muse-crew 0.11.1 → 0.13.0

package/lib/compose-evidence-caption.js

@@ -9,7 +9,18 @@
 // caller appends AFTER this caption. Deterministic: every line is extracted
 // mechanically from the Crew API, the task's events, and the merge commit —
 // no LLM prose. The caller (seed/cron-body-template.md Step 6) prints this
-// caption verbatim, then the two attachment lines, then logs delivery.
+// caption verbatim, then the two attachment lines (only when the audit
+// harness actually captured screenshots), then logs delivery.
+//
+// Capture guard (2026-09-17, room #14): the composer must SEE the captures
+// before it claims them. It once fabricated "desktop + mobile captures
+// below" for a terminal-surface task with no audit dir at all, and opened
+// with "these screenshots are dropping in" when no screenshots existed. So
+// it resolves the audit dir itself — <home>/workspace/ts-spaces/<deploy_slug>
+// /audits/<auditDir>/, the same root lib/crew-api.js and lib/readback-disk.js
+// resolve — and checks screenshot.png + screenshot-mobile.png are files.
+// Missing deploy_slug, missing dir, or missing PNGs gets the honest
+// no-captures line; terminal surfaces are named, not assumed.
 //
 // Usage:
 //   node lib/compose-evidence-caption.js --crew-home <home> \
@@ -19,6 +30,7 @@
 
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 
 function usage(msg) {
@@ -76,6 +88,22 @@ try {
 }
 const task = (state.tasks || []).find((t) => t.id === taskId);
 if (!task) usage("task " + taskId + " not found");
+const project = (state.projects || []).find((p) => p.id === task.project);
+
+// Capture guard (2026-09-17, room #14): resolve the audit dir the audit
+// harness actually writes and verify the captures exist before claiming
+// them. A bare --audit-dir name is never trusted on its own.
+function isFile(p) {
+  try { return fs.statSync(p).isFile(); } catch { return false; }
+}
+let auditPath = null;
+if (project && project.deploy_slug) {
+  auditPath = path.join(os.homedir(), "workspace", "ts-spaces",
+    project.deploy_slug, "audits", auditDir);
+}
+const hasCaptures = !!(auditPath &&
+  isFile(path.join(auditPath, "screenshot.png")) &&
+  isFile(path.join(auditPath, "screenshot-mobile.png")));
 
 let events = [];
 try {
@@ -126,7 +154,8 @@ if (!verdict) {
 }
 
 // Provenance: this task's own newest `publish: verified` event first; the
-// global provenance record only when it belongs to this task.
+// project-scoped provenance record only when it belongs to this task
+// (provenance is per-project — room #15 blocker 8).
 let commit = null;
 const verifiedNote = notesNewest
   .find((e) => (e.message || "").includes("publish: verified"));
@@ -134,9 +163,9 @@ if (verifiedNote) {
   const m = /\b([0-9a-f]{40})\b/.exec(verifiedNote.message);
   if (m) commit = m[1];
 }
-if (!commit) {
+if (!commit && project) {
   try {
-    const prov = api("get-provenance", {}).provenance;
+    const prov = api("get-provenance", { project_id: project.id }).provenance;
     if (prov && prov.task_id === taskId && /^[0-9a-f]{40}$/.test(prov.source_commit || "")) {
       commit = prov.source_commit;
     }
@@ -149,8 +178,7 @@ if (!commit) {
 // task title when the commit is unknown or unreadable.
 let solution = "";
 if (commit) {
-  const proj = (state.projects || []).find((p) => p.id === task.project);
-  if (proj && proj.repo_path) solution = gitSubject(proj.repo_path, commit);
+  if (project && project.repo_path) solution = gitSubject(project.repo_path, commit);
 }
 if (!solution) solution = task.title;
 
@@ -169,16 +197,37 @@ const newestBaselineNote = notesNewest.find((e) => /^baseline:\s*/i.test(e.messa
 const visualUnavailable = !verdict && !!newestBaselineNote &&
   /^baseline:\s*none/i.test(newestBaselineNote.message || "");
 
+const verdictLine = verdict
+  ? " QA verdict: " + verdict.status + (verdict.summary ? " — " + trimWords(verdict.summary, 200) : "") + "."
+  : " No QA verdict recorded.";
+
 const lines = [];
-lines.push("These screenshots are dropping in out of context — quick transition.");
+if (hasCaptures) {
+  lines.push("These screenshots are dropping in out of context — quick transition.");
+} else {
+  // Honest opener: no screenshots are arriving, so the report says so up
+  // front instead of pretending they are dropping in.
+  lines.push("QA evidence for this task — no screenshots, so this is the whole report.");
+}
 lines.push("");
 lines.push("**" + task.title + "**");
 lines.push("Problem: " + problem);
 lines.push("Shipped: " + trimWords(solution, 160) +
   (commit ? " (commit `" + commit.slice(0, 12) + "`, parent-verified)" : " (provenance not yet stamped)"));
-lines.push("Evidence: desktop + mobile captures below, taken by the platform audit harness after deploy (`" + auditDir + "`)." +
-  (verdict ? " QA verdict: " + verdict.status + (verdict.summary ? " — " + trimWords(verdict.summary, 200) : "") + "." : " No QA verdict recorded."));
-if (visualUnavailable) {
+if (hasCaptures) {
+  lines.push("Evidence: desktop + mobile captures below, taken by the platform audit harness after deploy (`" + auditDir + "`)." + verdictLine);
+} else {
+  // Honest no-captures line (2026-09-17, room #14): never claim captures
+  // that do not exist. Terminal surfaces are named, not assumed.
+  const surfaceNote = project && project.environment_type === "terminal"
+    ? " (terminal surface — QA judges the CLI, not pixels)"
+    : "";
+  lines.push("Evidence: no screenshots captured for this task" + surfaceNote + " — nothing to attach." + verdictLine);
+}
+if (visualUnavailable && hasCaptures) {
+  // The note's premise is the post-deploy capture — without captures it
+  // would fabricate evidence again (2026-09-17: the no-captures line above
+  // already covers the honest case).
   lines.push("Note: the visual protocol is unavailable — these are the post-deploy capture plus QA's mechanical checks, not a QA visual inspection.");
 }
 process.stdout.write(lines.join("\n") + "\n");

package/lib/compute-publish-diff.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// compute-publish-diff.js — deterministic publish-diff computer.
+//
+// Room #14 (2026-09-17): the Publish phase asked an agent to run
+// `git diff "$BASE" "$HEAD"` and return the raw unified diff as a JSON
+// string field. The agent produced the diff correctly on disk but the
+// JSON ferry dropped it — parseUnifiedDiff saw zero files and the task
+// parked at "Publish diff parsed to zero files" for a real, valid
+// 700-line / 23-file diff. General rule: NEVER ferry a deterministic
+// unified diff through an LLM JSON response.
+//
+// This script is the deterministic replacement. The workflow's agent is
+// pure hands — it runs exactly one command (this script) and returns the
+// small JSON summary verbatim. The diff bytes live in a file; the LLM
+// never carries them:
+//
+//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file>
+//
+// --base is the previously-stamped provenance source_commit (or the
+// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
+// publish) — the SAME base the workflow read from get-provenance. The
+// script echoes the base it used so the workflow can guard against the
+// agent running the wrong command (fail-closed, as before).
+//
+// Stdout contract: exactly one JSON object, always small (no diff text):
+//   { ok:true, commit, base, ancestor:"yes", diff_file, sha256, bytes,
+//     file_count, changed_lines, files:[<paths>], has_binary, has_rename }
+//   { ok:false, error:"not-ancestor", commit, base }   (semantic, exit 0)
+//
+// Exit codes: 0 ok (JSON on stdout) · 2 usage/validation · 1 git/diff/IO
+// failure. On non-zero exit NOTHING is printed to stdout, so a caller
+// must never treat stdout as a summary. Errors go to stderr as JSON.
+//
+// Security: --base must be 40-hex (or the empty tree); --repo-path must
+// be an existing directory; git is invoked via execFileSync with an argv
+// array (no shell). The diff file's parent directories are created.
+
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, statSync, writeFileSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
+function arg(name, required = true) {
+  const i = process.argv.indexOf(name);
+  if (i < 0 || i + 1 >= process.argv.length) {
+    if (!required) return null;
+    fail("usage", `${name} is required.`, 2);
+  }
+  return process.argv[i + 1];
+}
+function fail(code, message, exitCode) {
+  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
+  process.exit(exitCode);
+}
+function git(repoPath, args) {
+  try {
+    return execFileSync("git", ["-C", repoPath, ...args], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  } catch (e) {
+    fail("git-failed", `git ${args[0]} failed: ${(e && e.message) || e}`.slice(0, 500), 1);
+  }
+}
+
+const repoPath = arg("--repo-path");
+const base = arg("--base");
+const outFile = arg("--out");
+
+if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "--base must be a 40-char hex commit SHA (or the empty-tree SHA).", 2);
+let st = null;
+try { st = statSync(repoPath); } catch { /* falls through */ }
+if (!st || !st.isDirectory()) fail("usage", "--repo-path must be an existing directory.", 2);
+
+const head = git(repoPath, ["rev-parse", "HEAD"]).trim();
+if (!/^[0-9a-f]{40}$/.test(head)) fail("git-failed", "rev-parse HEAD did not return a commit SHA.", 1);
+
+// Ancestor check — deterministic, in code. The empty tree is not a commit:
+// git merge-base --is-ancestor fails on it, so a first publish hardcodes
+// ANCESTOR=yes here instead of executing the conditional (clean-room
+// 2026-09-16: an agent ran merge-base on the empty tree directly and parked).
+let ancestor = "yes";
+if (base !== EMPTY_TREE) {
+  try {
+    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, head], { stdio: "ignore" });
+    ancestor = "yes";
+  } catch {
+    ancestor = "no";
+  }
+}
+if (ancestor !== "yes") {
+  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit: head, base }) + "\n");
+  process.exit(0);
+}
+
+const outPath = resolve(outFile);
+mkdirSync(dirname(outPath), { recursive: true });
+const diffText = git(repoPath, ["diff", base, head]);
+writeFileSync(outPath, diffText, "utf8");
+const bytes = readFileSync(outPath);
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+
+// summarizeDiff — the parseUnifiedDiff logic, moved out of the workflows
+// (canary run 4, 2026-09-11: the builder's source tree was stale and the
+// workflow stamped a new hash on it — provenance fiction; the parse
+// exists so Publish verifies the artifact builder applied the carried
+// change). Counts changed lines (added + removed), never raw diff output
+// lines: context lines and file headers inflated the old split("\n").length
+// count ~2x, parking a 95-line change against the 200-line budget
+// (Gate 1 Journey 3 attempt 3, 2026-09-13).
+let files = [];
+let current = null;
+let added = 0;
+let removed = 0;
+let has_binary = false;
+let has_rename = false;
+for (const line of diffText.split("\n")) {
+  const m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
+  if (m) {
+    current = m[2];
+    files.push(current);
+    continue;
+  }
+  if (/^Binary files /.test(line)) { has_binary = true; continue; }
+  if (/^rename from /.test(line)) { has_rename = true; continue; }
+  if (current === null) continue;
+  if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
+  if (/^@@ /.test(line)) continue;
+  if (line.charAt(0) === "+") added++;
+  else if (line.charAt(0) === "-") removed++;
+}
+
+process.stdout.write(JSON.stringify({
+  ok: true,
+  commit: head,
+  base,
+  ancestor: "yes",
+  diff_file: outPath,
+  sha256,
+  bytes: bytes.length,
+  file_count: files.length,
+  changed_lines: added + removed,
+  files,
+  has_binary,
+  has_rename,
+}) + "\n");