Re-vendor Claudinite mount: close the stale-executor duplicate-dispatch hazard (#769)

This repo was carrying a 75-line `engine/scheduler/executor.md` — the copy as
it stood at the stamped ref 61b90ee (#413, the commit that first shipped
executor.md to consumers). Every other member of the fleet had since moved on;
we had not. The gap was not cosmetic:

  - the **one-session/one-issue** concurrency guard was missing, so a run was
    free to sweep every due task instead of running only the issue that
    triggered it; and
  - the **earliest-claim-wins** tie-break was missing, so two sessions that
    both claimed the same issue would both proceed.

Together those are precisely the guards that stop duplicate dispatch. Without
them concurrent scheduler runs can file duplicate tracker issues, duplicate bug
reports, and duplicate PRs making the same change — a live correctness hazard,
not latent drift.

Re-vendoring from current canon (526c991) brings executor.md to its present
188-line form and lands `engine/scheduler/resolve-dispatch.mjs` alongside it —
the shell executor.md's step 1 now invokes. The two ship as one unit in the
vendor set, so the mount stays import-closed.

Stamp: 61b90ee -> 526c991. 189 files vendored (mount 192 -> 189; the net drop is
the retired tidy-repo/repo-tidy task, not a truncation). Stamp lineage was
checked before vendoring: 61b90ee is a genuine ancestor of origin/main, so the
stamp was honest-but-stale and needed no correction.

`converge-wiring.mjs` additionally corrected the scheduler workflow: `actions:`
read -> write (creating a workflow_dispatch event needs write; `read` silently
403s the POST) and added the `report-failure` escalation job. No stamp fields
changed and the cron minute was re-derived unchanged.

check_the_world: 0 blocking before and after. Advisories 11 -> 10 — the
refreshed wiring resolved `gha/scheduled-failure-escalation`. Nothing new was
introduced and nothing had to be forced or suppressed.

Refs missingbulb/Claudinite#394


Claude-Session: https://claude.ai/code/session_01LgokEeqgbFvhbLqbYwxHgx

Co-authored-by: Claude <noreply@anthropic.com>

Author: missingbulb

.claudinite-checks.json

@@ -32,7 +32,7 @@
     "delivery": "auto-merge"
   },
   "claudinite": {
-    "updated": "2026-07-23T16:35:48.146Z",
-    "ref": "61b90ee879fa82a93ad42268dc3c4a81fa716b6c"
+    "updated": "2026-07-27T09:51:24.654Z",
+    "ref": "526c9910fb0dc276db293e64b8b16b57bc90f565"
   }
 }

.claudinite/shared/engine/checks/helpers/active-migrations.mjs

@@ -13,11 +13,27 @@ import { fileURLToPath } from 'node:url';
 // canonical shapes, no tolerance needed. The full registry
 // (migrations/registry.mjs) builds on this same surface canon-side.
 export const MIGRATIONS_SUBDIR = 'active_migrations';
-const specsDir = join(dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url))))), 'migrations', MIGRATIONS_SUBDIR); // <canon>/engine/checks/helpers/
+// The archive of migrations past their TTL (per-project-scheduling redesign): kept
+// CANON-ONLY (never vendored — a project up to speed on migrations carries few or
+// none), so a dormant project still BACKFILLS from it when baselining applies
+// migrations out of the fresh canon clone. `active_migrations` holds the recent
+// (within-TTL) records that ship in the mount and drive check-tolerance;
+// `migrations-old` holds the aged records that still APPLY but no longer tolerate.
+export const MIGRATIONS_OLD_SUBDIR = 'migrations-old';
+const migrationsRoot = join(dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url))))), 'migrations'); // <canon>/engine/checks/helpers/
+const specsDir = join(migrationsRoot, MIGRATIONS_SUBDIR);
+const oldSpecsDir = join(migrationsRoot, MIGRATIONS_OLD_SUBDIR);
 export const isSpec = (f) => f.endsWith('.mjs') && !f.endsWith('.test.mjs');
+const readSpecs = (d) => { try { return readdirSync(d).filter(isSpec).sort(); } catch { return []; } };
 // Tolerant of an absent/empty folder — a vendored consumer, or a canon
 // checkout after every record has retired.
-export const specFiles = () => { try { return readdirSync(specsDir).filter(isSpec).sort(); } catch { return []; } };
+export const specFiles = () => readSpecs(specsDir);
+// The aged (archived) records — canon-only, so this is empty in any vendored
+// consumer mount. Used by the APPLY/backfill path (registry.loadMigrations), NOT
+// by check-tolerance: a migration's legacy tolerance ENDS when it ages out of
+// active_migrations (all up-to-date repos converged within the TTL), while its
+// apply logic persists here for a dormant project's backfill.
+export const oldSpecFiles = () => readSpecs(oldSpecsDir);
 
