muse-crew 0.13.1 → 0.13.3

package/docs/decisions/workflow-core.md

@@ -0,0 +1,234 @@
+# Decision history: workflow core
+
+Relocated from workflow source comments during H5 (2026-09-18). The workflows keep only the relied-upon invariant inline; the full decision history lives here.
+
+<a id="verdict-reask"></a>
+## Verdict re-ask
+
+Invariant: a verdict-step report that fails extractVerdict gets up to two bounded re-ask calls; the re-ask agent transcribes, never decides; exhaustion keeps fail-closed behavior.
+
+Applies to: standard, bugfix, chore.
+
+```
+// Verdict re-ask (bug cd18ccc2): a verdict-step report that fails
+// extractVerdict is not failed immediately. Stochastic verdict-line
+// non-compliance (the agent did the work but omitted or garbled the VERDICT
+// line) gets up to two bounded follow-up agent() calls whose only job is to
+// read the preserved report and emit exactly one VERDICT line. The verdict
+// is still extracted mechanically by extractVerdict — the re-ask agent
+// transcribes, never decides the phase outcome. Each attempt uses a fresh
+// stable-key suffix so a cached failure can never replay deterministically.
+// Exhaustion keeps the existing fail-closed behavior. This is structure, not
+// prompt hardening: no instruction text was stern-ified to get here.
+```
+
+<a id="park-contract"></a>
+## Park contract + terminal cleanup
+
+Invariant: parking is one atomic parktask action; a failed park reports failed (retryable); terminal cleanup releases the lock and reclaims only fully-merged work.
+
+Applies to: standard, bugfix, chore.
+
+```
+// Park the task for human attention and end the run. "blocked" is never
+// manually authored — the dashboard derives it mechanically from unmet
+// dependencies — so a workflow outcome that needs a human parks the task
+// instead. Parking is one atomic dashboard action (parktask): the parked
+// state and the explanatory note land in one transaction, never half.
+// The dispatcher skips parked tasks; a human moving parked→todo
+// mechanically resets the retry counters. Returns the workflow result
+// envelope the launcher sees. If the park call itself fails, the run
+// reports "failed" (retryable) so the next tick re-attempts the park —
+// a lost park is never reported as parked.
+// Terminal cleanup: the run's last act at every park/fail boundary. A run
+// that parks or fails must not leak its worktree, branch, or merge lock.
+// The lifecycle's terminal-cleanup releases the lock unconditionally and
+// reclaims the worktree+branch ONLY when the task branch is fully merged
+// into main (then it is redundant); unmerged work is preserved for the
+// human by design. Fire-and-forget with one bounded retry — the merge-lock
+// lease expiry and the orphan sweep are the backstop for a dead transport.
+```
+
+<a id="closeout-envelope"></a>
+## Closeout transport envelope
+
+Invariant: the work agent returns the runtime's native transport envelope with no schema; the verdict is extracted mechanically by extractVerdict — never by an agent.
+
+Applies to: standard, bugfix, chore.
+
+```
+  // Work agent returns the runtime's native envelope {"status": "ok",
+  // "result": "<prose>"} with no schema. The runtime requires JSON output;
+  // the envelope is its own documented shape, so there is nothing for the
+  // agent to improvise. The workflow receives the prose report as a plain
+  // string. The verdict is still extracted deterministically from the report
+  // text by extractVerdict below — never by an agent.
+```
+
+<a id="extract-verdict-contract"></a>
+## extractVerdict contract
+
+Invariant: the verdict is the LAST VERDICT: PASS/FAIL line in the report; extraction is mechanical and deterministic.
+
+Applies to: standard, bugfix, chore.
+
+```
+  // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
+  // your report with the verdict). This ignores literal VERDICT strings echoed
