session-orchestrator 5.3.0 → 5.4.0

package/scripts/fleet-checkin.mjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * fleet-checkin.mjs — write this session's fleet check-in (#1462, PRD !53 § 3.2).
+ *
+ * Thin CLI over `scripts/lib/fleet-protocol.mjs`, called by session-start
+ * Phase 7.6 and the operations-contract peer preflight BEFORE the first writing
+ * action of a session.
+ *
+ * Usage:
+ *   echo '<check-in JSON>' | node scripts/fleet-checkin.mjs
+ *
+ * Reads one JSON object from stdin, stamps `zeit` (always overwritten), validates
+ * it with `validateCheckin()`, and writes it atomically (tmp file + rename in
+ * the target directory, mode 0600) to `<navigatorDir>/checkin/<session>.json`.
+ * Then reads the navigator lease and emits `orchestrator.fleet.checkin` with the
+ * payload `{ session, repo, modus, kandidaten, navigator_state }` — no paths, no
+ * quota, no `auftrag_ref`.
+ *
+ * stdout: one JSON line `{ ok, path, navigator_state, event }`.
+ *
+ * Exit codes:
+ *   0 — check-in written (an event failure only WARNs; `event: false` on stdout)
+ *   1 — write error
+ *   2 — invalid input (not JSON, not an object, or validation errors; no file)
+ */
+
+import { randomBytes } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { emitEvent } from './lib/events.mjs';
+import {
+  checkinPath,
+  navigatorDir,
+  readNavigatorLease,
+  utcSecondsTimestamp,
+  validateCheckin,
+} from './lib/fleet-protocol.mjs';
+import { isMainModule } from './lib/is-main-module.mjs';
+
+const PREFIX = 'fleet-checkin:';
+
+/** @returns {Promise<string>} */
+async function readStdin() {
+  let data = '';
+  process.stdin.setEncoding('utf8');
+  for await (const chunk of process.stdin) data += chunk;
+  return data;
+}
+
+/**
+ * Create `<navigatorDir>/checkin/` (0700) and write `record` atomically to
+ * `target` (0600). Refuses a `checkin/` that is not a real directory, so a
+ * planted symlink cannot redirect the chmod or the write.
+ * @param {string} target
+ * @param {object} record
+ */
+async function writeCheckinFile(target, record) {
+  const checkinDir = path.dirname(target);
+  await fs.mkdir(navigatorDir(), { recursive: true, mode: 0o700 });
+  await fs.mkdir(checkinDir, { recursive: true, mode: 0o700 });
+  const st = await fs.lstat(checkinDir);
+  if (!st.isDirectory()) throw new Error(`${checkinDir} is not a directory`);
+  // mkdir's mode does not apply to a directory that already existed.
+  await fs.chmod(checkinDir, 0o700);
+
+  const tmp = path.join(checkinDir, `.${path.basename(target)}.${randomBytes(6).toString('hex')}.tmp`);
+  try {
+    // `wx`: never follow or reuse a pre-existing path at the tmp name.
+    await fs.writeFile(tmp, JSON.stringify(record, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+    // The creation mode is filtered through the umask; pin it explicitly.
+    await fs.chmod(tmp, 0o600);
+    await fs.rename(tmp, target);
+  } catch (err) {
+    await fs.rm(tmp, { force: true }).catch(() => {});
+    throw err;
+  }
+}
+
+/** @returns {Promise<number>} exit code */
+async function main() {
+  let input;
+  try {
+    input = JSON.parse(await readStdin());
+  } catch {
+    process.stderr.write(`${PREFIX} stdin is not valid JSON\n`);
+    return 2;
+  }
+  if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+    process.stderr.write(`${PREFIX} stdin must be a JSON object\n`);
+    return 2;
+  }
+
+  const record = { ...input, zeit: utcSecondsTimestamp() };
+  const errors = validateCheckin(record);
+  if (errors.length > 0) {
+    for (const e of errors) process.stderr.write(`${PREFIX} ${e}\n`);
+    return 2;
+  }
+
+  const target = checkinPath(record.session);
+  try {
+    await writeCheckinFile(target, record);
+  } catch (err) {
+    process.stderr.write(`${PREFIX} write failed: ${err instanceof Error ? err.message : String(err)}\n`);
+    return 1;
+  }
+
+  const { state: navigatorState } = await readNavigatorLease();
+
+  let event = true;
+  try {
+    const repoRoot = (process.env.CLAUDE_PROJECT_DIR || '').trim() || process.cwd();
+    await emitEvent(
+      'orchestrator.fleet.checkin',
+      {
+        session: record.session,
+        repo: record.repo,
+        modus: record.modus,
+        kandidaten: record.kandidaten,
+        navigator_state: navigatorState,
+      },
+      { repoRoot },
+    );
+  } catch (err) {
+    event = false;
+    process.stderr.write(
+      `${PREFIX} WARN: check-in written but event emission failed: ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+  }
+
+  // Report the path with `~` for the home prefix: stdout lands in transcripts.
+  const home = os.homedir();
+  const shownPath = target.startsWith(`${home}${path.sep}`) ? `~${target.slice(home.length)}` : target;
+  process.stdout.write(JSON.stringify({ ok: true, path: shownPath, navigator_state: navigatorState, event }) + '\n');
+  return 0;
+}
+
+if (isMainModule(import.meta.url)) {
+  main().then(
+    (code) => { process.exitCode = code; },
+    (err) => {
+      process.stderr.write(`${PREFIX} ${err instanceof Error ? err.message : String(err)}\n`);
+      process.exitCode = 1;
+    },
+  );
+}

