muse-crew 0.1.1 → 0.2.1

package/API.md

@@ -210,6 +210,21 @@ Set a global configuration value.
 | `key` | string (1–80) | yes | |
 | `value` | string (≤ 10000) | yes | |
 
+### `setprovenance`
+
+Stamp publication provenance. Called by the crew Publish phase after rebuilding the artifact.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `source_commit` | 40-char hex | yes | Repo commit the artifact was built from |
+| `crew_release` | 40-char hex | yes | Active crew release (`$CREW_HOME/current`) at publish time |
+| `published_at` | ISO 8601 datetime (UTC) | yes | |
+| `task_id` | string | no | Publishing task, for traceability |
+
+### `getprovenance`
+
+Read the last publication provenance. Returns `{ "provenance": { "source_commit", "crew_release", "published_at" } }`, or `{ "provenance": null }` when nothing has been published yet.
+
 ---
 
 ## Not part of this API

package/docs/guide.md

@@ -190,7 +190,7 @@ Every 3 minutes, the `crew-poll` cron fires:
 
 5. **Main-chat agent launches workflows** — receives the claim records and calls `workflow_launch_async` for each one.
 
-6. **Workflow executes phases** — each phase dispatches an agent in character (the identity assigned to that phase), records the result, and advances the task.
+6. **Workflow executes phases** — each phase dispatches an agent in character (the identity assigned to that phase), records the result, and advances the task. At every phase boundary the workflow re-reads the task's project: if the task was moved to another project mid-run, the stale run aborts (its session is marked `failed` at the Build/Write step and its worktree is removed from the old repo) so the dispatcher re-launches it with the new project's repo and config.
 
 7. **Task completes** — when all phases finish, the dispatcher marks the task `done` on the next tick.
 

package/lib/crew-release.sh

@@ -59,6 +59,38 @@ cmd_init() {
   echo "CURRENT: $cur"
 }
 
+# ── workflow syntax validation ──────────────────────────────────────
+# Every workflow script must parse before a release can install.
+_validate_workflows() {
+  # The workflow runtime accepts top-level `export`, `return`, and `await`
+  # (it wraps scripts in an async function), so neither `node --check` on the
+  # raw .js (vacuous for ESM — exits 0 even on blatant syntax errors) nor a
+  # .mjs check (rejects the runtime-legal top-level `return`) is correct.
+  # Emulate the runtime instead: strip `export`, wrap the script in an async
+  # function, then node --check the result. Tokenizer errors (e.g. an
+  # unterminated string literal) still fail under the wrap.
+  local dir="$1"
+  local f tmp base
+  tmp="$(mktemp -d)"
+  for f in "$dir"/workflows/*.js; do
+    [ -f "$f" ] || continue
+    base="$(basename "$f" .js)"
+    {
+      echo "async function __crew_workflow__(args) {"
+      sed 's/^export //' "$f"
+      echo "}"
+    } > "$tmp/$base.js"
+    if ! node --check "$tmp/$base.js" 2>"$tmp/$base.err"; then
+      cat "$tmp/$base.err" >&2
+      echo "VALIDATION FAILED: $f does not parse" >&2
+      rm -rf "$tmp"
+      return 1
+    fi
+  done
+  rm -rf "$tmp"
+  echo "VALIDATED: workflow scripts parse"
+}
+
 # ── deploy ────────────────────────────────────────────────────────────
 # Build, validate, and atomically activate a release from repo HEAD.
 # Single command — no cross-step lock needed.
@@ -98,6 +130,11 @@ cmd_deploy() {
       [ -d workflows ] && cp -r workflows "$staging_dir/"
       [ -d lib ]       && cp -r lib "$staging_dir/"
     fi
+    # Gate: refuse to install a release whose workflow scripts don't parse.
+    if ! _validate_workflows "$staging_dir"; then
+      rm -rf "$staging_dir"
+      die "release $hash rejected: workflow syntax validation failed"
+    fi
     # Atomic rename into place
     mv "$staging_dir" "$release_dir"
     echo "INSTALLED: $hash"

