session-orchestrator 5.3.0 → 5.5.0

package/scripts/lib/lock-reaper.mjs

@@ -66,7 +66,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 import { enumerateCandidates } from './dispatcher/enumerate.mjs';
-import { readLock, isLockLive, isPidAliveOnHost, LOCK_PATH, DEFAULT_TTL_HOURS } from './session-lock.mjs';
+import { readLock, isLockLive, isPidAliveOnHost, LOCK_PATH, DEFAULT_TTL_HOURS, FUTURE_HEARTBEAT_TOLERANCE_MS } from './session-lock.mjs';
 import { emitEvent } from './events.mjs';
 import { hostnamesMatch, lockHostCandidate } from './host-identity.mjs';
 
@@ -109,21 +109,42 @@ function lockPathFor(repoRoot) {
 }
 
 /**
- * Fractional hours since a lock's last heartbeat (the liveness basis). Falls
- * back to started_at when last_heartbeat is absent (v1 lock). Returns null when
- * neither parses.
+ * Fractional hours since a lock's last heartbeat — the figure the reaper
+ * REPORTS (candidate list `ageHours`, `orchestrator.session.lock.reaped`
+ * `age_hours`). Display only: the reap decision is `isLockLive()`.
+ *
+ * Reads `last_heartbeat` only, like `isLockLive()` since the #595 sunset
+ * (2026-10-02). A lock without one has no heartbeat age, so this returns
+ * `null` (the CLI renders "unknown age") instead of passing off the age since
+ * `started_at` as heartbeat staleness.
  *
  * @param {object} lock
  * @param {number} nowMs
- * @returns {number|null}
+ * @returns {number|null} null when `last_heartbeat` is absent or unparseable.
  */
 function ageHoursOf(lock, nowMs) {
-  const hb = (typeof lock.last_heartbeat === 'string' && lock.last_heartbeat.length > 0)
-    ? lock.last_heartbeat
-    : lock.started_at;
-  const ms = Date.parse(hb);
+  if (typeof lock.last_heartbeat !== 'string' || lock.last_heartbeat.length === 0) return null;
+  const ms = Date.parse(lock.last_heartbeat);
   if (Number.isNaN(ms)) return null;
-  return Number(((nowMs - ms) / (3600 * 1000)).toFixed(2));
+  const hours = futureSafeAgeHours(ms, nowMs);
+  return hours === null ? null : Number(hours.toFixed(2));
+}
+
+/**
+ * Hours from `ms` to `nowMs`, or `null` when `ms` lies further in the future
+ * than {@link FUTURE_HEARTBEAT_TOLERANCE_MS} (#1505.2). Such a stamp measures
+ * no age, and a negative one is worse than none: it reads as "younger than
+ * every TTL" and was emitted as a negative `age_hours`. `null` — not 0 — so an
+ * unmeasurable age never looks like a fresh one. Within the tolerance (clock
+ * skew) the age clamps to 0.
+ *
+ * @param {number} ms
+ * @param {number} nowMs
+ * @returns {number|null}
+ */
+function futureSafeAgeHours(ms, nowMs) {
+  if (ms > nowMs + FUTURE_HEARTBEAT_TOLERANCE_MS) return null;
+  return Math.max(0, nowMs - ms) / (3600 * 1000);
 }
 
 /**
@@ -223,12 +244,15 @@ function currentSessionPathFor(repoRoot) {
 function currentSessionAgeHours(parsed, filePath, nowMs, fsDep) {
   const ts = typeof parsed?.timestamp === 'string' ? parsed.timestamp : null;
   const ms = ts ? Date.parse(ts) : NaN;
-  if (!Number.isNaN(ms)) {
-    return (nowMs - ms) / (3600 * 1000);
-  }
+  // #1505.2: a `timestamp` beyond the future tolerance measures nothing — it
+  // fell through as a negative age, always under the TTL, and kept the file
+  // 'fresh' forever. It is treated like an absent one: the mtime decides.
+  const fromTimestamp = Number.isNaN(ms) ? null : futureSafeAgeHours(ms, nowMs);
+  if (fromTimestamp !== null) return fromTimestamp;
   try {
     const info = fsDep.statSync(filePath);
-    return (nowMs - info.mtimeMs) / (3600 * 1000);
+    // A future mtime too → null → 'fresh': kept until the clock passes it.
+    return futureSafeAgeHours(info.mtimeMs, nowMs);
   } catch {
     return null;
   }

package/scripts/lib/maintenance-due-banner.mjs

@@ -132,6 +132,14 @@ const MS_PER_DAY = 86_400_000;
 /** The event name whose ABSENCE is the `evolve` signal. */
 const EVOLVE_EVENT = 'orchestrator.evolve.completed';
 