+  // from the worker's instructions (which contain quoted examples). Fail
+  // closed if: no verdict found, the last verdict is not in the trailing 100
+  // chars (verdict must be at the end), or conflicting verdicts appear in the
+  // trailing 200 chars. Word boundary prevents "PASSING" matching as PASS.
+```
+
+<a id="rework-attempt-key"></a>
+## Rework attempt key
+
+Invariant: rework attempts are keyed deterministically; the count is a parameter because chore names it differently.
+
+Applies to: standard, bugfix, chore.
+
+```
+// replay-key scoping for bug 1b8bb875 — runtime keys agent() calls by explicit key per workflow process; on in-process rework a re-executed phase must mint fresh keys; uses the same -r<N> suffix as the phase loop; pure function of inputs, no clock, no randomness (determinism contract). The count is a parameter because chore.js names the counter reworkCount while standard.js/bugfix.js name it totalReworkCount.
+```
+
+<a id="ux-doctrine-mirror"></a>
+## UX doctrine mirror
+
+Invariant: workflows mirror the UX doctrine map inline (relative-import support unverified); prompts read UX_DOCTRINE_PATH.
+
+Applies to: standard, bugfix, chore.
+
+```
+// UX doctrine page: the shared UX bar for this run's surface, resolved
+// mechanically — every phase prompt reads UX_DOCTRINE_PATH, never a
+// hardcoded filename. Canonical map: lib/ux-doctrine.js (mirrored here as a
+// one-liner because the workflow runtime's relative-import support is
+// unverified; tests pin the mirror). Null on unclassified surfaces: no
+// shared page, and prompts say so instead of naming the wrong one.
+```
+
+<a id="replay-key-scoping"></a>
+## Replay-key scoping
+
+Invariant: runtime keys agent() calls by explicit key per workflow process; on in-process rework a re-executed phase mints fresh keys with the -r<N> suffix.
+
+Applies to: standard, bugfix, chore.
+
+```
+// replay-key scoping for bug 1b8bb875 — runtime keys agent() calls by explicit key per workflow process; on in-process rework a re-executed phase must mint fresh keys; uses the same -r<N> suffix as the phase loop; pure function of inputs, no clock, no randomness (determinism contract). The count is a parameter because chore.js names the counter reworkCount while standard.js/bugfix.js name it totalReworkCount.
+```
+
+<a id="transport-retry"></a>
+## Transport retry
+
+Invariant: the work-agent agent() call can throw even when the agent did the work; retry boundedly with fresh keys before failing closed; re-entry is safe.
+
+Applies to: standard, bugfix, chore.
+
+```
+// Transport retry: the work-agent agent() call can throw even when the agent
+// did the work. Stochastic envelope non-compliance (bare prose instead of
+// the native {"status":"ok","result":"..."} envelope) trips the runtime's
+// JSON-candidate heuristic when the prose contains a {...}-looking
+// substring — canary 39457ee9's QA report quoted the change's own
+// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
+// and the workflow discarded a complete VERDICT: PASS report as "no output".
+// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
+// this covers the report never arriving. The assignment is retried boundedly
+// with fresh keys (never a cached replay) before failing closed. Re-entry is
+// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
+// retry trailer tells the agent to check existing state first and report
+// rather than duplicate completed side effects, and the rework path already
+// re-runs Build after rejection — Build re-entry is an established pattern.
+```
+
+<a id="honest-classification"></a>
+## Honest classification
+
+Invariant: classify work-agent calls that yield no usable output honestly.
+
+Applies to: standard, bugfix, chore.
+
+```
+  // Honest classification of a work-agent call that yielded no usable
+  // report, with the per-attempt evidence preserved in the session notes.
+  // Two distinct cases:
+  // - agent() THREW: the runtime discarded output it could not machine-read
+  //   (e.g. prose tripping the JSON-candidate heuristic). The raw output is
+  //   gone — the workflow never received it — so the surviving error text is
+  //   recorded here instead. (An earlier comment claimed the raw output was
+  //   "preserved in the run record"; that was false — nothing preserved it —
+  //   and the claim is removed.)
+  // - agent() RETURNED EMPTY without throwing: the child produced nothing
+  //   usable. Each attempt's outcome is the evidence.
+  // attempts: [{threw, error, outcome}, ...], in order.
+```
+
+<a id="oneshot-recovery"></a>
+## One-shot recovery
+
+Invariant: the dispatcher sets input for one-shot recovery routing.
+
+Applies to: standard, bugfix, chore.
+
+```
+// One-shot recovery routing: the dispatcher sets inputs.next_phase when it
+// routes this run via an explicit recover-task redirect. The value is
+// consumed (cleared) atomically by the successful self-claim below:
+// claim-task takes expected_next_phase and clears the matching next_phase in
+// the same transaction as the winning session insert, so no platform death
+// can slip between claim and consumption and replay the routing. A stale or
+// superseded routing survives — only an exact match clears.
+// what the dispatcher routed on.
+```
+
+<a id="discarded-reason"></a>
+## Discarded reason
+
+Invariant: the runtime threw the output away; reason is discarded.
+
+Applies to: standard, bugfix, chore.
+
+```
+  // reason: "discarded" (the runtime threw the output away - it could not be
+  // machine-read), "empty" (agent() returned without throwing but produced
+  // nothing usable), "no-tools" (the worker's TOOL CHECK reported
+  // artifact_tools: missing), or "no-transport" (the worker's TOOL CHECK
+  // reported shell_transport: unavailable).
+  // The trailer tells the retry what to expect, not just to try again.
+```
+
+
+<a id="h5-probe-blocked"></a>
+## H5 import probe: blocked, extraction refused (2026-09-18)
+
+Invariant: workflow scripts carry no imports; shared logic is mirrored inline, never imported.
+
+Applies to: standard, bugfix, chore.
+
+```
+# H5 (2026-09-18): the Phase 1 plan was probe-gated on the workflow runtime
+# resolving relative imports of a sibling lib/ module. The probe could not
+# be run: no platform launch capability exists in the build environment
+# (workflow_launch is a platform capability, not a shell command; no local
+# launcher exists), and a local node ESM check would prove nothing about the
+# platform runtime — so it was refused, not faked. Outcome: PROBE-BLOCKED.
+# Extraction without the probe would ship an unverified import into a
+# launch-gated script — a worse defect than the size defect. The failover
+# was measured in-file subtraction: delete dead buildVisualCapturePlan and
+# relocate decision-history narration to docs/decisions/ (this file),
+# keeping inline only the relied-upon invariant. The import question stays
+# an OPEN PLATFORM FINDING; helper extraction (and the Phase 2 publish-block
+# unification) is sequenced follow-up once the runtime's module support is
+# proven by a real launch.
+# Probe outcome, recorded 2026-09-18: the helper-extraction probe was
+# refused as unverified — workflow scripts have no module system
+# (typeof require === "undefined" on the platform runtime), so extraction
+# would have shipped an unverified mechanism into a launch-gated script.
+# The relocation-to-docs/decisions/ failover above was used instead.
+# Sequencing: the next publish-path change must be preceded by the Phase 2
+# publish-phase unification (or equivalent subtraction). bugfix.js sits at
+# 244,349 bytes — 1,411 bytes of headroom under the 245,760-byte target —
+# so an ad-hoc cut under gate pressure is not a plan.
+```

package/docs/guide.md

@@ -17,7 +17,7 @@ This is the full setup and operations reference. If you're new, start with the [
 - A **release** — the first immutable snapshot of the crew's runtime code.
 - An **`.orchestration/` directory** in the crew home with identities, personas, workflow docs, and feedback conventions.
 - A **project registration** — the task service registered as its own first project.
-- **Cron jobs** — the scheduler state declared in `seed/crons.json`: a polling loop (every 15 minutes via Muse's scheduling, even when nobody's in the conversation). The scheduler identity is dashboard-independent — owner `cli:<instance-id>`, chosen once at first init — so deleting the dashboard artifact does not stop the crew. Removing a crew entirely is `crew-uninstall`'s job.
+- **Cron jobs** — the scheduler state declared in `seed/crons.json`: a polling loop (every 15 minutes via Muse's scheduling, even when nobody's in the conversation). The scheduler identity is dashboard-independent — chosen once at first init (no owner; the platform rejects `cli:` owners) — so deleting the dashboard artifact does not stop the crew. Removing a crew entirely is `crew-uninstall`'s job.
 
 The agent running in the main chat receives the dispatcher's claims and launches each task workflow. Workflows can't launch workflows, so this handoff is structural.
 
@@ -63,7 +63,7 @@ Optional arguments:
 - `dashboardName` — display name for the project registration (default: `"Muse Crew"`).
 - `crewName` — the human's chosen name for the crew. Stored as plain text at `$CREW_HOME/crew-name` and returned in the init summary. The setup conversation should always ask for one; init won't fail without it.
 - `cronIds` — manifest id → live id map for parallel instances on one account (default: `{}`). The manifest's ids are used as-is unless overridden, e.g. `{"crew-poll": "crew-poll-canary"}`.
-- `cronOwner` — explicit owner for the created cron jobs. Defaults to `cli:<instance-id>`: the instance id is chosen at first init (the crew-home basename) and kept from `.cron-registry.json` on re-runs, so re-init never renames the crew's jobs.
+- `cronOwner` — explicit owner for the created cron jobs. Defaults to null (omitted): the instance id is chosen at first init (the crew-home basename) and kept from `.cron-registry.json` on re-runs, so re-init never renames the crew's jobs. The platform rejects `cli:` owners.
 - `autoUpdateCrew` — automatic crew upgrades on/off (default: `true`). Persists as the `auto_update_crew` config key; `false` turns the update watcher's crew check off.
 - `autoUpdateDashboard` — automatic dashboard upgrades on/off (default: `true`). Persists as the `auto_update_dashboard` config key.
 - `updateChannel` — `latest` (default) or `patch`: narrows crew upgrades to patch releases. Persists as the `update_channel` config key; any other value fails the init.
@@ -79,7 +79,7 @@ Init runs five phases, each idempotent — re-running converges anything that dr
 
 3. **Project registration** — registers the task service as a project in its own database via `createproject`, with `repo_path` set to the validated `dashboardRepoPath`. The dashboard becomes its own first project, so the crew can work on the dashboard itself. Re-running init is self-healing: a project already registered with the correct path is left alone, while one with a different path (e.g. from an older init) is repaired via `update-project`. Skipped entirely in CLI-only mode (no `dashboardSlug`) — create projects with `crew-api.js create-project` instead.
 
-4. **Crons** — reads the manifest at `seed/crons.json` and makes the scheduler match it: missing jobs are created from the entry (title, enabled, mode, schedule, owner, timeout_secs, and the body built from the entry's template with `crewHome` substituted in); existing jobs are viewed and converged — drifted fields are updated, unchanged jobs are left alone. The scheduler identity (`instanceId`, `cli:<instanceId>` owner) is chosen once at first init and never renamed by re-runs: the instance id comes from the existing `.cron-registry.json` when present, otherwise the crew-home basename. One exception: init never touches `enabled` on an existing job. `enabled` is a creation-time default only — a disabled job is a deliberate human decision, and re-init must not silently resurrect it. Jobs removed from the manifest are left alone; deletion is a human decision.
+4. **Crons** — reads the manifest at `seed/crons.json` and makes the scheduler match it: missing jobs are created from the entry (title, enabled, mode, schedule, timeout_secs, and the body built from the entry's template with `crewHome` substituted in — owner is omitted); existing jobs are viewed and converged — drifted fields are updated, unchanged jobs are left alone. The scheduler identity (`instanceId`) is chosen once at first init and never renamed by re-runs: the instance id comes from the existing `.cron-registry.json` when present, otherwise the crew-home basename. One exception: init never touches `enabled` on an existing job. `enabled` is a creation-time default only — a disabled job is a deliberate human decision, and re-init must not silently resurrect it. Jobs removed from the manifest are left alone; deletion is a human decision.
 
 5. **Update policy** — persists the automatic-update policy (`auto_update_crew`, `auto_update_dashboard`, `update_channel`) via the Crew API's `update-config`, with the re-init semantics above: explicit inputs win, existing values survive, defaults apply only on first init. Seeds `$CREW_HOME/.update-watch.json` as `{}` only when it does not exist (the watcher's idempotency record is never overwritten).
 

package/docs/visual-verdict.md

@@ -98,13 +98,12 @@ Triggered by the Capture phase when the task is experiential and no
 baseline evidence is recorded yet. The workflow logs
 `baseline: requested (attempt N)` and parks; the parent then:
 
-1. Run the deterministic capture plan:
-   `buildVisualCapturePlan(taskTitle, taskDescription, "baseline", captureTargets)`
-   — desktop 1440x900 top, desktop 1440x900 target-centered, mobile 390x844
-   target-centered, hover, keyboard focus, active/pressed where applicable,
-   plus console error count, the ARIA tree of the target region, and any
-   horizontal overflow. Capture targets come from the Map step's
-   `capture_targets:` line; if none, fall back to the task description.
+1. Run the deterministic capture plan — desktop 1440x900 top, desktop
+   1440x900 target-centered, mobile 390x844 target-centered, hover,
+   keyboard focus, active/pressed where applicable, plus console error
+   count, the ARIA tree of the target region, and any horizontal overflow.
+   Capture targets come from the Map step's `capture_targets:` line; if
+   none, fall back to the task description.
 2. Save the captures under `$CREW_HOME/task-evidence/<task-id>/baseline/`.
 3. Log the task note event:
    `baseline: captured <space-separated evidence refs>`

package/lib/compose-evidence-caption.js

@@ -22,6 +22,14 @@
 // Missing deploy_slug, missing dir, or missing PNGs gets the honest
 // no-captures line; terminal surfaces are named, not assumed.
 //
+// Freshness gate (2026-09-18, room #17): seeing the files is not enough —
+// the composer may claim captures ONLY when both PNGs exist AND both file
+// mtimes are strictly newer than task.created_at. That is all the gate
+// proves: captures from an earlier attempt on the same task are also newer
+// than creation, so the gate cannot tell them apart from this run's
+// captures — it excludes only captures predating the task. Missing or
+// unparseable created_at fails closed: the captures are never claimed.
+//
 // Usage:
 //   node lib/compose-evidence-caption.js --crew-home <home> \
 //     --task-id <id> --audit-dir <resolved-dir-name>
@@ -93,17 +101,40 @@ const project = (state.projects || []).find((p) => p.id === task.project);
 // Capture guard (2026-09-17, room #14): resolve the audit dir the audit
 // harness actually writes and verify the captures exist before claiming
 // them. A bare --audit-dir name is never trusted on its own.
-function isFile(p) {
-  try { return fs.statSync(p).isFile(); } catch { return false; }
+// Parse task.created_at (ISO-8601 UTC from the API, e.g. "...T...Z") to
+// epoch ms. Missing/unparseable values return NaN and the caller fails
+// closed: captures are never claimed without a trustworthy creation time.
+// Note: only the space-form legacy timestamp is normalized to UTC; a
+// T-form WITHOUT a zone marker parses as local time. Neither is a
+// documented input shape, and the machine runs UTC — no live impact.
+function parseCreatedAtMs(s) {
+  if (typeof s !== "string" || !s) return NaN;
+  // Legacy sqlite rows may carry "YYYY-MM-DD HH:MM:SS" (UTC, no zone
+  // marker), which V8 parses as LOCAL time — a timezone-sized skew that
+  // could fail the gate open. Normalize the space form to UTC.
+  const iso = s.includes("T") ? s : s.replace(" ", "T") + "Z";
+  const ms = Date.parse(iso);
+  return Number.isFinite(ms) ? ms : NaN;
+}
+// Strictly newer: an mtime exactly equal to created_at is stale — the
+// capture cannot predate the task it evidences, but "same instant" proves
+// nothing. (Only "newer than task creation" is proven: captures from an
+// earlier attempt on the same task pass this check too.)
+function isFreshFile(p, createdAtMs) {
+  try {
+    const st = fs.statSync(p);
+    return st.isFile() && st.mtimeMs > createdAtMs;
+  } catch { return false; }
 }
 let auditPath = null;
 if (project && project.deploy_slug) {
   auditPath = path.join(os.homedir(), "workspace", "ts-spaces",
     project.deploy_slug, "audits", auditDir);
 }
-const hasCaptures = !!(auditPath &&
-  isFile(path.join(auditPath, "screenshot.png")) &&
-  isFile(path.join(auditPath, "screenshot-mobile.png")));
+const createdAtMs = parseCreatedAtMs(task.created_at);
+const hasCaptures = !!(auditPath && Number.isFinite(createdAtMs) &&
+  isFreshFile(path.join(auditPath, "screenshot.png"), createdAtMs) &&
+  isFreshFile(path.join(auditPath, "screenshot-mobile.png"), createdAtMs));
 
