,6 +465,178 @@ export function checkCiConfig(repoRoot) {
   return findings;
 }
 
+const GITLAB_COMMAND_FIELDS = ['script', 'before_script', 'after_script'];
+const GITLAB_GLOBAL_FIELDS = new Set([
+  'stages', 'types', 'variables', 'default', 'include', 'workflow',
+  'image', 'services', 'cache', 'before_script', 'after_script', 'spec',
+]);
+const GITLAB_REFERENCE = Symbol('gitlab-reference');
+const GITLAB_SCHEMA = yaml.DEFAULT_SCHEMA.extend([
+  new yaml.Type('!reference', {
+    kind: 'sequence',
+    construct: (path) => ({ [GITLAB_REFERENCE]: path }),
+  }),
+]);
+const AUDIT_VALUE_FLAGS = new Set([
+  '--filter', '-F', '--dir', '-C', '--prefix', '--cwd', '--registry',
+  '--userconfig', '--globalconfig', '--workspace', '-w', '--cache', '--pm-on-fail',
+]);
+const AUDIT_BOOLEAN_FLAGS = new Set([
+  '-r', '--recursive', '-s', '--silent', '-g', '--global', '--workspaces', '--offline',
+]);
+
+/** Inspect executable job/step locations, never arbitrary keys named run/script. */
+function hasAuditStep({ text, platform }) {
+  let config;
+  try {
+    if (platform === 'gitlab') {
+      const documents = yaml.loadAll(text, undefined, { schema: GITLAB_SCHEMA });
+      if (documents.length === 1) {
+        [config] = documents;
+      } else if (documents.length === 2 && isConfigMap(documents[0])
+        && Object.keys(documents[0]).length === 1 && isConfigMap(documents[0].spec)) {
+        // GitLab permits a spec header followed by --- and the job document.
+        // Header input defaults are data; unrelated multi-document YAML is ambiguous.
+        [, config] = documents;
+      } else {
+        return false;
+      }
+    } else {
+      config = yaml.load(text);
+    }
+  } catch {
+    return false;
+  }
+  if (!isConfigMap(config)) return false;
+  if (platform === 'github') {
+    if (!isConfigMap(config.jobs)) return false;
+    return Object.values(config.jobs).some((job) => isConfigMap(job)
+      && job.if !== false && Array.isArray(job.steps)
+      && job.steps.some((step) => isConfigMap(step) && step.if !== false
+        && typeof step.run === 'string' && hasAuditCommand(step.run)));
+  }
+
+  return Object.keys(config).some((name) => {
+    if (name.startsWith('.') || GITLAB_GLOBAL_FIELDS.has(name)) return false;
+    const job = resolveGitlabJob(config, name);
+    if (!job?.script || job.when === 'never') return false;
+    return GITLAB_COMMAND_FIELDS.some((field) => {
+      let commands = job[field];
+      if (!Object.hasOwn(job, field) && field !== 'script') {
+        const inherit = job.inherit?.default;
+        if (inherit === false || (Array.isArray(inherit) && !inherit.includes(field))) return false;
+        commands = Object.hasOwn(config.default ?? {}, field) ? config.default[field] : config[field];
+      }
+      return hasGitlabAuditCommands(commands, config);
+    });
+  });
+}
+
+function isConfigMap(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    && !Object.hasOwn(value, GITLAB_REFERENCE);
+}
+
+/** Local extends uses later-parent/child replacement for command arrays. */
+function resolveGitlabJob(config, name, seen = new Set()) {
+  if (typeof name !== 'string' || !Object.hasOwn(config, name)
+    || !isConfigMap(config[name]) || seen.has(name)) return null;
+  seen.add(name);
+  const job = config[name];
+  let merged = {};
+  const parents = Array.isArray(job.extends) ? job.extends : [job.extends];
+  for (const parent of parents.filter((entry) => entry !== undefined)) {
+    const inherited = resolveGitlabJob(config, parent, seen);
+    // An unresolved later parent may override earlier commands. Only fields
+    // supplied by later local parents or the job itself remain evidence.
