muse-crew 0.12.0 → 0.13.0

package/API.md

@@ -474,18 +474,49 @@ Set a global configuration value.
 
 ### `setprovenance`
 
-Stamp publication provenance. Called by the crew Publish phase after rebuilding the artifact, and after installing/activating a crew release (npm path): in the release case Publish refreshes `crew_release` to the live release identity while preserving the existing `source_commit`.
+Stamp publication provenance. Provenance is per-project (2026-09-18): each
+project row carries its own publish base (`provenance_source_commit`,
+`provenance_crew_release`, `provenance_published_at`, `provenance_task_id`);
+a crew home with N artifact projects carries N independent bases. There are
+two stamp call paths, and they are different operations on the same row:
+
+- **Full stamp** — called by the parent's publish verification (`lib/verify-publish.js`)
+  after independently verifying the rebuilt artifact: `source_commit` is the
+  verified build commit, `crew_release` the active release at publish time.
+- **Refresh** — called by the release installer (`lib/advance-publish-base.js`)
+  after installing/activating a crew release: `crew_release` is refreshed to
+  the live release identity while preserving the existing `source_commit`.
+  A base-pointer move is not a publish.
+
+Both paths flow through the single writer in `lib/crew-api.js`; an unknown
+`project_id` fails closed (exit 3), and omitting `project_id` is a usage
+error (exit 2) — there is no silent global fallback.
 
 | Field | Type | Required | Notes |
 |-------|------|----------|-------|
+| `project_id` | string | yes | The project whose publish base is stamped |
 | `source_commit` | 40-char hex | yes | Repo commit the artifact was built from |
-| `crew_release` | 40-char hex | yes | Active crew release (`$CREW_HOME/current`) at publish time |
-| `published_at` | ISO 8601 datetime (UTC) | yes | |
+| `crew_release` | 40-char hex, or `pkg-<semver>` | yes | Active crew release (`$CREW_HOME/current`) at stamp time |
+| `published_at` | ISO 8601 datetime (UTC) | yes | Defaults to now when omitted |
 | `task_id` | string | no | Publishing task, for traceability |
 
+A one-time migration attributes a pre-per-project legacy `config.provenance.*`
+triple to a project row only when its `source_commit` is an ancestor of
+exactly one project's repo HEAD (verified with git); zero or ambiguous
+matches are recorded as `deferred:<reason>` and never attributed. A triple
+that matches exactly one project but violates the writer's shape rules
+(e.g. a hand-written abbreviated sha, which git resolves for the ancestor
+check but which fails the 40-char storage rule) is recorded as
+`deferred:stamp-failed:<reason>` — the migration never throws, so a bad
+triple can never brick the home. A `deferred:*` watermark is re-evaluated
+when a project is created (the only event that changes the match set), so
+a triple that predates the home's first project is attributed once a
+descendant project exists. The legacy keys are inert dead storage after a
+successful migration — new code never reads them.
+
 ### `getprovenance`
 
-Read the last publication provenance. Returns `{ "provenance": { "source_commit", "crew_release", "published_at", "task_id" } }`, or `{ "provenance": null }` when nothing has been published yet. `task_id` is the publishing task, for traceability — present when `setprovenance` was called with one, absent otherwise.
+Read a project's publication provenance. Returns `{ "provenance": { "source_commit", "crew_release", "published_at", "task_id" } }`, or `{ "provenance": null }` when nothing has been published yet. A project that was never stamped reads `null` — another project's stamp is never visible here. `task_id` is the publishing task, for traceability — present when `setprovenance` was called with one, absent otherwise. `project_id` is required (exit 2 when omitted); an unknown `project_id` fails closed (exit 3).
 
 ---
 

package/docs/publish-verification.md

@@ -223,7 +223,9 @@ For a task parked with `publish: verification-requested <commit>`:
    slug (the project's publish target).
 2. **Expected change.** The publish delta is `git diff <base> <commit>`
    in `repo_path`, where `<base>` is the previously-stamped provenance
-   `source_commit` (read it via `get-provenance`; use the empty-tree sha
+   `source_commit` for this project (read it via
+   `get-provenance --json '{"project_id":"<id>"}'` — provenance is
+   per-project; without `project_id` the call exits 2; use the empty-tree sha
    `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when no provenance is
    stamped yet — a first publish). Never use `commit^1` as the base and
    never take the expected change from the builder's report: push-time
@@ -293,9 +295,15 @@ For a task parked with `publish: verification-requested <commit>`:
      (the crew-owned store). Do NOT use the artifact's `setprovenance`
      action — it writes a different, non-authoritative store that QA never
      reads, so the stamp would be invisible to every gate:
-     `set-provenance --json '{"source_commit":"<commit>","crew_release":"<release>","task_id":"<task>"}'`
+     `set-provenance --json '{"project_id":"<id>","source_commit":"<commit>","crew_release":"<release>","task_id":"<task>"}'`
      (crew_release is the basename of the active release, e.g.
-     `pkg-0.7.10`). Then read the stamp back with `get-provenance`
+     `pkg-0.7.10`). This is the full publish-verification stamp — it
+     records a verified publish. Do not confuse it with the
+     provenance *refresh* (re-pointing `crew_release` at the active
+     release after a crew upgrade without a new publish), which also goes
+     through `set-provenance` but keeps the existing `source_commit`.
+     Then read the stamp back with
+     `get-provenance --json '{"project_id":"<id>"}'`
      and confirm source_commit, crew_release, and task_id match exactly
      what was sent — a stamp that cannot be read back is not a stamp. Only
      then log the task note event

package/lib/AGENTS.md

@@ -3,18 +3,18 @@
 Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, and the release system.
 
