muse-crew 0.11.0 → 0.12.0

package/lib/compose-evidence-caption.js

@@ -9,7 +9,18 @@
 // caller appends AFTER this caption. Deterministic: every line is extracted
 // mechanically from the Crew API, the task's events, and the merge commit —
 // no LLM prose. The caller (seed/cron-body-template.md Step 6) prints this
-// caption verbatim, then the two attachment lines, then logs delivery.
+// caption verbatim, then the two attachment lines (only when the audit
+// harness actually captured screenshots), then logs delivery.
+//
+// Capture guard (2026-09-17, room #14): the composer must SEE the captures
+// before it claims them. It once fabricated "desktop + mobile captures
+// below" for a terminal-surface task with no audit dir at all, and opened
+// with "these screenshots are dropping in" when no screenshots existed. So
+// it resolves the audit dir itself — <home>/workspace/ts-spaces/<deploy_slug>
+// /audits/<auditDir>/, the same root lib/crew-api.js and lib/readback-disk.js
+// resolve — and checks screenshot.png + screenshot-mobile.png are files.
+// Missing deploy_slug, missing dir, or missing PNGs gets the honest
+// no-captures line; terminal surfaces are named, not assumed.
 //
 // Usage:
 //   node lib/compose-evidence-caption.js --crew-home <home> \
@@ -19,6 +30,7 @@
 
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 
 function usage(msg) {
@@ -76,6 +88,22 @@ try {
 }
 const task = (state.tasks || []).find((t) => t.id === taskId);
 if (!task) usage("task " + taskId + " not found");
+const project = (state.projects || []).find((p) => p.id === task.project);
+
+// Capture guard (2026-09-17, room #14): resolve the audit dir the audit
+// harness actually writes and verify the captures exist before claiming
+// them. A bare --audit-dir name is never trusted on its own.
+function isFile(p) {
+  try { return fs.statSync(p).isFile(); } catch { return false; }
+}
+let auditPath = null;
+if (project && project.deploy_slug) {
+  auditPath = path.join(os.homedir(), "workspace", "ts-spaces",
+    project.deploy_slug, "audits", auditDir);
+}
+const hasCaptures = !!(auditPath &&
+  isFile(path.join(auditPath, "screenshot.png")) &&
+  isFile(path.join(auditPath, "screenshot-mobile.png")));
 
 let events = [];
 try {
@@ -149,8 +177,7 @@ if (!commit) {
 // task title when the commit is unknown or unreadable.
 let solution = "";
 if (commit) {
-  const proj = (state.projects || []).find((p) => p.id === task.project);
-  if (proj && proj.repo_path) solution = gitSubject(proj.repo_path, commit);
+  if (project && project.repo_path) solution = gitSubject(project.repo_path, commit);
 }
 if (!solution) solution = task.title;
 
@@ -169,16 +196,37 @@ const newestBaselineNote = notesNewest.find((e) => /^baseline:\s*/i.test(e.messa
 const visualUnavailable = !verdict && !!newestBaselineNote &&
   /^baseline:\s*none/i.test(newestBaselineNote.message || "");
 
