session-orchestrator 5.8.0 → 5.10.0

package/scripts/lib/pre-push-remote-gate.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+// Optional pre-push router: 0 verified, 1 blocked, 10 transport/readiness fallback.
+import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { readConfigFile } from './config/io.mjs';
+import { _parseRemoteHosts } from './config/remote-hosts.mjs';
+import { isMainModule } from './is-main-module.mjs';
+import { admitSuiteCounts, joinGateKillFields } from './gates/gate-helpers.mjs';
+import { resolveWaveNumber } from './quality-gate-wave.mjs';
+
+const log = (message) => process.stderr.write(`pre-push: ${message}\n`);
+
+// offload sync creates a snapshot commit even for a clean source. Check out the
+// pushed SHA again and reject extra source files before invoking the real gate.
+// A nonce-bound receipt separates command failures from offload's overlapping
+// transport exit codes. No receipt is ever interpreted as a passing gate.
+function remoteCommand(sha, nonce) {
+  return `
+    const { spawnSync } = require('node:child_process');
+    const { writeSync } = require('node:fs');
+    const sha = ${JSON.stringify(sha)}, nonce = ${JSON.stringify(nonce)};
+      const env = { ...process.env };
+      for (const key of Object.keys(env)) {
+        if (/(PROJECT_DIR|PLUGIN_ROOT|RULES_DIR)$/.test(key) ||
+            /^GIT_/.test(key) && !/^GIT_(AUTHOR_|COMMITTER_|EDITOR$|ASKPASS$|SSH$|SSH_COMMAND$|TERMINAL_PROMPT$|EXEC_PATH$)/.test(key)) delete env[key];
+      }
+    const git = (...args) => spawnSync('git', args, { env, encoding: 'utf8' });
+    let result = { nonce, sha, exit_code: 1, report: null };
+    const checkout = git('checkout', '--quiet', '--detach', sha);
+    const head = git('rev-parse', 'HEAD');
+    const tracked = git('status', '--porcelain', '--untracked-files=no');
+    const extras = git('ls-files', '--others', '--exclude-standard', '--exclude=node_modules');
+    if (checkout.status === 0 && head.status === 0 && head.stdout.trim() === sha &&
+        tracked.status === 0 && !tracked.stdout.trim() && extras.status === 0 && !extras.stdout.trim()) {
+      const gate = spawnSync('npm', ['run', '--silent', 'quality-gate'],
+        { env, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+      if (gate.stdout) writeSync(1, gate.stdout);
+      if (gate.stderr) writeSync(2, gate.stderr);
+      result.exit_code = gate.status;
+      try { result.report = JSON.parse(gate.stdout); } catch {}
+    }
+    writeSync(1, '\\nSO_PRE_PUSH_RESULT=' + JSON.stringify(result) + '\\n');
+    process.exit(result.exit_code === 0 ? 0 : 1);
+  `;
+}
+
+async function main() {
+  const [tree, sha, ledgerRoot] = process.argv.slice(2);
+  let hosts;
+  try {
+    hosts = _parseRemoteHosts(await readConfigFile(tree)).filter((host) => host['roles-allowed'].includes('test'));
+  } catch {
+    log('remote configuration unavailable — using local gate.');
+    return 10;
+  }
+  for (const { alias } of hosts) {
+    log(`checking remote readiness (${alias}).`);
+    const doctor = spawnSync('offload', ['doctor', '-H', alias, '--brief', '--no-probe'],
+      { encoding: 'utf8', timeout: 30_000, maxBuffer: 1024 * 1024 });
+    if (doctor.error?.code === 'ENOENT') break;
+    if (doctor.error || doctor.status !== 0) {
+      log(`remote ${alias} not ready (exit ${doctor.status ?? doctor.error?.code}) — trying next route.`);
+      continue;
+    }
+    const nonce = randomUUID();
+    log(`running full quality gate remotely on ${alias} against pushed SHA ${sha}.`);
+    const run = spawnSync('offload', ['run', '-H', alias, tree, '--job', `pre-push-${nonce}`,
+      '--klasse', 'gate', '--link-modules', '--rm', '--timeout', '1800', '--', 'node', '-e', remoteCommand(sha, nonce)],
+    { encoding: 'utf8', timeout: 1_860_000, maxBuffer: 64 * 1024 * 1024 });
+    process.stdout.write(run.stdout ?? '');
+    process.stderr.write(run.stderr ?? '');
+    const receipts = (run.stdout ?? '').split(/\r?\n/).filter((line) => line.startsWith('SO_PRE_PUSH_RESULT='));
+    let receipt;
+    try { if (receipts.length === 1) receipt = JSON.parse(receipts[0].slice('SO_PRE_PUSH_RESULT='.length)); } catch { /* unknown blocks */ }
+    if (receipts.length === 0 && !run.error && [2, 4, 8, 10, 255].includes(run.status)) {
+      log(`remote ${alias} transport/readiness failure (exit ${run.status}) — trying next route.`);
+      continue;
+    }
+    const report = receipt?.report;
+    const stubbedChecks = Object.keys(report?.stubbed ?? {});
+    if (stubbedChecks.length > 0) log(`remote gate contains stubbed checks: ${stubbedChecks.join(', ')} — Push blocked.`);
+    const passed = !run.error && run.status === 0 && receipt?.nonce === nonce && receipt.sha === sha &&
+      receipt.exit_code === 0 && report?.variant === 'full-gate' && report.test?.status === 'pass' &&
+      stubbedChecks.length === 0 && !(report.test.failed > 0) && report.test.suite_died !== true &&
+      ['pass', 'skip'].includes(report.typecheck?.status) && ['pass', 'skip'].includes(report.lint?.status) &&
+      ![report.test, report.typecheck, report.lint].some((check) => check.timed_out === true);
+    try {
+      const { emitEvent, sessionAttribution } = await import('./events.mjs');
+      const counts = admitSuiteCounts(report?.test);
+      const waveNumber = resolveWaveNumber(ledgerRoot);
+      await emitEvent(`orchestrator.quality_gate.${passed ? 'passed' : 'failed'}`, {
+        variant: 'full-gate', exit_code: passed ? 0 : 1, remote_host: alias,
+        pushed_sha: sha, ...sessionAttribution(ledgerRoot),
+        ...joinGateKillFields({ outer: {}, gateStdout: JSON.stringify(report) }),
+        ...(counts ? { counts } : {}),
+        ...(waveNumber !== null ? { wave_number: waveNumber } : {}),
+        ...(report?.test?.failed_files?.length ? { failed_files: report.test.failed_files } : {}),
+      }, { repoRoot: ledgerRoot });
+    } catch { /* telemetry cannot change the blocking verdict */ }
+    log(`remote quality gate ${passed ? 'passed' : 'FAILED — Push blocked'} (${alias}).`);
+    return passed ? 0 : 1;
+  }
+  log('remote routes unavailable — using local full quality gate.');
+  return 10;
+}
+
+if (isMainModule(import.meta.url)) process.exitCode = await main();

