session-orchestrator 5.2.0 → 5.4.0

package/scripts/lib/maintenance-due-banner.mjs

@@ -70,9 +70,10 @@
  * @module scripts/lib/maintenance-due-banner
  */
 
-import { closeSync, existsSync, fstatSync, openSync, readSync, statSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import path from 'node:path';
 
+import { SCAN_CHUNK_BYTES, scanEventsBackwards } from './events.mjs';
 import { computeReconcileNudge } from './reconcile-nudge-banner.mjs';
 import { sweepExpiredLearnings } from './learnings/expiry-sweep.mjs';
 import { shouldDispatchAutoDialectic } from './auto-dialectic.mjs';
@@ -152,104 +153,64 @@ function isoDay(ts) {
 }
 
 /**
- * Backwards-scan chunk size (#1290 item 2).
- *
- * NAMED CEILING: 256 KiB is ~800 records in this repo's ledger, so the common
- * case — a repo that ran /evolve within its recent history — answers after a
- * handful of reads instead of loading the whole 7.9 MB file. The scan is
- * UNBOUNDED in the worst case ON PURPOSE: "never ran" is a claim about every
- * line and cannot be made from a tail, so a repo with no `evolve.completed`
- * record still walks the file to its start — just in chunks, never all at once
- * in one string.
- *
- * REVISIT TRIGGER: the maintenance probe's median passes 1000 ms (half
- * `PROBE_BUDGET_MS`), or one repo's `events.jsonl` passes 50 MB. Either means
- * the "never ran" walk has become the cost that matters and the answer needs an
- * index rather than a scan.
+ * Backwards-scan chunk size (#1290 item 2) — the shared reader's constant, kept
+ * under this module's own name because it is the number this probe's cost is
+ * reasoned about in. NAMED CEILING + revisit trigger live at
+ * {@link SCAN_CHUNK_BYTES}.
  */
-export const TAIL_CHUNK_BYTES = 256 * 1024;
+export const TAIL_CHUNK_BYTES = SCAN_CHUNK_BYTES;
 
 /**
- * Scan a buffer of COMPLETE lines backwards for the newest evolve record.
+ * Wall-clock budget for the "did /evolve ever run?" walk (#1414).
+ *
+ * NAMED CEILING (BV-004): 1000 ms is half of `PROBE_BUDGET_MS` (2000 ms in
+ * `session-start-probes.mjs`), which this probe shares with six other signals.
+ * The walk is UNBOUNDED in principle — "never ran" is a claim about every line
+ * of every source — so it needs an own limit now that it spans the archives
+ * too, and running out must report `truncated`, never a clean "never".
  *
- * @param {Buffer} buf
- * @returns {{lastAt: string|null}|null} null ⇒ no record in this buffer
+ * REVISIT TRIGGER: a repo where this reports `truncated` more than rarely. That
+ * means the answer needs an index rather than a scan, not a bigger budget
+ * (HR-101).
  */
-function scanEvolveLines(buf) {
-  if (buf.length === 0) return null;
-  const lines = buf.toString('utf8').split('\n');
-  for (let i = lines.length - 1; i >= 0; i -= 1) {
-    const line = lines[i];
-    if (!line || !line.includes(EVOLVE_EVENT)) continue; // cheap pre-filter before JSON.parse
-    try {
-      const rec = JSON.parse(line);
-      if (rec?.event !== EVOLVE_EVENT) continue;
-      return { lastAt: typeof rec.timestamp === 'string' ? rec.timestamp : null };
-    } catch {
-      continue; // a malformed line is not evidence either way — keep scanning
-    }
-  }
-  return null;
-}
+export const EVOLVE_SCAN_BUDGET_MS = 1000;
 