+/**
+ * Events-ledger window for the #1401 census (`events-retention-banner.mjs`):
+ * `null` — the one ledger question here ("was {@link EVOLVE_EVENT} EVER
+ * recorded?") is about every line ever written, so no day count bounds it; a
+ * pruned history turns the answer `undeterminable`, never "never" (#1489).
+ */
+export const REQUIRED_EVENTS_WINDOW_DAYS = null;
+
 /** Pending-proposal sidecars, repo-relative (owned by auto-dream / auto-dialectic). */
 const PENDING_SIDECARS = ['.orchestrator/pending-dream.md', '.orchestrator/dialectic-pending.md'];
 
@@ -187,11 +195,13 @@ export const EVOLVE_SCAN_BUDGET_MS = 1000;
  * /evolve, which is the HR-101 failure mode this module exists to avoid.
  *
  * @param {string} repoRoot
- * @returns {{ok: boolean, lastAt: string|null, truncated: boolean}} `ok: false`
- *   ⇒ a source exists but could not be read; `truncated: true` ⇒ the budget ran
- *   out before the walk finished. In BOTH cases the caller must record
- *   `undeterminable`, never clean — a walk that did not finish has not proven
- *   "never".
+ * @returns {{ok: boolean, lastAt: string|null, truncated: boolean, historyCut: boolean}}
+ *   `ok: false` ⇒ a source exists but could not be read; `truncated: true` ⇒
+ *   the budget ran out before the walk finished. In BOTH cases the caller must
+ *   record `undeterminable`, never clean — a walk that did not finish has not
+ *   proven "never". `historyCut: true` ⇒ the walk finished but the history it
+ *   read begins after an archive that is gone (#1489: pruned by
+ *   `events-rotation.max-backups`), so a miss has not proven "never" either.
  */
 function readLastEvolveRun(repoRoot) {
   const file = path.join(repoRoot, '.orchestrator', 'metrics', 'events.jsonl');
@@ -209,8 +219,10 @@ function readLastEvolveRun(repoRoot) {
       return true;
     },
   });
-  if (scan.unreadable.length > 0) return { ok: false, lastAt: null, truncated: false };
-  return { ok: true, lastAt, truncated: scan.truncated };
+  if (scan.unreadable.length > 0) {
+    return { ok: false, lastAt: null, truncated: false, historyCut: false };
+  }
+  return { ok: true, lastAt, truncated: scan.truncated, historyCut: scan.gaps.length > 0 };
 }
 
 /**
@@ -301,7 +313,10 @@ export async function computeMaintenanceDue(opts = {}) {
     if (!evolve.ok || evolve.truncated) {
       undeterminable.push('evolve');
     } else if (evolve.lastAt === null && nudge.activeLearnings >= MAINTENANCE_MIN_LEARNINGS) {
-      markDue('evolve', `never, ${nudge.activeLearnings} active learnings`);
+      // #1489: judged only where it would flip the verdict, so a cut history
+      // adds no row to a repo the floor already keeps silent (HR-101).
+      if (evolve.historyCut) undeterminable.push('evolve');
+      else markDue('evolve', `never, ${nudge.activeLearnings} active learnings`);
     }
 
     // --- reconcile (S3) ----------------------------------------------------

package/scripts/lib/memory-proposals/schema.mjs

@@ -7,7 +7,8 @@
  * during a wave, reviewed by the memory-cleanup flow, and either accepted
  * (appended to learnings.jsonl) or discarded.
  *
- * Pure leaf module — imports only node:crypto. No I/O, no quota enforcement
+ * Pure module — imports only node:crypto and the pure learnings/schema.mjs
+ * (type registry, repo-relative path predicate). No I/O, no quota enforcement
  * (see store.mjs for those responsibilities).
  *
  * Canonical schema (schema_version: 1) — ALL required fields:
@@ -30,7 +31,8 @@
  */
 
 import { randomUUID } from 'node:crypto';
-import { LEARNING_TYPE_REGISTRY } from '../learnings/schema.mjs';
+
+import { isRepoRelativePathEntry, LEARNING_TYPE_REGISTRY } from '../learnings/schema.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -251,24 +253,28 @@ export function validateProposalRecord(record) {
   }
 
   // file_paths (optional, but if present must be a non-empty array of
-  // non-empty, newline-free, glob-metacharacter-free strings) — issue #900 C,
+  // repo-relative, newline-free, glob-metacharacter-free strings) — issue #900 C,
   // Q3-MED fix pass: a glob metacharacter (* ? [ ] { }) surviving this schema
   // gate would later reach emitter.mjs::globsFromFilePaths verbatim for a
   // top-level (dirname==='.') entry, effectively producing an always-on rule
   // glob (e.g. `file_paths: ['**']`). `createProposalRecord` never sets an
   // empty array (it omits the key), so a present-but-empty `[]` is itself a
   // signal of a malformed/tampered record — reject it explicitly.
+  // Repo-relative is the SAME predicate validateLearning applies at write time
+  // (isRepoRelativePathEntry): a record read back from proposals.jsonl is not
+  // re-validated before writeApproved → appendLearning, so an absolute, home-
+  // relative or URL entry must be refused here, not silently at promotion.
   if ('file_paths' in record) {
     const fp = record.file_paths;
     const isValidArray =
       Array.isArray(fp) &&
       fp.length > 0 &&
       fp.every(
-        (p) => typeof p === 'string' && p.length > 0 && !/[\r\n]/.test(p) && !/[*?[\]{}]/.test(p),
+        (p) => isRepoRelativePathEntry(p) && !/[\r\n]/.test(p) && !/[*?[\]{}]/.test(p),
       );
     if (!isValidArray) {
       errors.push(
-        'file_paths must be a non-empty array of non-empty, newline-free, glob-metacharacter-free strings when present',
+        'file_paths must be a non-empty array of repo-relative, newline-free, glob-metacharacter-free strings when present',
       );
     }
   }

package/scripts/lib/named-baseline-resolver.mjs

@@ -29,11 +29,21 @@
  *   also YIELDS to tier 1: when SO_BASELINE_PATH is set (non-blank), resolveNamedBaseline
  *   returns the null-fallback ({source:null}) so the caller's env tier wins.
  *
+ * ── Other sections (agents/vault#319) ────────────────────────────────────────
+ *
+ *   The same directory-prefix match serves any owner.yaml list of the shape
+ *   `{ path, match: { path-prefix } }`. `section` picks the list and `envKey` the
+ *   env var this tier yields to. The live second consumer is `vault-dirs:`
+ *   (section 'vault-dirs', envKey 'SO_VAULT_DIR'), driven by
+ *   `resolveVaultDir` in scripts/lib/config/host-paths.mjs. `name` is required
+ *   only for `baselines:` (the #819 contract); elsewhere it is optional and
+ *   defaults to `path`, which is what the ambiguity WARN then names.
+ *
  * ── Exports ──────────────────────────────────────────────────────────────────
  *
- *   parseBaselines(ownerConfig)
- *   matchBaselineForPath(absPath, baselines)
- *   resolveNamedBaseline({ cwd, ownerConfig, env })
+ *   parseBaselines(ownerConfig, section?)
+ *   matchBaselineForPath(absPath, baselines, section?)
+ *   resolveNamedBaseline({ cwd, ownerConfig, env, section?, envKey? })
  */
 
 import { normalize, sep } from 'node:path';
@@ -43,6 +53,9 @@ import { expandTilde } from './common.mjs';
 // Internal helpers
 // ---------------------------------------------------------------------------
 
+/** Sections whose entries MUST carry a `name` (the #819 baselines contract). */
+const NAME_REQUIRED_SECTIONS = new Set(['baselines']);
+
 /** @param {unknown} v */
 function isPlainObject(v) {
   return v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -70,18 +83,23 @@ function _normalizePath(p) {
 // ---------------------------------------------------------------------------
 
