session-orchestrator 5.2.0 → 5.4.0

package/docs/session-config-template.md

@@ -410,6 +410,14 @@ The gate never probes the network. Without a readiness witness no host counts as
 
 Read by: `scripts/lib/config/remote-hosts.mjs`, `scripts/lib/wave-resource-gate.mjs`.
 
+`offload-first` (#1465) makes placement the first choice instead of the answer to pressure: with `true`, an offloadable role (`test` / `ui` / `perf`) goes to the first witnessed-ready declared host even when the gate verdict is `proceed`. It needs both a `remote-hosts` entry and a readiness witness to act; without them the wave stays local and the gate names the reason.
+
+```yaml
+offload-first: false                   # true = offloadable roles go to a witnessed-ready remote host even on `proceed`
+```
+
+Read by: `scripts/lib/config.mjs`, `scripts/lib/config-schema.mjs`, `scripts/lib/wave-resource-gate.mjs`.
+
 ## Evolve Extra Sources (#638)
 
 Opt-in EXTRA learning sources for `/evolve`. A `domain-regression` measurement (e.g. an eval-learn harness) runs OUT-OF-BAND and writes a sidecar JSON; `/evolve` then READS each declared sidecar and emits a `domain-regression` learning candidate per persistent regression flag. `/evolve` NEVER runs the measurement itself — this is a strict read-only consumption contract. Absent/empty ⇒ `[]` ⇒ no extra sources are read.
@@ -477,9 +485,11 @@ Opt-in mode for `/evolve --dialectic` and session-end Phase 3.6.7 auto-trigger.
 dialectic:
   cadence: 5              # integer ≥ 0; 0 = kill-switch (no critique dispatches)
   model: haiku            # haiku | sonnet | opus — fail-fast on unknown value
-  budget-tokens: 8000     # integer ≥ 0 — input token budget per critique call
+  budget-tokens: 32000    # integer ≥ 0 — input token CEILING per critique call; the pre-dispatch estimate aborts above it
 ```
 
+`32000` — card bodies + steering alone estimated ~12k tokens in this repo, a consumer repo measured 30,262 (2026-09-18); the value is a ceiling, the pre-dispatch estimate aborts above it.
+
 Read by: `scripts/lib/config/dialectic.mjs`, `scripts/lib/auto-dialectic.mjs`, `skills/session-end/SKILL.md` Phase 3.6.7, `skills/evolve/SKILL.md` Phase 6.
 
 ## Eval (#803)
@@ -693,6 +703,8 @@ vcs: gitlab
 gitlab-host: gitlab.example.com        # only if remote URL doesn't expose it
 mirror: github
 cross-repos: []
+cross-repo:
+  projects: [~/Projects/my-app]        # block form (#469) — NOT the flat `cross-repos` above; INLINE list only
 pencil: path/to/design.pen             # design-code alignment input
 ecosystem-health: true
 health-endpoints: []
@@ -745,6 +757,7 @@ auto-commit-per-wave: false            # opt-in: commit after each wave's Qualit
 # Heavy-repo preflight & worktree hygiene (HR-003)
 heavy-repo: false                      # true clamps the dispatched agent count to agents-per-wave
 worktree-cleanup: default              # default | aggressive
+worktree-exclude: [node_modules, dist, build, .next, .nuxt, coverage, .cache, .turbo, .vercel, out]   # default; top-level dirs removed from a createWorktree() worktree; null disables
 
 # Env-aware
 resource-awareness: true
@@ -780,6 +793,15 @@ vault-integration:
   vault-name:                          # optional (#660) — per-project vault namespace override; null/absent → deriveRepo()
   gitlab-groups: []
 
+# GitLab portfolio dashboard — /portfolio (GH #41); needs vault-integration.vault-dir
