agent-dealer 1.2.4 → 1.2.6

package/bundle/server/dist/coordinator/worktree-owner-liveness.js

@@ -70,6 +70,10 @@ function sessionLooksLive(session) {
  *
  * Returns alive if **any** candidate session for this path is live — basename predecessor
  * and every `worktree_path` match (see {@link listWorkerSessionsOwningWorktree}).
+ *
+ * NOT-280: a dead verdict names the most recently created candidate — the predecessor
+ * whose dirt a resume salvage is attributed to. No candidate at all stays a bare dead
+ * verdict (unknown owner), which keeps dirt on the fail-closed conflict path.
  */
 export function checkDeveloperWorktreeOwnerLiveness(worktreePath) {
     const candidates = listWorkerSessionsOwningWorktree(worktreePath);
@@ -78,5 +82,6 @@ export function checkDeveloperWorktreeOwnerLiveness(worktreePath) {
             return { state: "alive", sessionId: session.id };
         }
     }
-    return { state: "dead" };
+    const latest = [...candidates].sort((a, b) => b.createdAt.localeCompare(a.createdAt))[0];
+    return latest ? { state: "dead", sessionId: latest.id } : { state: "dead" };
 }

package/bundle/server/dist/coordinator/worktree-owner-liveness.test.js

@@ -137,7 +137,8 @@ test("checkDeveloperWorktreeOwnerLiveness: terminal session with a dead pid is d
     patchRunningSession(session.id, { worktreePath: wt });
     recordSessionProcess(session.id, pid, COORDINATOR_PROCESS_OWNER, startTime);
     completeSession(session.id, { status: "failed", errorJson: JSON.stringify({ reason: "gone" }) });
-    assert.deepEqual(checkDeveloperWorktreeOwnerLiveness(wt), { state: "dead" });
+    // NOT-280: a proven-dead owner is named so a resume salvage can be tied to it.
+    assert.deepEqual(checkDeveloperWorktreeOwnerLiveness(wt), { state: "dead", sessionId: session.id });
 });
 test("checkDeveloperWorktreeOwnerLiveness: unknown path with no session is dead", () => {
     assert.deepEqual(checkDeveloperWorktreeOwnerLiveness("/repo/.agent-dealer-worktrees/no-such-session-developer"), { state: "dead" });

package/bundle/server/dist/repository/human-actions.js

@@ -144,6 +144,19 @@ export function updateOpenHumanAction(id, patch) {
         .run(patch.reason ?? null, patch.question ?? null, patch.evidence !== undefined ? JSON.stringify(patch.evidence) : null, id);
     return getHumanAction(id);
 }
+/**
+ * NOT-280: put a resolved action back to open, unchanged — used when a Resume ran into the
+ * exact same blocker again, so the operator keeps one action instead of an identical copy.
+ * Only touches resolved rows; returns null otherwise.
+ */
+export function reopenHumanAction(id) {
+    const info = getDb()
+        .prepare(`UPDATE human_actions SET
+        status = 'open', resolution_json = NULL, resolved_by = NULL, resolved_at = NULL
+      WHERE id = ? AND status = 'resolved'`)
+        .run(id);
+    return info.changes === 0 ? null : getHumanAction(id);
+}
 /** Run-scoped equivalent of `findOpenHumanAction` (NOT-95 — outbound-draft delivery
  * parking has no Issue). */
 export function findOpenHumanActionForRun(runId, actionType) {

