muse-crew 0.11.1 → 0.13.0

package/workflows/standard.js

@@ -89,9 +89,20 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
+const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The seven basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
+// 2026-09-17): the diff is computed by this script, never ferried as an
+// agent JSON string. Pinned like the other publish-critical modules so a
+// mid-run release swap cannot change it under the workflow.
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -267,7 +278,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the six pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -275,7 +286,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -456,37 +467,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish diff transport: parse a unified diff into per-file {path, added,
-// removed} line lists. Pure function — no I/O, no clock. Used by Publish to
-// verify the artifact builder applied the carried change (canary run 4,
-// 2026-09-11: the builder's source tree was stale and disconnected from the
-// crew's repo; "rebuild from current source" rebuilt stale code and the
-// workflow stamped the new commit hash on it — provenance fiction).
-function parseUnifiedDiff(diffText) {
-  var files = [];
-  var current = null;
-  var lines = (diffText || "").split("\n");
-  for (var i = 0; i < lines.length; i++) {
-    var line = lines[i];
-    var m = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
-    if (m) {
-      current = { path: m[2], added: [], removed: [] };
-      files.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (/^--- /.test(line) || /^\+\+\+ /.test(line)) continue;
-    if (/^@@ /.test(line)) continue;
-    if (line.charAt(0) === "+") {
-      current.added.push(line.slice(1));
-    } else if (line.charAt(0) === "-") {
-      current.removed.push(line.slice(1));
-    }
-  }
-  return files;
-}
-
-
 // Publish read-back request (agent path currently unavailable): the
 // verbatim_request the parent protocol (docs/publish-verification.md) would
 // hand to an independent read-back tool after the artifact build lands.
@@ -1454,7 +1434,7 @@ while (i < STEPS.length) {
         // first publish (no provenance stamped yet).
         var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
         var provResult = await agent(
-          crewCmd("get-provenance", {}) + "\n" +
+          crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "Return JSON { \"provenance\": <the CLI's provenance object, or null when nothing is stamped> } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-provenance-base-" + taskId, totalReworkCount), label: "Reading stamped publish base",
             schema: { type: "object", properties: { provenance: { type: ["object", "null"] } }, required: ["provenance"] } }
@@ -1467,59 +1447,77 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
-        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
-        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
-        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
-        // to execute the conditional (clean-room 2026-09-16: the agent ran
-        // merge-base on the empty tree directly and parked).
-        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
-          ? "ANCESTOR=yes && "
-          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
+        // Publish diff transport (room #14, 2026-09-17): the diff used to be
+        // ferried as a JSON string field in the agent's response — the agent
+        // produced a valid 700-line diff on disk but the JSON ferry dropped
+        // it, and the parse saw zero files ("Publish diff parsed to zero
+        // files"). The diff now travels git -> file -> deterministic script
+        // summary; the LLM never carries diff bytes. The agent is pure hands:
+        // it runs exactly one command (the PINNED compute-publish-diff.js —
+        // a mid-run release swap cannot change it under the workflow) and
+        // returns the small JSON summary verbatim. All fail-closed parks
+        // below are unchanged in meaning.
+        var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + ".diff";
         var diffResult = await agent(
-          "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          ancestorShell + 
-          "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
-          "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
-          "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
+          "Run exactly one command and nothing else:\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, totalReworkCount), label: "Computing publish diff from stamped base",
-            schema: { type: "object", properties: { commit: { type: "string" }, base: { type: "string" }, ancestor: { type: "string" }, diff: { type: "string" }, files: { type: "string" } }, required: ["commit", "base", "ancestor", "diff"] } }
+            schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
         );
-        if ((diffResult.ancestor || "").trim() !== "yes") {
-          return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + (diffResult.commit || "").trim().slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        var diffSummary = null;
+        try {
+          diffSummary = JSON.parse((diffResult.output || "").trim());
+        } catch (e) {
+          return await parkTask("Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+        }
+        if (!diffSummary || diffSummary.ok !== true) {
+          if (diffSummary && diffSummary.error === "not-ancestor") {
+            return await parkTask("Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+          }
+          return await parkTask("Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
         }
-        if ((diffResult.base || "").trim() !== publishBase) {
-          return await parkTask("Publish diff base mismatch: agent reported '" + (diffResult.base || "").trim().slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+        if (diffSummary.base !== publishBase) {