 - `build-registry.js` — deterministic extractor that generates `workflows/registry.json` (workflow step registry) from the workflow files' `meta` blocks at release time; invoked by `crew-release.sh` deploy
-- `crew-api.js` — the crew-owned task-service API (dependency inversion, 2026-09-11): a zero-dependency Node CLI implementing the API.md contract against `$CREW_HOME/crew-state.db` (schema in `schema.sql`). Workflows call it through their agents' shell; the dashboard delegates to it. All state-machine invariants live as CHECK constraints in the schema, never in client prose. Includes the `record-phase` composite (session + event in one transaction) and a one-time `migrate` import from a dashboard app.db.
+- `crew-api.js` — the crew-owned task-service API (dependency inversion, 2026-09-11): a zero-dependency Node CLI implementing the API.md contract against `$CREW_HOME/crew-state.db` (schema in `schema.sql`). Workflows call it through their agents' shell; the dashboard delegates to it. All state-machine invariants live as CHECK constraints in the schema, never in client prose. Includes the `record-phase` composite (session + event in one transaction) and a one-time `migrate` import from a dashboard app.db. Active-release resolution is split in two (room #15): `resolveActiveReleaseName` (symlink-only — writers like the initial-provenance stamp record the active release without proving they are it) and `resolveActiveRelease` (symlink + self-path cross-check — verifiers like `scan-verification-pending` refuse to stamp claims when the running code isn't the active release's own). Provenance is per-project (2026-09-18, room #15 blocker 8): nullable `provenance_*` columns on the projects row, a single `stampProvenance()` writer, `set-provenance`/`get-provenance` require `project_id` (no silent global fallback), and a watermarked openDb backfill that attributes the legacy `config.provenance.*` triple to exactly-one ancestor match — never fabricated, otherwise deferred.
 - `schema.sql` — the crew-owned state schema: projects, tasks, poll_state, config, agent_sessions, events. Vocabularies enforced by CHECK constraints; `rejected` is a valid event type (the 2026-09-11 crash was a stored session whose event was rejected). Column names match the historical dashboard tables for a verbatim migration.
 - `crew-release.sh` — immutable release manager: deploy, rollback, prune
 - `merge-lock.sh` — serialized merge lock for concurrent agents: time-based holder lease (bug 2fc8f52f — an unexpired lease is held regardless of process liveness; only an expired lease may be broken). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset). Lock file is key=value: task_id, opaque holder identity (never a PID), acquired_at epoch, lease_seconds (default 600, override via MERGE_LOCK_LEASE_SECONDS). acquire/refresh/release/status/force-release; holder-only refresh and release; every op appends to $CREW_HOME/.merge-lock.log
-- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/terminal-cleanup/refresh-lock/lock-status over git worktrees (`integrate` reconciles `origin/main` under the merge lock after the task merge — canary `a6d8b0c8`, 2026-09-11 — so the push is a fast-forward; fail-soft with no remote, fail closed on conflict) (`.worktrees/<id>`, branch `task/<id>`). Branch resolution order: the crew registry (`<repo>/.worktrees/.registry/<id>`), then the canonical `task/<full-id>` ref, then a `task/<id-prefix>` ref matched by strict prefix enumeration (task 4e1a1bba — a Build agent may create the branch with raw git from an abbreviated id, bypassing prepare; prefix names are tolerated, never created; ambiguous prefixes fail closed). `resolve-branch` prints the resolved branch for agent-side one-liners. Nothing reconstructs the branch name — every command resolves it. Prepare fails closed on dirty `main`; cleanup is forgiving. `terminal-cleanup` is the run's last act at every park/fail boundary (called from `parkTask` in standard/bugfix/chore): releases the merge lock unconditionally and reclaims the worktree+branch only when the task branch is fully merged into main — unmerged work is preserved for the human by design, and a dirty worktree is reported, never force-removed. `post-deploy` reports worktree removal honestly (a lying "removed" echo hid real leftovers — canary run 9, 2026-09-12). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset); `CREW_REPO` is exported so internal merge-lock.sh calls inherit the repo being worked on; `LIB_DIR` defaults to `$CREW_HOME/lib` (`CREW_LIB` override). `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
+- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/terminal-cleanup/refresh-lock/lock-status over git worktrees (`integrate` reconciles `origin/main` under the merge lock after the task merge — canary `a6d8b0c8`, 2026-09-11 — so the push is a fast-forward; fail-soft with no remote, fail closed on conflict) (`.worktrees/<id>`, branch `task/<id>`). Branch resolution order: the crew registry (`<repo>/.worktrees/.registry/<id>`), then the canonical `task/<full-id>` ref, then a `task/<id-prefix>` ref matched by strict prefix enumeration (task 4e1a1bba — a Build agent may create the branch with raw git from an abbreviated id, bypassing prepare; prefix names are tolerated, never created; ambiguous prefixes fail closed). `resolve-branch` prints the resolved branch for agent-side one-liners. Nothing reconstructs the branch name — every command resolves it. Prepare fails closed on dirty `main`; cleanup is forgiving. `terminal-cleanup` is the run's last act at every park/fail boundary (called from `parkTask` in standard/bugfix/chore): releases the merge lock unconditionally and reclaims the worktree+branch only when the task branch is fully merged into main — unmerged work is preserved for the human by design, and a dirty worktree is reported, never force-removed. `post-deploy` reports worktree removal honestly (a lying "removed" echo hid real leftovers — canary run 9, 2026-09-12). Requires both `CREW_REPO` and `CREW_HOME` (fail closed: BLOCKED, exit 2 when either is unset); `CREW_REPO` is exported so internal merge-lock.sh calls inherit the repo being worked on; `LIB_DIR` defaults to `$CREW_HOME/lib` (`CREW_LIB` override). `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure. post-deploy's `.worktrees/` guard is add-then-reset, never an all-negative pathspec: `git add -A -- ':!.worktrees/'` still exits 1 on git 2.43.0 against the crew's own gitignored non-empty `.worktrees/` (room #15 J3), killing post-deploy under `set -e` — a plain `add -A` never errors on ignored paths and the follow-up `git reset -q -- .worktrees/` keeps stray lock files out of main even on pre-gitignore-entry repos.
 - `test-worktree-backend.sh` — regression tests for the lifecycle script (validate, prepare/reuse, inspect, status, cleanup, idempotent cleanup, dirty-main preflight, integrate remote-reconcile with fixture sensitivity + no-remote fail-soft) on scratch repos
 - `test-version-write.sh` — regression tests for the escape-preserving step-8 version write in publish-npm.sh (fixture: current package.json with the \\u2014 escape; extracts the shipped block by anchor)
 - `test-publish-verify.sh` — regression tests for the retry-tolerant step-12 verification in publish-npm.sh (canary 5a027278): extracts the shipped block by anchor and runs it against a fake npm whose read replica lags (non-zero exits, then the old version, then the target) — requires convergence on success, fail-closed `PUBLISH_FAILED=verify` on exhaustion, and `--prefer-online` on every read
 - `test-publish-skip.sh` — regression tests for the no-lock graceful publish skip (park 2026-09-11): `lock-status` returns exact `UNLOCKED`/`LOCKED by <holder> since <ts> (pid <pid>)`; a fake empty-diff integrate takes the MERGED_EMPTY branch and never takes the lock; the shipped step-5 block from publish-npm.sh (extracted by anchor) skips gracefully on UNLOCKED (no park, no `PUBLISH_COMPLETE`), follows the refresh path when a lock is held, and fails closed on a `lock-status` query failure; the gate sits inside the ALREADY_PUBLISHED=0 branch and mutation steps are gated on NO_LOCK_HELD=0
 - `publish-npm.sh` — deterministic npm publish: lock refresh, release install, version write/commit, pack, registry publish, verify, push, post-deploy. Takes TARGET_VERSION as input; idempotent on retry/resume.
 - `compose-evidence.py` — deterministic visual-evidence compositor (Pillow): pairs identical PNG stems from baseline/ and postchange/ dirs, emits `<stem>-sidebyside.png` and amplified-difference `<stem>-overlay.png` into composites/, prints `PAIR`/`SKIP` manifests. Byte-deterministic; nonzero exit on errors.
-- `compose-evidence-caption.js` — deterministic QA-evidence caption composer (2026-09-14): given `--crew-home`, `--task-id`, and the resolved `--audit-dir` name, extracts the task title/description, the QA verdict, the `publish: verified` commit (or the global provenance record when it belongs to this task), and the merge commit's subject line from the project repo — and prints the out-of-context transition Eric asked for (problem → solution → evidence handoff) to stdout. The caller appends the desktop/mobile attachment lines after this caption. Verdict source (2026-09-16): Hazel's `task-evidence/<taskId>/postchange/verdict.json` is authoritative, then the last line of the append-only `verdicts.jsonl` ledger, then the newest legacy `visual_verdict:` note (the parent visual-verdict protocol was retired 2026-09-15). Honest labels: "provenance not yet stamped" when no commit is known, "no QA verdict recorded" when none exists, and the visual-protocol-unavailable note only when no verdict evidence exists at all, the newest `baseline:` note is `baseline: none`, AND captures exist (a `baseline: none` note means no baseline captures to compare against — it never overrules a real QA verdict; the note's premise is the post-deploy capture, so without captures it would fabricate evidence again). Capture guard (2026-09-17, room #14): the composer resolves the audit dir itself (`<home>/workspace/ts-spaces/<deploy_slug>/audits/<auditDir>/`, the same root crew-api.js and readback-disk.js resolve) and verifies `screenshot.png` + `screenshot-mobile.png` are files before claiming "desktop + mobile captures below" — a bare `--audit-dir` name is never trusted. Missing deploy_slug, missing dir, or missing PNGs gets the honest no-captures opener and Evidence line (terminal surfaces named explicitly: "terminal surface — QA judges the CLI, not pixels"); the caller only appends attachment lines when its own freshness check passes. "Latest" is by event timestamp, sorted explicitly. Exits non-zero on missing input.
+- `compose-evidence-caption.js` — deterministic QA-evidence caption composer (2026-09-14): given `--crew-home`, `--task-id`, and the resolved `--audit-dir` name, extracts the task title/description, the QA verdict, the `publish: verified` commit (or the task's project-scoped provenance record when it belongs to this task), and the merge commit's subject line from the project repo — and prints the out-of-context transition Eric asked for (problem → solution → evidence handoff) to stdout. The caller appends the desktop/mobile attachment lines after this caption. Verdict source (2026-09-16): Hazel's `task-evidence/<taskId>/postchange/verdict.json` is authoritative, then the last line of the append-only `verdicts.jsonl` ledger, then the newest legacy `visual_verdict:` note (the parent visual-verdict protocol was retired 2026-09-15). Honest labels: "provenance not yet stamped" when no commit is known, "no QA verdict recorded" when none exists, and the visual-protocol-unavailable note only when no verdict evidence exists at all, the newest `baseline:` note is `baseline: none`, AND captures exist (a `baseline: none` note means no baseline captures to compare against — it never overrules a real QA verdict; the note's premise is the post-deploy capture, so without captures it would fabricate evidence again). Capture guard (2026-09-17, room #14): the composer resolves the audit dir itself (`<home>/workspace/ts-spaces/<deploy_slug>/audits/<auditDir>/`, the same root crew-api.js and readback-disk.js resolve) and verifies `screenshot.png` + `screenshot-mobile.png` are files before claiming "desktop + mobile captures below" — a bare `--audit-dir` name is never trusted. Missing deploy_slug, missing dir, or missing PNGs gets the honest no-captures opener and Evidence line (terminal surfaces named explicitly: "terminal surface — QA judges the CLI, not pixels"); the caller only appends attachment lines when its own freshness check passes. "Latest" is by event timestamp, sorted explicitly. Exits non-zero on missing input.
 - `edit-image.py` — deterministic pixel-level evidence editing (2026-09-15, Pillow): `crop --region x,y,w,h` (pixel-exact, rejects out-of-bounds), `zoom --factor <f> [--center x,y]` (nearest-neighbor, returns to source frame size), `label --text <caption>` (caption bar), `nup --cols <n> --in <a.png> --in <b.png> [--labels "a|b"]` (side-by-side grid). Byte-deterministic PNG output; no network, no time, no randomness. Derivatives supplement raw frames — the source frame stays archived.
 - `render-html.js` — deterministic HTML evidence composition (2026-09-15, headless Chromium): renders a local HTML layout to PNG (fixed viewport width, device scale 1, full-page screenshot). Hermetic: remote HTTP(S) assets are blocked and fail the render loudly; relative image paths resolve against the HTML file; local/system fonts only. Exit 3 reports NOT POSSIBLE when Chromium is unavailable. The composition layer above edit-image.py's pixel layer.
 - `see-act.js` — single-step browser driver for experiential QA (2026-09-14): one browser action per invocation (`aria`, `shot`, `click`, `scroll`, `type`), one JSON line on stdout, exit 0/2/3 (3 = NOT POSSIBLE: missing playwright-core or Chromium). Spawns its own loopback forward proxy on an ephemeral port (Chromium blocks direct loopback). The QA work agent closes the OODA loop: run a step, read the screenshot/aria, decide the next. Determinism: no wall-clock reads, no randomness. `SEE_ACT_ARCHIVE_DIR=<phase-dir>` (2026-09-14): every screenshot is archived automatically as `001-shot-desktop.png`, `002-click-mobile.png`, ... (counter in `<dir>/.seq`); `--out` becomes optional; JSON carries `screenshot` + `archived`; explicit `--out` + archive copies into the archive; unusable dir is NOT POSSIBLE exit 3.
@@ -34,4 +34,4 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `sample-project.js` — optional sample-project setup (2026-09-17): extracts `seed/sample-project.tar.gz` (stripping the `sample-project/` prefix), `git init`, initial commit. No remote required. Registration happens via the existing `create-project` action — no sample-specific endpoint. CLI: `--tarball <path> --dest <dir> --name <project-name>`.
 - `compute-publish-diff.js` — deterministic publish-diff computer (2026-09-18, room #14): replaces the agent-ferried `git diff` JSON string field (the JSON ferry dropped a valid 700-line diff — "Publish diff parsed to zero files"). Runs `git diff <base> <HEAD>` via argv (no shell), writes the raw diff bytes to `--out`, and prints only a small JSON summary (`commit`, `base`, `diff_file`, `sha256`, `bytes`, `file_count`, `changed_lines` = added+removed, never raw diff output lines, `files`, `has_binary`, `has_rename`). Empty-tree base is the first-publish ancestor (hardcoded, never `merge-base` on the empty tree); non-ancestor is semantic JSON (`ok:false, error:"not-ancestor"`, exit 0); usage errors exit 2 with nothing on stdout. Pinned per-run alongside the other lifecycle files (`COMPUTE_DIFF` in `PIN_BASENAMES`) so a mid-run release swap cannot change it under the workflow.
 - `classify-surface.js` — deterministic project-surface classifier (2026-09-18, room #14 defect): a pure, never-throwing scan of the registered repo — `space.json` present → `artifact` surface (deploy_slug suggestion = `space.json`'s valid slug, verbatim — presence alone still means "web app"), `package.json` with a non-empty `bin` → `terminal` surface, otherwise null (unclassified); artifact wins conflicts (the deployed artifact is what users see, same rule as workflows/standard.js). CLI `--repo-path` prints one JSON object (`{surface, deploy_slug, signals}`), always exit 0 (classification failure is a null result, exit 2 only for usage). `create-project` fills omitted `environment_type`/`deploy_type`/`deploy_slug` from the classification; explicit values (including explicit null) always win and drive the effective surface.
-- `advance-publish-base.js` — publish-base advance past the setup scaffold (2026-09-18, room #14): `create-project` stamps provenance at the pre-scaffold repo HEAD, then crew-init commits `.orchestration/` (+ the consented `.gitignore`) on top — the first task's publish diff would carry the whole scaffold (517 insertions) and blow the 200-line diff-transport budget. The script moves `source_commit` to the scaffold commit only when `--project-created` (the stamp is this init's, never a real publish's), the scaffold commit's parent is exactly the stamped base, and the scaffold touches only crew-owned paths (`.orchestration/`, `.gitignore`); no provenance + root scaffold commit stamps fresh. Every other case skips without touching provenance; `published_at` is preserved on advance. Called from crew-init.js (best-effort, non-fatal). CLI: `--crew-home <path> --repo <path> --scaffold-sha <sha> [--project-created]`.
+- `advance-publish-base.js` — publish-base advance past the setup scaffold (2026-09-18, room #14): `create-project` stamps provenance at the pre-scaffold repo HEAD, then crew-init commits `.orchestration/` (+ the consented `.gitignore`) on top — the first task's publish diff would carry the whole scaffold (517 insertions) and blow the 200-line diff-transport budget. The script moves `source_commit` to the scaffold commit only when `--project-created` (the stamp is this init's, never a real publish's), the scaffold commit's parent is exactly the stamped base, and the scaffold touches only crew-owned paths (`.orchestration/`, `.gitignore`); no provenance + root scaffold commit stamps fresh. Every other case skips without touching provenance; `published_at` is preserved on advance. Called from crew-init.js (best-effort, non-fatal). Provenance is per-project (room #15 blocker 8): `--project-id` is required and every read/stamp is project-scoped. CLI: `--crew-home <path> --repo <path> --scaffold-sha <sha> --project-id <id> [--project-created]`.