 /**
- * Extract and validate the `baselines:` list from a raw ownerConfig object.
+ * Extract and validate a directory-prefix list (default `baselines:`) from a raw
+ * ownerConfig object.
  *
  * Drop-and-WARN on malformed entries; never throw. Returns [] when the section
- * is absent, null, or empty — the backward-compat no-op path.
+ * is absent, null, or empty — the backward-compat no-op path. Every WARN names
+ * the section it came from.
  *
- * Each valid entry: { name: string, path: string, match: { 'path-prefix': string } }
+ * Each valid entry: { name: string, path: string, match: { 'path-prefix': string } }.
+ * `name` is required for `baselines`; for other sections an absent name falls
+ * back to `path` (a present-but-blank or non-string name is still dropped).
  *
  * @param {object|undefined} ownerConfig — raw parsed owner.yaml (NOT merged with defaults)
+ * @param {string} [section='baselines'] — owner.yaml list to read (e.g. 'vault-dirs')
  * @returns {Array<{name:string, path:string, match:{'path-prefix':string}}>}
  */
-export function parseBaselines(ownerConfig) {
-  const raw = ownerConfig?.baselines;
+export function parseBaselines(ownerConfig, section = 'baselines') {
+  const raw = ownerConfig?.[section];
 
   // Absent or explicit null/empty → no-op
   if (raw === undefined || raw === null) return [];
@@ -89,54 +107,56 @@ export function parseBaselines(ownerConfig) {
 
   if (!Array.isArray(raw)) {
     process.stderr.write(
-      'WARN named-baseline-resolver: owner.yaml baselines: must be an array; ignoring\n',
+      `WARN named-baseline-resolver: owner.yaml ${section}: must be an array; ignoring\n`,
     );
     return [];
   }
 
+  const nameRequired = NAME_REQUIRED_SECTIONS.has(section);
   const result = [];
   for (let i = 0; i < raw.length; i++) {
     const entry = raw[i];
     if (!isPlainObject(entry)) {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}] is not an object; dropping\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}] is not an object; dropping\n`,
       );
       continue;
     }
 
     const { name, path: entryPath, match } = entry;
 
-    if (typeof name !== 'string' || name.trim() === '') {
+    const nameAbsent = name === undefined || name === null;
+    if ((nameRequired || !nameAbsent) && (typeof name !== 'string' || name.trim() === '')) {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].name must be a non-empty string; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].name must be a non-empty string; dropping entry\n`,
       );
       continue;
     }
     if (typeof entryPath !== 'string' || entryPath.trim() === '') {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].path must be a non-empty string; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].path must be a non-empty string; dropping entry\n`,
       );
       continue;
     }
 
-    // match is REQUIRED (unlike vaults) — a baseline with no path-prefix can
+    // match is REQUIRED (unlike vaults) — an entry with no path-prefix can
     // never be selected, so it is dropped rather than kept.
     if (!isPlainObject(match)) {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].match must be an object; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].match must be an object; dropping entry\n`,
       );
       continue;
     }
     const pathPrefix = match['path-prefix'];
     if (typeof pathPrefix !== 'string' || pathPrefix.trim() === '') {
       process.stderr.write(
-        `WARN named-baseline-resolver: owner.yaml baselines[${i}].match.path-prefix must be a non-empty string; dropping entry\n`,
+        `WARN named-baseline-resolver: owner.yaml ${section}[${i}].match.path-prefix must be a non-empty string; dropping entry\n`,
       );
       continue;
     }
 
     result.push({
-      name: name.trim(),
+      name: nameAbsent ? entryPath.trim() : name.trim(),
       path: entryPath.trim(),
       match: { 'path-prefix': pathPrefix.trim() },
     });
@@ -162,9 +182,10 @@ export function parseBaselines(ownerConfig) {
  *
  * @param {string} absPath — the working directory to classify
  * @param {Array<{name:string, path:string, match:{'path-prefix':string}}>} baselines
+ * @param {string} [section='baselines'] — owner.yaml list name, used only in the WARN
  * @returns {{name:string, path:string, match:{'path-prefix':string}}|null}
  */
-export function matchBaselineForPath(absPath, baselines) {
+export function matchBaselineForPath(absPath, baselines, section = 'baselines') {
   if (!absPath || !Array.isArray(baselines) || baselines.length === 0) return null;
 