 /**
- * Find the most recent `orchestrator.evolve.completed` record.
- *
- * Reads the ledger BACKWARDS in {@link TAIL_CHUNK_BYTES} chunks and stops at
- * the first hit, because the interesting answer is the LAST occurrence. The
- * former implementation `readFileSync`-ed the whole file (7.9 MB here, 30–44 ms)
- * to answer a question the last few kilobytes usually settle.
+ * Find the most recent `orchestrator.evolve.completed` record — across ROTATION
+ * boundaries (#1414).
  *
- * The one bug a naive chunked scan introduces is a record SPLIT across a chunk
- * boundary: the bytes before the first newline of a chunk are the tail of a line
- * whose head is in the chunk not read yet, so they are CARRIED, never parsed
- * here. Splitting on the 0x0A byte is safe on UTF-8 — no continuation byte can
- * equal a newline — so a multibyte character never splits a line either.
+ * Walks the ledger backwards through every source, newest first, and stops at
+ * the first hit, because the interesting answer is the LAST occurrence. Reading
+ * the active file alone was the bug: "never ran" is a claim about EVERY line
+ * ever written, and after a rotation the only `evolve.completed` record on the
+ * host can sit in `_archive/` — the probe then nags a repo that has run
+ * /evolve, which is the HR-101 failure mode this module exists to avoid.
  *
  * @param {string} repoRoot
- * @returns {{ok: boolean, lastAt: string|null}} `ok: false` ⇒ the ledger exists
- *   but could not be read — the caller must record `undeterminable`, never clean.
+ * @returns {{ok: boolean, lastAt: string|null, truncated: boolean}} `ok: false`
+ *   ⇒ a source exists but could not be read; `truncated: true` ⇒ the budget ran
+ *   out before the walk finished. In BOTH cases the caller must record
+ *   `undeterminable`, never clean — a walk that did not finish has not proven
+ *   "never".
  */
 function readLastEvolveRun(repoRoot) {
   const file = path.join(repoRoot, '.orchestrator', 'metrics', 'events.jsonl');
-  if (!existsSync(file)) return { ok: true, lastAt: null }; // fresh repo: genuinely never
-  let fd;
-  try {
-    fd = openSync(file, 'r');
-    let pos = fstatSync(fd).size;
-    /** Partial line at the FRONT of everything read so far. */
-    let carry = Buffer.alloc(0);
-
-    while (pos > 0) {
-      const length = Math.min(TAIL_CHUNK_BYTES, pos);
-      pos -= length;
-      const buf = Buffer.alloc(length);
-      readSync(fd, buf, 0, length, pos);
-      const block = carry.length > 0 ? Buffer.concat([buf, carry]) : buf;
-      const firstNewline = block.indexOf(0x0a);
-      if (firstNewline === -1) {
-        carry = block; // no complete line yet — a line longer than one chunk
-        continue;
-      }
-      const hit = scanEvolveLines(block.subarray(firstNewline + 1));
-      if (hit) return { ok: true, lastAt: hit.lastAt };
-      carry = block.subarray(0, firstNewline);
-    }
-
-    // pos === 0: the carry is the file's FIRST line, complete by construction.
-    const hit = scanEvolveLines(carry);
-    return { ok: true, lastAt: hit ? hit.lastAt : null };
-  } catch {
-    return { ok: false, lastAt: null };
-  } finally {
-    if (fd !== undefined) {
-      try {
-        closeSync(fd);
-      } catch {
-        /* best-effort */
-      }
-    }
-  }
+  let lastAt = null;
+  const scan = scanEventsBackwards({
+    filePath: file,
+    chunkBytes: TAIL_CHUNK_BYTES,
+    budgetMs: EVOLVE_SCAN_BUDGET_MS,
+    // Cheap substring pre-filter before JSON.parse — the property the previous
+    // hand-rolled scan was written for, kept here rather than re-derived.
+    filter: EVOLVE_EVENT,
+    onRecord: (rec) => {
+      if (rec?.event !== EVOLVE_EVENT) return false;
+      lastAt = typeof rec.timestamp === 'string' ? rec.timestamp : null;
+      return true;
+    },
+  });
+  if (scan.unreadable.length > 0) return { ok: false, lastAt: null, truncated: false };
+  return { ok: true, lastAt, truncated: scan.truncated };
 }
 