package/bundle/server/dist/routes/human-actions.js

@@ -1,5 +1,6 @@
 import { getHumanAction, listOpenHumanActions } from "../repository/human-actions.js";
 import { resolveHumanActionAndAdvanceAsync } from "../coordinator/commands.js";
+import { normalizeResolutionNote } from "../coordinator/human-resolution.js";
 import { triggerIssueReflect, resolveReflectionInteractionAction } from "../coordinator/reflect-trigger.js";
 import { resolveOutboundDeliveryAction } from "../queue/approve-deliver.js";
 export async function registerHumanActionRoutes(app) {
@@ -14,6 +15,12 @@ export async function registerHumanActionRoutes(app) {
         if (!resolvedBy || !choice) {
             return reply.status(400).send({ error: "resolvedBy and choice are required" });
         }
+        // NOT-272: optional human note for a product_scope_decision resolution — validated
+        // the same way as resolvedBy/choice above (present-but-not-a-string 400s, never 500s).
+        const normalizedNote = normalizeResolutionNote(body?.note);
+        if (!normalizedNote.ok) {
+            return reply.status(400).send({ error: normalizedNote.error });
+        }
         // Read before resolving — the issue id this action belongs to, needed for the reflect
         // trigger below and stable regardless of how resolution turns out.
         const action = getHumanAction(id);
@@ -45,7 +52,9 @@ export async function registerHumanActionRoutes(app) {
         }
         // Awaits undraft+merge when final_review:complete (NOT-102) — sync resolve alone would
         // only park at AUTO_MERGE_INTENT and leave the PR draft.
-        const result = await resolveHumanActionAndAdvanceAsync(id, resolvedBy, choice);
+        const result = await resolveHumanActionAndAdvanceAsync(id, resolvedBy, choice, {
+            note: normalizedNote.note,
+        });
         if (!result.ok)
             return reply.status(result.code).send({ error: result.error });
         // Reflect is a best-effort network call to Agent Deck (health check + a sequential