   const target = _normalizePath(absPath);
@@ -181,7 +202,7 @@ export function matchBaselineForPath(absPath, baselines) {
 
   if (matched.length > 1) {
     process.stderr.write(
-      `WARN named-baseline-resolver: multiple baselines match path "${absPath}": ${matched
+      `WARN named-baseline-resolver: multiple ${section} match path "${absPath}": ${matched
         .map((b) => b.name)
         .join(', ')}; using first match "${matched[0].name}"\n`,
     );
@@ -195,13 +216,13 @@ export function matchBaselineForPath(absPath, baselines) {
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve the `baselines:` match tier for a given cwd.
+ * Resolve the directory-prefix match tier (default `baselines:`) for a given cwd.
  *
  * Returns:
- *   { path, name, source:'match' } when a baseline directory-prefix matches cwd.
+ *   { path, name, source:'match' } when an entry's directory-prefix matches cwd.
  *   { path:null, name:null, source:null } (the null-fallback) otherwise — including
- *   when SO_BASELINE_PATH env is set (this tier yields to the higher env tier the
- *   caller owns), when no `baselines:` are configured, or when nothing matches.
+ *   when `env[envKey]` is set (this tier yields to the higher env tier the caller
+ *   owns), when the section is not configured, or when nothing matches.
  *
  * Pure + synchronous — no git calls, no disk reads. Never throws.
  *
@@ -209,22 +230,26 @@ export function matchBaselineForPath(absPath, baselines) {
  *   cwd?: string,
  *   ownerConfig?: object,
  *   env?: Record<string, string|undefined>,
- * }} [opts]
+ *   section?: string,
+ *   envKey?: string,
+ * }} [opts] — `section` defaults to 'baselines', `envKey` to 'SO_BASELINE_PATH'
  * @returns {{ path: string|null, name: string|null, source: 'match'|null }}
  */
 export function resolveNamedBaseline({
   cwd = process.cwd(),
   ownerConfig,
   env = process.env,
+  section = 'baselines',
+  envKey = 'SO_BASELINE_PATH',
 } = {}) {
-  // Yield to the higher-precedence env tier the caller owns (SO_BASELINE_PATH).
-  const envVal = env?.SO_BASELINE_PATH;
+  // Yield to the higher-precedence env tier the caller owns.
+  const envVal = env?.[envKey];
   if (typeof envVal === 'string' && envVal.trim() !== '') {
     return { path: null, name: null, source: null };
   }
 
-  const baselines = parseBaselines(ownerConfig);
-  const matched = baselines.length > 0 ? matchBaselineForPath(cwd, baselines) : null;
+  const entries = parseBaselines(ownerConfig, section);
+  const matched = entries.length > 0 ? matchBaselineForPath(cwd, entries, section) : null;
   if (matched !== null) {
     return { path: matched.path, name: matched.name, source: 'match' };
   }

package/scripts/lib/named-vault-resolver.mjs

@@ -47,11 +47,14 @@
  *   resolveCanonicalSuffixes({ ownerConfig, env })
  *   findRepoRoot(cwd, { existsSync, realpathSync })
  *   resolveNamedVault({ vaultName, cwd, ownerConfig, env, gitRemote, existsSync, realpathSync })
+ *   normalizeRemote(url)
+ *   checkCanonicalVault({ vaultDir, ownerConfig, env, readOriginUrl })
  */
 
 import { join, dirname } from 'node:path';
 import { existsSync as nodeExistsSync, realpathSync as nodeRealpathSync } from 'node:fs';
-import { resolvePreferredRemote, isQueryFailure } from './vcs-repo-spec.mjs';
+import { spawnSync } from 'node:child_process';
+import { resolvePreferredRemote, isQueryFailure, redactUrlCredentials } from './vcs-repo-spec.mjs';
 
