session-orchestrator 5.8.0 → 5.10.0

package/scripts/release.mjs

@@ -23,7 +23,7 @@
 //                         + Unreleased folded, drift sweep, tag collision
 //                         (local, origin, github), github/main mirror parity,
 //                         npm registry collision, npm token liveness, CI green
-//                         on HEAD, leakage gate over `npm pack --dry-run`.
+//                         on HEAD, leakage gate over retained archive filenames and contents.
 //   --publish             Runs --check first, then token publish via temp
 //                         userconfig (NPM_TOKEN from .env.local). A
 //                         target-confirmed npm receipt is the irreversible
@@ -80,10 +80,14 @@ import {
   chmodSync,
   rmSync,
   realpathSync,
+  mkdirSync,
+  lstatSync,
 } from 'node:fs';
-import { join, relative as relativePath, sep } from 'node:path';
+import { join, relative as relativePath, sep, basename, isAbsolute } from 'node:path';
 import { tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { packedFilename } from './lib/plugin-package-stage.mjs';
 import { parseArgs } from 'node:util';
 import { fileURLToPath } from 'node:url';
 
@@ -387,11 +391,14 @@ const INTENTIONAL_TEST_ASSET_PATHS = new Set([
 // `scripts/lib/locks/index.mjs` is the one-cycle deprecation shim (5.2.0 CHANGELOG, Changed): its
 // runtime warning names the version it was deprecated IN, so it legitimately carries the previous
 // release literal until its 6.0.0 removal — version history by construction, not drift.
+// `skills/eval/rubric-v3.md` (5.9.0 sweep, measured 2026-10-06): its change log quotes the dated
+// owner decision "rubric-v3 in 5.8.0" (2026-10-05, #1487) — the release that introduced the rubric.
+// Prose history, not a version surface; bumping it would falsify the quote.
 // `site/_census.json` is deliberately NOT allowlisted: it carries a `"version"` field that
 // `--set-version` re-stamps (scripts/site-numbers.mjs --write, see the post-bump hint in main()),
 // so leaving it under the drift sweep makes the sweep double as its staleness gate — a census
 // not re-stamped after a bump fails `--check` instead of shipping the previous version.
-export const HISTORY_ALLOWLIST = /^(CHANGELOG\.md|README\.md|scripts\/lib\/locks\/index\.mjs|CLAUDE\.md|AGENTS\.md|CONTRIBUTING\.md|NOTICE|\.husky\/pre-push|docs\/|tests\/|skills\/npm-publish\/|skills\/architecture\/references\/domain-model\.md|skills\/autopilot\/SKILL\.md|scripts\/release\.mjs|\.orchestrator\/|site\/leaderboard\.json|site\/guide\/index\.html|site\/llms-full\.txt|skills\/release\/SKILL\.md|marketing\/remotion\/(?:README\.md|campaign\.json|render-receipt\.json|src\/ReleaseFilm\.tsx)$)/;
+export const HISTORY_ALLOWLIST = /^(CHANGELOG\.md|README\.md|scripts\/lib\/locks\/index\.mjs|CLAUDE\.md|AGENTS\.md|CONTRIBUTING\.md|NOTICE|\.husky\/pre-push|docs\/|tests\/|skills\/npm-publish\/|skills\/architecture\/references\/domain-model\.md|skills\/autopilot\/SKILL\.md|skills\/eval\/rubric-v3\.md|scripts\/release\.mjs|\.orchestrator\/|site\/leaderboard\.json|site\/guide\/index\.html|site\/llms-full\.txt|skills\/release\/SKILL\.md|marketing\/remotion\/(?:README\.md|campaign\.json|render-receipt\.json|src\/ReleaseFilm\.tsx)$)/;
 
 /** Pure check over packed-entry lines. Returns violations: {name, line}[]. */
 export function checkLeakage(lines) {
@@ -825,6 +832,80 @@ export function evaluateLeakageGate(pack, { minEntries = MIN_PACKED_ENTRIES } =
     : { ok: true, detail: `${entries} packed entries, 0 leaks` };
 }
 