package/scripts/lib/agent-frontmatter.mjs

@@ -21,11 +21,11 @@ const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
 
 // Aliases per https://code.claude.com/docs/en/sub-agents § model resolution.
 // Full model IDs (claude-{opus|sonnet|haiku|fable}-N[-N][-YYYYMMDD], e.g.
-// "claude-opus-4-7", "claude-sonnet-5", "claude-fable-5-20260101") also
+// "claude-opus-5-5", "claude-sonnet-5", "claude-fable-5-20260101") also
 // accepted via MODEL_ID_RE. `fable` is a valid upstream model family
 // alongside opus/sonnet/haiku (#768) — the trailing numeric group is
 // optional so both the two-part ("claude-sonnet-5") and three-part
-// ("claude-opus-4-7") ID shapes validate.
+// ("claude-opus-5-5") ID shapes validate.
 // Exported so persona-panel modules (catalog-loader.mjs, persona-gate-wave.mjs) can
 // validate against the SSOT instead of re-declaring (W4 architect MED-1, 2026-05-19).
 export const ALLOWED_MODEL_ALIASES = new Set(['inherit', 'sonnet', 'opus', 'haiku', 'fable']);
@@ -187,7 +187,7 @@ export function validateAgentFrontmatter(frontmatter) {
     errors.push({
       path: 'model',
       rule: 'enum',
-      message: `model must be one of ${[...ALLOWED_MODEL_ALIASES].map((m) => JSON.stringify(m)).join('|')} or a full model ID like "claude-opus-4-7" or "claude-sonnet-5" (got ${JSON.stringify(model)})`,
+      message: `model must be one of ${[...ALLOWED_MODEL_ALIASES].map((m) => JSON.stringify(m)).join('|')} or a full model ID like "claude-opus-5-5" or "claude-sonnet-5" (got ${JSON.stringify(model)})`,
     });
   }
 

package/scripts/lib/auto-dream.mjs

@@ -1,10 +1,11 @@
 /**
- * auto-dream.mjs — Auto-Dream Post-Session Hook helper (issue #502, PRD F2.2).
+ * auto-dream.mjs — Memory-maintenance signals and proposal I/O (issue #502).
  *
- * Provides the decision + I/O surface used by session-end Phase 3.6.5 and by
- * /memory-cleanup --dry-run / --apply-pending. Decides whether the post-session
- * dream should fire, writes the proposed diff to `.orchestrator/pending-dream.md`
- * atomically, and applies it in a follow-up session.
+ * Provides the due signal used by session-start's maintenance-due probe and
+ * the I/O used by /memory-cleanup --dry-run / --apply-pending. The former
+ * session-end Phase 3.6.5 nudge was retired in #1288. The manual skill writes
+ * `.orchestrator/pending-dream.md` atomically and applies a reviewed proposal;
+ * the maintenance probe does not generate proposals or dispatch a cleanup.
  *
  * Decision inputs (PRD F2.2 acceptance criteria):
  *   - memory-cleanup-threshold (default 5) — sessions since last cleanup
@@ -118,7 +119,7 @@ export async function readDreamSignals({ repoRoot, memoryDir }) {
 // ---------------------------------------------------------------------------
 
 /**
- * Decide whether session-end Phase 3.6.5 should dispatch /memory-cleanup --dry-run.
+ * Decide whether session-start should report that memory cleanup is due.
  *
  * Rules (PRD F2.2):
  *   - threshold === 0 → never trigger (kill-switch).

package/scripts/lib/autopilot/flags.mjs

@@ -20,7 +20,12 @@ export const FLAG_BOUNDS = Object.freeze({
   maxSessions: { min: 1, max: 50, default: 5 },
   maxHours: { min: 0.5, max: 24.0, default: 4.0 },
   confidenceThreshold: { min: 0.0, max: 1.0, default: 0.85 },
-  maxTokens: { min: 0, max: 10_000_000, default: 500_000 },
+  // Default 0 = token-budget switch OFF until calibrated (HR-101): the budget
+  // counts subagent OUTPUT tokens only, and one measured deep session's
+  // subagents alone produced 450 499 — a 500 000 default stopped autopilot after
+  // about one deep session. Revisit once sessions.jsonl carries enough
+  // total_token_output values to pick a threshold that fires rarely.
+  maxTokens: { min: 0, max: 10_000_000, default: 0 },
 });
 
 /** Default peer Claude-process count above which `resource-overload` fires when verdict is critical. */

package/scripts/lib/autopilot/loop.mjs

@@ -131,11 +131,14 @@ export async function runLoop(opts = {}) {
     confidence_threshold: confidenceThreshold,
     // Persisted for the same reason as the three above (HR-105): a switch whose
     // input is never recorded cannot be falsified afterwards. `0` = disabled.
-    // CEILING: reaching a NON-zero value here does not make TOKEN_BUDGET_EXCEEDED
-    // live under the headless driver — `readTailSession()` in scripts/autopilot.mjs
-    // returns no `usage`, and sessions.jsonl carries no token field to build one
-    // from, so `total_tokens_used` stays 0. Revisit when a session record gains
-    // token counts.
+    // Live path (#1436): scripts/emit-session.mjs merges the subagents.jsonl
+    // rollup (`total_token_output`, `total_tokens`) into each session record,
+    // scripts/autopilot.mjs selects the unique canonical record whose
+    // raw_session_id equals the child's --session-id UUID and projects its
+    // totals as `usage`; the accumulator sums them into `total_tokens_used`.
+    // Zero or multiple matches throw → FAILED_WAVE, never foreign token usage.
+    // CEILING: an own record without token totals adds 0 — the budget
+    // undercounts, it never over-fires.
     max_tokens: opts.maxTokens ?? 0,
     iterations_completed: 0,
     kill_switch: null,
@@ -271,7 +274,8 @@ export async function runLoop(opts = {}) {
     }
     state.iterations_completed += 1;
 
-    // Accumulate output tokens; stays 0 when sessionRunner omits `usage` (forward-compat).
+    // Accumulate own-record output tokens (total_tokens fallback); missing totals
+    // add 0. An unassignable child record already threw → FAILED_WAVE above.
     if (sessionResult && typeof sessionResult.usage === 'object' && sessionResult.usage !== null) {
       const outTokens = Number(
         sessionResult.usage.output_tokens ?? sessionResult.usage.total_tokens

package/scripts/lib/baseline-archetypes.mjs

@@ -19,10 +19,11 @@ const BASENAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*\.md$/;
 const unique = (items) => [...new Set(items)].sort();
 const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
 
+/** `message` must never interpolate a baseline root or any other host path. */
 export class BaselineContractError extends Error {
-  constructor(reason) { super(`Baseline archetype lookup failed (${reason}).`); this.name = 'BaselineContractError'; this.reason = reason; }
+  constructor(reason, message = `Baseline archetype lookup failed (${reason}).`) { super(message); this.name = 'BaselineContractError'; this.reason = reason; }
 }
-function fail(reason = 'invalid-contract') { throw new BaselineContractError(reason); }
+function fail(reason = 'invalid-contract', message) { throw new BaselineContractError(reason, message); }
 function check(condition) { if (!condition) fail(); }
 function shape(value, required, optional = []) {
   check(object(value) && required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => [...required, ...optional].includes(key)));
@@ -122,24 +123,38 @@ process.stdout.write(JSON.stringify(resolveConfiguredBaselinePath(JSON.parse(rea
   return realpathSync(root);
 }
 