+    merged = inherited ? mergeGitlabJob(merged, inherited) : {};
+  }
+  seen.delete(name);
+  return mergeGitlabJob(merged, job);
+}
+
+function mergeGitlabJob(parent, child) {
+  const merged = { ...parent, ...child };
+  // Command fields replace wholesale; inherit is a map, so its default flag
+  // survives a child that overrides only inherit.variables.
+  if (isConfigMap(parent.inherit) && isConfigMap(child.inherit)) {
+    merged.inherit = { ...parent.inherit, ...child.inherit };
+  }
+  return merged;
+}
+
+/** Resolve only command strings/arrays and local !reference paths, with cycle guards. */
+function hasGitlabAuditCommands(commands, config) {
+  const seen = new WeakSet();
+  function visit(value) {
+    if (typeof value === 'string') return hasAuditCommand(value);
+    if (!value || typeof value !== 'object' || seen.has(value)) return false;
+    seen.add(value);
+    let found = false;
+    if (Array.isArray(value)) {
+      found = value.some(visit);
+    } else if (Array.isArray(value[GITLAB_REFERENCE])) {
+      let target = config;
+      for (const key of value[GITLAB_REFERENCE]) {
+        target = target && typeof target === 'object' && Object.hasOwn(target, key) ? target[key] : undefined;
+      }
+      found = visit(target);
+    }
+    seen.delete(value);
+    return found;
+  }
+  return visit(commands);
+}
+
+/**
+ * Bounded command recognition: wrappers and options may precede the audit
+ * subcommand, but another verb (install/run/echo) ends the search. Unknown
+ * value-taking flags and commands hidden in external includes are not resolved.
+ */
+function hasAuditCommand(command) {
+  return splitChainSegments(tokenizeCommand(command)).some((segment) => hasAuditSegment(segment));
+}
+
+function hasAuditSegment(segment, depth = 0) {
+  const resolved = resolveSegmentVerb(segment);
+  if (resolved.alt) return false;
+  let { verb, index } = resolved;
+  if (resolved.payloads.length > 0) {
+    if (depth >= 3 || resolved.payloads.length !== 1) return false;
+    const tokens = tokenizeCommand(resolved.payloads[0]);
+    const parts = splitChainSegments(tokens);
+    // env -S splits argv; it does not execute shell operators. Restrict this
+    // reuse of the shared tokenizer to one plain command with no redirects.
+    if (parts.length !== 1 || parts[0].length !== tokens.length
+      || tokens.some((token) => token.redirect)) return false;
+    const trailingArgs = index < 0 ? [] : segment.slice(index);
+    return hasAuditSegment([...tokens, ...trailingArgs], depth + 1);
+  }
+  if (verb === 'corepack' || verb === 'npx') {
+    index++;
+    while (['-y', '--yes', '--no-install', '--'].includes(segment[index]?.text)) index++;
+    verb = segment[index]?.text;
+  }
+  if (segment.slice(index + 1).some((token) => ['-h', '--help', '--version'].includes(token.text))) return false;
+  if (/^(?:pip-audit|osv-scanner|dependency-check(?:\.sh)?)$/.test(verb ?? '')) return true;
+  if (!/^(?:npm|pnpm|yarn|bun)(?:@[\w.+-]+)?$/.test(verb ?? '') && verb !== 'cargo') return false;
+  let i = index + 1;
+  while (segment[i]?.text.startsWith('-')) {
+    const flag = segment[i].text;
+    if (flag === '--') { i++; break; }
+    if (AUDIT_VALUE_FLAGS.has(flag)) {
+      if (!segment[i + 1] || segment[i + 1].redirect) return false;
+      i += 2;
+    } else if (AUDIT_BOOLEAN_FLAGS.has(flag) || /^--[\w-]+=/.test(flag)) {
+      i++;
+    } else {
+      return false;
+    }
+  }
+  if (/^yarn(?:@|$)/.test(verb) && segment[i]?.text === 'npm') i++;
+  return segment[i]?.text === 'audit';
+}
+
 /** @param {string} p @returns {string} */
 function safeRead(p) {
   try {