package/scripts/lib/quality-gate-wave.mjs

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { classifyManifestSession, readProcessLocalSessionIds } from './session-identity/own-session.mjs';
+import { findOwnScopeFile } from './scope-gate.mjs';
+
+/**
+ * Resolve the active wave number from the wave-scope sidecar (#966 step 1).
+ *
+ * Mirrors `resolveWave()` in `hooks/pre-bash-memory-propose-audit.mjs` — the
+ * same `.{pi,cursor,codex,claude}/wave-scope.json` precedence via
+ * {@link findOwnScopeFile}, skipping a PEER session's manifest in the same
+ * working copy (#1504: a peer-only result is no wave of ours, never the peer's
+ * number) — with ONE deliberate difference: the hook returns `0` for "no
+ * wave-scope file", this returns `null`.
+ *
+ * Absent is not zero. A human running `npm run quality-gate` from a `git push`
+ * has no wave at all, and that is the common case; publishing `wave_number: 0`
+ * would invent a wave 0 that every consumer then has to special-case. The
+ * caller spreads the result so the KEY is omitted, exactly as `counts` is.
+ *
+ * A non-positive, unsafe or non-integer `wave` field is treated the same way — waves
+ * are 1-indexed, so `0` on disk carries no more information than an absent file.
+ *
+ * Never throws.
+ *
+ * @param {string} projectDir — directory whose wave-scope sidecar to read.
+ * @returns {number|null} positive safe integer wave number, or `null` when there is no wave.
+ */
+export function resolveWaveNumber(projectDir) {
+  try {
+    const ownIds = new Set(readProcessLocalSessionIds({ env: process.env, hookInput: null }));
+    const { path: waveFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
+    if (!waveFile || !existsSync(waveFile)) return null;
+    const wave = JSON.parse(readFileSync(waveFile, 'utf8'))?.wave;
+    if (!Number.isSafeInteger(wave) || wave <= 0) return null;
+    return wave;
+  } catch {
+    return null;
+  }
+}
+