 let events = [];
 try {

package/lib/crew-api.js

@@ -1675,6 +1675,13 @@ commands["resolve-publish-unknown"] = (db, args, ctx) => {
   if (evidenceDirs.length === 0) {
     return { resolved: false, reason: "no audit build completed inside the publish window — still unknown" };
   }
+  // (N3) Ambiguity guard: multiple builds in the recovery window have the
+  // same attribution ambiguity as the workflow's immediate verdict — no
+  // single dir can be attributed to this attempt, so resolution stays
+  // unknown. Only when exactly one dir remains is evidenceDirs[0] safe.
+  if (evidenceDirs.length > 1) {
+    return { resolved: false, reason: `audit-dir ambiguity: ${evidenceDirs.length} audit dirs inside the publish window — still unknown` };
+  }
   const evidenceDir = evidenceDirs[0];
 
   // Corroboration, observation only: the audit harness's own verdict.
@@ -1700,7 +1707,7 @@ commands["resolve-publish-unknown"] = (db, args, ctx) => {
     db.prepare(
       "INSERT INTO events (id, type, task_id, identity, message, timestamp) VALUES (?, 'note', ?, NULL, ?, ?)"
     ).run(uuid(), taskId,
-      `Parked: publish: verification-requested ${latest.commit} (build agent_id unobserved) — recovered from publish-unknown via resolve-publish-unknown; durable evidence ${evidenceDir}. Parent: run docs/publish-verification.md.`,
+      `Parked: publish: verification-requested ${latest.commit} (build agent_id unobserved) — recovered from publish-unknown via resolve-publish-unknown; durable evidence ${evidenceDir}. waiting on the manual read-back in docs/publish-verification.md.`,
       tsLater);
     db.prepare("UPDATE tasks SET state = 'parked', updated_at = ? WHERE id = ?").run(tsLater, taskId);
     db.exec("COMMIT");