+const verdictLine = verdict
+  ? " QA verdict: " + verdict.status + (verdict.summary ? " — " + trimWords(verdict.summary, 200) : "") + "."
+  : " No QA verdict recorded.";
+
 const lines = [];
-lines.push("These screenshots are dropping in out of context — quick transition.");
+if (hasCaptures) {
+  lines.push("These screenshots are dropping in out of context — quick transition.");
+} else {
+  // Honest opener: no screenshots are arriving, so the report says so up
+  // front instead of pretending they are dropping in.
+  lines.push("QA evidence for this task — no screenshots, so this is the whole report.");
+}
 lines.push("");
 lines.push("**" + task.title + "**");
 lines.push("Problem: " + problem);
 lines.push("Shipped: " + trimWords(solution, 160) +
   (commit ? " (commit `" + commit.slice(0, 12) + "`, parent-verified)" : " (provenance not yet stamped)"));
-lines.push("Evidence: desktop + mobile captures below, taken by the platform audit harness after deploy (`" + auditDir + "`)." +
-  (verdict ? " QA verdict: " + verdict.status + (verdict.summary ? " — " + trimWords(verdict.summary, 200) : "") + "." : " No QA verdict recorded."));
-if (visualUnavailable) {
+if (hasCaptures) {
+  lines.push("Evidence: desktop + mobile captures below, taken by the platform audit harness after deploy (`" + auditDir + "`)." + verdictLine);
+} else {
+  // Honest no-captures line (2026-09-17, room #14): never claim captures
+  // that do not exist. Terminal surfaces are named, not assumed.
+  const surfaceNote = project && project.environment_type === "terminal"
+    ? " (terminal surface — QA judges the CLI, not pixels)"
+    : "";
+  lines.push("Evidence: no screenshots captured for this task" + surfaceNote + " — nothing to attach." + verdictLine);
+}
+if (visualUnavailable && hasCaptures) {
+  // The note's premise is the post-deploy capture — without captures it
+  // would fabricate evidence again (2026-09-17: the no-captures line above
+  // already covers the honest case).
   lines.push("Note: the visual protocol is unavailable — these are the post-deploy capture plus QA's mechanical checks, not a QA visual inspection.");
 }
 process.stdout.write(lines.join("\n") + "\n");

package/lib/compute-publish-diff.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// compute-publish-diff.js — deterministic publish-diff computer.
+//
+// Room #14 (2026-09-17): the Publish phase asked an agent to run
+// `git diff "$BASE" "$HEAD"` and return the raw unified diff as a JSON
+// string field. The agent produced the diff correctly on disk but the
+// JSON ferry dropped it — parseUnifiedDiff saw zero files and the task
+// parked at "Publish diff parsed to zero files" for a real, valid
+// 700-line / 23-file diff. General rule: NEVER ferry a deterministic
+// unified diff through an LLM JSON response.
+//
+// This script is the deterministic replacement. The workflow's agent is
+// pure hands — it runs exactly one command (this script) and returns the
+// small JSON summary verbatim. The diff bytes live in a file; the LLM
+// never carries them:
+//
+//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file>
+//
+// --base is the previously-stamped provenance source_commit (or the
+// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
+// publish) — the SAME base the workflow read from get-provenance. The
+// script echoes the base it used so the workflow can guard against the
+// agent running the wrong command (fail-closed, as before).
+//
+// Stdout contract: exactly one JSON object, always small (no diff text):
+//   { ok:true, commit, base, ancestor:"yes", diff_file, sha256, bytes,
+//     file_count, changed_lines, files:[<paths>], has_binary, has_rename }
+//   { ok:false, error:"not-ancestor", commit, base }   (semantic, exit 0)
+//
+// Exit codes: 0 ok (JSON on stdout) · 2 usage/validation · 1 git/diff/IO
+// failure. On non-zero exit NOTHING is printed to stdout, so a caller
+// must never treat stdout as a summary. Errors go to stderr as JSON.
+//
+// Security: --base must be 40-hex (or the empty tree); --repo-path must
+// be an existing directory; git is invoked via execFileSync with an argv
+// array (no shell). The diff file's parent directories are created.
+
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, statSync, writeFileSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
+function arg(name, required = true) {
+  const i = process.argv.indexOf(name);
+  if (i < 0 || i + 1 >= process.argv.length) {
+    if (!required) return null;
+    fail("usage", `${name} is required.`, 2);
+  }
+  return process.argv[i + 1];
+}
+function fail(code, message, exitCode) {
+  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
+  process.exit(exitCode);
+}
+function git(repoPath, args) {
+  try {
+    return execFileSync("git", ["-C", repoPath, ...args], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  } catch (e) {
+    fail("git-failed", `git ${args[0]} failed: ${(e && e.message) || e}`.slice(0, 500), 1);
+  }
+}
+
+const repoPath = arg("--repo-path");
+const base = arg("--base");
+const outFile = arg("--out");
+
+if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "--base must be a 40-char hex commit SHA (or the empty-tree SHA).", 2);
+let st = null;
+try { st = statSync(repoPath); } catch { /* falls through */ }
+if (!st || !st.isDirectory()) fail("usage", "--repo-path must be an existing directory.", 2);
+
+const head = git(repoPath, ["rev-parse", "HEAD"]).trim();
+if (!/^[0-9a-f]{40}$/.test(head)) fail("git-failed", "rev-parse HEAD did not return a commit SHA.", 1);
+
+// Ancestor check — deterministic, in code. The empty tree is not a commit:
+// git merge-base --is-ancestor fails on it, so a first publish hardcodes
+// ANCESTOR=yes here instead of executing the conditional (clean-room
+// 2026-09-16: an agent ran merge-base on the empty tree directly and parked).
+let ancestor = "yes";
+if (base !== EMPTY_TREE) {
+  try {
+    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, head], { stdio: "ignore" });
+    ancestor = "yes";
+  } catch {
+    ancestor = "no";
+  }
+}
+if (ancestor !== "yes") {
+  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit: head, base }) + "\n");
+  process.exit(0);
+}
+
+const outPath = resolve(outFile);
+mkdirSync(dirname(outPath), { recursive: true });
+const diffText = git(repoPath, ["diff", base, head]);
+writeFileSync(outPath, diffText, "utf8");
+const bytes = readFileSync(outPath);
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+
+// summarizeDiff — the parseUnifiedDiff logic, moved out of the workflows
+// (canary run 4, 2026-09-11: the builder's source tree was stale and the
+// workflow stamped a new hash on it — provenance fiction; the parse
+// exists so Publish verifies the artifact builder applied the carried
+// change). Counts changed lines (added + removed), never raw diff output
+// lines: context lines and file headers inflated the old split("\n").length
+// count ~2x, parking a 95-line change against the 200-line budget
+// (Gate 1 Journey 3 attempt 3, 2026-09-13).
+let files = [];
+let current = null;
+let added = 0;
+let removed = 0;
+let has_binary = false;
+let has_rename = false;
+for (const line of diffText.split("\n")) {
+  const m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
+  if (m) {
+    current = m[2];
+    files.push(current);
+    continue;
+  }
+  if (/^Binary files /.test(line)) { has_binary = true; continue; }
+  if (/^rename from /.test(line)) { has_rename = true; continue; }
+  if (current === null) continue;
+  if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
+  if (/^@@ /.test(line)) continue;
+  if (line.charAt(0) === "+") added++;
+  else if (line.charAt(0) === "-") removed++;
+}
+
+process.stdout.write(JSON.stringify({
+  ok: true,
+  commit: head,
+  base,
+  ancestor: "yes",
+  diff_file: outPath,
+  sha256,
+  bytes: bytes.length,
+  file_count: files.length,
+  changed_lines: added + removed,
+  files,
+  has_binary,
+  has_rename,
+}) + "\n");

package/lib/crew-api.js

@@ -28,6 +28,7 @@ import { randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { homedir } from "node:os";
+import { classifySurface } from "./classify-surface.js";
 
 // ---------------------------------------------------------------------------
 // Errors
@@ -1618,17 +1619,47 @@ commands["create-project"] = (db, args, ctx) => {
   const repoPath = (args.repo_path ?? "").trim();
   if (!repoPath) throw usageError("repo_path is required.");
   if (!isGitRepoPath(repoPath)) throw usageError("repo_path must be a valid Git repository path.");
-  const deployType = args.deploy_type ?? "";
+  let deployType = args.deploy_type ?? "";
   if (!["npm", "artifact", "vercel", ""].includes(deployType)) throw usageError("bad deploy_type.");
   if (db.prepare("SELECT id FROM projects WHERE id = ?").get(id)) {
     throw conflict("A project with this ID already exists.");
   }
   const timestamp = now();
   const visualProtocol = validateVisualProtocol(args.visual_protocol);
-  const environmentType = validateEnvironmentType(args.environment_type);
+  // Surface classification default (room #14, 2026-09-17): the setup
+  // conversation never classified the flashcards sample — environment_type
+  // stayed null and no deploy target was set, so Capture skipped
+  // ("surface unclassified"), Publish had nothing to build, and QA had no
+  // runnable surface (J1/J2 parked). Fill OMITTED fields from the
+  // deterministic repo scan (lib/classify-surface.js); explicit values
+  // always win — including an explicit null environment_type, which still
+  // means "unclassified". An artifact surface needs a deploy target:
+  // classification alone doesn't close the loop, because Publish skips
+  // when deploy_type is empty and QA can only run against the built
+  // artifact. The initial-provenance stamp below then keys off the
+  // defaulted deploy_type, so the sample's first publish diffs only the
+  // task's changes instead of the whole tree.
+  let environmentType = validateEnvironmentType(args.environment_type);
+  let deploySlug = args.deploy_slug ?? null;
+  if (args.environment_type === undefined || args.deploy_type === undefined) {
+    let c = null;
+    try { c = classifySurface(repoPath); } catch { c = null; }
+    // Effective surface: an explicit environment_type always wins; the
+    // classifier only speaks for omitted fields. Deploy defaults follow
+    // the effective surface — an explicit "terminal" (or an explicit
+    // null = "unclassified") never triggers artifact deploy defaults.
+    // The slug is only auto-filled when we auto-set the artifact deploy;
+    // a caller who chose their own deploy_type owns their slug.
+    const effectiveSurface = args.environment_type === undefined ? (c && c.surface) : environmentType;
+    if (args.environment_type === undefined && c && c.surface) environmentType = c.surface;
+    if (effectiveSurface === "artifact" && args.deploy_type === undefined) {
+      deployType = "artifact";
+      if (args.deploy_slug === undefined && c && c.deploy_slug) deploySlug = c.deploy_slug;
+    }
+  }
   const row = {
     id, display_name: displayName, repo_path: repoPath, deploy_type: deployType,
-    deploy_slug: args.deploy_slug ?? null,
+    deploy_slug: deploySlug,
     description: (args.description ?? "").trim().slice(0, 3000),
     simultaneity: args.simultaneity ?? 2,
     quiesced: args.quiesced ? 1 : 0,

package/lib/setup-project-repo.js

@@ -4,17 +4,37 @@
 // Composes the deterministic building blocks after create-project:
 //   1. Scaffold $REPO/.orchestration/ (workflows/identities/phases versioned, user/ ignored)
 //   2. Optionally update .gitignore (only with explicit --consent)
+//   3. Commit the scaffold (and the .gitignore update when consented) so
+//      the repo's main checkout is clean when setup finishes.
+//
+// Step 3 is the 2026-09-18 fix for the room #13 defect: 0.11.0 wrote the
+// scaffold but never committed it, and the first task's Integrate then
+// refused to merge onto the dirty main — twice, deterministically. Setup
+// must leave main clean; the commit is mechanical, not agent judgment.
 //
 // This is the CLI path equivalent of what crew-init's dashboard mode does.
 // The dashboard calls the same script. No new API endpoint — composition.
 //
+// Guards:
+//   - With --consent, .gitignore must be clean before we touch it. The
+//     commit only ever stages .orchestration/ (+ .gitignore when we changed
+//     it), but a pre-existing dirty .gitignore would be swept into our
+//     commit by `git add` — so refuse loudly instead. Commit or stash it,
+//     then re-run.
+//   - .orchestration/ is crew-owned: pre-existing uncommitted content there
+//     (e.g. left dirty by 0.11.0) is committed, not refused.
+//
 // Usage:
 //   node lib/setup-project-repo.js --repo <path> --crew-repo <path> [--consent]
 //     --consent: user approved the .gitignore change (from the setup conversation)
-// Prints JSON: { orchestration: {...}, gitignore: {...} | { declined: true } }
+// Prints JSON: { orchestration: {...}, gitignore: {...} | { declined: true }, commit: {...} }
+// Exits non-zero on any failure (fail closed, loud).
 
