muse-crew 0.11.1 → 0.13.0

package/lib/crew-api.js

@@ -28,6 +28,7 @@ import { randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { homedir } from "node:os";
+import { classifySurface } from "./classify-surface.js";
 
 // ---------------------------------------------------------------------------
 // Errors
@@ -87,12 +88,148 @@ function resolveCrewHome(flagValue) {
 
 const SCHEMA_PATH = join(import.meta.dirname, "schema.sql");
 
+// Provenance shape rules, shared by the writer and the backfill's
+// pre-validation so they can never diverge (room #15, 2026-09-18).
+const PROVENANCE_SOURCE_COMMIT_RE = /^[0-9a-f]{40}$/;
+const PROVENANCE_CREW_RELEASE_RE = /^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/;
+
+// One-time backfill of the legacy crew-home-global provenance triple
+// (config.provenance.*) into the per-project provenance columns (room #15
+// blocker 8, 2026-09-18). Attribution is never fabricated: the legacy base
+// is stamped onto a project ONLY when it is an ancestor of exactly one
+// project's repo HEAD (verified with git, never assumed). Zero or ambiguous
+// matches are recorded as deferred:<reason> and the legacy keys are left
+// untouched — new readers see null (empty-tree first publish) while old
+// readers keep their global triple. Watermarked in config, so it runs at
+// most once per crew home. Benign edge: a legacy key written by the very
+// command whose open triggers the backfill is re-created after the DELETE
+// and lingers in config — inert dead storage, never read by new code.
+function backfillProjectProvenance(db) {
+  let wm = db.prepare("SELECT value FROM config WHERE key = 'provenance.backfill'").get();
+  if (wm && wm.value === "none") {
+    // "none" means "no legacy triple at the last look". A triple that
+    // arrives later (hand-written via update-config — the key space is
+    // open) is new evidence, not a settled state: clear the watermark and
+    // evaluate it. Any other watermark (stamped:*, deferred:*) is terminal.
+    const legacy = db.prepare(
+      "SELECT key FROM config WHERE key LIKE 'provenance.%' AND key != 'provenance.backfill'"
+    ).all();
+    if (legacy.length > 0) {
+      db.prepare("DELETE FROM config WHERE key = 'provenance.backfill'").run();
+      wm = null;
+    } else {
+      return;
+    }
+  }
+  if (wm) return;
+  const setWatermark = (v) =>
+    db.prepare("INSERT OR IGNORE INTO config (key, value) VALUES ('provenance.backfill', ?)").run(v);
+  const rows = db.prepare(
+    "SELECT key, value FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at','provenance.task_id')"
+  ).all();
+  const byKey = Object.fromEntries(rows.map((r) => [r.key, r.value]));
+  const sc = byKey["provenance.source_commit"];
+  const cr = byKey["provenance.crew_release"];
+  const pa = byKey["provenance.published_at"];
+  if (!sc && !cr && !pa && !byKey["provenance.task_id"]) {
+    // No legacy provenance at all: nothing to attribute, ever.
+    setWatermark("none");
+    return;
+  }
+  if (!sc || !cr || !pa) {
+    // Incomplete triple (partial hand-write): do NOT watermark — the next
+    // open retries. Watermarking here would strand keys that arrive later.
+    return;
+  }
+  const matches = [];
+  for (const p of db.prepare("SELECT id, repo_path FROM projects").all()) {
+    try {
+      execFileSync("git", ["merge-base", "--is-ancestor", sc, "HEAD"],
+        { cwd: p.repo_path, encoding: "utf8", timeout: 10000, stdio: ["ignore", "pipe", "ignore"] });
+      matches.push(p.id);
+    } catch {
+      // Not an ancestor, or the repo is unreadable: not a match.
+    }
+  }
+  if (matches.length === 1) {
+    // Validate the legacy triple against the writer's shape rules BEFORE
+    // touching the database: a hand-written abbreviated sha passes
+    // `git merge-base --is-ancestor` (git resolves abbreviations) but
+    // violates the storage CHECK — and a throw here would escape openDb
+    // and hard-fail every CLI command against the home. The backfill's
+    // whole contract is best-effort attribution, so a bad shape is a
+    // deferred watermark, never an exception. Legacy keys are retained
+    // read-only for old readers, exactly like the other deferred cases.
+    const shapeProblem =
+      !PROVENANCE_SOURCE_COMMIT_RE.test(sc ?? "")
+        ? `source_commit not 40-char hex (${String(sc).slice(0, 24)})`
+        : !PROVENANCE_CREW_RELEASE_RE.test(cr ?? "")
+          ? `crew_release not 40-char hex or pkg-<semver> (${String(cr).slice(0, 24)})`
