From b26a991cd02d0d41f78d38be8d82ba1ddad2e1f9 Mon Sep 17 00:00:00 2001
From: William Thorsen <william@thorsen.dev>
Date: Tue, 9 Jun 2026 03:36:57 -0700
Subject: [PATCH] feat!: Adopt explicit-UTC second-precision timestamps for KB
 date fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

KB assertion date fields and event capture timestamps are now stored as explicit-UTC second-precision timestamps (`YYYY-MM-DDTHH:MM:SSZ`) sourced from a single authoritative clock, replacing the previous date-only form. Frontmatter validation accepts both the timestamp form and the legacy bare `YYYY-MM-DD` form, so date-only notes already in existing stores stay valid; this dual-accept policy is permanent, not a migration window.

Notes written by `kb-add` derive their creation, update, and verification dates from one instant, so a note can no longer be born already marked verified before it was created. The `--last-verified` flag is removed: an agent can no longer supply a verification date from its own clock, which near the UTC-midnight boundary could disagree with the writer's clock and produce a verified-before-created record. Passing the flag now reports an unknown-flag error.

Staleness detection and freshness ranking are unchanged in granularity — both date forms resolve to identical whole-day ages — while a stored value matching neither form now yields no age rather than a best-effort, possibly wrong one. Malformed values, including a timestamp missing the `Z` marker, an offset form, an unreal calendar date, or an unreal clock time, are rejected.

Because a freshly added note now always carries a verification date, adding the first note to a vault that previously had none enables vault-wide verification-staleness checks: `kb-curate` then surfaces older notes lacking a verification date as re-verification candidates.
---
 .../agents/content/skills/kb-add/SKILL.md     | 17 ++--
 .../agents/scripts/bundle-skill-helpers.ts    | 25 +++---
 .../src/capture-event/__tests__/cli.test.ts   |  4 +-
 packages/agents/src/capture-event/cli.ts      |  3 +-
 .../agents/src/kb-add/__tests__/cli.test.ts   | 12 +--
 .../src/kb-add/__tests__/prepare-note.test.ts | 30 ++------
 packages/agents/src/kb-add/cli.ts             |  5 +-
 packages/agents/src/kb-add/prepare-note.ts    | 18 ++---
 packages/agents/src/kb-add/types.ts           |  4 +-
 .../agents/src/kb-edit/__tests__/cli.test.ts  |  2 +-
 .../operations/__tests__/append.test.ts       |  2 +-
 .../operations/__tests__/bump-updated.test.ts |  2 +-
 .../operations/__tests__/retag.test.ts        |  2 +-
 .../__tests__/supersede-with.test.ts          |  4 +-
 .../operations/__tests__/verify.test.ts       | 19 ++++-
 .../agents/src/kb-edit/operations/append.ts   |  8 +-
 .../src/kb-edit/operations/bump-updated.ts    | 14 ++--
 .../agents/src/kb-edit/operations/retag.ts    |  4 +-
 .../src/kb-edit/operations/supersede-with.ts  |  4 +-
 .../agents/src/kb-edit/operations/verify.ts   |  4 +-
 .../kb-shared/__tests__/note-helpers.test.ts  | 52 ++++++++++---
 packages/agents/src/kb-shared/note-helpers.ts | 20 +++--
 packages/kb/src/create/render-seeds.ts        |  3 +
 .../fixtures/parity/expected-findings.json    |  2 +-
 .../rules/__tests__/frontmatter-rule.test.ts  | 77 +++++++++++++++++++
 packages/kb/src/rules/frontmatter-rule.ts     | 35 ++++++---
 packages/kb/src/types.ts                      |  4 +-
 27 files changed, 254 insertions(+), 122 deletions(-)

diff --git a/packages/agents/content/skills/kb-add/SKILL.md b/packages/agents/content/skills/kb-add/SKILL.md
index d2e23704..7cec742d 100644
--- a/packages/agents/content/skills/kb-add/SKILL.md
+++ b/packages/agents/content/skills/kb-add/SKILL.md
@@ -14,14 +14,13 @@ The split is deliberate: the helper is narrow and mechanical; the classification
 
 ## Arguments
 
-| Argument          | Description                                                                             | Required |
-| ----------------- | --------------------------------------------------------------------------------------- | -------- |
-| `--diataxis`      | The note's Diátaxis label (e.g. `howto`, `concept`, `reference`, `tutorial`).           | No       |
-| `--title`         | The note title; also doubles as the filename.                                           | Yes      |
-| `--kb`            | Explicit knowledge base name; overrides the discovered `.kb/` and the registry default. | No       |
-| `--folder`        | KB-relative folder under which to write the note. Defaults to the KB root.              | No       |
-| `--tags`          | Comma-separated tag list. Known aliases are canonicalized at write time.                | No       |
-| `--last-verified` | `YYYY-MM-DD` date the note's claims were last verified.                                 | No       |
+| Argument     | Description                                                                             | Required |
+| ------------ | --------------------------------------------------------------------------------------- | -------- |
+| `--diataxis` | The note's Diátaxis label (e.g. `howto`, `concept`, `reference`, `tutorial`).           | No       |
+| `--title`    | The note title; also doubles as the filename.                                           | Yes      |
+| `--kb`       | Explicit knowledge base name; overrides the discovered `.kb/` and the registry default. | No       |
+| `--folder`   | KB-relative folder under which to write the note. Defaults to the KB root.              | No       |
+| `--tags`     | Comma-separated tag list. Known aliases are canonicalized at write time.                | No       |
 
 A value-bearing flag accepts both `--diataxis howto` and `--diataxis=howto`. The note body is read from stdin to EOF; an empty body is allowed when a stub note is appropriate.
 
@@ -79,7 +78,7 @@ Pipe the composed body to the bundled helper. A heredoc keeps multi-line bodies
 cat <<'EOF' | node "$(dirname "$SKILL_PATH")/kb-add.mjs" \
   --diataxis <label> --title "<title>" \
   [--kb <name>] [--folder <kb-relative-folder>] \
-  [--tags <comma,separated>] [--last-verified YYYY-MM-DD]
+  [--tags <comma,separated>]
 <note body, may span multiple lines and contain any characters>
 EOF
 ```
diff --git a/packages/agents/scripts/bundle-skill-helpers.ts b/packages/agents/scripts/bundle-skill-helpers.ts
index 7dd43a04..432bbd98 100644
--- a/packages/agents/scripts/bundle-skill-helpers.ts
+++ b/packages/agents/scripts/bundle-skill-helpers.ts
@@ -1,5 +1,5 @@
 /**
- * Build step: bundle each skill's TypeScript helper into a single self-contained `.mjs` placed inside
+ * Build step: Bundle each skill's TypeScript helper into a single self-contained `.mjs` placed inside
  * the skill's content directory.