package/lib/advance-publish-base.js

@@ -39,7 +39,7 @@ const RELEASE_RE = /^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/;
 
 function usage() {
   console.error(
-    "Usage: node lib/advance-publish-base.js --crew-home <path> --repo <path> --scaffold-sha <sha> --project-created"
+    "Usage: node lib/advance-publish-base.js --crew-home <path> --repo <path> --scaffold-sha <sha> --project-id <id> --project-created"
   );
 }
 
@@ -50,6 +50,7 @@ function parseArgv(argv) {
     if (a === "--crew-home") out.crewHome = argv[++i];
     else if (a === "--repo") out.repo = argv[++i];
     else if (a === "--scaffold-sha") out.scaffoldSha = argv[++i];
+    else if (a === "--project-id") out.projectId = argv[++i];
     else if (a === "--project-created") out.projectCreated = true;
     else {
       console.error("unknown argument: " + a);
@@ -94,10 +95,10 @@ function skip(reason) {
 }
 
 function main() {
-  const { crewHome, repo, scaffoldSha, projectCreated } = parseArgv(
+  const { crewHome, repo, scaffoldSha, projectId, projectCreated } = parseArgv(
     process.argv.slice(2)
   );
-  if (!crewHome || !repo || !scaffoldSha) {
+  if (!crewHome || !repo || !scaffoldSha || !projectId) {
     usage();
     process.exit(2);
   }
@@ -112,7 +113,7 @@ function main() {
 
   let provenance;
   try {
-    provenance = crewApi(crewHome, "get-provenance").provenance;
+    provenance = crewApi(crewHome, "get-provenance", JSON.stringify({ project_id: projectId })).provenance;
   } catch (e) {
     console.error("get-provenance failed: " + (e.message || e));
     process.exit(1);
@@ -167,10 +168,17 @@ function main() {
       skip("no provenance stamped and the active release name is not a valid crew_release (" + crewRelease + ")");
       return;
     }
-    const stamped = crewApi(crewHome, "set-provenance", JSON.stringify({
-      source_commit: scaffoldSha,
-      crew_release: crewRelease,
-    }));
+    let stamped;
+    try {
+      stamped = crewApi(crewHome, "set-provenance", JSON.stringify({
+        project_id: projectId,
+        source_commit: scaffoldSha,
+        crew_release: crewRelease,
+      }));
+    } catch (e) {
+      console.error("set-provenance failed: " + (e.message || e));
+      process.exit(1);
+    }
     if (!stamped || stamped.ok !== true) {
       console.error("set-provenance did not return ok");
       process.exit(1);
@@ -215,19 +223,32 @@ function main() {
     return;
   }
 
-  const stamped = crewApi(crewHome, "set-provenance", JSON.stringify({
-    source_commit: scaffoldSha,
-    crew_release: crewRelease,
-    // A base-pointer move is not a publish: keep the existing published_at.
-    ...(provenance.published_at ? { published_at: provenance.published_at } : {}),
-  }));
+  let stamped;
+  try {
+    stamped = crewApi(crewHome, "set-provenance", JSON.stringify({
+      project_id: projectId,
+      source_commit: scaffoldSha,
+      crew_release: crewRelease,
+      // A base-pointer move is not a publish: keep the existing published_at.
+      ...(provenance.published_at ? { published_at: provenance.published_at } : {}),
+    }));
+  } catch (e) {
+    console.error("set-provenance failed: " + (e.message || e));
+    process.exit(1);
+  }
   if (!stamped || stamped.ok !== true) {
     console.error("set-provenance did not return ok");
     process.exit(1);
   }
   // Exact read-back: the stamp must match what we intended, or it is fiction
   // (same discipline as lib/verify-publish.js).
-  const recheck = crewApi(crewHome, "get-provenance").provenance;
+  let recheck;
+  try {
+    recheck = crewApi(crewHome, "get-provenance", JSON.stringify({ project_id: projectId })).provenance;
+  } catch (e) {
+    console.error("post-stamp get-provenance failed: " + (e.message || e));
+    process.exit(1);
+  }
   if (!recheck || recheck.source_commit !== scaffoldSha) {
     console.error("post-stamp read-back mismatch: provenance does not point at the scaffold commit");
     process.exit(1);

package/lib/compose-evidence-caption.js

@@ -154,7 +154,8 @@ if (!verdict) {
 }
 
 // Provenance: this task's own newest `publish: verified` event first; the
-// global provenance record only when it belongs to this task.
+// project-scoped provenance record only when it belongs to this task
+// (provenance is per-project — room #15 blocker 8).
 let commit = null;
 const verifiedNote = notesNewest
   .find((e) => (e.message || "").includes("publish: verified"));
@@ -162,9 +163,9 @@ if (verifiedNote) {
   const m = /\b([0-9a-f]{40})\b/.exec(verifiedNote.message);
   if (m) commit = m[1];
 }
-if (!commit) {
+if (!commit && project) {
   try {
-    const prov = api("get-provenance", {}).provenance;
+    const prov = api("get-provenance", { project_id: project.id }).provenance;
     if (prov && prov.task_id === taskId && /^[0-9a-f]{40}$/.test(prov.source_commit || "")) {
       commit = prov.source_commit;
     }

package/lib/crew-api.js

@@ -88,12 +88,148 @@ function resolveCrewHome(flagValue) {
 
 const SCHEMA_PATH = join(import.meta.dirname, "schema.sql");
 
+// Provenance shape rules, shared by the writer and the backfill's
+// pre-validation so they can never diverge (room #15, 2026-09-18).
+const PROVENANCE_SOURCE_COMMIT_RE = /^[0-9a-f]{40}$/;
+const PROVENANCE_CREW_RELEASE_RE = /^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/;
+
+// One-time backfill of the legacy crew-home-global provenance triple
+// (config.provenance.*) into the per-project provenance columns (room #15
+// blocker 8, 2026-09-18). Attribution is never fabricated: the legacy base
+// is stamped onto a project ONLY when it is an ancestor of exactly one
+// project's repo HEAD (verified with git, never assumed). Zero or ambiguous
+// matches are recorded as deferred:<reason> and the legacy keys are left
+// untouched — new readers see null (empty-tree first publish) while old
+// readers keep their global triple. Watermarked in config, so it runs at
+// most once per crew home. Benign edge: a legacy key written by the very
+// command whose open triggers the backfill is re-created after the DELETE
+// and lingers in config — inert dead storage, never read by new code.
+function backfillProjectProvenance(db) {
+  let wm = db.prepare("SELECT value FROM config WHERE key = 'provenance.backfill'").get();
+  if (wm && wm.value === "none") {
+    // "none" means "no legacy triple at the last look". A triple that
+    // arrives later (hand-written via update-config — the key space is
+    // open) is new evidence, not a settled state: clear the watermark and
+    // evaluate it. Any other watermark (stamped:*, deferred:*) is terminal.
+    const legacy = db.prepare(
+      "SELECT key FROM config WHERE key LIKE 'provenance.%' AND key != 'provenance.backfill'"
+    ).all();
+    if (legacy.length > 0) {
+      db.prepare("DELETE FROM config WHERE key = 'provenance.backfill'").run();
+      wm = null;
+    } else {
+      return;
+    }
+  }
+  if (wm) return;
+  const setWatermark = (v) =>
+    db.prepare("INSERT OR IGNORE INTO config (key, value) VALUES ('provenance.backfill', ?)").run(v);
+  const rows = db.prepare(
+    "SELECT key, value FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at','provenance.task_id')"
+  ).all();
+  const byKey = Object.fromEntries(rows.map((r) => [r.key, r.value]));
+  const sc = byKey["provenance.source_commit"];
+  const cr = byKey["provenance.crew_release"];
+  const pa = byKey["provenance.published_at"];
+  if (!sc && !cr && !pa && !byKey["provenance.task_id"]) {
+    // No legacy provenance at all: nothing to attribute, ever.
+    setWatermark("none");
+    return;
+  }
+  if (!sc || !cr || !pa) {
+    // Incomplete triple (partial hand-write): do NOT watermark — the next
+    // open retries. Watermarking here would strand keys that arrive later.
+    return;
+  }
+  const matches = [];
+  for (const p of db.prepare("SELECT id, repo_path FROM projects").all()) {
+    try {
+      execFileSync("git", ["merge-base", "--is-ancestor", sc, "HEAD"],
+        { cwd: p.repo_path, encoding: "utf8", timeout: 10000, stdio: ["ignore", "pipe", "ignore"] });
+      matches.push(p.id);
+    } catch {
+      // Not an ancestor, or the repo is unreadable: not a match.
+    }
+  }
+  if (matches.length === 1) {
+    // Validate the legacy triple against the writer's shape rules BEFORE
+    // touching the database: a hand-written abbreviated sha passes
+    // `git merge-base --is-ancestor` (git resolves abbreviations) but
+    // violates the storage CHECK — and a throw here would escape openDb
+    // and hard-fail every CLI command against the home. The backfill's
+    // whole contract is best-effort attribution, so a bad shape is a
+    // deferred watermark, never an exception. Legacy keys are retained
+    // read-only for old readers, exactly like the other deferred cases.
+    const shapeProblem =
+      !PROVENANCE_SOURCE_COMMIT_RE.test(sc ?? "")
+        ? `source_commit not 40-char hex (${String(sc).slice(0, 24)})`
+        : !PROVENANCE_CREW_RELEASE_RE.test(cr ?? "")
+          ? `crew_release not 40-char hex or pkg-<semver> (${String(cr).slice(0, 24)})`
+          : null;
+    if (shapeProblem) {
+      setWatermark(`deferred:stamp-failed:${shapeProblem}`);
+    } else {
+      db.exec("BEGIN");
+      try {
+        db.prepare(
+          `UPDATE projects SET provenance_source_commit = ?, provenance_crew_release = ?,
+           provenance_published_at = ?, provenance_task_id = ?, updated_at = ? WHERE id = ?`
+        ).run(sc, cr, pa, byKey["provenance.task_id"] ?? null, now(), matches[0]);
+        db.prepare("DELETE FROM config WHERE key LIKE 'provenance.%' AND key != 'provenance.backfill'").run();
+        setWatermark(`stamped:${matches[0]}`);
+        db.exec("COMMIT");
+      } catch (e) {
+        db.exec("ROLLBACK");
+        const reason = String((e && e.message) || e).replace(/[\r\n]+/g, " ").slice(0, 100);
+        setWatermark(`deferred:stamp-failed:${reason}`);
+      }
+    }
+  } else if (matches.length === 0) {
+    setWatermark(`deferred:no-ancestor-match:${String(sc).slice(0, 7)}`);
+  } else {
+    setWatermark(`deferred:ambiguous:${matches.length}`);
+  }
+}
+
+// Re-run a deferred backfill when the match set may have changed: a new
+// project was just created, and a `deferred:no-ancestor-match` or
+// `deferred:ambiguous` watermark from an earlier look can now resolve —
+// e.g. a home whose legacy triple predates its first project. Only
+// deferred:* watermarks are retried, and only while the legacy keys still
+// exist (a successful stamp deleted them). Returns the stamped project id,
+// or null. Never throws for a bad triple — the evaluation watermarks
+// instead (see above); a throw here means the database itself is broken,
+// and failing project creation is then the honest outcome.
+function retryDeferredBackfill(db) {
+  const wm = db.prepare("SELECT value FROM config WHERE key = 'provenance.backfill'").get();
+  if (!wm || !String(wm.value).startsWith("deferred:")) return null;
+  const legacy = db.prepare(
+    "SELECT key FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at')"
+  ).all();
+  if (legacy.length === 0) return null;
+  // Lift the terminal watermark, re-evaluate, and let the evaluation write
+  // the new one. If the re-evaluation throws (it shouldn't — every path
+  // watermarks), restore the old watermark so the deferral isn't lost.
+  const old = wm.value;
+  db.prepare("DELETE FROM config WHERE key = 'provenance.backfill'").run();
+  try {
+    backfillProjectProvenance(db);
+  } catch (e) {
+    db.prepare("INSERT OR IGNORE INTO config (key, value) VALUES ('provenance.backfill', ?)").run(old);
+    throw e;
+  }
+  const wm2 = db.prepare("SELECT value FROM config WHERE key = 'provenance.backfill'").get();
+  const m = wm2 && /^stamped:(.+)$/.exec(String(wm2.value));
+  return m ? m[1] : null;
+}
+
 function openDb(crewHome) {
   const dbPath = join(crewHome, "crew-state.db");
   const fresh = !existsSync(dbPath);
   const db = new DatabaseSync(dbPath);
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");
+  db.exec("PRAGMA busy_timeout = 5000;");
   if (fresh) {
     const schema = readFileSync(SCHEMA_PATH, "utf8");
     db.exec(schema);
@@ -139,6 +275,29 @@ function openDb(crewHome) {
         if (!/duplicate column name/i.test(e.message)) throw e;
       }
     }
+    // Migration: per-project provenance columns (room #15 blocker 8,
+    // 2026-09-18). Same idempotent PRAGMA-check pattern; ADD COLUMN without
+    // a default leaves existing rows NULL, which is "no provenance yet" by
+    // design — attribution is never fabricated, so there is no backfill step
+    // here beyond the watermarked legacy-triple attribution below.
+    const provMigration = [
+      ["provenance_source_commit", "TEXT CHECK (provenance_source_commit IS NULL OR length(provenance_source_commit) = 40)"],
+      ["provenance_crew_release", "TEXT"],
+      ["provenance_published_at", "TEXT"],
+      ["provenance_task_id", "TEXT"],
+    ];
+    const provColNames = new Set(db.prepare("PRAGMA table_info(projects)").all().map((c) => c.name));
+    for (const [colName, colType] of provMigration) {
+      if (!provColNames.has(colName)) {
+        try {
+          db.exec(`ALTER TABLE projects ADD COLUMN ${colName} ${colType}`);
+        } catch (e) {
+          if (!/duplicate column name/i.test(e.message)) throw e;
+        }
+      }
+    }
+    // Legacy global-provenance backfill (watermarked, runs at most once).
+    backfillProjectProvenance(db);
   }
   return db;
 }
@@ -276,7 +435,7 @@ function requireTask(db, id) {
 