+          return await parkTask("Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
         }
-        var mergeCommitForPublish = (diffResult.commit || "").trim();
-        var mergeDiff = diffResult.diff || "";
-        if (!mergeDiff.trim()) {
+        var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+        var publishDiffSha256 = String(diffSummary.sha256 || "");
+        if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
-        if (/^Binary files /m.test(mergeDiff)) {
-          return await parkTask("Publish diff contains binary files — the text diff transport cannot carry them. Human attention needed.");
+        if (diffSummary.has_binary) {
+          return await parkTask("Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
         }
-        if (/^rename from /m.test(mergeDiff)) {
+        if (diffSummary.has_rename) {
           return await parkTask("Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
         }
-        var expectedChanges = parseUnifiedDiff(mergeDiff);
         // Budget counts CHANGED lines (added + removed), not raw unified-diff
         // output lines: context lines and file headers inflated the old
         // split("\n").length count ~2x, parking a 95-line change against a
-        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13).
-        var mergeDiffChangedLines = expectedChanges.reduce(function (n, f) { return n + f.added.length + f.removed.length; }, 0);
+        // 200-line budget (Gate 1 Journey 3 attempt 3, 2026-09-13). The count
+        // now comes from the deterministic script summary, never from the LLM.
+        var mergeDiffChangedLines = diffSummary.changed_lines || 0;
         if (mergeDiffChangedLines > 200) {
           return await parkTask("Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
         }
-        if (expectedChanges.length === 0) {
+        if (!diffSummary.file_count) {
           return await parkTask("Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
         }
+        // The trigger agent reads the diff from the checksummed file — the
+        // workflow never holds diff bytes (room #14, 2026-09-17). The file
+        // is small by construction: the 200-line budget above gates the
+        // trigger. The sha256 check is the agent's only verification step;
+        // a mismatch stops the trigger before any artifact_edit call.
         var rebuildPrompt =
           ARTIFACT_LOAD_PREAMBLE +
-          "Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
+          "The change to apply is the unified diff in the file \"" + publishDiffFile + "\" (sha256 " + publishDiffSha256 + ").\n" +
+          "1. Verify the file: run sha256sum on it. If the printed hash is not exactly " + publishDiffSha256 + ", STOP and end your turn — do not call artifact_edit.\n" +
+          "2. Read the file's full content.\n" +
+          "3. Call artifact_edit with slug \"" + PUBLISH_SLUG + "\" and verbatim_request:\n" +
           "'Apply the following change to your source tree, then rebuild and deploy.\n" +
           "\n" +
           "UNIFIED DIFF (relative to your source tree):\n" +
-          "```diff\n" + mergeDiff + "\n```\n" +
+          "```diff\n<the full content of the verified file, pasted verbatim>\n```\n" +
           "\n" +
           "Rules:\n" +
           "- For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).\n" +
@@ -2233,7 +2231,7 @@ while (i < STEPS.length) {
         "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
         "Use the returned tasks, sessions, and events to check the task's data-level effects.\n" +
         "DOCS GATE: If the change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), verify the public docs describe it. If public docs are missing or stale for a public-affecting change, report 'public docs missing/stale for [the change]', then end your report with exactly this line: VERDICT: FAIL. QA always fails when public-affecting changes lack public docs. Guide/tutorial gaps are lower priority — file a follow-up task for those instead of failing.\n\n" +
-        "PROVENANCE CHECK: Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+        "PROVENANCE CHECK: Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
         "If provenance is null, report 'provenance missing — publish did not stamp source/crew release', then end your report with exactly this line: VERDICT: FAIL.\n" +
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD — call this LIVE_HEAD.\n" +
         "Run: test -d " + crewHome + "/releases/<provenance.crew_release> (substitute the real stamped hash; do not run the literal placeholder). If the directory does not exist, FAIL: { \"passed\": false, \"summary\": \"provenance mismatch: crew_release [value from get-provenance] not found in release registry\" }.\n" +
@@ -2710,11 +2708,11 @@ while (i < STEPS.length) {
       // dashboard QA source check).
       try {
         var provRefresh = await agent(
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
           "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
           "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
-          "Then run in shell:\n" + crewCmd("set-provenance", { source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
+          "Then run in shell:\n" + crewCmd("set-provenance", { project_id: LAUNCH_PROJECT_ID, source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
           "(substitute the real existing source_commit, REL, and TS for the placeholders). " +
           "Return JSON { \"refreshed\": <true if the set-provenance stdout contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
           { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",

package/workflows/upgrade.js

@@ -157,9 +157,14 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -190,7 +195,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }