session-orchestrator 5.9.0 → 5.10.0

package/scripts/lib/vault-backfill/template.mjs

@@ -173,7 +173,7 @@ export function renderTemplate({ humanName, slug, tier, gitlabPath, owner }, tem
 
   // owner field — value comes from GitLab API (externally controlled).
   // Use yamlScalar() to produce a quoted scalar, preventing newline injection (CWE-1336, #247).
-  // The template has a bare unquoted owner value (e.g. `owner: bernhard`);
+  // The template has a bare unquoted owner value (e.g. `owner: example-owner`);
   // the regex replaces only the bare value token, preserving any trailing comment.
   out = out.replace(/^(\s*owner:\s*)\S+(.*)$/m, `$1${yamlScalar(owner)}$2`);
 

package/scripts/lib/vault-mirror/render-sessions.mjs

@@ -16,6 +16,7 @@
  */
 
 import { toDate, buildTag, slugifyIdSafe } from './utils.mjs';
+import { stableHostname } from '../host-identity.mjs';
 import { sourceRecordValue, sourceRecordLine } from './render-learnings.mjs';
 import { sessionNarrativeText } from './retention.mjs';
 
@@ -275,6 +276,17 @@ export function vaultStatusForSession(entry) {
     : VAULT_STATUS_FALLBACK;
 }
 
+/**
+ * Recorded identity only: never infer the writer's machine for historical notes.
+ * Hardware class is a fallback, and cannot distinguish equally equipped hosts.
+ */
+function sessionHostLine(entry) {
+  const recorded = [entry?.host_id, entry?.host, entry?.host_class]
+    .find((value) => typeof value === 'string' && value.trim() !== '');
+  if (recorded === undefined) return '';
+  return `host: ${JSON.stringify(stableHostname(recorded))}\n`;
+}
+
 /**
  * Frontmatter line emitter — skips emission when value is null/undefined/empty
  * to avoid template-literal coercion bugs (e.g. `platform: undefined` → "undefined").
@@ -549,7 +561,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
+${sessionHostLine(entry)}${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}
@@ -636,7 +648,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
+${sessionHostLine(entry)}${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}
@@ -763,7 +775,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
+${sessionHostLine(entry)}${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}

package/scripts/lib/vault-status/board-writer.mjs

@@ -54,6 +54,7 @@ import path from 'node:path';
 
 import { emitEvent, sessionAttribution } from '../events.mjs';
 import { isLockLive, readLock, DEFAULT_TTL_HOURS } from '../session-lock.mjs';
+import { stableHostname } from '../host-identity.mjs';
 import { readRegistry, repoPathHash, isRegistryEntryFresh } from '../session-registry.mjs';
 import { parseFrontmatter } from '../vault-mirror/utils.mjs';
 import { readConfigFile, parseSessionConfig } from '../config.mjs';
@@ -351,6 +352,10 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
     const semanticFromRegistry = registryEntry
       ? (registryEntry.semantic_session_id ?? registryEntry.session_id ?? null)
       : null;
+    // Hardware class is only a fallback; it cannot distinguish identical machines.
+    const recordedHost = [lock?.host_id, lock?.host, registryEntry?.host_id, registryEntry?.host, registryEntry?.host_class]
+      .find((value) => typeof value === 'string' && value.trim() !== '');
+    const host = recordedHost === undefined ? null : stableHostname(recordedHost);
     const session = semanticFromLock ?? semanticFromRegistry ?? null;
 
     // branch ONLY exists on the registry entry — the lock has no branch field.
@@ -435,6 +440,7 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
       branch: status === STATUS_FREI ? null : branch,
       mode: status === STATUS_FREI ? null : mode,
       heartbeat: status === STATUS_FREI ? null : heartbeat,
+      host: status === STATUS_FREI ? null : host,
     });
   }
 
@@ -458,7 +464,7 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
  *
  * @param {Array<{ repo: string, key?: string|null, status: string,
  *   session?: string|null, branch?: string|null, mode?: string|null,
- *   heartbeat?: string|null }>} rows
+ *   heartbeat?: string|null, host?: string|null }>} rows
  * @param {{ now: Date, createdIso?: string, updatedPlaceholder?: string }} opts
  * @returns {string} full markdown (frontmatter + table)
  */
@@ -495,13 +501,13 @@ export function renderBoard(rows, opts = {}) {
   lines.push('');
 
   // Board table
-  lines.push('| Repo | Status | Session | Branch | Mode | Last heartbeat | Key |');
-  lines.push('|---|---|---|---|---|---|---|');
+  lines.push('| Repo | Status | Session | Branch | Mode | Last heartbeat | Key | Host |');
+  lines.push('|---|---|---|---|---|---|---|---|');
   for (const row of sortedRows) {
     lines.push(
       `| ${cell(row?.repo)} | ${cell(row?.status)} | ${cell(row?.session)} | ` +
       `${cell(row?.branch)} | ${cell(row?.mode)} | ${cell(fmtHeartbeat(row?.heartbeat))} | ` +
-      `${cell(row?.key)} |`,
+      `${cell(row?.key)} | ${row?.host ? cell(row.host) : ''} |`,
     );
   }
   lines.push('');
@@ -528,9 +534,10 @@ export function normalizeUpdated(content) {
  * (status carry-over + row preservation for repos not in the current update).
  *
  * Tolerant by design: skips the header + separator rows, ignores any line that
- * is not a 6- or 7-column table row, and maps the literal '—' placeholder back
+ * is not a 6-, 7- or 8-column table row, and maps the literal '—' placeholder back
  * to null. Unescapes the `\|` pipe-escaping applied by {@link renderBoard}.
  *
+ * Host is appended as column 8 (#1054); older rows retain a null host.
  * SIX **or** seven columns (#871): the pre-#871 board rendered 6. A hard
  * `length !== 7` filter would silently DROP every row on an operator's existing
  * board on the first run after upgrade — the board would appear to reset. A
@@ -553,7 +560,7 @@ export function parseBoardRows(content) {
       .split(/(?<!\\)\|/)
       .slice(1, -1)
       .map((c) => c.trim());
-    if (cells.length !== 6 && cells.length !== 7) continue;
+    if (cells.length !== 6 && cells.length !== 7 && cells.length !== 8) continue;
     // Skip the header row and the |---|---| separator row.
     if (cells[0] === 'Repo' || /^-+$/.test(cells[0])) continue;
     const unesc = (v) => (v === '—' ? null : v.replace(/\\\|/g, '|'));
@@ -561,12 +568,13 @@ export function parseBoardRows(content) {
     if (repo === null) continue;
     rows.push({
       repo,
-      key: cells.length === 7 ? unesc(cells[6]) : null,
+      key: cells.length >= 7 ? unesc(cells[6]) : null,
       status: cells[1],
       session: unesc(cells[2]),
       branch: unesc(cells[3]),
       mode: unesc(cells[4]),
       heartbeat: unesc(cells[5]),
+      host: cells.length === 8 ? (unesc(cells[7]) || null) : null,
     });
   }
   return rows;

package/scripts/migrate-vault-paths.mjs

@@ -52,6 +52,7 @@ import { promises as fs, existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import os from 'node:os';
+import { load as loadYaml } from 'js-yaml';
 import {
   loadVaultMigrationRules,
   VAULT_MIGRATION_RULES_PATH,
@@ -59,6 +60,7 @@ import {
 import { parseColumnFlags, CliFlagError } from './lib/cli-flags.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import { atomicWriteText, envelopeToError } from './lib/io.mjs';
+import { loadHostPaths, resolveHostPath } from './lib/config/host-paths.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -89,28 +91,9 @@ function _setSegmentsForTest(oldSeg, newSeg) {
 }
 
 // ── Missing-segment class (GitLab #600 D3) ────────────────────────────────────
-// A second, username-independent drift class: a `vault-dir:` value that points at
-// `~/Projects/vault` (or `/Users/<user>/Projects/vault`) — MISSING the canonical
-// `/Bernhard/` owner segment — must become `~/Projects/Bernhard/vault`.
-//
-// Scoping discipline (do NOT blunt-rewrite every `~/Projects/` path):
-//   - Only lines in a `vault-dir:` context (vault-integration.vault-dir /
-//     vault-sync.vault-dir) are touched. `cache: ~/Projects/vault-backups` and
-//     other unrelated `~/Projects/...` paths are left untouched.
-//   - The match anchors the value to `~` or `/Users/<user>` immediately before
-//     `/Projects/vault`, and requires a path boundary AFTER `vault` (negative
-//     lookahead `(?![\w-])`) so `vault-backups` / `vaultfoo` never match.
-//   - Matching `Projects/vault` directly (not `Projects/Bernhard/vault`) yields
-//     idempotency for free: a canonical line has `Projects/Bernhard/vault`, so
-//     the pattern does not match it → no `.../Bernhard/Bernhard/vault`.
-//
-// The owner segment is the canonical `Bernhard`; the rewrite inserts it between
-// `Projects/` and `vault`.
-const MISSING_SEGMENT_OWNER = 'Bernhard';
-
-// Classification label for the missing-/Bernhard/-segment drift class. Referenced
-// in findMissingSegmentHits() (hit record) and the emit() action strings — hoisted
-// here so the literal lives in exactly one place (architect MED #607 D3).
+// Legacy vault-dir values rooted at Projects/vault use an explicit host canonical
+// target. Detection remains narrow; rewriting never guesses a personal segment.
+// Username-owned lines and historical contexts remain separate migration classes.
 const MISSING_SEGMENT_CLASS = 'vault-dir-missing-segment';
 
 const MISSING_SEGMENT_RE = new RegExp(
@@ -243,6 +226,8 @@ historical contexts (decisions.md, history/, archive*).
 