+gitlab-portfolio:
+  enabled: false                       # opt-in; only the literal true enables it
+  mode: warn                           # warn | strict | off
+  stale-days: 30                       # integer ≥ 1
+  critical-labels:                     # BLOCK list only — an inline [a, b] is silently ignored
+    - priority::critical
+    - priority::high
+
 # Vault mirror quality thresholds
 vault-mirror:
   quality:
@@ -842,7 +864,7 @@ persona-gate-wave:
   after: quality                       # quality | impl-polish
   threshold: all                       # all | any | <m>-of-<n>
   personas: []                         # persona slugs the panel dispatches
-  dispatch-model: claude-opus-4-7
+  dispatch-model: opus                 # alias or full model ID — default 'opus'
   mode: off                            # off | warn | strict — enabled: true with mode: off never fires
 
 # Agentic test orchestrator (/test) — run profiles and artifact retention
@@ -872,6 +894,7 @@ remote-hosts:
     roles-allowed: [test, ui, perf]    # subset of test|ui|perf (default: all three)
     repo-path: ~/Projects/Alice     # optional SAFE path (default: null)
     claude-path: ~/.local/bin/claude   # optional SAFE path (default: null)
+offload-first: false                   # #1465: true = offloadable roles go to a witnessed-ready remote host even on `proceed`
 
 # Evolve extra-sources — opt-in EXTRA /evolve learning sources (#638)
 evolve:
@@ -898,7 +921,7 @@ discovery-validator:
 dialectic:
   cadence: 5              # integer ≥ 0; 0 = kill-switch (no critique dispatches)
   model: haiku            # haiku | sonnet | opus — fail-fast on unknown value
-  budget-tokens: 8000     # integer ≥ 0 — input token budget per critique call
+  budget-tokens: 32000    # integer ≥ 0 — input token ceiling per critique call (aborts above, never truncates)
 
 # Eval — Standard v1 harness config surface (#809 / Epic #803)
 eval:
@@ -995,6 +1018,21 @@ config-protection:
   mode: warn               # warn | strict (strict blocks loosening, exit 2)
 allow-config-weakening: false   # per-session bypass (mirrors allow-destructive-ops)
 
+# Orphan-process watchdog (#1425 / #1432) — DEFAULT OFF; arm only after measuring its firing rate (HR-101)
+reaper:
+  enabled: false                 # only an explicit `true` arms it; it can send signals to processes
+  mode: report                   # report (decide + audit only) | kill (send signals — PRD Stufe 2)
+  min-age-seconds: 300           # DevWatchdog's hard limit for tsgo; the 2026-09-20 orphans were 7–17 min old
+  min-scan-interval-seconds: 30  # throttle; keeps a PostToolBatch storm from taxing every tool call
+  kill-grace-ms: 10000           # DEFAULT_KILL_GRACE_MS from process-group.mjs:52 — repo convention
+  verify-wait-ms: 500            # wait before reading the effect back (a sent signal proves nothing)
+  max-hook-latency-ms: 50        # ceiling a scan may delay a hook by
+  false-alarm-window: 50         # rolling window of audit decisions the HR-101 10 % rate is judged over
+
+# Quality-gate path B ceiling (#1425 A3) — SO_GATE_TIMEOUT_MS still overrides this per run
+gate:
+  timeout-path-b-ms: 900000      # 15 min; same cap as GATE_TIMEOUT_MS on path A
+
 # Agent mapping
 agent-mapping:
   impl: code-implementer

package/docs/telemetry.md

@@ -58,6 +58,7 @@ projection unit test enforces the drop of any non-whitelisted input field.