+          : null;
+    if (shapeProblem) {
+      setWatermark(`deferred:stamp-failed:${shapeProblem}`);
+    } else {
+      db.exec("BEGIN");
+      try {
+        db.prepare(
+          `UPDATE projects SET provenance_source_commit = ?, provenance_crew_release = ?,
+           provenance_published_at = ?, provenance_task_id = ?, updated_at = ? WHERE id = ?`
+        ).run(sc, cr, pa, byKey["provenance.task_id"] ?? null, now(), matches[0]);
+        db.prepare("DELETE FROM config WHERE key LIKE 'provenance.%' AND key != 'provenance.backfill'").run();
+        setWatermark(`stamped:${matches[0]}`);
+        db.exec("COMMIT");
+      } catch (e) {
+        db.exec("ROLLBACK");
+        const reason = String((e && e.message) || e).replace(/[\r\n]+/g, " ").slice(0, 100);
+        setWatermark(`deferred:stamp-failed:${reason}`);
+      }
+    }
+  } else if (matches.length === 0) {
+    setWatermark(`deferred:no-ancestor-match:${String(sc).slice(0, 7)}`);
+  } else {
+    setWatermark(`deferred:ambiguous:${matches.length}`);
+  }
+}
+
+// Re-run a deferred backfill when the match set may have changed: a new
+// project was just created, and a `deferred:no-ancestor-match` or
+// `deferred:ambiguous` watermark from an earlier look can now resolve —
+// e.g. a home whose legacy triple predates its first project. Only
+// deferred:* watermarks are retried, and only while the legacy keys still
+// exist (a successful stamp deleted them). Returns the stamped project id,
+// or null. Never throws for a bad triple — the evaluation watermarks
+// instead (see above); a throw here means the database itself is broken,
+// and failing project creation is then the honest outcome.
+function retryDeferredBackfill(db) {
+  const wm = db.prepare("SELECT value FROM config WHERE key = 'provenance.backfill'").get();
+  if (!wm || !String(wm.value).startsWith("deferred:")) return null;
+  const legacy = db.prepare(
+    "SELECT key FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at')"
+  ).all();
+  if (legacy.length === 0) return null;
+  // Lift the terminal watermark, re-evaluate, and let the evaluation write
+  // the new one. If the re-evaluation throws (it shouldn't — every path
+  // watermarks), restore the old watermark so the deferral isn't lost.
+  const old = wm.value;
+  db.prepare("DELETE FROM config WHERE key = 'provenance.backfill'").run();
+  try {
+    backfillProjectProvenance(db);
+  } catch (e) {
+    db.prepare("INSERT OR IGNORE INTO config (key, value) VALUES ('provenance.backfill', ?)").run(old);
+    throw e;
+  }
+  const wm2 = db.prepare("SELECT value FROM config WHERE key = 'provenance.backfill'").get();
+  const m = wm2 && /^stamped:(.+)$/.exec(String(wm2.value));
+  return m ? m[1] : null;
+}
+
 function openDb(crewHome) {
   const dbPath = join(crewHome, "crew-state.db");
   const fresh = !existsSync(dbPath);
   const db = new DatabaseSync(dbPath);
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");
+  db.exec("PRAGMA busy_timeout = 5000;");
   if (fresh) {
     const schema = readFileSync(SCHEMA_PATH, "utf8");
     db.exec(schema);
@@ -138,6 +275,29 @@ function openDb(crewHome) {
         if (!/duplicate column name/i.test(e.message)) throw e;
       }
     }
+    // Migration: per-project provenance columns (room #15 blocker 8,
+    // 2026-09-18). Same idempotent PRAGMA-check pattern; ADD COLUMN without
+    // a default leaves existing rows NULL, which is "no provenance yet" by
+    // design — attribution is never fabricated, so there is no backfill step
+    // here beyond the watermarked legacy-triple attribution below.
+    const provMigration = [
+      ["provenance_source_commit", "TEXT CHECK (provenance_source_commit IS NULL OR length(provenance_source_commit) = 40)"],
+      ["provenance_crew_release", "TEXT"],
+      ["provenance_published_at", "TEXT"],
+      ["provenance_task_id", "TEXT"],
+    ];
+    const provColNames = new Set(db.prepare("PRAGMA table_info(projects)").all().map((c) => c.name));
+    for (const [colName, colType] of provMigration) {
+      if (!provColNames.has(colName)) {
+        try {
+          db.exec(`ALTER TABLE projects ADD COLUMN ${colName} ${colType}`);
+        } catch (e) {
+          if (!/duplicate column name/i.test(e.message)) throw e;
+        }
+      }
+    }
+    // Legacy global-provenance backfill (watermarked, runs at most once).
+    backfillProjectProvenance(db);
   }
   return db;
 }
@@ -275,7 +435,7 @@ function requireTask(db, id) {
 