 /**
@@ -335,7 +296,9 @@ export async function computeMaintenanceDue(opts = {}) {
   } else {
     // --- evolve (S1) -------------------------------------------------------
     const evolve = readLastEvolveRun(repoRoot);
-    if (!evolve.ok) {
+    // `truncated` is NOT "not found": a walk that ran out of budget proves
+    // nothing about the lines it never reached (#1414).
+    if (!evolve.ok || evolve.truncated) {
       undeterminable.push('evolve');
     } else if (evolve.lastAt === null && nudge.activeLearnings >= MAINTENANCE_MIN_LEARNINGS) {
       markDue('evolve', `never, ${nudge.activeLearnings} active learnings`);
@@ -344,7 +307,9 @@ export async function computeMaintenanceDue(opts = {}) {
     // --- reconcile (S3) ----------------------------------------------------
     if (nudge.nudge === true) {
       // HR-106: report what the rule JUDGED. `computeReconcileNudge` nudges on
-      // a BACKLOG (eligible-unmaterialized learnings), never on a date — so
+      // a BACKLOG — rule-eligible learnings minus those already materialized
+      // in the sidecar or `.claude/rules/` (`countReconcileBacklog`, #1380;
+      // before #1380 it counted all eligible ones) — never on a date — so
       // printing `lastRunAt` here put today's date next to the word "due" and
       // read as "last run today and already due again". Measured 2026-09-09
       // (learning 013a45ba): with 108 learnings capped under

package/scripts/lib/memory-proposals/schema.mjs

@@ -7,7 +7,8 @@
  * during a wave, reviewed by the memory-cleanup flow, and either accepted
  * (appended to learnings.jsonl) or discarded.
  *
- * Pure leaf module — imports only node:crypto. No I/O, no quota enforcement
+ * Pure module — imports only node:crypto and the pure learnings/schema.mjs
+ * (type registry, repo-relative path predicate). No I/O, no quota enforcement
  * (see store.mjs for those responsibilities).
  *
  * Canonical schema (schema_version: 1) — ALL required fields:
@@ -30,7 +31,8 @@
  */
 
 import { randomUUID } from 'node:crypto';
-import { LEARNING_TYPE_REGISTRY } from '../learnings/schema.mjs';
+
+import { isRepoRelativePathEntry, LEARNING_TYPE_REGISTRY } from '../learnings/schema.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -251,24 +253,28 @@ export function validateProposalRecord(record) {
   }
 
   // file_paths (optional, but if present must be a non-empty array of
-  // non-empty, newline-free, glob-metacharacter-free strings) — issue #900 C,
+  // repo-relative, newline-free, glob-metacharacter-free strings) — issue #900 C,
   // Q3-MED fix pass: a glob metacharacter (* ? [ ] { }) surviving this schema
   // gate would later reach emitter.mjs::globsFromFilePaths verbatim for a
   // top-level (dirname==='.') entry, effectively producing an always-on rule
   // glob (e.g. `file_paths: ['**']`). `createProposalRecord` never sets an
   // empty array (it omits the key), so a present-but-empty `[]` is itself a
   // signal of a malformed/tampered record — reject it explicitly.
+  // Repo-relative is the SAME predicate validateLearning applies at write time
+  // (isRepoRelativePathEntry): a record read back from proposals.jsonl is not
+  // re-validated before writeApproved → appendLearning, so an absolute, home-
+  // relative or URL entry must be refused here, not silently at promotion.
   if ('file_paths' in record) {
     const fp = record.file_paths;
     const isValidArray =
       Array.isArray(fp) &&
       fp.length > 0 &&
       fp.every(
-        (p) => typeof p === 'string' && p.length > 0 && !/[\r\n]/.test(p) && !/[*?[\]{}]/.test(p),
+        (p) => isRepoRelativePathEntry(p) && !/[\r\n]/.test(p) && !/[*?[\]{}]/.test(p),
       );
     if (!isValidArray) {
       errors.push(
-        'file_paths must be a non-empty array of non-empty, newline-free, glob-metacharacter-free strings when present',
+        'file_paths must be a non-empty array of repo-relative, newline-free, glob-metacharacter-free strings when present',
       );
     }
   }

