muse-crew 0.11.1 → 0.12.0

package/lib/compute-publish-diff.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// compute-publish-diff.js — deterministic publish-diff computer.
+//
+// Room #14 (2026-09-17): the Publish phase asked an agent to run
+// `git diff "$BASE" "$HEAD"` and return the raw unified diff as a JSON
+// string field. The agent produced the diff correctly on disk but the
+// JSON ferry dropped it — parseUnifiedDiff saw zero files and the task
+// parked at "Publish diff parsed to zero files" for a real, valid
+// 700-line / 23-file diff. General rule: NEVER ferry a deterministic
+// unified diff through an LLM JSON response.
+//
+// This script is the deterministic replacement. The workflow's agent is
+// pure hands — it runs exactly one command (this script) and returns the
+// small JSON summary verbatim. The diff bytes live in a file; the LLM
+// never carries them:
+//
+//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file>
+//
+// --base is the previously-stamped provenance source_commit (or the
+// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
+// publish) — the SAME base the workflow read from get-provenance. The
+// script echoes the base it used so the workflow can guard against the
+// agent running the wrong command (fail-closed, as before).
+//
+// Stdout contract: exactly one JSON object, always small (no diff text):
+//   { ok:true, commit, base, ancestor:"yes", diff_file, sha256, bytes,
+//     file_count, changed_lines, files:[<paths>], has_binary, has_rename }
+//   { ok:false, error:"not-ancestor", commit, base }   (semantic, exit 0)
+//
+// Exit codes: 0 ok (JSON on stdout) · 2 usage/validation · 1 git/diff/IO
+// failure. On non-zero exit NOTHING is printed to stdout, so a caller
+// must never treat stdout as a summary. Errors go to stderr as JSON.
+//
+// Security: --base must be 40-hex (or the empty tree); --repo-path must
+// be an existing directory; git is invoked via execFileSync with an argv
+// array (no shell). The diff file's parent directories are created.
+
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, statSync, writeFileSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
+function arg(name, required = true) {
+  const i = process.argv.indexOf(name);
+  if (i < 0 || i + 1 >= process.argv.length) {
+    if (!required) return null;
+    fail("usage", `${name} is required.`, 2);
+  }
+  return process.argv[i + 1];
+}
+function fail(code, message, exitCode) {
+  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
+  process.exit(exitCode);
+}
+function git(repoPath, args) {
+  try {
+    return execFileSync("git", ["-C", repoPath, ...args], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  } catch (e) {
+    fail("git-failed", `git ${args[0]} failed: ${(e && e.message) || e}`.slice(0, 500), 1);
+  }
+}
+
+const repoPath = arg("--repo-path");
+const base = arg("--base");
+const outFile = arg("--out");
+
+if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "--base must be a 40-char hex commit SHA (or the empty-tree SHA).", 2);
+let st = null;
+try { st = statSync(repoPath); } catch { /* falls through */ }
+if (!st || !st.isDirectory()) fail("usage", "--repo-path must be an existing directory.", 2);
+
+const head = git(repoPath, ["rev-parse", "HEAD"]).trim();
+if (!/^[0-9a-f]{40}$/.test(head)) fail("git-failed", "rev-parse HEAD did not return a commit SHA.", 1);
+
+// Ancestor check — deterministic, in code. The empty tree is not a commit:
+// git merge-base --is-ancestor fails on it, so a first publish hardcodes
+// ANCESTOR=yes here instead of executing the conditional (clean-room
+// 2026-09-16: an agent ran merge-base on the empty tree directly and parked).
+let ancestor = "yes";
+if (base !== EMPTY_TREE) {
+  try {
+    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, head], { stdio: "ignore" });
+    ancestor = "yes";
+  } catch {
+    ancestor = "no";
+  }
+}
+if (ancestor !== "yes") {
+  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit: head, base }) + "\n");
+  process.exit(0);
+}
+
+const outPath = resolve(outFile);
+mkdirSync(dirname(outPath), { recursive: true });
+const diffText = git(repoPath, ["diff", base, head]);
+writeFileSync(outPath, diffText, "utf8");
+const bytes = readFileSync(outPath);
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+
+// summarizeDiff — the parseUnifiedDiff logic, moved out of the workflows
+// (canary run 4, 2026-09-11: the builder's source tree was stale and the
+// workflow stamped a new hash on it — provenance fiction; the parse
+// exists so Publish verifies the artifact builder applied the carried
+// change). Counts changed lines (added + removed), never raw diff output
+// lines: context lines and file headers inflated the old split("\n").length
+// count ~2x, parking a 95-line change against the 200-line budget
+// (Gate 1 Journey 3 attempt 3, 2026-09-13).
+let files = [];
+let current = null;
+let added = 0;
+let removed = 0;
+let has_binary = false;
+let has_rename = false;
+for (const line of diffText.split("\n")) {
+  const m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
+  if (m) {
+    current = m[2];
+    files.push(current);
+    continue;
+  }
+  if (/^Binary files /.test(line)) { has_binary = true; continue; }
+  if (/^rename from /.test(line)) { has_rename = true; continue; }
+  if (current === null) continue;
+  if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
+  if (/^@@ /.test(line)) continue;
+  if (line.charAt(0) === "+") added++;
+  else if (line.charAt(0) === "-") removed++;
+}
+
+process.stdout.write(JSON.stringify({
+  ok: true,
+  commit: head,
+  base,
+  ancestor: "yes",
+  diff_file: outPath,
+  sha256,
+  bytes: bytes.length,
+  file_count: files.length,
+  changed_lines: added + removed,
+  files,
+  has_binary,
+  has_rename,
+}) + "\n");

package/lib/crew-api.js

@@ -28,6 +28,7 @@ import { randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { homedir } from "node:os";
+import { classifySurface } from "./classify-surface.js";
 
 // ---------------------------------------------------------------------------
 // Errors
@@ -1618,17 +1619,47 @@ commands["create-project"] = (db, args, ctx) => {
   const repoPath = (args.repo_path ?? "").trim();
   if (!repoPath) throw usageError("repo_path is required.");
   if (!isGitRepoPath(repoPath)) throw usageError("repo_path must be a valid Git repository path.");
-  const deployType = args.deploy_type ?? "";
+  let deployType = args.deploy_type ?? "";
   if (!["npm", "artifact", "vercel", ""].includes(deployType)) throw usageError("bad deploy_type.");
   if (db.prepare("SELECT id FROM projects WHERE id = ?").get(id)) {
     throw conflict("A project with this ID already exists.");
   }
   const timestamp = now();
   const visualProtocol = validateVisualProtocol(args.visual_protocol);
-  const environmentType = validateEnvironmentType(args.environment_type);
+  // Surface classification default (room #14, 2026-09-17): the setup
+  // conversation never classified the flashcards sample — environment_type
+  // stayed null and no deploy target was set, so Capture skipped
+  // ("surface unclassified"), Publish had nothing to build, and QA had no
+  // runnable surface (J1/J2 parked). Fill OMITTED fields from the
+  // deterministic repo scan (lib/classify-surface.js); explicit values
+  // always win — including an explicit null environment_type, which still
+  // means "unclassified". An artifact surface needs a deploy target:
+  // classification alone doesn't close the loop, because Publish skips
+  // when deploy_type is empty and QA can only run against the built
+  // artifact. The initial-provenance stamp below then keys off the
+  // defaulted deploy_type, so the sample's first publish diffs only the
+  // task's changes instead of the whole tree.
+  let environmentType = validateEnvironmentType(args.environment_type);
+  let deploySlug = args.deploy_slug ?? null;
+  if (args.environment_type === undefined || args.deploy_type === undefined) {
+    let c = null;
+    try { c = classifySurface(repoPath); } catch { c = null; }
+    // Effective surface: an explicit environment_type always wins; the
+    // classifier only speaks for omitted fields. Deploy defaults follow
+    // the effective surface — an explicit "terminal" (or an explicit
+    // null = "unclassified") never triggers artifact deploy defaults.
+    // The slug is only auto-filled when we auto-set the artifact deploy;
+    // a caller who chose their own deploy_type owns their slug.
+    const effectiveSurface = args.environment_type === undefined ? (c && c.surface) : environmentType;
+    if (args.environment_type === undefined && c && c.surface) environmentType = c.surface;
+    if (effectiveSurface === "artifact" && args.deploy_type === undefined) {
+      deployType = "artifact";
+      if (args.deploy_slug === undefined && c && c.deploy_slug) deploySlug = c.deploy_slug;
+    }
+  }
   const row = {
     id, display_name: displayName, repo_path: repoPath, deploy_type: deployType,
-    deploy_slug: args.deploy_slug ?? null,
+    deploy_slug: deploySlug,
     description: (args.description ?? "").trim().slice(0, 3000),
     simultaneity: args.simultaneity ?? 2,
     quiesced: args.quiesced ? 1 : 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -70,13 +70,14 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
    - Dedupe: for each candidate, check `get-events --json '{"task_id": "<id>", "limit": 50}'` for an event whose message starts with `evidence: delivered`. Skip tasks already delivered.
    - For each remaining task:
      - Read its QA verdict: from get-state's `sessions`, the completed session for this task whose notes mention Hazel/QA. Quote one verdict line (pass/fail and the one-line reason).
-     - Find the screenshots (platform audit harness): `AUDIT=$(readlink ~/workspace/ts-spaces/<project>/audits/latest)` where `<project>` is the task's project field. Confirm `$AUDIT/screenshot.png` and `$AUDIT/screenshot-mobile.png` exist AND are newer than the task's `created_at` (compare with `stat -c %Y`). If the audit dir predates the task, the capture is stale from an earlier run — say so and do NOT attach it. Never attach screenshots from a different run.
-     - Write the transition BEFORE the attachments (2026-09-14 — Eric: screenshots arriving out of context need a problem→solution handoff). Do not hand-write it: run the deterministic composer and paste its stdout verbatim, then the two attachment lines:
+     - Find the screenshots (platform audit harness): `AUDIT=$(readlink ~/workspace/ts-spaces/<project>/audits/latest)` where `<project>` is the task's project field. Confirm `$AUDIT/screenshot.png` and `$AUDIT/screenshot-mobile.png` exist AND are newer than the task's `created_at` (compare with `stat -c %Y`). Set `CAPTURES_OK=1` only when both PNGs exist and are fresh; otherwise `CAPTURES_OK=0`. If the audit dir predates the task, the capture is stale from an earlier run — say so and do NOT attach it. Never attach screenshots from a different run. Terminal-surface tasks never have harness captures — expect CAPTURES_OK=0 for them.
+     - Write the transition BEFORE the attachments (2026-09-14 — Eric: screenshots arriving out of context need a problem→solution handoff). Do not hand-write it: run the deterministic composer and paste its stdout verbatim:
        `node {crewHome}/lib/compose-evidence-caption.js --crew-home {crewHome} --task-id "<id>" --audit-dir "<resolved_dir>"`
-       The composer emits: the out-of-context acknowledgment, the task title, Problem: (from the task description), Shipped: (the merge commit's subject + short-sha, or an honest "provenance not yet stamped"), Evidence: (the audit dir + QA verdict, or "No QA verdict recorded"), and the visual-protocol-unavailable honest label when the run recorded one. If the composer exits non-zero, say so in one line and attach nothing for that task.
-     - Attach both to your report, each on its own plain line, using the RESOLVED dir name (not the `latest` symlink) so the evidence is pinned to this run:
+       The composer emits: the out-of-context acknowledgment, the task title, Problem: (from the task description), Shipped: (the merge commit's subject + short-sha, or an honest "provenance not yet stamped"), Evidence: (the audit dir + QA verdict when captures exist, or the honest no-captures line — 2026-09-17: the composer verifies the captures exist before claiming them, so a terminal-surface task with no audit dir gets the honest line, never "desktop + mobile captures below"), and the visual-protocol-unavailable honest label when the run recorded one. If the composer exits non-zero, say so in one line and attach nothing for that task.
+     - Attach the two screenshot lines ONLY when CAPTURES_OK=1, each on its own plain line, using the RESOLVED dir name (not the `latest` symlink) so the evidence is pinned to this run:
        `![desktop](sandbox://workspace/ts-spaces/<project>/audits/<resolved_dir>/screenshot.png)`
        `![mobile](sandbox://workspace/ts-spaces/<project>/audits/<resolved_dir>/screenshot-mobile.png)`
+       When CAPTURES_OK=0, attach nothing — the composer's caption already says so honestly.
      - Log the delivery so the next tick skips it: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} log-event --json '{"task_id": "<id>", "type": "note", "message": "evidence: delivered <id> — screenshots attached to tick report"}'`.
    - If a done task has no fresh screenshots, say so in one line — never claim evidence you don't have.
 

package/workflows/bugfix.js

@@ -81,9 +81,15 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
+const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
+// 2026-09-17): the diff is computed by this script, never ferried as an
+// agent JSON string. Pinned like the other publish-critical modules so a
+// mid-run release swap cannot change it under the workflow.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -259,7 +265,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the six pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -267,7 +273,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -448,37 +454,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish diff transport: parse a unified diff into per-file {path, added,
-// removed} line lists. Pure function — no I/O, no clock. Used by Publish to
-// verify the artifact builder applied the carried change (canary run 4,
-// 2026-09-11: the builder's source tree was stale and disconnected from the
-// crew's repo; "rebuild from current source" rebuilt stale code and the
-// workflow stamped the new commit hash on it — provenance fiction).
-function parseUnifiedDiff(diffText) {
-  var files = [];
-  var current = null;
-  var lines = (diffText || "").split("\n");
-  for (var i = 0; i < lines.length; i++) {
-    var line = lines[i];
-    var m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
-    if (m) {
-      current = { path: m[2], added: [], removed: [] };
-      files.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
-    if (/^@@ /.test(line)) continue;
-    if (line.charAt(0) === "+") {
-      current.added.push(line.slice(1));
-    } else if (line.charAt(0) === "-") {
-      current.removed.push(line.slice(1));
-    }
-  }
-  return files;
-}
-
-
 // Publish read-back request (currently unavailable): the verbatim_request
 // the parent protocol (docs/publish-verification.md) would hand to an
 // independent read-back tool after the artifact build lands. artifact_inspect
@@ -1586,59 +1561,77 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
-        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
-        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
-        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
-        // to execute the conditional (clean-room 2026-09-16: the agent ran
-        // merge-base on the empty tree directly and parked).
-        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
-          ? "ANCESTOR=yes && "
-          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
+        // Publish diff transport (room #14, 2026-09-17): the diff used to be
+        // ferried as a JSON string field in the agent's response — the agent
+        // produced a valid 700-line diff on disk but the JSON ferry dropped
+        // it, and the parse saw zero files ("Publish diff parsed to zero
+        // files"). The diff now travels git -> file -> deterministic script
+        // summary; the LLM never carries diff bytes. The agent is pure hands:
+        // it runs exactly one command (the PINNED compute-publish-diff.js —
+        // a mid-run release swap cannot change it under the workflow) and
+        // returns the small JSON summary verbatim. All fail-closed parks
+        // below are unchanged in meaning.
+        var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + ".diff";
         var diffResult = await agent(
-          "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          ancestorShell + 
-          "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
-          "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
-          "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
+          "Run exactly one command and nothing else:\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, totalReworkCount), label: "Computing publish diff from stamped base",
-            schema: { type: "object", properties: { commit: { type: "string" }, base: { type: "string" }, ancestor: { type: "string" }, diff: { type: "string" }, files: { type: "string" } }, required: ["commit", "base", "ancestor", "diff"] } }
+            schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
         );
-        if ((diffResult.ancestor || "").trim() !== "yes") {
-          return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + (diffResult.commit || "").trim().slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        var diffSummary = null;
+        try {
+          diffSummary = JSON.parse((diffResult.output || "").trim());
+        } catch (e) {
+          return await parkTask("Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+        }
+        if (!diffSummary || diffSummary.ok !== true) {
+          if (diffSummary && diffSummary.error === "not-ancestor") {
+            return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+          }
+          return await parkTask("Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
         }
-        if ((diffResult.base || "").trim() !== publishBase) {
-          return await parkTask("Publish diff base mismatch: agent reported '" + (diffResult.base || "").trim().slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+        if (diffSummary.base !== publishBase) {
+          return await parkTask("Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
         }
-        var mergeCommitForPublish = (diffResult.commit || "").trim();
-        var mergeDiff = diffResult.diff || "";
-        if (!mergeDiff.trim()) {
+        var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+        var publishDiffSha256 = String(diffSummary.sha256 || "");
+        if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
-        if (/^Binary files /m.test(mergeDiff)) {
-          return await parkTask("Publish diff contains binary files — the text diff transport cannot carry them. Human attention needed.");
+        if (diffSummary.has_binary) {
+          return await parkTask("Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
         }
-        if (/^rename from /m.test(mergeDiff)) {
+        if (diffSummary.has_rename) {
           return await parkTask("Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
         }
-        var expectedChanges = parseUnifiedDiff(mergeDiff);
         // Budget counts CHANGED lines (added + removed), not raw unified-diff
         // output lines: context lines and file headers inflated the old
         // split("\n").length count ~2x, parking a 95-line change against a
-        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13).
-        var mergeDiffChangedLines = expectedChanges.reduce(function (n, f) { return n + f.added.length + f.removed.length; }, 0);
+        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13). The count
+        // now comes from the deterministic script summary, never from the LLM.
+        var mergeDiffChangedLines = diffSummary.changed_lines || 0;
         if (mergeDiffChangedLines > 200) {
           return await parkTask("Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
         }
-        if (expectedChanges.length === 0) {
+        if (!diffSummary.file_count) {
           return await parkTask("Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
         }
+        // The trigger agent reads the diff from the checksummed file — the
+        // workflow never holds diff bytes (room #14, 2026-09-17). The file
+        // is small by construction: the 200-line budget above gates the
+        // trigger. The sha256 check is the agent's only verification step;
+        // a mismatch stops the trigger before any artifact_edit call.
         var rebuildPrompt =
           ARTIFACT_LOAD_PREAMBLE +
-          "Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
+          "The change to apply is the unified diff in the file \"" + publishDiffFile + "\" (sha256 " + publishDiffSha256 + ").\n" +
+          "1. Verify the file: run sha256sum on it. If the printed hash is not exactly " + publishDiffSha256 + ", STOP and end your turn — do not call artifact_edit.\n" +
+          "2. Read the file's full content.\n" +
+          "3. Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
           "'Apply the following change to your source tree, then rebuild and deploy.\n" +
           "\n" +
           "UNIFIED DIFF (relative to your source tree):\n" +
-          "```diff\n" + mergeDiff + "\n```\n" +
+          "```diff\n<the full content of the verified file, pasted verbatim>\n```\n" +
           "\n" +
           "Rules:\n" +
           "- For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).\n" +

package/workflows/chore.js

@@ -138,9 +138,15 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
+const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
+// 2026-09-17): the diff is computed by this script, never ferried as an
+// agent JSON string. Pinned like the other publish-critical modules so a
+// mid-run release swap cannot change it under the workflow.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -311,7 +317,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the six pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -319,7 +325,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -500,37 +506,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish diff transport: parse a unified diff into per-file {path, added,
-// removed} line lists. Pure function — no I/O, no clock. Used by Publish to
-// verify the artifact builder applied the carried change (canary run 4,
-// 2026-09-11: the builder's source tree was stale and disconnected from the
-// crew's repo; "rebuild from current source" rebuilt stale code and the
-// workflow stamped the new commit hash on it — provenance fiction).
-function parseUnifiedDiff(diffText) {
-  var files = [];
-  var current = null;
-  var lines = (diffText || "").split("\n");
-  for (var i = 0; i < lines.length; i++) {
-    var line = lines[i];
-    var m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
-    if (m) {
-      current = { path: m[2], added: [], removed: [] };
-      files.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
-    if (/^@@ /.test(line)) continue;
-    if (line.charAt(0) === "+") {
-      current.added.push(line.slice(1));
-    } else if (line.charAt(0) === "-") {
-      current.removed.push(line.slice(1));
-    }
-  }
-  return files;
-}
-
-
 // Publish read-back request (currently unavailable): the verbatim_request
 // the parent protocol (docs/publish-verification.md) would hand to an
 // independent read-back tool after the artifact build lands. artifact_inspect
@@ -1473,59 +1448,77 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
-        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
-        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
-        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
-        // to execute the conditional (clean-room 2026-09-16: the agent ran
-        // merge-base on the empty tree directly and parked).
-        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
-          ? "ANCESTOR=yes && "
-          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
+        // Publish diff transport (room #14, 2026-09-17): the diff used to be
+        // ferried as a JSON string field in the agent's response — the agent
+        // produced a valid 700-line diff on disk but the JSON ferry dropped
+        // it, and the parse saw zero files ("Publish diff parsed to zero
+        // files"). The diff now travels git -> file -> deterministic script
+        // summary; the LLM never carries diff bytes. The agent is pure hands:
+        // it runs exactly one command (the PINNED compute-publish-diff.js —
+        // a mid-run release swap cannot change it under the workflow) and
+        // returns the small JSON summary verbatim. All fail-closed parks
+        // below are unchanged in meaning.
+        var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (reworkCount > 0 ? "-r" + reworkCount : "") + ".diff";
         var diffResult = await agent(
-          "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          ancestorShell + 
-          "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
-          "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
-          "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
+          "Run exactly one command and nothing else:\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, reworkCount), label: "Computing publish diff from stamped base",
-            schema: { type: "object", properties: { commit: { type: "string" }, base: { type: "string" }, ancestor: { type: "string" }, diff: { type: "string" }, files: { type: "string" } }, required: ["commit", "base", "ancestor", "diff"] } }
+            schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
         );
-        if ((diffResult.ancestor || "").trim() !== "yes") {
-          return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + (diffResult.commit || "").trim().slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        var diffSummary = null;
+        try {
+          diffSummary = JSON.parse((diffResult.output || "").trim());
+        } catch (e) {
+          return await parkTask("Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+        }
+        if (!diffSummary || diffSummary.ok !== true) {
+          if (diffSummary && diffSummary.error === "not-ancestor") {
+            return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+          }
+          return await parkTask("Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
         }
-        if ((diffResult.base || "").trim() !== publishBase) {
-          return await parkTask("Publish diff base mismatch: agent reported '" + (diffResult.base || "").trim().slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+        if (diffSummary.base !== publishBase) {
+          return await parkTask("Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
         }
-        var mergeCommitForPublish = (diffResult.commit || "").trim();
-        var mergeDiff = diffResult.diff || "";
-        if (!mergeDiff.trim()) {
+        var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+        var publishDiffSha256 = String(diffSummary.sha256 || "");
+        if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
-        if (/^Binary files /m.test(mergeDiff)) {
-          return await parkTask("Publish diff contains binary files — the text diff transport cannot carry them. Human attention needed.");
+        if (diffSummary.has_binary) {
+          return await parkTask("Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
         }
-        if (/^rename from /m.test(mergeDiff)) {
+        if (diffSummary.has_rename) {
           return await parkTask("Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
         }
-        var expectedChanges = parseUnifiedDiff(mergeDiff);
         // Budget counts CHANGED lines (added + removed), not raw unified-diff
         // output lines: context lines and file headers inflated the old
         // split("\n").length count ~2x, parking a 95-line change against a
-        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13).
-        var mergeDiffChangedLines = expectedChanges.reduce(function (n, f) { return n + f.added.length + f.removed.length; }, 0);
+        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13). The count
+        // now comes from the deterministic script summary, never from the LLM.
+        var mergeDiffChangedLines = diffSummary.changed_lines || 0;
         if (mergeDiffChangedLines > 200) {
           return await parkTask("Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
         }
-        if (expectedChanges.length === 0) {
+        if (!diffSummary.file_count) {
           return await parkTask("Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
         }
+        // The trigger agent reads the diff from the checksummed file — the
+        // workflow never holds diff bytes (room #14, 2026-09-17). The file
+        // is small by construction: the 200-line budget above gates the
+        // trigger. The sha256 check is the agent's only verification step;
+        // a mismatch stops the trigger before any artifact_edit call.
         var rebuildPrompt =
           ARTIFACT_LOAD_PREAMBLE +
-          "Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
+          "The change to apply is the unified diff in the file \"" + publishDiffFile + "\" (sha256 " + publishDiffSha256 + ").\n" +
+          "1. Verify the file: run sha256sum on it. If the printed hash is not exactly " + publishDiffSha256 + ", STOP and end your turn — do not call artifact_edit.\n" +
+          "2. Read the file's full content.\n" +
+          "3. Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
           "'Apply the following change to your source tree, then rebuild and deploy.\n" +
           "\n" +
           "UNIFIED DIFF (relative to your source tree):\n" +
-          "```diff\n" + mergeDiff + "\n```\n" +
+          "```diff\n<the full content of the verified file, pasted verbatim>\n```\n" +
           "\n" +
           "Rules:\n" +
           "- For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).\n" +