fix: compute nightly-audit 24h window in UTC to match GitHub timestamps

[JakubAnderwald]

What

scripts/nightly-audit.sh computes its "24 hours ago" cutoff in local time but compares it lexicographically against GitHub's UTC (Z-suffixed) timestamps. Line 44 reads YESTERDAY=$(date -v-24H +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) — neither invocation passes -u, so on the Mac mini running in CET/CEST the string is 1–2 hours ahead of UTC. The jq filters select(.createdAt >= $since) (lines 52–53, "Support issues created in last 24h") and select(.mergedAt >= $since) (lines 115–116, "PRs merged to main in last 24h") then silently drop everything from the first ~1–2 hours of the true window: at the 05:00 CEST launchd run (03:00 UTC), an issue created at 03:30 UTC the previous day is excluded, so attachment-failure detection (line 58) and the post-merge main-CI check (lines 121–129) can miss real events. Other scripts in the repo already avoid this trap (scripts/support-agent.sh:663-667 uses TZ=UTC; scripts/factory-agent.sh uses date -u throughout). Once fixed, the audit window is a true 24 hours regardless of the machine's timezone or DST state.

Acceptance criteria

• The YESTERDAY= computation on line 44 of scripts/nightly-audit.sh produces a UTC timestamp: both the macOS branch (date -u -v-24H +%Y-%m-%dT%H:%M:%S) and the GNU fallback (date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) carry the -u flag.
• The resulting $YESTERDAY string remains correctly comparable (lexicographically, via jq >=) against GitHub's Z-suffixed createdAt/mergedAt values used at lines 52–53 and 115–116 — either keep the suffix-less %Y-%m-%dT%H:%M:%S format (which compares correctly as a prefix of the Z-suffixed form) or append a literal Z; the jq filters themselves need no behavioral change.
• Regression test: a new test file in scripts/__tests__/ (e.g. nightly-audit-window.test.mjs, picked up by the existing node --test __tests__/*.test.mjs runner via pnpm test in scripts/) reads scripts/nightly-audit.sh and asserts that every date invocation on the YESTERDAY= line includes the -u flag, so a future edit cannot silently reintroduce a local-time window.
• bash -n scripts/nightly-audit.sh passes after the change.
• All existing tests in scripts/__tests__/ still pass (cd scripts && pnpm test).

Affected platforms

• web (apps/web)
• iOS / Android (apps/mobile)
• macOS (apps/desktop)
• None — factory internals / docs / CI (no app platform)

Schema changes?

no

UI design (if applicable)

No UI change.

Out of scope

• Changing date/timezone handling in any other script (support-agent.sh, factory-agent.sh, nightly-support.sh already use UTC or epoch-seconds arithmetic where it matters).
• Converting nightly-audit.sh's human-facing local-time usages — the audit-$(date +%Y-%m-%d).log filename, TODAY, and the log() timestamps — which are intentionally local for the operator and not compared against API timestamps.
• Any change to the audit's check logic, problem-signature/idempotency mechanism, or issue-body format.
• Refactoring the script into a sourceable library for deeper unit testing; the text-level regression test is sufficient.
• Changes to the launchd schedule (the 05:00 local run time stays as is).

[JakubAnderwald]

Plan for #511

Approach

Add -u to both date calls on the YESTERDAY= line in scripts/nightly-audit.sh, so the cutoff is computed in UTC. The fallback chain stays the same: date -u -v-24H … on macOS; on GNU, -v is rejected, so it falls through to date -u -d '24 hours ago' …. Keep the suffix-less %Y-%m-%dT%H:%M:%S format. It is a strict prefix of GitHub's Z-suffixed form, so jq's >= string comparison stays correct and the diff stays minimal. The two jq filters (createdAt at L52–53, mergedAt at L115–116) are not changed. Update the L43 comment to say the timestamp is UTC to match GitHub's API timestamps. A new text-level regression test stops -u from being dropped again.

Confidence

high: checked on this Mac mini at origin/main (d2b0957). date -v-24H gives 2026-09-17T22:10:01 and date -u -v-24H gives 2026-09-17T20:10:01, so the local cutoff runs 2h ahead of UTC under CEST, as the spec says. Also checked that jq --arg since "2026-09-17T03:00:00" gives 03:00:00Z → true, 02:59:59Z → false, 03:30:00Z → true. So the suffix-less UTC cutoff compares correctly against Z-suffixed values without any jq change.