package/lib/worktree-lifecycle.sh

@@ -125,6 +125,14 @@ cmd_inspect() {
     return 1
   fi
 
+  echo "=== Branch: task/$task_id ==="
+  local tip
+  tip=$(git rev-parse "task/$task_id")
+  echo "TIP: $tip"
+  echo ""
+  echo "=== Commits ahead of main ==="
+  git log --oneline "main..task/$task_id"
+  echo ""
   echo "=== Diff: main...task/$task_id ==="
   git diff --stat "main...task/$task_id"
   echo ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,
@@ -10,7 +10,7 @@
   },
   "files": [
     "workflows/",
-    "identities/*.md",
+    "identities/",
     "personas/",
     "lib/",
     "seed/",

package/seed/workflows/AGENTS.md

@@ -1,3 +1,7 @@
 # AGENTS.md
 
 Human-readable workflow definitions — the canonical source. `crew-init` copies these to `$CREW_HOME/.orchestration/workflows/` during setup. Each file describes one workflow type: its phases, identity assignments, and progression rules.
+
+## Sync policy
+
+The workflow `.md` docs are synced from the activated release into `$CREW_HOME/.orchestration/workflows/` on every `crew-release.sh` release activation (deploy and rollback) — automatically, never as a manual step. The invariant is that the dashboard's workflow documents always reflect the phases the dispatcher actually runs: the dashboard reads those documents live from disk and `recovertask` validates target phases against them, so drift breaks recovery. Because the docs and the workflow scripts ship in the same repo commit, syncing at activation maintains the invariant by construction; the manual-step approach is what drifted (docs seeded once by `crew-init`'s `cp -n` went stale while the phases gained Integrate and Publish), so there is no manual re-sync step.

package/workflows/bugfix.js

@@ -37,6 +37,9 @@ const ORPHAN_SWEEP = RUN_LIB + "/orphan-sweep.sh";
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
+// Project this run was dispatched for — the mid-run project-change guard
+// compares the task's live project against this on every phase boundary.
+const LAUNCH_PROJECT_ID = inputs.project_id || "";
 const REPO_PATH = projectConfig.repo_path || "~/workspace/ts-spaces/orchestra-dashboard";
 const PUBLISH_TYPE = projectConfig.deploy_type || "";
 const PUBLISH_SLUG = projectConfig.deploy_slug || DASHBOARD_SLUG;
@@ -68,6 +71,7 @@ const STEPS = [
 ];
 const BUILD_INDEX = STEPS.findIndex(s => s.name === 'Build');
 if (BUILD_INDEX < 0) throw new Error("STEPS missing 'Build' step");
+const REWORK_STEP = STEPS[BUILD_INDEX].name;
 // Shared rework budget: Review and QA rejections draw from the SAME pool of 2.
 // E.g. 2 Review bounces + 1 QA bounce = 3 total > budget -> task blocks.
 const MAX_TOTAL_REWORK = 2;
@@ -90,6 +94,44 @@ while (i < STEPS.length) {
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
 