 Both --from and --to are required unless username-rewrites[0] is set in
 ${VAULT_MIGRATION_RULES_PATH}.
+Legacy vault-dir targets use SO_VAULT_DIR or owner.yaml paths.vault-dir;
+unconfigured targets are skipped without guessing a location.
 
 Options:
   --from SEG           Literal source segment (e.g. '/Users/oldname/')
@@ -330,8 +315,7 @@ function findCandidateFiles(roots) {
 /**
  * Discover files containing a missing-segment `vault-dir:` drift (GitLab #600
  * D3) — i.e. a `vault-dir:` line pointing at `~/Projects/vault` (or
- * `/Users/<user>/Projects/vault`) that lacks the canonical `/Bernhard/` owner
- * segment. These files do NOT contain OLD_SEGMENT, so findCandidateFiles() (which
+ * `/Users/<user>/Projects/vault`) that may need an explicitly configured canonical target. These files do NOT contain OLD_SEGMENT, so findCandidateFiles() (which
  * greps OLD_SEGMENT) cannot find them.
  *
  * grep matches the literal `Projects/vault`; per-file classification then applies
@@ -350,7 +334,7 @@ function findMissingSegmentFiles(roots) {
       '--include=*.md',
       // Coarse literal pre-filter; precise vault-dir/idempotency check happens
       // per-line in findMissingSegmentHits(). 'Projects/vault' also matches
-      // canonical 'Projects/Bernhard/vault' lines, but those are dropped later.
+      // longer paths; exact per-line matching prevents unrelated rewrites.
       'Projects/vault',
       ...roots,
     ],
@@ -407,8 +391,8 @@ function classifyHit(filePath, line) {
 /**
  * Does this line carry a missing-segment `vault-dir:` drift (GitLab #600 D3)?
  * Returns true only for a `vault-dir:` value at `~/Projects/vault` or
- * `/Users/<user>/Projects/vault` that is NOT already canonical
- * (`~/Projects/Bernhard/vault`) — see MISSING_SEGMENT_RE for the precise shape.
+ * `/Users/<user>/Projects/vault` matching the legacy shape — see MISSING_SEGMENT_RE.
+ * Whether the target differs is decided separately by the configured rewrite.
  * `RegExp.test` advances lastIndex on a /g regex, so reset it before each probe.
  */
 function lineHasMissingSegment(line) {
@@ -444,7 +428,7 @@ function isOwnedByUsernamePath(line) {
  * deliberately skipped here: a `vault-dir: /Users/oldname/Projects/vault` line is
  * a username drift (→ /Users/newname/Projects/vault), NOT a missing-segment drift.
  * Without this guard the two classes collide and the username output would gain a
- * spurious /Bernhard/ segment.
+ * second, unrelated vault-target rewrite.
  */
 function findMissingSegmentHits(filePath, content) {
   const historical = isHistorical(filePath);
@@ -464,37 +448,40 @@ function findMissingSegmentHits(filePath, content) {
 }
 