 function requireProject(db, id) {
   const row = db.prepare("SELECT * FROM projects WHERE id = ?").get(id);
-  if (!row) throw notFound("Project not found.");
+  if (!row) throw notFound(`Project not found: "${id}" — check list-projects, or create it with create-project.`);
   return row;
 }
 
@@ -1262,16 +1422,27 @@ commands["get-events"] = (db, args) => {
 // against this code's own realpath (the release it is actually running
 // from). Unresolvable or disputed => throw fail-closed BEFORE the claim
 // transaction: provenance is never stamped with an unknown release.
-function resolveActiveRelease(crewHome) {
+//
+// Active-release resolution is split in two (room #15, 2026-09-18):
+// resolveActiveReleaseName (symlink only — for writers) below, and
+// resolveActiveRelease (symlink + self-path cross-check — for verifiers).
+function resolveActiveReleaseName(crewHome) {
   let linkTarget;
   try {
     linkTarget = readlinkSync(join(crewHome, "current"));
   } catch (e) {
     throw usageError(
-      `scan-verification-pending: cannot resolve the active release: ${join(crewHome, "current")} is not a readable symlink (${e.message}). Refusing to verify.`
+      `cannot resolve the active release: ${join(crewHome, "current")} is not a readable symlink (${e.message}).`
     );
   }
-  const activeRelease = basename(resolve(crewHome, linkTarget));
+  return basename(resolve(crewHome, linkTarget));
+}
+// The strict resolver for verifiers (scan-verification-pending): the symlink
+// answer PLUS the self-path cross-check — the running code must provably be
+// the active release's own crew-api.js before it stamps verification claims.
+// Stale cron bodies and mid-deploy swaps throw fail-closed here.
+function resolveActiveRelease(crewHome) {
+  const activeRelease = resolveActiveReleaseName(crewHome);
   const selfPath = new URL(import.meta.url).pathname;
   const selfMatch = selfPath.match(/releases\/([^/]+)\/lib\/crew-api\.js$/);
   if (!selfMatch) {
@@ -1574,39 +1745,49 @@ commands["record-phase"] = (db, args) => {
 // the JSON transport and over the 200-line budget. The artifact is built from
 // the repo checkout at registration time, so create-project stamps
 // source_commit = repo HEAD for artifact-deploy projects; the first publish
-// then diffs only the task's own changes. The stamp never clobbers an
-// existing one (provenance storage is crew-home-global, so a second artifact
-// project keeps the first stamp — per-project provenance is a known gap this
-// does not introduce). A skipped stamp is reported, never silent, and never
-// fails project creation.
-function initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName }) {
+// The initial-provenance stamp at create-project time: an artifact project
+// opens with its publish base set to the repo HEAD at registration, so the
+// first publish diffs only the task's own changes. Per-project (room #15
+// blocker 8): the project row was just inserted, so it is unstamped by
+// construction — there is no "already stamped" skip; a second artifact
+// project gets its own row, never the first project's base. A skipped stamp
+// is reported, never silent, and never fails project creation.
+function initialProvenancePlan({ deployType, headSha, releaseName }) {
   if (deployType !== "artifact") return { stamped: false, reason: "deploy_type is not artifact" };
-  if (provenanceExists) return { stamped: false, reason: "provenance already stamped" };
   if (!headSha) return { stamped: false, reason: "repo HEAD is unresolvable (unborn repo?)" };
   if (!releaseName) return { stamped: false, reason: "active crew release is unresolvable" };
   return { stamped: true, source_commit: headSha, crew_release: releaseName };
 }
 