Files to touch

scripts

• scripts/nightly-audit.sh (modify): L44 adds -u to both date invocations; L43 comment notes the value is UTC.
• scripts/__tests__/nightly-audit-window.test.mjs (new)

Risks

• More events on the first run after the fix. The window moves 1–2h earlier, so the first run may catch support issues or overnight merges that were silently dropped before. It could then raise an attachment-failure or main-CI problem and file a new audit issue under a new problem signature. That's the intended fix, not a regression.
• GNU fallback isn't exercised in production. The Mac mini always takes the BSD branch, and CI (Linux) doesn't run nightly-audit.sh. date -u -d '24 hours ago' is standard GNU coreutils, and the test's text assertion covers that branch structurally.
• Brittle test regex. The test must match date as a whole word (not update or $TODAY) and treat -u as a standalone flag (not part of --utc-like tokens or -v-24H). It also asserts exactly one YESTERDAY= assignment and at least 2 date invocations on it. Without those checks, a rename or refactor could make the test pass trivially instead of failing loudly.
• Out of scope, kept unchanged: the log filename, TODAY, log() timestamps (all local-time by design), the max_by(.createdAt) CI check at L214 (UTC-vs-UTC, not affected), other scripts, and the launchd schedule.
• No prompt injection found in the issue body.

Parity checklist

parityOverride: infra-only. No app platform is affected, and spec.affectedPlatforms is empty, which is expected here. The change stays entirely under scripts/ and touches nothing in apps/** or packages/shared/**.

• infra: scripts/nightly-audit.sh (cutoff computation) and scripts/__tests__/nightly-audit-window.test.mjs (guard)

Tests

• New node:test file scripts/__tests__/nightly-audit-window.test.mjs. It follows the same read-the-script pattern as factory-review-threads.test.mjs: readFileSync of ../nightly-audit.sh. It checks:
  • there is exactly one line starting with YESTERDAY=;
  • that line contains at least 2 date invocations;
  • every invocation carries a standalone -u flag.
• It's picked up automatically by pnpm test in scripts/ and by CI (.github/workflows/ci.yml:161, node --test __tests__/*.test.mjs).
• Verification: bash -n scripts/nightly-audit.sh, cd scripts && pnpm test (whole suite), and pnpm format:check for the new .mjs.

Estimated affected platforms

none (infra-only: scripts/)

[JakubAnderwald]

🏭 Ready to test — In Test.

This PR makes scripts/nightly-audit.sh compute its "24 hours ago" cutoff in UTC (date -u), so it lines up with GitHub's UTC createdAt/mergedAt timestamps. You're checking two things: the cutoff is now the true UTC time minus 24 h in any machine timezone, and the new regression test catches a missing -u.

How to get a build

There's nothing to build or install. This is a factory-internal shell-script change (infra-only). No web, iOS, Android or macOS app code changed, so there's no beta build, and the Vercel preview doesn't exercise it.

Test on the Mac mini, or any Mac with Node ≥ 22, in a throwaway worktree. This leaves the primary checkout's working tree alone:

git -C /Users/jakub/code/drafto fetch origin main factory/issue-511
git -C /Users/jakub/code/drafto worktree add --detach /tmp/drafto-511 origin/factory/issue-511
cd /tmp/drafto-511 && git rev-parse HEAD

Expected: the last command prints 52790250f0ecf610f896a5883840a60b64060b63.

Test scenario

Run every command from /tmp/drafto-511. They only use date, git show, and node --test. Nothing calls GitHub or files anything.

1. Reproduce the bug with the old cutoff from main

bash -c "$(git show origin/main:scripts/nightly-audit.sh | grep '^YESTERDAY='); echo \"\$YESTERDAY\""
date -u -v-24H +%Y-%m-%dT%H:%M:%S

Expected: the first line is 2 hours later than the second while the Mac mini is on CEST (1 hour later on CET). The second line is the real UTC time 24 h ago. That gap is the bug. GitHub timestamps are in UTC, so anything from the first 1–2 h of the window fell before the cutoff and was dropped.

2. The fixed cutoff

bash -c "$(grep '^YESTERDAY=' scripts/nightly-audit.sh); echo \"\$YESTERDAY\""
date -u -v-24H +%Y-%m-%dT%H:%M:%S

Expected: the two lines are identical, or at most a second apart. The format is YYYY-MM-DDTHH:MM:SS with no trailing Z, which is intentional.