package/scripts/lib/named-baseline-resolver.mjs

@@ -29,11 +29,21 @@
  *   also YIELDS to tier 1: when SO_BASELINE_PATH is set (non-blank), resolveNamedBaseline
  *   returns the null-fallback ({source:null}) so the caller's env tier wins.
  *
+ * ── Other sections (agents/vault#319) ────────────────────────────────────────
+ *
+ *   The same directory-prefix match serves any owner.yaml list of the shape
+ *   `{ path, match: { path-prefix } }`. `section` picks the list and `envKey` the
+ *   env var this tier yields to. The live second consumer is `vault-dirs:`
+ *   (section 'vault-dirs', envKey 'SO_VAULT_DIR'), driven by
+ *   `resolveVaultDir` in scripts/lib/config/host-paths.mjs. `name` is required
+ *   only for `baselines:` (the #819 contract); elsewhere it is optional and
+ *   defaults to `path`, which is what the ambiguity WARN then names.
+ *
  * ── Exports ──────────────────────────────────────────────────────────────────
  *
- *   parseBaselines(ownerConfig)
- *   matchBaselineForPath(absPath, baselines)
- *   resolveNamedBaseline({ cwd, ownerConfig, env })
+ *   parseBaselines(ownerConfig, section?)
+ *   matchBaselineForPath(absPath, baselines, section?)
+ *   resolveNamedBaseline({ cwd, ownerConfig, env, section?, envKey? })
  */
 
 import { normalize, sep } from 'node:path';
@@ -43,6 +53,9 @@ import { expandTilde } from './common.mjs';
 // Internal helpers
 // ---------------------------------------------------------------------------
 
+/** Sections whose entries MUST carry a `name` (the #819 baselines contract). */
+const NAME_REQUIRED_SECTIONS = new Set(['baselines']);
+
 /** @param {unknown} v */
 function isPlainObject(v) {
   return v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -70,18 +83,23 @@ function _normalizePath(p) {
 // ---------------------------------------------------------------------------
 
 /**
- * Extract and validate the `baselines:` list from a raw ownerConfig object.
+ * Extract and validate a directory-prefix list (default `baselines:`) from a raw
+ * ownerConfig object.
  *
  * Drop-and-WARN on malformed entries; never throw. Returns [] when the section
- * is absent, null, or empty — the backward-compat no-op path.
+ * is absent, null, or empty — the backward-compat no-op path. Every WARN names
+ * the section it came from.
  *
- * Each valid entry: { name: string, path: string, match: { 'path-prefix': string } }
+ * Each valid entry: { name: string, path: string, match: { 'path-prefix': string } }.
+ * `name` is required for `baselines`; for other sections an absent name falls
+ * back to `path` (a present-but-blank or non-string name is still dropped).
  *
  * @param {object|undefined} ownerConfig — raw parsed owner.yaml (NOT merged with defaults)
+ * @param {string} [section='baselines'] — owner.yaml list to read (e.g. 'vault-dirs')
  * @returns {Array<{name:string, path:string, match:{'path-prefix':string}}>}
  */
-export function parseBaselines(ownerConfig) {
-  const raw = ownerConfig?.baselines;
+export function parseBaselines(ownerConfig, section = 'baselines') {
+  const raw = ownerConfig?.[section];
 
