muse-crew 0.11.1 → 0.12.0

package/workflows/crew-dispatch.js

@@ -941,11 +941,17 @@ await agent(
 // not timestamps — no wall-clock calls (see tests/determinism.test.js).
 // Fire-and-forget: the script swallows its own errors and exits 0, the
 // agent call carries no schema, and the whole call is wrapped in
-// try/catch — a failed write can never fail the tick. Placement: every run
-// that completes the poll (dispatching, NO_DISPATCH, partial-cap) reaches
-// this point. Concurrency edge: overlapping ticks could duplicate seq
-// (count+append is not atomic) but appends are atomic, so lines never
-// interleave — seq is advisory, file order is the proof.
+// try/catch — a failed write can never fail the tick. The script echoes
+// the appended line to stdout (2026-09-17, rooms #12–#14): the fire-and-forget
+// agent() call carries no schema and its return is discarded, but the
+// platform's JSON-candidate scan throws on an EMPTY schema-less result —
+// which is what the writer returned before it echoed. Every other
+// fire-and-forget call in this file returns the CLI's non-empty JSON
+// stdout verbatim, so the writer now speaks the same proven shape.
+// Placement: every run that completes the poll (dispatching, NO_DISPATCH,
+// partial-cap) reaches this point. Concurrency edge: overlapping ticks
+// could duplicate seq (count+append is not atomic) but appends are atomic,
+// so lines never interleave — seq is advisory, file order is the proof.
 var tickReleaseScript = [
   "var crewHome=process.argv[1];",
   "try{",
@@ -954,7 +960,16 @@ var tickReleaseScript = [
   "var file=path.join(crewHome,\".tick-releases.jsonl\");",
   "var count=0;",
   "try{var lines=fs.readFileSync(file,\"utf8\").split(\"\\n\");for(var i=0;i<lines.length;i++){if(lines[i].trim()!==\"\"){count++;}}}catch(e){}",
-  "fs.appendFileSync(file,JSON.stringify({seq:count+1,release:release})+\"\\n\");",
+  "var line=JSON.stringify({seq:count+1,release:release});",
+  "fs.appendFileSync(file,line+\"\\n\");",
+  // Rooms #12–#14: echo the appended line to stdout. The fire-and-forget
+  // agent() call below carries no schema and its return is discarded — but
+  // the platform's JSON-candidate scan throws on an EMPTY schema-less
+  // result, which is exactly what this script returned before (exit 0, no
+  // output). Every other fire-and-forget call in this file returns the
+  // CLI's non-empty JSON stdout verbatim, so the writer now speaks the same
+  // proven shape: the echoed line is the evidence of the write.
+  "process.stdout.write(line+\"\\n\");",
   "}catch(e){}",
   "process.exit(0);"
 ].join("");

package/workflows/crew-init.js

@@ -492,6 +492,56 @@ if (dashboardRepoPath) {
   log("Repo setup: no repo (CLI-only mode) — skipping.");
 }
 
+// ── Publish-base advance (2026-09-18) ─────────────────────────────────
+// Room #14: create-project stamps provenance.source_commit at the
+// pre-scaffold repo HEAD, then the scaffold commits .orchestration/ (and the
+// consented .gitignore) on top. The first task's publish diff then carries
+// the whole scaffold (517 insertions in room #14) and blows the 200-line
+// diff-transport budget. The scaffold is crew-owned infrastructure the
+// dashboard artifact never consumes, so the correct publish base is the
+// scaffold commit itself. Advance it deterministically via
+// lib/advance-publish-base.js — only when this init created the project
+// (the stamp is ours, never a real publish's), the scaffold commit's parent
+// is exactly the stamped base (nothing slipped between), and the scaffold
+// touches only crew-owned paths. Best-effort: a failed advance never blocks
+// init — the first task then publishes from the stamped base as before.
+var publishBaseResult = null;
+if (dashboardRepoPath && projectResult && projectResult.action === "created" &&
+    setupRepoResult && setupRepoResult.commit && setupRepoResult.commit.committed) {
+  try {
+    publishBaseResult = await agent(
+      "Run the deterministic publish-base advance script. Do not decide anything — just run the command and return its JSON output.\n\n" +
+      "Command:\n" +
+      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-created\n\n" +
+      "The script prints one JSON object: { ok, action, reason?, from?, to? }.\n" +
+      "Return that JSON verbatim.",
+      {
+        key: "advance-publish-base",
+        label: "Advance publish base past scaffold commit",
+        schema: {
+          type: "object",
+          properties: {
+            ok: { type: "boolean" },
+            action: { type: "string" },
+            reason: {},
+            from: {},
+            to: {}
+          },
+          required: ["ok", "action"]
+        }
+      }
+    );
+    log("Publish base: " + publishBaseResult.action +
+        (publishBaseResult.reason ? " (" + publishBaseResult.reason + ")" : "") +
+        (publishBaseResult.from ? " " + publishBaseResult.from + " -> " + publishBaseResult.to : ""));
+  } catch (e) {
+    log("Publish base: advance script failed (" + String(e.message || e) + ") — continuing with the stamped base (non-fatal).");
+  }
+} else {
+  log("Publish base: no advance (project " + (projectResult ? projectResult.action : "unknown") +
+      ", scaffold " + (setupRepoResult && setupRepoResult.commit && setupRepoResult.commit.committed ? "committed" : "not committed") + ").");
+}
+
 // ── Scheduler identity (2026-09-16) ──────────────────────────────────
 // The crew's scheduler identity is dashboard-independent and chosen once.
 // First init uses the crew-home basename; a re-run keeps the instanceId

package/workflows/standard.js

@@ -89,9 +89,15 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
+const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
+// 2026-09-17): the diff is computed by this script, never ferried as an
+// agent JSON string. Pinned like the other publish-critical modules so a
+// mid-run release swap cannot change it under the workflow.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -267,7 +273,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the six pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -275,7 +281,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -456,37 +462,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish diff transport: parse a unified diff into per-file {path, added,
-// removed} line lists. Pure function — no I/O, no clock. Used by Publish to
-// verify the artifact builder applied the carried change (canary run 4,
-// 2026-09-11: the builder's source tree was stale and disconnected from the
-// crew's repo; "rebuild from current source" rebuilt stale code and the
-// workflow stamped the new commit hash on it — provenance fiction).
-function parseUnifiedDiff(diffText) {
-  var files = [];
-  var current = null;
-  var lines = (diffText || "").split("\n");
-  for (var i = 0; i < lines.length; i++) {
-    var line = lines[i];
-    var m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
-    if (m) {
-      current = { path: m[2], added: [], removed: [] };
-      files.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
-    if (/^@@ /.test(line)) continue;
-    if (line.charAt(0) === "+") {
-      current.added.push(line.slice(1));
-    } else if (line.charAt(0) === "-") {
-      current.removed.push(line.slice(1));
-    }
-  }
-  return files;
-}
-
-
 // Publish read-back request (agent path currently unavailable): the
 // verbatim_request the parent protocol (docs/publish-verification.md) would
 // hand to an independent read-back tool after the artifact build lands.
@@ -1467,59 +1442,77 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
-        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
-        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
-        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
-        // to execute the conditional (clean-room 2026-09-16: the agent ran
-        // merge-base on the empty tree directly and parked).
-        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
-          ? "ANCESTOR=yes && "
-          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
+        // Publish diff transport (room #14, 2026-09-17): the diff used to be
+        // ferried as a JSON string field in the agent's response — the agent
+        // produced a valid 700-line diff on disk but the JSON ferry dropped
+        // it, and the parse saw zero files ("Publish diff parsed to zero
+        // files"). The diff now travels git -> file -> deterministic script
+        // summary; the LLM never carries diff bytes. The agent is pure hands:
+        // it runs exactly one command (the PINNED compute-publish-diff.js —
+        // a mid-run release swap cannot change it under the workflow) and
+        // returns the small JSON summary verbatim. All fail-closed parks
+        // below are unchanged in meaning.
+        var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + ".diff";
         var diffResult = await agent(
-          "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          ancestorShell + 
-          "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
-          "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
-          "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
+          "Run exactly one command and nothing else:\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, totalReworkCount), label: "Computing publish diff from stamped base",
-            schema: { type: "object", properties: { commit: { type: "string" }, base: { type: "string" }, ancestor: { type: "string" }, diff: { type: "string" }, files: { type: "string" } }, required: ["commit", "base", "ancestor", "diff"] } }
+            schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
         );
-        if ((diffResult.ancestor || "").trim() !== "yes") {
-          return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + (diffResult.commit || "").trim().slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        var diffSummary = null;
+        try {
+          diffSummary = JSON.parse((diffResult.output || "").trim());
+        } catch (e) {
+          return await parkTask("Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+        }
+        if (!diffSummary || diffSummary.ok !== true) {
+          if (diffSummary && diffSummary.error === "not-ancestor") {
+            return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+          }
+          return await parkTask("Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
         }
-        if ((diffResult.base || "").trim() !== publishBase) {
-          return await parkTask("Publish diff base mismatch: agent reported '" + (diffResult.base || "").trim().slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+        if (diffSummary.base !== publishBase) {
+          return await parkTask("Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
         }
-        var mergeCommitForPublish = (diffResult.commit || "").trim();
-        var mergeDiff = diffResult.diff || "";
-        if (!mergeDiff.trim()) {
+        var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+        var publishDiffSha256 = String(diffSummary.sha256 || "");
+        if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
-        if (/^Binary files /m.test(mergeDiff)) {
-          return await parkTask("Publish diff contains binary files — the text diff transport cannot carry them. Human attention needed.");
+        if (diffSummary.has_binary) {
+          return await parkTask("Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
         }
-        if (/^rename from /m.test(mergeDiff)) {
+        if (diffSummary.has_rename) {
           return await parkTask("Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
         }
-        var expectedChanges = parseUnifiedDiff(mergeDiff);
         // Budget counts CHANGED lines (added + removed), not raw unified-diff
         // output lines: context lines and file headers inflated the old
         // split("\n").length count ~2x, parking a 95-line change against a
-        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13).
-        var mergeDiffChangedLines = expectedChanges.reduce(function (n, f) { return n + f.added.length + f.removed.length; }, 0);
+        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13). The count
+        // now comes from the deterministic script summary, never from the LLM.
+        var mergeDiffChangedLines = diffSummary.changed_lines || 0;
         if (mergeDiffChangedLines > 200) {
           return await parkTask("Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
         }
-        if (expectedChanges.length === 0) {
+        if (!diffSummary.file_count) {
           return await parkTask("Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
         }
+        // The trigger agent reads the diff from the checksummed file — the
+        // workflow never holds diff bytes (room #14, 2026-09-17). The file
+        // is small by construction: the 200-line budget above gates the
+        // trigger. The sha256 check is the agent's only verification step;
+        // a mismatch stops the trigger before any artifact_edit call.
         var rebuildPrompt =
           ARTIFACT_LOAD_PREAMBLE +
-          "Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
+          "The change to apply is the unified diff in the file \"" + publishDiffFile + "\" (sha256 " + publishDiffSha256 + ").\n" +
+          "1. Verify the file: run sha256sum on it. If the printed hash is not exactly " + publishDiffSha256 + ", STOP and end your turn — do not call artifact_edit.\n" +
+          "2. Read the file's full content.\n" +
+          "3. Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
           "'Apply the following change to your source tree, then rebuild and deploy.\n" +
           "\n" +
           "UNIFIED DIFF (relative to your source tree):\n" +
-          "```diff\n" + mergeDiff + "\n```\n" +
+          "```diff\n<the full content of the verified file, pasted verbatim>\n```\n" +
           "\n" +
           "Rules:\n" +
           "- For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).\n" +