 // ---------------------------------------------------------------------------
 // Internal helpers
@@ -255,6 +258,73 @@ export function resolveCanonicalSuffixes({ ownerConfig, env = process.env } = {}
   return canonicalSuffixesFromVaults(vaults, env?.VAULT_MIRROR_CANONICAL_SUFFIX);
 }
 
+// ---------------------------------------------------------------------------
+// checkCanonicalVault — the canonical-vault write guard (#1450)
+// ---------------------------------------------------------------------------
+
+/**
+ * Default origin reader: `git -C <vaultDir> remote get-url origin`. Returns
+ * `''` on a spawn error or a non-zero exit, so every failure reads as "no
+ * origin" and the guard stays fail-closed.
+ * @param {string} vaultDir
+ * @returns {string}
+ */
+function _defaultReadOriginUrl(vaultDir) {
+  const res = spawnSync('git', ['-C', vaultDir, 'remote', 'get-url', 'origin'], { encoding: 'utf8' });
+  if (res.error || res.status !== 0) return '';
+  return String(res.stdout ?? '').trim();
+}
+
+/**
+ * Decide whether `vaultDir` is a canonical Meta-Vault, i.e. whether its git
+ * `origin` ends in one of {@link resolveCanonicalSuffixes}. Shared by every
+ * writer into the vault so none of them can write into a foreign vault that
+ * `vault-dir` happened to resolve to.
+ *
+ * Fail-closed: a missing origin, a failing or throwing reader, and a suffix
+ * resolution that throws all return `ok: false`. The only bypass is the
+ * existing `VAULT_MIRROR_SKIP_CANONICAL_CHECK === '1'` switch, read from the
+ * `env` passed in (never from the ambient process.env when `env` is given).
+ * It is evaluated before any suffix resolution, so a skipped check neither
+ * parses `ownerConfig.vaults` nor prints its WARN lines, and returns
+ * `expected: []`.
+ *
+ * @param {{
+ *   vaultDir: string,
+ *   ownerConfig?: object,
+ *   env?: Record<string, string|undefined>,
+ *   readOriginUrl?: (vaultDir: string) => string,
+ * }} opts
+ * @returns {{ ok: boolean, reason?: 'skipped-by-env'|'no-git-origin'|'not-canonical', got?: string, expected: string[] }}
+ */
+export function checkCanonicalVault({ vaultDir, ownerConfig, env = process.env, readOriginUrl = _defaultReadOriginUrl } = {}) {
+  if (env?.VAULT_MIRROR_SKIP_CANONICAL_CHECK === '1') {
+    // Empty on purpose: suffix resolution is exactly what the switch skips, and
+    // callers read `expected` only on `ok: false`.
+    return { ok: true, reason: 'skipped-by-env', expected: [] };
+  }
+  let expected;
+  try {
+    expected = resolveCanonicalSuffixes({ ownerConfig, env });
+  } catch {
+    return { ok: false, reason: 'not-canonical', expected: [] };
+  }
+
+  let url;
+  try {
+    url = String(readOriginUrl(vaultDir) ?? '').trim();
+  } catch {
+    url = '';
+  }
+  if (!url) return { ok: false, reason: 'no-git-origin', expected };
+
+  const normalized = normalizeRemote(url);
+  if (!expected.some((s) => normalized.endsWith(s))) {
+    return { ok: false, reason: 'not-canonical', got: url, expected };
+  }
+  return { ok: true, expected };
+}
+
 // ---------------------------------------------------------------------------
 // findRepoRoot — injectable IO
 // ---------------------------------------------------------------------------
@@ -414,7 +484,7 @@ export function resolveNamedVault({
 
         // Guard: if this repo IS one of the vaults, skip (don't self-mirror)
         const canonicalSuffixes = canonicalSuffixesFromVaults(vaults, env?.VAULT_MIRROR_CANONICAL_SUFFIX);
-        const normalized = _normalizeRemoteUrl(remoteUrl);
+        const normalized = normalizeRemote(remoteUrl);
         if (canonicalSuffixes.some((s) => normalized.endsWith(s))) {
           // This is the vault itself — fall through to fallback
         } else {
@@ -460,11 +530,14 @@ function _resolveEnvSuffix(env) {
 }
 