-/** Resolve a canonical relative source and reject symlinks at every component. */
-export function baselineSourcePath(root, source, directory = false) {
+/** Resolve a canonical relative source and reject symlinks at every component.
+ * Only an ENOENT thrown by the per-component `lstatSync` itself maps to
+ * `missingReason`; every other failure is `unsafe-source`. Existence is never
+ * probed with a link-following call (existsSync/statSync/accessSync/realpathSync):
+ * a dangling symlink would then read as "missing" instead of `unsafe-source`.
+ */
+export function baselineSourcePath(root, source, directory = false, { missingReason = 'unsafe-source' } = {}) {
   relative(source);
+  // Resolved first: a vanished root is unsafe, never a missing source.
+  let realRoot;
+  try { realRoot = realpathSync(root); } catch { fail('unsafe-source'); }
   let current = root;
-  try {
-    for (const component of source.split('/')) {
-      current = path.join(current, component);
-      if (lstatSync(current).isSymbolicLink()) fail('unsafe-source');
-    }
-    const stat = lstatSync(current);
-    if (directory ? !stat.isDirectory() : !stat.isFile()) fail('unsafe-source');
-    if (!realpathSync(current).startsWith(`${realpathSync(root)}${path.sep}`)) fail('unsafe-source');
-    return current;
-  } catch { fail('unsafe-source'); }
+  let stat;
+  for (const component of source.split('/')) {
+    current = path.join(current, component);
+    try { stat = lstatSync(current); } catch (error) { fail(error?.code === 'ENOENT' ? missingReason : 'unsafe-source'); }
+    if (stat.isSymbolicLink()) fail('unsafe-source');
+  }
+  if (directory ? !stat.isDirectory() : !stat.isFile()) fail('unsafe-source');
+  let real;
+  try { real = realpathSync(current); } catch { fail('unsafe-source'); }
+  if (!real.startsWith(`${realRoot}${path.sep}`)) fail('unsafe-source');
+  return current;
 }
 
+const PRODUCER = 'scripts/archetype-manifest.mjs';
 function projection(root, args, { timeoutMs = 5000, maxBuffer = MAX_BYTES } = {}) {
-  const script = baselineSourcePath(root, 'scripts/archetype-manifest.mjs');
+  let script;
+  try { script = baselineSourcePath(root, PRODUCER, false, { missingReason: 'producer-missing' }); } catch (error) {
+    if (error?.reason !== 'producer-missing') throw error;
+    fail('producer-missing', `Baseline archetype lookup failed (producer-missing): the configured baseline has no ${PRODUCER} exporter — see docs/baseline.md § How bootstrap finds it.`);
+  }
   const result = spawnSync(process.execPath, [script, ...args], {
     cwd: root, encoding: 'utf8', timeout: Math.min(timeoutMs, 5000), maxBuffer: Math.min(maxBuffer, MAX_BYTES),
     shell: false, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'],
@@ -195,7 +210,8 @@ export async function loadBaselineArchetypes(options = {}) {
     let manifest;
     try { manifest = validateBaselineContract(JSON.parse(projection(root, ['export'], options))); }
     catch (error) { if (error instanceof BaselineContractError) throw error; fail(); }
-    for (const item of manifest.archetypes) baselineSourcePath(root, item.templatePath, true);
+    // An absent declared source is an incomplete baseline, not a security refusal (#1447 3a).
+    for (const item of manifest.archetypes) baselineSourcePath(root, item.templatePath, true, { missingReason: 'invalid-contract' });
     const facts = collectFacts(repoRoot);
     const ordered = [...manifest.archetypes].sort((a, b) => a.order - b.order);
     const archetypes = ordered.map(({ id, order, runtimes, packageManagers, ui, api, deploy }) => ({ id, order, runtimes, packageManagers, ui, api, deploy }));
@@ -220,7 +236,7 @@ export async function loadBaselineArchetypes(options = {}) {
       if (!ruleTargets.includes(name) || seen.has(name)) fail('invalid-rule-projection');
       seen.add(name);
       if (owned.includes(name)) continue;
-      baselineSourcePath(root, source);
+      baselineSourcePath(root, source, false, { missingReason: 'invalid-rule-projection' });
       baselineRules.push({ source, target: `.claude/rules/${name}` });
     }
     if (ruleTargets.some((name) => !seen.has(name))) fail('invalid-rule-projection');
@@ -230,7 +246,9 @@ export async function loadBaselineArchetypes(options = {}) {
       pluginRuleTargets: ruleTargets.filter((name) => owned.includes(name)), baselineRules,
     } };
   } catch (error) {
-    return { status: 'error', reason: error instanceof BaselineContractError ? error.reason : 'lookup-failed', archetypes: [], selected: null };
+    // Only a BaselineContractError message is path-free by construction; others stay opaque.
+    const contract = error instanceof BaselineContractError;
+    return { status: 'error', reason: contract ? error.reason : 'lookup-failed', ...(contract && { message: error.message }), archetypes: [], selected: null };
   }
 }
 
