muse-crew 0.12.0 → 0.13.1

package/workflows/chore.js

@@ -140,13 +140,18 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
-// The six basenames the pin step must materialize — asserted mechanically
+const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
+const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+// The seven basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // COMPUTE_DIFF is the deterministic publish-diff computer (room #14,
 // 2026-09-17): the diff is computed by this script, never ferried as an
 // agent JSON string. Pinned like the other publish-critical modules so a
 // mid-run release swap cannot change it under the workflow.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF].map(function (p) { return p.split("/").pop(); });
+// CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
+// crew-api.js statically imports it, so the pin must carry it — a pin
+// without it kills every claim with ERR_MODULE_NOT_FOUND.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -325,7 +330,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -596,14 +601,34 @@ function extractMarkerLines(workerText) {
 // builder correctly makes no commit because the deliverable is already on
 // main (a prior merge or hand-repair landed it), it declares
 // `repo_diff: none (already-merged: <sha>)` naming the main commit that
-// carries the work. The sha is hex-only (7-40 chars) so the workflow can
-// interpolate it into the mechanical ancestor check without injection
-// risk. Pure — pinned byte-identical across standard/bugfix/chore.
+// carries the work. Room #16 blocker 11 (2026-09-18): the line anchor
+// missed Wren's mid-paragraph declaration, and the persisted notes truncated
+// the tail — so the anchor is gone and a sha followed by `)`, whitespace, or
+// end-of-string (truncation) is accepted. The sha is hex-only (7-40 chars)
+// so the workflow can interpolate it into the mechanical ancestor check
+// without injection risk; a over-long hex run never matches (the lookahead
+// fails on the extra hex char). Pure — pinned byte-identical across
+// standard/bugfix/chore.
 function extractAlreadyMerged(workerText) {
-  var m = /^repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})\)/im.exec(workerText || "");
+  var m = /repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})(?=[\s)]|$)/i.exec(workerText || "");
   return m ? { sha: m[1].toLowerCase() } : { sha: null };
 }
 
+// Explicit artifact refusal (room #16 blocker 10, 2026-09-18): the rebuild
+// trigger child ends its turn with `ARTIFACT_EDIT_REFUSED: <text>` when
+// artifact_edit explicitly refuses the edit (e.g. the artifact does not
+// exist). A refusal is conclusive negative evidence — the edit provably did
+// NOT go through — distinct from an unconsumed trigger return (unknown).
+// Pure — pinned byte-identical across standard/bugfix/chore.
+// The signal must be the ENTIRE trimmed turn output (not a line within prose):
+// the trigger child is instructed to end its turn with exactly this line and
+// nothing else. A confused child quoting the instructions back in prose must
+// NOT produce a conclusive negative — that degrades to unknown (fail-closed).
+function extractRefusal(workerText) {
+  var m = /^ARTIFACT_EDIT_REFUSED:\s*(.+?)\s*$/.exec(String(workerText || "").trim());
+  return m ? m[1].slice(0, 300) : null;
+}
+
 // Worktree confinement: the Build agent must declare the exact worktree
 // path it built in on a `worktree:` marker line. The workflow compares it
 // against WORKTREE_HINT mechanically (exact string match) — never by
@@ -1260,23 +1285,40 @@ while (i < STEPS.length) {
   } else if (step.name === "Review") {
     // Already-merged hydration: when this run did not execute Build itself
     // (dispatcher resume at Review after a platform death between phases),
-    // recover the workflow-attested verification from the latest completed
-    // Build session notes. The `already_merged_verified:` line was written
-    // by the workflow after a mechanical ancestor check — it is trusted;
-    // the builder's bare declaration never is. Absent the line, the
-    // mechanical fact below reads "none declared" and Cass fails closed.