-function tryStampInitialProvenance(db, crewHome, repoPath, deployType) {
-  const keys = db.prepare(
-    "SELECT key FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at')"
-  ).all().map((r) => r.key);
-  const provenanceExists = keys.length === 3;
+function tryStampInitialProvenance(db, projectId, crewHome, repoPath, deployType) {
   let headSha = null;
   try {
     headSha = execFileSync("git", ["rev-parse", "HEAD"],
-      { cwd: repoPath, encoding: "utf8", timeout: 10000 }).trim();
+      { cwd: repoPath, encoding: "utf8", timeout: 10000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (!/^[0-9a-f]{40}$/.test(headSha)) headSha = null;
   } catch { headSha = null; }
   let releaseName = null;
-  try { releaseName = resolveActiveRelease(crewHome); } catch { releaseName = null; }
-  const plan = initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName });
+  // Symlink-only resolution: the stamp records the crew home's ACTIVE
+  // release — it must not depend on which copy of this file is running.
+  // The strict self-path cross-check lives in resolveActiveRelease, used by
+  // scan-verification-pending; requiring it here silently skipped the stamp
+  // for every setup path that invokes crew-api.js outside the release tree
+  // (room #15: create-project through the npm package's own lib/).
+  try { releaseName = resolveActiveReleaseName(crewHome); } catch { releaseName = null; }
+  const plan = initialProvenancePlan({ deployType, headSha, releaseName });
   if (!plan.stamped) return plan;
-  const upsert = db.prepare(
-    "INSERT INTO config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value");
-  upsert.run("provenance.source_commit", plan.source_commit);
-  upsert.run("provenance.crew_release", plan.crew_release);
-  upsert.run("provenance.published_at", now());
+  try {
+    stampProvenance(db, {
+      project_id: projectId,
+      source_commit: plan.source_commit,
+      crew_release: plan.crew_release,
+    });
+  } catch (e) {
+    // The stamp is best-effort: a writer rejection (e.g. a release name
+    // outside the stampable shape) skips the stamp, never the project.
+    // Reported via the reason, never silent.
+    return { stamped: false, reason: `initial stamp rejected: ${e.message}` };
+  }
   return plan;
 }
 
@@ -1618,17 +1799,47 @@ commands["create-project"] = (db, args, ctx) => {
   const repoPath = (args.repo_path ?? "").trim();
   if (!repoPath) throw usageError("repo_path is required.");
   if (!isGitRepoPath(repoPath)) throw usageError("repo_path must be a valid Git repository path.");
-  const deployType = args.deploy_type ?? "";
+  let deployType = args.deploy_type ?? "";
   if (!["npm", "artifact", "vercel", ""].includes(deployType)) throw usageError("bad deploy_type.");
   if (db.prepare("SELECT id FROM projects WHERE id = ?").get(id)) {
     throw conflict("A project with this ID already exists.");
   }
   const timestamp = now();
   const visualProtocol = validateVisualProtocol(args.visual_protocol);
-  const environmentType = validateEnvironmentType(args.environment_type);
+  // Surface classification default (room #14, 2026-09-17): the setup
+  // conversation never classified the flashcards sample — environment_type
+  // stayed null and no deploy target was set, so Capture skipped
+  // ("surface unclassified"), Publish had nothing to build, and QA had no
+  // runnable surface (J1/J2 parked). Fill OMITTED fields from the
+  // deterministic repo scan (lib/classify-surface.js); explicit values
+  // always win — including an explicit null environment_type, which still
+  // means "unclassified". An artifact surface needs a deploy target:
+  // classification alone doesn't close the loop, because Publish skips
+  // when deploy_type is empty and QA can only run against the built
+  // artifact. The initial-provenance stamp below then keys off the
+  // defaulted deploy_type, so the sample's first publish diffs only the
+  // task's changes instead of the whole tree.
+  let environmentType = validateEnvironmentType(args.environment_type);
+  let deploySlug = args.deploy_slug ?? null;
+  if (args.environment_type === undefined || args.deploy_type === undefined) {
+    let c = null;
+    try { c = classifySurface(repoPath); } catch { c = null; }
+    // Effective surface: an explicit environment_type always wins; the
+    // classifier only speaks for omitted fields. Deploy defaults follow
+    // the effective surface — an explicit "terminal" (or an explicit
+    // null = "unclassified") never triggers artifact deploy defaults.
+    // The slug is only auto-filled when we auto-set the artifact deploy;
+    // a caller who chose their own deploy_type owns their slug.
+    const effectiveSurface = args.environment_type === undefined ? (c && c.surface) : environmentType;
+    if (args.environment_type === undefined && c && c.surface) environmentType = c.surface;
+    if (effectiveSurface === "artifact" && args.deploy_type === undefined) {
+      deployType = "artifact";
+      if (args.deploy_slug === undefined && c && c.deploy_slug) deploySlug = c.deploy_slug;
+    }
+  }
   const row = {
     id, display_name: displayName, repo_path: repoPath, deploy_type: deployType,
-    deploy_slug: args.deploy_slug ?? null,
+    deploy_slug: deploySlug,
     description: (args.description ?? "").trim().slice(0, 3000),
     simultaneity: args.simultaneity ?? 2,
     quiesced: args.quiesced ? 1 : 0,
@@ -1644,7 +1855,17 @@ commands["create-project"] = (db, args, ctx) => {
       description, simultaneity, quiesced, visual_protocol, environment_type, created_at, updated_at)
      VALUES (@id, @display_name, @repo_path, @deploy_type, @deploy_slug,
       @description, @simultaneity, @quiesced, @visual_protocol, @environment_type, @created_at, @updated_at)`).run(row);
-  const initialProvenance = tryStampInitialProvenance(db, ctx.crewHome, repoPath, deployType);
+  // A deferred backfill (zero/ambiguous matches at the last look) gets one
+  // more evaluation now that the match set changed: a new project whose
+  // repo descends from the legacy commit inherits the attribution instead
+  // of stranding the triple in config forever. When the backfill stamps
+  // this project, the initial stamp below is skipped — the legacy triple
+  // is a real publish record and must not be overwritten by the
+  // creation-time HEAD.
+  const backfillStampedId = retryDeferredBackfill(db);
+  const initialProvenance = backfillStampedId === id
+    ? { stamped: true, reason: "legacy backfill attributed this project; initial stamp skipped" }
+    : tryStampInitialProvenance(db, id, ctx.crewHome, repoPath, deployType);
   return { project: mapProject(row), initial_provenance: initialProvenance };
 };
 