 /**
- * Normalize a git remote URL to host/path tail (mirrors vault-mirror.mjs _normalizeRemote).
+ * Normalize a git remote URL to a host/path tail for canonical-suffix matching.
+ * Strips `.git`, the `git@host:` / scheme prefixes, and trailing slashes —
+ * byte-identical to vault-mirror.mjs `_normalizeRemote`, which predates this
+ * export and can import it from here.
  * @param {string} url
  * @returns {string}
  */
-function _normalizeRemoteUrl(url) {
+export function normalizeRemote(url) {
   return String(url ?? '')
     .trim()
     .replace(/\.git$/, '')
@@ -473,6 +546,75 @@ function _normalizeRemoteUrl(url) {
     .replace(/\/+$/, '');
 }
 
+/**
+ * Render a git origin URL for a stderr line (#1479). The vault writers print
+ * the origin {@link checkCanonicalVault} rejected, and that stderr lands in CI
+ * logs and session transcripts — so a LOCAL origin must not carry its path
+ * (the operator's home dir, `.claude/rules/security.md` § Owner-Privacy).
+ *
+ * - `file:` URL, or a bare/relative path (git's rule: no `://` and no `:`
+ *   before the first `/`, a Windows drive letter counting as a path)
+ *   → `file://<local path>`.
+ * - Login rule, both remote forms: a userinfo other than the forge-shared `git`
+ *   is the operator's account (or a password-shaped `user:pass`) → `***@`, the
+ *   same marker {@link redactUrlCredentials} uses; it never takes part in the
+ *   suffix match, so dropping it costs the line no diagnostic value.
+ * - A URL form (`ssh://`, `https://`, … #1490 item 5) applies the login rule,
+ *   keeps its host/port, and keeps its path UNLESS the path has the absolute
+ *   home-dir shape (`/home/<u>…`, `/Users/<u>…`, `/root…`, `/~…`) →
+ *   `/<remote path>`. In URL form every path starts with `/`, so a forge's
+ *   `/org/repo` and a plain `/srv/vault` cannot be told from a filesystem path;
+ *   only the home-dir shape is the owner leak, and the forge shape is what the
+ *   suffix comparison is about. The result still goes through
+ *   {@link redactUrlCredentials}, so a bare `https://git@` (a token slot there)
+ *   is redacted as before. A `://` with no scheme before it (`/srv/a://b`,
+ *   `host:/p://q`) is no URL form: the path and scp rules read it (#1496).
+ * - A scp-like `[user@]host:path` (#1487 item 10) applies the login rule and
+ *   keeps the host and a RELATIVE path — the repo shape the canonical-suffix
+ *   comparison is about. Here a path starting with `/` or `~` is unambiguous: a
+ *   filesystem path on that host (typically a home dir) → `<remote path>`. A
+ *   bracketed IPv6 host (`[::1]:path`, `user@[::1]:path`, `[user@::1]:path`)
+ *   follows the same two rules.
+ *
+ * Returns `''` for an empty/absent origin; callers supply their own wording.
+ * @param {string|undefined|null} url
+ * @returns {string}
+ */
+export function describeOriginForLog(url) {
+  const s = String(url ?? '').trim();
+  if (!s) return '';
+  if (/^file:/i.test(s)) return 'file://<local path>';
+  const login = (u) => (u === undefined ? '' : u === 'git' ? 'git@' : '***@');
+  // A `://` with no scheme in front of it is no URL — git's is_url() reads
+  // such a string by the scp/local rules below, and so does this (#1496: it
+  // used to be printed verbatim, home dir and all).
+  const m = /^([a-z][a-z0-9+.-]*:\/\/)([^/]*)(.*)$/is.exec(s);
+  if (m) {
+    const [, scheme, authority, urlPath] = m;
+    // userinfo runs to the LAST '@' of the authority (a password may hold one).
+    const at = authority.lastIndexOf('@');
+    const user = at === -1 ? undefined : authority.slice(0, at);
+    const homeShaped = /^\/(?:~|(?:home|Users)\/[^/]+(?:\/|$)|root(?:\/|$))/.test(urlPath);
+    return redactUrlCredentials(
+      `${scheme}${login(user)}${authority.slice(at + 1)}${homeShaped ? '/<remote path>' : urlPath}`,
+    );
+  }
+  const scpLike = /^[^/\\]*:/.test(s) && !/^[a-z]:[\\/]/i.test(s);
+  if (!scpLike) return 'file://<local path>';
+  // Split host from path the way git's connect.c host_end() does: a host in
+  // brackets — leading, or right after `user@` — runs to its `]`, so the ':'
+  // inside an IPv6 literal (`[::1]`, `[alice@::1]`) is never the separator.
+  // Otherwise the userinfo runs to the last '@' and the host to the next ':';
+  // `scpLike` guarantees a ':' with no '/' or '\' before it, so that second
+  // pattern always matches.
+  const [, user, host, path] =
+    /^(?:([^[]*)@)?(\[[^\]]*\]):(.*)$/s.exec(s) ?? /^(?:(.*)@)?([^@:]*):(.*)$/s.exec(s);
+  // A login inside the brackets is the same account as one before them.
+  const shownHost = host.replace(/^\[([^\]]*)@/, (_, u) => `[${login(u)}`);
+  const where = /^[/~]/.test(path) ? '<remote path>' : path;
+  return redactUrlCredentials(`${login(user)}${shownHost}:${where}`);
+}
+
 /**
  * Derive an org/repo slug from a git remote URL.
  * e.g. 'git@github.com:my-org/my-repo.git' → 'my-org/my-repo'
@@ -480,7 +622,7 @@ function _normalizeRemoteUrl(url) {
  * @returns {string}
  */
 function _deriveSlugFromRemote(url) {
-  const normalized = _normalizeRemoteUrl(url);
+  const normalized = normalizeRemote(url);
   // normalized is now 'host/path/to/repo' — take the last two segments
   const parts = normalized.split('/').filter(Boolean);
   if (parts.length >= 2) {