package/lib/crew-release.sh

@@ -73,9 +73,12 @@ cmd_init() {
   echo "CURRENT: $cur"
 }
 
-# ── workflow syntax validation ──────────────────────────────────────
-# Every workflow script must parse before a release can install.
+# ── workflow validation ─────────────────────────────────────────────
+# Every workflow script must (a) parse under the workflow-loader emulation
+# and (b) fit the launch budget before a release can install.
+# Exit codes: 10 = parse check failed, 20 = size check failed (0 = pass).
 _validate_workflows() {
+  # --- Parse gate (restored 2026-09-18, finding B2) ---
   # The workflow runtime accepts top-level `export`, `return`, and `await`
   # (it wraps scripts in an async function), so neither `node --check` on the
   # raw .js (vacuous for ESM — exits 0 even on blatant syntax errors) nor a
@@ -83,8 +86,23 @@ _validate_workflows() {
   # Emulate the runtime instead: strip `export`, wrap the script in an async
   # function, then node --check the result. Tokenizer errors (e.g. an
   # unterminated string literal) still fail under the wrap.
+  #
+  # HONESTY NOTE: this is a provisional emulation, not a verification. The
+  # platform's actual loading mechanism was never verified (probe blocked,
+  # 2026-09-18), so this check cannot prove how the platform loads the
+  # workflows. What it DOES prove: the file is syntactically well-formed JS
+  # when read the way the runtime claims to read it (strip export, run as one
+  # async function body). What it does NOT prove: that the platform actually
+  # loads it that way, or that the code runs correctly. The export-strip +
+  # async-wrap transform exists precisely because raw `node --check` on ESM
+  # `.js` is unreliable — it silently exits 0 on some malformed input — so
+  # the transform is what makes the check actually parse.
+  # A failure here is a signal to INSPECT THE CODE, never to delete the
+  # check: this gate was once removed on a misdiagnosis ("the check
+  # false-positives"), and the workflows it rejected turned out to be
+  # genuinely broken (2026-09-18, Gate 1 H2 — a true positive).
   local dir="$1"
-  local f tmp base
+  local f tmp base size
   tmp="$(mktemp -d)"
   for f in "$dir"/workflows/*.js; do
     [ -f "$f" ] || continue
@@ -96,13 +114,28 @@ _validate_workflows() {
     } > "$tmp/$base.js"
     if ! node --check "$tmp/$base.js" 2>"$tmp/$base.err"; then
       cat "$tmp/$base.err" >&2
-      echo "VALIDATION FAILED: $f does not parse" >&2
+      echo "VALIDATION FAILED [parse]: $f does not parse under the workflow-loader emulation" >&2
       rm -rf "$tmp"
-      return 1
+      return 10
     fi
   done
   rm -rf "$tmp"
-  echo "VALIDATED: workflow scripts parse"
+
+  # --- Size gate (H5, 2026-09-18) ---
+  # The platform reads the full workflow file on launch; the platform hard
+  # maximum is 262144 bytes (256 KiB) and 245760 bytes (240 KiB) is the
+  # project's safety target. The release fails closed if any launchable
+  # workflow hits the safety target.
+  for f in "$dir"/workflows/*.js; do
+    [ -f "$f" ] || continue
+    size="$(wc -c < "$f")"
+    if [ "$size" -ge 245760 ]; then
+      echo "VALIDATION FAILED [size]: $f is $size bytes (>= 245760 byte launch budget)" >&2
+      return 20
+    fi
+  done
+
+  echo "VALIDATED: workflow scripts parse and fit the launch budget"
 }
 
 # ── workflow doc sync ───────────────────────────────────────────────
@@ -255,10 +288,19 @@ cmd_deploy() {
       rm -rf "$staging_dir"
       die "release $hash rejected: registry build failed"
     fi
-    # Gate: refuse to install a release whose workflow scripts don't parse.
-    if ! _validate_workflows "$staging_dir"; then
+    # Gate: refuse to install a release whose workflow scripts fail the
+    # parse or size checks. _validate_workflows returns 10 on a parse
+    # failure, 20 on a size-budget failure; the rejection names the check
+    # that failed so the message is never misleading.
+    _vw_status=0
+    _validate_workflows "$staging_dir" || _vw_status=$?
+    if [ "$_vw_status" -ne 0 ]; then
       rm -rf "$staging_dir"
-      die "release $hash rejected: workflow syntax validation failed"
+      case "$_vw_status" in
+        10) die "release $hash rejected: workflow parse check failed" ;;
+        20) die "release $hash rejected: workflow size-budget check failed" ;;
+        *)  die "release $hash rejected: workflow validation failed (unexpected exit $_vw_status)" ;;
+      esac
     fi
     # Atomic rename into place
     mv "$staging_dir" "$release_dir"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,
@@ -29,4 +29,4 @@
   "dependencies": {
     "playwright-core": "1.63.0"
   }
-}
+}