@@ -1788,35 +2009,48 @@ commands["update-config"] = (db, args) => {
   return { ok: true };
 };
 
-commands["set-provenance"] = (db, args) => {
-  if (!/^[0-9a-f]{40}$/.test(args.source_commit ?? "")) throw usageError("source_commit must be 40-char hex.");
-  if (!/^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/.test(args.crew_release ?? "")) {
+// The single provenance writer (room #15 blocker 8). Every stamp flows
+// through here: set-provenance and create-project's initial stamp are thin
+// shells over it. Per-project by design — a crew home with N artifact
+// projects carries N independent publish bases, and stamping one project
+// never touches another's row.
+function stampProvenance(db, { project_id, source_commit, crew_release, published_at, task_id }) {
+  const pid = String(project_id ?? "").trim();
+  if (!pid) throw usageError("project_id is required — pass the project's id (see list-projects).");
+  requireProject(db, pid);
+  if (!PROVENANCE_SOURCE_COMMIT_RE.test(source_commit ?? "")) throw usageError("source_commit must be 40-char hex.");
+  if (!PROVENANCE_CREW_RELEASE_RE.test(crew_release ?? "")) {
     throw usageError("crew_release must be 40-char hex or pkg-<semver>.");
   }
   // task_id is optional; when present it must be 1-80 chars (matches dashboard contract).
-  const taskId = args.task_id ?? null;
-  if (taskId !== null && (typeof taskId !== "string" || taskId.trim().length < 1 || taskId.length > 80)) {
+  const tid = task_id ?? null;
+  if (tid !== null && (typeof tid !== "string" || tid.trim().length < 1 || tid.length > 80)) {
     throw usageError("task_id must be 1-80 chars when provided.");
   }
-  const upsert = db.prepare(
-    "INSERT INTO config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value");
-  upsert.run("provenance.source_commit", args.source_commit);
-  upsert.run("provenance.crew_release", args.crew_release);
-  upsert.run("provenance.published_at", args.published_at ?? now());
-  if (taskId !== null) upsert.run("provenance.task_id", taskId);
-  return { ok: true };
+  db.prepare(
+    `UPDATE projects SET provenance_source_commit = ?, provenance_crew_release = ?,
+     provenance_published_at = ?, provenance_task_id = ?, updated_at = ?
+     WHERE id = ?`
+  ).run(source_commit, crew_release, published_at ?? now(), tid, now(), pid);
+  return { ok: true, project_id: pid };
+}
+
+commands["set-provenance"] = (db, args) => {
+  return stampProvenance(db, args ?? {});
 };
 
-commands["get-provenance"] = (db) => {
-  const rows = db.prepare("SELECT key, value FROM config WHERE key LIKE 'provenance.%'").all();
-  const byKey = Object.fromEntries(rows.map((r) => [r.key, r.value]));
-  const sc = byKey["provenance.source_commit"];
-  const cr = byKey["provenance.crew_release"];
-  const pa = byKey["provenance.published_at"];
-  if (!sc || !cr || !pa) return { provenance: null };
+commands["get-provenance"] = (db, args) => {
+  const pid = String((args ?? {}).project_id ?? "").trim();
+  if (!pid) throw usageError("project_id is required — pass the project's id (see list-projects).");
+  const row = requireProject(db, pid);
+  if (!row.provenance_source_commit || !row.provenance_crew_release || !row.provenance_published_at) {
+    return { provenance: null };
+  }
   return { provenance: {
-    source_commit: sc, crew_release: cr, published_at: pa,
-    task_id: byKey["provenance.task_id"] ?? null,
+    source_commit: row.provenance_source_commit,
+    crew_release: row.provenance_crew_release,
+    published_at: row.provenance_published_at,
+    task_id: row.provenance_task_id ?? null,
   } };
 };
 

package/lib/schema.sql

@@ -34,6 +34,18 @@ CREATE TABLE IF NOT EXISTS projects (
   -- deploy_type is NOT reused for this (it names the deployment target, not
   -- the UX surface a user experiences).
   environment_type TEXT CHECK (environment_type IN ('artifact', 'terminal')),
+  -- Per-project provenance (2026-09-18, room #15 blocker 8): each project
+  -- carries its own publish base. Provenance was crew-home-global
+  -- (config.provenance.*), which broke any multi-project home: the first
+  -- artifact project's stamp was read as the second project's base, parking
+  -- the second task with "not an ancestor". Nullable by design: a project
+  -- with no provenance reads null and its first publish diffs from the
+  -- empty tree. Never fabricated — the one-time backfill in openDb stamps
+  -- only an exactly-one-ancestor match, otherwise records deferred.
+  provenance_source_commit TEXT CHECK (provenance_source_commit IS NULL OR length(provenance_source_commit) = 40),
+  provenance_crew_release TEXT,
+  provenance_published_at TEXT,
+  provenance_task_id TEXT,
   created_at    TEXT NOT NULL,
   updated_at    TEXT NOT NULL
 );

package/lib/test-worktree-backend.sh

@@ -239,6 +239,35 @@ if git -C "$T5" log --name-only --format= | grep -q '^\.worktrees/'; then
 fi
 rm -rf "$T5"
 
+# post-deploy survives the crew's own gitignored non-empty .worktrees/
+# (2026-09-18, room #15 J3): the old `git add -A -- ':!.worktrees/'`
+# exited 1 on git 2.43.0 whenever setup's `.gitignore` entry ignored a
+# non-empty .worktrees/, and set -e killed post-deploy before "DEPLOYED:".
+T6=/tmp/crew-git-postdeploy-gitignore-test
+rm -rf "$T6"
+mkdir -p "$T6"
+git init -q -b main "$T6"
+git -C "$T6" config user.email test@test.t
+git -C "$T6" config user.name test
+echo base > "$T6/f.txt"
+echo ".worktrees/" > "$T6/.gitignore"
+git -C "$T6" add -A
+git -C "$T6" commit -qm base
+export CREW_REPO="$T6"
+export CREW_LIB="$REPO_DIR/lib"
+# Non-empty ignored .worktrees/, exactly the shape of real integrate state
+mkdir -p "$T6/.worktrees/pd2"
+printf 'task_id=pd2\nholder=test\n' > "$T6/.worktrees/pd2/.merge-lock"
+# A genuine user change the post-deploy commit should pick up
+echo userchange > "$T6/user.txt"
+out=$(bash "$LIFECYCLE" post-deploy "pd2") || fail "postdeploy-gitignore-test: post-deploy failed: $out"
+echo "$out" | grep -q '^DEPLOYED: ' || fail "postdeploy-gitignore-test: no DEPLOYED: line: $out"
+git -C "$T6" log --name-only --format= -1 | grep -q '^user\.txt$' || fail "postdeploy-gitignore-test: user change not committed"
+if git -C "$T6" log --name-only --format= | grep -q '^\.worktrees/'; then
+  fail "postdeploy-gitignore-test: .worktrees/ content committed into main"
+fi
+rm -rf "$T6"
+
 rm -rf "$T2" "$T3" "$T4"
 export CREW_REPO="$T"
 rm -rf "$T"

package/lib/verify-publish.js

@@ -23,7 +23,7 @@
 //   node verify-publish.js --crew-home <path> --task-id <uuid>
 //       --commit <sha> --base <sha> --repo-path <path> --slug <slug>
 //       --crew-release <release> --inspection-id <uuid> --result-file <path>
-//       [--build-agent-id <uuid>]
+//       --project-id <project-id> [--build-agent-id <uuid>]
 //
 // --base is the previously-stamped provenance source_commit (or the
 // empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
@@ -66,6 +66,7 @@ const inspectionId = arg("--inspection-id");
 const resultFile = arg("--result-file");
 const crewRelease = arg("--crew-release");
 const buildAgentId = arg("--build-agent-id", false);
+const projectId = arg("--project-id");
 
 if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
 if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
@@ -334,7 +335,7 @@ if (buildAgentId && resultText.includes(buildAgentId)) buildNote = `build-id-cor
 // --- 7. Stamp (only after the machine-checked comparison succeeded) ---------
 let stamp;
 try {
-  stamp = api("set-provenance", { source_commit: commit, crew_release: crewRelease, task_id: taskId });
+  stamp = api("set-provenance", { project_id: projectId, source_commit: commit, crew_release: crewRelease, task_id: taskId });
 } catch (e) {
   terminal("stamp-failed", `set-provenance threw: ${e.message}`);
 }
@@ -342,7 +343,7 @@ if (!stamp || stamp.ok !== true) terminal("stamp-failed", "set-provenance did no
 // Exact read-back: the stamp must match what we intended, or it is fiction.
 let prov;
 try {
-  prov = api("get-provenance", {});
+  prov = api("get-provenance", { project_id: projectId });
 } catch (e) {
   terminal("stamp-failed", `get-provenance threw: ${e.message}`);
 }