 // True while a migration whose file name carries `slug` is still present — a
 // check consults it to know whether an in-flight transition's legacy shape is

.claudinite/shared/engine/checks/helpers/repo-context.mjs

@@ -4,8 +4,8 @@ import { join, resolve, sep } from 'node:path';
 import { parseEntries } from './session-transcript.mjs';
 import { SHARED_SUBDIR, packEntryId } from '../../pack_loader/pack-registry.mjs';
 
-function sh(root, cmd, args, { allowFail = false, input = undefined } = {}) {
-  const r = spawnSync(cmd, args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, input });
+function sh(root, cmd, args, { allowFail = false, input = undefined, timeout = undefined } = {}) {
+  const r = spawnSync(cmd, args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, input, timeout });
   if (r.status !== 0 && !allowFail) {
     throw new Error(`${cmd} ${args.join(' ')} failed (${r.status}): ${r.stderr}`);
   }
@@ -22,6 +22,31 @@ function resolveBaseRef(root) {
   return null;
 }
 
+const FETCH_TIMEOUT_MS = 8000;
+
+// A remote-tracking base ref is only as fresh as the last fetch, and a cloud session's
+// clone freezes it at container-creation time — so every commit the base branch gained
+// since lands inside `mergeBase..HEAD` and gets billed to the work. That is a wrong
+// verdict, not a stale one: the delta rules (squash-merge-history above all, a *blocking*
+// rule) report other people's commits as introduced by this change, and `--changed`
+// widens to files the change never touched. Refreshing the ref once per run is what makes
+// "the work" mean the work.
+//
+// Best-effort by construction — no network, no remote, a lock held, a slow server: the
+// fetch fails or times out and the run continues against the ref as it stands, exactly as
+// before this existed. It writes ONLY the remote-tracking ref (explicit refspec, no tags):
+// no local branch, no index, no working tree, nothing the session could be surprised by.
+// Set CLAUDINITE_CHECKS_NO_FETCH=1 to skip it (sealed sandboxes, or to pin a base).
+function refreshBaseRef(root, ref) {
+  if (!ref || process.env.CLAUDINITE_CHECKS_NO_FETCH === '1') return;
+  const m = /^([^/]+)\/(.+)$/.exec(ref);
+  if (!m) return; // a local branch is already as current as the checkout — nothing to fetch
+  const [, remote, branch] = m;
+  sh(root, 'git', ['fetch', '--quiet', '--no-tags', remote,
+    `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`],
+  { allowFail: true, timeout: FETCH_TIMEOUT_MS });
+}
+
 function lines(out) {
   return (out || '').split('\n').filter(Boolean);
 }
@@ -253,9 +278,15 @@ export function loadConfig(root) {
 export function buildContext({ root, mode = 'changed', baseOverride = null, transcriptPath = null }) {
   root = resolve(root);
   const baseRef = baseOverride || resolveBaseRef(root);
+  refreshBaseRef(root, baseRef);
   const mergeBase = baseRef ? (gitTry(root, 'merge-base', 'HEAD', baseRef) || '').trim() || null : null;
   // Diffing against HEAD keeps uncommitted work in scope even when no base branch resolves.
   const diffBase = mergeBase || 'HEAD';
+  // Is this commit already on the base branch? `--is-ancestor` exits non-zero for "no",
+  // which gitTry surfaces as null. No base ref to compare against ⇒ nothing is known to
+  // be on it, so nothing is filtered out.
+  const onBaseBranch = (sha) =>
+    !!baseRef && gitTry(root, 'merge-base', '--is-ancestor', sha, baseRef) !== null;
 
   const tracked = lines(gitTry(root, 'ls-files'));
   const untracked = lines(gitTry(root, 'ls-files', '--others', '--exclude-standard'));
@@ -394,13 +425,20 @@ export function buildContext({ root, mode = 'changed', baseOverride = null, tran
     // chain since the merge-base with the base branch (the squash-only effect
     // check, scoped to the work). Empty when no base resolves or the branch is
     // even with it; pre-existing merges already on the base are out of range.
+    //
+    // The range alone trusts the merge-base to be right, and it isn't always: a
+    // shallow clone's grafted boundary or a criss-cross history can hand back a
+    // merge-base that sweeps the base branch's own merges into the range. So each
+    // candidate is confirmed against the base ref itself — a merge already on the
+    // base branch was never introduced here, whatever the range says. Offline and
+    // exact, and it holds when refreshBaseRef couldn't run.
     introducedMergeCommits() {
       if (!mergeBase) return [];
       const out = gitTry(root, 'log', '--merges', '--first-parent', '--format=%h %s', `${mergeBase}..HEAD`);
       return lines(out).map((l) => {
         const i = l.indexOf(' ');
         return { sha: l.slice(0, i), subject: l.slice(i + 1) };
-      });
+      }).filter(({ sha }) => !onBaseBranch(sha));
     },
 
     // Fixed-string search across tracked files; git grep exits 1 on no match.

.claudinite/shared/engine/checks/helpers/work.mjs

@@ -69,6 +69,7 @@ class Work {
   get changedFiles() { return this.ctx.changedFiles; }
   get tracked() { return this.ctx.tracked; }
   read(path) { return this.ctx.read(path); }
+  readBase(path) { return this.ctx.readBase(path); }
   exists(path) { return this.ctx.exists(path); }
   packConfig(id) { return this.ctx.config?.packConfig?.[id]; }
 

.claudinite/shared/engine/pack_loader/pack-registry.mjs

@@ -248,7 +248,7 @@ export const declTokenFor = (pack) =>
 // A `packs` declaration entry is either a plain id string or an entry object
 // `{ id, config?, rules?, accept?, via? }` carrying that pack's own settings
 // (see engine/checks/README.md). This is the one id-extractor every reader shares, so
-// raw-JSON consumers (the SessionStart hooks, the fleet routines) and the
+// raw-JSON consumers (the SessionStart hooks, the fleet signal probe) and the
 // engine agree on both shapes — and on both declaration forms: it returns the
 // BARE pack id, stripping a `local_packs/` namespace where one is declared.
 // Returns undefined for a malformed entry.

.claudinite/shared/engine/scheduler/converge-wiring.mjs

@@ -35,13 +35,36 @@ export const CLAUDE_MD = 'CLAUDE.md';
 // The whole line (and its trailing newline) is removed wherever it appears.
 const CORPUS_IMPORT_RE = /^.*@\.claudinite\/shared\/CLAUDE\.md.*\n?/m;
 