 /**
- * Rewrite missing-segment `vault-dir:` values in `content`: insert the canonical
- * `/Bernhard/` owner segment between `Projects/` and `vault`. Only `vault-dir:`
- * lines matching MISSING_SEGMENT_RE are touched — unrelated `~/Projects/...`
- * paths (e.g. `cache: ~/Projects/vault-backups`) are preserved verbatim.
- *
- * `originalContent` (the file BEFORE rewriteContent ran) gates which lines are
- * eligible: any line whose original carried OLD_SEGMENT is owned by the username
- * path and is skipped, even though the username rewrite may have produced a
- * `/Users/newname/Projects/vault` form that would otherwise match the regex.
- * This keeps the two classes from colliding when both transforms chain.
- *
- * `originalContent` is REQUIRED (no default): the collision-gate is meaningless
- * without the pre-rewrite text, and a `= content` default silently fails open if
- * a future caller forgets it — passing the already-rewritten content as its own
- * "original" would let a chained username rewrite leak a spurious /Bernhard/
- * segment. Callers MUST pass the original content explicitly (architect MED #607 D3).
+ * Rewrite a legacy vault-dir base to an explicit canonical target, preserving
+ * suffixes, scalar quotes and comments. Missing/invalid targets leave text intact.
+ * originalContent is required so username-owned lines are never rewritten twice.
  */
-function rewriteMissingSegment(content, originalContent) {
+function rewriteMissingSegment(content, originalContent, canonicalVaultPath) {
   const origLines = originalContent.split('\n');
-  return content
-    .split('\n')
-    .map((line, i) => {
-      // Skip lines the username path owns (matched on the ORIGINAL line text).
-      if (isOwnedByUsernamePath(origLines[i])) return line;
-      MISSING_SEGMENT_RE.lastIndex = 0;
-      return line.replace(
-        MISSING_SEGMENT_RE,
-        (_m, prefix, root) => `${prefix}${root}/Projects/${MISSING_SEGMENT_OWNER}/vault`,
-      );
-    })
-    .join('\n');
+  if (typeof canonicalVaultPath !== 'string' || !canonicalVaultPath.trim()) return content;
+  const target = canonicalVaultPath.trim().replace(/\/+$/, '') || '/';
+  if (!target.startsWith('/') && !target.startsWith('~/')) return content;
+  if ([...target].some((c) => c.charCodeAt(0) < 32)) return content;
+  return content.split('\n').map((line, i) => {
+    if (isOwnedByUsernamePath(origLines[i])) return line;
+    return line.replace(/(vault-dir:\s*)(?:"((?:\\[^\r\n]|[^"\\\r\n])*)"|'((?:''|[^'\r\n])*)'|([^#\r\n]*))/g,
+      (match, prefix, double, single, bare) => {
+        let value = bare;
+        if (double !== undefined || single !== undefined) {
+          // Decode the complete scalar once so YAML escapes retain their path meaning.
+          try {
+            value = loadYaml(double !== undefined ? `"${double}"` : `'${single}'`);
+          } catch {
+            return match; // Leave malformed quoted values untouched.
+          }
+        }
+        const tailSpace = value.match(/\s*$/)[0];
+        const pathValue = value.slice(0, value.length - tailSpace.length);
+        const legacy = /^(?:~|\/Users\/[^/\s'"]+)\/Projects\/vault(?![\w-])(.*)$/.exec(pathValue);
+        if (!legacy) return match;
+        const replacement = target === '/' && legacy[1].startsWith('/') ? legacy[1] : target + legacy[1];
+        if (double !== undefined) return prefix + JSON.stringify(replacement + tailSpace);
+        if (single !== undefined) return prefix + "'" + (replacement + tailSpace).replace(/'/g, "''") + "'";
+        const scalar = /[\s#:'"[\]{}&*!|>]/.test(replacement) ? JSON.stringify(replacement) : replacement;
+        return prefix + scalar + tailSpace;
+      });
+  }).join('\n');
 }
 
 // ---------------------------------------------------------------------------
@@ -554,6 +541,8 @@ function abbrev(filePath) {
 
 async function main() {
   const opts = parseArgs(process.argv);
+  const canonicalVaultPath = resolveHostPath('vault-dir', null, loadHostPaths());
+  let canonicalWarningEmitted = false;
 
   if (opts.help) {
     printHelp();
@@ -659,7 +648,7 @@ async function main() {
     totalScanned++;
     // Two independent drift classes, each discovered per-line:
     //   - OLD_SEGMENT username drift  → rewriteContent (split+join)
-    //   - missing /Bernhard/ segment  → rewriteMissingSegment (#600 D3)
+    //   - legacy vault base → rewriteMissingSegment (#600 D3)
     const hits = findHits(filePath, content);
     const missingHits = findMissingSegmentHits(filePath, content);
     if (hits.length === 0 && missingHits.length === 0) continue;
@@ -669,7 +658,15 @@ async function main() {
     // in mixed files are rare; if any exist, classify each line and skip-count.
     const fixableHits = hits.filter((h) => h.classification !== 'historical');
     const historicalHits = hits.filter((h) => h.classification === 'historical');
-    const fixableMissing = missingHits.filter((h) => h.classification !== 'historical');
+    const pendingMissing = missingHits.filter((h) => h.classification !== 'historical');
+    if (pendingMissing.length && !canonicalVaultPath && !canonicalWarningEmitted) {
+      process.stderr.write('migrate-vault-paths: WARN legacy vault targets skipped — set SO_VAULT_DIR or owner.yaml paths.vault-dir\n');
+      canonicalWarningEmitted = true;
+    }
+    const fixableMissing = pendingMissing.filter((h) => rewriteMissingSegment(h.text, h.text, canonicalVaultPath) !== h.text);
+    for (const h of pendingMissing.filter((hit) => !fixableMissing.includes(hit))) {
+      emit(opts, { action:'skipped', reason: canonicalVaultPath ? 'canonical-target-unchanged-or-invalid' : 'canonical-vault-unconfigured', file:filePath, line:h.line, classification:h.classification });
+    }
     const historicalMissing = missingHits.filter((h) => h.classification === 'historical');
 