package/scripts/lib/quality-gate.mjs

@@ -67,6 +67,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { emitEvent, sessionAttribution } from './events.mjs';
+import { resolveWaveNumber } from './quality-gate-wave.mjs';
 import { parsePorcelainZ } from './git-porcelain.mjs';
 import { admitSuiteCounts, extractTestCounts } from './gates/gate-helpers.mjs';
 import {
@@ -834,32 +835,35 @@ export function gateKillFields(run) {
  * test gate (fail-fast on lint/typecheck) or its output carried no parseable
  * count. See {@link suiteCountsFromOutput}.
  *
- * IT DOES NOT YET REPLACE THE PROSE PATH (#957/F1 — the earlier wording here
- * claimed it did). `waves[].suite_passed` / `suite_failed` still travel as prose
- * through two LLM hops: `skills/wave-executor/wave-loop.md` step 7 hand-writes
- * them, `skills/session-end/metrics-collection.md` § 1.7 parses them back out of
- * the STATE.md Wave History header into sessions.jsonl. `counts` is a SECOND,
- * machine-measured emission of the same fact. Measured 2026-10-05 against this
- * repo's `.orchestrator/metrics/events.jsonl` (main checkout @ 1386a98e; the
- * file has been rotated since the 4404-record 2026-07-31 reading this note
- * used to quote): 82 `orchestrator.quality_gate.*` records, 46 carrying
- * `counts` (`grep '"orchestrator.quality_gate' <file> | grep -c '"counts"'`).
- *
- * `waves[].*` is PER-WAVE, so the event needs a per-wave key. The
- * `scripts/run-quality-gate.mjs` wrapper emits `wave_number` when a wave-scope
- * sidecar names one (#966 step 1, `resolveWaveNumber`) and OMITS it otherwise —
- * 37 of the same 82 records carry it
- * (`grep '"orchestrator.quality_gate' <file> | grep -c '"wave_number"'`).
- * Readers exist: `skills/session-end/metrics-collection.md` § 1.7 reads
- * `counts` by `wave_number` first and keeps the STATE.md header only as a
- * fallback (#966 step 3), and `scripts/lib/convergence-monitor.mjs` folds a
- * gate record only when it carries both. THIS emitter still sets no
- * `wave_number` — its records are mid-wave auto-fix retries, so they fall to
- * that fallback by design. A record without the key could only be attributed
- * to a wave by a wall-clock window whose own boundaries (`waves[].started_at`
- * / `completed_at`) are themselves LLM-written, against the posture
- * `scripts/lib/eval/session-resolve.mjs` documents for window-attributed gate
- * events ("a contaminated window means gate-attribution is unsafe").
+ * Both skill readers now take `counts` from `orchestrator.quality_gate.*`:
+ * `skills/wave-executor/references/wave-loop-review.md` step 7 and
+ * `skills/session-end/metrics-collection.md` § 1.7. They filter the flat record
+ * by the same `semantic_session_id` + `wave_number` and select the last
+ * matching gate run; `counts.passed` / `counts.failed` supply the per-wave
+ * `suite_passed` / `suite_failed`. A third reader,
+ * `scripts/lib/convergence-monitor.mjs`, folds `counts` from gate records
+ * that also carry `wave_number`. This library emits ONE record per
+ * `runQualityGateWithRetry` call, not per retry; `attempts` carries retries.
+ *
+ * Both emitters resolve `wave_number` from the existing own-session manifest
+ * at the event's repoRoot and omit it without a usable source. No wall-clock
+ * attribution or guessed wave number is added. Missing counts are not zeros.
+ * Count fallback is limited to pre-#954 sessions, gates outside the event
+ * wrapper, or missing wave attribution; step 7 falls back to this wave's own
+ * gate output (its header is not written yet), session end to the header. Auto-fix with a known wave
+ * uses the event; missing counts alone do not permit count fallback.
+ * Diagnose own-session events without the counts filter to distinguish absent
+ * events, missing wave attribution, and fail-fast events without counts; never
+ * adopt counts from another session/wave or an unattributed row. A truncated
+ * append can be skipped by fromjson?, leaving an older matching run: that alone
+ * does not establish the current gate result.
+ *
+ * `suite_platform` comes from this wave's gate run (step 7) or the STATE.md
+ * Wave History header `— suite <passed>/<failed> on <platform>` (session end);
+ * the payload has NO platform field.
+ * Event-derived counts may be mirrored into that existing header as
+ * compatibility output, not a second measurement source. Neither the header
+ * nor sessions.jsonl changes its contract.
  *
  * Note also that THIS emitter only runs under `verification-auto-fix.enabled:
  * true` (default `false`, and `false` in this repo's Session Config). The gate
@@ -891,12 +895,14 @@ export function gateKillFields(run) {
  */
 async function emitGateEvent(repoRoot, ok, attempts, gate, counts, killRun = null) {
   try {
+    const waveNumber = resolveWaveNumber(repoRoot);
     await emitEvent(
       `orchestrator.quality_gate.${ok ? 'passed' : 'failed'}`,
       {
         variant: 'auto-fix-loop',
         exit_code: ok ? 0 : 1,
         attempts,
+        ...(waveNumber !== null ? { wave_number: waveNumber } : {}),
         ...(gate ? { gate } : {}),
         ...(counts ? { counts } : {}),
         ...gateKillFields(killRun),

package/scripts/lib/redact-spans.mjs

@@ -9,28 +9,19 @@
  *
  * Behaviour is unchanged from the original: this module is a move, not a rewrite.
  *
- * DELIBERATE SECOND COPY — `check-owner-leakage.mjs` still carries its OWN inline
- * `redactSpans()` and must keep it. That scanner is a documented standalone
- * single-file vendoring target (`.claude/rules/security.md` § "Owner-Privacy
- * Pre-Commit Hook"): consumer repos copy that ONE file, so a static import of this
- * module throws ERR_MODULE_NOT_FOUND in every vendored copy and blocks all commits
- * (proven by the three cases in `tests/husky/pre-commit-owner-leakage.test.mjs`).
- * Unlike CP11's confidential-names helpers, a redaction sink cannot degrade to
- * inert — an absent redaction prints confidential names into a PUBLIC CI log.
- * So: THIS module serves in-tree consumers, the inline copy serves the vendored
- * path, and `tests/lib/redact-spans.test.mjs` pins the two byte-for-byte against
- * each other. Edit one → that drift guard goes red until both agree again.
+ * The owner-leakage scanner remains a standalone vendoring target. Since #1530
+ * it omits offending line content entirely and redacts private filename segments,
+ * so it no longer carries a second copy of this primitive. In-tree consumers
+ * that retain surrounding text use this module; its overlap and ordering
+ * contracts are covered by tests/lib/redact-spans.test.mjs.
  */
 
 /**
  * Redact every confidential-name span from `line`, ORDER-INDEPENDENTLY (Fix 1 + Fix 2).
  *
- * This is the single redaction sink for the confidential-names privacy invariant.
- * In `check-owner-leakage.mjs` it is applied at the print choke-point over EVERY
- * violation's lineContent — not only CP11 hits — because that scanner runs in a
- * PUBLIC GitHub-Actions mirror: a confidential customer/repo name that co-occurs
- * with a CP1–CP10 hit on the same line (e.g. a name beside an RFC1918 IP that
- * fails CP8) would otherwise be echoed verbatim to the public CI log (Fix 1).
+ * Consumers must pass every relevant confidential pattern before emitting text.
+ * This helper matches the supplied text literally; callers handling reversible
+ * encodings must normalize first or omit the sensitive text entirely.
  *
  * ORDER-INDEPENDENCE (Fix 2): a naïve chain of `.replace()` calls is order-dependent
  * — when one configured name is a PREFIX of another (`['acme','acme-corp-secret']`),

package/scripts/lib/scope-gate.mjs

@@ -5,14 +5,15 @@
  * hot-paths — all sync. Re-exported by hardening.mjs as a barrel so existing
  * importers keep working unchanged.
  *
- * Layering: hook-safe — pure functions only; no I/O at import time;
- * ESM-pure for fast hook hot-paths. Hooks (under `hooks/`) import from
- * this lib; this lib MUST NOT reverse-import from `hooks/`. Cross-cutting
- * invariant for all exports below — see #554 A2.
+ * Layering: hook-safe synchronous helpers; no I/O at import time. Guard
+ * context lookups read bounded filesystem state when called. Hooks (under
+ * `hooks/`) import this ESM-only lib; it MUST NOT reverse-import from hooks.
+ * Cross-cutting invariant for all exports below — see #554 A2.
  */
 
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, lstatSync, openSync, fstatSync, readSync, closeSync, constants } from 'node:fs';
 import path from 'node:path';
+import { resolveSessionRoot, isolatedAgentCheckout, registeredWorktreeRoots } from './platform.mjs';
 
 import { tokenizeCommand, splitChainSegments, resolveSegmentVerb } from './command-blocker.mjs';
 
@@ -106,6 +107,68 @@ export function findOwnScopeFile(projectRoot, ownIds, classify) {
   return { path: null, foreignPath };
 }
 
+/**
+ * Guard context: control state belongs to the coordinator, relative grants to
+ * the actual isolated checkout. Remote adoption requires unique OWN identity;
+ * local unknown/corrupt/foreign/missing dispositions remain unchanged.
+ * Root-only discovery deliberately excludes arbitrary worktree subdirectories;
+ * revisit when the harness supplies a coordinator-root witness (#1504).
+ * @param {{cwd: string, ownIds: Set<string>, classify: Function}} options
+ * @returns {{manifestRoot: string, writeRoot: string, path: string|null,
+ *   foreignPath: string|null, isolated: boolean, error: string|null}}
+ */
+export function resolveScopeContext({ cwd, ownIds, classify }) {
+  let manifestRoot = resolveSessionRoot(cwd);
+  try { manifestRoot = realpathSync.native(manifestRoot); } catch { /* preserve non-existing-root fallback */ }
+  const local = findOwnScopeFile(manifestRoot, ownIds, classify);
+  const agent = isolatedAgentCheckout(cwd);
+  const context = { manifestRoot, writeRoot: agent?.writeRoot ?? manifestRoot,
+    ...local, isolated: agent !== null, error: null };
+  if (!agent || local.path || ownIds.size === 0) return context;
+  const candidates = registeredWorktreeRoots(agent.commonDir);
+  if (candidates.error) return { ...context, error: candidates.error };
+  const matches = new Map();
+  for (const root of candidates.roots) {
+    if (root === agent.writeRoot || root === manifestRoot || isolatedAgentCheckout(root)) continue;
+    // Inspect precedence candidates separately. An unsafe candidate has unknown
+    // ownership: it must never turn an isolated session into a no-scope ALLOW.
+    for (const dir of SCOPE_FILE_DIRS) {
+      const file = path.join(root, dir, 'wave-scope.json');
+      let fd;
+      let raw;
+      try {
+        const before = lstatSync(file);
+        if (!before.isFile() || before.size > 1024 * 1024) return { ...context, error: 'unsafe-coordinator-scope' };
+        fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.ino !== before.ino || opened.dev !== before.dev || opened.size > 1024 * 1024) return { ...context, error: 'unsafe-coordinator-scope' };
+        const buffer = Buffer.alloc(1024 * 1024 + 1);
+        let length = 0;
+        while (length < buffer.length) {
+          const n = readSync(fd, buffer, length, buffer.length - length, null);
+          if (n === 0) break;
+          length += n;
+        }
+        if (length > 1024 * 1024) return { ...context, error: 'unsafe-coordinator-scope' };
+        raw = buffer.toString('utf8', 0, length);
+      } catch (err) {
+        if (err?.code === 'ENOENT') continue;
+        return { ...context, error: 'unsafe-coordinator-scope' };
+      } finally { if (fd !== undefined) closeSync(fd); }
+      try {
+        const scope = JSON.parse(raw);
+        if (classify(scope, ownIds).verdict === 'own') {
+          matches.set(realpathSync(file), { root, path: file, foreignPath: null });
+          break; // highest-precedence positively owned manifest in this root
+        }
+      } catch { /* unbound/corrupt remote state is never authority */ }
+    }
+  }
+  if (matches.size > 1) return { ...context, error: 'ambiguous-coordinator-scope' };
+  const match = matches.values().next().value;
+  return match ? { ...context, manifestRoot: match.root, path: match.path, foreignPath: null } : context;
+}
+
 /**
  * Read the enforcement level from a scope file.
  * Defaults to "strict" (fail-closed) on parse error or missing field.