@@ -290,11 +308,12 @@ function applyCopies(plan) {
   return { status: 'applied', created, preserved };
 }
 function applyFailure(error) {
-  return { status: 'error', reason: error instanceof BaselineContractError ? error.reason : 'apply-failed', created: [], preserved: [] };
+  const contract = error instanceof BaselineContractError;
+  return { status: 'error', reason: contract ? error.reason : 'apply-failed', ...(contract && { message: error.message }), created: [], preserved: [] };
 }
 async function selectedContext(options) {
   const result = await loadBaselineArchetypes(options);
-  if (result.status !== 'private' || !result.selected) fail(result.reason);
+  if (result.status !== 'private' || !result.selected) fail(result.reason, result.message);
   const root = await resolveBaselineLocation(options);
   if (!root) fail('baseline-unavailable');
   return { root, selected: result.selected };
@@ -340,7 +359,7 @@ export async function scaffoldBaselineArchetype(options = {}) {
     const { repoRoot = process.cwd(), projectName } = options;
     if (typeof projectName !== 'string' || !ID.test(projectName)) fail('invalid-project-name');
     const { root, selected } = await selectedContext(options);
-    const template = baselineSourcePath(root, selected.templatePath, true);
+    const template = baselineSourcePath(root, selected.templatePath, true, { missingReason: 'invalid-contract' });
     sourceFiles(template);
     const shared = baselineSourcePath(root, 'templates/shared', true);
     sourceFiles(shared);
@@ -401,7 +420,7 @@ export async function syncBootstrapRules(options = {}) {
     // ordinary plugin rules, just as its minimal scaffold does.
     const contract = options.minimal ? { status: 'public', selected: null }
       : await loadBaselineArchetypes({ ...options, repoRoot, pluginRoot, archetype });
-    if (contract.status === 'error') fail(contract.reason);
+    if (contract.status === 'error') fail(contract.reason, contract.message);
     if (contract.status === 'private' && !contract.selected && !hasUnselectedFastLock(repoRoot)) fail(contract.reason);
     const before = new Set();
     for (const name of pluginRuleTargets(pluginRoot)) {

package/scripts/lib/config/host-paths.mjs

@@ -13,6 +13,17 @@
  *   3. committed Session Config default (the value the committed CLAUDE.md —
  *      AGENTS.md on Codex CLI — produced)
  *
+ * `vault-dir` has one more tier (agents/vault#319): an owner.yaml `vault-dirs:`
+ * cwd match between env and paths.vault-dir. That tier lives in
+ * `resolveVaultDir` in scripts/lib/config.mjs, NOT here: this module is one of
+ * the three direct CP11 helpers check-owner-leakage.mjs imports, and a standalone
+ * vendored copy carries only those three files. A new import edge from here
+ * (e.g. to named-baseline-resolver.mjs) makes CP11 fail closed in that copy.
+ *
+ * `resolveVaultIntegrationHost` is the host-local switch for the
+ * `vault-integration` gate itself (SO#1448). It may only LOWER the committed
+ * level (strict → warn → off), never raise it.
+ *
  * SYNCHRONOUS by design: `parseSessionConfig` in scripts/lib/config.mjs is sync,
  * so this layer reuses the SYNC owner loader (`loadOwnerConfig`) and exposes only
  * sync functions. An empty/whitespace value at any tier is treated as "unset" and
@@ -90,3 +101,71 @@ export function resolveHostPath(key, committedDefault, { env = process.env, owne
 