     for (const h of [...historicalHits, ...historicalMissing]) {
@@ -695,7 +692,7 @@ async function main() {
     // touches a line the username rewrite already owns (see rewriteMissingSegment).
     let newContent = content;
     if (fixableHits.length > 0) newContent = rewriteContent(newContent);
-    if (fixableMissing.length > 0) newContent = rewriteMissingSegment(newContent, content);
+    if (fixableMissing.length > 0) newContent = rewriteMissingSegment(newContent, content, canonicalVaultPath);
 
     for (const h of fixableHits) {
       totalLinesFixed++;

package/scripts/release.mjs

@@ -23,7 +23,7 @@
 //                         + Unreleased folded, drift sweep, tag collision
 //                         (local, origin, github), github/main mirror parity,
 //                         npm registry collision, npm token liveness, CI green
-//                         on HEAD, leakage gate over `npm pack --dry-run`.
+//                         on HEAD, leakage gate over retained archive filenames and contents.
 //   --publish             Runs --check first, then token publish via temp
 //                         userconfig (NPM_TOKEN from .env.local). A
 //                         target-confirmed npm receipt is the irreversible
@@ -80,10 +80,14 @@ import {
   chmodSync,
   rmSync,
   realpathSync,
+  mkdirSync,
+  lstatSync,
 } from 'node:fs';
-import { join, relative as relativePath, sep } from 'node:path';
+import { join, relative as relativePath, sep, basename, isAbsolute } from 'node:path';
 import { tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { packedFilename } from './lib/plugin-package-stage.mjs';
 import { parseArgs } from 'node:util';
 import { fileURLToPath } from 'node:url';
 
@@ -828,6 +832,80 @@ export function evaluateLeakageGate(pack, { minEntries = MIN_PACKED_ENTRIES } =
     : { ok: true, detail: `${entries} packed entries, 0 leaks` };
 }
 
+/** Strict npm 11/12 inventory, preserving the existing filename policy/floor. */
+export function evaluatePackedInventory(pack, { minEntries = MIN_PACKED_ENTRIES } = {}) {
+  if (pack.status !== 0) return { ok: false, detail: 'npm pack failed' };
+  try {
+    const json = JSON.parse(pack.stdout);
+    const records = Array.isArray(json) ? json : json && typeof json === 'object' ? Object.values(json) : [];
+    if (records.length !== 1) throw new Error('inventory-shape');
+    const record = records[0];
+    const filename = packedFilename([record]);
+    if (!filename || basename(filename) !== filename || !/^[A-Za-z0-9][A-Za-z0-9._-]*\.tgz$/.test(filename)) throw new Error('archive-name');
+    if (!Array.isArray(record.files) || record.files.length > 20000 || record.files.length < minEntries) throw new Error('inventory-floor');
+    const paths = record.files.map((entry) => entry?.path);
+    if (paths.some((name) => typeof name !== 'string' || !name || name.length > 4096 || isAbsolute(name) || name.split('/').some((part) => !part || part === '.' || part === '..') || (name.includes('\\') || [...name].some((c) => c.charCodeAt(0) < 32 || c.charCodeAt(0) === 127))) || new Set(paths).size !== paths.length) throw new Error('inventory-path');
+    const violations = checkLeakage(paths.map((name) => `npm notice 1B ${name}`));
+    if (violations.length) return { ok: false, detail: 'forbidden packed filename class: ' + [...new Set(violations.map((v) => v.name))].join(', ') };
+    return { ok: true, detail: `${paths.length} packed entries, 0 filename leaks`, record, filename, paths };
+  } catch { return { ok: false, detail: 'invalid packed inventory or insufficient entry count' }; }
+}
+
+function archiveDigest(tarballPath) {
+  if (!lstatSync(tarballPath).isFile()) throw new Error('checked archive is not a regular file');
+  return createHash('sha256').update(readFileSync(tarballPath)).digest('hex');
+}
+
+/**
+ * Scan extracted archive bytes, retain that archive for the callback, and always
+ * clean up. Command/scan failures never call the publication callback. The
+ * 20,000-entry inventory ceiling matches the scanner; revisit for larger packs.
+ */
+export async function withCheckedPackage(repoRoot, callback, {
+  runImpl = run, env = process.env, minEntries = MIN_PACKED_ENTRIES, cleanupImpl = rmSync,
+} = {}) {
+  const work = mkdtempSync(join(tmpdir(), 'so-release-pack-'));
+  try {
+    let artifact;
+    let detail;
+    try {
+      const opts = { cwd: repoRoot, env: { ...env, npm_config_loglevel: 'notice' }, timeout: 60000 };
+      const pack = runImpl('npm', ['pack', '--json', '--ignore-scripts', '--pack-destination', work], opts);
+      const inventory = evaluatePackedInventory(pack, { minEntries });
+      if (!inventory.ok) return inventory;
+      const tarballPath = join(work, inventory.filename);
+      const digest = archiveDigest(tarballPath);
+      // Refuse links/special members BEFORE extraction and check the file census.
+      const members = runImpl('tar', ['-tzf', tarballPath], opts);
+      const types = runImpl('tar', ['-tvzf', tarballPath], opts);
+      if (members.status !== 0 || types.status !== 0 || types.stdout.trim().split('\n').some((line) => !/^[-d]/.test(line))) throw new Error('archive-list');
+      const names = members.stdout.trim().split('\n');
+      const files = names.filter((name) => !name.endsWith('/'));
+      const expected = new Set(inventory.paths.map((name) => `package/${name}`));
+      if (names.some((name) => !name.startsWith('package/') || name.split('/').some((part) => part === '..' || part === '.')) || files.length !== expected.size || new Set(files).size !== files.length || files.some((name) => !expected.has(name))) throw new Error('archive-census');
+      const unpacked = join(work, 'unpacked');
+      mkdirSync(unpacked);
+      const extracted = runImpl('tar', ['-xzf', tarballPath, '-C', unpacked], opts);
+      if (extracted.status !== 0) throw new Error('archive-extraction');
+      const inventoryPath = join(work, 'inventory.json');
+      writeFileSync(inventoryPath, JSON.stringify([inventory.record]), { mode: 0o600 });
+      const scanner = fileURLToPath(new URL('./lib/validate/check-owner-leakage.mjs', import.meta.url));
+      const scan = runImpl(process.execPath, [scanner, join(unpacked, 'package'), '--require-owner-patterns', '--packed-files', inventoryPath], opts);
+      const summaries = [...(scan.stdout || '').matchAll(/^Results: (\d+) passed, (\d+) failed \((\d+) scanned files\)$/gm)];
+      if (scan.status !== 0 || summaries.length !== 1 || Number(summaries[0][1]) < 1 || Number(summaries[0][2]) !== 0 || Number(summaries[0][3]) !== inventory.paths.length) return { ok: false, detail: 'required owner policy / packed content scan failed or incomplete' };
+      if (archiveDigest(tarballPath) !== digest) throw new Error('archive-changed');
+      chmodSync(tarballPath, 0o400);
+      artifact = { tarballPath, digest };
+      detail = `${inventory.paths.length} packed files, filenames and contents verified`;
+    } catch { return { ok: false, detail: 'packed archive preparation or content verification failed' }; }
+    return { ok: true, detail, value: await callback(artifact) };
+  } finally {
+    // Cleanup must never replace an irreversible receipt or the original error.
+    try { cleanupImpl(work, { recursive: true, force: true }); }
+    catch { console.error('release: temporary package cleanup failed; release outcome unchanged'); }
+  }
+}
+
 /**
  * Remote-branch parity verdict over `git ls-remote <remote> refs/heads/<branch>`.
  *
@@ -1209,22 +1287,6 @@ async function preflight(repoRoot, target, { skipCi = false } = {}) {
   add('ci-green-on-head', ciRows.gitlab.ok, ciRows.gitlab.detail);
   add('ci-green-on-head-github', ciRows.github.ok, ciRows.github.detail);
 
-  // 7. Leakage gate over the actual pack file list.
-  // `npm_config_loglevel` is INHERITED, and `npm pack --dry-run` writes its whole
-  // file listing as `npm notice` lines. Any ancestor that ran under `npm run
-  // --silent` (the pre-push gate does exactly that) therefore hands this child a
-  // silent loglevel and the listing is EMPTY with exit 0 — measured: 818 notice
-  // lines normally, 0 under `npm_config_loglevel=silent`. The blind-scan floor
-  // turns that into a correct fail-closed verdict, but a red leakage row that
-  // means "we could not look" is not the row anyone reads it as. Pin the level
-  // rather than inherit it, so the gate's input never depends on its caller.
-  const pack = run('npm', ['pack', '--dry-run'], {
-    cwd: repoRoot,
-    env: { ...process.env, npm_config_loglevel: 'notice' },
-  });
-  const leakage = evaluateLeakageGate(pack);
-  add('leakage-gate', leakage.ok, leakage.detail);
-
   return checks;
 }
 
@@ -1407,7 +1469,7 @@ export function waitForRegistryPropagation(repoRoot, target, deps = {}) {
  * reads as unconfirmed, `publish()` throws, and `main()` exits 2 = "pre-receipt,
  * safe to rerun" while the registry already holds the version. That is the worst
  * failure this file can produce, and it is the same inherited-silent trap the
- * leakage gate's `npm pack --dry-run` was already pinned against (see preflight
+ * leakage gate's `npm pack --json` was already pinned against (see preflight
  * step 7). The pin makes the receipt independent of the caller's environment.
  *
  * Exported because `publish()` itself deliberately is not (it is the
@@ -1418,10 +1480,11 @@ export function waitForRegistryPropagation(repoRoot, target, deps = {}) {
  * @param {string} userconfigPath — the 0600 temp npmrc carrying the token
  * @returns {{cmd: string, args: string[], opts: {cwd: string, env: object}}}
  */
-export function publishInvocation(repoRoot, userconfigPath) {
+export function publishInvocation(repoRoot, userconfigPath, artifact) {
+  if (!artifact?.tarballPath || !artifact.digest || archiveDigest(artifact.tarballPath) !== artifact.digest) throw new Error('refusing publish without unchanged checked archive');
   return {
     cmd: 'npm',
-    args: ['publish', '--access', 'public', '--userconfig', userconfigPath],
+    args: ['publish', artifact.tarballPath, '--ignore-scripts', '--access', 'public', '--userconfig', userconfigPath],
     opts: { cwd: repoRoot, env: { ...process.env, npm_config_loglevel: 'notice' } },
   };
 }
@@ -1434,7 +1497,7 @@ function publish(repoRoot, target, deps = {}) {
   const token = loadNpmToken(repoRoot);
   const runImpl = deps.runImpl ?? run;
   const res = withTempUserconfig(token, (tmpRc) => {
-    const call = publishInvocation(repoRoot, tmpRc);
+    const call = publishInvocation(repoRoot, tmpRc, deps.artifact);
     return runImpl(call.cmd, call.args, call.opts);
   });
   const receipt = evaluatePublishReceipt(res, target);
@@ -1919,20 +1982,24 @@ async function main() {
   if (values.check || values.publish) {
     const target = readPackageVersion(repoRoot);
     const checks = await preflight(repoRoot, target, { skipCi: values['skip-ci'] });
-    const ok = printChecks(checks, values.json && !values.publish, target);
-    if (!ok) return 1;
-    if (!values.publish) return 0;
-
-    console.log(`\nPublishing ${PACKAGE_NAME}@${target} ...`);
-    // No spawn timeout is set anywhere in this file, on purpose: a kill in the
-    // middle of `npm publish` or a tag push is the very failure the receipt
-    // boundary exists to avoid. The wall-clock cost is real, though — each of
-    // the two `git push` remotes re-runs the husky pre-push full gate (~2.5 min
-    // each, measured) and the site poll waits up to 120 s.
-    console.log('  This tail can run ~7 minutes (pre-push gate x2 remotes + up to 120s site poll).');
-    console.log('  Run it with a >=600s command timeout or in the background — do NOT kill it mid-run.');
-    const outcome = await runPublishRelease(repoRoot, target, { publishImpl: publish });
-    return printPublishOutcome(outcome, target);
+    const checked = await withCheckedPackage(repoRoot, async (artifact) => {
+      checks.push({ name: 'leakage-gate', ok: true, detail: 'packed filenames and required owner-policy content scan verified' });
+      const ok = printChecks(checks, values.json && !values.publish, target);
+      if (!ok) return 1;
+      if (!values.publish) return 0;
+      console.log(`\nPublishing ${PACKAGE_NAME}@${target} ...`);
+      console.log('  Publish and post-receipt reconciliation may take several minutes; do not kill it mid-run.');
+      const outcome = await runPublishRelease(repoRoot, target, {
+        publishImpl: (root, version) => publish(root, version, { artifact }),
+      });
+      return printPublishOutcome(outcome, target);
+    });
+    if (!checked.ok) {
+      checks.push({ name: 'leakage-gate', ok: false, detail: checked.detail });
+      printChecks(checks, values.json && !values.publish, target);
+      return 1;
+    }
+    return checked.value;
   }
 
   console.error('Nothing to do — pass --check, --publish, or --set-version X.Y.Z (see --help).');

package/scripts/vault-consolidate.mjs

@@ -3,7 +3,7 @@
  * vault-consolidate.mjs — One-shot vault consolidation migration (PRD F1.1, Issue #499).
  *
  * Folds the redundant vault at `~/Projects/vault/` into the canonical
- * `~/Projects/Bernhard/vault/`, with per-file conflict resolution, idempotent
+ * host-configured destination, with per-file conflict resolution, idempotent
  * re-runs, and a compressed backup of the source side BEFORE any write.
  *
  * Design — two-phase coordinator-driven flow for merge resolution
@@ -95,10 +95,10 @@ import {
   stageBackup,
   compressAndCleanupBackup,
 } from './lib/vault-consolidate-fs.mjs';
+import { loadHostPaths, resolveHostPath } from './lib/config/host-paths.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 
 const DEFAULT_SOURCE = '~/Projects/vault';
-const DEFAULT_CANONICAL = '~/Projects/Bernhard/vault';
 
 // ---------------------------------------------------------------------------
 // CLI parsing
@@ -122,7 +122,7 @@ Options:
   --source <path>            Path to the redundant (source) vault.
                              Default: ${DEFAULT_SOURCE}
   --canonical <path>         Path to the canonical vault.
-                             Default: ${DEFAULT_CANONICAL}
+                             Default: SO_VAULT_DIR or owner.yaml paths.vault-dir (required when source exists)
   --json                     Newline-delimited JSON output (one record per
                              file, plus a final summary record).
   --resolve <rel>=<choice>   Record a merge decision for the file at the
@@ -215,7 +215,9 @@ async function main() {
   const isJson = parsed.values.json === true;
 
   const sourceRoot = path.resolve(expandTilde(parsed.values.source ?? DEFAULT_SOURCE));
-  const canonicalRoot = path.resolve(expandTilde(parsed.values.canonical ?? DEFAULT_CANONICAL));
+  const canonicalTarget = parsed.values.canonical ?? resolveHostPath('vault-dir', null, loadHostPaths());
+  const canonicalRoot = typeof canonicalTarget === 'string' && canonicalTarget.trim()
+    ? path.resolve(expandTilde(canonicalTarget.trim())) : null;
 
   // Parse --resolve flags into a Map<relPath, "src"|"dst"|"skip">
   const resolutions = new Map();
@@ -255,6 +257,11 @@ async function main() {
     process.exit(0);
   }
 
+  if (!canonicalRoot) {
+    process.stderr.write('ERROR: canonical vault is unconfigured — pass --canonical or set SO_VAULT_DIR / owner.yaml paths.vault-dir\n');
+    process.exit(1);
+  }
+
   if (!(await isDir(canonicalRoot))) {
     process.stderr.write(
       `ERROR: canonical vault not found at ${canonicalRoot} — refusing to consolidate\n`
@@ -262,6 +269,14 @@ async function main() {
     process.exit(2);
   }
 
+  if (await fs.realpath(sourceRoot) === await fs.realpath(canonicalRoot)) {
+    const summary = { kind:'summary', mode:isDryRun ? 'dry-run' : 'apply', source:sourceRoot,
+      canonical:canonicalRoot, counts:{copy:0,'skip-already-present':0,merge:0,'conflict-needs-review':0},
+      notice:'source and canonical resolve to the same vault — nothing to do' };
+    process.stdout.write(isJson ? JSON.stringify(summary) + '\n' : summary.notice + '\n');
+    process.exit(0);
+  }
+
   // -------------------------------------------------------------------------
   // Output helpers (close over isJson + the per-run records buffer)
   // -------------------------------------------------------------------------

package/skills/claude-md-drift-check/SKILL.md

@@ -34,7 +34,7 @@ PHASE 1 IMPLEMENTED (2026-04-19). Session-end opt-in quality gate. Upstream of `
 
 | # | Check | What it scans | How |
 |---|-------|---------------|-----|
-| 1 | `path-resolver` | Every absolute path `/Users/…` in scope files | `existsSync(path)` |
+| 1 | `path-resolver` | Every absolute path `/Users/…` in scope files | `existsSync(path)`; missing paths under validated owner.yaml `drift-check.foreign-host-prefixes` are warnings (#937) |
 | 2 | `project-count-sync` | Hardcoded "N registered" / "N projects" claims next to `01-projects/` | compare to `ls -d 01-projects/*/` |
 | 3 | `issue-reference-freshness` | `#NN` in forward-looking sections (What's Next, Backlog, Open Issues, Offene Themen, Todo, Next Steps) | `glab issue view NN --repo <origin>` |
 | 4 | `session-file-existence` | `50-sessions/YYYY-MM-DD-*.md` references anywhere in scope | `existsSync(vault/50-sessions/<file>)` |