 | `fleet_self_declared` | Boolean, optional — the client's own claim that this send came from an operator host. **Self-declared, and the name says so on purpose:** the authoritative classification is server-side (see below). Derived from the *resolved consent state* (`enabled-fleet` from an `owner.yaml` opt-in, or `enabled-env` from `SO_TELEMETRY=1`), no longer from a raw `owner.yaml` read. |
 | `session_profile` | Optional — the STATE.md frontmatter `session-profile`, and **whitelisted profile names only** (today exactly `ultradeep`). Anything else — a value your repo invented, a client name, a typo — is **omitted from the ping entirely**: never sent verbatim, and never flattened to `other` either. A SECOND axis beside `session_type`, never a substitute for it: an ultradeep session is `session_type: "deep"` PLUS `session_profile: "ultradeep"`. **Absent when no profile is set or the profile is not on the whitelist** (the key is omitted, never `null`), including on derived pings, which never invent one. The whitelist is enforced twice — client-side before the send, and again server-side, which rejects a record carrying an unlisted profile rather than storing it. |
 | `session_record` | Optional — WHICH source the session facts in this ping came from: `ledger` (a matching `sessions.jsonl` record), `derived` (reconstructed from `events.jsonl`), `absent` (neither). When `absent`, `session_type` is `unknown` and `duration_bucket` is **not a measurement**. |
+| `ledger_complete` | Optional boolean — whether the `events.jsonl` read behind a reconstruction saw every rotation archive (`true`) or measured at least one gap (`false`, e.g. a deleted archive). A SECOND axis beside `session_record`, never a fourth provenance token: it says how whole the SOURCE was, not which source was used. **Absent when nothing was measured** — no read happened, the read threw, or the facts came straight from the ledger (that path never opens `events.jsonl`). The key is omitted, never `null` and never a stand-in `false`. |
 | `session_type` | One of `housekeeping`, `feature`, `deep`, `other`, `unknown`. `other` means MEASURED but not one of the three modes; `unknown` means NOT MEASURED. Before 2026-09-06 both collapsed to `other`. |
 | `duration_bucket` | One of `<15m`, `15-60m`, `1-3h`, `>3h` — a coarse bucket, never an exact duration. |
 | `skills[]` | Names of invoked skills, filtered against the shipped plugin roster — any name not in that roster becomes `"other"`. |
@@ -359,6 +360,7 @@ generation, then drop the old one.
 | `fleet` | deprecated alias, same value | **2027-03-06** |
 | `session_record` | new (`ledger` \| `derived` \| `absent`) | — |
 | `session_profile` | new (STATE.md `session-profile`, whitelisted names only; omitted when unset or unlisted) | — |
+| `ledger_complete` | new 2026-09-21 (boolean; omitted when nothing was measured, incl. every `ledger`-sourced ping) | — |
 
 Client-side the frozen whitelist is split in two: `USAGE_PING_FIELDS` (the
 REQUIRED v1 contract, which `tests/telemetry/parity.test.mjs` asserts the

package/hooks/_lib/hook-import-set.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-09-16T17:00:47.173Z",
-  "head": "1ef26415ce80164bd7e27705a4e7d97c37c72126",
+  "generated_at": "2026-10-01T17:18:47.118Z",
+  "head": "ffc5929f12df0b5fd7c75d9708a3aa1a5dc6fa45",
   "entries": [
     {
       "file": "hooks/_lib/atomic-json.mjs",
@@ -61,6 +61,7 @@
         "pre-bash-sessions-ledger-guard.mjs",
         "pre-bash-staging-fence.mjs",
         "pre-bash-templates-first.mjs",
+        "pre-edit-sessions-ledger-guard.mjs",
         "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs",
         "subagent-telemetry.mjs"
@@ -239,6 +240,12 @@
         "pre-bash-templates-first.mjs"
       ]
     },
+    {
+      "file": "hooks/pre-edit-sessions-ledger-guard.mjs",
+      "reachable_from": [
+        "pre-edit-sessions-ledger-guard.mjs"
+      ]
+    },
     {
       "file": "hooks/pre-task-scope-disjoint.mjs",
       "reachable_from": [
@@ -307,6 +314,7 @@
         "post-tool-batch-wave-signal.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-bash-staging-fence.mjs",