+const fs = require("fs");
+const path = require("path");
 const { scaffoldRepoOrchestration } = require("./repo-orchestration");
 const { ensureGitignoreEntries, describeGitignoreChange } = require("./gitignore");
+const { commitScaffold, isPathDirty } = require("./commit-scaffold");
 
 function main() {
   const argv = process.argv.slice(2);
@@ -31,18 +51,44 @@ function main() {
     process.exit(2);
   }
 
-  const orchestration = scaffoldRepoOrchestration(repoPath, crewRepoPath);
+  try {
+    // Guard: never sweep the user's own .gitignore edits into our commit.
+    if (consent && fs.existsSync(path.join(repoPath, ".git")) && isPathDirty(repoPath, ".gitignore")) {
+      throw new Error(
+        "setup refused: .gitignore has uncommitted changes not made by setup — " +
+          "commit or stash them, then re-run setup"
+      );
+    }
 
-  let gitignore;
-  if (consent) {
-    gitignore = ensureGitignoreEntries(repoPath);
-  } else {
-    // Declined (or non-interactive default): report what WOULD change.
-    const preview = describeGitignoreChange(repoPath);
-    gitignore = { declined: true, wouldChange: preview };
-  }
+    const orchestration = scaffoldRepoOrchestration(repoPath, crewRepoPath);
 
-  console.log(JSON.stringify({ orchestration, gitignore }, null, 2));
+    let gitignore;
+    if (consent) {
+      gitignore = ensureGitignoreEntries(repoPath);
+    } else {
+      // Declined (or non-interactive default): report what WOULD change.
+      const preview = describeGitignoreChange(repoPath);
+      gitignore = { declined: true, wouldChange: preview };
+    }
+
+    let commit;
+    try {
+      commit = commitScaffold(repoPath, { includeGitignore: consent });
+    } catch (commitErr) {
+      throw new Error(
+        "commit failed: " +
+          commitErr.message +
+          " — the repo has uncommitted crew files; configure git identity and run: " +
+          "node lib/commit-scaffold.js --repo <path>" +
+          (consent ? " --gitignore" : "")
+      );
+    }
+
+    console.log(JSON.stringify({ orchestration, gitignore, commit }, null, 2));
+  } catch (e) {
+    console.error("setup-project-repo failed: " + (e.message || e));
+    process.exit(1);
+  }
 }
 
 if (require.main === module) main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -70,13 +70,14 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
    - Dedupe: for each candidate, check `get-events --json '{"task_id": "<id>", "limit": 50}'` for an event whose message starts with `evidence: delivered`. Skip tasks already delivered.
    - For each remaining task:
      - Read its QA verdict: from get-state's `sessions`, the completed session for this task whose notes mention Hazel/QA. Quote one verdict line (pass/fail and the one-line reason).
-     - Find the screenshots (platform audit harness): `AUDIT=$(readlink ~/workspace/ts-spaces/<project>/audits/latest)` where `<project>` is the task's project field. Confirm `$AUDIT/screenshot.png` and `$AUDIT/screenshot-mobile.png` exist AND are newer than the task's `created_at` (compare with `stat -c %Y`). If the audit dir predates the task, the capture is stale from an earlier run — say so and do NOT attach it. Never attach screenshots from a different run.