   // Absent or explicit null/empty → no-op
   if (raw === undefined || raw === null) return [];
@@ -89,54 +107,56 @@ export function parseBaselines(ownerConfig) {
 
   if (!Array.isArray(raw)) {
     process.stderr.write(
-      'WARN named-baseline-resolver: owner.yaml baselines: must be an array; ignoring\n',
+      `WARN named-baseline-resolver: owner.yaml ${section}: must be an array; ignoring\n`,
     );
     return [];
   }
 
+  const nameRequired = NAME_REQUIRED_SECTIONS.has(section);
   const result = [];
   for (let i = 0; i < raw.length; i++) {
     const entry = raw[i];
     if (!isPlainObject(entry)) {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}] is not an object; dropping\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}] is not an object; dropping\n`,
       );
       continue;
     }
 
     const { name, path: entryPath, match } = entry;
 
-    if (typeof name !== 'string' || name.trim() === '') {
+    const nameAbsent = name === undefined || name === null;
+    if ((nameRequired || !nameAbsent) && (typeof name !== 'string' || name.trim() === '')) {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].name must be a non-empty string; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].name must be a non-empty string; dropping entry\n`,
       );
       continue;
     }
     if (typeof entryPath !== 'string' || entryPath.trim() === '') {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].path must be a non-empty string; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].path must be a non-empty string; dropping entry\n`,
       );
       continue;
     }
 
-    // match is REQUIRED (unlike vaults) — a baseline with no path-prefix can
+    // match is REQUIRED (unlike vaults) — an entry with no path-prefix can
     // never be selected, so it is dropped rather than kept.
     if (!isPlainObject(match)) {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].match must be an object; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].match must be an object; dropping entry\n`,
       );
       continue;
     }
     const pathPrefix = match['path-prefix'];
     if (typeof pathPrefix !== 'string' || pathPrefix.trim() === '') {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].match.path-prefix must be a non-empty string; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].match.path-prefix must be a non-empty string; dropping entry\n`,
       );
       continue;
     }
 
     result.push({
-      name: name.trim(),
+      name: nameAbsent ? entryPath.trim() : name.trim(),
       path: entryPath.trim(),
       match: { 'path-prefix': pathPrefix.trim() },
     });
@@ -162,9 +182,10 @@ export function parseBaselines(ownerConfig) {
  *
  * @param {string} absPath — the working directory to classify
  * @param {Array<{name:string, path:string, match:{'path-prefix':string}}>} baselines
+ * @param {string} [section='baselines'] — owner.yaml list name, used only in the WARN
  * @returns {{name:string, path:string, match:{'path-prefix':string}}|null}
  */
-export function matchBaselineForPath(absPath, baselines) {
+export function matchBaselineForPath(absPath, baselines, section = 'baselines') {
   if (!absPath || !Array.isArray(baselines) || baselines.length === 0) return null;
 
   const target = _normalizePath(absPath);
@@ -181,7 +202,7 @@ export function matchBaselineForPath(absPath, baselines) {
 
   if (matched.length > 1) {
     process.stderr.write(
-      `WARN named-baseline-resolver: multiple baselines match path "${absPath}": ${matched
+      `WARN named-baseline-resolver: multiple ${section} match path "${absPath}": ${matched
         .map((b) => b.name)
         .join(', ')}; using first match "${matched[0].name}"\n`,
     );
@@ -195,13 +216,13 @@ export function matchBaselineForPath(absPath, baselines) {
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve the `baselines:` match tier for a given cwd.
+ * Resolve the directory-prefix match tier (default `baselines:`) for a given cwd.
  *
  * Returns:
- *   { path, name, source:'match' } when a baseline directory-prefix matches cwd.
+ *   { path, name, source:'match' } when an entry's directory-prefix matches cwd.
  *   { path:null, name:null, source:null } (the null-fallback) otherwise — including
- *   when SO_BASELINE_PATH env is set (this tier yields to the higher env tier the
- *   caller owns), when no `baselines:` are configured, or when nothing matches.
+ *   when `env[envKey]` is set (this tier yields to the higher env tier the caller
+ *   owns), when the section is not configured, or when nothing matches.
  *
  * Pure + synchronous — no git calls, no disk reads. Never throws.
  *
@@ -209,22 +230,26 @@ export function matchBaselineForPath(absPath, baselines) {
  *   cwd?: string,
  *   ownerConfig?: object,
  *   env?: Record<string, string|undefined>,
- * }} [opts]
+ *   section?: string,
+ *   envKey?: string,
+ * }} [opts] — `section` defaults to 'baselines', `envKey` to 'SO_BASELINE_PATH'
  * @returns {{ path: string|null, name: string|null, source: 'match'|null }}
  */
 export function resolveNamedBaseline({
   cwd = process.cwd(),
   ownerConfig,
   env = process.env,
+  section = 'baselines',
+  envKey = 'SO_BASELINE_PATH',
 } = {}) {
-  // Yield to the higher-precedence env tier the caller owns (SO_BASELINE_PATH).
-  const envVal = env?.SO_BASELINE_PATH;
+  // Yield to the higher-precedence env tier the caller owns.
+  const envVal = env?.[envKey];
   if (typeof envVal === 'string' && envVal.trim() !== '') {
     return { path: null, name: null, source: null };
   }
 
-  const baselines = parseBaselines(ownerConfig);
-  const matched = baselines.length > 0 ? matchBaselineForPath(cwd, baselines) : null;
+  const entries = parseBaselines(ownerConfig, section);
+  const matched = entries.length > 0 ? matchBaselineForPath(cwd, entries, section) : null;
   if (matched !== null) {
     return { path: matched.path, name: matched.name, source: 'match' };
   }

package/scripts/lib/named-vault-resolver.mjs

@@ -47,11 +47,14 @@
  *   resolveCanonicalSuffixes({ ownerConfig, env })
  *   findRepoRoot(cwd, { existsSync, realpathSync })
  *   resolveNamedVault({ vaultName, cwd, ownerConfig, env, gitRemote, existsSync, realpathSync })
+ *   normalizeRemote(url)
+ *   checkCanonicalVault({ vaultDir, ownerConfig, env, readOriginUrl })
  */
 
 import { join, dirname } from 'node:path';
 import { existsSync as nodeExistsSync, realpathSync as nodeRealpathSync } from 'node:fs';
-import { resolvePreferredRemote, isQueryFailure } from './vcs-repo-spec.mjs';
+import { spawnSync } from 'node:child_process';
+import { resolvePreferredRemote, isQueryFailure, redactUrlCredentials } from './vcs-repo-spec.mjs';
 
 // ---------------------------------------------------------------------------
 // Internal helpers
@@ -255,6 +258,73 @@ export function resolveCanonicalSuffixes({ ownerConfig, env = process.env } = {}
   return canonicalSuffixesFromVaults(vaults, env?.VAULT_MIRROR_CANONICAL_SUFFIX);
 }
 