+  // ── Project-change guard ───────────────────────────────────────────
+  // A task moved to another project mid-run must not keep working in the
+  // old project's repo. Re-read the task's project at every phase
+  // boundary: if it differs from the project this run was dispatched for,
+  // abort the stale run (failed at the rework target) so the dispatcher
+  // re-launches the step with the new project's config.
+  if (LAUNCH_PROJECT_ID) {
+    const projectCheck = await agent(
+      "Read this task's current project from the dashboard.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }.\n" +
+      "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
+      "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
+      {
+        key: "project-check-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""),
+        label: "Checking project before " + step.name,
+        schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
+      }
+    );
+    const currentProject = (projectCheck && projectCheck.project) ? projectCheck.project : LAUNCH_PROJECT_ID;
+    if (currentProject !== LAUNCH_PROJECT_ID) {
+      const abortMessage = "Task project changed mid-run from '" + LAUNCH_PROJECT_ID + "' to '" + currentProject + "' — aborting stale run. The dispatcher will re-launch from " + REWORK_STEP + " with the new project context.";
+      log(abortMessage);
+      const abortSessionPatch = (isFirstClaim && firstSessionId) ? "\"id\": \"" + firstSessionId + "\", " : "";
+      await agent(
+        "Abort the stale run and remove its worktree from the old project's repo.\n" +
+        "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", " + abortSessionPatch + "\"identity\": \"" + step.identity + "\", \"step\": \"" + REWORK_STEP + "\", \"status\": \"failed\", " +
+        "\"notes\": " + JSON.stringify(abortMessage + " Rebuild from the Map session notes in the task's event history.") + " }.\n" +
+        "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"identity\": \"" + step.identity + "\", \"message\": " + JSON.stringify(abortMessage) + " }.\n" +
+        "Then run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " cleanup " + taskId + "\n" +
+        "The cleanup output should contain CLEANUP.",
+        { key: "abort-project-change", label: "Aborting stale run (project changed)", schema: { type: "object" } }
+      );
+      return { status: "failed", task_id: taskId, reason: abortMessage };
+    }
+  }
+
   // Publish is optional and target-based. Empty target = prototyping project: skip the phase.
   // Unknown target (incl. legacy "repo") = config error: block.
   if (step.name === "Publish" && !PUBLISH_TYPE) {
@@ -175,6 +217,7 @@ while (i < STEPS.length) {
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec (from the task description or spec files under " + crewHome + "/).\n\n") +
       "Examine the code changes by running:\n" +
       "CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " inspect " + taskId + "\n\n" +
+      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
       "You can also read specific files in the worktree at:\n" +
       REPO_PATH + "/.worktrees/" + taskId + "/\n\n" +
       "Check quality, correctness, and spec compliance.\n" +
@@ -198,8 +241,7 @@ while (i < STEPS.length) {
       "- If the push succeeds, report the merged commit hash.\n" +
       "- If the push is rejected as non-fast-forward (the remote has commits not present locally),\n" +
       "  NEVER force-push. Do not run any --force variant. Set passed to false with summary:\n" +
-      "  'git push origin main rejected as non-fast-forward — remote main has diverged; manual resolution required'.
-\n\n" +
+      "  'git push origin main rejected as non-fast-forward — remote main has diverged; manual resolution required'.\n\n" +
       "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true/false }. No prose, no markdown, just the JSON object.";
 
   } else if (step.name === "Publish") {
@@ -232,6 +274,7 @@ while (i < STEPS.length) {
     } else if (PUBLISH_TYPE === "artifact") {
       // Artifact projects: rebuild the live artifact via artifact_edit, then finalize
       instructions = "Publish the merged code to the live artifact.\n\n" +
+        "POLICY: The live artifact is rebuilt only in this phase, from the repo. Never use artifact_edit to change the artifact directly — fixes go through the repo and the loop. A source fix is not done until the artifact is rebuilt from it here.\n\n" +
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "STEP 0: Refresh the merge lock to prevent stale-lock breaking during publish.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "\n\n" +
@@ -240,6 +283,13 @@ while (i < STEPS.length) {
         "Then call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
         "'Rebuild the application from current source. Do not modify any source files — just rebuild and deploy what is on disk.'\n" +
         "Wait for the build to complete by polling artifact_status until it is no longer running.\n\n" +
+        "STEP 1B: Stamp publication provenance.\n" +
+        "Run: cd " + REPO_PATH + " && git rev-parse HEAD\n" +
+        "Run: basename $(readlink " + crewHome + "/current)\n" +
+        "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+        "Call artifact_invoke_action on slug \"" + PUBLISH_SLUG + "\", action \"setprovenance\", args:\n" +
+        "{ \"source_commit\": \"<rev-parse output>\", \"crew_release\": \"<basename output>\", \"published_at\": \"<date output>\", \"task_id\": \"" + taskId + "\" }.\n" +
+        "Confirm the response contains ok: true. If setprovenance fails, report it in your summary but still run post-deploy to release the lock.\n\n" +
         "STEP 2: Finalize.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, publishing is complete.\n\n" +
@@ -266,6 +316,15 @@ while (i < STEPS.length) {
       "If testing passes, your final response MUST be valid JSON and nothing else: { \"passed\": true, \"summary\": \"test results\" }.\n" +
       "If testing fails, your final response MUST be valid JSON and nothing else: { \"passed\": false, \"summary\": \"failure details\" }.\n" +
       "No prose, no markdown, just the JSON object.";
+    if (PUBLISH_TYPE === "artifact") {
+      instructions = "PROVENANCE CHECK (this project publishes to a dashboard artifact).\n" +
+        "Call artifact_invoke_action on slug \"" + PUBLISH_SLUG + "\", action \"getprovenance\", args: {}.\n" +
+        "If provenance is null, FAIL: { \"passed\": false, \"summary\": \"provenance missing — publish did not stamp\" }.\n" +
+        "Run: cd " + REPO_PATH + " && git rev-parse HEAD\n" +
+        "Run: basename $(readlink " + crewHome + "/current)\n" +
+        "If either hash mismatches, FAIL: { \"passed\": false, \"summary\": \"provenance mismatch: [details]\" }.\n\n" +
+        instructions;
+    }
   }
 