-     - Write the transition BEFORE the attachments (2026-09-14 — Eric: screenshots arriving out of context need a problem→solution handoff). Do not hand-write it: run the deterministic composer and paste its stdout verbatim, then the two attachment lines:
+     - Find the screenshots (platform audit harness): `AUDIT=$(readlink ~/workspace/ts-spaces/<project>/audits/latest)` where `<project>` is the task's project field. Confirm `$AUDIT/screenshot.png` and `$AUDIT/screenshot-mobile.png` exist AND are newer than the task's `created_at` (compare with `stat -c %Y`). Set `CAPTURES_OK=1` only when both PNGs exist and are fresh; otherwise `CAPTURES_OK=0`. If the audit dir predates the task, the capture is stale from an earlier run — say so and do NOT attach it. Never attach screenshots from a different run. Terminal-surface tasks never have harness captures — expect CAPTURES_OK=0 for them.
+     - Write the transition BEFORE the attachments (2026-09-14 — Eric: screenshots arriving out of context need a problem→solution handoff). Do not hand-write it: run the deterministic composer and paste its stdout verbatim:
        `node {crewHome}/lib/compose-evidence-caption.js --crew-home {crewHome} --task-id "<id>" --audit-dir "<resolved_dir>"`
-       The composer emits: the out-of-context acknowledgment, the task title, Problem: (from the task description), Shipped: (the merge commit's subject + short-sha, or an honest "provenance not yet stamped"), Evidence: (the audit dir + QA verdict, or "No QA verdict recorded"), and the visual-protocol-unavailable honest label when the run recorded one. If the composer exits non-zero, say so in one line and attach nothing for that task.
-     - Attach both to your report, each on its own plain line, using the RESOLVED dir name (not the `latest` symlink) so the evidence is pinned to this run:
+       The composer emits: the out-of-context acknowledgment, the task title, Problem: (from the task description), Shipped: (the merge commit's subject + short-sha, or an honest "provenance not yet stamped"), Evidence: (the audit dir + QA verdict when captures exist, or the honest no-captures line — 2026-09-17: the composer verifies the captures exist before claiming them, so a terminal-surface task with no audit dir gets the honest line, never "desktop + mobile captures below"), and the visual-protocol-unavailable honest label when the run recorded one. If the composer exits non-zero, say so in one line and attach nothing for that task.
+     - Attach the two screenshot lines ONLY when CAPTURES_OK=1, each on its own plain line, using the RESOLVED dir name (not the `latest` symlink) so the evidence is pinned to this run:
        `![desktop](sandbox://workspace/ts-spaces/<project>/audits/<resolved_dir>/screenshot.png)`
        `![mobile](sandbox://workspace/ts-spaces/<project>/audits/<resolved_dir>/screenshot-mobile.png)`
+       When CAPTURES_OK=0, attach nothing — the composer's caption already says so honestly.
      - Log the delivery so the next tick skips it: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} log-event --json '{"task_id": "<id>", "type": "note", "message": "evidence: delivered <id> — screenshots attached to tick report"}'`.
    - If a done task has no fresh screenshots, say so in one line — never claim evidence you don't have.
 