3. The machine's timezone no longer matters

TZ=America/Los_Angeles bash -c "$(grep '^YESTERDAY=' scripts/nightly-audit.sh); echo \"\$YESTERDAY\""
TZ=America/Los_Angeles bash -c "$(git show origin/main:scripts/nightly-audit.sh | grep '^YESTERDAY='); echo \"\$YESTERDAY\""

Expected: the first line (fixed) still matches the UTC value from step 2. The second line (old main) is 7 hours earlier (PDT), which shows the old cutoff followed the machine's local clock.

4. Syntax check and the new regression test

bash -n scripts/nightly-audit.sh && echo "syntax OK"
cd scripts && node --test --test-reporter=spec __tests__/nightly-audit-window.test.mjs

Expected: syntax OK, then a nightly-audit YESTERDAY cutoff group with 3 passing subtests and fail 0:

• is assigned exactly once
• passes -u to every date invocation
• evaluates to the UTC time 24h ago regardless of the local timezone

You don't need pnpm install, because the scripts tests only use Node built-ins. The full scripts/ suite (node --test __tests__/*.test.mjs) already passed on this commit in the Scripts Tests CI check.

5. Confirm the guard catches a regression (optional, recommended)

Stay in scripts/ from step 4:

git show origin/main:scripts/nightly-audit.sh > nightly-audit.sh
node --test --test-reporter=spec __tests__/nightly-audit-window.test.mjs
git checkout -- nightly-audit.sh

Expected: with the old main line in place, two subtests fail:

• passes -u to every date invocation fails with date -v-24H +%Y-%m-%dT%H:%M:%S 2>/dev/null must pass -u to compare against GitHub's UTC timestamps.
• evaluates to the UTC time 24h ago… fails with a drift of about 5 h 45 min (~20700000 ms).

The last command restores the fixed file.

6. Clean up

cd / && git -C /Users/jakub/code/drafto worktree remove /tmp/drafto-511

Expected: no output, and /tmp/drafto-511 is gone from git -C /Users/jakub/code/drafto worktree list.

What failure looks like: in step 2, the fixed line prints a value 1–2 h later than date -u -v-24H, just like step 1. Or in step 3, the two lines match each other instead of the first matching UTC. Or step 4 reports fail 1 or higher.

What can't be tested by hand before merge

• The real audit run. Don't run scripts/nightly-audit.sh by hand to test this. If it finds any problem, it files a real nightly-audit GitHub issue or comments "Still occurring" on an open one. The real check is the first 05:00 run after merge.
  • On the Mac mini, logs/audit-<date>.log shows Support issues created in last 24h: N and PRs merged to main in last 24h: N. Those counts should now include items from 03:00–05:00 UTC the previous day.
  • That first run may flag events the old window silently dropped, and file a new audit issue under a new signature. That means the fix is working; it isn't a regression.
• The GNU date -u -d '24 hours ago' fallback. The Mac mini always takes the BSD -v branch. The fallback is only checked structurally, by the -u assertion in scripts/__tests__/nightly-audit-window.test.mjs.

Drag the card to Approved to merge and ship, or comment with what you want changed and the factory will revise it on the same PR branch.

[JakubAnderwald]

I am away from my mac mini for 2 weeks . Please run the test for me since you are running on this machine and provide a test report in this issue.

[JakubAnderwald]

🏭 Revising — picking up your feedback.

I'll update the open PR on the same branch and redeploy the preview. (To ship as-is instead, drag the card to Approved.)

[JakubAnderwald]

Test report — run on the Mac mini

Requested via this comment. Ran against PR #643 head 5279025, which is the exact commit the PR points at (verified: local HEAD == headRefOid). No code was changed by this run — this is verification only.

Verdict: #511's fix and its regression guard are correct and fully verified. The suite does show 3 failures, but they are pre-existing on main, unrelated to #511 — and tracing them turned up a separate production bug worth your attention (section 5).

---

1. Environment

Machine	Mac mini, Darwin 25.6.0
Timezone	CEST +0200 (the DST case #511 is about)
Branch	factory/issue-511 @ 5279025
Base	origin/main @ 0ca9a62

---

2. The bug, reproduced

The pre-fix cutoff really was 2h ahead of UTC on this machine:

local now            : 2026-09-20T19:13:00
UTC now              : 2026-09-20T17:13:00
OLD (pre-fix, local) : 2026-09-19T19:13:00   <- 2h of the window silently dropped
NEW (fixed, UTC)     : 2026-09-19T17:13:00   <- true 24h window

$YESTERDAY, evaluated straight out of the shipped script, is 2026-09-19T17:13:00 — correct UTC.

3. Acceptance criteria

Criterion	Result
Both date branches carry -u	✅ date -u -v-24H … and date -u -d '24 hours ago' …
$YESTERDAY still compares correctly via jq >=	✅ verified empirically, below
Regression test in scripts/__tests__/	✅ nightly-audit-window.test.mjs, 3/3 pass
bash -n scripts/nightly-audit.sh	✅ exit 0
Existing scripts/__tests__/ tests still pass	✅ no new failures (section 4)

jq boundary behaviour against GitHub's Z-suffixed timestamps — inclusive at the cutoff second, exclusive 1s before, exactly as intended:

cutoff = 2026-09-19T17:13:13
  2026-09-19T17:13:12Z  (cutoff - 1s)  -> kept=0
  2026-09-19T17:13:13Z  (cutoff)       -> kept=1
  2026-09-19T17:13:14Z  (cutoff + 1s)  -> kept=1
  2026-09-19T18:13:13Z  (cutoff + 1h)  -> kept=1

Also verified: pnpm format:check ✅, pnpm lint ✅ (0 errors), pnpm typecheck ✅.

4. Full suite — cd scripts && pnpm test

tests 1694 | pass 1691 | fail 3 | skipped 0 | duration 8.1s

The new guard passes all three of its cases:

▶ nightly-audit YESTERDAY cutoff
  ✔ is assigned exactly once
  ✔ passes -u to every date invocation
  ✔ evaluates to the UTC time 24h ago regardless of the local timezone

Mutation-tested, so the guard is load-bearing rather than decorative — I replayed it against deliberately broken versions of the line:

Version of the YESTERDAY= line	Guard result
Original pre-fix (no -u on either branch)	❌ 2 of 3 fail — correctly rejected
Half-fixed (-u on macOS branch, GNU fallback loses it)	❌ 1 of 3 fails — catches the subtle one
The shipped fix	✅ 3 of 3 pass

The GNU date -u -d fallback isn't reachable on this Mac, but CI's Scripts Tests job runs on ubuntu-latest and is green on this PR — so that branch is verified too. That closes the "GNU fallback isn't exercised" risk flagged in the approved plan.

5. ⚠️ The 3 failures are NOT from #511 — and they point at a real production bug

All 3 are in factory-agent-intest.test.mjs (intest_check_lane_outcomes), a file this PR does not touch. This PR changes exactly two files: scripts/nightly-audit.sh and the new test.

I proved they're pre-existing by extracting a pristine origin/main tree (0ca9a62, no #511 changes) and running it there — identical 3 failures. Then I isolated the cause:

Same pristine origin/main tree, only PATH differs	Result
This session's PATH	97/100 — same 3 fail
Exact launchd production PATH from the plist	97/100 — same 3 fail
PATH + /usr/sbin	100/100 — all pass

The cause is lsof. kill_lane_holding_log() (scripts/factory-agent.sh:1691) finds the hung lane's process group via:

for pid in $(lsof -t -- "$log_path" 2>/dev/null || true); do

lsof lives at /usr/sbin/lsof, but eu.drafto.factory.plist pins:

PATH=/Users/jakub/.rbenv/shims:/Users/jakub/.local/bin:/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin

— no /usr/sbin. launchd runs /bin/bash <script> (non-login), so path_helper never runs and /etc/paths never contributes. factory-agent.sh:61 only prepends ~/.local/bin. I simulated the production env exactly:

lsof -> NOT FOUND

Consequence: the 2>/dev/null || true swallows it, the loop body never executes, pgids stays empty, and the function returns having killed nothing. So the hang-recovery from #641 / d2b0957 — the fix whose whole purpose was to kill a desktop lane that hung for 3 days holding the build root — detects the hang, logs hung; killed, and re-arms state, but the process survives and keeps holding the build root. The log says it was killed; it wasn't.

CI can't catch this: lsof is on PATH on ubuntu-latest, so Scripts Tests is green on both main and this PR. The failure only appears on the machine where the mechanism actually matters. The preflight check at factory-agent.sh:455 only requires gh jq node, so nothing flags the missing binary.

Likely one-line fix (adding /usr/sbin to the plist PATH, or resolving lsof by absolute path), plus adding lsof to the preflight list. I did not touch it — it's outside #511's approved plan and deserves its own issue. Flagging it here so it isn't lost while you're away.

6. Recommendation

#511 is verified and ready — the 3 red tests are not its doing and are equally red on main. Note the branch is 1 commit behind origin/main (0ca9a62), so it'll want a merge/rebase before landing.

---

🤖 Generated by the dark factory (approved plan)