 function requireProject(db, id) {
   const row = db.prepare("SELECT * FROM projects WHERE id = ?").get(id);
-  if (!row) throw notFound("Project not found.");
+  if (!row) throw notFound(`Project not found: "${id}" — check list-projects, or create it with create-project.`);
   return row;
 }
 
@@ -1263,16 +1422,27 @@ commands["get-events"] = (db, args) => {
 // against this code's own realpath (the release it is actually running
 // from). Unresolvable or disputed => throw fail-closed BEFORE the claim
 // transaction: provenance is never stamped with an unknown release.
-function resolveActiveRelease(crewHome) {
+//
+// Active-release resolution is split in two (room #15, 2026-09-18):
+// resolveActiveReleaseName (symlink only — for writers) below, and
+// resolveActiveRelease (symlink + self-path cross-check — for verifiers).
+function resolveActiveReleaseName(crewHome) {
   let linkTarget;
   try {
     linkTarget = readlinkSync(join(crewHome, "current"));
   } catch (e) {
     throw usageError(
-      `scan-verification-pending: cannot resolve the active release: ${join(crewHome, "current")} is not a readable symlink (${e.message}). Refusing to verify.`
+      `cannot resolve the active release: ${join(crewHome, "current")} is not a readable symlink (${e.message}).`
     );
   }
-  const activeRelease = basename(resolve(crewHome, linkTarget));
+  return basename(resolve(crewHome, linkTarget));
+}
+// The strict resolver for verifiers (scan-verification-pending): the symlink
+// answer PLUS the self-path cross-check — the running code must provably be
+// the active release's own crew-api.js before it stamps verification claims.
+// Stale cron bodies and mid-deploy swaps throw fail-closed here.
+function resolveActiveRelease(crewHome) {
+  const activeRelease = resolveActiveReleaseName(crewHome);
   const selfPath = new URL(import.meta.url).pathname;
   const selfMatch = selfPath.match(/releases\/([^/]+)\/lib\/crew-api\.js$/);
   if (!selfMatch) {
@@ -1575,39 +1745,49 @@ commands["record-phase"] = (db, args) => {
 // the JSON transport and over the 200-line budget. The artifact is built from
 // the repo checkout at registration time, so create-project stamps
 // source_commit = repo HEAD for artifact-deploy projects; the first publish
-// then diffs only the task's own changes. The stamp never clobbers an
-// existing one (provenance storage is crew-home-global, so a second artifact
-// project keeps the first stamp — per-project provenance is a known gap this
-// does not introduce). A skipped stamp is reported, never silent, and never
-// fails project creation.
-function initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName }) {
+// The initial-provenance stamp at create-project time: an artifact project
+// opens with its publish base set to the repo HEAD at registration, so the
+// first publish diffs only the task's own changes. Per-project (room #15
+// blocker 8): the project row was just inserted, so it is unstamped by
+// construction — there is no "already stamped" skip; a second artifact
+// project gets its own row, never the first project's base. A skipped stamp
+// is reported, never silent, and never fails project creation.
+function initialProvenancePlan({ deployType, headSha, releaseName }) {
   if (deployType !== "artifact") return { stamped: false, reason: "deploy_type is not artifact" };
-  if (provenanceExists) return { stamped: false, reason: "provenance already stamped" };
   if (!headSha) return { stamped: false, reason: "repo HEAD is unresolvable (unborn repo?)" };
   if (!releaseName) return { stamped: false, reason: "active crew release is unresolvable" };
   return { stamped: true, source_commit: headSha, crew_release: releaseName };
 }
 
-function tryStampInitialProvenance(db, crewHome, repoPath, deployType) {
-  const keys = db.prepare(
-    "SELECT key FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at')"
-  ).all().map((r) => r.key);
-  const provenanceExists = keys.length === 3;
+function tryStampInitialProvenance(db, projectId, crewHome, repoPath, deployType) {
   let headSha = null;
   try {
     headSha = execFileSync("git", ["rev-parse", "HEAD"],
-      { cwd: repoPath, encoding: "utf8", timeout: 10000 }).trim();
+      { cwd: repoPath, encoding: "utf8", timeout: 10000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (!/^[0-9a-f]{40}$/.test(headSha)) headSha = null;
   } catch { headSha = null; }
   let releaseName = null;
-  try { releaseName = resolveActiveRelease(crewHome); } catch { releaseName = null; }
-  const plan = initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName });
+  // Symlink-only resolution: the stamp records the crew home's ACTIVE
+  // release — it must not depend on which copy of this file is running.
+  // The strict self-path cross-check lives in resolveActiveRelease, used by
+  // scan-verification-pending; requiring it here silently skipped the stamp
+  // for every setup path that invokes crew-api.js outside the release tree
+  // (room #15: create-project through the npm package's own lib/).
+  try { releaseName = resolveActiveReleaseName(crewHome); } catch { releaseName = null; }
+  const plan = initialProvenancePlan({ deployType, headSha, releaseName });
   if (!plan.stamped) return plan;
-  const upsert = db.prepare(
-    "INSERT INTO config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value");
-  upsert.run("provenance.source_commit", plan.source_commit);
-  upsert.run("provenance.crew_release", plan.crew_release);
-  upsert.run("provenance.published_at", now());
+  try {
+    stampProvenance(db, {
+      project_id: projectId,
+      source_commit: plan.source_commit,
+      crew_release: plan.crew_release,
+    });
+  } catch (e) {
+    // The stamp is best-effort: a writer rejection (e.g. a release name
+    // outside the stampable shape) skips the stamp, never the project.
+    // Reported via the reason, never silent.
+    return { stamped: false, reason: `initial stamp rejected: ${e.message}` };
+  }
   return plan;
 }
 