package/bundle/server/dist/routes/human-actions.test.js

@@ -12,7 +12,7 @@ const { createHumanAction, getHumanAction, listHumanActionsForIssue } = await im
 const { registerHumanActionRoutes } = await import("./human-actions.js");
 const { startWorkflow, applyCompletion } = await import("../coordinator/commands.js");
 const { ReviewerResult } = await import("../coordinator/reviewer-result.js");
-const { claimWorkItem } = await import("../repository/work-items.js");
+const { claimWorkItem, getWorkItem } = await import("../repository/work-items.js");
 const { listArtifactsForIssue } = await import("../repository/artifacts-for-issue.js");
 const { createRun, getRun, transitionRun, addArtifact, updateRunFields } = await import("../repository/runs.js");
 const { pendingSendCount, getPendingOutboundDraft } = await import("../repository/outbound-drafts.js");
@@ -284,3 +284,119 @@ test("POST resolve 400s on a choice not valid for reflection_interaction_require
     assert.equal(res.statusCode, 400);
     await app.close();
 });
+// NOT-272: seeds.
+function seedPreStartScopeDecision() {
+    const issue = createIssue({ title: "Scope gated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const action = createHumanAction({
+        issueId: issue.id,
+        actionType: "product_scope_decision",
+        reason: "Scope unclear before start",
+        question: "Is this in scope?",
+        responseOptions: [{ choice: "resume", label: "Resume development" }],
+    });
+    return { issue, action };
+}
+/** Drives a real issue to a mid-workflow product_scope_decision via a reviewer
+ * escalate verdict carrying a productScopeQuestion (NOT-150 routing). */
+async function seedMidWorkflowScopeDecision() {
+    const issue = createIssue({ title: "Scope escalated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const start = startWorkflow(issue.id);
+    assert.equal(start.ok, true);
+    const devItem = claimWorkItem(`scope-note-test-${issue.id}-dev`, { leaseMs: 60_000 });
+    await applyCompletion(devItem.id, devItem.leaseToken, {
+        kind: "clean_handoff",
+        branch: `issue-${issue.id}`,
+        headSha: "a".repeat(40),
+        baseSha: "b".repeat(40),
+        prNumber: 1,
+        prUrl: "https://gh/pr/1"
+    });
+    const reviewItem = claimWorkItem(`scope-note-test-${issue.id}-rev`, { leaseMs: 60_000 });
+    await applyCompletion(reviewItem.id, reviewItem.leaseToken, {
+        kind: "verdict",
+        result: ReviewerResult.parse({
+            verdict: "escalated",
+            baseSha: "b".repeat(40),
+            headSha: "a".repeat(40),
+            acceptanceCriteriaAssessment: "unclear scope",
+            evidenceAssessment: "fine",
+            findings: [],
+            risks: [],
+            productScopeQuestion: "Is the runner migration in scope?"
+        })
+    });
+    const humanAction = listHumanActionsForIssue(issue.id).find((a) => a.actionType === "product_scope_decision");
+    assert.ok(humanAction, "expected a product_scope_decision human action");
+    return { issueId: issue.id, actionId: humanAction.id };
+}
+test("NOT-272: POST resolve 400s (not 500) on a non-string note", async () => {
+    const app = await buildApp();
+    const { action } = seedPreStartScopeDecision();
+    const res = await app.inject({ method: "POST", url: `/api/human-actions/${action.id}/resolve`, payload: { resolvedBy: "yusuke", choice: "resume", note: 123 } });
+    assert.equal(res.statusCode, 400);
+    assert.match(res.json().error, /note must be a string/);
+    assert.equal(getHumanAction(action.id).status, "open", "a rejected resolve must leave the action open");
+    await app.close();
+});
+test("NOT-272: POST resolve 400s on an over-long note", async () => {
+    const app = await buildApp();
+    const { action } = seedPreStartScopeDecision();
+    const res = await app.inject({ method: "POST", url: `/api/human-actions/${action.id}/resolve`, payload: { resolvedBy: "yusuke", choice: "resume", note: "x".repeat(4001) } });
+    assert.equal(res.statusCode, 400);
+    assert.match(res.json().error, /at most 4000/);
+    assert.equal(getHumanAction(action.id).status, "open");
+    await app.close();
+});
+test("NOT-272: pre-start product_scope_decision resolve with a note persists it and carries it on the round-1 payload", async () => {
+    const app = await buildApp();
+    const { action } = seedPreStartScopeDecision();
+    const note = "The runner migration IS in scope — proceed with it.";
+    const res = await app.inject({ method: "POST", url: `/api/human-actions/${action.id}/resolve`, payload: { resolvedBy: "yusuke", choice: "resume", note: `  ${note}  ` } });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.restarted, true);
+    assert.ok(body.nextWorkItemId);
+    const stored = getHumanAction(action.id);
+    assert.equal(stored.status, "resolved");
+    assert.deepEqual(JSON.parse(stored.resolutionJson), { choice: "resume", note }, "note round-trips exactly (trimmed)");
+    const payload = JSON.parse(getWorkItem(body.nextWorkItemId).payloadJson);
+    assert.equal(payload.scopeDecisionNote, note, "the very next round's payload carries the note");
+    await app.close();
+});
+test("NOT-272: mid-workflow product_scope_decision resolve with a note persists it and carries it on the next developer payload", async () => {
+    const app = await buildApp();
+    const { issueId, actionId } = await seedMidWorkflowScopeDecision();
+    const note = "Out of scope for this ticket — finish the runner work already here, nothing more.";
+    const res = await app.inject({ method: "POST", url: `/api/human-actions/${actionId}/resolve`, payload: { resolvedBy: "yusuke", choice: "resume", note } });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.issueStatus, "developing");
+    assert.ok(body.nextWorkItemId);
+    const stored = getHumanAction(actionId);
+    assert.deepEqual(JSON.parse(stored.resolutionJson), { choice: "resume", note });
+    const payload = JSON.parse(getWorkItem(body.nextWorkItemId).payloadJson);
+    assert.equal(payload.scopeDecisionNote, note);
+    assert.equal(getIssue(issueId).status, "developing");
+    await app.close();
+});
+test("NOT-272: resolving a product_scope_decision without a note stores exactly today's record and queues a noteless payload", async () => {
+    const app = await buildApp();
+    const { action } = seedPreStartScopeDecision();
+    const res = await app.inject({ method: "POST", url: `/api/human-actions/${action.id}/resolve`, payload: { resolvedBy: "yusuke", choice: "resume" } });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    const stored = getHumanAction(action.id);
+    assert.equal(stored.resolutionJson, JSON.stringify({ choice: "resume" }));
+    const payload = JSON.parse(getWorkItem(body.nextWorkItemId).payloadJson);
+    assert.ok(!("scopeDecisionNote" in payload), "no new payload key without a note");
+    await app.close();
+});
+test("NOT-272: a note sent with any other action type is dropped, never stored", async () => {
+    const app = await buildApp();
+    const { actionId } = await seedRealIssueAwaitingFinalReview();
+    const res = await app.inject({ method: "POST", url: `/api/human-actions/${actionId}/resolve`, payload: { resolvedBy: "yusuke", choice: "close", note: "should not persist" } });
+    assert.equal(res.statusCode, 200);
+    const stored = getHumanAction(actionId);
+    assert.equal(stored.resolutionJson, JSON.stringify({ choice: "close" }));
+    await app.close();
+});

