muse-crew 0.11.0 → 0.12.0

package/workflows/chore.js

@@ -138,9 +138,15 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
+const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
+// 2026-09-17): the diff is computed by this script, never ferried as an
+// agent JSON string. Pinned like the other publish-critical modules so a
+// mid-run release swap cannot change it under the workflow.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -311,7 +317,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the six pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -319,7 +325,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -500,37 +506,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish diff transport: parse a unified diff into per-file {path, added,
-// removed} line lists. Pure function — no I/O, no clock. Used by Publish to
-// verify the artifact builder applied the carried change (canary run 4,
-// 2026-09-11: the builder's source tree was stale and disconnected from the
-// crew's repo; "rebuild from current source" rebuilt stale code and the
-// workflow stamped the new commit hash on it — provenance fiction).
-function parseUnifiedDiff(diffText) {
-  var files = [];
-  var current = null;
-  var lines = (diffText || "").split("\n");
-  for (var i = 0; i < lines.length; i++) {
-    var line = lines[i];
-    var m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
-    if (m) {
-      current = { path: m[2], added: [], removed: [] };
-      files.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
-    if (/^@@ /.test(line)) continue;
-    if (line.charAt(0) === "+") {
-      current.added.push(line.slice(1));
-    } else if (line.charAt(0) === "-") {
-      current.removed.push(line.slice(1));
-    }
-  }
-  return files;
-}
-
-
 // Publish read-back request (currently unavailable): the verbatim_request
 // the parent protocol (docs/publish-verification.md) would hand to an
 // independent read-back tool after the artifact build lands. artifact_inspect
@@ -1473,59 +1448,77 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
-        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
-        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
-        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
-        // to execute the conditional (clean-room 2026-09-16: the agent ran
-        // merge-base on the empty tree directly and parked).
-        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
-          ? "ANCESTOR=yes && "
-          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
+        // Publish diff transport (room #14, 2026-09-17): the diff used to be
+        // ferried as a JSON string field in the agent's response — the agent
+        // produced a valid 700-line diff on disk but the JSON ferry dropped
+        // it, and the parse saw zero files ("Publish diff parsed to zero
+        // files"). The diff now travels git -> file -> deterministic script
+        // summary; the LLM never carries diff bytes. The agent is pure hands:
+        // it runs exactly one command (the PINNED compute-publish-diff.js —
+        // a mid-run release swap cannot change it under the workflow) and
+        // returns the small JSON summary verbatim. All fail-closed parks
+        // below are unchanged in meaning.
+        var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (reworkCount > 0 ? "-r" + reworkCount : "") + ".diff";
         var diffResult = await agent(
-          "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          ancestorShell + 
-          "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
-          "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
-          "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
+          "Run exactly one command and nothing else:\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, reworkCount), label: "Computing publish diff from stamped base",
-            schema: { type: "object", properties: { commit: { type: "string" }, base: { type: "string" }, ancestor: { type: "string" }, diff: { type: "string" }, files: { type: "string" } }, required: ["commit", "base", "ancestor", "diff"] } }
+            schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
         );
-        if ((diffResult.ancestor || "").trim() !== "yes") {
-          return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + (diffResult.commit || "").trim().slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        var diffSummary = null;
+        try {
+          diffSummary = JSON.parse((diffResult.output || "").trim());
+        } catch (e) {
+          return await parkTask("Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+        }
+        if (!diffSummary || diffSummary.ok !== true) {
+          if (diffSummary && diffSummary.error === "not-ancestor") {
+            return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+          }
+          return await parkTask("Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
         }
-        if ((diffResult.base || "").trim() !== publishBase) {
-          return await parkTask("Publish diff base mismatch: agent reported '" + (diffResult.base || "").trim().slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+        if (diffSummary.base !== publishBase) {
+          return await parkTask("Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
         }
-        var mergeCommitForPublish = (diffResult.commit || "").trim();
-        var mergeDiff = diffResult.diff || "";
-        if (!mergeDiff.trim()) {
+        var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+        var publishDiffSha256 = String(diffSummary.sha256 || "");
+        if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
-        if (/^Binary files /m.test(mergeDiff)) {
-          return await parkTask("Publish diff contains binary files — the text diff transport cannot carry them. Human attention needed.");
+        if (diffSummary.has_binary) {
+          return await parkTask("Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
         }
-        if (/^rename from /m.test(mergeDiff)) {
+        if (diffSummary.has_rename) {
           return await parkTask("Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
         }
-        var expectedChanges = parseUnifiedDiff(mergeDiff);
         // Budget counts CHANGED lines (added + removed), not raw unified-diff
         // output lines: context lines and file headers inflated the old
         // split("\n").length count ~2x, parking a 95-line change against a
-        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13).
-        var mergeDiffChangedLines = expectedChanges.reduce(function (n, f) { return n + f.added.length + f.removed.length; }, 0);
+        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13). The count
+        // now comes from the deterministic script summary, never from the LLM.
+        var mergeDiffChangedLines = diffSummary.changed_lines || 0;
         if (mergeDiffChangedLines > 200) {
           return await parkTask("Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
         }
-        if (expectedChanges.length === 0) {
+        if (!diffSummary.file_count) {
           return await parkTask("Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
         }
+        // The trigger agent reads the diff from the checksummed file — the
+        // workflow never holds diff bytes (room #14, 2026-09-17). The file
+        // is small by construction: the 200-line budget above gates the
+        // trigger. The sha256 check is the agent's only verification step;
+        // a mismatch stops the trigger before any artifact_edit call.
         var rebuildPrompt =
           ARTIFACT_LOAD_PREAMBLE +
-          "Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
+          "The change to apply is the unified diff in the file \"" + publishDiffFile + "\" (sha256 " + publishDiffSha256 + ").\n" +
+          "1. Verify the file: run sha256sum on it. If the printed hash is not exactly " + publishDiffSha256 + ", STOP and end your turn — do not call artifact_edit.\n" +
+          "2. Read the file's full content.\n" +
+          "3. Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
           "'Apply the following change to your source tree, then rebuild and deploy.\n" +
           "\n" +
           "UNIFIED DIFF (relative to your source tree):\n" +
-          "```diff\n" + mergeDiff + "\n```\n" +
+          "```diff\n<the full content of the verified file, pasted verbatim>\n```\n" +
           "\n" +
           "Rules:\n" +
           "- For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).\n" +

package/workflows/crew-dispatch.js

@@ -941,11 +941,17 @@ await agent(
 // not timestamps — no wall-clock calls (see tests/determinism.test.js).
 // Fire-and-forget: the script swallows its own errors and exits 0, the
 // agent call carries no schema, and the whole call is wrapped in
-// try/catch — a failed write can never fail the tick. Placement: every run
-// that completes the poll (dispatching, NO_DISPATCH, partial-cap) reaches
-// this point. Concurrency edge: overlapping ticks could duplicate seq
-// (count+append is not atomic) but appends are atomic, so lines never
-// interleave — seq is advisory, file order is the proof.
+// try/catch — a failed write can never fail the tick. The script echoes
+// the appended line to stdout (2026-09-17, rooms #12–#14): the fire-and-forget
+// agent() call carries no schema and its return is discarded, but the
+// platform's JSON-candidate scan throws on an EMPTY schema-less result —
+// which is what the writer returned before it echoed. Every other
+// fire-and-forget call in this file returns the CLI's non-empty JSON
+// stdout verbatim, so the writer now speaks the same proven shape.
+// Placement: every run that completes the poll (dispatching, NO_DISPATCH,
+// partial-cap) reaches this point. Concurrency edge: overlapping ticks
+// could duplicate seq (count+append is not atomic) but appends are atomic,
+// so lines never interleave — seq is advisory, file order is the proof.
 var tickReleaseScript = [
   "var crewHome=process.argv[1];",
   "try{",
@@ -954,7 +960,16 @@ var tickReleaseScript = [
   "var file=path.join(crewHome,\".tick-releases.jsonl\");",
   "var count=0;",
   "try{var lines=fs.readFileSync(file,\"utf8\").split(\"\\n\");for(var i=0;i<lines.length;i++){if(lines[i].trim()!==\"\"){count++;}}}catch(e){}",
-  "fs.appendFileSync(file,JSON.stringify({seq:count+1,release:release})+\"\\n\");",
+  "var line=JSON.stringify({seq:count+1,release:release});",
+  "fs.appendFileSync(file,line+\"\\n\");",
+  // Rooms #12–#14: echo the appended line to stdout. The fire-and-forget
+  // agent() call below carries no schema and its return is discarded — but
+  // the platform's JSON-candidate scan throws on an EMPTY schema-less
+  // result, which is exactly what this script returned before (exit 0, no
+  // output). Every other fire-and-forget call in this file returns the
+  // CLI's non-empty JSON stdout verbatim, so the writer now speaks the same
+  // proven shape: the echoed line is the evidence of the write.
+  "process.stdout.write(line+\"\\n\");",
   "}catch(e){}",
   "process.exit(0);"
 ].join("");

package/workflows/crew-init.js

@@ -337,47 +337,6 @@ var scaffoldCreated = scaffoldResult.created ? scaffoldResult.created.length : 0
 var scaffoldSkipped = scaffoldResult.skipped ? scaffoldResult.skipped.length : 0;
 log("Scaffold: " + scaffoldCreated + " created, " + scaffoldSkipped + " skipped");
 
-// ── Gitignore consent execution ─────────────────────────────────────
-// If the user approved during the setup conversation (gitignoreConsent=true)
-// and we have a repo (dashboard mode), append crew-owned paths to .gitignore
-// via the deterministic lib/gitignore.js (no agent judgment — the agent
-// just runs the fixed command; all merge logic is in the tested JS module).
-// This is the ONLY user file outside .orchestration/ that the crew modifies.
-if (gitignoreConsent && dashboardRepoPath) {
-  var gitignoreResult;
-  try {
-    gitignoreResult = await agent(
-      "Run the deterministic gitignore updater. Do not decide anything — just run the command and return its JSON output.\n\n" +
-      "Command:\n" +
-      "node " + crewHome + "/current/lib/gitignore.js --repo \"" + gateFacts.dashboardRepoExpanded + "\"\n\n" +
-      "The script prints one JSON line: { created, appended[], skipped[] }.\n" +
-      "Return that JSON verbatim.",
-      {
-        key: "scaffold-gitignore",
-        label: "Update .gitignore for crew paths",
-        schema: {
-          type: "object",
-          properties: {
-            created: { type: "boolean" },
-            appended: { type: "array", items: { type: "string" } },
-            skipped: { type: "array", items: { type: "string" } }
-          },
-          required: ["created", "appended", "skipped"]
-        }
-      }
-    );
-    log("Gitignore: " + (gitignoreResult.created ? "created" : "updated") +
-        " — appended [" + (gitignoreResult.appended || []).join(", ") + "]" +
-        ", already present [" + (gitignoreResult.skipped || []).join(", ") + "]");
-  } catch (e) {
-    log("Gitignore update failed (non-fatal): " + String(e.message || e));
-  }
-} else if (dashboardRepoPath) {
-  log("Gitignore: user declined — add '.worktrees/' and '.orchestration/user/' to " + dashboardRepoPath + "/.gitignore manually.");
-} else {
-  log("Gitignore: no repo (CLI-only mode) — skipping.");
-}
-
 // ── Phase 3: Project registration ─────────────────────────────────────
 // Registers the first project in crew-state.db via the Crew API. In
 // dashboard mode, the dashboard becomes the crew's first project (so the
@@ -455,37 +414,132 @@ try {
 log("Project: " + dashboardSlug + " " + projectResult.action + " (repo_path=" + gateFacts.dashboardRepoExpanded + ")");
 } // end dashboard-mode project registration
 
-// ── Repo-local .orchestration/ scaffold ─────────────────────────────
-// Scaffold $REPO/.orchestration/ in the dashboard repo (version-controlled
-// workflows/identities/phases + ignored user/). Deterministic — the agent
-// runs the fixed command; all logic is in the tested lib module.
+// ── Project repo setup (2026-09-18) ─────────────────────────────────
+// One deterministic composer — lib/setup-project-repo.js — scaffolds
+// $REPO/.orchestration/, applies the consented .gitignore update, and COMMITS
+// both so the repo's main checkout is clean when setup finishes.
+// Room #13 (2026-09-17): the old two-call shape wrote the scaffold but never
+// committed it, and the first task's Integrate then refused to merge onto the
+// dirty main — twice, deterministically. This replaces both calls; the agent
+// still runs one fixed command and all logic stays in the tested lib modules.
+// Best-effort as before (a failed setup never blocks init), but a failed
+// COMMIT is logged loudly: the repo is dirty and the first task will fail
+// Integrate until the scaffold is committed.
+var setupRepoWarning = null;
+var setupRepoResult = null;
 if (dashboardRepoPath) {
-  var repoOrchResult;
   try {
-    repoOrchResult = await agent(
-      "Scaffold the repository-local .orchestration/ directory. Do not decide anything — just run the command and return its JSON output.\n\n" +
+    setupRepoResult = await agent(
+      "Run the deterministic project-repo setup composer. Do not decide anything — just run the command and return its JSON output.\n\n" +
+      "Command:\n" +
+      "node " + crewHome + "/current/lib/setup-project-repo.js --repo \"" + gateFacts.dashboardRepoExpanded + "\" --crew-repo \"" + crewRepoPath + "\"" + (gitignoreConsent ? " --consent" : "") + "\n\n" +
+      "The script prints one JSON object: { orchestration, gitignore, commit }.\n" +
+      "orchestration carries orchDir, dirsCreated, and per-area created/skipped arrays;\n" +
+      "gitignore carries created/appended/skipped (or declined:true with a wouldChange preview);\n" +
+      "commit carries { committed, sha, reason }.\n" +
+      "Return that JSON verbatim.",
+      {
+        key: "scaffold-repo-setup",
+        label: "Set up project repo (scaffold + gitignore + commit)",
+        schema: {
+          type: "object",
+          properties: {
+            orchestration: {
+              type: "object",
+              properties: {
+                orchDir: { type: "string" },
+                dirsCreated: { type: "array", items: { type: "string" } }
+              },
+              required: ["orchDir", "dirsCreated"]
+            },
+            gitignore: { type: "object" },
+            commit: {
+              type: "object",
+              properties: {
+                committed: { type: "boolean" },
+                sha: { type: ["string", "null"] },
+                reason: { type: ["string", "null"] }
+              },
+              required: ["committed"]
+            }
+          },
+          required: ["orchestration", "gitignore", "commit"]
+        }
+      }
+    );
+    var orchDirs = (setupRepoResult.orchestration.dirsCreated || []).join(", ");
+    var commitMsg = setupRepoResult.commit.committed
+      ? "committed " + setupRepoResult.commit.sha
+      : "not committed (" + setupRepoResult.commit.reason + ")";
+    log("Repo setup: scaffolded " + setupRepoResult.orchestration.orchDir +
+        " (dirs: [" + orchDirs + "]); gitignore " +
+        (gitignoreConsent ? "update consented" : "declined by user — add '.worktrees/' and '.orchestration/user/' manually") +
+        "; scaffold " + commitMsg);
+    if (!setupRepoResult.commit.committed && setupRepoResult.commit.reason !== "nothing-to-commit") {
+      setupRepoWarning = "Project repo setup left the scaffold uncommitted (" +
+        setupRepoResult.commit.reason + ") — the first task's Integrate will refuse to merge until it is committed.";
+      log("WARNING: " + setupRepoWarning);
+    }
+  } catch (e) {
+    var setupErr = String(e.message || e);