package/workflows/bugfix.js

@@ -81,9 +81,15 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
+const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
+// 2026-09-17): the diff is computed by this script, never ferried as an
+// agent JSON string. Pinned like the other publish-critical modules so a
+// mid-run release swap cannot change it under the workflow.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -259,7 +265,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the six pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -267,7 +273,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -448,37 +454,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish diff transport: parse a unified diff into per-file {path, added,
-// removed} line lists. Pure function — no I/O, no clock. Used by Publish to
-// verify the artifact builder applied the carried change (canary run 4,
-// 2026-09-11: the builder's source tree was stale and disconnected from the
-// crew's repo; "rebuild from current source" rebuilt stale code and the
-// workflow stamped the new commit hash on it — provenance fiction).
-function parseUnifiedDiff(diffText) {
-  var files = [];
-  var current = null;
-  var lines = (diffText || "").split("\n");
-  for (var i = 0; i < lines.length; i++) {
-    var line = lines[i];
-    var m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
-    if (m) {
-      current = { path: m[2], added: [], removed: [] };
-      files.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
-    if (/^@@ /.test(line)) continue;
-    if (line.charAt(0) === "+") {
-      current.added.push(line.slice(1));
-    } else if (line.charAt(0) === "-") {
-      current.removed.push(line.slice(1));
-    }
-  }
-  return files;
-}
-
-
 // Publish read-back request (currently unavailable): the verbatim_request
 // the parent protocol (docs/publish-verification.md) would hand to an
 // independent read-back tool after the artifact build lands. artifact_inspect
@@ -1586,59 +1561,77 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
-        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
-        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
-        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
-        // to execute the conditional (clean-room 2026-09-16: the agent ran
-        // merge-base on the empty tree directly and parked).
-        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
-          ? "ANCESTOR=yes && "
-          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
+        // Publish diff transport (room #14, 2026-09-17): the diff used to be
+        // ferried as a JSON string field in the agent's response — the agent
+        // produced a valid 700-line diff on disk but the JSON ferry dropped
+        // it, and the parse saw zero files ("Publish diff parsed to zero
+        // files"). The diff now travels git -> file -> deterministic script
+        // summary; the LLM never carries diff bytes. The agent is pure hands:
+        // it runs exactly one command (the PINNED compute-publish-diff.js —
+        // a mid-run release swap cannot change it under the workflow) and
+        // returns the small JSON summary verbatim. All fail-closed parks
+        // below are unchanged in meaning.
+        var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + ".diff";
         var diffResult = await agent(
-          "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          ancestorShell + 
-          "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
-          "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
-          "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
+          "Run exactly one command and nothing else:\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, totalReworkCount), label: "Computing publish diff from stamped base",
-            schema: { type: "object", properties: { commit: { type: "string" }, base: { type: "string" }, ancestor: { type: "string" }, diff: { type: "string" }, files: { type: "string" } }, required: ["commit", "base", "ancestor", "diff"] } }
+            schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
         );
-        if ((diffResult.ancestor || "").trim() !== "yes") {
-          return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + (diffResult.commit || "").trim().slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        var diffSummary = null;
+        try {
+          diffSummary = JSON.parse((diffResult.output || "").trim());
+        } catch (e) {
+          return await parkTask("Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+        }
+        if (!diffSummary || diffSummary.ok !== true) {
+          if (diffSummary && diffSummary.error === "not-ancestor") {
+            return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+          }
+          return await parkTask("Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
         }
-        if ((diffResult.base || "").trim() !== publishBase) {
-          return await parkTask("Publish diff base mismatch: agent reported '" + (diffResult.base || "").trim().slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+        if (diffSummary.base !== publishBase) {
+          return await parkTask("Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
         }
-        var mergeCommitForPublish = (diffResult.commit || "").trim();
-        var mergeDiff = diffResult.diff || "";
-        if (!mergeDiff.trim()) {
+        var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+        var publishDiffSha256 = String(diffSummary.sha256 || "");
+        if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
-        if (/^Binary files /m.test(mergeDiff)) {
-          return await parkTask("Publish diff contains binary files — the text diff transport cannot carry them. Human attention needed.");
+        if (diffSummary.has_binary) {
+          return await parkTask("Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
         }
-        if (/^rename from /m.test(mergeDiff)) {
+        if (diffSummary.has_rename) {
           return await parkTask("Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
         }
-        var expectedChanges = parseUnifiedDiff(mergeDiff);
         // Budget counts CHANGED lines (added + removed), not raw unified-diff
         // output lines: context lines and file headers inflated the old
         // split("\n").length count ~2x, parking a 95-line change against a
-        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13).
-        var mergeDiffChangedLines = expectedChanges.reduce(function (n, f) { return n + f.added.length + f.removed.length; }, 0);
+        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13). The count
+        // now comes from the deterministic script summary, never from the LLM.
+        var mergeDiffChangedLines = diffSummary.changed_lines || 0;
         if (mergeDiffChangedLines > 200) {
           return await parkTask("Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
         }
-        if (expectedChanges.length === 0) {
+        if (!diffSummary.file_count) {
           return await parkTask("Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
         }
+        // The trigger agent reads the diff from the checksummed file — the
+        // workflow never holds diff bytes (room #14, 2026-09-17). The file
+        // is small by construction: the 200-line budget above gates the
+        // trigger. The sha256 check is the agent's only verification step;
+        // a mismatch stops the trigger before any artifact_edit call.
         var rebuildPrompt =
           ARTIFACT_LOAD_PREAMBLE +
-          "Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
+          "The change to apply is the unified diff in the file \"" + publishDiffFile + "\" (sha256 " + publishDiffSha256 + ").\n" +
+          "1. Verify the file: run sha256sum on it. If the printed hash is not exactly " + publishDiffSha256 + ", STOP and end your turn — do not call artifact_edit.\n" +
+          "2. Read the file's full content.\n" +
+          "3. Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
           "'Apply the following change to your source tree, then rebuild and deploy.\n" +
           "\n" +
           "UNIFIED DIFF (relative to your source tree):\n" +
-          "```diff\n" + mergeDiff + "\n```\n" +
+          "```diff\n<the full content of the verified file, pasted verbatim>\n```\n" +
           "\n" +
           "Rules:\n" +
           "- For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).\n" +