package/scripts/lib/orphan-reaper/defaults.mjs

@@ -0,0 +1,41 @@
+/**
+ * orphan-reaper/defaults.mjs — the reaper's parameter table and its repo-path join.
+ *
+ * Imports nothing but `node:path` on purpose: the trigger hooks reach it through
+ * `scan-throttle.mjs` on a hot path whose import closure is measured (#1432), and
+ * every other reaper module shares these numbers instead of re-spelling them.
+ */
+
+import path from 'node:path';
+
+/**
+ * Stufe-1 parameters. Every number carries its provenance from the PRD
+ * parameter table (`docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md`
+ * § 4) — NOT calibrated, so the provenance is what makes a later re-measurement
+ * possible ("keine Zahl ohne ihre Population").
+ */
+export const REAPER_DEFAULTS = Object.freeze({
+  /** `reaper.min-age-seconds`: DevWatchdogs' hard limit for `tsgo`; the
+   *  2026-09-20 orphans were 7-17 min old, comfortably above it. */
+  minAgeSeconds: 300,
+  /** `reaper.min-scan-interval-seconds`: DevWatchdogs' normal scan cadence —
+   *  keeps a `PostToolBatch` storm from taxing every tool call. */
+  minScanIntervalSeconds: 30,
+  /** `reaper.kill-grace-ms`: `DEFAULT_KILL_GRACE_MS` from `process-group.mjs` —
+   *  a repo convention, not a new number. A literal rather than an import so this
+   *  module stays out of `process-group.mjs`'s closure. */
+  killGraceMs: 10_000,
+  /** `reaper.verify-wait-ms`: without it the 2026-09-20 hand-run cleanup
+   *  reported "still alive" for processes that were already gone. */
+  verifyWaitMs: 500,
+  /** `reaper.max-hook-latency-ms`: ceiling a scan may delay a hook by. */
+  maxHookLatencyMs: 50,
+  /** `reaper.false-alarm-window`: last N audit decisions — a ROLLING window
+   *  rather than calendar time, so a quiet host still has a population (HR-101). */
+  falseAlarmWindow: 50,
+});
+
+/** @param {string} repoRoot @param {string} relpath @returns {string} */
+export function underRepo(repoRoot, relpath) {
+  return path.join(repoRoot, ...relpath.split('/'));
+}