session-orchestrator 5.9.0 → 5.11.0

package/hooks/enforce-scope.mjs

@@ -107,12 +107,12 @@ import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 let isPathInside;
 let relativeFromRoot;
 let resolveProjectDir;
-let resolveSessionRoot;
 // The launch dir the harness states — platform.mjs's one definition of the env
 // chain, so the relocation trace below cannot drift from the clamp (#1504).
 let launchDirFromEnv;
 // #1504 point 6 — the manifest that governs THIS session; bound from scope-gate below.
 let findOwnScopeFile;
+let resolveScopeContext;
 let pathMatchesPattern;
 let suggestForScopeViolation;
 let readJson;
@@ -202,7 +202,7 @@ async function bootstrap() {
 
   ({ readStdin, emitAllow, emitDeny, emitWarn } = modules.io);
   ({ isPathInside, relativeFromRoot } = modules.pathUtils);
-  ({ resolveProjectDir, resolveSessionRoot, launchDirFromEnv } = modules.platform);
+  ({ resolveProjectDir, launchDirFromEnv } = modules.platform);
   ({ pathMatchesPattern, suggestForScopeViolation } = modules.hardening);
   ({ readJson } = modules.common);
   ({
@@ -212,6 +212,7 @@ async function bootstrap() {
     gradeScopeEntry,
     canonicalizeGrantPrefix,
     findOwnScopeFile,
+    resolveScopeContext,
   } = modules.scopeGate);
   ({ readProcessLocalSessionIds, classifyManifestSession } = modules.sessionIdentity);
 }
@@ -230,38 +231,18 @@ async function main() {
   // Gate 2: file_path must be a non-empty string
   if (!filePath || typeof filePath !== 'string') return emitAllow();
 
-  // #1492 — the SESSION's working copy, not the launch dir: after
-  // `EnterWorktree`, `$CLAUDE_PROJECT_DIR` still names the dir the session was
-  // launched in, while the manifest lives in the worktree. Never above the launch
-  // dir; a harness subagent worktree (`isolation: "worktree"`) is lifted to the
-  // launch checkout it sits under — still unenforced in an entered-worktree
-  // session (named ceiling in `resolveSessionRoot`, scripts/lib/platform.mjs).
-  const projectRootRaw = resolveSessionRoot(input.cwd);
-
-  // Resolve symlinks in the project root itself so that realpath(file) comparisons
-  // are consistent. On macOS /tmp → /private/tmp; mismatches would cause false denials.
-  let projectRoot;
-  try {
-    projectRoot = await fs.realpath(projectRootRaw);
-  } catch {
-    projectRoot = projectRootRaw;
-  }
-
-  // `new Set(...)` is load-bearing: `readProcessLocalSessionIds` returns a
-  // string[], and `classifyManifestSession` does `ownIds instanceof Set ?
-  // ownIds : new Set()` — a bare array would silently become EMPTY, making
-  // every manifest read `unknown`. Process-local only (#1194, see Gate 3b).
+  // Control state follows the session coordinator; relative grants follow
+  // the actual isolated agent checkout. Entered coordinator worktrees are
+  // discovered only through bounded reciprocal Git metadata and own identity.
   const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
-
-  // Gate 3: no wave-scope.json → nothing to enforce.
-  //
-  // #1504 point 6 — the first manifest that is not provably a peer's, in the
-  // `.pi` > `.cursor` > `.codex` > `.claude` order. `findScopeFile` stopped at
-  // the first file that exists, so a peer's `.pi`/`.cursor` manifest made Gate
-  // 3b stand down and this session's own `.claude/wave-scope.json` was never
-  // read. Only when EVERY candidate is foreign does the first of them come back
-  // (`foreignPath`), so Gate 3b's stand-down below stays unchanged.
-  const located = findOwnScopeFile(projectRoot, ownIds, classifyManifestSession);
+  const context = resolveScopeContext({ cwd: input.cwd, ownIds, classify: classifyManifestSession });
+  if (context.error) return emitDeny('Scope coordinator cannot be resolved', context.error);
+  const projectRootRaw = context.writeRoot;
+  let projectRoot;
+  try { projectRoot = await fs.realpath(projectRootRaw); }
+  catch { projectRoot = projectRootRaw; }
+  const manifestRoot = context.manifestRoot;
+  const located = context;
   const scopePath = located.path ?? located.foreignPath;
   if (!scopePath) {
     await recordHiddenManifestOncePerWave({ projectRootRaw, projectRoot, ownIds, filePath });
@@ -354,7 +335,7 @@ async function main() {
             wave: scope.wave,
             file_path: filePath,
           },
-          { repoRoot: projectRoot },
+          { repoRoot: manifestRoot },
         );
       } catch { /* observability is best-effort — never blocks the decision */ }
       return emitAllow();
@@ -395,10 +376,10 @@ async function main() {
           role: scope.role,
           parseOk,
           scopeMtimeMs: await mtimeMsOf(scopePath),
-          sessionStartMs: sessionStartedAtMs(projectRoot),
+          sessionStartMs: sessionStartedAtMs(manifestRoot),
         })
       : null;
-  const scopeRelRaw = relativeFromRoot(projectRoot, scopePath);
+  const scopeRelRaw = relativeFromRoot(manifestRoot, scopePath);
   const scopeHint = (scopeRelRaw ?? scopePath).split(path.sep).join('/');
 