+// The repo Actions secrets its scheduled tasks declare via `required_secrets`,
+// deduped and sorted. Async because task discovery is; pure otherwise.
+export async function declaredSecrets(root, config) {
+  const { discoverTasks } = await import('./discover.mjs');
+  const { tasks } = await discoverTasks(root, config);
+  return [...new Set(tasks.flatMap((t) => t.decl?.required_secrets ?? []))].sort();
+}
+
+// Stamp the declared secrets into the scheduler workflow's engine step, beside
+// GITHUB_TOKEN. This is the whole delivery mechanism: GitHub Actions requires each
+// secret to be named statically in the workflow, and a task's `required_secrets` is
+// exactly that list — so the wiring converge writes it, and a worker then reads
+// `process.env.<NAME>` like any other environment variable. No bundle, no parsing,
+// no engine-side selection. Regenerated from the stub each converge, so the list
+// tracks the declarations rather than accumulating.
+export function withDeclaredSecrets(stubText, names = []) {
+  if (!names.length) return stubText;
+  const lines = names.map((n) => `          ${n}: \${{ secrets.${n} }}`).join('\n');
+  return stubText.replace(/^(\s*GITHUB_TOKEN: \$\{\{ github\.token \}\})$/m, `$1\n${lines}`);
+}
+
 // Re-converge the scheduler workflow to the vendored stub, with the cron minute set
 // to this repo's stable hashed value (never guessed — hash-minute.mjs, a pure
-// function of the full name, so re-vendors and this convergence agree). `stubText`
-// is the vendored stub's content (the caller reads it from the mount). Returns true
-// when the file was written (absent, or drifted from the target).
-export function convergeSchedulerWorkflow(root, fullName, stubText) {
-  const target = stubText.replace(/cron:\s*'[^']*'/, `cron: '${hashedCron(fullName)}'`);
+// function of the full name, so re-vendors and this convergence agree) and the
+// declared `required_secrets` stamped into the engine step's env. `stubText` is the
+// vendored stub's content (the caller reads it from the mount). Returns true when
+// the file was written (absent, or drifted from the target).
+export function convergeSchedulerWorkflow(root, fullName, stubText, secretNames = []) {
+  const target = withDeclaredSecrets(stubText, secretNames)
+    .replace(/cron:\s*'[^']*'/, `cron: '${hashedCron(fullName)}'`);
   const path = join(root, SCHEDULER_WORKFLOW);
   const current = existsSync(path) ? readFileSync(path, 'utf8') : null;
   if (current === target) return false;
@@ -92,9 +115,9 @@ export function removeRetiredCorpusImport(root) {
 
 // Converge every wiring surface, returning a flat summary of what changed (empty
 // when the repo was already converged). `stubText` is the vendored scheduler stub.
-export function convergeWiring(root, fullName, stubText) {
+export function convergeWiring(root, fullName, stubText, secretNames = []) {
   const changed = [];
-  if (convergeSchedulerWorkflow(root, fullName, stubText)) changed.push(SCHEDULER_WORKFLOW);
+  if (convergeSchedulerWorkflow(root, fullName, stubText, secretNames)) changed.push(SCHEDULER_WORKFLOW);
   const hooks = ensureHooks(root);
   for (const h of hooks.added) changed.push(`hook:${h}`);
   if (removeRetiredCorpusImport(root)) changed.push(`removed retired ${CLAUDE_MD} corpus import`);
@@ -111,7 +134,9 @@ async function main() {
   const root = process.env.CLAUDINITE_REPO_ROOT || process.cwd();
   const stubPath = join(root, '.claudinite/shared/engine/scheduler/stubs/claudinite-scheduler.yml');
   if (!existsSync(stubPath)) { console.error(`converge-wiring: vendored stub not found at ${stubPath}`); process.exit(1); }
-  const { changed, error } = convergeWiring(root, fullName, readFileSync(stubPath, 'utf8'));
+  const { loadConfig } = await import('../checks/helpers/repo-context.mjs');
+  const secretNames = await declaredSecrets(root, loadConfig(root));
+  const { changed, error } = convergeWiring(root, fullName, readFileSync(stubPath, 'utf8'), secretNames);
   if (error) console.log(`! ${error}`);
   console.log(changed.length ? `converge-wiring: ${changed.join(', ')}` : 'converge-wiring: already converged');
 }