  *
  * A skill installs to a platform directory outside the monorepo, so it cannot import a private workspace package.
@@ -186,7 +186,7 @@ function makeDeriveSessionContextSmokeTest(): SmokeTestInvocation {
   };
 }
 
-/** Assert the deriver emitted the expected field set for the smoke fixture. */
+/** Asserts that the deriver emitted the expected field set for the smoke fixture. */
 function assertDeriveSessionContextOutput(result: unknown): void {
   if (!isRecord(result)) {
     throw new TypeError('expected object result from derive-session-context');
@@ -217,11 +217,10 @@ function assertDeriveSessionContextOutput(result: unknown): void {
 }
 
 /**
- * Type guard: narrows `value` to a plain object with unknown property values.
+ * Type guard: Narrows `value` to a plain object with unknown property values.
  *
- * Intentionally kept local rather than imported from `src/lib/type-guards.ts`: this build
- * script sits outside the runtime surface, and importing runtime source into build tooling
- * would couple the two for the sake of a one-line guard.
+ * Intentionally kept local rather than imported from `src/lib/type-guards.ts`: This build script sits outside the
+ * runtime surface; importing runtime source into build tooling would couple the two for the sake of a one-line guard.
  */
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null;
@@ -234,8 +233,8 @@ function isRecord(value: unknown): value is Record<string, unknown> {
  * the fixture dir so the dev's real `~/.claude/kb.yaml` does not pollute KB resolution.
  *
  * The fixture is process-lifetime — `mkdtempSync` runs at module load and the OS reclaims short-lived temp
- * directories without explicit cleanup. The seed note's `updated:` field is bumped by every invocation;
- * `--bump-updated` is idempotent at the field level so re-runs within the same day are no-ops on disk.
+ * directories without explicit cleanup. The seed note's `updated:` field is rewritten to the current instant
+ * on every invocation.
  */
 function makeKbEditSmokeTest(): SmokeTestInvocation {
   const fixtureDir = mkdtempSync(path.join(tmpdir(), 'kb-edit-smoke-'));
@@ -254,7 +253,7 @@ function makeKbEditSmokeTest(): SmokeTestInvocation {
   };
 }
 
-/** Assert the kb-edit smoke produced an ok bump-updated result with a today-shaped `updated:` field. */
+/** Asserts that the kb-edit smoke produced an ok bump-updated result with second-precision UTC `updated:` timestamp. */
 function assertKbEditSmokeResult(result: unknown): void {
   if (!isRecord(result)) {
     throw new TypeError('expected object result from kb-edit');
@@ -269,8 +268,8 @@ function assertKbEditSmokeResult(result: unknown): void {
   if (!isRecord(frontmatter)) {
     throw new TypeError('expected frontmatter object on kb-edit result');
   }
-  if (typeof frontmatter.updated !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(frontmatter.updated)) {
-    throw new Error(`expected updated to be YYYY-MM-DD, got ${JSON.stringify(frontmatter.updated)}`);
+  if (typeof frontmatter.updated !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(frontmatter.updated)) {
+    throw new Error(`expected updated to be YYYY-MM-DDTHH:MM:SSZ, got ${JSON.stringify(frontmatter.updated)}`);
   }
 }
 
@@ -301,8 +300,8 @@ function makeKbCurateSmokeTest(): SmokeTestInvocation {
 }
 
 /**
- * Assert the kb-curate smoke produced an ok read-only report that actually enumerated the seed note. The seed note
- * carries an unresolved wikilink, so a non-empty enumeration always surfaces a `wikilinks.unresolved` finding; its
+ * Asserts that the kb-curate smoke produced an ok read-only report that actually enumerated the seed note. The seed
+ * note carries an unresolved wikilink, so a non-empty enumeration always surfaces a `wikilinks.unresolved` finding; its
  * absence means the bundle enumerated nothing — a broken `content/` scoping must fail here rather than pass with an
  * empty report.
  */
diff --git a/packages/agents/src/capture-event/__tests__/cli.test.ts b/packages/agents/src/capture-event/__tests__/cli.test.ts
index 862e972f..10649255 100644
--- a/packages/agents/src/capture-event/__tests__/cli.test.ts
+++ b/packages/agents/src/capture-event/__tests__/cli.test.ts
@@ -124,7 +124,7 @@ describe(normalizeRemoteUrl, () => {
 });
 
 describe(runCapture, () => {
-  it('writes recordType: event and returns a ULID id and ISO capturedAt', async () => {
+  it('writes recordType: event and returns a ULID id and second-precision capturedAt', async () => {
     const { home } = await makeStore('codeassembly');
     const repo = await makeRepoWithRemote('git@github.com:williamthorsen/codeassembly.git');
 
@@ -140,7 +140,7 @@ describe(runCapture, () => {
     expect(result.ok).toBe(true);
     if (result.ok) {
       expect(result.id).toMatch(/^[0-9A-HJKMNP-TV-Z]{26}$/);
-      expect(result.capturedAt).toBe('2026-06-04T06:57:22.000Z');
+      expect(result.capturedAt).toBe('2026-06-04T06:57:22Z');
       expect(result.store).toBe('codeassembly');
       const written = await readFile(result.path, 'utf8');
       expect(written).toMatch(/^recordType: event$/m);
diff --git a/packages/agents/src/capture-event/cli.ts b/packages/agents/src/capture-event/cli.ts
index a6532d23..a855b520 100644
--- a/packages/agents/src/capture-event/cli.ts
+++ b/packages/agents/src/capture-event/cli.ts
@@ -12,6 +12,7 @@ import type { KbRoot } from '@codeassembly/kb';
 import { loadSchema } from '@codeassembly/kb/schema';
 import { ulid } from 'ulid';
 
+import { formatUtcTimestamp } from '../kb-shared/note-helpers.ts';
 import { resolveStoreByName } from '../kb-shared/resolve-store-by-name.ts';
 import { isEnoent } from '../lib/type-guards.ts';
 import { prepareEvent } from './prepare-event.ts';
@@ -113,7 +114,7 @@ export async function runCapture(input: {
     args,
     context,
     id: ulid(),
-    capturedAt: input.now.toISOString(),
+    capturedAt: formatUtcTimestamp(input.now),
     schema,
     body,
   });
diff --git a/packages/agents/src/kb-add/__tests__/cli.test.ts b/packages/agents/src/kb-add/__tests__/cli.test.ts
index 374d0773..492d8e4e 100644
--- a/packages/agents/src/kb-add/__tests__/cli.test.ts
+++ b/packages/agents/src/kb-add/__tests__/cli.test.ts
@@ -39,7 +39,7 @@ async function runChild(input: {
 }
 
 const NOW = new Date('2026-05-24T14:35:00Z');
-const TODAY = '2026-05-24';
+const TODAY = '2026-05-24T14:35:00Z';
 
 /** Build a Readable stream that emits the given body and ends. */
 function bodyStream(body: string): Readable {
@@ -66,8 +66,6 @@ describe(parseArgs, () => {
       'My note',
       '--tags',
       'one, two,three',
-      '--last-verified',
-      '2026-01-15',
     ]);
 
     expect(parsed).toEqual({
@@ -76,7 +74,6 @@ describe(parseArgs, () => {
       diataxis: 'howto',
       title: 'My note',
       tags: ['one', 'two', 'three'],
-      lastVerified: '2026-01-15',
     });
   });
 
@@ -94,7 +91,6 @@ describe(parseArgs, () => {
     expect(parsed.kb).toBeNull();