package/scripts/lib/session-record-repair.mjs

@@ -124,12 +124,11 @@ const INCOMPLETE_FIELD_ORDER = Object.freeze([
 const MS_PRECISION_FIELDS = Object.freeze(['started_at', 'completed_at', 'lease_acquired_at']);
 
 /**
- * ISO-8601 UTC with MORE than three fractional digits (`.994600Z`) — the one
- * rejected shape that has an unambiguous canonical form. Group 1 is the value
- * cut at the millisecond. Offsets, `.3Z` and non-ISO strings do not match and
- * stay for the validator to reject: there is no defensible default for them.
+ * ISO-8601 UTC with MORE than three fractional digits and exactly `Z` or
+ * `+00:00` (#1525). Group 1 is the value cut at the millisecond. Nonzero
+ * offsets, other timezone spellings and shorter fractions stay unrepaired.
  */
-const ISO_UTC_SUB_MS_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})\d+Z$/;
+const ISO_UTC_SUB_MS_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})\d+(?:Z|\+00:00)$/;
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -155,7 +154,13 @@ function isCount(v) {
 function truncateToMs(value) {
   if (typeof value !== 'string') return null;
   const m = ISO_UTC_SUB_MS_RE.exec(value);
-  return m ? `${m[1]}Z` : null;
+  if (!m) return null;
+  const canonical = `${m[1]}Z`;
+  const ms = Date.parse(canonical);
+  // Date.parse rolls over e.g. April 31, non-leap February 29 and 24:00.
+  // Equality with the original calendar components refuses those repairs.
+  if (!Number.isFinite(ms) || new Date(ms).toISOString() !== canonical) return null;
+  return canonical;
 }
 
 function orderIncompleteFields(fields) {
@@ -391,10 +396,16 @@ export function repairRecord(record) {
     preserveRaw(out, 'completed_at', record.completed_at, rescued);
     const endedMs = typeof out.ended_at === 'string' ? Date.parse(out.ended_at) : NaN;
     const startedMs = Date.parse(out.started_at);
-    if (Number.isFinite(endedMs) && Number.isFinite(startedMs) && endedMs >= startedMs) {
+    const endedTruncated = truncateToMs(out.ended_at);
+    if (typeof out.ended_at === 'string' &&
+        (!Number.isFinite(endedMs) ||
+         (ISO_UTC_SUB_MS_RE.test(out.ended_at) && endedTruncated === null))) {
+      // Preserve an invalid legacy measurement for the final schema gate to
+      // reject; do not turn it into a valid default or a rolled-over date.
+      out.completed_at = out.ended_at;
+    } else if (Number.isFinite(endedMs) && Number.isFinite(startedMs) && endedMs >= startedMs) {
       // The COPY is cut to milliseconds; `ended_at` itself is not a validated
       // field and keeps its original bytes, so nothing needs a sidecar here.
-      const endedTruncated = truncateToMs(out.ended_at);
       if (endedTruncated !== null) precisionCut = true;
       out.completed_at = endedTruncated ?? out.ended_at;
     } else {

package/scripts/lib/session-schema/validator.mjs

@@ -182,6 +182,12 @@ function _validateTimestamps(entry) {
       `started_at must match ISO-8601 UTC ms format (YYYY-MM-DDTHH:MM:SS[.SSS]Z), got: ${entry.started_at}`
     );
   }
+  // Date.parse normalizes impossible calendar dates; compare without mutating the record.
+  const startedCanonical = entry.started_at.includes('.')
+    ? entry.started_at : entry.started_at.replace(/Z$/, '.000Z');
+  if (new Date(startedMs).toISOString() !== startedCanonical) {
+    throw new ValidationError(`started_at must be a valid calendar timestamp, got: ${entry.started_at}`);
+  }
   if (typeof entry.completed_at !== 'string') {
     throw new ValidationError('completed_at must be an ISO timestamp string');
   }
@@ -194,6 +200,12 @@ function _validateTimestamps(entry) {
       `completed_at must match ISO-8601 UTC ms format (YYYY-MM-DDTHH:MM:SS[.SSS]Z), got: ${entry.completed_at}`
     );
   }
+  // Date.parse normalizes impossible calendar dates; compare without mutating the record.
+  const completedCanonical = entry.completed_at.includes('.')
+    ? entry.completed_at : entry.completed_at.replace(/Z$/, '.000Z');
+  if (new Date(completedMs).toISOString() !== completedCanonical) {
+    throw new ValidationError(`completed_at must be a valid calendar timestamp, got: ${entry.completed_at}`);
+  }
   if (completedMs < startedMs) {
     throw new ValidationError(
       `completed_at (${entry.completed_at}) must be >= started_at (${entry.started_at})`

package/scripts/lib/session-start-probes.mjs

@@ -258,10 +258,11 @@ function commitRunsCommand(gh, sha) {
  * @returns {string}
  */
 function ciUnknownHint(result) {
-  if (!PUSHED_FOLLOW_UP_REASONS.has(result?.details?.reason)) return CI_UNKNOWN_HINT_DEFAULT;
-  // The GitHub reason names the gh CLI; a glab command there would be wrong.
-  const gh = result.details.cliUsed === 'gh';
+  // Every GitHub unknown reason needs a GitHub hint, including running,
+  // queued and cancelled checks that do not trigger a pushed-commit query.
+  const gh = result?.details?.cliUsed === 'gh';
   const onDemand = gh ? 'run `gh run list` on demand' : CI_UNKNOWN_HINT_DEFAULT;
+  if (!PUSHED_FOLLOW_UP_REASONS.has(result?.details?.reason)) return onDemand;
   const pushed = result.pushed && typeof result.pushed === 'object' ? result.pushed : null;
   // Pure (#1396): the SHA is whatever the follow-up resolved inside the budget.
   // Without `pushed` (the follow-up overran or threw before resolving it) the
@@ -275,6 +276,20 @@ function ciUnknownHint(result) {
   return `last pushed: ${short} (pipeline not checked; run \`${commitRunsCommand(gh, sha)}\`)`;
 }
 
+/** Additive GitHub diagnostics; absent counts leave existing banners unchanged. */
+function checkRunCountsText(result) {
+  const counts = result?.details?.checkRunCounts;
+  if (!counts || result?.details?.cliUsed !== 'gh') return '';
+  const parts = [
+    ['success', 'successful'], ['failure', 'failed/action required'],
+    ['inProgress', 'in progress'], ['queued', 'queued'],
+    ['cancelled', 'cancelled'], ['skipped', 'skipped'],
+    ['neutral', 'neutral'], ['waiting', 'waiting'], ['other', 'unrecognised'],
+  ].filter(([key]) => Number.isSafeInteger(counts[key]) && counts[key] > 0)
+    .map(([key, label]) => `${label}: ${counts[key]}`);
+  return parts.length ? ` — Check runs: ${parts.join(', ')}` : '';
+}
+
 /**
  * "Green, but allow_failure jobs failed" — the ONE predicate both the
  * `ci-status` renderer and its `severityOf` use (#1333). Two predicates once
@@ -584,7 +599,7 @@ export const PROBES = [
         // #1337: a RED pushed commit is an alert, and the banner says what the
         // rule judges (HR-106) — same 🚨 as a red HEAD.
         const mark = r.pushed?.verdict?.status === 'red' ? '🚨' : '⚠';
-        return `${mark} ci-status: CI status for HEAD could not be determined (${reason}) — ${ciUnknownHint(r)}`;
+        return `${mark} ci-status: CI status for HEAD could not be determined (${reason})${checkRunCountsText(r)} — ${ciUnknownHint(r)}`;
       }
       if (r.status === 'red') {
         const pid = r.details?.currentPipelineId ?? '?';
@@ -592,7 +607,7 @@ export const PROBES = [
           ? ` — last green: #${r.lastGreen.pipelineId} (commit ${String(r.lastGreen.sha ?? '').slice(0, 7)}, ${r.redCount} pipelines ago)`
           : '';
         const job = r.failingJobName ? ` Failing job: ${r.failingJobName}` : '';
-        return `🚨 CI RED on HEAD (pipeline #${pid})${green}.${job}`;
+        return `🚨 CI RED on HEAD (pipeline #${pid})${green}.${job}${checkRunCountsText(r)}`;
       }
       if (r.status === 'green') {
         const lines = [];