+// ---------------------------------------------------------------------------
+// checkCanonicalVault — the canonical-vault write guard (#1450)
+// ---------------------------------------------------------------------------
+
+/**
+ * Default origin reader: `git -C <vaultDir> remote get-url origin`. Returns
+ * `''` on a spawn error or a non-zero exit, so every failure reads as "no
+ * origin" and the guard stays fail-closed.
+ * @param {string} vaultDir
+ * @returns {string}
+ */
+function _defaultReadOriginUrl(vaultDir) {
+  const res = spawnSync('git', ['-C', vaultDir, 'remote', 'get-url', 'origin'], { encoding: 'utf8' });
+  if (res.error || res.status !== 0) return '';
+  return String(res.stdout ?? '').trim();
+}
+
+/**
+ * Decide whether `vaultDir` is a canonical Meta-Vault, i.e. whether its git
+ * `origin` ends in one of {@link resolveCanonicalSuffixes}. Shared by every
+ * writer into the vault so none of them can write into a foreign vault that
+ * `vault-dir` happened to resolve to.
+ *
+ * Fail-closed: a missing origin, a failing or throwing reader, and a suffix
+ * resolution that throws all return `ok: false`. The only bypass is the
+ * existing `VAULT_MIRROR_SKIP_CANONICAL_CHECK === '1'` switch, read from the
+ * `env` passed in (never from the ambient process.env when `env` is given).
+ * It is evaluated before any suffix resolution, so a skipped check neither
+ * parses `ownerConfig.vaults` nor prints its WARN lines, and returns
+ * `expected: []`.
+ *
+ * @param {{
+ *   vaultDir: string,
+ *   ownerConfig?: object,
+ *   env?: Record<string, string|undefined>,
+ *   readOriginUrl?: (vaultDir: string) => string,
+ * }} opts
+ * @returns {{ ok: boolean, reason?: 'skipped-by-env'|'no-git-origin'|'not-canonical', got?: string, expected: string[] }}
+ */
+export function checkCanonicalVault({ vaultDir, ownerConfig, env = process.env, readOriginUrl = _defaultReadOriginUrl } = {}) {
+  if (env?.VAULT_MIRROR_SKIP_CANONICAL_CHECK === '1') {
+    // Empty on purpose: suffix resolution is exactly what the switch skips, and
+    // callers read `expected` only on `ok: false`.
+    return { ok: true, reason: 'skipped-by-env', expected: [] };
+  }
+  let expected;
+  try {
+    expected = resolveCanonicalSuffixes({ ownerConfig, env });
+  } catch {
+    return { ok: false, reason: 'not-canonical', expected: [] };
+  }
+
+  let url;
+  try {
+    url = String(readOriginUrl(vaultDir) ?? '').trim();
+  } catch {
+    url = '';
+  }
+  if (!url) return { ok: false, reason: 'no-git-origin', expected };
+
+  const normalized = normalizeRemote(url);
+  if (!expected.some((s) => normalized.endsWith(s))) {
+    return { ok: false, reason: 'not-canonical', got: url, expected };
+  }
+  return { ok: true, expected };
+}
+
 // ---------------------------------------------------------------------------
 // findRepoRoot — injectable IO
 // ---------------------------------------------------------------------------
@@ -414,7 +484,7 @@ export function resolveNamedVault({
 
         // Guard: if this repo IS one of the vaults, skip (don't self-mirror)
         const canonicalSuffixes = canonicalSuffixesFromVaults(vaults, env?.VAULT_MIRROR_CANONICAL_SUFFIX);
-        const normalized = _normalizeRemoteUrl(remoteUrl);
+        const normalized = normalizeRemote(remoteUrl);
         if (canonicalSuffixes.some((s) => normalized.endsWith(s))) {
           // This is the vault itself — fall through to fallback
         } else {
@@ -460,11 +530,14 @@ function _resolveEnvSuffix(env) {
 }
 
 /**
- * Normalize a git remote URL to host/path tail (mirrors vault-mirror.mjs _normalizeRemote).
+ * Normalize a git remote URL to a host/path tail for canonical-suffix matching.
+ * Strips `.git`, the `git@host:` / scheme prefixes, and trailing slashes —
+ * byte-identical to vault-mirror.mjs `_normalizeRemote`, which predates this
+ * export and can import it from here.
  * @param {string} url
  * @returns {string}
  */
-function _normalizeRemoteUrl(url) {
+export function normalizeRemote(url) {
   return String(url ?? '')
     .trim()
     .replace(/\.git$/, '')
@@ -473,6 +546,32 @@ function _normalizeRemoteUrl(url) {
     .replace(/\/+$/, '');
 }
 