@@ -1675,7 +1855,17 @@ commands["create-project"] = (db, args, ctx) => {
       description, simultaneity, quiesced, visual_protocol, environment_type, created_at, updated_at)
      VALUES (@id, @display_name, @repo_path, @deploy_type, @deploy_slug,
       @description, @simultaneity, @quiesced, @visual_protocol, @environment_type, @created_at, @updated_at)`).run(row);
-  const initialProvenance = tryStampInitialProvenance(db, ctx.crewHome, repoPath, deployType);
+  // A deferred backfill (zero/ambiguous matches at the last look) gets one
+  // more evaluation now that the match set changed: a new project whose
+  // repo descends from the legacy commit inherits the attribution instead
+  // of stranding the triple in config forever. When the backfill stamps
+  // this project, the initial stamp below is skipped — the legacy triple
+  // is a real publish record and must not be overwritten by the
+  // creation-time HEAD.
+  const backfillStampedId = retryDeferredBackfill(db);
+  const initialProvenance = backfillStampedId === id
+    ? { stamped: true, reason: "legacy backfill attributed this project; initial stamp skipped" }
+    : tryStampInitialProvenance(db, id, ctx.crewHome, repoPath, deployType);
   return { project: mapProject(row), initial_provenance: initialProvenance };
 };
 
@@ -1819,35 +2009,48 @@ commands["update-config"] = (db, args) => {
   return { ok: true };
 };
 
-commands["set-provenance"] = (db, args) => {
-  if (!/^[0-9a-f]{40}$/.test(args.source_commit ?? "")) throw usageError("source_commit must be 40-char hex.");
-  if (!/^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/.test(args.crew_release ?? "")) {
+// The single provenance writer (room #15 blocker 8). Every stamp flows
+// through here: set-provenance and create-project's initial stamp are thin
+// shells over it. Per-project by design — a crew home with N artifact
+// projects carries N independent publish bases, and stamping one project
+// never touches another's row.
+function stampProvenance(db, { project_id, source_commit, crew_release, published_at, task_id }) {
+  const pid = String(project_id ?? "").trim();
+  if (!pid) throw usageError("project_id is required — pass the project's id (see list-projects).");
+  requireProject(db, pid);
+  if (!PROVENANCE_SOURCE_COMMIT_RE.test(source_commit ?? "")) throw usageError("source_commit must be 40-char hex.");
+  if (!PROVENANCE_CREW_RELEASE_RE.test(crew_release ?? "")) {
     throw usageError("crew_release must be 40-char hex or pkg-<semver>.");
   }
   // task_id is optional; when present it must be 1-80 chars (matches dashboard contract).
-  const taskId = args.task_id ?? null;
-  if (taskId !== null && (typeof taskId !== "string" || taskId.trim().length < 1 || taskId.length > 80)) {
+  const tid = task_id ?? null;
+  if (tid !== null && (typeof tid !== "string" || tid.trim().length < 1 || tid.length > 80)) {
     throw usageError("task_id must be 1-80 chars when provided.");
   }
-  const upsert = db.prepare(
-    "INSERT INTO config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value");
-  upsert.run("provenance.source_commit", args.source_commit);
-  upsert.run("provenance.crew_release", args.crew_release);
-  upsert.run("provenance.published_at", args.published_at ?? now());
-  if (taskId !== null) upsert.run("provenance.task_id", taskId);
-  return { ok: true };
+  db.prepare(
+    `UPDATE projects SET provenance_source_commit = ?, provenance_crew_release = ?,
+     provenance_published_at = ?, provenance_task_id = ?, updated_at = ?
+     WHERE id = ?`
+  ).run(source_commit, crew_release, published_at ?? now(), tid, now(), pid);
+  return { ok: true, project_id: pid };
+}
+
+commands["set-provenance"] = (db, args) => {
+  return stampProvenance(db, args ?? {});
 };
 
-commands["get-provenance"] = (db) => {
-  const rows = db.prepare("SELECT key, value FROM config WHERE key LIKE 'provenance.%'").all();
-  const byKey = Object.fromEntries(rows.map((r) => [r.key, r.value]));
-  const sc = byKey["provenance.source_commit"];
-  const cr = byKey["provenance.crew_release"];
-  const pa = byKey["provenance.published_at"];
-  if (!sc || !cr || !pa) return { provenance: null };
+commands["get-provenance"] = (db, args) => {
+  const pid = String((args ?? {}).project_id ?? "").trim();
+  if (!pid) throw usageError("project_id is required — pass the project's id (see list-projects).");
+  const row = requireProject(db, pid);
+  if (!row.provenance_source_commit || !row.provenance_crew_release || !row.provenance_published_at) {
+    return { provenance: null };
+  }
   return { provenance: {
-    source_commit: sc, crew_release: cr, published_at: pa,
-    task_id: byKey["provenance.task_id"] ?? null,
+    source_commit: row.provenance_source_commit,
+    crew_release: row.provenance_crew_release,
+    published_at: row.provenance_published_at,
+    task_id: row.provenance_task_id ?? null,
   } };
 };
 

package/lib/schema.sql

@@ -34,6 +34,18 @@ CREATE TABLE IF NOT EXISTS projects (
   -- deploy_type is NOT reused for this (it names the deployment target, not
   -- the UX surface a user experiences).
   environment_type TEXT CHECK (environment_type IN ('artifact', 'terminal')),
+  -- Per-project provenance (2026-09-18, room #15 blocker 8): each project
+  -- carries its own publish base. Provenance was crew-home-global
+  -- (config.provenance.*), which broke any multi-project home: the first
+  -- artifact project's stamp was read as the second project's base, parking
+  -- the second task with "not an ancestor". Nullable by design: a project
+  -- with no provenance reads null and its first publish diffs from the
+  -- empty tree. Never fabricated — the one-time backfill in openDb stamps
+  -- only an exactly-one-ancestor match, otherwise records deferred.
+  provenance_source_commit TEXT CHECK (provenance_source_commit IS NULL OR length(provenance_source_commit) = 40),
+  provenance_crew_release TEXT,
+  provenance_published_at TEXT,
+  provenance_task_id TEXT,
   created_at    TEXT NOT NULL,
   updated_at    TEXT NOT NULL
 );

package/lib/test-worktree-backend.sh

@@ -239,6 +239,35 @@ if git -C "$T5" log --name-only --format= | grep -q '^\.worktrees/'; then
 fi
 rm -rf "$T5"
 