   /**
@@ -514,7 +495,7 @@ async function main() {
   if (matchedGrant !== null) {
     const grade = gradeScopeEntry(matchedGrant, { resolve: canonicalizeGrantPrefix });
     if (grade?.verdict === 'error') {
-      await recordRefusedGrantOncePerWave({ scope, scopePath, projectRoot, input, grant: matchedGrant, grade, filePath: resolvedPath });
+      await recordRefusedGrantOncePerWave({ scope, scopePath, projectRoot: manifestRoot, input, grant: matchedGrant, grade, filePath: resolvedPath });
       return emitWarn(
         `Gate 5b honoured an out-of-repo grant that scripts/validate-wave-scope.mjs would REFUSE ` +
           `before dispatch — allowedPaths ${grade.message}. The write to '${resolvedPath}' is ` +
@@ -566,9 +547,9 @@ async function main() {
     // not grant the path (Discovery's `allowedPaths: []`) that is a DENY.
     // #1492: the LAUNCH dir too — the harness keys auto-memory on the path it
     // was launched with, which after `EnterWorktree` is no longer the root.
-    const memoryDirs = await ownMemoryDirs([resolveProjectDir(), projectRootRaw, projectRoot]);
+    const memoryDirs = await ownMemoryDirs([resolveProjectDir(), manifestRoot]);
     const caller = classifyCaller(input);
-    if (caller !== 'subagent' && memoryDirs.some((dir) => isInsideDir(resolvedPath, dir))) {
+    if (!context.isolated && caller !== 'subagent' && memoryDirs.some((dir) => isInsideDir(resolvedPath, dir))) {
       // One event per decision point, awaited before emitAllow() —
       // emitAllow() calls process.exit(), which would discard a pending append.
       try {
@@ -589,7 +570,7 @@ async function main() {
             // `'coordinator'` = `agent_type` without `agent_id`.
             discriminator: caller,
           },
-          { repoRoot: projectRoot },
+          { repoRoot: manifestRoot },
         );
       } catch { /* observability is best-effort — never blocks the decision */ }
       return emitAllow();
@@ -642,7 +623,7 @@ async function main() {
   // `emitAllow()` (`process.exit(0)`, no log, no event), so whether it ever fired
   // was unfalsifiable after the fact.
   const carveoutCaller = classifyCaller(input);
-  if (carveoutCaller !== 'subagent' && isCoordinatorCarveout(normalizedRel, projectRoot, scopePath)) {
+  if (!context.isolated && carveoutCaller !== 'subagent' && isCoordinatorCarveout(normalizedRel, projectRoot, scopePath)) {
     // One event per decision point, awaited before emitAllow() — emitAllow()
     // calls process.exit(), which would discard a pending append.
     try {
@@ -659,7 +640,7 @@ async function main() {
           file_path: normalizedRel,
           discriminator: carveoutCaller,
         },
-        { repoRoot: projectRoot },
+        { repoRoot: manifestRoot },
       );
     } catch { /* observability is best-effort — never blocks the decision */ }
     return emitAllow();

package/hooks/hooks-codex.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.9.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.11.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.9.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.11.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/on-session-end.mjs