   return committedDefault;
 }
+
+/** vault-integration levels, weakest first. The index order IS the ordering. */
+const VAULT_INTEGRATION_LEVELS = /** @type {readonly string[]} */ (['off', 'warn', 'strict']);
+
+/**
+ * @param {unknown} v
+ * @returns {'off'|'warn'|'strict'|undefined} a valid level, or undefined for unset/invalid
+ */
+function coerceVaultIntegrationLevel(v) {
+  if (typeof v !== 'string') return undefined;
+  const lower = v.trim().toLowerCase();
+  return VAULT_INTEGRATION_LEVELS.includes(lower)
+    ? /** @type {'off'|'warn'|'strict'} */ (lower)
+    : undefined;
+}
+
+/**
+ * Overlay the host-local `vault-integration` switch onto the committed block
+ * (SO#1448). Precedence: env `SO_VAULT_INTEGRATION=off|warn|strict` > owner.yaml
+ * `vault-integration: { enabled: false | mode: off|warn|strict }` > committed.
+ * An invalid value at a tier counts as unset and falls through, mirroring
+ * resolveDispatcherAutonomy in dispatcher-autonomy.mjs.
+ *
+ * LOWER-ONLY: the host's level is applied only when it is weaker than the
+ * committed one. A host that could raise it would mirror repos into the vault
+ * that never opted in, so `enabled: true` or a stronger mode is ignored.
+ * Applying `off` sets both `enabled: false` and `mode: 'off'`, so either
+ * consumer check (`enabled`, `mode != off`) sees the integration as off.
+ *
+ * @param {{ enabled?: boolean, mode?: string } & Record<string, unknown>} vi — parsed committed block
+ * @param {{ env?: Record<string, string|undefined>, ownerConfig?: object }} [ctx] — from loadHostPaths()
+ * @returns {Record<string, unknown> & { enabled?: boolean, mode?: string, 'host-override': 'env:SO_VAULT_INTEGRATION'|'owner.yaml'|null }}
+ *   a copy of `vi`; `host-override` names the tier that lowered it, `null` when none did
+ */
+export function resolveVaultIntegrationHost(vi, { env = process.env, ownerConfig } = {}) {
+  /** @type {Record<string, unknown> & { enabled?: boolean, mode?: string, 'host-override': 'env:SO_VAULT_INTEGRATION'|'owner.yaml'|null }} */
+  const result = { ...vi, 'host-override': null };
+
+  /** @type {'off'|'warn'|'strict'|undefined} */
+  let requested = coerceVaultIntegrationLevel(env?.SO_VAULT_INTEGRATION);
+  /** @type {'env:SO_VAULT_INTEGRATION'|'owner.yaml'} */
+  let source = 'env:SO_VAULT_INTEGRATION';
+  if (requested === undefined) {
+    const owner = ownerConfig?.['vault-integration'];
+    if (owner !== null && typeof owner === 'object' && !Array.isArray(owner)) {
+      requested = owner.enabled === false ? 'off' : coerceVaultIntegrationLevel(owner.mode);
+      source = 'owner.yaml';
+    }
+  }
+  if (requested === undefined) return result;
+
+  const committedLevel =
+    vi?.enabled === true ? (coerceVaultIntegrationLevel(vi.mode) ?? 'warn') : 'off';
+  if (
+    VAULT_INTEGRATION_LEVELS.indexOf(requested) >= VAULT_INTEGRATION_LEVELS.indexOf(committedLevel)
+  ) {
+    return result;
+  }
+
+  if (requested === 'off') {
+    result.enabled = false;
+    result.mode = 'off';
+  } else {
+    result.mode = requested;
+  }
+  result['host-override'] = source;
+  return result;
+}

package/scripts/lib/config/persona-gate-wave.mjs

@@ -10,7 +10,7 @@
  *   after           — 'quality' | 'impl-polish'  (default: 'quality')
  *   threshold       — string spec parsed via parseThreshold (default: 'all')
  *   personas        — string[] (each matches SAFE_PERSONA_NAME_RE)  (default: [])
- *   dispatch-model  — model alias or full ID  (default: 'claude-opus-4-7')
+ *   dispatch-model  — model alias or full ID  (default: 'opus' — tracks the current Opus)
  *   mode            — 'off' | 'warn' | 'strict'  (default: 'off')
  *
  * Used by skills/wave-executor/wave-loop.md § 3b: Persona-Gate Hook to decide
@@ -32,7 +32,7 @@ const DEFAULTS = Object.freeze({
   threshold: 'all',
   threshold_parsed: null,  // cached ParsedThreshold result; populated by _normalizePersonaGateWave
   personas: [],
-  'dispatch-model': 'claude-opus-4-7',
+  'dispatch-model': 'opus',
   mode: 'off',
 });
 