         "pre-bash-templates-first.mjs"
       ]
     },
@@ -522,6 +530,14 @@
         "post-tooluse-frontend-slop.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/config/gate.mjs",
+      "reachable_from": [
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "post-edit-validate.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/config/gitlab-portfolio.mjs",
       "reachable_from": [
@@ -627,6 +643,16 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/config/reaper.mjs",
+      "reachable_from": [
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "on-stop.mjs",
+        "post-edit-validate.mjs",
+        "post-tool-batch-wave-signal.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/config/reconcile.mjs",
       "reachable_from": [
@@ -844,7 +870,8 @@
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
         "pre-bash-memory-propose-audit.mjs",
-        "pre-task-scope-disjoint.mjs"
+        "pre-task-scope-disjoint.mjs",
+        "skill-invocation-telemetry.mjs"
       ]
     },
     {
@@ -866,7 +893,8 @@
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
         "pre-bash-memory-propose-audit.mjs",
-        "pre-task-scope-disjoint.mjs"
+        "pre-task-scope-disjoint.mjs",
+        "skill-invocation-telemetry.mjs"
       ]
     },
     {
@@ -925,6 +953,12 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/fleet-protocol.mjs",
+      "reachable_from": [
+        "on-session-start.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/frontend-detect/detect.mjs",
       "reachable_from": [
@@ -994,6 +1028,7 @@
         "pre-bash-sessions-ledger-guard.mjs",
         "pre-bash-staging-fence.mjs",
         "pre-bash-templates-first.mjs",
+        "pre-edit-sessions-ledger-guard.mjs",
         "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
@@ -1001,11 +1036,32 @@
     {
       "file": "scripts/lib/is-main-module.mjs",
       "reachable_from": [
+        "config-protection.mjs",
+        "cwd-change-restore.mjs",
+        "enforce-commands.mjs",
         "enforce-scope.mjs",
+        "loop-guard.mjs",
         "on-session-end.mjs",
         "on-session-start.mjs",
+        "on-stop.mjs",
+        "operator-steer.mjs",
+        "post-bash-issue-budget-refund.mjs",
+        "post-edit-import-probe.mjs",
+        "post-edit-validate.mjs",
+        "post-subagent-discovery-validator.mjs",
+        "post-tool-batch-wave-signal.mjs",
+        "post-tool-failure-corrective-context.mjs",
+        "post-tooluse-frontend-slop.mjs",
+        "pre-bash-destructive-guard.mjs",
+        "pre-bash-issue-budget.mjs",
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-bash-sessions-ledger-guard.mjs",
+        "pre-bash-staging-fence.mjs",
+        "pre-bash-templates-first.mjs",
+        "pre-edit-sessions-ledger-guard.mjs",
         "pre-task-scope-disjoint.mjs",
-        "skill-invocation-telemetry.mjs"
+        "skill-invocation-telemetry.mjs",
+        "subagent-telemetry.mjs"
       ]
     },
     {
@@ -1102,6 +1158,20 @@
         "post-edit-validate.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/orphan-reaper/defaults.mjs",
+      "reachable_from": [
+        "on-stop.mjs",
+        "post-tool-batch-wave-signal.mjs"
+      ]
+    },
+    {
+      "file": "scripts/lib/orphan-reaper/scan-throttle.mjs",
+      "reachable_from": [
+        "on-stop.mjs",
+        "post-tool-batch-wave-signal.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/owner-yaml.mjs",
       "reachable_from": [
@@ -1272,7 +1342,8 @@
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
         "pre-bash-memory-propose-audit.mjs",
-        "pre-task-scope-disjoint.mjs"
+        "pre-task-scope-disjoint.mjs",
+        "skill-invocation-telemetry.mjs"
       ]
     },
     {
@@ -1511,6 +1582,16 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/tail-window.mjs",
+      "reachable_from": [
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "on-stop.mjs",
+        "post-subagent-discovery-validator.mjs",
+        "subagent-telemetry.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/telemetry/anon-id.mjs",
       "reachable_from": [