+    // recover the workflow-verified sha. Room #16 blocker 11: the structured
+    // session field is read FIRST — the `already_merged_verified:` notes line
+    // is only a fallback, because session notes are hard-capped at 3000
+    // chars and a truthful declaration at the report's tail was silently
+    // truncated. The structured value was written by the workflow after a
+    // mechanical ancestor check — it is trusted; the builder's bare
+    // declaration never is. Absent both, the mechanical fact below reads
+    // "none declared" and Cass fails closed. The hydration read is best-effort:
+    // a transport throw degrades to "none declared" rather than crashing Review.
     if (!alreadyMergedSha) {
-      var hydNotes = await agent(
-        "Read the latest completed Build session notes for task " + taskId + ".\n" +
-        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
-        "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return ONLY its notes field, verbatim, with no commentary.",
-        { key: "hydrate-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Hydrating already-merged verification" }
-      );
-      var hydStr = (typeof hydNotes === "string") ? hydNotes : JSON.stringify(hydNotes);
-      var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
-      if (hvm) {
-        alreadyMergedSha = hvm[1].toLowerCase();
-        log("Hydrated already-merged verification from Build session notes: " + alreadyMergedSha);
+      var hydResult = null;
+      try {
+        hydResult = await agent(
+          "Read the latest completed Build session for task " + taskId + ".\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
+          "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return exactly two sections, verbatim, with no commentary:\n" +
+          "SHA: <the session's already_merged_sha field value, or the word null when it is null>\n" +
+          "NOTES:\n<the session's notes field, verbatim>",
+          { key: "hydrate-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Hydrating already-merged verification" }
+        );
+      } catch (hydErr) {
+        log("Hydration read failed (" + String(hydErr && hydErr.message || hydErr) + "); treating as none declared.");
+      }
+      var hydStr = hydResult ? ((typeof hydResult === "string") ? hydResult : JSON.stringify(hydResult)) : "";
+      var hydSha = /^SHA:\s*([0-9a-f]{7,40})\s*$/im.exec(hydStr);
+      if (hydSha) {
+        alreadyMergedSha = hydSha[1].toLowerCase();
+        log("Hydrated already-merged verification from structured session field: " + alreadyMergedSha);
+      } else {
+        var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
+        if (hvm) {
+          alreadyMergedSha = hvm[1].toLowerCase();
+          log("Hydrated already-merged verification from Build session notes (fallback): " + alreadyMergedSha);
+        }
       }
     }
     instructions = "Review independently and cold. No prior context from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
@@ -1419,6 +1461,85 @@ while (i < STEPS.length) {
         // Skipped entirely when no lock was held — nothing merged, nothing
         // to ship.
         if (!publishSkippedNoLock) {
+        // The trigger key of the attempt that last ran, for the publish ledger.
+        // Minted once here (not re-minted per use site) so the ledger always
+        // records the exact key that was issued — and so a re-minted duplicate
+        // can never drift from it. Defined before the preflight so pre-trigger
+        // parks (room #16 blocker 10) record the same attempt key.
+        var rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId, reworkCount);
+        // STEP 0.5 (mechanical, room #16 blocker 10): assert the artifact
+        // target exists before any artifact_status / artifact_edit call. The
+        // project was classified as an artifact surface (deploy_slug set),
+        // but setup never provisioned the artifact — Publish then entered
+        // the trigger path against a slug with no on-disk target and the
+        // edit failed opaquely ("web artifact <slug> was not found on
+        // disk"), which the ledger could only record as unknown. A missing
+        // target is conclusive negative evidence: the edit provably did NOT
+        // go through, so this parks rejected (not unknown) with the actual
+        // missing path — no trigger issued, no blind retry, no observation
+        // polling. The check is a pure filesystem stat; the path is
+        // workflow-computed, never agent prose. An inconclusive check
+        // (throw / unparseable signal) is fail-closed unknown: without
+        // proof the target exists, no edit is issued. The slug is
+        // interpolated into a shell command — a slug outside [a-zA-Z0-9_-]
+        // (e.g. from a hand-edited space.json) is treated as inconclusive
+        // rather than risking shell injection.
+        var artifactTargetDir = "~/workspace/ts-spaces/" + PUBLISH_SLUG + "/";
+        var preflightSignal = "";
+        var preflightInconclusive = false;
+        // Misconfiguration fast path: artifact surface with no slug is not a
+        // signal problem — it's a project setup defect. Park rejected with a
+        // truthful reason, not "inconclusive."
+        if (!PUBLISH_SLUG) {
+          await recordPublishLedger({
+            commit: mergeCommitForPublish,
+            attempt: rebuildAttemptKey,
+            agent_id: null,
+            applied_report: null,
+            outcome: "rejected",
+            detail: "artifact surface with empty deploy_slug (preflight): the project is classified as artifact but has no deploy_slug — misconfiguration, not a missing artifact. No edit was issued."