     expect(parsed.folder).toBeNull();
     expect(parsed.tags).toEqual([]);
-    expect(parsed.lastVerified).toBeNull();
   });
 
   it('defaults --diataxis to null when omitted', () => {
@@ -118,6 +114,10 @@ describe(parseArgs, () => {
   it('rejects the retired --type flag as unknown', () => {
     expect(() => parseArgs(['--type', 'howto', '--title', 'X'])).toThrow(/unknown flag/);
   });
+
+  it('rejects the retired --last-verified flag as unknown', () => {
+    expect(() => parseArgs(['--last-verified', '2026-01-15', '--title', 'X'])).toThrow(/unknown flag/);
+  });
 });
 
 describe(runAdd, () => {
@@ -138,6 +138,8 @@ describe(runAdd, () => {
       expect(result.kb.source).toBe('discovered');
       expect(result.frontmatter.title).toBe('Working with streams');
       expect(result.frontmatter.created).toBe(TODAY);
+      expect(result.frontmatter.updated).toBe(TODAY);
+      expect(result.frontmatter.extra['last-verified']).toBe(TODAY);
       const content = await readFile(result.path, 'utf8');
       expect(content).toContain('title: Working with streams');
       expect(content).toContain('How to work with Node streams.');
diff --git a/packages/agents/src/kb-add/__tests__/prepare-note.test.ts b/packages/agents/src/kb-add/__tests__/prepare-note.test.ts
index 85f758b2..1195913a 100644
--- a/packages/agents/src/kb-add/__tests__/prepare-note.test.ts
+++ b/packages/agents/src/kb-add/__tests__/prepare-note.test.ts
@@ -8,7 +8,7 @@ import { prepareNote } from '../prepare-note.ts';
 import type { ParsedArgs } from '../types.ts';
 
 const NOW = new Date('2026-05-24T14:35:00Z');
-const TODAY = '2026-05-24';
+const TODAY = '2026-05-24T14:35:00Z';
 
 const baseArgs: ParsedArgs = {
   kb: null,
@@ -16,7 +16,6 @@ const baseArgs: ParsedArgs = {
   diataxis: 'howto',
   title: 'Working with Node streams',
   tags: ['streams'],
-  lastVerified: null,
 };
 
 const emptyAliases: AliasMap = new Map();
@@ -55,13 +54,14 @@ describe(prepareNote, () => {
     }
   });
 
-  it('fills in UTC created and updated dates from now', () => {
+  it('stamps created, updated, and last-verified from one second-precision instant', () => {
     const result = prepareNote({ args: baseArgs, schema: defaultSchema, aliases: emptyAliases, now: NOW });
 
     expect(result.ok).toBe(true);
     if (result.ok) {
       expect(result.prepared.frontmatter.created).toBe(TODAY);
       expect(result.prepared.frontmatter.updated).toBe(TODAY);
+      expect(result.prepared.frontmatter.extra['last-verified']).toBe(TODAY);
     }
   });
 
@@ -102,18 +102,8 @@ describe(prepareNote, () => {
     }
   });
 
-  it('emits last-verified into the extra map when supplied', () => {
-    const args: ParsedArgs = { ...baseArgs, lastVerified: '2026-01-15' };
-    const result = prepareNote({ args, schema: defaultSchema, aliases: emptyAliases, now: NOW });
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.prepared.frontmatter.extra['last-verified']).toBe('2026-01-15');
-    }
-  });
-
   it('round-trips: rendered frontmatter re-parses back to the prepared shape', () => {
-    const args: ParsedArgs = { ...baseArgs, lastVerified: '2026-01-15', tags: ['node.js', 'streams'] };
+    const args: ParsedArgs = { ...baseArgs, tags: ['node.js', 'streams'] };
     const result = prepareNote({ args, schema: defaultSchema, aliases, now: NOW });
 
     expect(result.ok).toBe(true);
@@ -126,18 +116,8 @@ describe(prepareNote, () => {
         created: TODAY,
         updated: TODAY,
         tags: ['nodejs', 'streams'],
-        extra: { diataxis: 'howto', 'last-verified': '2026-01-15' },
+        extra: { diataxis: 'howto', 'last-verified': TODAY },
       });
     }
   });
-
-  it('refuses to proceed when last-verified is not a valid YYYY-MM-DD date', () => {
-    const args: ParsedArgs = { ...baseArgs, lastVerified: '2026-99-99' };
-    const result = prepareNote({ args, schema: defaultSchema, aliases: emptyAliases, now: NOW });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.findings.some((finding) => finding.rule === 'frontmatter.date')).toBe(true);
-    }
-  });
 });
diff --git a/packages/agents/src/kb-add/cli.ts b/packages/agents/src/kb-add/cli.ts
index ddb46f1a..5ce90a52 100644
--- a/packages/agents/src/kb-add/cli.ts
+++ b/packages/agents/src/kb-add/cli.ts
@@ -16,7 +16,7 @@ import type { AddResult, ParsedArgs } from './types.ts';
 import { writeNote } from './write-note.ts';
 
 /** Flag names that take a value. */
-const VALUE_FLAGS = ['kb', 'folder', 'diataxis', 'title', 'tags', 'last-verified'] as const;
+const VALUE_FLAGS = ['kb', 'folder', 'diataxis', 'title', 'tags'] as const;
 type ValueFlag = (typeof VALUE_FLAGS)[number];
 
 /** Executes the helper from `process.argv` and writes the JSON result to stdout. */
@@ -85,7 +85,6 @@ export function parseArgs(argv: readonly string[]): ParsedArgs {
     diataxis: raw.diataxis ?? null,
     title,
     tags: raw.tags === undefined ? [] : parseTagList(raw.tags),
-    lastVerified: raw['last-verified'] ?? null,
   };
 }
 
@@ -224,7 +223,7 @@ function isEntryPoint(): boolean {
   }
 }
 
-/** Matches a `--kb`/`--folder`/`--title`/`--tags`/`--last-verified` flag (and the optional `--diataxis` Diátaxis label), returning its key and any inline `=value`. */
+/** Matches a `--kb`/`--folder`/`--title`/`--tags` flag (and the optional `--diataxis` Diátaxis label), returning its key and any inline `=value`. */
 function matchValueFlag(arg: string): { key: ValueFlag; inlineValue: string | null } | null {
   for (const key of VALUE_FLAGS) {
     if (arg === `--${key}`) {
diff --git a/packages/agents/src/kb-add/prepare-note.ts b/packages/agents/src/kb-add/prepare-note.ts
index 45678aae..e78d58b1 100644
--- a/packages/agents/src/kb-add/prepare-note.ts
+++ b/packages/agents/src/kb-add/prepare-note.ts
@@ -3,7 +3,7 @@ import { parseNoteContent, writeFrontmatter } from '@codeassembly/kb/frontmatter
 import { frontmatterRule, runRules } from '@codeassembly/kb/rules';
 import { canonicalize } from '@codeassembly/kb/tags';
 
-import { dedupeInOrder, formatUtcDate } from '../kb-shared/note-helpers.ts';
+import { dedupeInOrder, formatUtcTimestamp } from '../kb-shared/note-helpers.ts';
 import type { ParsedArgs, PreparedNote } from './types.ts';
 
 /** Successful preparation: a fully-typed `Frontmatter` plus the canonicalization audit trail. */
@@ -22,11 +22,11 @@ export interface PrepareFailure {
 export type PrepareOutcome = PrepareSuccess | PrepareFailure;
 
 /**
- * Composes a typed `Frontmatter` from parsed CLI args, fills in UTC `created` and `updated` dates, canonicalizes
- * tags via the supplied alias map, and validates the result against the destination KB's schema using the
- * `frontmatterRule` from kb. Every note carries `recordType: assertion` as the stored discriminant — `kb-add` only
- * writes assertions. Any Diátaxis label the agent supplies via `--diataxis` is a vault facet, written to the note's
- * `extra` fields rather than a top-level field.
+ * Composes a typed `Frontmatter` from parsed CLI args, stamps `created`, `updated`, and `last-verified` from one
+ * second-precision UTC instant so the note is born verified, canonicalizes tags via the supplied alias map, and
+ * validates the result against the destination KB's schema using the `frontmatterRule` from kb. Every note carries
+ * `recordType: assertion` as the stored discriminant — `kb-add` only writes assertions. Any Diátaxis label the agent
+ * supplies via `--diataxis` is a vault facet, written to the note's `extra` fields rather than a top-level field.
  *
  * Validation is performed by round-tripping the rendered frontmatter through `parseNoteContent` and feeding the parsed
  * note through `runRules`. The round trip is the cheapest way to give the rule a real `ParsedNote` carrying valid
@@ -42,15 +42,13 @@ export function prepareNote(input: { args: ParsedArgs; schema: Schema; aliases:
   // original list intact for the audit trail and deduplicate the written tag list in first-occurrence order so the
   // note doesn't ship `['nodejs', 'nodejs']`.
   const canonicalTags = dedupeInOrder(originalTags.map((tag) => canonicalize(tag, aliases)));
-  const today = formatUtcDate(now);
+  const today = formatUtcTimestamp(now);
 
   const extra: Record<string, unknown> = {};
   if (args.diataxis !== null) {
     extra.diataxis = args.diataxis;
   }
-  if (args.lastVerified !== null) {
-    extra['last-verified'] = args.lastVerified;
-  }
+  extra['last-verified'] = today;
 
   const frontmatter: Frontmatter = {
     title: args.title,
diff --git a/packages/agents/src/kb-add/types.ts b/packages/agents/src/kb-add/types.ts
index e4e2bb69..632d8afd 100644
--- a/packages/agents/src/kb-add/types.ts
+++ b/packages/agents/src/kb-add/types.ts
@@ -20,13 +20,11 @@ export interface ParsedArgs {
   title: string;
   /** The proposed tag list, in the order the agent supplied them. */
   tags: string[];
-  /** Optional `last-verified` date (`YYYY-MM-DD`). */
-  lastVerified: string | null;
 }
 
 /** The prepared note ready to be written: the rendered frontmatter, the body, and the canonicalization audit trail. */
 export interface PreparedNote {
-  /** Frontmatter with canonical tags, UTC dates filled in, and the optional `last-verified` field merged into `extra`. */
+  /** Frontmatter with canonical tags and a born-verified triad: `created`, `updated`, and the `extra['last-verified']` field stamped from one instant. */
   frontmatter: Frontmatter;
   /** Tag list as the agent supplied it, before alias canonicalization. */
   originalTags: string[];
diff --git a/packages/agents/src/kb-edit/__tests__/cli.test.ts b/packages/agents/src/kb-edit/__tests__/cli.test.ts
index 865adfb5..d6984940 100644
--- a/packages/agents/src/kb-edit/__tests__/cli.test.ts
+++ b/packages/agents/src/kb-edit/__tests__/cli.test.ts
@@ -8,7 +8,7 @@ import { describe, expect, it } from 'vitest';
 import { parseArgs, runEdit } from '../cli.ts';
 
 const NOW = new Date('2026-05-24T14:35:00Z');
-const TODAY = '2026-05-24';
+const TODAY = '2026-05-24T14:35:00Z';
 
 const SAMPLE_NOTE = `---
 title: Sample
diff --git a/packages/agents/src/kb-edit/operations/__tests__/append.test.ts b/packages/agents/src/kb-edit/operations/__tests__/append.test.ts
index 859d7a65..2ae605e3 100644
--- a/packages/agents/src/kb-edit/operations/__tests__/append.test.ts
+++ b/packages/agents/src/kb-edit/operations/__tests__/append.test.ts
@@ -29,7 +29,7 @@ describe(append, () => {
     expect(result.ok).toBe(true);
     if (result.ok) {
       expect(result.body).toBe('First paragraph.\n\nSecond paragraph.\n');
-      expect(result.frontmatter.updated).toBe('2026-05-24');
+      expect(result.frontmatter.updated).toBe('2026-05-24T14:35:00Z');
     }
   });
 
diff --git a/packages/agents/src/kb-edit/operations/__tests__/bump-updated.test.ts b/packages/agents/src/kb-edit/operations/__tests__/bump-updated.test.ts
index e06f5b85..f9741389 100644
--- a/packages/agents/src/kb-edit/operations/__tests__/bump-updated.test.ts
+++ b/packages/agents/src/kb-edit/operations/__tests__/bump-updated.test.ts
@@ -21,7 +21,7 @@ describe(bumpUpdated, () => {
   it('sets updated to today (UTC) and leaves other fields untouched', () => {
     const result = bumpUpdated({ frontmatter: frontmatter(), body: 'unchanged body', now: NOW });
 
-    expect(result.frontmatter.updated).toBe('2026-05-24');
+    expect(result.frontmatter.updated).toBe('2026-05-24T14:35:00Z');
     expect(result.frontmatter.title).toBe('Example');
     expect(result.frontmatter.created).toBe('2026-05-01');
     expect(result.frontmatter.tags).toEqual(['example']);
diff --git a/packages/agents/src/kb-edit/operations/__tests__/retag.test.ts b/packages/agents/src/kb-edit/operations/__tests__/retag.test.ts
index ded57bdf..76ed8ba1 100644
--- a/packages/agents/src/kb-edit/operations/__tests__/retag.test.ts
+++ b/packages/agents/src/kb-edit/operations/__tests__/retag.test.ts
@@ -34,7 +34,7 @@ describe(retag, () => {
     });
 
     expect(result.frontmatter.tags).toEqual(['new', 'set']);
-    expect(result.frontmatter.updated).toBe('2026-05-24');
+    expect(result.frontmatter.updated).toBe('2026-05-24T14:35:00Z');
   });
 
   it('returns originalTags and canonicalTags for audit', () => {
diff --git a/packages/agents/src/kb-edit/operations/__tests__/supersede-with.test.ts b/packages/agents/src/kb-edit/operations/__tests__/supersede-with.test.ts
index 54d3793a..0f8e1143 100644
--- a/packages/agents/src/kb-edit/operations/__tests__/supersede-with.test.ts
+++ b/packages/agents/src/kb-edit/operations/__tests__/supersede-with.test.ts
@@ -70,8 +70,8 @@ describe(prepareSupersedeWith, () => {
       now: NOW,
     });
 
-    expect(result.old.frontmatter.updated).toBe('2026-05-24');
-    expect(result.new.frontmatter.updated).toBe('2026-05-24');
+    expect(result.old.frontmatter.updated).toBe('2026-05-24T14:35:00Z');
+    expect(result.new.frontmatter.updated).toBe('2026-05-24T14:35:00Z');
   });
 
   it('writes KB-relative pointers when notes are in subfolders', () => {
diff --git a/packages/agents/src/kb-edit/operations/__tests__/verify.test.ts b/packages/agents/src/kb-edit/operations/__tests__/verify.test.ts
index 8ef52324..42ab0227 100644
--- a/packages/agents/src/kb-edit/operations/__tests__/verify.test.ts
+++ b/packages/agents/src/kb-edit/operations/__tests__/verify.test.ts
@@ -21,7 +21,7 @@ describe(verify, () => {
   it('sets last-verified to today (UTC) and does not bump updated', () => {
     const result = verify({ frontmatter: frontmatter(), body: 'body', now: NOW });
 
-    expect(result.frontmatter.extra['last-verified']).toBe('2026-05-24');
+    expect(result.frontmatter.extra['last-verified']).toBe('2026-05-24T14:35:00Z');
     expect(result.frontmatter.updated).toBe('2026-05-01');
   });
 
@@ -30,7 +30,7 @@ describe(verify, () => {
 
     const result = verify({ frontmatter: fm, body: 'b', now: NOW });
 
-    expect(result.frontmatter.extra).toEqual({ 'last-verified': '2026-05-24' });
+    expect(result.frontmatter.extra).toEqual({ 'last-verified': '2026-05-24T14:35:00Z' });
   });
 
   it('overwrites an existing last-verified value', () => {
@@ -38,7 +38,7 @@ describe(verify, () => {
 
     const result = verify({ frontmatter: fm, body: 'b', now: NOW });
 
-    expect(result.frontmatter.extra['last-verified']).toBe('2026-05-24');
+    expect(result.frontmatter.extra['last-verified']).toBe('2026-05-24T14:35:00Z');
   });
 
   it('preserves other extra fields when adding last-verified', () => {
@@ -49,10 +49,21 @@ describe(verify, () => {
     expect(result.frontmatter.extra).toEqual({
       'applies-to': 'node 24',
       sources: ['docs.example.com'],
-      'last-verified': '2026-05-24',
+      'last-verified': '2026-05-24T14:35:00Z',
     });
   });
 
+  it('advances a born-verified note last-verified to an instant at or after created', () => {
+    const born = '2026-05-01T09:00:00Z';
+    const fm = frontmatter({ created: born, updated: born, extra: { 'last-verified': born } });
+
+    const result = verify({ frontmatter: fm, body: 'b', now: NOW });
+    const lastVerified = result.frontmatter.extra['last-verified'];
+
+    expect(lastVerified).toBe('2026-05-24T14:35:00Z');
+    expect(Date.parse(String(lastVerified))).toBeGreaterThanOrEqual(Date.parse(result.frontmatter.created));
+  });
+
   it('does not mutate the input frontmatter', () => {
     const fm = frontmatter();
 
diff --git a/packages/agents/src/kb-edit/operations/append.ts b/packages/agents/src/kb-edit/operations/append.ts
index e890a54b..c2be6a8c 100644
--- a/packages/agents/src/kb-edit/operations/append.ts
+++ b/packages/agents/src/kb-edit/operations/append.ts
@@ -1,6 +1,6 @@
 import type { Frontmatter } from '@codeassembly/kb';
 
-import { formatUtcDate } from '../../kb-shared/note-helpers.ts';
+import { formatUtcTimestamp } from '../../kb-shared/note-helpers.ts';
 
 /** Successful append: a mutated `{ frontmatter, body }` ready for `writeBackNote`. */
 export interface AppendSuccess {
@@ -37,7 +37,11 @@ export function append(input: { frontmatter: Frontmatter; body: string; addition
 
   return {
     ok: true,
-    frontmatter: { ...input.frontmatter, updated: formatUtcDate(input.now), extra: { ...input.frontmatter.extra } },
+    frontmatter: {
+      ...input.frontmatter,
+      updated: formatUtcTimestamp(input.now),
+      extra: { ...input.frontmatter.extra },
+    },
     body: newBody,
   };
 }
diff --git a/packages/agents/src/kb-edit/operations/bump-updated.ts b/packages/agents/src/kb-edit/operations/bump-updated.ts
index ab0a894c..164459b3 100644
--- a/packages/agents/src/kb-edit/operations/bump-updated.ts
+++ b/packages/agents/src/kb-edit/operations/bump-updated.ts
@@ -1,18 +1,22 @@
 import type { Frontmatter } from '@codeassembly/kb';
 
-import { formatUtcDate } from '../../kb-shared/note-helpers.ts';
+import { formatUtcTimestamp } from '../../kb-shared/note-helpers.ts';
 
 /**
- * Sets `updated:` to today (UTC). The body is preserved exactly. Running twice on the same UTC day is an
- * idempotent no-op at the field level but still produces a write — schema validation runs unconditionally
- * so a note that was already invalid surfaces as `schema-validation` rather than rotting silently.
+ * Sets `updated:` to the current instant (UTC). The body is preserved exactly. The operation always
+ * produces a write — schema validation runs unconditionally, so a note that was already invalid surfaces
+ * as `schema-validation` rather than rotting silently.
  */
 export function bumpUpdated(input: { frontmatter: Frontmatter; body: string; now: Date }): {
   frontmatter: Frontmatter;
   body: string;
 } {
   return {
-    frontmatter: { ...input.frontmatter, updated: formatUtcDate(input.now), extra: { ...input.frontmatter.extra } },
+    frontmatter: {
+      ...input.frontmatter,
+      updated: formatUtcTimestamp(input.now),
+      extra: { ...input.frontmatter.extra },
+    },
     body: input.body,
   };
 }
diff --git a/packages/agents/src/kb-edit/operations/retag.ts b/packages/agents/src/kb-edit/operations/retag.ts
index 654e741c..809771d5 100644
--- a/packages/agents/src/kb-edit/operations/retag.ts
+++ b/packages/agents/src/kb-edit/operations/retag.ts
@@ -1,7 +1,7 @@
 import type { AliasMap, Frontmatter } from '@codeassembly/kb';
 import { canonicalize } from '@codeassembly/kb/tags';
 
-import { dedupeInOrder, formatUtcDate } from '../../kb-shared/note-helpers.ts';
+import { dedupeInOrder, formatUtcTimestamp } from '../../kb-shared/note-helpers.ts';
 
 /**
  * Replaces the tag list, canonicalizing each entry through the supplied alias map, deduplicating in
@@ -23,7 +23,7 @@ export function retag(input: {
     frontmatter: {
       ...input.frontmatter,
       tags: canonicalTags,
-      updated: formatUtcDate(input.now),
+      updated: formatUtcTimestamp(input.now),
       extra: { ...input.frontmatter.extra },
     },
     body: input.body,
diff --git a/packages/agents/src/kb-edit/operations/supersede-with.ts b/packages/agents/src/kb-edit/operations/supersede-with.ts
index c3d7f903..35212504 100644
--- a/packages/agents/src/kb-edit/operations/supersede-with.ts
+++ b/packages/agents/src/kb-edit/operations/supersede-with.ts
@@ -3,7 +3,7 @@ import { relative } from 'node:path';
 import type { AliasMap, Frontmatter, ParsedNote } from '@codeassembly/kb';
 import { canonicalize } from '@codeassembly/kb/tags';
 
-import { dedupeInOrder, formatUtcDate } from '../../kb-shared/note-helpers.ts';
+import { dedupeInOrder, formatUtcTimestamp } from '../../kb-shared/note-helpers.ts';
 
 /**
  * Prepares the in-memory edits for `--supersede-with`. Old note: `superseded-by` pointer plus a `deprecated` tag
@@ -29,7 +29,7 @@ export function prepareSupersedeWith(input: {
   old: { frontmatter: Frontmatter; body: string };
   new: { frontmatter: Frontmatter; body: string };
 } {
-  const today = formatUtcDate(input.now);
+  const today = formatUtcTimestamp(input.now);
   const oldRelative = relative(input.kbPath, input.oldNote.path);
   const newRelative = relative(input.kbPath, input.newNote.path);
 
diff --git a/packages/agents/src/kb-edit/operations/verify.ts b/packages/agents/src/kb-edit/operations/verify.ts
index 0fd1deef..44b12167 100644
--- a/packages/agents/src/kb-edit/operations/verify.ts
+++ b/packages/agents/src/kb-edit/operations/verify.ts
@@ -1,6 +1,6 @@
 import type { Frontmatter } from '@codeassembly/kb';
 
-import { formatUtcDate } from '../../kb-shared/note-helpers.ts';
+import { formatUtcTimestamp } from '../../kb-shared/note-helpers.ts';
 
 /**
  * Sets `last-verified:` to today (UTC), inserting the field if it isn't already present. Does **not** bump
@@ -16,7 +16,7 @@ export function verify(input: { frontmatter: Frontmatter; body: string; now: Dat
   return {
     frontmatter: {
       ...input.frontmatter,
-      extra: { ...input.frontmatter.extra, 'last-verified': formatUtcDate(input.now) },
+      extra: { ...input.frontmatter.extra, 'last-verified': formatUtcTimestamp(input.now) },
     },
     body: input.body,
   };
diff --git a/packages/agents/src/kb-shared/__tests__/note-helpers.test.ts b/packages/agents/src/kb-shared/__tests__/note-helpers.test.ts
index 0d0373a6..9ee6fd9a 100644
--- a/packages/agents/src/kb-shared/__tests__/note-helpers.test.ts
+++ b/packages/agents/src/kb-shared/__tests__/note-helpers.test.ts
@@ -1,19 +1,53 @@
 import { describe, expect, it } from 'vitest';
 
-import { dedupeInOrder, formatUtcDate } from '../note-helpers.ts';
+import { computeAgeDays, dedupeInOrder, formatUtcTimestamp } from '../note-helpers.ts';
 
-describe(formatUtcDate, () => {
-  it('formats midnight UTC as YYYY-MM-DD', () => {
-    expect(formatUtcDate(new Date('2026-05-24T00:00:00Z'))).toBe('2026-05-24');
+describe(formatUtcTimestamp, () => {
+  it('formats midnight UTC as a second-precision timestamp', () => {
+    expect(formatUtcTimestamp(new Date('2026-05-24T00:00:00Z'))).toBe('2026-05-24T00:00:00Z');
   });
 
-  it('formats a mid-day UTC instant as the same calendar date', () => {
-    expect(formatUtcDate(new Date('2026-05-24T14:35:00Z'))).toBe('2026-05-24');
+  it('formats a mid-day UTC instant to whole-second precision', () => {
+    expect(formatUtcTimestamp(new Date('2026-05-24T14:35:09Z'))).toBe('2026-05-24T14:35:09Z');
   });
 
-  it('uses the UTC date when local timezone would yield a different day', () => {
-    // 23:30 UTC on May 24 is May 25 in most positive offsets and May 24 elsewhere; the helper anchors to UTC.
-    expect(formatUtcDate(new Date('2026-05-24T23:30:00Z'))).toBe('2026-05-24');
+  it('drops sub-second milliseconds', () => {
+    expect(formatUtcTimestamp(new Date('2026-05-24T14:35:09.987Z'))).toBe('2026-05-24T14:35:09Z');
+  });
+
+  it('anchors to UTC when the local timezone would yield a different day', () => {
+    expect(formatUtcTimestamp(new Date('2026-05-24T23:30:00Z'))).toBe('2026-05-24T23:30:00Z');
+  });
+});
+
+describe(computeAgeDays, () => {
+  const now = new Date('2026-05-24T12:00:00Z');
+
+  it('returns null for an absent value', () => {
+    expect(computeAgeDays(null, now)).toBeNull();
+  });
+
+  it('returns null for an unparseable value', () => {
+    expect(computeAgeDays('not-a-date', now)).toBeNull();
+  });
+
+  it.each(['2024/01/15', '2024-1-5', '2026-05-01T14:35:09', '2026-05-01T14:35:09+00:00'])(
+    'returns null for the Date.parse-able but non-accepted form %s',
+    (value) => {
+      expect(computeAgeDays(value, now)).toBeNull();
+    },
+  );
+
+  it('computes whole-day age for a bare legacy date read as UTC midnight', () => {
+    expect(computeAgeDays('2026-05-20', now)).toBe(4);
+  });
+
+  it('computes the same whole-day age for a midnight timestamp of the same date', () => {
+    expect(computeAgeDays('2026-05-20T00:00:00Z', now)).toBe(computeAgeDays('2026-05-20', now));
+  });
+
+  it('reads a same-day timestamp earlier than now as zero whole days', () => {
+    expect(computeAgeDays('2026-05-24T09:00:00Z', now)).toBe(0);
   });
 });
 
diff --git a/packages/agents/src/kb-shared/note-helpers.ts b/packages/agents/src/kb-shared/note-helpers.ts
index 63d951a1..8d16de22 100644
--- a/packages/agents/src/kb-shared/note-helpers.ts
+++ b/packages/agents/src/kb-shared/note-helpers.ts
@@ -1,17 +1,25 @@
 /** Whole-day divisor for converting a date delta in milliseconds to an age in days. */
 const MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;
 
-/** Formats a `Date` as a UTC `YYYY-MM-DD` string for note frontmatter date fields. */
-export function formatUtcDate(date: Date): string {
-  return date.toISOString().slice(0, 10);
+/** Matches the two accepted stored-date forms: bare `YYYY-MM-DD` or second-precision UTC `YYYY-MM-DDTHH:MM:SSZ`. */
+const ACCEPTED_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}Z)?$/;
+
+/** Formats a `Date` as a second-precision UTC `YYYY-MM-DDTHH:MM:SSZ` timestamp for note frontmatter date fields. */
+export function formatUtcTimestamp(date: Date): string {
+  return `${date.toISOString().slice(0, 19)}Z`;
 }
 
-/** Computes whole days between a `YYYY-MM-DD` date string and `now`; `null` for an absent or unparseable value. */
+/**
+ * Computes whole days between a stored date value and `now`; `null` for an absent value or one not in an accepted form.
+ * A `YYYY-MM-DDTHH:MM:SSZ` timestamp is read as its instant and a bare legacy `YYYY-MM-DD` date as UTC midnight, both
+ * truncated to whole-day resolution. Values outside the two accepted forms return `null` rather than a `Date.parse`
+ * best-effort age, since a non-`Z` or locale-dependent string would otherwise be silently misread as local time.
+ */
 export function computeAgeDays(dateValue: string | null, now: Date): number | null {
-  if (dateValue === null) {
+  if (dateValue === null || !ACCEPTED_DATE.test(dateValue)) {
     return null;
   }
-  const parsed = Date.parse(`${dateValue}T00:00:00Z`);
+  const parsed = Date.parse(dateValue);
   if (Number.isNaN(parsed)) {
     return null;
   }
diff --git a/packages/kb/src/create/render-seeds.ts b/packages/kb/src/create/render-seeds.ts
index d5d46b5b..513107a2 100644
--- a/packages/kb/src/create/render-seeds.ts
+++ b/packages/kb/src/create/render-seeds.ts
@@ -29,6 +29,9 @@ const SCHEMA_HEADER = `# Schema for this knowledge store.
 # type declares its required and optional fields plus its recall policy; a record's family is the
 # stored \`recordType\` discriminant.
 #
+# Date fields (created, updated, last-verified) are written as second-precision UTC timestamps
+# (YYYY-MM-DDTHH:MM:SSZ); bare YYYY-MM-DD dates remain valid for hand-authored and legacy notes.
+#
 # Safe to edit: add record types, or add optional fields. Do NOT remove or rename the default record types or their
 # required fields — the kb-* skills (kb-add, capture-event, kb-edit) depend on them. Delete this file to re-inherit
 # the bundled default.
diff --git a/packages/kb/src/rules/__tests__/fixtures/parity/expected-findings.json b/packages/kb/src/rules/__tests__/fixtures/parity/expected-findings.json
index 31cb8611..b5463bc8 100644
--- a/packages/kb/src/rules/__tests__/fixtures/parity/expected-findings.json
+++ b/packages/kb/src/rules/__tests__/fixtures/parity/expected-findings.json
@@ -53,7 +53,7 @@
     "line": 4,
     "rule": "frontmatter.date",
     "severity": "error",
-    "message": "created: expected YYYY-MM-DD, got \"2026/04/12\""
+    "message": "created: expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got \"2026/04/12\""
   },
   {
     "path": "11-bad-date-calendar.md",
diff --git a/packages/kb/src/rules/__tests__/frontmatter-rule.test.ts b/packages/kb/src/rules/__tests__/frontmatter-rule.test.ts
index 7ff619cf..862cbc84 100644
--- a/packages/kb/src/rules/__tests__/frontmatter-rule.test.ts
+++ b/packages/kb/src/rules/__tests__/frontmatter-rule.test.ts
@@ -102,6 +102,59 @@ describe('frontmatterRule', () => {
     expect(frontmatterRule.check({ note, document, schema: defaultSchema })).toEqual([]);
   });
 
+  it('accepts a second-precision UTC timestamp in a date field', () => {
+    const dateFinding = checkDateField('created', '2026-05-01T14:35:09Z').find(
+      (finding) => finding.rule === 'frontmatter.date',
+    );
+
+    expect(dateFinding).toBeUndefined();
+  });
+
+  it.each([
+    ['created', 'date without a Z marker', '2026-05-01T14:35:09', 'expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got'],
+    [
+      'created',
+      'date with a numeric offset',
+      '2026-05-01T14:35:09+00:00',
+      'expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got',
+    ],
+    ['created', 'slash-separated date', '2026/05/01', 'expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got'],
+    ['created', 'unreal calendar date', '2026-02-30', 'is not a real calendar date'],
+    ['created', 'unreal clock time', '2026-05-01T25:00:00Z', 'is not a real timestamp'],
+    ['updated', 'unreal calendar date', '2026-02-30', 'is not a real calendar date'],
+  ] as const)('rejects %s as a %s', (field, _label, value, expectedMessage) => {
+    const dateFinding = checkDateField(field, value).find((finding) => finding.rule === 'frontmatter.date');
+
+    expect(dateFinding?.message).toContain(expectedMessage);
+  });
+
+  it('accepts a bare date in the last-verified field', () => {
+    const dateFinding = checkDateField('last-verified', '2026-05-14').find(
+      (finding) => finding.rule === 'frontmatter.date',
+    );
+
+    expect(dateFinding).toBeUndefined();
+  });
+
+  it('accepts a second-precision UTC timestamp in the last-verified field', () => {
+    const dateFinding = checkDateField('last-verified', '2026-05-14T14:35:09Z').find(
+      (finding) => finding.rule === 'frontmatter.date',
+    );
+
+    expect(dateFinding).toBeUndefined();
+  });
+
+  it.each([
+    ['date without a Z marker', '2026-05-14T14:35:09', 'expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got'],
+    ['date with a numeric offset', '2026-05-14T14:35:09+00:00', 'expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got'],
+    ['unreal calendar date', '2026-02-30', 'is not a real calendar date'],
+    ['unreal clock time', '2026-05-14T25:00:00Z', 'is not a real timestamp'],
+  ])('rejects %s in the last-verified field', (_label, value, expectedMessage) => {
+    const dateFinding = checkDateField('last-verified', value).find((finding) => finding.rule === 'frontmatter.date');
+
+    expect(dateFinding?.message).toContain(expectedMessage);
+  });
+
   it('emits frontmatter.recordType when the recordType field is absent', () => {
     const content = [
       '---',
@@ -234,6 +287,30 @@ describe('frontmatterRule across record types', () => {
 
 // region | Helpers
 
+/** Builds a minimal valid assertion note with one date field overridden, then runs the frontmatter rule against it. */
+function checkDateField(field: 'created' | 'updated' | 'last-verified', value: string): Finding[] {
+  const defaults: Record<'created' | 'updated' | 'last-verified', string> = {
+    created: '2026-05-01',
+    updated: '2026-05-14',
+    'last-verified': '2026-05-14',
+  };
+  const lines = { ...defaults, [field]: value };
+  const content = [
+    '---',
+    'title: Date field under test',
+    'recordType: assertion',
+    `created: ${lines.created}`,
+    `updated: ${lines.updated}`,
+    `last-verified: ${lines['last-verified']}`,
+    'tags: [git]',
+    '---',
+    '',
+    '# Body',
+  ].join('\n');
+  const { note, document } = parseNoteWithDocument(content, 'date-field.md');
+  return frontmatterRule.check({ note, document, schema: defaultSchema });
+}
+
 async function checkFixture(name: string): Promise<Finding[]> {
   const content = await readFile(join(RULE_CASES_DIR, `${name}.md`), 'utf8');
   const { note, document } = parseNoteWithDocument(content, `${name}.md`);
diff --git a/packages/kb/src/rules/frontmatter-rule.ts b/packages/kb/src/rules/frontmatter-rule.ts
index a8419770..73fe7587 100644
--- a/packages/kb/src/rules/frontmatter-rule.ts
+++ b/packages/kb/src/rules/frontmatter-rule.ts
@@ -6,7 +6,8 @@ import type { Finding, Schema } from '../types.ts';
 import type { KbRule, KbRuleInput } from './types.ts';
 
 const DATE_FIELDS = ['created', 'updated', 'last-verified'] as const;
-const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+const DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
 
 /**
  * Validate a note's frontmatter block: presence, parseability, the stored `recordType` discriminant, the required
@@ -143,20 +144,34 @@ function toDateString(value: unknown): string {
   return typeof value === 'string' ? value : String(value);
 }
 
-/** Validate that a value is a real UTC `YYYY-MM-DD` calendar date; returns an error message or `null`. */
+/**
+ * Validate that a value is a real UTC instant in either the bare `YYYY-MM-DD` form or the second-precision
+ * `YYYY-MM-DDTHH:MM:SSZ` form; returns an error message or `null`. An unmarked or offset timestamp (no trailing `Z`,
+ * or `+00:00`) matches neither pattern and falls to the format error. Both forms are round-tripped through `Date.UTC`
+ * so an unreal calendar date or unreal clock time is rejected.
+ */
 function validateDate(value: string): string | null {
-  if (!DATE_PATTERN.test(value)) {
-    return `expected YYYY-MM-DD, got "${value}"`;
+  const isDateOnly = DATE_ONLY.test(value);
+  if (!isDateOnly && !TIMESTAMP.test(value)) {
+    return `expected YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ, got "${value}"`;
   }
-  // The regex match guarantees fixed-width segments, so slice yields plain strings.
+  // Each regex guarantees fixed-width segments, so slice yields plain numeric strings.
   const year = Number(value.slice(0, 4));
   const month = Number(value.slice(5, 7));
   const day = Number(value.slice(8, 10));
-  const roundTrip = new Date(Date.UTC(year, month - 1, day));
-  const isRealDate =
-    roundTrip.getUTCFullYear() === year && roundTrip.getUTCMonth() === month - 1 && roundTrip.getUTCDate() === day;
-  if (!isRealDate) {
-    return `"${value}" is not a real calendar date`;
+  const hour = isDateOnly ? 0 : Number(value.slice(11, 13));
+  const minute = isDateOnly ? 0 : Number(value.slice(14, 16));
+  const second = isDateOnly ? 0 : Number(value.slice(17, 19));
+  const roundTrip = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+  const isReal =
+    roundTrip.getUTCFullYear() === year &&
+    roundTrip.getUTCMonth() === month - 1 &&
+    roundTrip.getUTCDate() === day &&
+    roundTrip.getUTCHours() === hour &&
+    roundTrip.getUTCMinutes() === minute &&
+    roundTrip.getUTCSeconds() === second;
+  if (!isReal) {
+    return isDateOnly ? `"${value}" is not a real calendar date` : `"${value}" is not a real timestamp`;
   }
   return null;
 }
diff --git a/packages/kb/src/types.ts b/packages/kb/src/types.ts
index 188489b2..1591e414 100644
--- a/packages/kb/src/types.ts
+++ b/packages/kb/src/types.ts
@@ -71,9 +71,9 @@ export interface Frontmatter {
   title: string;
   /** The stored record-type discriminant (e.g. `assertion`, `event`). */
   recordType: string;
-  /** UTC `YYYY-MM-DD`. */
+  /** Second-precision UTC timestamp (`YYYY-MM-DDTHH:MM:SSZ`); bare legacy `YYYY-MM-DD` dates remain valid. */
   created: string;
-  /** UTC `YYYY-MM-DD`. */
+  /** Second-precision UTC timestamp (`YYYY-MM-DDTHH:MM:SSZ`); bare legacy `YYYY-MM-DD` dates remain valid. */
   updated: string;
   tags: string[];
   /** Optional and unknown fields, preserved through round-trip in insertion order. */