+/** Strict npm 11/12 inventory, preserving the existing filename policy/floor. */
+export function evaluatePackedInventory(pack, { minEntries = MIN_PACKED_ENTRIES } = {}) {
+  if (pack.status !== 0) return { ok: false, detail: 'npm pack failed' };
+  try {
+    const json = JSON.parse(pack.stdout);
+    const records = Array.isArray(json) ? json : json && typeof json === 'object' ? Object.values(json) : [];
+    if (records.length !== 1) throw new Error('inventory-shape');
+    const record = records[0];
+    const filename = packedFilename([record]);
+    if (!filename || basename(filename) !== filename || !/^[A-Za-z0-9][A-Za-z0-9._-]*\.tgz$/.test(filename)) throw new Error('archive-name');
+    if (!Array.isArray(record.files) || record.files.length > 20000 || record.files.length < minEntries) throw new Error('inventory-floor');
+    const paths = record.files.map((entry) => entry?.path);
+    if (paths.some((name) => typeof name !== 'string' || !name || name.length > 4096 || isAbsolute(name) || name.split('/').some((part) => !part || part === '.' || part === '..') || (name.includes('\\') || [...name].some((c) => c.charCodeAt(0) < 32 || c.charCodeAt(0) === 127))) || new Set(paths).size !== paths.length) throw new Error('inventory-path');
+    const violations = checkLeakage(paths.map((name) => `npm notice 1B ${name}`));
+    if (violations.length) return { ok: false, detail: 'forbidden packed filename class: ' + [...new Set(violations.map((v) => v.name))].join(', ') };
+    return { ok: true, detail: `${paths.length} packed entries, 0 filename leaks`, record, filename, paths };
+  } catch { return { ok: false, detail: 'invalid packed inventory or insufficient entry count' }; }
+}
+
+function archiveDigest(tarballPath) {
+  if (!lstatSync(tarballPath).isFile()) throw new Error('checked archive is not a regular file');
+  return createHash('sha256').update(readFileSync(tarballPath)).digest('hex');
+}
+
+/**
+ * Scan extracted archive bytes, retain that archive for the callback, and always
+ * clean up. Command/scan failures never call the publication callback. The
+ * 20,000-entry inventory ceiling matches the scanner; revisit for larger packs.
+ */
+export async function withCheckedPackage(repoRoot, callback, {
+  runImpl = run, env = process.env, minEntries = MIN_PACKED_ENTRIES, cleanupImpl = rmSync,
+} = {}) {
+  const work = mkdtempSync(join(tmpdir(), 'so-release-pack-'));
+  try {
+    let artifact;
+    let detail;
+    try {
+      const opts = { cwd: repoRoot, env: { ...env, npm_config_loglevel: 'notice' }, timeout: 60000 };
+      const pack = runImpl('npm', ['pack', '--json', '--ignore-scripts', '--pack-destination', work], opts);
+      const inventory = evaluatePackedInventory(pack, { minEntries });
+      if (!inventory.ok) return inventory;
+      const tarballPath = join(work, inventory.filename);
+      const digest = archiveDigest(tarballPath);
+      // Refuse links/special members BEFORE extraction and check the file census.
+      const members = runImpl('tar', ['-tzf', tarballPath], opts);
+      const types = runImpl('tar', ['-tvzf', tarballPath], opts);
+      if (members.status !== 0 || types.status !== 0 || types.stdout.trim().split('\n').some((line) => !/^[-d]/.test(line))) throw new Error('archive-list');
+      const names = members.stdout.trim().split('\n');
+      const files = names.filter((name) => !name.endsWith('/'));
+      const expected = new Set(inventory.paths.map((name) => `package/${name}`));
+      if (names.some((name) => !name.startsWith('package/') || name.split('/').some((part) => part === '..' || part === '.')) || files.length !== expected.size || new Set(files).size !== files.length || files.some((name) => !expected.has(name))) throw new Error('archive-census');
+      const unpacked = join(work, 'unpacked');
+      mkdirSync(unpacked);
+      const extracted = runImpl('tar', ['-xzf', tarballPath, '-C', unpacked], opts);
+      if (extracted.status !== 0) throw new Error('archive-extraction');
+      const inventoryPath = join(work, 'inventory.json');
+      writeFileSync(inventoryPath, JSON.stringify([inventory.record]), { mode: 0o600 });
+      const scanner = fileURLToPath(new URL('./lib/validate/check-owner-leakage.mjs', import.meta.url));
+      const scan = runImpl(process.execPath, [scanner, join(unpacked, 'package'), '--require-owner-patterns', '--packed-files', inventoryPath], opts);
+      const summaries = [...(scan.stdout || '').matchAll(/^Results: (\d+) passed, (\d+) failed \((\d+) scanned files\)$/gm)];
+      if (scan.status !== 0 || summaries.length !== 1 || Number(summaries[0][1]) < 1 || Number(summaries[0][2]) !== 0 || Number(summaries[0][3]) !== inventory.paths.length) return { ok: false, detail: 'required owner policy / packed content scan failed or incomplete' };
+      if (archiveDigest(tarballPath) !== digest) throw new Error('archive-changed');
+      chmodSync(tarballPath, 0o400);
+      artifact = { tarballPath, digest };
+      detail = `${inventory.paths.length} packed files, filenames and contents verified`;
+    } catch { return { ok: false, detail: 'packed archive preparation or content verification failed' }; }
+    return { ok: true, detail, value: await callback(artifact) };
+  } finally {
+    // Cleanup must never replace an irreversible receipt or the original error.
+    try { cleanupImpl(work, { recursive: true, force: true }); }
+    catch { console.error('release: temporary package cleanup failed; release outcome unchanged'); }
+  }
+}
+
 /**
  * Remote-branch parity verdict over `git ls-remote <remote> refs/heads/<branch>`.
  *
@@ -1206,22 +1287,6 @@ async function preflight(repoRoot, target, { skipCi = false } = {}) {
   add('ci-green-on-head', ciRows.gitlab.ok, ciRows.gitlab.detail);
   add('ci-green-on-head-github', ciRows.github.ok, ciRows.github.detail);
 
-  // 7. Leakage gate over the actual pack file list.
-  // `npm_config_loglevel` is INHERITED, and `npm pack --dry-run` writes its whole
-  // file listing as `npm notice` lines. Any ancestor that ran under `npm run
-  // --silent` (the pre-push gate does exactly that) therefore hands this child a
-  // silent loglevel and the listing is EMPTY with exit 0 — measured: 818 notice
-  // lines normally, 0 under `npm_config_loglevel=silent`. The blind-scan floor
-  // turns that into a correct fail-closed verdict, but a red leakage row that
-  // means "we could not look" is not the row anyone reads it as. Pin the level
-  // rather than inherit it, so the gate's input never depends on its caller.
-  const pack = run('npm', ['pack', '--dry-run'], {
-    cwd: repoRoot,
-    env: { ...process.env, npm_config_loglevel: 'notice' },
-  });
-  const leakage = evaluateLeakageGate(pack);
-  add('leakage-gate', leakage.ok, leakage.detail);
-
   return checks;
 }
 