package/bundle/server/dist/routes/index.js

@@ -12,6 +12,7 @@ import { refreshMuseCapacityIfStale } from "../capacity/muse-probe.js";
 import { refreshCodexCapacityIfStale } from "../capacity/codex-app-server.js";
 import { getCursorTeamBillingSnapshot, refreshCursorTeamBillingIfStale, } from "../capacity/cursor-team.js";
 import { getCursorIndividualBillingSnapshot, refreshCursorIndividualBillingIfStale, refreshCursorIndividualCapacityIfStale, } from "../capacity/cursor-individual.js";
+import { registerVersionRoute } from "./version.js";
 async function resolveDeckName(deckId) {
     if (!deckId)
         return null;
@@ -22,6 +23,7 @@ async function resolveDeckName(deckId) {
 }
 export async function registerRoutes(app) {
     app.get("/health", async () => ({ ok: true }));
+    registerVersionRoute(app);
     // NOT-159: process-lifetime Linear GraphQL counters (API-key bucket diagnostics).
     app.get("/api/debug/linear-usage", async () => getLinearUsageSnapshot());
     app.get("/api/runtimes/:runtime/models", async (req, reply) => {
@@ -76,11 +78,16 @@ export async function registerRoutes(app) {
     // subprocess.
     // NOT-268: Claude local-first ladder — one background refresh ingests
     // Claude Code's own free cache (plain file read, never a spawn) and then
-    // considers the paid probe without blocking the read: a bounded Haiku
-    // probe fires at most once per hour and only under the explicit
-    // valid 5H/1W observation is older than 60 minutes. This is the default;
-    // `AGENT_DEALER_CLAUDE_CAPACITY_REFRESH=off` is a strict no-op (no spawn,
-    // no spend). Failures never break the read below.
+    // considers the free `/usage` refresh without blocking the read: a
+    // bounded `claude -p "/usage"` call fires at most once per 14 minutes,
+    // only when either valid 5H/1W observation is missing or at least 14
+    // minutes old (NOT-281 — checked per window so a fresh sibling never
+    // suppresses its stale twin), and only when enabled (default on;
+    // `AGENT_DEALER_CLAUDE_CAPACITY_REFRESH=off` disables it). `/usage` is a
+    // local slash-command — no model call, $0 cost, ~300ms, verified live
+    // 2026-09-27 (the original design spawned a real model turn and was
+    // fixed after a live proof showed it never worked; see
+    // docs/RUNTIME_CAPACITY.md). Failures never break the read below.
     app.get("/api/runtime-capacity", async () => {
         try {
             void refreshClaudeCapacityIfStale().catch(() => {

package/bundle/server/dist/routes/runtime-capacity.test.js

@@ -15,8 +15,9 @@ process.env.AGENT_DEALER_SKIP_AGENT_HEALTH = "1";
 // Never spawn a real provider from route tests: the on-demand Codex refresh is
 // covered against the fake App Server in codex-app-server.test.ts.
 process.env.AGENT_DEALER_CODEX_CAPACITY_REFRESH = "off";
-// Claude's paid-after-1h fallback is default-on in production. Route tests
-// exercise stored/read behavior only and must never launch a real paid probe.
+// Claude's `/usage` refresh is free and default-on in production (fixed
+// 2026-09-27 — see docs/RUNTIME_CAPACITY.md); still disabled here so route
+// tests never spawn a real `claude` subprocess.
 process.env.AGENT_DEALER_CLAUDE_CAPACITY_REFRESH = "off";
 // Muse's one-hour fallback is also default-on; route tests cover the free
 // host trigger only and must never run a real model turn.

package/bundle/server/dist/routes/version.js

@@ -0,0 +1,30 @@
+// packages/server/src/routes/version.ts
+//
+// NOT-279: the running backend reports its own version. The CLI's installed version (and
+// the managed `current` symlink) can move ahead of a server that is still serving the old
+// build, so `agent-dealer status` must ask the live process instead of inferring from disk.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+/** Read once at module load: the package this process was started from, not whatever is on
+ * disk later (a managed update may replace sibling install dirs while we keep running). */
+function readServerPackageVersion() {
+    try {
+        // src/routes/version.ts and dist/routes/version.js both sit two levels below package.json.
+        const pkgPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+        return typeof pkg.version === "string" ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+const RUNNING_VERSION = readServerPackageVersion();
+const STARTED_AT = new Date().toISOString();
+export function registerVersionRoute(app) {
+    app.get("/api/version", async () => ({
+        version: RUNNING_VERSION,
+        pid: process.pid,
+        startedAt: STARTED_AT,
+    }));
+}

package/bundle/server/dist/routes/version.test.js

@@ -0,0 +1,21 @@
+// packages/server/src/routes/version.test.ts
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Fastify from "fastify";
+import { registerVersionRoute } from "./version.js";
+test("NOT-279: /api/version reports the running server package version and pid", async () => {
+    const pkgPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+    const expected = JSON.parse(fs.readFileSync(pkgPath, "utf8")).version;
+    const app = Fastify();
+    registerVersionRoute(app);
+    const res = await app.inject({ method: "GET", url: "/api/version" });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.version, expected);
+    assert.equal(body.pid, process.pid);
+    assert.ok(!Number.isNaN(Date.parse(body.startedAt)));
+    await app.close();
+});

package/bundle/server/dist/runners/muse-config-core.js

@@ -13,7 +13,11 @@ export const NOT_177_EVIDENCE = Object.freeze({
 });
 export const MUSE_MODEL = "muse-spark-1.3-contributor";
 export const AGENT_DECK_SERVER = "agent-deck";
-/** Deck reads a worker needs. `call_service_tool` (outbound mutation) is never in this list. */
+/**
+ * NOT-278: the read-only allowlist is a reviewer requirement, not a developer requirement.
+ * Developers receive the selected deck's full surface, including `call_service_tool`. These
+ * lists only ever materialize for a reviewer build that proves allowlist enforcement.
+ */
 export const AGENT_DECK_READ_TOOLS = [
     "get_bound_deck",
     "get_playbook",
@@ -46,6 +50,10 @@ const FORBIDDEN_FLAGS = [
 ];
 /** Which ambient env vars reach Muse. Everything else (META_API_KEY, MUSE_*, CODEX_HOME, ...) is dropped. */
 const ENV_ALLOWLIST = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "TERM", "TMPDIR"];
+/** Test-only harness vars for the fake `muse` fixture (fixtures/fake-muse.mjs), which can only be
+ * selected via the operator/test `MUSE_CLI` override — and passed through only when that
+ * override is set, so production runs of the default binary never carry them. */
+const FAKE_HARNESS_PREFIX = "FAKE_MUSE_";
 const ATTEMPT_PREFIX = "muse-attempt-";
 const SENTINEL = ".dealer-muse-attempt";
 /** Messages name fields and paths, never values that could be credentials. */
@@ -59,10 +67,17 @@ export class MuseIsolationError extends Error {
         this.name = "MuseIsolationError";
     }
 }
-/** Capabilities a role needs that the evidence does not prove. Both roles need both today. */
-export function unenforceableRestrictions(_role, evidence = NOT_177_EVIDENCE) {
+/**
+ * NOT-278: capabilities a role needs that the evidence does not prove. Developers receive the
+ * selected deck's full surface (including `call_service_tool`), so no allowlist enforcement is
+ * required; `cron_*` stays prohibited by the developer prompt and is detected post-run
+ * (`muse_cron_used`), not mechanically disabled. Reviewers still need both controls proven.
+ */
+export function unenforceableRestrictions(role, evidence = NOT_177_EVIDENCE) {
+    if (role === "developer")
+        return [];
     const missing = [];
-    // Outbound mutation (`call_service_tool`) must stay denied for every role, and Muse only
+    // Outbound mutation (`call_service_tool`) must stay denied for reviewers, and Muse only
     // stores enabled_tools/disabled_tools unless this is proven.
     if (!evidence.mcp_tool_allowlist_enforcement)
         missing.push("mcp_tool_allowlist_enforcement");
@@ -71,15 +86,37 @@ export function unenforceableRestrictions(_role, evidence = NOT_177_EVIDENCE) {
         missing.push("cron_tool_disable");
     return missing;
 }
-export function buildMuseSettings(agentDeck, evidence = NOT_177_EVIDENCE) {
+/**
+ * NOT-278: the deckless worker posture shared by every Muse settings.json — workflows and
+ * subagents off, reminder child runs off, plus `cron_*` only when proven mechanically
+ * disableable. The capacity serve host (which is shared across decks and never runs a
+ * session) uses this directly; per-attempt sessions add the required `agent-deck` server
+ * below. Exported only for that host — it is not a session attempt and `assertMuseSettings`
+ * rejects it (exactly one required `agent-deck` server is mandatory for a launch).
+ */
+export function buildMuseBaseSettings(role = "developer", evidence = NOT_177_EVIDENCE) {
     const runtime_capabilities = {};
     for (const name of REMINDERS) {
         runtime_capabilities[`plugin:tbh-reminders:reminder:${name}`] = { enabled: false };
     }
-    if (evidence.cron_tool_disable) {
+    // NOT-278: `cron_*` can only be claimed disabled for reviewers on a build that proves it.
+    // Developers are prohibited by prompt and detected post-run; their settings never claim it.
+    if (role === "reviewer" && evidence.cron_tool_disable) {
         for (const tool of CRON_TOOLS)
             runtime_capabilities[`tool:${tool}`] = { enabled: false };
     }
+    return {
+        schema_version: 1,
+        run: { workflow_trigger_mode: "off", subagent_delegation_mode: "off" },
+        runtime_capabilities,
+    };
+}
+/**
+ * NOT-278: developers always receive the selected deck's full surface unfiltered — their
+ * settings never carry `enabled_tools`/`disabled_tools` claims. The read-only allowlist only
+ * materializes for reviewers on a build that proves enforcement.
+ */
+export function buildMuseSettings(agentDeck, role = "developer", evidence = NOT_177_EVIDENCE) {
     const server = {
         type: "streamable-http",
         url: agentDeck.url,
@@ -90,20 +127,18 @@ export function buildMuseSettings(agentDeck, evidence = NOT_177_EVIDENCE) {
         // `mode`, not `required`: writing both drops the whole MCP block. Never "optional".
         mode: "required",
     };
-    if (evidence.mcp_tool_allowlist_enforcement) {
+    if (role === "reviewer" && evidence.mcp_tool_allowlist_enforcement) {
         server.enabled_tools = [...AGENT_DECK_READ_TOOLS];
         server.disabled_tools = [...AGENT_DECK_DENIED_TOOLS];
     }
     return {
-        schema_version: 1,
-        run: { workflow_trigger_mode: "off", subagent_delegation_mode: "off" },
-        runtime_capabilities,
+        ...buildMuseBaseSettings(role, evidence),
         mcpServers: { [AGENT_DECK_SERVER]: server },
     };
 }
 /** Whitelist check on a settings object (generated or re-read from disk). */
-export function assertMuseSettings(settings, agentDeck, evidence = NOT_177_EVIDENCE) {
-    const expected = buildMuseSettings(agentDeck, evidence);
+export function assertMuseSettings(settings, agentDeck, role = "developer", evidence = NOT_177_EVIDENCE) {
+    const expected = buildMuseSettings(agentDeck, role, evidence);
     if (JSON.stringify(sortKeys(settings)) !== JSON.stringify(sortKeys(expected))) {
         throw new MuseIsolationError("invalid_settings", "Muse settings differ from the approved role settings (extra, missing, or altered keys)");
     }
@@ -194,6 +229,17 @@ export function buildMuseEnv(root, ambient = process.env) {
         if (key.startsWith("LC_") && value !== undefined)
             env[key] = value;
     }
+    // Test-only seam: the fake fixture is driven by FAKE_MUSE_* (scenario, record path, version
+    // pins) and the exec lane is exact, so without this the fixture cannot be driven at all.
+    // These vars join attempt.env only when the operator/test MUSE_CLI override selects the
+    // binary — i.e. only the fixture can ever receive them, never the default real binary —
+    // and the pre-spawn verify() snapshot covers them exactly like every other approved var.
+    if (ambient.MUSE_CLI?.trim()) {
+        for (const [key, value] of Object.entries(ambient)) {
+            if (key.startsWith(FAKE_HARNESS_PREFIX) && value !== undefined)
+                env[key] = value;
+        }
+    }
     env.MUSE_NO_AUTO_UPDATE = "1";
     env.XDG_CONFIG_HOME = path.join(root, "config");
     env.XDG_DATA_HOME = path.join(root, "data");
@@ -337,7 +383,8 @@ function sameJson(a, b) {
  * Validates, refuses unenforceable restrictions, then writes the per-attempt dir (0700) with
  * settings.json (0600) and an auth link. Throws before spawn; leaves nothing behind on failure.
  *
- * Always uses the pinned `NOT_177_EVIDENCE`, under which both roles are currently refused. There is
+ * Always uses the pinned `NOT_177_EVIDENCE`, under which developers are admitted unfiltered
+ * (NOT-278: the full deck surface, no allowlist claims) and reviewers are still refused. There is
  * deliberately no runtime seam that accepts other evidence: the enforced-path tests load a
  * source-rewritten copy of this file instead (see muse-config.test.ts).
  */
@@ -355,8 +402,8 @@ function prepareWithEvidence(rawInput, evidence) {
     const { worktree, baseDir } = validateInput(input);
     const agentDeck = input.agentDeck;
     const credentialKind = input.credential.kind;
-    const settings = deepFreeze(buildMuseSettings(agentDeck, evidence));
-    assertMuseSettings(settings, agentDeck, evidence);
+    const settings = deepFreeze(buildMuseSettings(agentDeck, input.role, evidence));
+    assertMuseSettings(settings, agentDeck, input.role, evidence);
     const apiKey = input.credential.kind === "api-key" ? input.credential.apiKey : undefined;
     const argv = buildMuseArgv({
         role: input.role,
@@ -445,7 +492,7 @@ function prepareWithEvidence(rawInput, evidence) {
                 throw err;
             throw new MuseIsolationError("invalid_settings", "Muse settings.json is missing or unreadable");
         }
-        assertMuseSettings(onDisk, agentDeck, evidence);
+        assertMuseSettings(onDisk, agentDeck, input.role, evidence);
         const entries = fs.readdirSync(path.dirname(settingsPath)).sort();
         const allowed = credentialKind === "auth-file" ? ["auth.json", "settings.json"] : ["settings.json"];
         if (entries.join() !== allowed.join()) {

package/bundle/server/dist/runners/muse-config.js

@@ -2,4 +2,4 @@
 //
 // The implementation lives in muse-config-core.ts, which pins `prepareMuseAttempt` to
 // `NOT_177_EVIDENCE`. No module in the build exports a preparer that accepts caller-supplied evidence.
-export { AGENT_DECK_DENIED_TOOLS, AGENT_DECK_READ_TOOLS, AGENT_DECK_SERVER, MUSE_MODEL, MuseIsolationError, NOT_177_EVIDENCE, assertMuseArgv, assertMuseSettings, buildMuseArgv, buildMuseEnv, buildMuseSettings, createRedactor, defaultOperatorAuthPath, prepareMuseAttempt, unenforceableRestrictions, } from "./muse-config-core.js";
+export { AGENT_DECK_DENIED_TOOLS, AGENT_DECK_READ_TOOLS, AGENT_DECK_SERVER, MUSE_MODEL, MuseIsolationError, NOT_177_EVIDENCE, assertMuseArgv, assertMuseSettings, buildMuseArgv, buildMuseBaseSettings, buildMuseEnv, buildMuseSettings, createRedactor, defaultOperatorAuthPath, prepareMuseAttempt, unenforceableRestrictions, } from "./muse-config-core.js";