+# post-deploy survives the crew's own gitignored non-empty .worktrees/
+# (2026-09-18, room #15 J3): the old `git add -A -- ':!.worktrees/'`
+# exited 1 on git 2.43.0 whenever setup's `.gitignore` entry ignored a
+# non-empty .worktrees/, and set -e killed post-deploy before "DEPLOYED:".
+T6=/tmp/crew-git-postdeploy-gitignore-test
+rm -rf "$T6"
+mkdir -p "$T6"
+git init -q -b main "$T6"
+git -C "$T6" config user.email test@test.t
+git -C "$T6" config user.name test
+echo base > "$T6/f.txt"
+echo ".worktrees/" > "$T6/.gitignore"
+git -C "$T6" add -A
+git -C "$T6" commit -qm base
+export CREW_REPO="$T6"
+export CREW_LIB="$REPO_DIR/lib"
+# Non-empty ignored .worktrees/, exactly the shape of real integrate state
+mkdir -p "$T6/.worktrees/pd2"
+printf 'task_id=pd2\nholder=test\n' > "$T6/.worktrees/pd2/.merge-lock"
+# A genuine user change the post-deploy commit should pick up
+echo userchange > "$T6/user.txt"
+out=$(bash "$LIFECYCLE" post-deploy "pd2") || fail "postdeploy-gitignore-test: post-deploy failed: $out"
+echo "$out" | grep -q '^DEPLOYED: ' || fail "postdeploy-gitignore-test: no DEPLOYED: line: $out"
+git -C "$T6" log --name-only --format= -1 | grep -q '^user\.txt$' || fail "postdeploy-gitignore-test: user change not committed"
+if git -C "$T6" log --name-only --format= | grep -q '^\.worktrees/'; then
+  fail "postdeploy-gitignore-test: .worktrees/ content committed into main"
+fi
+rm -rf "$T6"
+
 rm -rf "$T2" "$T3" "$T4"
 export CREW_REPO="$T"
 rm -rf "$T"

package/lib/verify-publish.js

@@ -23,7 +23,7 @@
 //   node verify-publish.js --crew-home <path> --task-id <uuid>
 //       --commit <sha> --base <sha> --repo-path <path> --slug <slug>
 //       --crew-release <release> --inspection-id <uuid> --result-file <path>
-//       [--build-agent-id <uuid>]
+//       --project-id <project-id> [--build-agent-id <uuid>]
 //
 // --base is the previously-stamped provenance source_commit (or the
 // empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
@@ -66,6 +66,7 @@ const inspectionId = arg("--inspection-id");
 const resultFile = arg("--result-file");
 const crewRelease = arg("--crew-release");
 const buildAgentId = arg("--build-agent-id", false);
+const projectId = arg("--project-id");
 
 if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
 if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
@@ -334,7 +335,7 @@ if (buildAgentId && resultText.includes(buildAgentId)) buildNote = `build-id-cor
 // --- 7. Stamp (only after the machine-checked comparison succeeded) ---------
 let stamp;
 try {
-  stamp = api("set-provenance", { source_commit: commit, crew_release: crewRelease, task_id: taskId });
+  stamp = api("set-provenance", { project_id: projectId, source_commit: commit, crew_release: crewRelease, task_id: taskId });
 } catch (e) {
   terminal("stamp-failed", `set-provenance threw: ${e.message}`);
 }
@@ -342,7 +343,7 @@ if (!stamp || stamp.ok !== true) terminal("stamp-failed", "set-provenance did no
 // Exact read-back: the stamp must match what we intended, or it is fiction.
 let prov;
 try {
-  prov = api("get-provenance", {});
+  prov = api("get-provenance", { project_id: projectId });
 } catch (e) {
   terminal("stamp-failed", `get-provenance threw: ${e.message}`);
 }

package/lib/worktree-lifecycle.sh

@@ -416,9 +416,15 @@ cmd_post_deploy() {
 
   # Commit any changes the artifact builder left behind.
   # The crew's own .worktrees/ dir (merge lock, registry) is crew-owned
-  # state, never user content — exclude it so a stray lock file can never
-  # be committed into main (J1 canary: .merge-lock landed in main via add -A).
-  git add -A -- ':!.worktrees/'
+  # state, never user content — unstage it after the add so a stray lock
+  # file can never be committed into main (J1 canary: .merge-lock landed
+  # in main via add -A). Never use an all-negative pathspec here: on git
+  # 2.43.0 `git add -A -- ':!.worktrees/'` still exits 1 against the
+  # crew's own gitignored .worktrees/ (room #15, J3), and set -e then
+  # kills post-deploy before "DEPLOYED:". A plain add never errors on
+  # ignored paths; the reset covers pre-gitignore-entry repos too.
+  git add -A
+  git reset -q -- .worktrees/ 2>/dev/null || true
   if ! git diff --cached --quiet 2>/dev/null; then
     git commit -m "rebuild: $task_id"
     echo "COMMITTED: artifact builder changes"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -40,11 +40,13 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
      This atomically claims each verification-pending task (1-hour lease, so a second tick cannot double-verify) and reconciles verified-but-still-parked tasks to `in_progress`. It returns `{ to_verify: [...], reconciled: [...] }`. Log both lists. If the scan exits 2 (e.g. the active release cannot be resolved), log the error loudly and continue — do NOT work around it.
-   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish), then run:
+   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish):
+     `node {crewHome}/lib/crew-api.js --crew-home {crewHome} get-provenance --json '{"project_id": "<project_id>"}'`
+     (use the entry's `project_id` verbatim), then run:
      `node {crewHome}/lib/readback-disk.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<deploy_slug>" --task-id <task_id> > /tmp/readback-<task_id>.txt 2> /tmp/readback-<task_id>.err`
      Use the entry's `repo_path` and `deploy_slug` verbatim. If the sensor exits 0, the result file holds the findings block — hand it to the verify step below. If it exits non-zero, do NOT save or use stdout: log `publish: verification-procedural-error <commit> <first line of the .err file>` and leave the task parked — the next tick retries. A sensor failure is procedural (the read could not be performed), never a content verdict. Do NOT judge content yourself, and do NOT stamp provenance.
-   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
-     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
+   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --project-id <project_id> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
+     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with and the entry's `project_id` verbatim. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The verify script's machine-checked comparison is the only certification.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.

package/workflows/bugfix.js

@@ -83,13 +83,18 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
-// The six basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The seven basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
 // 2026-09-17): the diff is computed by this script, never ferried as an
 // agent JSON string. Pinned like the other publish-critical modules so a
 // mid-run release swap cannot change it under the workflow.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -273,7 +278,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -1548,7 +1553,7 @@ while (i < STEPS.length) {
         // first publish (no provenance stamped yet).
         var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
         var provResult = await agent(
-          crewCmd("get-provenance", {}) + "\n" +
+          crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "Return JSON { \"provenance\": <the CLI's provenance object, or null when nothing is stamped> } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-provenance-base-" + taskId, totalReworkCount), label: "Reading stamped publish base",
             schema: { type: "object", properties: { provenance: { type: ["object", "null"] } }, required: ["provenance"] } }
@@ -2399,7 +2404,7 @@ while (i < STEPS.length) {
     if (PUBLISH_TYPE === "artifact") {
       instructions = "PROVENANCE CHECK (this project publishes to a dashboard artifact).\n" +
         "Provenance is crew-owned state: read it from the Crew API, never from the artifact's own getprovenance action (a different, non-authoritative store).\n" +
-        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
         "If provenance is null, report 'provenance missing — publish did not stamp source/crew release', then end your report with exactly this line: VERDICT: FAIL.\n" +
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD — call this LIVE_HEAD.\n" +
         "Run: test -d " + crewHome + "/releases/<provenance.crew_release> (substitute the real stamped hash; do not run the literal placeholder). If the directory does not exist, report 'provenance mismatch: crew_release [value from get-provenance] not found in release registry', then end your report with exactly this line: VERDICT: FAIL.\n" +
@@ -2944,11 +2949,11 @@ while (i < STEPS.length) {
       // dashboard QA source check).
       try {
         var provRefresh = await agent(
-          "Run in shell and read the stdout JSON:\n" + crewCmd("get-provenance", {}) + "\n" +
+          "Run in shell and read the stdout JSON:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
           "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
           "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
-          "Then run in shell: node " + CREW_API + " --crew-home " + crewHome + " set-provenance --json '{\"source_commit\":\"<the existing provenance.source_commit value>\",\"crew_release\":\"<REL>\",\"published_at\":\"<TS>\",\"task_id\":\"" + taskId + "\"}' " +
+          "Then run in shell: node " + CREW_API + " --crew-home " + crewHome + " set-provenance --json '{\"project_id\":\"" + LAUNCH_PROJECT_ID + "\",\"source_commit\":\"<the existing provenance.source_commit value>\",\"crew_release\":\"<REL>\",\"published_at\":\"<TS>\",\"task_id\":\"" + taskId + "\"}' " +
           "(substitute the real values; the JSON must be single-quote-wrapped for the shell). " +
           "Return JSON { \"refreshed\": <true if the set-provenance stdout contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
           { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",