+          }, reworkCount);
+          return await parkTask("Publish cannot proceed for task " + taskId + ": the project is classified as an artifact surface but has no deploy_slug. This is a project configuration defect — set a deploy_slug for the project, then re-run Publish. Human attention needed.");
+        }
+        if (!/^[a-zA-Z0-9_-]+$/.test(PUBLISH_SLUG)) {
+          preflightInconclusive = true;
+          log("Publish artifact preflight for task " + taskId + ": PUBLISH_SLUG has an unsafe shape — inconclusive, fail-closed");
+        } else try {
+          var preflight = await agent(
+            "Check whether the artifact target directory exists.\n" +
+            "Run in shell: test -d ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/ && echo ARTIFACT_TARGET: present || echo ARTIFACT_TARGET: missing\n" +
+            "Return JSON { \"signal\": \"<the exact ARTIFACT_TARGET line>\" } and nothing else.",
+            { key: attemptKey("publish-artifact-preflight-" + taskId, reworkCount), label: "Checking artifact target exists",
+              schema: { type: "object", properties: { signal: { type: "string" } }, required: ["signal"] } }
+          );
+          preflightSignal = String((preflight && preflight.signal) || "");
+        } catch (preflightErr) {
+          preflightInconclusive = true;
+          log("Publish artifact preflight for task " + taskId + " threw (" + (preflightErr && preflightErr.message ? preflightErr.message : preflightErr) + ") — inconclusive, fail-closed");
+        }
+        if (!preflightInconclusive && /ARTIFACT_TARGET:\s*missing/.test(preflightSignal)) {
+          await recordPublishLedger({
+            commit: mergeCommitForPublish,
+            attempt: rebuildAttemptKey,
+            agent_id: null,
+            applied_report: null,
+            outcome: "rejected",
+            detail: "artifact target directory missing (preflight): " + artifactTargetDir + " does not exist — setup never provisioned the artifact for deploy_slug " + PUBLISH_SLUG + ". The edit provably did not go through: no trigger issued, no blind retry"
+          }, reworkCount);
+          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact target directory " + artifactTargetDir + " does not exist. The project is classified as an artifact surface (deploy_slug " + PUBLISH_SLUG + ") but setup never provisioned the artifact — this is conclusive (rejected, not unknown): no edit was issued. Create the artifact via the Muse UI (Publish edits an existing artifact; it never creates one), then re-run init and Publish. Human attention needed.");
+        }
+        if (preflightInconclusive || !/ARTIFACT_TARGET:\s*present/.test(preflightSignal)) {
+          await recordPublishLedger({
+            commit: mergeCommitForPublish,
+            attempt: rebuildAttemptKey,
+            agent_id: null,
+            applied_report: null,
+            outcome: "unknown",
+            detail: "artifact preflight inconclusive (no parsable ARTIFACT_TARGET signal): target existence unproven, so the trigger was NOT issued; unknown parks fail closed with no blind retry"
+          }, reworkCount);
+          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact target preflight was inconclusive (no parsable signal). Target existence is unproven, so no edit was issued and nothing was retried blindly. Human attention needed.");
+        }
+        log("Publish artifact preflight for task " + taskId + ": target " + artifactTargetDir + " present");
         // (below) the diff computation, rebuild trigger, application
         // verification, bounded poll, and provenance stamp. The builder
         // only makes the artifact_edit call and reports the applied
@@ -1435,7 +1556,7 @@ while (i < STEPS.length) {
         // first publish (no provenance stamped yet).
         var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
         var provResult = await agent(
-          crewCmd("get-provenance", {}) + "\n" +
+          crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "Return JSON { \"provenance\": <the CLI's provenance object, or null when nothing is stamped> } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-provenance-base-" + taskId, reworkCount), label: "Reading stamped publish base",
             schema: { type: "object", properties: { provenance: { type: ["object", "null"] } }, required: ["provenance"] } }
@@ -1529,14 +1650,10 @@ while (i < STEPS.length) {
           "- After applying, rebuild and deploy.'\n" +
           "Edit-request contract (read carefully):\n" +
           "- Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — end your turn.\n" +
+          "- If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: end your turn with exactly one line and nothing else: ARTIFACT_EDIT_REFUSED: <the refusal text, one line>.\n" +
           "- If artifact_edit is not available after the load, do NOT improvise — end your turn.\n" +
           "- You do NOT call setprovenance, artifact_inspect, or post-deploy yourself.\n" +
           "No report is needed: do not return JSON, do not summarize what you did, do not echo the diff. End your turn after the artifact_edit call.\n";
-        // The trigger key of the attempt that last ran, for the publish ledger.