package/lib/worktree-lifecycle.sh

@@ -416,9 +416,15 @@ cmd_post_deploy() {
 
   # Commit any changes the artifact builder left behind.
   # The crew's own .worktrees/ dir (merge lock, registry) is crew-owned
-  # state, never user content — exclude it so a stray lock file can never
-  # be committed into main (J1 canary: .merge-lock landed in main via add -A).
-  git add -A -- ':!.worktrees/'
+  # state, never user content — unstage it after the add so a stray lock
+  # file can never be committed into main (J1 canary: .merge-lock landed
+  # in main via add -A). Never use an all-negative pathspec here: on git
+  # 2.43.0 `git add -A -- ':!.worktrees/'` still exits 1 against the
+  # crew's own gitignored .worktrees/ (room #15, J3), and set -e then
+  # kills post-deploy before "DEPLOYED:". A plain add never errors on
+  # ignored paths; the reset covers pre-gitignore-entry repos too.
+  git add -A
+  git reset -q -- .worktrees/ 2>/dev/null || true
   if ! git diff --cached --quiet 2>/dev/null; then
     git commit -m "rebuild: $task_id"
     echo "COMMITTED: artifact builder changes"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -40,11 +40,13 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
      This atomically claims each verification-pending task (1-hour lease, so a second tick cannot double-verify) and reconciles verified-but-still-parked tasks to `in_progress`. It returns `{ to_verify: [...], reconciled: [...] }`. Log both lists. If the scan exits 2 (e.g. the active release cannot be resolved), log the error loudly and continue — do NOT work around it.
-   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish), then run:
+   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish):
+     `node {crewHome}/lib/crew-api.js --crew-home {crewHome} get-provenance --json '{"project_id": "<project_id>"}'`
+     (use the entry's `project_id` verbatim), then run:
      `node {crewHome}/lib/readback-disk.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<deploy_slug>" --task-id <task_id> > /tmp/readback-<task_id>.txt 2> /tmp/readback-<task_id>.err`
      Use the entry's `repo_path` and `deploy_slug` verbatim. If the sensor exits 0, the result file holds the findings block — hand it to the verify step below. If it exits non-zero, do NOT save or use stdout: log `publish: verification-procedural-error <commit> <first line of the .err file>` and leave the task parked — the next tick retries. A sensor failure is procedural (the read could not be performed), never a content verdict. Do NOT judge content yourself, and do NOT stamp provenance.
-   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
-     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
+   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --project-id <project_id> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
+     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with and the entry's `project_id` verbatim. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The verify script's machine-checked comparison is the only certification.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.
@@ -70,13 +72,14 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
    - Dedupe: for each candidate, check `get-events --json '{"task_id": "<id>", "limit": 50}'` for an event whose message starts with `evidence: delivered`. Skip tasks already delivered.
    - For each remaining task:
      - Read its QA verdict: from get-state's `sessions`, the completed session for this task whose notes mention Hazel/QA. Quote one verdict line (pass/fail and the one-line reason).
-     - Find the screenshots (platform audit harness): `AUDIT=$(readlink ~/workspace/ts-spaces/<project>/audits/latest)` where `<project>` is the task's project field. Confirm `$AUDIT/screenshot.png` and `$AUDIT/screenshot-mobile.png` exist AND are newer than the task's `created_at` (compare with `stat -c %Y`). If the audit dir predates the task, the capture is stale from an earlier run — say so and do NOT attach it. Never attach screenshots from a different run.
-     - Write the transition BEFORE the attachments (2026-09-14 — Eric: screenshots arriving out of context need a problem→solution handoff). Do not hand-write it: run the deterministic composer and paste its stdout verbatim, then the two attachment lines:
+     - Find the screenshots (platform audit harness): `AUDIT=$(readlink ~/workspace/ts-spaces/<project>/audits/latest)` where `<project>` is the task's project field. Confirm `$AUDIT/screenshot.png` and `$AUDIT/screenshot-mobile.png` exist AND are newer than the task's `created_at` (compare with `stat -c %Y`). Set `CAPTURES_OK=1` only when both PNGs exist and are fresh; otherwise `CAPTURES_OK=0`. If the audit dir predates the task, the capture is stale from an earlier run — say so and do NOT attach it. Never attach screenshots from a different run. Terminal-surface tasks never have harness captures — expect CAPTURES_OK=0 for them.
+     - Write the transition BEFORE the attachments (2026-09-14 — Eric: screenshots arriving out of context need a problem→solution handoff). Do not hand-write it: run the deterministic composer and paste its stdout verbatim:
        `node {crewHome}/lib/compose-evidence-caption.js --crew-home {crewHome} --task-id "<id>" --audit-dir "<resolved_dir>"`
-       The composer emits: the out-of-context acknowledgment, the task title, Problem: (from the task description), Shipped: (the merge commit's subject + short-sha, or an honest "provenance not yet stamped"), Evidence: (the audit dir + QA verdict, or "No QA verdict recorded"), and the visual-protocol-unavailable honest label when the run recorded one. If the composer exits non-zero, say so in one line and attach nothing for that task.
-     - Attach both to your report, each on its own plain line, using the RESOLVED dir name (not the `latest` symlink) so the evidence is pinned to this run:
+       The composer emits: the out-of-context acknowledgment, the task title, Problem: (from the task description), Shipped: (the merge commit's subject + short-sha, or an honest "provenance not yet stamped"), Evidence: (the audit dir + QA verdict when captures exist, or the honest no-captures line — 2026-09-17: the composer verifies the captures exist before claiming them, so a terminal-surface task with no audit dir gets the honest line, never "desktop + mobile captures below"), and the visual-protocol-unavailable honest label when the run recorded one. If the composer exits non-zero, say so in one line and attach nothing for that task.
+     - Attach the two screenshot lines ONLY when CAPTURES_OK=1, each on its own plain line, using the RESOLVED dir name (not the `latest` symlink) so the evidence is pinned to this run:
        `![desktop](sandbox://workspace/ts-spaces/<project>/audits/<resolved_dir>/screenshot.png)`
        `![mobile](sandbox://workspace/ts-spaces/<project>/audits/<resolved_dir>/screenshot-mobile.png)`
+       When CAPTURES_OK=0, attach nothing — the composer's caption already says so honestly.
      - Log the delivery so the next tick skips it: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} log-event --json '{"task_id": "<id>", "type": "note", "message": "evidence: delivered <id> — screenshots attached to tick report"}'`.
    - If a done task has no fresh screenshots, say so in one line — never claim evidence you don't have.