@@ -138,7 +138,7 @@ export function _normalizePersonaGateWave(parsed) {
     }
     if (!ALLOWED_MODEL_ALIASES.has(m) && !MODEL_ID_RE.test(m)) {
       throw new Error(
-        `persona-gate-wave.dispatch-model must be one of ${[...ALLOWED_MODEL_ALIASES].map((a) => JSON.stringify(a)).join('|')} or a full model ID like "claude-opus-4-7" (got ${JSON.stringify(m)})`,
+        `persona-gate-wave.dispatch-model must be one of ${[...ALLOWED_MODEL_ALIASES].map((a) => JSON.stringify(a)).join('|')} or a full model ID like "claude-opus-5-5" (got ${JSON.stringify(m)})`,
       );
     }
     out['dispatch-model'] = m;

package/scripts/lib/config/reaper.mjs

@@ -27,18 +27,19 @@ import { preprocessBlockLines } from './block-preprocess.mjs';
  * Startwerte für Stufe 1 — NOT calibrated. Every number carries its provenance
  * from the PRD §4 parameter table ("keine Zahl ohne ihre Population").
  *
- * RUNTIME SSOT is `REAPER_DEFAULTS` in `scripts/lib/orphan-reaper.mjs`; these
- * literals mirror it deliberately rather than importing it, because that module
- * pulls `process-group.mjs` + `resource-probe/parsers.mjs` into the config
- * import graph, which every `parseSessionConfig()` caller would then pay for.
- * The parity is held by a test, not by an import
+ * RUNTIME SSOT is `REAPER_DEFAULTS` in `scripts/lib/orphan-reaper/defaults.mjs`; these
+ * literals mirror it rather than importing it. The original reason — the
+ * single-file `orphan-reaper.mjs` pulled `process-group.mjs` +
+ * `resource-probe/parsers.mjs` into the config import graph — no longer holds
+ * since the #1437 split (`defaults.mjs` imports only `node:path`); revisit the
+ * mirror there. The parity is held by a test, not by an import
  * (`tests/lib/config/reaper.test.mjs` § defaults mirror REAPER_DEFAULTS).
  */
 /** 300 s — DevWatchdog's hard limit for `tsgo`; the 2026-09-20 orphans were 7–17 min old. */
 const DEFAULT_MIN_AGE_SECONDS = 300;
 /** 30 s — DevWatchdog's normal scan cadence; keeps a PostToolBatch storm from taxing every tool call. */
 const DEFAULT_MIN_SCAN_INTERVAL_SECONDS = 30;
-/** 10 000 ms — `DEFAULT_KILL_GRACE_MS` from `dispatch-common.mjs:61`; repo convention, not newly invented. */
+/** 10 000 ms — `DEFAULT_KILL_GRACE_MS` from `process-group.mjs`; repo convention, not newly invented. */
 const DEFAULT_KILL_GRACE_MS = 10_000;
 /** 500 ms — wait before reading the effect back; without it the 2026-09-20 check falsely reported "still alive". */
 const DEFAULT_VERIFY_WAIT_MS = 500;

package/scripts/lib/config-schema.mjs

@@ -120,6 +120,19 @@ export function validateSessionConfig(config) {
     }
   }
 
+  // #1465 cross-field: offload-first with no declared host can never place a
+  // wave anywhere — advisory (warn-level), it never flips `ok`.
+  if (config['offload-first'] === true) {
+    const hosts = config['remote-hosts'];
+    if (!Array.isArray(hosts) || hosts.length === 0) {
+      warnings.push({
+        path: 'remote-hosts',
+        rule: 'offload-first-cross-field',
+        message: 'offload-first: true but no remote-hosts declared — every wave stays local',
+      });
+    }
+  }
+
   if (errors.length > 0) {
     return { ok: false, errors, warnings };
   }