-        // Minted once here (not re-minted per use site) so the ledger always
-        // records the exact key that was issued — and so a re-minted duplicate
-        // can never drift from it.
-        var rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId, reworkCount);
         // The artifact build's agent_id, attributed to this edit by the
         // workflow-owned observation below. The agent_id is the artifact
         // system's in-flight correlation ID (research 2026-09-12):
@@ -1702,9 +1819,27 @@ while (i < STEPS.length) {
         // re-trigger duplicated the edit on 2026-09-12).
         var rebuildTrigger = null;
         try {
-          var triggerResultLength = String(await agent(rebuildPrompt,
-            { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "").length;
-          log("Publish rebuild trigger for task " + taskId + " returned (" + triggerResultLength + " chars; awaited but return intentionally unconsumed)");
+          var triggerText = String(await agent(rebuildPrompt,
+            { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
+          log("Publish rebuild trigger for task " + taskId + " returned (" + triggerText.length + " chars; awaited; scanned only for the explicit refusal signal)");
+          // Explicit refusal (room #16 blocker 10): the child ends its turn
+          // with ARTIFACT_EDIT_REFUSED when artifact_edit explicitly refused.
+          // Conclusive negative evidence — the edit provably did NOT go
+          // through — so this parks rejected and skips observation polling.
+          // A missing/unparseable signal is NOT a refusal: it stays unknown
+          // and fail-closed below.
+          var refusalText = extractRefusal(triggerText);
+          if (refusalText) {
+            await recordPublishLedger({
+              commit: mergeCommitForPublish,
+              attempt: rebuildAttemptKey,
+              agent_id: null,
+              applied_report: null,
+              outcome: "rejected",
+              detail: "artifact_edit explicitly refused the edit (parsed ARTIFACT_EDIT_REFUSED signal): " + refusalText + " — conclusive negative: the edit provably did not go through, no observation polling, no blind retry"
+            }, reworkCount);
+            return await parkTask("Publish cannot proceed for task " + taskId + ": artifact_edit explicitly refused the edit (" + refusalText + "). This is conclusive (rejected, not unknown): the edit did not go through. Repair or provision the artifact target, then re-run Publish. Human attention needed.");
+          }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
         }
@@ -2521,11 +2656,11 @@ while (i < STEPS.length) {
       // dashboard QA source check).
       try {
         var provRefresh = await agent(
-          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", {}) + "\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
           "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
           "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
           "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
-          "Then run in shell:\n" + crewCmd("set-provenance", { source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
+          "Then run in shell:\n" + crewCmd("set-provenance", { project_id: LAUNCH_PROJECT_ID, source_commit: "<existing provenance.source_commit>", crew_release: "<REL trimmed>", published_at: "<TS trimmed>", task_id: taskId }) + "\n" +
           "(substitute the real existing source_commit, REL, and TS for the placeholders). " +
           "Return JSON { \"refreshed\": <true if the set-provenance stdout contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
           { key: attemptKey("publish-provenance-refresh-" + taskId, reworkCount), label: "Refreshing dashboard provenance after crew release",
@@ -2619,7 +2754,11 @@ while (i < STEPS.length) {
     "Update session and log event.\n" +
     "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
       task_id: taskId,
-      session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary },
+      // Room #16 blocker 11: the workflow-verified already-merged sha as
+      // structured control state. Only the Build gate sets alreadyMergedSha
+      // (after the mechanical ancestor check); the API validates the shape
+      // and a later write without the field never clears it (COALESCE).
+      session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary, already_merged_sha: (step.name === "Build" ? alreadyMergedSha : null) },
       event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity }
     }) + "\n",
     {
@@ -2635,6 +2774,15 @@ while (i < STEPS.length) {
       return await parkTask("Exceeded " + MAX_REWORK + " rework attempts after Review rejection. Worktree preserved.");
     }
     rejectionNotes = summary;
+    // Already-merged corrective (room #16 blocker 11): when Review rejected
+    // an empty branch but the work is already on main (the workflow verified
+    // the sha), Wren must declare it — not re-implement or re-commit
+    // already-landed work. Scoped to the empty-branch rejection; any other
+    // rejection already carries its own specific notes.
+    if (step.name === "Review" && alreadyMergedSha && /no commits ahead of main/i.test(summary)) {
+      rejectionNotes += "\n\nCORRECTIVE (from the workflow, not the reviewer): the deliverable is already on main — the workflow mechanically verified that " + alreadyMergedSha + " is an ancestor of main. Do NOT re-implement the work and do NOT create a new commit for it. In your Build report, declare exactly: repo_diff: none (already-merged: " + alreadyMergedSha + ") — then end with VERDICT: PASS.";
+      log("Rework corrective appended for task " + taskId + ": already-merged " + alreadyMergedSha + " — Wren must declare, not rebuild");
+    }
     i = BUILD_INDEX;
     log("Review rejected — bouncing to Build (rework #" + reworkCount + ")");
     continue;

package/workflows/crew-init.js

@@ -350,6 +350,7 @@ log("Scaffold: " + scaffoldCreated + " created, " + scaffoldSkipped + " skipped"
 // projects later via crew-api.js create-project.
 phase("project");
 var projectResult;
+var initialProvenanceWarning = null;
 if (!dashboardSlug) {
   log("Project: skipped (CLI-only mode — no dashboard; create projects via crew-api.js create-project)");
   projectResult = { action: "skipped", project_id: null };
@@ -380,7 +381,8 @@ try {
     "      Return { action: \"repaired\", project_id: \"" + dashboardSlug + "\" }.\n" +
     "3. If not found (error), create it:\n" +
     "   node " + crewHome + "/current/lib/crew-api.js --crew-home " + crewHome + " create-project --json '{\"id\": \"" + dashboardSlug + "\", \"display_name\": \"" + safeDashboardName + "\", \"repo_path\": \"" + safeDashboardRepo + "\", \"deploy_type\": \"artifact\", \"deploy_slug\": \"" + dashboardSlug + "\", \"environment_type\": \"artifact\", \"description\": \"The dashboard task service — the crew\\u0027s first project\"}'\n" +
-    "   Return { action: \"created\", project_id: \"" + dashboardSlug + "\" }.\n\n" +
+    "   The create-project response carries initial_provenance { stamped, reason?, source_commit?, crew_release? } — pass it through verbatim.\n" +
+    "   Return { action: \"created\", project_id: \"" + dashboardSlug + "\", initial_provenance: <the verbatim initial_provenance object> }.\n\n" +
     "4. Seed the update watcher's trusted dashboard base (enrollment) — the\n" +
     "   commit this installation starts from. Only ever seeds when no base\n" +
     "   exists; an established base is never moved by a re-init:\n" +
@@ -394,7 +396,7 @@ try {
     "      dashboard upgrade with oldSha unknown and park it with enrollment\n" +
     "      guidance, fail-closed.\n\n" +
     "The repo_path must be the dashboard git repository — never the crew home.\n" +
-    "Return JSON with action (\"exists\", \"repaired\", or \"created\") and project_id (string).",
+    "Return JSON with action (\"exists\", \"repaired\", or \"created\"), project_id (string), and — only when action is \"created\" — the create-project response's initial_provenance object verbatim.",
     {
       key: "project-1",
       label: "Register dashboard project",
@@ -402,7 +404,8 @@ try {
         type: "object",
         properties: {
           action: { type: "string", enum: ["exists", "repaired", "created"] },
-          project_id: { type: "string" }
+          project_id: { type: "string" },
+          initial_provenance: { type: "object" }
         },
         required: ["action", "project_id"]
       }
@@ -412,8 +415,59 @@ try {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Project registration failed", message: String(e.message || e) } };
 }
 log("Project: " + dashboardSlug + " " + projectResult.action + " (repo_path=" + gateFacts.dashboardRepoExpanded + ")");
+if (projectResult && projectResult.action === "created" &&
+    projectResult.initial_provenance && !projectResult.initial_provenance.stamped) {
+  // Room #15 (reliability): create-project's initial stamp is best-effort,
+  // but "reported" used to mean "returned into the void" — zero production
+  // code read it, so a skipped stamp (the J1/J2 shape) stayed invisible.
+  // Surface it here; the publish-base advance below re-stamps right after,
+  // and fails loudly (exit 1) if the re-stamp itself cannot stamp.
+  initialProvenanceWarning = "Project created but its initial provenance stamp was skipped (" +
+    (projectResult.initial_provenance.reason || "unknown reason") +
+    ") — the publish-base advance re-stamps it next; if that also fails, the first task's publish diffs from the empty tree.";
+  log("WARNING: " + initialProvenanceWarning);
+}
 } // end dashboard-mode project registration
 
+// ── Artifact target verification (room #16 blocker 10, 2026-09-18) ──
+// Setup owns the invariant: deploy_slug ⇒ artifact exists. The dashboard
+// project is registered with deploy_slug = dashboardSlug, but registration
+// alone does not create the artifact — the artifact is a platform primitive
+// created by the human via the Muse UI (docs/guide.md prerequisite: "A task
+// service artifact already created"). If the target directory is missing,
+// init blocks loudly: a dangling deploy_slug would otherwise let the first
+// task reach Publish and fail opaquely. This is not a provisioner — the
+// human creates the artifact; init only verifies and refuses to proceed
+// without it.
+if (dashboardSlug) {
+  // The slug is interpolated into a shell command — reject an unsafe shape
+  // rather than risking injection (dashboardSlug comes from init args).
+  if (!/^[a-zA-Z0-9_-]+$/.test(dashboardSlug)) {
+    return { __hatchWorkflowControl: "blocked", result: {
+      blocked_reason: "Dashboard slug has an unsafe shape",
+      message: "dashboardSlug \"" + dashboardSlug + "\" contains characters outside [a-zA-Z0-9_-]. The slug is used in shell paths and as the artifact key — choose a safe slug and re-run init."
+    } };
+  }
+  var artifactTargetCheck = await agent(
+    "Verify the dashboard artifact target exists.\n" +
+    "Run in shell: test -d ~/workspace/ts-spaces/" + dashboardSlug + "/ && echo ARTIFACT_TARGET: present || echo ARTIFACT_TARGET: missing\n" +
+    "Return JSON { \"signal\": \"<the exact ARTIFACT_TARGET line>\" } and nothing else.",
+    {
+      key: "artifact-target-verify",
+      label: "Verifying dashboard artifact target exists",
+      schema: { type: "object", properties: { signal: { type: "string" } }, required: ["signal"] }
+    }
+  );
+  var artifactSignal = String((artifactTargetCheck && artifactTargetCheck.signal) || "");
+  if (!/ARTIFACT_TARGET:\s*present/.test(artifactSignal)) {
+    return { __hatchWorkflowControl: "blocked", result: {
+      blocked_reason: "Dashboard artifact target missing",
+      message: "The dashboard project is registered with deploy_slug \"" + dashboardSlug + "\", but the artifact target directory ~/workspace/ts-spaces/" + dashboardSlug + "/ does not exist. An artifact is a Muse platform primitive (a hosted web app) — the crew never creates artifacts, it only edits existing ones. Create the artifact from your dashboard repo via the Muse UI first (see docs/guide.md prerequisites), then re-run init. Init will not complete with a deploy_slug that points to nothing: the first task's Publish would otherwise fail with a confusing error."
+    } };
+  }
+  log("Artifact target verified: ~/workspace/ts-spaces/" + dashboardSlug + "/ exists");
+}
+
 // ── Project repo setup (2026-09-18) ─────────────────────────────────
 // One deterministic composer — lib/setup-project-repo.js — scaffolds
 // $REPO/.orchestration/, applies the consented .gitignore update, and COMMITS
@@ -512,7 +566,7 @@ if (dashboardRepoPath && projectResult && projectResult.action === "created" &&
     publishBaseResult = await agent(
       "Run the deterministic publish-base advance script. Do not decide anything — just run the command and return its JSON output.\n\n" +
       "Command:\n" +
-      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-created\n\n" +
+      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-id " + projectResult.project_id + " --project-created\n\n" +
       "The script prints one JSON object: { ok, action, reason?, from?, to? }.\n" +
       "Return that JSON verbatim.",
       {
@@ -801,6 +855,7 @@ return {
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
   repoSetupWarning: setupRepoWarning,
+  initialProvenanceWarning: initialProvenanceWarning,
   crons: cronsResult.summary.crons,
   registry: cronsResult.summary.registry,
   autoUpdate: {