@@ -1404,7 +1469,7 @@ export function waitForRegistryPropagation(repoRoot, target, deps = {}) {
  * reads as unconfirmed, `publish()` throws, and `main()` exits 2 = "pre-receipt,
  * safe to rerun" while the registry already holds the version. That is the worst
  * failure this file can produce, and it is the same inherited-silent trap the
- * leakage gate's `npm pack --dry-run` was already pinned against (see preflight
+ * leakage gate's `npm pack --json` was already pinned against (see preflight
  * step 7). The pin makes the receipt independent of the caller's environment.
  *
  * Exported because `publish()` itself deliberately is not (it is the
@@ -1415,10 +1480,11 @@ export function waitForRegistryPropagation(repoRoot, target, deps = {}) {
  * @param {string} userconfigPath — the 0600 temp npmrc carrying the token
  * @returns {{cmd: string, args: string[], opts: {cwd: string, env: object}}}
  */
-export function publishInvocation(repoRoot, userconfigPath) {
+export function publishInvocation(repoRoot, userconfigPath, artifact) {
+  if (!artifact?.tarballPath || !artifact.digest || archiveDigest(artifact.tarballPath) !== artifact.digest) throw new Error('refusing publish without unchanged checked archive');
   return {
     cmd: 'npm',
-    args: ['publish', '--access', 'public', '--userconfig', userconfigPath],
+    args: ['publish', artifact.tarballPath, '--ignore-scripts', '--access', 'public', '--userconfig', userconfigPath],
     opts: { cwd: repoRoot, env: { ...process.env, npm_config_loglevel: 'notice' } },
   };
 }
@@ -1431,7 +1497,7 @@ function publish(repoRoot, target, deps = {}) {
   const token = loadNpmToken(repoRoot);
   const runImpl = deps.runImpl ?? run;
   const res = withTempUserconfig(token, (tmpRc) => {
-    const call = publishInvocation(repoRoot, tmpRc);
+    const call = publishInvocation(repoRoot, tmpRc, deps.artifact);
     return runImpl(call.cmd, call.args, call.opts);
   });
   const receipt = evaluatePublishReceipt(res, target);
@@ -1916,20 +1982,24 @@ async function main() {
   if (values.check || values.publish) {
     const target = readPackageVersion(repoRoot);
     const checks = await preflight(repoRoot, target, { skipCi: values['skip-ci'] });
-    const ok = printChecks(checks, values.json && !values.publish, target);
-    if (!ok) return 1;
-    if (!values.publish) return 0;
-
-    console.log(`\nPublishing ${PACKAGE_NAME}@${target} ...`);
-    // No spawn timeout is set anywhere in this file, on purpose: a kill in the
-    // middle of `npm publish` or a tag push is the very failure the receipt
-    // boundary exists to avoid. The wall-clock cost is real, though — each of
-    // the two `git push` remotes re-runs the husky pre-push full gate (~2.5 min
-    // each, measured) and the site poll waits up to 120 s.
-    console.log('  This tail can run ~7 minutes (pre-push gate x2 remotes + up to 120s site poll).');
-    console.log('  Run it with a >=600s command timeout or in the background — do NOT kill it mid-run.');
-    const outcome = await runPublishRelease(repoRoot, target, { publishImpl: publish });
-    return printPublishOutcome(outcome, target);
+    const checked = await withCheckedPackage(repoRoot, async (artifact) => {
+      checks.push({ name: 'leakage-gate', ok: true, detail: 'packed filenames and required owner-policy content scan verified' });
+      const ok = printChecks(checks, values.json && !values.publish, target);
+      if (!ok) return 1;
+      if (!values.publish) return 0;
+      console.log(`\nPublishing ${PACKAGE_NAME}@${target} ...`);
+      console.log('  Publish and post-receipt reconciliation may take several minutes; do not kill it mid-run.');
+      const outcome = await runPublishRelease(repoRoot, target, {
+        publishImpl: (root, version) => publish(root, version, { artifact }),
+      });
+      return printPublishOutcome(outcome, target);
+    });
+    if (!checked.ok) {
+      checks.push({ name: 'leakage-gate', ok: false, detail: checked.detail });
+      printChecks(checks, values.json && !values.publish, target);
+      return 1;
+    }
+    return checked.value;
   }
 
   console.error('Nothing to do — pass --check, --publish, or --set-version X.Y.Z (see --help).');

package/scripts/run-quality-gate.mjs

@@ -55,8 +55,8 @@ import {
   resolveGateTimeoutMs,
 } from './lib/gates/gate-helpers.mjs';
 import { buildCommandSignature, spawnInGroup } from './lib/process-group.mjs';
-import { classifyManifestSession, readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
-import { findOwnScopeFile } from './lib/scope-gate.mjs';
+import { resolveWaveNumber } from './lib/quality-gate-wave.mjs';
+import { readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
 import { gateKillFields } from './lib/quality-gate.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import { shellQuote } from './lib/sh-quote.mjs';
@@ -266,42 +266,6 @@ function resolveLedgerRoot(value) {
   return null;
 }
 
-/**
- * Resolve the active wave number from the wave-scope sidecar (#966 step 1).
- *
- * Mirrors `resolveWave()` in `hooks/pre-bash-memory-propose-audit.mjs` — the
- * same `.{pi,cursor,codex,claude}/wave-scope.json` precedence via
- * {@link findOwnScopeFile}, skipping a PEER session's manifest in the same
- * working copy (#1504: a peer-only result is no wave of ours, never the peer's
- * number) — with ONE deliberate difference: the hook returns `0` for "no
- * wave-scope file", this returns `null`.
- *
- * Absent is not zero. A human running `npm run quality-gate` from a `git push`
- * has no wave at all, and that is the common case; publishing `wave_number: 0`
- * would invent a wave 0 that every consumer then has to special-case. The
- * caller spreads the result so the KEY is omitted, exactly as `counts` is.
- *
- * A non-positive or non-numeric `wave` field is treated the same way — waves
- * are 1-indexed, so `0` on disk carries no more information than an absent file.
- *
- * Never throws.
- *
- * @param {string} projectDir — directory whose wave-scope sidecar to read.
- * @returns {number|null} positive wave number, or `null` when there is no wave.
- */
-function resolveWaveNumber(projectDir) {
-  try {
-    const ownIds = new Set(readProcessLocalSessionIds({ env: process.env, hookInput: null }));
-    const { path: waveFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
-    if (!waveFile || !existsSync(waveFile)) return null;
-    const wave = JSON.parse(readFileSync(waveFile, 'utf8'))?.wave;
-    if (typeof wave !== 'number' || !Number.isFinite(wave) || wave <= 0) return null;
-    return Math.trunc(wave);
-  } catch {
-    return null;
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Main — the CLI body. Guarded below so a bare `import()` runs none of it.
 // ---------------------------------------------------------------------------
@@ -471,7 +435,13 @@ async function main() {
   //
   // stdout is PIPED (not inherited) so the suite counts the gate already computed
   // can be lifted straight off its JSON envelope into telemetry (#954) instead of
-  // travelling as prose through the STATE.md header. The envelope is re-emitted
+  // travelling as prose through the STATE.md header. Both skill readers select
+  // the last matching flat event by semantic_session_id + wave_number; there is
+  // no platform field on the payload. Count fallback (wave-loop step 7: this
+  // wave's own gate output; session end: the STATE.md header) is limited to
+  // pre-#954 sessions, gates outside the event wrapper, or missing wave
+  // attribution (see docs/events-schema.md).
+  // The envelope is re-emitted
   // verbatim below, so the stdout contract is unchanged — a gate sub-script writes
   // exactly one JSON line at the very end (its own child commands are captured by
   // `runCheck`), so nothing streamed before and nothing streams now.