+/**
+ * Render a git origin URL for a stderr line (#1479). The vault writers print
+ * the origin {@link checkCanonicalVault} rejected, and that stderr lands in CI
+ * logs and session transcripts — so a LOCAL origin must not carry its path
+ * (the operator's home dir, `.claude/rules/security.md` § Owner-Privacy).
+ *
+ * - `file:` URL, or a bare/relative path (git's rule: no `://` and no `:`
+ *   before the first `/`, a Windows drive letter counting as a path)
+ *   → `file://<local path>`.
+ * - Every other form (`https://`, `ssh://`, scp-like `git@host:path`) keeps its
+ *   host/path and goes through {@link redactUrlCredentials}, so an
+ *   `https://user:token@host/…` origin cannot leak its credential either.
+ *
+ * Returns `''` for an empty/absent origin; callers supply their own wording.
+ * @param {string|undefined|null} url
+ * @returns {string}
+ */
+export function describeOriginForLog(url) {
+  const s = String(url ?? '').trim();
+  if (!s) return '';
+  if (/^file:/i.test(s)) return 'file://<local path>';
+  if (s.includes('://')) return redactUrlCredentials(s);
+  const scpLike = /^[^/\\]*:/.test(s) && !/^[a-z]:[\\/]/i.test(s);
+  return scpLike ? redactUrlCredentials(s) : 'file://<local path>';
+}
+
 /**
  * Derive an org/repo slug from a git remote URL.
  * e.g. 'git@github.com:my-org/my-repo.git' → 'my-org/my-repo'
@@ -480,7 +579,7 @@ function _normalizeRemoteUrl(url) {
  * @returns {string}
  */
 function _deriveSlugFromRemote(url) {
-  const normalized = _normalizeRemoteUrl(url);
+  const normalized = normalizeRemote(url);
   // normalized is now 'host/path/to/repo' — take the last two segments
   const parts = normalized.split('/').filter(Boolean);
   if (parts.length >= 2) {

package/scripts/lib/orphan-reaper/defaults.mjs

@@ -0,0 +1,41 @@
+/**
+ * orphan-reaper/defaults.mjs — the reaper's parameter table and its repo-path join.
+ *
+ * Imports nothing but `node:path` on purpose: the trigger hooks reach it through
+ * `scan-throttle.mjs` on a hot path whose import closure is measured (#1432), and
+ * every other reaper module shares these numbers instead of re-spelling them.
+ */
+
+import path from 'node:path';
+
+/**
+ * Stufe-1 parameters. Every number carries its provenance from the PRD
+ * parameter table (`docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md`
+ * § 4) — NOT calibrated, so the provenance is what makes a later re-measurement
+ * possible ("keine Zahl ohne ihre Population").
+ */
+export const REAPER_DEFAULTS = Object.freeze({
+  /** `reaper.min-age-seconds`: DevWatchdogs' hard limit for `tsgo`; the
+   *  2026-09-20 orphans were 7-17 min old, comfortably above it. */
+  minAgeSeconds: 300,
+  /** `reaper.min-scan-interval-seconds`: DevWatchdogs' normal scan cadence —
+   *  keeps a `PostToolBatch` storm from taxing every tool call. */
+  minScanIntervalSeconds: 30,
+  /** `reaper.kill-grace-ms`: `DEFAULT_KILL_GRACE_MS` from `process-group.mjs` —
+   *  a repo convention, not a new number. A literal rather than an import so this
+   *  module stays out of `process-group.mjs`'s closure. */
+  killGraceMs: 10_000,
+  /** `reaper.verify-wait-ms`: without it the 2026-09-20 hand-run cleanup
+   *  reported "still alive" for processes that were already gone. */
+  verifyWaitMs: 500,
+  /** `reaper.max-hook-latency-ms`: ceiling a scan may delay a hook by. */
+  maxHookLatencyMs: 50,
+  /** `reaper.false-alarm-window`: last N audit decisions — a ROLLING window
+   *  rather than calendar time, so a quiet host still has a population (HR-101). */
+  falseAlarmWindow: 50,
+});
+
+/** @param {string} repoRoot @param {string} relpath @returns {string} */
+export function underRepo(repoRoot, relpath) {
+  return path.join(repoRoot, ...relpath.split('/'));
+}