package/scripts/lib/reconcile/engine.mjs

@@ -389,6 +389,28 @@ const BODY_LEARNING_ID_RE = /-\s*learning-id:\s*`([^`]+)`/g;
  * on disk: re-proposing it is the issue #484 defect (9 of 10 proposals in one
  * run were learnings a `.claude/rules/` file already covered).
  *
+ * **This scan is the AUTHORITATIVE half of the dedupe contract** (#1242). The
+ * `.claude/rules/*.md` files it reads are TRACKED, so they survive a fresh
+ * clone, a wiped working copy, and any loss of `.orchestrator/runtime/` (which
+ * is gitignored — `.gitignore:114`). The idempotency sidecar consulted beside
+ * it is a CACHE that can only SHORT-CIRCUIT this scan, never replace it: on a
+ * fresh clone the sidecar is empty and correctness rests entirely on the
+ * markers below. Measured 2026-09-07 on this repo: with the sidecar emptied,
+ * the run produced the identical 10 proposals and 30 "already materialized"
+ * rejections; with this scan disabled instead, 5 already-consolidated
+ * learnings were re-proposed.
+ *
+ * Both marker forms are load-bearing. Frontmatter `learning-key:` is a YAML
+ * SCALAR and can name exactly ONE learning, so a CONSOLIDATED rule file (one
+ * file absorbing N learnings) carries the remaining N-1 identities ONLY as
+ * `## Provenance` body bullets. Breaking {@link BODY_LEARNING_KEY_RE} would
+ * therefore silently re-propose most of a consolidated corpus while every
+ * single-learning file still deduped correctly — pinned by the "fresh clone,
+ * consolidated shape" test in `tests/lib/reconcile/engine.test.mjs`.
+ *
+ * `rule-loader.mjs` only EXCLUDES expired rules from injection; it never
+ * deletes a file, so an expired rule keeps deduping through these markers.
+ *
  * Gated the same way as {@link defaultLoadCandidatesForDedupe}: an absent
  * `repoRoot` yields empty sets rather than falling back to `process.cwd()`.
  * Never throws — a missing `.claude/rules/` dir or an unreadable file
@@ -555,14 +577,23 @@ async function runReconcileInner(
     // new learning could use — the #484 defect measured on a real repo was
     // exactly this: 9 of 10 proposals in one run were learnings that already
     // had a `.claude/rules/` file on disk, crowding out the tenth new one.
-    // Two independent sources both count as terminal, either is sufficient:
-    //   - the idempotency sidecar already carries a `processed_at` stamp for
-    //     this `learning_key` (`isProcessed`, previously computed but NEVER
-    //     called from this module — the other half of #484);
-    //   - a `.claude/rules/*.md` file already carries a matching
+    // Two independent sources both count as terminal, either is sufficient —
+    // but they are NOT peers (#1242). Their contract is:
+    //   - AUTHORITATIVE: a `.claude/rules/*.md` file already carries a matching
     //     `learning-key`/`learning-id` provenance marker, discovered by
-    //     scanning disk directly (covers the case where a rule was written
-    //     without ever going through this sidecar, e.g. hand-authored).
+    //     scanning disk directly. Those files are TRACKED, so this source alone
+    //     is sufficient on a fresh clone and covers rules written without ever
+    //     going through the sidecar (hand-authored, or consolidated by hand).
+    //   - CACHE: the idempotency sidecar already carries a `processed_at` stamp
+    //     for this `learning_key` (`isProcessed`, previously computed but NEVER
+    //     called from this module — the other half of #484). It lives in the
+    //     GITIGNORED `.orchestrator/runtime/` (`.gitignore:114`), so it is
+    //     absent on a fresh clone. It only SHORT-CIRCUITS the scan above (and
+    //     carries forward verdicts the scan can no longer see, e.g. an operator
+    //     decline (#1042) or a rule file since removed) — it never replaces it.
+    // Consequence: an empty sidecar must never change the verdict for a
+    // learning whose rule file exists. Pinned by the "fresh clone, consolidated
+    // shape" test in `tests/lib/reconcile/engine.test.mjs`.
     const { records: existingCandidates } = loadCandidatesForDedupe(repoRoot) ?? { records: [] };
     const materialized = readMaterializedProvenance(repoRoot) ?? { keys: new Set(), ids: new Set() };
 

package/scripts/lib/session-identity/own-session.mjs

@@ -80,8 +80,8 @@ function readLockIds(repoRoot) {
  *      handled right now (`session_id` / `sessionId`, plus `parent_session_id`
  *      for a sub-agent invocation, whose coordinator is equally us). The only
  *      tier that is per-INVOCATION rather than per-working-copy.
- *   2. `CLAUDE_CODE_SESSION_ID` — process-scoped, absent on harnesses that
- *      export no session env var.
+ *   2. The native process-scoped id (`CLAUDE_CODE_SESSION_ID` or
+ *      `CODEX_THREAD_ID`), selected by {@link readProcessLocalSessionIds}.
  *   3. `session.lock` `session_id` / `semantic_session_id` — repo-GLOBAL, and
  *      the identity the WRITER of a manifest uses: `wave-scope.json`'s
  *      `session` field comes from `sessionAttribution()`, which reads this same
@@ -138,20 +138,12 @@ function readLockIds(repoRoot) {
  *   never as a mismatch.
  */
 export function readOwnSessionIds(repoRoot, { hookInput = null } = {}) {
-  const ids = new Set();
+  const ids = new Set(readProcessLocalSessionIds({ hookInput }));
   const add = (value) => {
     const trimmed = typeof value === 'string' ? value.trim() : '';
     if (trimmed) ids.add(trimmed);
   };
 
-  // Source 1 — the harness's statement about THIS invocation.
-  if (hookInput && typeof hookInput === 'object') {
-    for (const key of ['session_id', 'sessionId', 'parent_session_id']) add(hookInput[key]);
-  }
-
-  // Source 2 — process-scoped env var.
-  add(process.env.CLAUDE_CODE_SESSION_ID);
-
   // Source 3 — repo-global lock file (the manifest writer's own identity).
   try {
     const lock = readLockIds(repoRoot);
@@ -190,6 +182,14 @@ export function readOwnSessionIds(repoRoot, { hookInput = null } = {}) {
  * rather than unioning is the fix — a better signal REPLACES a worse one
  * (`.claude/rules/host-resources.md` § HR-102).
  *
+ * Native env identity (#1274): an explicit SO_PLATFORM selects ONLY its own
+ * variable (claude → CLAUDE_CODE_SESSION_ID, codex → CODEX_THREAD_ID). Cursor
+ * and Pi have no native env source here. Without a valid explicit selection,
+ * a single non-empty native id, or two equal ids, is usable; conflicting ids
+ * are ambiguous and contribute nothing. This prevents an inherited parent
+ * harness's id from confirming a peer lock. Hook invocation/parent ids remain
+ * valid independently. No filesystem/platform detection is an identity proof.
+ *
  * Never throws.
  *
  * @param {{ env?: object, hookInput?: object|null }} [opts]
@@ -211,8 +211,19 @@ export function readProcessLocalSessionIds({ env = process.env, hookInput = null
   if (hookInput && typeof hookInput === 'object') {
     for (const key of ['session_id', 'sessionId', 'parent_session_id']) add(hookInput[key]);
   }
-  // Tier 2 — process-scoped env var.
-  add(env?.CLAUDE_CODE_SESSION_ID);
+  // Tier 2 — select a native process id without importing the platform module
+  // into this hook-safe leaf or using shared repository markers as evidence.
+  const trim = (value) => typeof value === 'string' ? value.trim() : '';
+  const platform = trim(env?.SO_PLATFORM);
+  const claudeId = trim(env?.CLAUDE_CODE_SESSION_ID);
+  const codexId = trim(env?.CODEX_THREAD_ID);
+  if (platform === 'claude') add(claudeId);
+  else if (platform === 'codex') add(codexId);
+  else if (platform !== 'cursor' && platform !== 'pi') {
+    // Invalid/absent SO_PLATFORM is not an explicit choice (platform.mjs uses
+    // the same trimmed allowlist). Disagreement must never become a union.
+    if (!claudeId || !codexId || claudeId === codexId) add(claudeId || codexId);
+  }
 
   return ids;
 }

package/scripts/lib/session-schema/constants.mjs

@@ -5,7 +5,8 @@
  * Leaf module — no imports from siblings or parent.
  *
  * Exports: CURRENT_SESSION_SCHEMA_VERSION, SESSION_KEY_ALIASES,
- *          VALID_SESSION_TYPES, REQUIRED_FIELDS, AGENT_SUMMARY_FIELDS
+ *          VALID_SESSION_TYPES, VALID_SESSION_PROFILES, REQUIRED_FIELDS,
+ *          AGENT_SUMMARY_FIELDS
  */
 
 // ---------------------------------------------------------------------------
@@ -82,6 +83,38 @@ export const SESSION_KEY_ALIASES = Object.freeze({
  */
 export const VALID_SESSION_TYPES = Object.freeze(['feature', 'deep', 'housekeeping', 'unknown']);
 
+/**
+ * CLOSED set of valid `session_profile` values — the SSOT for this enum
+ * (GitLab #1252). `scripts/lib/telemetry/schema.mjs` re-exports this constant
+ * rather than defining a second literal; `server/ingest/validate.mjs`
+ * `SESSION_PROFILES` is a deliberate MIRROR (the server tree must not import
+ * from `scripts/`) held in lockstep by `tests/telemetry/parity.test.mjs`.
+ *
+ * A profile names a WAVE-SHAPE variant on top of an UNCHANGED `session_type`:
+ * an ultradeep session is `session_type: "deep"` PLUS
+ * `session_profile: "ultradeep"` — never `session_type: "ultradeep"`.
+ * PRD: docs/prd/2026-09-06-ultradeep-session-profile.md. Writer:
+ * `commands/session.md` § "Argument alias: ultradeep" → STATE.md frontmatter
+ * `session-profile`; wave shape: `skills/session-plan/SKILL.md`.
+ *
+ * DELIBERATELY NOT A MEMBER of VALID_SESSION_TYPES above: that set is consumed
+ * by `scripts/lib/telemetry/schema.mjs` (an unlisted type → 'other') and by
+ * `scripts/lib/wave-sizing.mjs` (an unlisted type → TypeError), where a new
+ * MODE would be MISLABELLED rather than rejected. That reasoning is unchanged
+ * by the `unknown` member: `unknown` is the absence of a measurement, not a
+ * mode, and nothing dispatches on it.
+ *
+ * WHY A WHITELIST AND NOT A REGEX: the value is copied from repo-authored
+ * STATE.md frontmatter, i.e. it is the only usage-ping field whose VALUE is
+ * free text. Two Wave-1 reviewers reproduced the leak end-to-end (2026-09-06):
+ * `session-profile: client-acme-private-repo` travelled verbatim to the ingest
+ * server's `raw_json`. A shape regex does not close it — that string already
+ * passes any lowercase-and-hyphens pattern. Only an enumeration of names that
+ * are public BY CONSTRUCTION does. Adding a profile therefore means a reviewed
+ * edit HERE and in the server mirror.
+ */
+export const VALID_SESSION_PROFILES = Object.freeze(['ultradeep']);
+
 /**
  * Required fields for a schema_version=1 record. Validated by validateSession
  * before any write reaches disk.
@@ -154,15 +187,9 @@ export const OPTIONAL_FIELDS = Object.freeze([
   // into a note a human reads" ⊃ "schema-valid". A record missing it is a clean
   // vault-mirror skip, NOT a malformed record.
   'effectiveness',
-  // PRD docs/prd/2026-09-06-ultradeep-session-profile.md — `session_profile`
-  // names a WAVE-SHAPE variant on top of an unchanged `session_type`. It is
-  // additive and optional on purpose: `ultradeep` is deliberately NOT a member
-  // of VALID_SESSION_TYPES above, because that set is mirrored in
-  // scripts/lib/telemetry/schema.mjs (an unlisted type -> 'other') and in
-  // scripts/lib/wave-sizing.mjs (an unlisted type -> TypeError), where a new
-  // MODE would be MISLABELLED rather than rejected. That reasoning is unchanged
-  // by the `unknown` member added above: `unknown` is the absence of a
-  // measurement, not a mode, and nothing dispatches on it. Every historical
-  // record lacking the field validates unchanged.
+  // `session_profile` — a WAVE-SHAPE variant on top of an unchanged
+  // `session_type`. Additive and optional on purpose: every historical record
+  // lacking the field validates unchanged. Value set + the full rationale for
+  // why it is NOT a VALID_SESSION_TYPES member: VALID_SESSION_PROFILES above.
   'session_profile',
 ]);

package/scripts/lib/session-start-probes.mjs

@@ -168,6 +168,18 @@ export const PROBES = [
     // vault-staleness-banner.mjs's header for the "one vocabulary, not two"
     // rationale.
   },
+  {
+    id: 'telemetry-flush-health',
+    spec: local('./telemetry-flush-health-banner.mjs'),
+    fn: 'checkTelemetryFlushHealth',
+    network: false,
+    args: ({ repoRoot }) => ({ repoRoot }),
+    // No custom render/severityOf: the probe returns `{severity:'warn',
+    // message}` — exactly the shape the module-level defaults below read. It
+    // reports the LAST `orchestrator.telemetry.flush` record when that record
+    // is a `sandbox:*` refusal (#1255); the refusal reached the ledger and
+    // nothing else before this entry existed.
+  },
   {
     id: 'ci-status',
     spec: local('./ci-status-banner.mjs'),

package/scripts/lib/telemetry/schema.mjs

@@ -38,6 +38,7 @@
 import { getPlatform, getPluginRoot } from '../platform.mjs';
 import { enumerateSurface } from '../sunset/walker.mjs';
 import { readPluginVersionFromPackageJson } from '../bootstrap-lock-freshness.mjs';
+import { VALID_SESSION_PROFILES } from '../session-schema/constants.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -124,8 +125,31 @@ const ROSTER_OTHER = 'other';
 const MAX_NAME_LENGTH = 64;
 const MAX_NAMES = 100;
 
+/**
+ * The two list bounds that are genuinely SHARED with the ingest server
+ * (`server/ingest/validate.mjs` `INGEST_LIST_BOUNDS` — MAX_LIST_ITEMS /
+ * MAX_LIST_ITEM_LEN). Exported so `tests/telemetry/parity.test.mjs` can compare
+ * the two trees instead of trusting two hand-typed numbers: a client that caps
+ * higher than the server emits pings the server 400s.
+ *
+ * The server's other five bounds (MAX_ANON_ID, MAX_SENT_AT, MAX_PLUGIN_VERSION,
+ * MAX_SESSION_TYPE, MAX_SESSION_PROFILE) are SERVER-ONLY BY DESIGN — they bound
+ * inputs from any client, including foreign or tampered ones, and have no client
+ * counterpart to keep in lockstep. Do not mirror them here.
+ */
+export const SHARED_LIST_BOUNDS = Object.freeze({
+  maxItems: MAX_NAMES,
+  maxItemLength: MAX_NAME_LENGTH,
+});
+
 /** Enum fallbacks. */
 const VALID_PLATFORMS = Object.freeze(['claude', 'codex', 'cursor', 'pi']);
+// DELIBERATE ASYMMETRY, not a drift: this is the TELEMETRY type set and omits
+// `'unknown'`, which session-schema/constants.mjs VALID_SESSION_TYPES carries.
+// There `unknown` is a storable ledger value; here it is a NORMALIZER FALLBACK
+// (SESSION_TYPE_UNKNOWN below) that must never be reachable from the input set,
+// or "we could not tell" would be indistinguishable from a measured type. Not
+// unified with constants.mjs for exactly that reason.
 const VALID_SESSION_TYPES = Object.freeze(['housekeeping', 'feature', 'deep']);
 const PLATFORM_OTHER = 'other';
 const SESSION_TYPE_OTHER = 'other';
@@ -145,27 +169,24 @@ const SESSION_TYPE_UNKNOWN = 'unknown';
 /**
  * CLOSED whitelist of PUBLIC session-profile names that may reach the wire.
  *
- * WHY A WHITELIST AND NOT A REGEX: `session_profile` is copied from the STATE.md
- * frontmatter key `session-profile`, which is written per repo by whoever runs
- * `/session <alias>` — i.e. it is the only field on the usage-ping whose VALUE is
- * repo-authored free text. Two independent Wave-1 reviewers reproduced the leak
- * end-to-end (2026-09-06): `session-profile: client-acme-private-repo` travelled
- * verbatim through `buildUsagePing` → `projectUsagePing` → the ingest server's
- * `raw_json` column. A shape regex does NOT close it — that example string is
- * already lowercase-and-hyphens and passes any such pattern. Only an
- * enumeration of names that are public BY CONSTRUCTION does.
+ * RE-EXPORT, not a definition (GitLab #1252): the SSOT is
+ * `scripts/lib/session-schema/constants.mjs` `VALID_SESSION_PROFILES`, whose
+ * docblock carries the reproduced leak and the whitelist-over-regex rationale.
  *
- * Today exactly one profile exists: `ultradeep`, the 7-wave variant of a `deep`
- * session (writer: `commands/session.md` § "Argument alias: ultradeep" → STATE.md
- * frontmatter `session-profile`; wave shape: `skills/session-plan/SKILL.md`).
- * Adding a profile there means adding it HERE and in the server's mirror
- * (`server/ingest/validate.mjs` `SESSION_PROFILES`) — a deliberate two-line,
- * reviewed edit, the same contract `ACCEPTED_VERSIONS` already uses server-side.
+ * Kept as a pure COMPATIBILITY SHIM, and measured as one: since 2026-09-07 no
+ * module in this repo imports the name from here (`rg -n VALID_SESSION_PROFILES
+ * scripts server hooks skills tests` — the two telemetry tests that used to now
+ * address constants.mjs). It stays because removing an export is a MAJOR change
+ * and this is a patch line; a deep importer outside the repo may still hold it.
+ * `tests/telemetry/schema.test.mjs` pins it with an IDENTITY assertion
+ * (`toBe`, not `toEqual`) so the shim can never quietly become a second
+ * definition of the whitelist.
  *
- * NOT a member of VALID_SESSION_TYPES: the profile is a SECOND axis. An
- * ultradeep session is `session_type: "deep"` PLUS `session_profile: "ultradeep"`.
+ * Adding a profile is a reviewed edit in constants.mjs AND in the server's
+ * mirror (`server/ingest/validate.mjs` `SESSION_PROFILES`) — the same two-tree
+ * contract `ACCEPTED_VERSIONS` already uses server-side.
  */
-export const VALID_SESSION_PROFILES = Object.freeze(['ultradeep']);
+export { VALID_SESSION_PROFILES };
 
 /**
  * Closed sets for os/arch client-side normalization. A value outside the set —