package/scripts/site-numbers.mjs

@@ -996,11 +996,15 @@ export const SITEMAP_FILE = 'sitemap.xml';
  * Unknown either way is an ERROR, never a skip (the `METRIC_IDS` rule): a
  * sitemap `<loc>` missing here would never be dated, and a page carrying cells
  * that is missing here would drift unseen.
+ *
+ * A page without counted cells (for example /lead) never has its <lastmod>
+ * raised automatically: bump it by hand whenever its content changes.
  */
 export const SITEMAP_PAGES = Object.freeze([
   { page: 'index.html', loc: 'https://session-orchestrator.com/' },
   { page: 'de/index.html', loc: 'https://session-orchestrator.com/de' },
   { page: 'guide/index.html', loc: 'https://session-orchestrator.com/guide' },
+  { page: 'lead/index.html', loc: 'https://session-orchestrator.com/lead' },
   { page: 'impressum/index.html', loc: 'https://session-orchestrator.com/impressum' },
   { page: 'datenschutz/index.html', loc: 'https://session-orchestrator.com/datenschutz' },
 ]);

package/scripts/vault-consolidate.mjs

@@ -3,7 +3,7 @@
  * vault-consolidate.mjs — One-shot vault consolidation migration (PRD F1.1, Issue #499).
  *
  * Folds the redundant vault at `~/Projects/vault/` into the canonical
- * `~/Projects/Bernhard/vault/`, with per-file conflict resolution, idempotent
+ * host-configured destination, with per-file conflict resolution, idempotent
  * re-runs, and a compressed backup of the source side BEFORE any write.
  *
  * Design — two-phase coordinator-driven flow for merge resolution
@@ -95,10 +95,10 @@ import {
   stageBackup,
   compressAndCleanupBackup,
 } from './lib/vault-consolidate-fs.mjs';
+import { loadHostPaths, resolveHostPath } from './lib/config/host-paths.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 
 const DEFAULT_SOURCE = '~/Projects/vault';
-const DEFAULT_CANONICAL = '~/Projects/Bernhard/vault';
 
 // ---------------------------------------------------------------------------
 // CLI parsing
@@ -122,7 +122,7 @@ Options:
   --source <path>            Path to the redundant (source) vault.
                              Default: ${DEFAULT_SOURCE}
   --canonical <path>         Path to the canonical vault.
-                             Default: ${DEFAULT_CANONICAL}
+                             Default: SO_VAULT_DIR or owner.yaml paths.vault-dir (required when source exists)
   --json                     Newline-delimited JSON output (one record per
                              file, plus a final summary record).
   --resolve <rel>=<choice>   Record a merge decision for the file at the
@@ -215,7 +215,9 @@ async function main() {
   const isJson = parsed.values.json === true;
 
   const sourceRoot = path.resolve(expandTilde(parsed.values.source ?? DEFAULT_SOURCE));
-  const canonicalRoot = path.resolve(expandTilde(parsed.values.canonical ?? DEFAULT_CANONICAL));
+  const canonicalTarget = parsed.values.canonical ?? resolveHostPath('vault-dir', null, loadHostPaths());
+  const canonicalRoot = typeof canonicalTarget === 'string' && canonicalTarget.trim()
+    ? path.resolve(expandTilde(canonicalTarget.trim())) : null;
 
   // Parse --resolve flags into a Map<relPath, "src"|"dst"|"skip">
   const resolutions = new Map();
@@ -255,6 +257,11 @@ async function main() {
     process.exit(0);
   }
 
+  if (!canonicalRoot) {
+    process.stderr.write('ERROR: canonical vault is unconfigured — pass --canonical or set SO_VAULT_DIR / owner.yaml paths.vault-dir\n');
+    process.exit(1);
+  }
+
   if (!(await isDir(canonicalRoot))) {
     process.stderr.write(
       `ERROR: canonical vault not found at ${canonicalRoot} — refusing to consolidate\n`
@@ -262,6 +269,14 @@ async function main() {
     process.exit(2);
   }
 
+  if (await fs.realpath(sourceRoot) === await fs.realpath(canonicalRoot)) {
+    const summary = { kind:'summary', mode:isDryRun ? 'dry-run' : 'apply', source:sourceRoot,
+      canonical:canonicalRoot, counts:{copy:0,'skip-already-present':0,merge:0,'conflict-needs-review':0},
+      notice:'source and canonical resolve to the same vault — nothing to do' };
+    process.stdout.write(isJson ? JSON.stringify(summary) + '\n' : summary.notice + '\n');
+    process.exit(0);
+  }
+
   // -------------------------------------------------------------------------
   // Output helpers (close over isJson + the per-run records buffer)
   // -------------------------------------------------------------------------

package/skills/_shared/fleet-protocol.md

@@ -8,6 +8,8 @@ knows paths, fields, deadlines and lease validity; `scripts/fleet-checkin.mjs` w
 This file describes them and never redefines them. The coordinator itself is not part of this
 package: it is operated outside the plugin, which owns its operational detail (how it measures,
 which conditions it issues, how it acquires and hands over the lease).
+A public coordinator that implements this contract is lead-session-orchestrator
+(https://session-orchestrator.com/lead); any other tool that writes the same files works too.
 
 **Grundsatz (CSM-003).** Zustand liegt in Dateien; Nachrichten sind nur Hinweise auf eine Datei.
 Der Navigator erteilt keine Freigaben — maßgeblich ist der Owner-Auftrag der Session. Eine Datei,

package/skills/claude-md-drift-check/SKILL.md

@@ -34,7 +34,7 @@ PHASE 1 IMPLEMENTED (2026-04-19). Session-end opt-in quality gate. Upstream of `
 
 | # | Check | What it scans | How |
 |---|-------|---------------|-----|
-| 1 | `path-resolver` | Every absolute path `/Users/…` in scope files | `existsSync(path)` |
+| 1 | `path-resolver` | Every absolute path `/Users/…` in scope files | `existsSync(path)`; missing paths under validated owner.yaml `drift-check.foreign-host-prefixes` are warnings (#937) |
 | 2 | `project-count-sync` | Hardcoded "N registered" / "N projects" claims next to `01-projects/` | compare to `ls -d 01-projects/*/` |
 | 3 | `issue-reference-freshness` | `#NN` in forward-looking sections (What's Next, Backlog, Open Issues, Offene Themen, Todo, Next Steps) | `glab issue view NN --repo <origin>` |
 | 4 | `session-file-existence` | `50-sessions/YYYY-MM-DD-*.md` references anywhere in scope | `existsSync(vault/50-sessions/<file>)` |

package/skills/claude-md-drift-check/checker.mjs

@@ -31,7 +31,7 @@
  */
 
 import { readFileSync, readdirSync, existsSync, statSync, lstatSync, realpathSync } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { join, relative, resolve, posix } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { resolveInstructionFile } from '../../scripts/lib/common.mjs';
@@ -41,6 +41,7 @@ import { isSessionConfigHeading } from '../../scripts/lib/config/section-extract
 import { FRONTMATTER_NOT_AT_TOP, isRuleExpired, parseGlobsFrontmatter } from '../../scripts/lib/rule-loader.mjs';
 import { resolveRepoSpec } from '../../scripts/lib/vcs-repo-spec.mjs';
 import { userInvocableSkills } from '../../scripts/lib/user-invocable-skills.mjs';
+import { loadOwnerConfig } from '../../scripts/lib/owner-yaml.mjs';
 import { learningKeyOf } from '../../scripts/lib/learnings/kebab.mjs';
 
 const FORWARD_HEADING_RE =
@@ -1016,6 +1017,9 @@ function main() {
   if (!args.skipSessionFiles) checksRun.push('session-file-existence');
   for (const s of activeSurfaces) checksRun.push(s.id);
 
+  const foreignHostPrefixes = args.skipPathResolver ? [] :
+    (loadOwnerConfig().config['drift-check']?.['foreign-host-prefixes'] ?? [])
+      .map((prefix) => prefix.replace(/\/+$/, ''));
   const errors = [];
   const warnings = [];
   // Informational findings — never block, never count as a warning. Currently
@@ -1731,9 +1735,16 @@ function main() {
         while ((m = pathRegex.exec(line)) !== null) {
           const p = m[0].replace(/[.,;:)\]`"']+$/, '');
           if (!existsSync(p)) {
-            errors.push({
+            // Lexical containment must use the effective POSIX path: '..' can
+            // escape an allowed foreign directory. Keep p for diagnostics.
+            const normalizedPath = posix.normalize(p);
+            const foreign = foreignHostPrefixes.some((prefix) =>
+              normalizedPath === prefix || normalizedPath.startsWith(`${prefix}/`));
+            (foreign ? warnings : errors).push({
               check: 'path-resolver', file: rel, line: lineNum,
-              message: `Absolute path does not exist: ${p}`,
+              message: foreign
+                ? `Known foreign-host path does not exist on this host: ${p}`
+                : `Absolute path does not exist: ${p}`,
               extracted: p,
             });
           }

package/skills/remote-offload/SKILL.md

@@ -30,7 +30,7 @@ Exit codes (`offload --help`, measured 2026-09-02): `0` ok · `1` usage/config
 
 The gate decides, not the coordinator. `applyOffloadDecision()` in `scripts/lib/wave-resource-gate.mjs` fires when the resource verdict is `reduce` or `coordinator-direct` (and, with `offload-first: true`, on `proceed` as well — see below), and only AFTER the HR-004 heavy-repo cap — a capped wave that offloads still respects the cap. It never probes the network; the coordinator supplies a readiness WITNESS:
 
-- `opts.remoteReady` — `{ [alias]: boolean }`, built from the SessionStart banner line `Offload <alias>: ready=yes …`, or
+- `opts.remoteReady` — `{ [alias]: boolean }`, built from the SessionStart banner line `Offload <alias>: headless-ready=yes …` (legacy `ready=yes` only without new readiness markers; `gate-ready` does not authorize Claude dispatch), or
 - `opts.probeFn` — an async `(alias) => boolean` fallback, consulted only for aliases `remoteReady` doesn't answer for (backed by `remoteDoctor()`, i.e. `offload doctor -H <alias> --brief` parsed by `parseDoctorLine()`).
 
 With neither supplied, no host counts as ready and the wave stays local — the gate fails toward local, never toward an unverified host. A role in `NEVER_FOREIGN_ROLES` (`scripts/lib/wave-executor/dispatch-common.mjs`: `impl-core`, `security-review`, `migration`, `release`, `secrets`, `incident`, `refactor-crosscut`) is never offloaded regardless of readiness.

package/skills/session-end/metrics-collection.md

@@ -172,19 +172,49 @@ Finalize session metrics by reading the wave data accumulated during execution:
 > - `effectiveness`: ALWAYS populated from Phase 1 plan verification results, and CONSTRUCTED EXPLICITLY in the METRICS_ENTRY snippet (#773) — never deferred to a "remember to add" optional step (that omission is how `carryover: 0` slipped past 41 records). `completion_rate` = `completed / planned_issues` (0.0-1.0, where 0.0 means nothing was completed). **`carryover` counting rule (#773):** `carryover` is the **length of the Phase 1.65 gate carry-list** — `autoCarry` ∪ the middle-band `ask` items the operator LEFT SELECTED ∪ the answered-question `impliesWork: true` candidates — NOT the raw Phase 1.2+1.3 candidate count. On the fail-open skip (gate disabled / headless / AUQ unavailable), EVERY candidate carries, so `carryover` = the full candidate-list length. Count the gate's OUTPUT (what reaches Phase 5 Step 3 filing), not its INPUT.
 > - `effectiveness.override_ratio` (#730/H5): OPTIONAL nested field = `overridden_findings / max(total_findings_surfaced, 1)` (float 0.0-1.0). Populate ONLY when Phase 2.6 (Broken-Window Budget) ran this session (`broken-window-budget.enabled: true`). OMIT (do NOT write null/0) otherwise — **absent = "not measured"**, `0.0` = "measured, nothing overridden". `overridden_findings` = the summed `count` of the `orchestrator.finding.overridden` events emitted this session; `total_findings_surfaced` = every MED/LOW+ finding surfaced across Phase 1.8 + wave reviewers.
 > - `waves[].agent_count_planned` / `waves[].agent_count_started` / `waves[].agent_count_completed` (#724/#1115): OPTIONAL per-wave fields, sourced from `wave-loop.md` § Capture wave metrics step 7 — mirror its definitions exactly, do not re-derive them here. `agent_count_planned` = agents named in the session plan for this wave. `agent_count_started` = distinct agents whose `agent-<id>.meta.json` sidecar is present, after any silent-drop re-dispatch — NOT "produced a tool-result" (under background dispatch the launch ack is a result and would count an agent that never ran). `agent_count_completed` = distinct agents whose task-notification (`<status>completed</status>`) arrived. Omit each field when the wave did not measure it — **absent = "not measured"**, never zero-fill; `0` would read as "measured, no agent started", which is the opposite of an unmeasured wave. The two gaps carry the diagnosis: `agent_count_planned > agent_count_started` after re-dispatch is a persistent silent drop, `agent_count_started > agent_count_completed` at wave end is an agent that started and never returned. Both are also logged to STATE.md `## Deviations` by wave-loop.md, so a record and a deviation entry should agree.
-> - `waves[].suite_passed` / `waves[].suite_failed` / `waves[].suite_platform` (#944): OPTIONAL per-wave fields. Omit all three when absent — absent = "not measured", `suite_failed: 0` = "measured, zero failures".
->   **`suite_passed` / `suite_failed`: read the event FIRST, the STATE.md header only as fallback (#966 step 3).** Since #954/#967 the between-waves gate wrapper `scripts/run-quality-gate.mjs` emits `orchestrator.quality_gate.{passed,failed}` with a machine-measured `counts: {passed, failed, total}` AND the `wave_number` it resolved from the `wave-scope.json` sidecar, so per-wave attribution needs no wall-clock window join. Payload fields are flat at the record's top level; for each wave `N` of this session:
+> - `waves[].suite_passed` / `waves[].suite_failed` / `waves[].suite_platform` (#944): OPTIONAL per-wave fields. Treat counts and header platform independently; absent = "not measured", `suite_failed: 0` = "measured, zero failures".
+>   **`suite_passed` / `suite_failed`: read the event FIRST, the STATE.md header only as fallback (#966 step 3).** Since #954/#967 the between-waves gate wrapper `scripts/run-quality-gate.mjs` emits `orchestrator.quality_gate.{passed,failed}` with a machine-measured `counts: {passed, failed, total}` AND the `wave_number` it resolved from the `wave-scope.json` sidecar, so per-wave attribution needs no wall-clock window join. Payload fields are flat at the record's top level; for each wave of this session:
 >
 >   ```bash
->   jq -c --argjson w N --arg s "<semantic_session_id>" '
->     select(.event | startswith("orchestrator.quality_gate."))
->     | select(.semantic_session_id == $s and .wave_number == $w and .counts != null)
->     | .counts' .orchestrator/metrics/events.jsonl | tail -1
+>   jq -cR --argjson w "$WAVE" --arg s "$SEMANTIC_SESSION_ID" '
+>     fromjson? | objects
+>     | select((.event | type) == "string" and (.event | startswith("orchestrator.quality_gate.")))
+>     | select(.semantic_session_id == $s and .wave_number == $w and .["counts"] != null)
+>     | .["counts"]
+>   ' .orchestrator/metrics/events.jsonl | tail -1
 >   ```
 >
->   Filtering by `semantic_session_id` is mandatory — `events.jsonl` accumulates across sessions and every past session also had a wave `N`. Take the LAST matching record (the wave's final gate run); `counts.passed` → `suite_passed`, `counts.failed` → `suite_failed`. No match = the field was not measured for that wave → omit, never zero-fill (the producer already omits `counts` rather than zero-filling when a run fail-fast'd before the test gate).
->   **Fallback, still live:** when no event matches, fall back to the STATE.md Wave History header `— suite <passed>/<failed> on <platform>` (written by wave-executor §3a since #944). Three cases genuinely need it: pre-#954 sessions, a gate run outside the `run-quality-gate.mjs` wrapper, and the `verification-auto-fix` producer in `scripts/lib/quality-gate.mjs`, which emits `counts` but no `wave_number` (its records are mid-wave retries, so not matching the selector is correct).
->   **`suite_platform` has no event source at all** and is read from the STATE.md header, unchanged. **Remaining work to retire the prose path fully:** (1) carry the platform on the gate event payload; (2) once a session has landed with the event path green and no fallback hits, drop the hand-written trio from `wave-loop.md` step 7. Until both hold, the trio stays written — deleting the writer before the reader is proven loses the numbers for sessions in flight.
+>   `WAVE` and `SEMANTIC_SESSION_ID` come from the existing own session/wave identity; never construct either for this lookup. Filtering by both is mandatory: the ledger accumulates across sessions, and a different session or wave must not supply these counts. `counts.passed` → `suite_passed`, `counts.failed` → `suite_failed`. `tail -1` selects the last matching gate run of the wave, including auto-fix. `-R` with `fromjson? | objects` skips an unreadable ledger line (a torn tail from a killed writer, #1401) instead of letting one parse error end `jq`. The old pipeline could emit an earlier matching value before the parse error; `tail -1` retained that stale value and could hide the jq failure. Known limit: an interrupted `appendFile` can leave a truncated record that `fromjson?` discards completely; `tail -1` can still select an older matching run, which alone is not evidence of the current gate result. The library emits one record per `runQualityGateWithRetry` call, not per retry; `attempts` is not a record count.
+>
+>   An empty counts selector cannot distinguish a missing event, missing wave attribution,
+>   or an attributed event without counts after fail-fast. Inspect the own session's
+>   records without the counts filter before deciding whether a documented count
+>   fallback case applies:
+>
+>   ```bash
+>   jq -cR --argjson w "$WAVE" --arg s "$SEMANTIC_SESSION_ID" '
+>     fromjson? | objects
+>     | select((.event | type) == "string" and (.event | startswith("orchestrator.quality_gate.")))
+>     | select(.semantic_session_id == $s)
+>     | select(.wave_number == $w or .wave_number == null)
+>     | {event, semantic_session_id, wave_number, counts}
+>   ' .orchestrator/metrics/events.jsonl
+>   ```
+>
+>   This is a diagnostic, not a replacement counts source. No rows means no readable
+>   matching event; a row without `wave_number` is not proof of this wave's run;
+>   a row for this wave without `counts` supplies no measurement. Keep the session
+>   filter and never copy counts from another session or wave, or from a row without
+>   wave attribution. An event without `semantic_session_id` is not attributable by
+>   this query either; diagnose missing session attribution from independent evidence
+>   of the own gate run, not by adopting an unrelated unattributed event. Missing
+>   attribution or an empty result alone does not prove a fallback source exists.
+>
+>   **Count fallback is limited to three cases:** pre-#954 sessions, a gate run outside the event wrapper, or missing wave attribution (including an auto-fix call without a readable own wave scope). An event without `semantic_session_id` cannot match the selector — emitters set it only from the session lock via `sessionAttribution()` — and is treated like a gate run outside the wrapper. In those cases only, read the STATE.md Wave History header `— suite <passed>/<failed> on <platform>`. An auto-fix call with a known wave uses the event selector above. An empty selector alone is not a fallback case: an event without `counts`, for example after fail-fast before the test suite, supplies no replacement zeros and does not by itself permit count fallback.
+>
+>   If no counts are available and none of those fallback cases applies, omit `suite_passed` and `suite_failed`. Absent means "not measured"; a present `suite_failed: 0` means "measured, zero failures". Never zero-fill missing measurements.
+>
+>   **`suite_platform` comes separately and exclusively from the STATE.md Wave History header. There is no platform field in the event payload.** Omit it when no header platform measurement is available; do not infer it from `variant`, runner OS, or session platform. Event-derived counts may still be mirrored into the existing header as compatibility output, not a second measurement source; keep the header and sessions.jsonl contracts unchanged.
 > - `open_questions_asked` / `open_questions_answered` / `open_questions_deferred` (#773): the three open-question counts from the Phase 1.65 gate's AUQ Call 2 (identical to the `questions_*` payload fields on the `orchestrator.handover.gated` event). Top-level, additive, non-negative integers. Populate ONLY when the gate ran an interactive triage ("Closen + Triage" path). OMIT all three (do NOT write `0`) when the gate was skipped (fail-open / headless / disabled) or took the fast-path — absent = "not measured", `0` = "measured, zero questions". Validator accepts absent/null/non-negative-integer.
 > - `stagnation_events`: populated ONLY when ≥1 stagnation event was logged to `events.jsonl` during this session. When `total == 0`, the field is omitted from the JSONL entry.
 > - `grounding_injections`: populated ONLY when ≥1 `orchestrator.grounding.injected` event was logged to `events.jsonl` during this session. When `count == 0`, the field is omitted from the JSONL entry.

package/skills/wave-executor/references/wave-loop-dispatch.md

@@ -84,7 +84,7 @@ const gate = await evaluateWaveResourceGate({
 
 **The offload witness is supplied, never probed (#1160).** The gate's own JSDoc states it: `@param {Record<string, boolean>} [opts.remoteReady] — #1160 readiness witness per declared host alias. The gate never probes the network itself; without a witness no host counts as ready and the decision stays local.` So an `offload` decision is impossible unless the coordinator passes one of two things alongside `config`/`plannedAgents`/`waveRole`:
 
-- `remoteReady: { '<alias>': true }` — built from the SessionStart banner line `Offload <alias>: ready=yes`, which was measured at session start and needs no new network call here; or
+- `remoteReady: { '<alias>': true }` — built from the SessionStart banner line `Offload <alias>: headless-ready=yes` (legacy `ready=yes` only without new readiness markers; `gate-ready` does not authorize Claude dispatch), which was measured at session start and needs no new network call here; or
 - `probeFn: remoteReadyProbe` from `scripts/lib/wave-executor/remote-dispatch.mjs` — `@param {(alias: string) => Promise<boolean>} [opts.probeFn] — optional async witness, consulted only for aliases absent from `remoteReady`. Default null.` Use it when the banner is stale or absent; it costs a live probe per alias.
 
 Passing neither is a valid choice, not a bug: the gate then behaves exactly as it did before #1160 and reduces locally.

package/skills/wave-executor/references/wave-loop-review.md

@@ -378,15 +378,45 @@ If the commit itself fails (e.g., nothing to commit, pre-commit hook rejects), d
      **Copy the two counts off the gate's own event — do not re-read them from the terminal (#966 step 3).** `scripts/run-quality-gate.mjs`, the wrapper that fires between waves, emits `orchestrator.quality_gate.{passed,failed}` carrying a machine-measured `counts: {passed, failed, total}` (admitted by `admitSuiteCounts()`) plus the `wave_number` it resolved from `wave-scope.json`. Payload fields are flat at the record's top level:
 
      ```bash
-     jq -c --argjson w <wave_number> --arg s "<semantic_session_id>" '
-       select(.event | startswith("orchestrator.quality_gate."))
-       | select(.semantic_session_id == $s and .wave_number == $w and .counts != null)
-       | .counts' .orchestrator/metrics/events.jsonl | tail -1
+     jq -cR --argjson w "$WAVE" --arg s "$SEMANTIC_SESSION_ID" '
+       fromjson? | objects
+       | select((.event | type) == "string" and (.event | startswith("orchestrator.quality_gate.")))
+       | select(.semantic_session_id == $s and .wave_number == $w and .["counts"] != null)
+       | .["counts"]
+     ' .orchestrator/metrics/events.jsonl | tail -1
      ```
 
-     The session filter is not optional — `events.jsonl` accumulates across sessions and every past session also had a wave with this number.
-     **OMIT all three when that selector returns nothing** — absent = "not measured", `suite_failed: 0` = "measured, zero failures". Never write `0` for a suite that did not run. The event enforces the same distinction at the producer: `counts` is omitted, never zero-filled, when the run fail-fast'd before the test gate or its output carried no parseable count.
-     > **What is NOT on the event, and stays hand-written:** `suite_platform` — the payload has no platform field, so keep writing it from the § 3a header as before. Likewise, the auto-fix-loop producer (`scripts/lib/quality-gate.mjs`, active only under `verification-auto-fix.enabled: true`) emits `counts` WITHOUT `wave_number`, so its retry records correctly never match the selector above; they are mid-wave attempts, not the wave's verdict. If the wave's gate ran outside `run-quality-gate.mjs` entirely, no event exists — fall back to the gate output you read, and say so in the progress update. The reader side (`skills/session-end/metrics-collection.md` § 1.7) reads the event first and this hand-written trio second, so keep writing the trio: it is the compatibility path for those two cases and for sessions already in flight.
+     `WAVE` and `SEMANTIC_SESSION_ID` come from the existing own session/wave identity; never construct either for this lookup. Filtering by both is mandatory: the ledger accumulates across sessions, and a different session or wave must not supply these counts. `counts.passed` → `suite_passed`, `counts.failed` → `suite_failed`. `tail -1` selects the last matching gate run of the wave, including auto-fix. `-R` with `fromjson? | objects` skips an unreadable ledger line (a torn tail from a killed writer, #1401) instead of letting one parse error end `jq`. The old pipeline could emit an earlier matching value before the parse error; `tail -1` retained that stale value and could hide the jq failure. Known limit: an interrupted `appendFile` can leave a truncated record that `fromjson?` discards completely; `tail -1` can still select an older matching run, which alone is not evidence of the current gate result. The library emits one record per `runQualityGateWithRetry` call, not per retry; `attempts` is not a record count.
+
+     An empty counts selector cannot distinguish a missing event, missing wave attribution,
+     or an attributed event without counts after fail-fast. Inspect the own session's
+     records without the counts filter before deciding whether a documented count
+     fallback case applies:
+
+     ```bash
+     jq -cR --argjson w "$WAVE" --arg s "$SEMANTIC_SESSION_ID" '
+       fromjson? | objects
+       | select((.event | type) == "string" and (.event | startswith("orchestrator.quality_gate.")))
+       | select(.semantic_session_id == $s)
+       | select(.wave_number == $w or .wave_number == null)
+       | {event, semantic_session_id, wave_number, counts}
+     ' .orchestrator/metrics/events.jsonl
+     ```
+
+     This is a diagnostic, not a replacement counts source. No rows means no readable
+     matching event; a row without `wave_number` is not proof of this wave's run;
+     a row for this wave without `counts` supplies no measurement. Keep the session
+     filter and never copy counts from another session or wave, or from a row without
+     wave attribution. An event without `semantic_session_id` is not attributable by
+     this query either; diagnose missing session attribution from independent evidence
+     of the own gate run, not by adopting an unrelated unattributed event. Missing
+     attribution or an empty result alone does not prove a fallback source exists.
+
+     **Count fallback is limited to three cases:** pre-#954 sessions, a gate run outside the event wrapper, or missing wave attribution (including an auto-fix call without a readable own wave scope). An event without `semantic_session_id` cannot match the selector — emitters set it only from the session lock via `sessionAttribution()` — and is treated like a gate run outside the wrapper. In those cases only, fall back to the gate output you read for this wave — the same run whose counts go into the § 3a header — and say so in the progress update. Do not read the STATE.md Wave History header here: this step runs before § 3a writes this wave's header, so the newest header line there belongs to the previous wave. An auto-fix call with a known wave uses the event selector above. An empty selector alone is not a fallback case: an event without `counts`, for example after fail-fast before the test suite, supplies no replacement zeros and does not by itself permit count fallback.
+
+     If no counts are available and none of those fallback cases applies, omit `suite_passed` and `suite_failed`. Absent means "not measured"; a present `suite_failed: 0` means "measured, zero failures". Never zero-fill missing measurements.
+
+     **`suite_platform` comes separately from that same gate run of this wave — the platform it ran on, which § 3a then writes as `on <platform>` into the header. There is no platform field in the event payload.** Omit it when the platform of that run is not known; never infer it from `variant`. Event-derived counts may still be mirrored into the existing header as compatibility output, not a second measurement source; keep the header and sessions.jsonl contracts unchanged.
    Append this wave record to the session metrics `waves` array.
 
 7a. **Scope drift tripwire (S2 — #896, warn-only)**: session-cumulative and filtered through `DRIFT_EXCLUDE_PATTERNS`, so its `filesRatio` is NOT expected to agree with this wave's unfiltered `files_changed` from step 7. Only the committed part of its numerator starts at `session-start-ref`; the uncommitted and untracked parts read the checkout as it is now, so files already dirty at session start and a same-checkout peer's files count too (an over-report, named as a ceiling in `computeDrift()`'s JSDoc). Call `computeDrift()` from the same `scripts/lib/scope-baseline.mjs` module as `wave-loop-dispatch.md` § 0a Scope Baseline Freeze. Never blocks — exit code stays 0 and the next wave is dispatched regardless of the result.