+    setupRepoWarning = "Project repo setup failed: " + setupErr + " — continuing without the repo scaffold.";
+    if (/commit failed/i.test(setupErr)) {
+      setupRepoWarning += " The repo has uncommitted crew files; the first task's Integrate will refuse to merge until they are committed.";
+    }
+    log(setupRepoWarning + " (non-fatal)");
+  }
+} else {
+  log("Repo setup: no repo (CLI-only mode) — skipping.");
+}
+
+// ── Publish-base advance (2026-09-18) ─────────────────────────────────
+// Room #14: create-project stamps provenance.source_commit at the
+// pre-scaffold repo HEAD, then the scaffold commits .orchestration/ (and the
+// consented .gitignore) on top. The first task's publish diff then carries
+// the whole scaffold (517 insertions in room #14) and blows the 200-line
+// diff-transport budget. The scaffold is crew-owned infrastructure the
+// dashboard artifact never consumes, so the correct publish base is the
+// scaffold commit itself. Advance it deterministically via
+// lib/advance-publish-base.js — only when this init created the project
+// (the stamp is ours, never a real publish's), the scaffold commit's parent
+// is exactly the stamped base (nothing slipped between), and the scaffold
+// touches only crew-owned paths. Best-effort: a failed advance never blocks
+// init — the first task then publishes from the stamped base as before.
+var publishBaseResult = null;
+if (dashboardRepoPath && projectResult && projectResult.action === "created" &&
+    setupRepoResult && setupRepoResult.commit && setupRepoResult.commit.committed) {
+  try {
+    publishBaseResult = await agent(
+      "Run the deterministic publish-base advance script. Do not decide anything — just run the command and return its JSON output.\n\n" +
       "Command:\n" +
-      "node " + crewHome + "/current/lib/repo-orchestration.js --repo \"" + gateFacts.dashboardRepoExpanded + "\" --crew-repo \"" + crewRepoPath + "\"\n\n" +
-      "The script prints JSON with dirsCreated, workflows, identities, phases.\n" +
+      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-created\n\n" +
+      "The script prints one JSON object: { ok, action, reason?, from?, to? }.\n" +
       "Return that JSON verbatim.",
       {
-        key: "scaffold-repo-orch",
-        label: "Scaffold repo-local .orchestration",
+        key: "advance-publish-base",
+        label: "Advance publish base past scaffold commit",
         schema: {
           type: "object",
           properties: {
-            orchDir: { type: "string" },
-            dirsCreated: { type: "array", items: { type: "string" } }
+            ok: { type: "boolean" },
+            action: { type: "string" },
+            reason: {},
+            from: {},
+            to: {}
           },
-          required: ["orchDir", "dirsCreated"]
+          required: ["ok", "action"]
         }
       }
     );
-    log("Repo-orchestration: scaffolded " + repoOrchResult.orchDir +
-        " (dirs: [" + (repoOrchResult.dirsCreated || []).join(", ") + "])");
+    log("Publish base: " + publishBaseResult.action +
+        (publishBaseResult.reason ? " (" + publishBaseResult.reason + ")" : "") +
+        (publishBaseResult.from ? " " + publishBaseResult.from + " -> " + publishBaseResult.to : ""));
   } catch (e) {
-    log("Repo-orchestration scaffold failed (non-fatal): " + String(e.message || e));
+    log("Publish base: advance script failed (" + String(e.message || e) + ") — continuing with the stamped base (non-fatal).");
   }
+} else {
+  log("Publish base: no advance (project " + (projectResult ? projectResult.action : "unknown") +
+      ", scaffold " + (setupRepoResult && setupRepoResult.commit && setupRepoResult.commit.committed ? "committed" : "not committed") + ").");
 }
 
 // ── Scheduler identity (2026-09-16) ──────────────────────────────────
@@ -746,6 +800,7 @@ return {
   releaseHash: releaseResult.hash,
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
+  repoSetupWarning: setupRepoWarning,
   crons: cronsResult.summary.crons,
   registry: cronsResult.summary.registry,
   autoUpdate: {