package/seed/crons.json

@@ -5,7 +5,6 @@
       "enabled": true,
       "id": "crew-poll",
       "mode": "task",
-      "owner": "cli:{instanceId}",
       "schedule": {
         "every": "15m",
         "kind": "interval"
@@ -18,7 +17,6 @@
       "enabled": true,
       "id": "crew-update-watch",
       "mode": "task",
-      "owner": "cli:{instanceId}",
       "schedule": {
         "every": "24h",
         "kind": "interval"

package/workflows/AGENTS.md

@@ -4,7 +4,9 @@ Executable Muse workflow scripts (JavaScript). These are what the workflow runti
 
 - `crew-dispatch.js` — reads the board, recommends eligible tasks, returns structured launch records (the launched workflow self-claims; the dispatcher never writes claims). Skips tasks on quiesced projects and on projects with no repo_path configured.
 
-All four workflow scripts share byte-identical transport helpers (`workRetryKey`, `buildTransportRetryTrailer`, `describeWorkAgentFailure`, `workerMissingArtifactTools` — pinned by `tests/closeout.test.js`). The transport-retry loop treats a worker report naming the missing artifact tool namespace (bug 3472bf36, a per-launch platform flake) as a retryable attempt with a fresh launch rather than accepting a useless report.
+All four workflow scripts share byte-identical transport helpers (`workRetryKey`, `buildTransportRetryTrailer`, `describeWorkAgentFailure` — pinned by `tests/closeout.test.js`). The transport-retry loop treats a worker report naming the missing artifact tool namespace (bug 3472bf36, a per-launch platform flake) as a retryable attempt with a fresh launch rather than accepting a useless report.
+
+**Growth budget (2026-09-18):** the platform reads the full workflow file on launch; the platform hard maximum is 262144 bytes (256 KiB) and the project's safety target is 245760 bytes (240 KiB). Any change adding net bytes to a workflow already over 240 KiB must subtract ≥ the addition in the same change — see `tests/workflow-size.test.js` and the release-time gate in `lib/crew-release.sh` `_validate_workflows`. Decision-history narration lives in `docs/decisions/`; workflows keep only the relied-upon invariant inline. See `docs/decisions/workflow-core.md#h5-probe-blocked` for why helper extraction was refused and decision history was relocated instead. Target-vs-cap (2026-09-18): the release gate intentionally enforces the 245760-byte target, not just the 262144-byte cap — safe because target ≤ cap, stricter by design.
 - `crew-init.js` — sets up a new crew instance: Gate 0 validates crewHome is workspace-contained and a valid git repo, and (in dashboard mode) validates dashboardRepoPath is workspace-contained and an existing git repo (never auto-created); bootstraps the release system; scaffolds orchestration folders; registers the first project with repo_path set to the validated dashboard repo — skipped in CLI-only mode (no dashboardSlug/dashboardRepoPath), where projects are created later via crew-api.js; creates/converges cron jobs from the declarative manifest (scheduler identity is dashboard-independent: first init uses the crew-home basename, re-runs keep the instanceId recorded in `.cron-registry.json`; owner `cli:<instanceId>` — deleting a dashboard artifact never stops the crew). Idempotent. The crew owns its state via the Crew API (lib/crew-api.js); the dashboard is an optional client and is never a dependency.
 - `standard.js` — default task workflow: Triage → Capture → Map → Build → Review → Integrate → Publish → QA
 - `bugfix.js` — adds Capture after Triage, then Reproduce