@@ -43,6 +43,7 @@ import {
   release,
   loadOwnerProof,
   OWNER_PROOF_RELPATH,
+  isLockOwnedByProof,
 } from '../scripts/lib/session-lock.mjs';
 import { parseSessionId } from '../scripts/lib/session-id.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
@@ -789,8 +790,14 @@ async function main() {
           // millisecond started_at cannot match any FUTURE lock, so it
           // self-invalidates), this just avoids the stale artifact. ENOENT
           // (no proof was ever written) lands in the same swallow.
+          // Only when the proof still describes the lock we released: since
+          // #1541 every acquire() rewrites it, so a successor that acquired
+          // during the awaited emit above owns a fresh proof we must not
+          // remove. A narrow window between this read and the unlink remains.
           try {
-            await fs.unlink(path.join(projectRoot, OWNER_PROOF_RELPATH));
+            if (isLockOwnedByProof(lock, loadOwnerProof({ repoRoot: projectRoot }))) {
+              await fs.unlink(path.join(projectRoot, OWNER_PROOF_RELPATH));
+            }
           } catch { /* best-effort — a leftover proof is self-invalidating */ }
         }
       } else {

package/hooks/on-session-start.mjs

@@ -36,6 +36,7 @@ import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
+import { ensureOrchestratorIgnore } from './_lib/orchestrator-ignore.mjs';
 
 import { emitEvent, eventsFilePath } from '../scripts/lib/events.mjs';
 import { readNavigatorLease } from '../scripts/lib/fleet-protocol.mjs';
@@ -781,6 +782,12 @@ function maybeQueueConsentNudge() {
 async function main() {
   const projectRoot = resolveProjectDir();
 
+  // #1515 Pkt 5 — before this hook's own writers (host.json, session.lock,
+  // events.jsonl) run: an un-bootstrapped repo gets `.orchestrator/.gitignore`
+  // so the runtime state never shows up in `git status`. Bootstrapped repos
+  // pay two existsSync and nothing else. Never throws.
+  await ensureOrchestratorIgnore(projectRoot);
+
   // Read optional stdin payload in parallel with git info so we don't stall
   // the hook. Both are best-effort and the promise races against a 500 ms cap
   // inside readStdinJson itself.

package/hooks/post-bash-write-verify.mjs

@@ -156,7 +156,6 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync, realpathSync, statSync } from 'node:fs';
 
 import { readStdin, writeStdoutLineSync } from '../scripts/lib/io.mjs';
-import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
 import { pathMatchesPattern } from '../scripts/lib/hardening.mjs';
 // #1057 — `sessionAgeMs` and its private `clockAgeMs` helper MOVED to the lib so
 // hooks/enforce-scope.mjs can read the same session clock without a hook->hook
@@ -169,7 +168,8 @@ import {
   PEER_RECORD_PREFIX,
   isPeerRecordId,
   isScopeDeclarationPath,
-  findOwnScopeFile,
+  resolveScopeContext,
+  canonicalizeGrantPrefix,
 } from '../scripts/lib/scope-gate.mjs';
 // #1153 P1 — the same process-local ownership check hooks/enforce-scope.mjs
 // applies at Gate 3b. This hook reads the SAME working-copy `wave-scope.json`,
@@ -371,11 +371,23 @@ export function isOutsideSessionRoot(relPath) {
  *
  * @param {string} relPath
  * @param {string[]} allowedPaths
+ * @param {string|null} [writeRoot] actual checkout root for absolute grants
  * @returns {boolean}
  */
-export function isInScope(relPath, allowedPaths) {
+export function isInScope(relPath, allowedPaths, writeRoot = null) {
   if (!Array.isArray(allowedPaths) || allowedPaths.length === 0) return false;
-  return allowedPaths.some((p) => typeof p === 'string' && pathMatchesPattern(relPath, p));
+  return allowedPaths.some((p) => {
+    if (typeof p !== 'string') return false;
+    if (!path.isAbsolute(p)) return pathMatchesPattern(relPath, p);
+    if (typeof writeRoot !== 'string' || !path.isAbsolute(writeRoot) || path.isAbsolute(relPath) || isOutsideSessionRoot(relPath)) return false;
+    // Match the canonical target, as PreToolUse does, but never let an absolute
+    // grant suppress reporting for a path escaping the observed checkout.
+    const root = canonicalizeGrantPrefix(writeRoot);
+    const target = canonicalizeGrantPrefix(path.resolve(root, relPath));
+    const relative = path.relative(root, target);
+    if (path.isAbsolute(relative) || isOutsideSessionRoot(relative.split(path.sep).join('/'))) return false;
+    return pathMatchesPattern(target, p);
+  });
 }
 
 /**
@@ -599,6 +611,7 @@ export function snapshotPathFor(repoRoot) {
  * @param {object} args
  * @param {string[]} args.dirtyPaths     repo-relative paths from git status
  * @param {string[]} args.allowedPaths   wave allowedPaths
+ * @param {string|null} [args.writeRoot] actual checkout root for absolute grants
  * @param {object|null} args.snapshot    previous `{ signature, paths[] }`, or null
  * @param {string} args.signature        current scope signature
  * @param {number|null} [args.scopeMtimeMs] mtime (ms) of wave-scope.json, or null
@@ -606,12 +619,12 @@ export function snapshotPathFor(repoRoot) {
  *   dirty path; null = not attributable (deleted path / stat failure)
  * @returns {{ report: string[], nextSnapshot: { signature: string, paths: string[] }, rebaselined: boolean }}
  */
-export function computeReport({ dirtyPaths, allowedPaths, snapshot, signature, scopeMtimeMs = null, mtimeMs = null, scopeRelPath = null }) {
+export function computeReport({ dirtyPaths, allowedPaths, snapshot, signature, scopeMtimeMs = null, mtimeMs = null, scopeRelPath = null, writeRoot = null }) {
   const outOfScope = dirtyPaths
     .filter((p) => !isIgnoredPath(p))
     // A `../…` path (outside the project root, see rebaseToSessionRoot) is never
     // in scope — not even under a broad glob that would happen to match it.
-    .filter((p) => isOutsideSessionRoot(p) || !isInScope(p, allowedPaths))
+    .filter((p) => isOutsideSessionRoot(p) || !isInScope(p, allowedPaths, writeRoot))
     // The wave-scope.json control file is out-of-scope by construction (it is
     // never under allowedPaths) but its CHANGES are reported via the content-hash
     // control-notice path, not here. Excluding it keeps the mtime re-baseline
@@ -970,18 +983,22 @@ async function main() {
   // G2 — only Bash calls carry the bypass risk this hook watches.
   if (input.tool_name !== 'Bash') return;
 
-  // #1492 — the SESSION's working copy, not the launch dir `$CLAUDE_PROJECT_DIR`
-  // keeps after `EnterWorktree` (the manifest lives in the worktree). See
-  // `resolveSessionRoot` in scripts/lib/platform.mjs.
-  const repoRootRaw = resolveSessionRoot(input.cwd);
-  let repoRoot;
-  try {
-    repoRoot = realpathSync(repoRootRaw);
-  } catch {
-    repoRoot = repoRootRaw;
+  // Coordinator control state and isolated-agent write targets may live in
+  // different working copies; the shared guard context resolves both.
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const context = resolveScopeContext({ cwd: input.cwd, ownIds, classify: classifyManifestSession });
+  if (context.error) {
+    emitMessages([`bash-write-verify: scope coordinator unresolved (${context.error})`], true);
+    return;
   }
-
-  const snapFile = snapshotPathFor(repoRoot);
+  const repoRootRaw = context.writeRoot;
+  let repoRoot;
+  try { repoRoot = realpathSync(repoRootRaw); }
+  catch { repoRoot = repoRootRaw; }
+  // Isolated snapshots bind both trees: two agents never share report-once state,
+  // and reselecting a coordinator cannot inherit another manifest's trust.
+  const snapFile = snapshotPathFor(context.isolated
+    ? `${repoRoot}\0${context.manifestRoot}\0${context.path ?? context.foreignPath ?? ""}` : repoRoot);
   const snapshot = readSnapshot(snapFile);
   // The ONE trust decision (see `trustedScopeState`). Every downstream use of a
   // "previous" value reads this binding, so no code path can accidentally act on
@@ -1004,8 +1021,7 @@ async function main() {
   // peer's higher-precedence manifest no longer hides this session's own one;
   // only when every candidate is foreign does the first come back, and G3b
   // below keeps its stand-down and its rebind notice unchanged.
-  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
-  const located = findOwnScopeFile(repoRoot, ownIds, classifyManifestSession);
+  const located = context;
   const scopePath = located.path ?? located.foreignPath;
   if (!scopePath) {
     if (prevScopeState && prevScopeState.hash !== 'absent') {
@@ -1096,7 +1112,7 @@ async function main() {
             own_session: [...ownIds],
             wave: scope?.wave,
           },
-          { repoRoot },
+          { repoRoot: context.manifestRoot },
         );
       } catch { /* observability is best-effort — never blocks the decision */ }
 
@@ -1156,7 +1172,7 @@ async function main() {
   // `toContain('out-of-scope.mjs')` test to say otherwise.
   const missingSnapshotNotice = prevScopeState === null
     ? formatSnapshotMissingNotice({
-      sessionAge: sessionAgeMs(repoRoot),
+      sessionAge: sessionAgeMs(context.manifestRoot),
       scopeAge: typeof scopeMtimeMs === 'number' ? Date.now() - scopeMtimeMs : null,
       reason: snapshot === null ? 'absent' : 'untrusted',
     })
@@ -1239,6 +1255,7 @@ async function main() {
   const { report, nextSnapshot } = computeReport({
     dirtyPaths,
     allowedPaths,
+    writeRoot: repoRoot,
     // `prevRecord`, not `snapshot`: an untrusted record's report-once list is a
     // forgeable claim about what was already reported (see the binding above).
     snapshot: prevRecord,
@@ -1282,10 +1299,23 @@ async function main() {
     ? []
     : readPeerScopeRecords(path.dirname(scopePath), scope.wave, sidecarRaw);
   if (sidecarBinding.notify) {
-    messages.push(formatSidecarMismatchNotice(
-      path.relative(repoRoot, path.join(path.dirname(scopePath), 'filescopes', `wave-${scope.wave}.scopes.json`)),
-    ));
+    const relSidecar = path.relative(
+      repoRoot,
+      path.join(path.dirname(scopePath), 'filescopes', `wave-${scope.wave}.scopes.json`),
+    );
+    messages.push(formatSidecarMismatchNotice(relSidecar));
     warn = true;
+    // #1514 point 6 (HR-105) — the notice alone left its firing rate unmeasurable.
+    // Same once-per-new-hash dedupe as the notice (`bindPeerSidecar().notify`);
+    // awaited so the append cannot be lost to the process exiting.
+    try {
+      const { emitEvent } = await import('../scripts/lib/events.mjs');
+      await emitEvent(
+        'orchestrator.scope.sidecar_mismatch',
+        { hook: 'post-bash-write-verify', sidecar: relSidecar.split(path.sep).join('/'), wave: scope.wave },
+        { repoRoot: context.manifestRoot },
+      );
+    } catch { /* observability is best-effort — never blocks the notice */ }
   }
   const violations = [];
   for (const relPath of report) {

package/hooks/pre-task-scope-disjoint.mjs

@@ -301,6 +301,18 @@ const DISPATCH_TOOL = 'Agent';
  * A flat sibling, not a directory, on purpose: bootstrap's `store-lock-ignore`
  * step (#1495) ignores `.orchestrator/wave-dispatch-scopes.*` in consumer repos,
  * which covers this name; a directory would surface untracked in each of them.
+ *
+ * NAMED CEILING (BV-004, #1504 point 7a): nothing ever deletes a per-session
+ * file — the hook only writes its own, and no sweep exists (a sweep would delete
+ * files that may be a live peer's state, PSA-003). Each FILE is bounded: it holds
+ * one `waveKey`'s agents, reset on the next wave. The DIRECTORY is not: it grows
+ * by one file (plus a transient `.lock`) per session that dispatched an agent.
+ * Measured 2026-10-08 in this repo's main checkout: 7 files, largest 2918 bytes,
+ * oldest 2026-10-03 — negligible. Fine under ~500 files; the hook never lists
+ * the directory, so the count costs disk, not latency.
+ * Revisit-Trigger: `ls .orchestrator/wave-dispatch-scopes.*.json | wc -l`
+ * passes 500 in any repo, OR a reader starts enumerating these files — then
+ * build an age-gated sweep that skips any session with a live `session.lock`.
  */
 const LEDGER_DIR_REL = '.orchestrator';
 const LEDGER_STEM = 'wave-dispatch-scopes';

package/hooks/subagent-telemetry.mjs

@@ -113,6 +113,7 @@ import { appendSubagent } from '../scripts/lib/subagents-schema.mjs';
 import { getProjectDir } from '../scripts/lib/platform.mjs';
 import { resolveSubagentSidecar } from './_lib/subagent-paths.mjs';
 import { readTailWindow } from '../scripts/lib/tail-window.mjs';
+import { COST_BASIS } from '../scripts/lib/telemetry/pricing.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -859,14 +860,18 @@ async function main() {
     // the rollup can price it part by part; absent on every other record.
     if (modelsUsage !== null) record.models_usage = modelsUsage;
 
-    // Cost is best-effort / forward-compat (#624): the native transcript does
-    // NOT expose total_cost_usd today, so this is null in practice. No rate
-    // table is applied HERE — use the native cost only, default null when absent.
+    // Cost is best-effort (#624): retain the native payload value when valid,
+    // including a genuine zero; use null when absent. No rate table is applied
+    // HERE. Provenance (#1543) requires an explicit recognized payload basis;
+    // a native number alone says nothing about billing or API list prices.
     const totalCostUsd =
       typeof input.total_cost_usd === 'number' && Number.isFinite(input.total_cost_usd) && input.total_cost_usd >= 0
         ? input.total_cost_usd
         : null;
     record.total_cost_usd = totalCostUsd;
+    record.cost_basis = totalCostUsd !== null && input.cost_basis === COST_BASIS
+      ? input.cost_basis
+      : null;
 
     // OTel alias — #411 additive. `gen_ai.usage.input_tokens` stays the RAW
     // UNCACHED value (OTel semantic), which is why it is deliberately NOT equal

package/hooks/wave-scope-commit-guard.mjs

@@ -336,7 +336,10 @@ async function main() {
   // when every candidate is foreign the first comes back and
   // `scopeCommitVerdict` passes it as before. The git process inherits the
   // committing session's env; there is no hook payload here, so the env tier is
-  // the only process-local identity.
+  // the only process-local identity. CEILING (#1504 point 7b): a shell that
+  // exports a foreign CLAUDE_CODE_SESSION_ID makes this session's manifest read
+  // `foreign` and the guard stands down: the same power `--no-verify` grants, so it
+  // stays named, not fixed (docs/scope-collision-guard.md § 6 item 12).
   const ownIds = new Set(readProcessLocalSessionIds());
 
   // #1511 point d — ALSO read the manifest at the SESSION root the scope guards

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "5.9.0",
+  "version": "5.11.0",
   "description": "Your coding agents get an agreed plan, a check after each round of changes and a handover to the next session. Plan, Go, Close: /session reads your repo and agrees the scope, /go runs the work in waves with your tests and typecheck after each implementation wave, /close runs the full gate, verifies, commits and files the rest as issues. Scope and destructive-command guards, crash-safe resume, learnings you approve. For Claude Code, Codex CLI, Cursor and Pi.",
   "type": "module",
   "homepage": "https://session-orchestrator.com",
@@ -96,7 +96,7 @@
     "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^10.2.1",
     "husky": "^9.1.7",
-    "lint-staged": "^15.2.10",
+    "lint-staged": "^16.4.0",
     "prettier": "^3.0.0",
     "vitest": "^4.1.11"
   },

package/rules/opt-in-stack/security-web.md

@@ -19,7 +19,7 @@ tier: wave-only
 
 CSRF, rate limiting, CSP, and transport security. Core security rules are in `security.md` (always-on).
 
-## CSRF Protection (SEC-005)
+## CSRF Protection (SEC-018)
 - **Next.js 15+ Server Actions**: Built-in CSRF protection via Origin header validation against Host header. No manual CSRF token needed.
 - **Manual CSRF tokens required for**: custom API routes (`/api/*`), form submissions to external endpoints, any non-Server-Action mutation endpoint.
 - For manual CSRF token validation, use `crypto.timingSafeEqual()` for timing-safe comparison.

package/scripts/emit-session.mjs

@@ -39,6 +39,7 @@ import {
 import { parseStateMd, readSessionProfile, resolveStateMdPath } from './lib/state-md.mjs';
 import { readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
 import { rollupSessionTokens } from './lib/session-token-rollup.mjs';
+import { COST_BASIS, PRICING_TABLE_DATE } from './lib/telemetry/pricing.mjs';
 import { serializeSessionLineChecked } from './lib/session-schema/serializer.mjs';
 import {
   validateSession,
@@ -48,6 +49,7 @@ import {
   aliasLegacyEndedAt,
   normalizeWaveKeys,
 } from './lib/session-schema.mjs';
+import { stableHostname } from './lib/host-identity.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 
 /**
@@ -297,6 +299,20 @@ async function main() {
     recordSessionId: repaired.session_id,
   });
 
+  // #1054: origin belongs to the session, not the later mirror writer.
+  // Only the owned new-record path may derive this machine's identity:
+  // resolveOwnSessionUuid gates shared markers, while --session-uuid is the
+  // caller's explicit assertion that this is its own session (not proof of a
+  // historical import's origin). Incoming raw_session_id signals replayed
+  // provenance: leave its host unknown rather than guess. Explicit host keys,
+  // including null/empty values, always win. Never backfill existing records.
+  const carriesOrigin = ['raw_session_id', 'host_id', 'host', 'host_class']
+    .some((key) => Object.prototype.hasOwnProperty.call(repaired, key));
+  if (ownUuid && !carriesOrigin) {
+    const hostId = stableHostname();
+    if (hostId) repaired = { ...repaired, host_id: hostId };
+  }
+
   // An explicit session_start_ref that is not a full sha (#1443) names a
   // DIFFERENT commit once the short form becomes ambiguous. Dropped with a WARN
   // rather than rejected: the record is the load-bearing artefact, and the
@@ -527,6 +543,18 @@ async function main() {
         }
         merged[key] = rollup[key];
       }
+      // #1470 Pkt 4/6 — label the merged cost fields. A dollar figure is the
+      // API list-price equivalent, never a payment (`cost_basis`, only beside
+      // a written `total_cost_usd`). The coverage counters, too, depend on
+      // which models the table knows, so `pricing_table_date` names the table
+      // that produced them — read from pricing.mjs, the same module the rollup
+      // priced with, never a second copy of the date.
+      if ('total_cost_usd' in merged && !hasOwn('cost_basis')) {
+        merged.cost_basis = COST_BASIS;
+      }
+      if ('cost_records_total' in merged && !hasOwn('pricing_table_date')) {
+        merged.pricing_table_date = PRICING_TABLE_DATE;
+      }
       // Enrichment must never be the reason the ledger gains no line: validate
       // the enriched record first and fall back to the un-enriched one. Blamed
       // on the rollup only when the un-enriched record validates on its own —