   // Task event history — all phases except Review see the comment log

package/workflows/chore.js

@@ -35,6 +35,9 @@ const ORPHAN_SWEEP = RUN_LIB + "/orphan-sweep.sh";
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
+// Project this run was dispatched for — the mid-run project-change guard
+// compares the task's live project against this on every phase boundary.
+const LAUNCH_PROJECT_ID = inputs.project_id || "";
 const REPO_PATH = projectConfig.repo_path || "~/workspace/ts-spaces/orchestra-dashboard";
 const PUBLISH_TYPE = projectConfig.deploy_type || "";
 const PUBLISH_SLUG = projectConfig.deploy_slug || DASHBOARD_SLUG;
@@ -64,6 +67,7 @@ const STEPS = [
 ];
 const BUILD_INDEX = STEPS.findIndex(s => s.name === 'Build');
 if (BUILD_INDEX < 0) throw new Error("STEPS missing 'Build' step");
+const REWORK_STEP = STEPS[BUILD_INDEX].name;
 const MAX_REWORK = 2;
 let reworkCount = 0;
 let rejectionNotes = inputs.rejection_notes || "";
@@ -84,6 +88,44 @@ while (i < STEPS.length) {
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
 
+  // ── Project-change guard ───────────────────────────────────────────
+  // A task moved to another project mid-run must not keep working in the
+  // old project's repo. Re-read the task's project at every phase
+  // boundary: if it differs from the project this run was dispatched for,
+  // abort the stale run (failed at the rework target) so the dispatcher
+  // re-launches the step with the new project's config.
+  if (LAUNCH_PROJECT_ID) {
+    const projectCheck = await agent(
+      "Read this task's current project from the dashboard.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }.\n" +
+      "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
+      "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
+      {
+        key: "project-check-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : ""),
+        label: "Checking project before " + step.name,
+        schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
+      }
+    );
+    const currentProject = (projectCheck && projectCheck.project) ? projectCheck.project : LAUNCH_PROJECT_ID;
+    if (currentProject !== LAUNCH_PROJECT_ID) {
+      const abortMessage = "Task project changed mid-run from '" + LAUNCH_PROJECT_ID + "' to '" + currentProject + "' — aborting stale run. The dispatcher will re-launch from " + REWORK_STEP + " with the new project context.";
+      log(abortMessage);
+      const abortSessionPatch = (isFirstClaim && firstSessionId) ? "\"id\": \"" + firstSessionId + "\", " : "";
+      await agent(
+        "Abort the stale run and remove its worktree from the old project's repo.\n" +
+        "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", " + abortSessionPatch + "\"identity\": \"" + step.identity + "\", \"step\": \"" + REWORK_STEP + "\", \"status\": \"failed\", " +
+        "\"notes\": " + JSON.stringify(abortMessage + " Rebuild from the Map session notes in the task's event history.") + " }.\n" +
+        "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"identity\": \"" + step.identity + "\", \"message\": " + JSON.stringify(abortMessage) + " }.\n" +
+        "Then run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " cleanup " + taskId + "\n" +
+        "The cleanup output should contain CLEANUP.",
+        { key: "abort-project-change", label: "Aborting stale run (project changed)", schema: { type: "object" } }
+      );
+      return { status: "failed", task_id: taskId, reason: abortMessage };
+    }
+  }
+
   // Publish is optional and target-based. Empty target = prototyping project: skip the phase.
   // Unknown target (incl. legacy "repo") = config error: block.
   if (step.name === "Publish" && !PUBLISH_TYPE) {
@@ -157,6 +199,7 @@ while (i < STEPS.length) {
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec from the task description.\n\n") +
       "Examine the code changes by running:\n" +
       "CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " inspect " + taskId + "\n\n" +
+      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
       "You can also read specific files in the worktree at:\n" +
       REPO_PATH + "/.worktrees/" + taskId + "/\n\n" +
       "Check quality, correctness, spec compliance.\n" +
@@ -180,8 +223,7 @@ while (i < STEPS.length) {
       "- If the push succeeds, report the merged commit hash.\n" +
       "- If the push is rejected as non-fast-forward (the remote has commits not present locally),\n" +
       "  NEVER force-push. Do not run any --force variant. Set passed to false with summary:\n" +
-      "  'git push origin main rejected as non-fast-forward — remote main has diverged; manual resolution required'.
-\n\n" +
+      "  'git push origin main rejected as non-fast-forward — remote main has diverged; manual resolution required'.\n\n" +
       "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true/false }. No prose, no markdown, just the JSON object.";
 
   } else if (step.name === "Publish") {
@@ -214,6 +256,7 @@ while (i < STEPS.length) {
     } else if (PUBLISH_TYPE === "artifact") {
       // Artifact projects: rebuild the live artifact via artifact_edit, then finalize
       instructions = "Publish the merged code to the live artifact.\n\n" +
+        "POLICY: The live artifact is rebuilt only in this phase, from the repo. Never use artifact_edit to change the artifact directly — fixes go through the repo and the loop. A source fix is not done until the artifact is rebuilt from it here.\n\n" +
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "STEP 0: Refresh the merge lock to prevent stale-lock breaking during publish.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "\n\n" +
@@ -222,6 +265,13 @@ while (i < STEPS.length) {
         "Then call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
         "'Rebuild the application from current source. Do not modify any source files — just rebuild and deploy what is on disk.'\n" +
         "Wait for the build to complete by polling artifact_status until it is no longer running.\n\n" +
+        "STEP 1B: Stamp publication provenance.\n" +
+        "Run: cd " + REPO_PATH + " && git rev-parse HEAD\n" +
+        "Run: basename $(readlink " + crewHome + "/current)\n" +
+        "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+        "Call artifact_invoke_action on slug \"" + PUBLISH_SLUG + "\", action \"setprovenance\", args:\n" +
+        "{ \"source_commit\": \"<rev-parse output>\", \"crew_release\": \"<basename output>\", \"published_at\": \"<date output>\", \"task_id\": \"" + taskId + "\" }.\n" +
+        "Confirm the response contains ok: true. If setprovenance fails, report it in your summary but still run post-deploy to release the lock.\n\n" +
         "STEP 2: Finalize.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, publishing is complete.\n\n" +

package/workflows/crew-dispatch.js

@@ -285,6 +285,7 @@ for (var p = 0; p < toProcess.length; p++) {
     start_step_index: item.startStep,
     rejection_notes: item.rejectionNotes || "",
     project_config: projectCfg,
+    project_id: taskProject,
     dashboardSlug: DASHBOARD_SLUG,
     crewHome: crewHome
   };

package/workflows/docs.js

@@ -25,6 +25,9 @@ const ORCH_PATH = crewHome + "/.orchestration";
 // Project repo — the docs workflow edits the project's own docs, not the crew home.
 // Falls back to crew home only for manual launches without a project config.
 const projectConfig = inputs.project_config || {};
+// Project this run was dispatched for — the mid-run project-change guard
+// compares the task's live project against this on every phase boundary.
+const LAUNCH_PROJECT_ID = inputs.project_id || "";
 const REPO_PATH = projectConfig.repo_path || crewHome;
 
 if (!taskId) {
@@ -39,6 +42,7 @@ const STEPS = [
 ];
 const WRITE_INDEX = STEPS.findIndex(s => s.name === 'Write');
 if (WRITE_INDEX < 0) throw new Error("STEPS missing 'Write' step");
+const REWORK_STEP = STEPS[WRITE_INDEX].name;
 const MAX_REWORK = 2;
 let reworkCount = 0;
 let rejectionNotes = inputs.rejection_notes || "";
@@ -51,6 +55,42 @@ while (i < STEPS.length) {
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
 
+  // ── Project-change guard ───────────────────────────────────────────
+  // A task moved to another project mid-run must not keep editing the old
+  // project's repo. Re-read the task's project at every phase boundary: if
+  // it differs from the project this run was dispatched for, abort the
+  // stale run (failed at the rework target) so the dispatcher re-launches
+  // the step with the new project's config.
+  if (LAUNCH_PROJECT_ID) {
+    const projectCheck = await agent(
+      "Read this task's current project from the dashboard.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }.\n" +
+      "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
+      "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
+      {
+        key: "project-check-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : ""),
+        label: "Checking project before " + step.name,
+        schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
+      }
+    );
+    const currentProject = (projectCheck && projectCheck.project) ? projectCheck.project : LAUNCH_PROJECT_ID;
+    if (currentProject !== LAUNCH_PROJECT_ID) {
+      const abortMessage = "Task project changed mid-run from '" + LAUNCH_PROJECT_ID + "' to '" + currentProject + "' — aborting stale run. The dispatcher will re-launch from " + REWORK_STEP + " with the new project context.";
+      log(abortMessage);
+      const abortSessionPatch = (isFirstClaim && firstSessionId) ? "\"id\": \"" + firstSessionId + "\", " : "";
+      await agent(
+        "Abort the stale run.\n" +
+        "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", " + abortSessionPatch + "\"identity\": \"" + step.identity + "\", \"step\": \"" + REWORK_STEP + "\", \"status\": \"failed\", " +
+        "\"notes\": " + JSON.stringify(abortMessage) + " }.\n" +
+        "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"identity\": \"" + step.identity + "\", \"message\": " + JSON.stringify(abortMessage) + " }.",
+        { key: "abort-project-change", label: "Aborting stale run (project changed)", schema: { type: "object" } }
+      );
+      return { status: "failed", task_id: taskId, reason: abortMessage };
+    }
+  }
+
   let activeSessionId;
   if (isFirstClaim && firstSessionId) {
     activeSessionId = firstSessionId;

package/workflows/standard.js

@@ -37,6 +37,9 @@ const ORPHAN_SWEEP = RUN_LIB + "/orphan-sweep.sh";
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
+// Project this run was dispatched for — the mid-run project-change guard
+// compares the task's live project against this on every phase boundary.
+const LAUNCH_PROJECT_ID = inputs.project_id || "";
 const REPO_PATH = projectConfig.repo_path || "~/workspace/ts-spaces/orchestra-dashboard";
 const PUBLISH_TYPE = projectConfig.deploy_type || "";
 const PUBLISH_SLUG = projectConfig.deploy_slug || DASHBOARD_SLUG;
@@ -67,6 +70,7 @@ const STEPS = [
 ];
 const BUILD_INDEX = STEPS.findIndex(s => s.name === 'Build');
 if (BUILD_INDEX < 0) throw new Error("STEPS missing 'Build' step");
+const REWORK_STEP = STEPS[BUILD_INDEX].name;
 // Shared rework budget: Review and QA rejections draw from the SAME pool of 2.
 // E.g. 2 Review bounces + 1 QA bounce = 3 total > budget -> task blocks.
 const MAX_TOTAL_REWORK = 2;
@@ -98,6 +102,44 @@ while (i < STEPS.length) {
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
 
+  // ── Project-change guard ───────────────────────────────────────────
+  // A task moved to another project mid-run must not keep working in the
+  // old project's repo. Re-read the task's project at every phase
+  // boundary: if it differs from the project this run was dispatched for,
+  // abort the stale run (failed at the rework target) so the dispatcher
+  // re-launches the step with the new project's config.
+  if (LAUNCH_PROJECT_ID) {
+    const projectCheck = await agent(
+      "Read this task's current project from the dashboard.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }.\n" +
+      "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
+      "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
+      {
+        key: "project-check-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""),
+        label: "Checking project before " + step.name,
+        schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
+      }
+    );
+    const currentProject = (projectCheck && projectCheck.project) ? projectCheck.project : LAUNCH_PROJECT_ID;
+    if (currentProject !== LAUNCH_PROJECT_ID) {
+      const abortMessage = "Task project changed mid-run from '" + LAUNCH_PROJECT_ID + "' to '" + currentProject + "' — aborting stale run. The dispatcher will re-launch from " + REWORK_STEP + " with the new project context.";
+      log(abortMessage);
+      const abortSessionPatch = (isFirstClaim && firstSessionId) ? "\"id\": \"" + firstSessionId + "\", " : "";
+      await agent(
+        "Abort the stale run and remove its worktree from the old project's repo.\n" +
+        "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", " + abortSessionPatch + "\"identity\": \"" + step.identity + "\", \"step\": \"" + REWORK_STEP + "\", \"status\": \"failed\", " +
+        "\"notes\": " + JSON.stringify(abortMessage + " Rebuild from the Map session notes in the task's event history.") + " }.\n" +
+        "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"logevent\", args:\n" +
+        "{ \"task_id\": \"" + taskId + "\", \"type\": \"failed\", \"identity\": \"" + step.identity + "\", \"message\": " + JSON.stringify(abortMessage) + " }.\n" +
+        "Then run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " cleanup " + taskId + "\n" +
+        "The cleanup output should contain CLEANUP.",
+        { key: "abort-project-change", label: "Aborting stale run (project changed)", schema: { type: "object" } }
+      );
+      return { status: "failed", task_id: taskId, reason: abortMessage };
+    }
+  }
+
   // Publish is optional and target-based. Empty target = prototyping project: skip the phase.
   // Unknown target (incl. legacy "repo") = config error: block.
   if (step.name === "Publish" && !PUBLISH_TYPE) {
@@ -173,6 +215,7 @@ while (i < STEPS.length) {
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec (from the task description or spec files under " + crewHome + "/).\n\n") +
       "Examine the code changes by running:\n" +
       "CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " inspect " + taskId + "\n\n" +
+      "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
       "You can also read specific files in the worktree at:\n" +
       REPO_PATH + "/.worktrees/" + taskId + "/\n\n" +
       "Check quality, correctness, and spec compliance.\n" +
@@ -229,6 +272,7 @@ while (i < STEPS.length) {
     } else if (PUBLISH_TYPE === "artifact") {
       // Artifact projects: rebuild the live artifact via artifact_edit, then finalize
       instructions = "Publish the merged code to the live artifact.\n\n" +
+        "POLICY: The live artifact is rebuilt only in this phase, from the repo. Never use artifact_edit to change the artifact directly — fixes go through the repo and the loop. A source fix is not done until the artifact is rebuilt from it here.\n\n" +
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "STEP 0: Refresh the merge lock to prevent stale-lock breaking during publish.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "\n\n" +
@@ -237,6 +281,13 @@ while (i < STEPS.length) {
         "Then call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
         "'Rebuild the application from current source. Do not modify any source files — just rebuild and deploy what is on disk.'\n" +
         "Wait for the build to complete by polling artifact_status until it is no longer running.\n\n" +
+        "STEP 1B: Stamp publication provenance.\n" +
+        "Run: cd " + REPO_PATH + " && git rev-parse HEAD\n" +
+        "Run: basename $(readlink " + crewHome + "/current)\n" +
+        "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+        "Call artifact_invoke_action on slug \"" + PUBLISH_SLUG + "\", action \"setprovenance\", args:\n" +
+        "{ \"source_commit\": \"<rev-parse output>\", \"crew_release\": \"<basename output>\", \"published_at\": \"<date output>\", \"task_id\": \"" + taskId + "\" }.\n" +
+        "Confirm the response contains ok: true. If setprovenance fails, report it in your summary but still run post-deploy to release the lock.\n\n" +
         "STEP 2: Finalize.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, publishing is complete.\n\n" +
@@ -265,6 +316,11 @@ while (i < STEPS.length) {
         "STEP 2: Verify data integrity via the dashboard API.\n" +
         "Use artifact_invoke_action on slug \"" + PUBLISH_SLUG + "\" with read-only actions (e.g. gettasks, getagentsessions) to check the task's data-level effects.\n" +
         "DOCS GATE: If the change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), verify the public docs describe it. If public docs are missing or stale for a public-affecting change, FAIL with { \"passed\": false, \"summary\": \"public docs missing/stale for [the change]\" }. QA always fails when public-affecting changes lack public docs. Guide/tutorial gaps are lower priority — file a follow-up task for those instead of failing.\n\n" +
+        "PROVENANCE CHECK: Call artifact_invoke_action on slug \"" + PUBLISH_SLUG + "\", action \"getprovenance\", args: {}.\n" +
+        "If provenance is null, FAIL: { \"passed\": false, \"summary\": \"provenance missing — publish did not stamp source/crew release\" }.\n" +
+        "Run: cd " + REPO_PATH + " && git rev-parse HEAD\n" +
+        "Run: basename $(readlink " + crewHome + "/current)\n" +
+        "If provenance.source_commit does not equal the rev-parse output or provenance.crew_release does not equal the basename output, FAIL: { \"passed\": false, \"summary\": \"provenance mismatch: [details]\" }.\n\n" +
         "STEP 3: File follow-up tasks for any related issues you discover.\n" +
         "Use artifact_invoke_action createtask on slug \"" + DASHBOARD_SLUG + "\" for each issue.\n\n" +
         "Your final response MUST be valid JSON and nothing else:\n" +