package/workflows/chore.js

@@ -140,13 +140,18 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
-// The six basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The seven basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
 // 2026-09-17): the diff is computed by this script, never ferried as an
 // agent JSON string. Pinned like the other publish-critical modules so a
 // mid-run release swap cannot change it under the workflow.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -325,7 +330,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -1435,7 +1440,7 @@ while (i < STEPS.length) {
         // first publish (no provenance stamped yet).
         var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
         var provResult = await agent(
-          crewCmd("get-provenance", {}) + "\n" +
+          crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "Return JSON { \"provenance\": <the CLI's provenance object, or null when nothing is stamped> } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-provenance-base-" + taskId, reworkCount), label: "Reading stamped publish base",
             schema: { type: "object", properties: { provenance: { type: ["object", "null"] } }, required: ["provenance"] } }
@@ -2521,11 +2526,11 @@ while (i < STEPS.length) {
       // dashboard QA source check).
       try {
         var provRefresh = await agent(
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
           "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
           "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
-          "Then run in shell:\n" + crewCmd("set-provenance", { source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
+          "Then run in shell:\n" + crewCmd("set-provenance", { project_id: LAUNCH_PROJECT_ID, source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
           "(substitute the real existing source_commit, REL, and TS for the placeholders). " +
           "Return JSON { \"refreshed\": <true if the set-provenance stdout contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
           { key: attemptKey("publish-provenance-refresh-" + taskId, reworkCount), label: "Refreshing dashboard provenance after crew release",

package/workflows/crew-init.js

@@ -350,6 +350,7 @@ log("Scaffold: " + scaffoldCreated + " created, " + scaffoldSkipped + " skipped"
 // projects later via crew-api.js create-project.
 phase("project");
 var projectResult;
+var initialProvenanceWarning = null;
 if (!dashboardSlug) {
   log("Project: skipped (CLI-only mode — no dashboard; create projects via crew-api.js create-project)");
   projectResult = { action: "skipped", project_id: null };
@@ -380,7 +381,8 @@ try {
     "      Return { action: \"repaired\", project_id: \"" + dashboardSlug + "\" }.\n" +
     "3. If not found (error), create it:\n" +
     "   node " + crewHome + "/current/lib/crew-api.js --crew-home " + crewHome + " create-project --json '{\"id\": \"" + dashboardSlug + "\", \"display_name\": \"" + safeDashboardName + "\", \"repo_path\": \"" + safeDashboardRepo + "\", \"deploy_type\": \"artifact\", \"deploy_slug\": \"" + dashboardSlug + "\", \"environment_type\": \"artifact\", \"description\": \"The dashboard task service — the crew\\u0027s first project\"}'\n" +
-    "   Return { action: \"created\", project_id: \"" + dashboardSlug + "\" }.\n\n" +
+    "   The create-project response carries initial_provenance { stamped, reason?, source_commit?, crew_release? } — pass it through verbatim.\n" +
+    "   Return { action: \"created\", project_id: \"" + dashboardSlug + "\", initial_provenance: <the verbatim initial_provenance object> }.\n\n" +
     "4. Seed the update watcher's trusted dashboard base (enrollment) — the\n" +
     "   commit this installation starts from. Only ever seeds when no base\n" +
     "   exists; an established base is never moved by a re-init:\n" +
@@ -394,7 +396,7 @@ try {
     "      dashboard upgrade with oldSha unknown and park it with enrollment\n" +
     "      guidance, fail-closed.\n\n" +
     "The repo_path must be the dashboard git repository — never the crew home.\n" +
-    "Return JSON with action (\"exists\", \"repaired\", or \"created\") and project_id (string).",
+    "Return JSON with action (\"exists\", \"repaired\", or \"created\"), project_id (string), and — only when action is \"created\" — the create-project response's initial_provenance object verbatim.",
     {
       key: "project-1",
       label: "Register dashboard project",
@@ -402,7 +404,8 @@ try {
         type: "object",
         properties: {
           action: { type: "string", enum: ["exists", "repaired", "created"] },
-          project_id: { type: "string" }
+          project_id: { type: "string" },
+          initial_provenance: { type: "object" }
         },
         required: ["action", "project_id"]
       }
@@ -412,6 +415,18 @@ try {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Project registration failed", message: String(e.message || e) } };
 }
 log("Project: " + dashboardSlug + " " + projectResult.action + " (repo_path=" + gateFacts.dashboardRepoExpanded + ")");
+if (projectResult && projectResult.action === "created" &&
+    projectResult.initial_provenance && !projectResult.initial_provenance.stamped) {
+  // Room #15 (reliability): create-project's initial stamp is best-effort,
+  // but "reported" used to mean "returned into the void" — zero production
+  // code read it, so a skipped stamp (the J1/J2 shape) stayed invisible.
+  // Surface it here; the publish-base advance below re-stamps right after,
+  // and fails loudly (exit 1) if the re-stamp itself cannot stamp.
+  initialProvenanceWarning = "Project created but its initial provenance stamp was skipped (" +
+    (projectResult.initial_provenance.reason || "unknown reason") +
+    ") — the publish-base advance re-stamps it next; if that also fails, the first task's publish diffs from the empty tree.";
+  log("WARNING: " + initialProvenanceWarning);
+}
 } // end dashboard-mode project registration
 
 // ── Project repo setup (2026-09-18) ─────────────────────────────────
@@ -512,7 +527,7 @@ if (dashboardRepoPath && projectResult && projectResult.action === "created" &&
     publishBaseResult = await agent(
       "Run the deterministic publish-base advance script. Do not decide anything — just run the command and return its JSON output.\n\n" +
       "Command:\n" +
-      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-created\n\n" +
+      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-id " + projectResult.project_id + " --project-created\n\n" +
       "The script prints one JSON object: { ok, action, reason?, from?, to? }.\n" +
       "Return that JSON verbatim.",
       {
@@ -801,6 +816,7 @@ return {
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
   repoSetupWarning: setupRepoWarning,
+  initialProvenanceWarning: initialProvenanceWarning,
   crons: cronsResult.summary.crons,
   registry: cronsResult.summary.registry,
   autoUpdate: {

package/workflows/standard.js

@@ -91,13 +91,18 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
-// The six basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The seven basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
 // 2026-09-17): the diff is computed by this script, never ferried as an
 // agent JSON string. Pinned like the other publish-critical modules so a
 // mid-run release swap cannot change it under the workflow.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -281,7 +286,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -1429,7 +1434,7 @@ while (i < STEPS.length) {
         // first publish (no provenance stamped yet).
         var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
         var provResult = await agent(
-          crewCmd("get-provenance", {}) + "\n" +
+          crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "Return JSON { \"provenance\": <the CLI's provenance object, or null when nothing is stamped> } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-provenance-base-" + taskId, totalReworkCount), label: "Reading stamped publish base",
             schema: { type: "object", properties: { provenance: { type: ["object", "null"] } }, required: ["provenance"] } }
@@ -2226,7 +2231,7 @@ while (i < STEPS.length) {
         "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
         "Use the returned tasks, sessions, and events to check the task's data-level effects.\n" +
         "DOCS GATE: If the change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), verify the public docs describe it. If public docs are missing or stale for a public-affecting change, report 'public docs missing/stale for [the change]', then end your report with exactly this line: VERDICT: FAIL. QA always fails when public-affecting changes lack public docs. Guide/tutorial gaps are lower priority — file a follow-up task for those instead of failing.\n\n" +
-        "PROVENANCE CHECK: Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+        "PROVENANCE CHECK: Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
         "If provenance is null, report 'provenance missing — publish did not stamp source/crew release', then end your report with exactly this line: VERDICT: FAIL.\n" +
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD — call this LIVE_HEAD.\n" +
         "Run: test -d " + crewHome + "/releases/<provenance.crew_release> (substitute the real stamped hash; do not run the literal placeholder). If the directory does not exist, FAIL: { \"passed\": false, \"summary\": \"provenance mismatch: crew_release [value from get-provenance] not found in release registry\" }.\n" +
@@ -2703,11 +2708,11 @@ while (i < STEPS.length) {
       // dashboard QA source check).
       try {
         var provRefresh = await agent(
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
           "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
           "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
-          "Then run in shell:\n" + crewCmd("set-provenance", { source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
+          "Then run in shell:\n" + crewCmd("set-provenance", { project_id: LAUNCH_PROJECT_ID, source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
           "(substitute the real existing source_commit, REL, and TS for the placeholders). " +
           "Return JSON { \"refreshed\": <true if the set-provenance stdout contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
           { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",

package/workflows/upgrade.js

@@ -157,9 +157,14 @@ const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
 const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
-// The five basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -190,7 +195,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }