muse-crew 0.13.3 → 0.14.1

package/docs/publish-unknown-recovery.md

@@ -0,0 +1,113 @@
+# Publish-unknown recovery (blocker 15, 2026-09-18)
+
+When a standard/bugfix Publish parks with "Publish outcome unknown", the
+artifact-edit trigger went out fire-and-forget and no receipt came back —
+async was planned for, receipt-less was not. The unknown-recovery loop
+closes that gap without re-issuing blindly.
+
+## The note is the state machine
+
+Recovery state lives in the task's `note` events, keyed on machine-written
+`publish: <transition>` markers. Deterministic code (`lib/crew-api.js`) owns
+every transition; the cron tick (Step 4.4) is only the ferry between the
+deterministic steps. The initial park note is the workflow's
+"Publish outcome unknown …" note (no `publish:` marker — the scan matches it
+explicitly); every transition after that is machine-written.
+
+State diagram (latest `publish:` note wins; history is the retry budget):
+
+```
+"Publish outcome unknown" park
+  (< 30m) ──waiting──> scan: waiting (leave alone)
+  (>= 30m) ──scan──> publish: unknown-recovery-claimed <expiry>   (1h lease)
+       │
+       ├─ tick runs lib/classify-publish-absence.js, then
+       │  record-unknown-classification (CAS on the claim expiry):
+       │
+       ├─ verified ──────────> publish: verification-requested <commit>
+       │                        (content IS present; Step 4.5 verifies;
+       │                         ledger: unknown-resolved)
+       ├─ provably-dropped ──> publish: dropped <commit>
+       │                        (queues the retry protocol, next tick)
+       ├─ applied-not-built / ambiguous ──> publish: ambiguous <commit>
+       │                        (terminal; ledger: unknown-classified)
+       ├─ superseded ────────> publish: superseded <commit>  (terminal)
+       └─ deferred ──────────> (no note; the claim expires; the next scan
+                                re-claims and re-classifies)
+```
+
+Retry protocol (Step 4.4, for `publish: dropped` with a free budget):
+
+```
+publish: dropped
+  ── tick: HEAD == commit? no ──> publish: retry-superseded (terminal)
+  ── tick: acquire merge lock publish-retry:<task> (600s); held ──> stop, retry next tick
+  ── tick: re-read content in the lock (classifier)
+       ├─ not provably-dropped ──> record-retry-recheck routes it
+       │    (verified → verification-requested; ambiguous → terminal;
+       │     superseded → terminal; deferred → no-op)
+       └─ provably-dropped ──> publish: retry-intended <commit> <ts>
+            ── trigger (same child shape as the first attempt)
+            ├─ ARTIFACT_EDIT_REFUSED ──> publish: retry-refused (terminal)
+            └─ no refusal ──> publish: retry-issued <commit>
+                 ──> publish: verification-requested <commit> not-before=<ts+20m>
+                     (Step 4.5 skips not-before entries until the window passes)
+                 ──> one -retry1 ledger entry (best-effort)
+            ── release the merge lock (every path)
+```
+
+Crash recovery (fail closed, never re-trigger blind):
+
+- `publish: retry-intended` without `retry-issued` → the next scan mirrors
+  `verification-requested` with `not-before=intended+20m`. The trigger may
+  or may not have gone out; content verification is the arbiter.
+- `publish: retry-issued` without a mirrored request → the next scan writes
+  the missing mirror.
+- Exactly one retry per task, enforced from note history: the scan emits
+  `retry_due` only when no `publish: retry-issued` exists in the task's
+  history — including a retry for an earlier unknown attempt on a reworked
+  task. When the budget is spent, the drop is terminal: `publish: ambiguous`.
+
+## Commands
+
+- `scan-publish-unknown` — the cron scan (Step 4.5 of the old numbering).
+  Returns `{ waiting, due, retry_due, mirrored, skipped }`. `due` entries
+  ferry the classifier inputs: `commit`, `trigger_ts` (from the `submitted`
+  ledger entry — never a time window), `park_ts`, `slug`, `repo_path`,
+  `base` (provenance `source_commit`, else the empty tree), and
+  `claim_expiry` for the record CAS. `retry_due` entries ferry the retry
+  inputs (`commit`, `attempt`, `slug`, `repo_path`, `base`, `ledger_path`).
+- `record-unknown-classification --json '{task_id, claim_expiry, decision}'`
+  — routes the classifier's decision; CAS on the claim expiry (a stale tick
+  records nothing).
+- `record-retry-recheck --json '{task_id, decision}'` — routes the retry
+  protocol's in-lock content re-read; CAS on latest being `publish: dropped`.
+- `resolve-publish-unknown` — the manual one-shot for a single parked task
+  (unchanged; the audit-window contract, not the classifier).
+
+## Classifier (lib/classify-publish-absence.js)
+
+Decides, from the task's repo and the platform's on-disk state, whether the
+dropped edit is proven:
+
+- `verified` — the content IS present (the platform applied it; the receipt
+  was the only thing lost). Never re-issue.
+- `provably-dropped` — the old source is live AND the manifest shows no
+  build since the trigger. Only this decision may retry.
+- `applied-not-built` — the new source is live but no build ran (the
+  trigger reached the platform but the build didn't). Ambiguous outcome,
+  terminal: a retry would double-apply.
+- `ambiguous` — the content check is inconclusive. Never retry blind.
+- `deferred` — not yet quiesced; re-check next tick.
+- `superseded` — HEAD moved past the attempt's commit. Terminal.
+
+The classifier's verified path requires the CURRENT manifest to be a new
+build identity: `built_at` advanced past the trigger AND `content_sha256`
+differs from the pre-trigger baseline the workflow snapshots into the
+submitted ledger entry (design §1.9 — defeats a replayed manifest). When
+the baseline is unavailable the classifier falls back to the time-based
+advance check and notes it; the Step 4.5 verifier (`lib/verify-publish.js`)
+is the strict gate and fails closed without a baseline before stamping.
+Build-in-flight is checked twice bracketing the content read via manifest
+state change (no mtime heuristics), and the suite carries add-only and
+removal-only regression fixtures.

package/lib/AGENTS.md

@@ -24,8 +24,10 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `ux-doctrine.js` — UX-surface doctrine page resolution (2026-09-17): the canonical map from `environment_type` to the crew's shared UX bar (`artifact` → `docs/artifact-ux.md`, `terminal` → `docs/terminal-ux.md`; null/unknown → no page). Pure and deterministic: `doctrinePage(env)`, `doctrinePath(crewHome, env)`, `doctrinePageExists(crewHome, env)`; CLI `--page <env>` / `--path <crewHome> <env>`. Workflows mirror the map inline (one line — the workflow runtime's relative-import support is unverified) and tests pin the mirror against this file.
 - `serve-artifact.js` — local server for a built TS space for experiential QA (2026-09-14): serves `<space-dir>/client/dist` statically and dispatches POST `*/actions` to the compiled server actions with a locally-built Ctx. Prints `READY port=<n>` then serves until killed. Read-only w.r.t. the space directory. Fidelity: the served client and action handlers are the artifact's own built code; the Ctx is locally built (privileged handlers run from the space's own `server/dist/privileged.js` when present; blobs are stored in a per-run temp dir and served back at `/__blobs/<key>`); environment is inherited from the caller. It is not the hosted runtime — tasks that cannot be judged under it must report `NOT POSSIBLE: <reason>`.
 - `readback-disk.js` — deterministic publish content sensor (2026-09-16): reads the on-disk tree the artifact is built/served from and emits the machine-readable findings block (`FILE:`/`ADDED:`/`REMOVED:`/`END_FILE`) that `verify-publish.js` judges. The primary sensor — the LLM-inspector path (`build-readback-request.js`) is manual-fallback only since `artifact_inspect` was removed by the platform 2026-09-14.
+- `publish-content.js` — shared ESM content-primitives for publish verification (2026-09-18, blocker 15): diff parsing (`parseDiff`), findings parsing (`parseFindings`), old-tree occurrence counting (`makeOldCounter`), and the discriminating-line / collision-exemption logic (`discriminatingLines`). Unifies `verify-publish.js` and the unknown-recovery classifier on one judgment so the two paths can never disagree about what a diff proves.
+- `classify-publish-absence.js` — deterministic six-way classifier for publish-parked UNKNOWN outcomes (2026-09-18, blocker 15): decides from durable signals only — the pre-trigger manifest baseline (captured by the workflow into the submitted ledger entry; design §1.9) vs the current manifest's `built_at`/`content_sha256`, `git diff <base> <commit>` discriminating lines against the on-disk source tree, and HEAD vs the publish commit. Outcomes: `provably-dropped` (source shows pre-edit state, manifest NOT advanced past the trigger, HEAD == commit, aged past quiesce — retry once), `verified` (manifest advanced past the trigger AND content_sha256 differs from the pre-trigger baseline — a new build identity, not a replayed manifest; falls back to the time-based advance check with a note when the baseline is absent, and the Step 4.5 verifier fails closed without a baseline), `applied-not-built` (platform build-emission failure; no retry — the 2026-09-12 re-trigger hazard), `ambiguous` (any inconclusive shape — no retry by design), `deferred` (build in flight — manifest changed during the content read, or built within the settle window — or park below quiesce; not a verdict, retry later), `superseded` (HEAD != commit — never retry the old commit). Retry budget is consumed by the classification itself, never by the edit attempt. Never reads the wall clock except for recovery timing; addition-only and removal-only diffs are vacuously satisfied on their empty side.
 - `build-readback-request.js` — builds the LLM-inspector read-back `verbatim_request` from the merge commit's diff (2026-09-14): carries the merged diff as the expected change and asks for an independent read of the artifact's actual source. Retained as the manual fallback; the deterministic `readback-disk.js` is the primary sensor.
-- `verify-publish.js` — mechanical publish verification judge (2026-09-14/16): certifies the read-back findings block against `git diff` (strict `FILE:`/`ADDED:`/`REMOVED:`/`END_FILE` parsing, every added line PRESENT / every removed line ABSENT, HEAD==commit supersession check) and only then stamps provenance. Binary files, mode-only changes, and fully-colliding added hunks fail closed as `unverifiable-content` (2026-09-16, critic findings 1/5) — they can never vacuously stamp. Content-mismatch, unreadable-result, superseded, and stamp failures exit 1 with `publish: verification-failed` and no stamp. Collision exemption (2026-09-15): a removed line occurring in the old tree strictly more times than the diff removes is exempt from ABSENT (zero discriminating power); computed from `git show <base>:<path>`, never the working tree.
+- `verify-publish.js` — mechanical publish verification judge (2026-09-14/16; shared primitives 2026-09-18): certifies the read-back findings block against `git diff` (strict `FILE:`/`ADDED:`/`REMOVED:`/`END_FILE` parsing, every discriminating added line PRESENT / every discriminating removed line ABSENT, HEAD==commit supersession check), then the design §1.9 manifest-freshness gate (current manifest `built_at` advanced past the trigger AND `content_sha256` differs from the workflow's pre-trigger baseline in the submitted ledger entry — a new build identity, not a replayed manifest; missing baseline fails closed), and only then stamps provenance. Diff parsing, findings parsing, and the collision-exemption rules come from the shared `lib/publish-content.js` (the unknown-recovery classifier's own judgment — one definition, never two). Binary files, mode-only changes, and fully-colliding added hunks fail closed as `unverifiable-content` (2026-09-16, critic findings 1/5) — they can never vacuously stamp. Content-mismatch, unreadable-result, superseded, and stamp failures exit 1 with `publish: verification-failed` and no stamp.
 - `update-watch.js` — deterministic automatic update watcher (2026-09-16, zero deps): `node update-watch.js --crew-home <path>` (missing arg → usage, exit 2; every other path exits 0). Watches the public npm registry (`npm view muse-crew version` pinned to `https://registry.npmjs.org/`) vs `crew-release.sh current` and files a `workflow: "upgrade"` task with `source: npm@<version>` when policy (`auto_update_crew`, `update_channel`) and channel gating allow; watches `git ls-remote origin HEAD` on the first `deploy_type=artifact` project vs `$CREW_HOME/.update-watch.json` and files a `workflow: "chore"` task carrying the mechanical dashboard-upgrade journey. Reads the `.crew-version` compatibility anchor at the new ref via `git fetch` + `git show <sha>:.crew-version` (never the working tree) and orders dashboard-led: a declared newer crew files the crew upgrade task FIRST and the dashboard task notes it follows the crew upgrade (declaration bypasses `update_channel`, not the `auto_update_crew=false` opt-out); a declared older crew skips the dashboard leg entirely as a human decision; a missing/invalid/unfetchable anchor fails open to the dashboard leg as today. Idempotency via the same state file (records at file time); check failures log to `$CREW_HOME/update-watch.log` and are never thrown. Safety: only files tasks — never deploys, never touches the artifact/config/scheduler. Run by the daily `crew-update-watch` cron through the `current` symlink (latest release); deliberately NOT in the lib-pinning `PIN_BASENAMES`.
 - `gitignore.js` — deterministic .gitignore management for crew-owned paths (2026-09-17): the crew touches exactly one user-owned file outside `.orchestration/` — the repo's `.gitignore`. `ensureGitignoreEntries(repoPath, entries)` creates the file when missing, appends missing entries (exact line match, no duplicates), preserves existing content byte-for-byte, and is idempotent. `describeGitignoreChange(repoPath, entries)` renders the exact diff for the setup consent conversation. Crew-owned entries: `.worktrees/`, `.orchestration/user/`. CLI: `--repo <path> [--dry-run]`.
 - `repo-orchestration.js` — repository-local `.orchestration/` scaffold (2026-09-17): `scaffoldRepoOrchestration(repoPath, crewRepoPath)` creates `$REPO/.orchestration/{workflows,identities,phases,user}/`, seeds workflows/identities/phases from the crew repo's platform defaults with no-clobber semantics (existing project customizations never overwritten), and writes a README in `user/` explaining it's for local config. Idempotent. CLI: `--repo <path> --crew-repo <path>`.
@@ -34,4 +36,7 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `sample-project.js` — optional sample-project setup (2026-09-17): extracts `seed/sample-project.tar.gz` (stripping the `sample-project/` prefix), `git init`, initial commit. No remote required. Registration happens via the existing `create-project` action — no sample-specific endpoint. CLI: `--tarball <path> --dest <dir> --name <project-name>`.
 - `compute-publish-diff.js` — deterministic publish-diff computer (2026-09-18, room #14): replaces the agent-ferried `git diff` JSON string field (the JSON ferry dropped a valid 700-line diff — "Publish diff parsed to zero files"). Runs `git diff <base> <HEAD>` via argv (no shell), writes the raw diff bytes to `--out`, and prints only a small JSON summary (`commit`, `base`, `diff_file`, `sha256`, `bytes`, `file_count`, `changed_lines` = added+removed, never raw diff output lines, `files`, `has_binary`, `has_rename`). Empty-tree base is the first-publish ancestor (hardcoded, never `merge-base` on the empty tree); non-ancestor is semantic JSON (`ok:false, error:"not-ancestor"`, exit 0); usage errors exit 2 with nothing on stdout. Pinned per-run alongside the other lifecycle files (`COMPUTE_DIFF` in `PIN_BASENAMES`) so a mid-run release swap cannot change it under the workflow.
 - `classify-surface.js` — deterministic project-surface classifier (2026-09-18, room #14 defect): a pure, never-throwing scan of the registered repo — `space.json` present → `artifact` surface (deploy_slug suggestion = `space.json`'s valid slug, verbatim — presence alone still means "web app"), `package.json` with a non-empty `bin` → `terminal` surface, otherwise null (unclassified); artifact wins conflicts (the deployed artifact is what users see, same rule as workflows/standard.js). CLI `--repo-path` prints one JSON object (`{surface, deploy_slug, signals}`), always exit 0 (classification failure is a null result, exit 2 only for usage). `create-project` fills omitted `environment_type`/`deploy_type`/`deploy_slug` from the classification; explicit values (including explicit null) always win and drive the effective surface.
-- `advance-publish-base.js` — publish-base advance past the setup scaffold (2026-09-18, room #14): `create-project` stamps provenance at the pre-scaffold repo HEAD, then crew-init commits `.orchestration/` (+ the consented `.gitignore`) on top — the first task's publish diff would carry the whole scaffold (517 insertions) and blow the 200-line diff-transport budget. The script moves `source_commit` to the scaffold commit only when `--project-created` (the stamp is this init's, never a real publish's), the scaffold commit's parent is exactly the stamped base, and the scaffold touches only crew-owned paths (`.orchestration/`, `.gitignore`); no provenance + root scaffold commit stamps fresh. Every other case skips without touching provenance; `published_at` is preserved on advance. Called from crew-init.js (best-effort, non-fatal). Provenance is per-project (room #15 blocker 8): `--project-id` is required and every read/stamp is project-scoped. CLI: `--crew-home <path> --repo <path> --scaffold-sha <sha> --project-id <id> [--project-created]`.
+- `advance-publish-base.js` — publish-base advance past the setup scaffold (2026-09-18, room #14; testimony-free 2026-09-19 REVIEW): `create-project` stamps provenance at the pre-scaffold repo HEAD, then crew-init commits `.orchestration/` (+ the consented `.gitignore`) on top — the first task's publish diff would carry the whole scaffold (517 insertions) and blow the 200-line diff-transport budget. The script resolves the scaffold commit itself (`git rev-parse HEAD` in `--repo`; `--scaffold-sha` is an explicit override only) and moves `source_commit` to it only when every fail-closed condition holds deterministically: the existing stamp is not a real publish's (provenance.task_id is set by every real publish and null for initial stamps/base advances — the task_id invariant documented on stampProvenance; the old `--project-created` testimony flag is gone), the scaffold commit's parent is exactly the stamped base, and the scaffold touches only crew-owned paths (`.orchestration/`, `.gitignore`); no provenance + root scaffold commit stamps fresh. Every other case skips without touching provenance; `published_at` is preserved on advance. Every stdout JSON object also carries `repo_clean` (informational — whether `git status --porcelain` is empty — so the caller can warn loudly about a dirty tree; the first task's Integrate refuses to merge onto one). Called from crew-init.js (best-effort, non-fatal). Provenance is per-project (room #15 blocker 8): `--project-id` is required and every read/stamp is project-scoped. CLI: `--crew-home <path> --repo <path> --project-id <id> [--scaffold-sha <sha>]`.
+- `scaffold-crew.js` — deterministic crew-home scaffold composer (2026-09-19, Room #19 D1): replaces the agent-authored scaffold report (the agent returned prose instead of the schema'd JSON and the platform rejected it, killing room #19's init on minute one — the copying itself always succeeded). The script copies the fixed file sets (identities *.md+*.png, personas *.md, seed/workflows *.md, seed/feedback/README.md) into `<orchDir>/{identities,personas,workflows,feedback}/` with mkdir -p + no-clobber semantics (existing files never overwritten), verifies every expected file on disk (the decision rule), then writes `<orchDir>/.scaffold-receipt.json` `{created, skipped}` (integer counts, durable evidence) and prints the same JSON to stdout. Idempotent: all-skipped is exit 0. Exit 1 with the reason on stderr on any failure; exit 2 on usage errors. crew-init's scaffold-1 call is a byte courier only — it runs this script and prints the receipt's exact bytes; a paraphrased ferry fails the mechanical parse loudly as a blocked init (tripwire, never a fabricated 0/0). The receipt bytes are the agent's report of script output, not proof the script ran: crew-init corroborates with a witness re-run of this same idempotent composer (a witness that still has files to create proves the ferry's work didn't land; the witness's own disk-verification then holds the end state). Fail-closed source guards (2026-09-19 REVIEW): a missing
+or empty identities/, personas/, or seed/workflows/ source refuses loudly (exit 1,
+naming the source) before creating anything — never an empty 0/0 receipt. No wall-clock reads, no randomness.

package/lib/advance-publish-base.js

@@ -10,8 +10,14 @@
 //
 // This script moves provenance.source_commit to the scaffold commit only when
 // every fail-closed condition holds:
-//   1. --project-created: this init created the project, so the existing stamp
-//      is this run's initial stamp — never a real publish's.
+//   1. The existing stamp is not a real publish's: provenance.task_id is set
+//      by every real publish (lib/verify-publish.js and the workflow
+//      provenance-refresh paths) and is null for initial stamps and for this
+//      script's own base advances. A stamp with task_id set is never moved.
+//      (2026-09-19 REVIEW: this deterministic check replaces the old
+//      --project-created flag, which was agent testimony ferried through the
+//      workflow. The task_id invariant is documented on stampProvenance in
+//      lib/crew-api.js.)
 //   2. The scaffold commit's parent IS the stamped source_commit: nothing
 //      slipped between the stamp and the scaffold, so no un-published task
 //      work can be silently dropped from a future diff.
@@ -19,10 +25,17 @@
 //      (.orchestration/ or .gitignore).
 //   4. Special case: no provenance was ever stamped (empty repo at create
 //      time) and the scaffold commit is the root commit -> stamp fresh.
+// The scaffold commit is resolved by this script itself (git rev-parse HEAD
+// in --repo) unless --scaffold-sha overrides it — the caller never ferries
+// the sha through agent testimony (2026-09-19 REVIEW: agent-mechanic boundary
+// razor — consequential parameters come from deterministic reads, not
+// testimony).
 // Anything else yields { ok: true, action: "skipped", reason } — never an
 // error, never a clobber. stdout carries exactly one JSON object; operational
 // failures go to stderr with a non-zero exit (the caller treats failure as
-// best-effort: init continues with the stamped base).
+// best-effort: init continues with the stamped base). Every JSON object also
+// carries repo_clean (boolean): whether `git status --porcelain` in --repo
+// is empty — informational for the caller, never a gate.
 //
 // No wall-clock reads, no randomness — the published_at on a fresh stamp is
 // left to crew-api's default; on an advance the existing published_at is
@@ -39,7 +52,7 @@ const RELEASE_RE = /^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/;
 
 function usage() {
   console.error(
-    "Usage: node lib/advance-publish-base.js --crew-home <path> --repo <path> --scaffold-sha <sha> --project-id <id> --project-created"
+    "Usage: node lib/advance-publish-base.js --crew-home <path> --repo <path> --project-id <id> [--scaffold-sha <sha>]"
   );
 }
 
@@ -51,7 +64,6 @@ function parseArgv(argv) {
     else if (a === "--repo") out.repo = argv[++i];
     else if (a === "--scaffold-sha") out.scaffoldSha = argv[++i];
     else if (a === "--project-id") out.projectId = argv[++i];
-    else if (a === "--project-created") out.projectCreated = true;
     else {
       console.error("unknown argument: " + a);
       usage();
@@ -90,25 +102,47 @@ function isCrewOwnedPath(p) {
   return p === ".gitignore" || p === ".orchestration" || p.startsWith(".orchestration/");
 }
 
-function skip(reason) {
-  console.log(JSON.stringify({ ok: true, action: "skipped", reason }));
+function skip(reason, repoClean) {
+  console.log(JSON.stringify({ ok: true, action: "skipped", reason, repo_clean: repoClean }));
 }
 
 function main() {
-  const { crewHome, repo, scaffoldSha, projectId, projectCreated } = parseArgv(
-    process.argv.slice(2)
-  );
-  if (!crewHome || !repo || !scaffoldSha || !projectId) {
+  const parsed = parseArgv(process.argv.slice(2));
+  const { crewHome, repo, projectId } = parsed;
+  let scaffoldSha = parsed.scaffoldSha || null;
+  if (!crewHome || !repo || !projectId) {
     usage();
     process.exit(2);
   }
-  if (!SHA_RE.test(scaffoldSha)) {
-    console.error("scaffold-sha is not a 40-char hex sha");
-    process.exit(2);
+  // The scaffold commit is resolved by this script, not ferried through the
+  // caller: --scaffold-sha is an explicit override; otherwise HEAD is read
+  // directly from the repo.
+  if (scaffoldSha) {
+    if (!SHA_RE.test(scaffoldSha)) {
+      console.error("scaffold-sha is not a 40-char hex sha");
+      process.exit(2);
+    }
+  } else {
+    try {
+      scaffoldSha = git(repo, ["rev-parse", "HEAD"]);
+    } catch (e) {
+      console.error("rev-parse HEAD failed: " + (e.message || e));
+      process.exit(1);
+    }
+    if (!SHA_RE.test(scaffoldSha)) {
+      console.error("rev-parse HEAD did not print a 40-char hex sha");
+      process.exit(1);
+    }
   }
-  if (!projectCreated) {
-    skip("project was not created by this init — provenance left untouched");
-    return;
+
+  // Informational for the caller (never a gate): whether the repo worktree
+  // is clean. The caller warns loudly on a dirty tree — the first task's
+  // Integrate refuses to merge onto one.
+  let repoClean = null;
+  try {
+    repoClean = git(repo, ["status", "--porcelain"]) === "";
+  } catch (e) {
+    repoClean = null;
   }
 
   let provenance;
@@ -119,6 +153,19 @@ function main() {
     process.exit(1);
   }
 
+  // Deterministic, not testimony: every real publish stamps provenance with
+  // its task_id (see the task_id invariant on stampProvenance in
+  // lib/crew-api.js); initial stamps and base advances leave it null. A
+  // publish's base is never moved.
+  if (provenance && provenance.task_id) {
+    skip(
+      "provenance was stamped by a real publish (task_id " + provenance.task_id +
+        ") — a publish's base is never moved",
+      repoClean
+    );
+    return;
+  }
+
   // The scaffold commit's parent: empty output means S is the root commit.
   let parent;
   try {
@@ -144,8 +191,7 @@ function main() {
     skip(
       "scaffold commit touches non-crew-owned paths (" +
         foreign.slice(0, 5).join(", ") +
-        ") — provenance left untouched"
-    );
+        ") — provenance left untouched", repoClean);
     return;
   }
 
@@ -154,18 +200,18 @@ function main() {
     // scaffold commit is the root commit — anything else means history we
     // did not create, and we do not invent a base over it.
     if (parent !== null) {
-      skip("no provenance stamped and scaffold commit is not the root commit — provenance left untouched");
+      skip("no provenance stamped and scaffold commit is not the root commit — provenance left untouched", repoClean);
       return;
     }
     let crewRelease = null;
     try {
       crewRelease = resolveActiveRelease(crewHome);
     } catch (e) {
-      skip("no provenance stamped and the active crew release is unresolvable (" + (e.message || e) + ")");
+      skip("no provenance stamped and the active crew release is unresolvable (" + (e.message || e) + ")", repoClean);
       return;
     }
     if (!RELEASE_RE.test(crewRelease)) {
-      skip("no provenance stamped and the active release name is not a valid crew_release (" + crewRelease + ")");
+      skip("no provenance stamped and the active release name is not a valid crew_release (" + crewRelease + ")", repoClean);
       return;
     }
     let stamped;
@@ -183,17 +229,17 @@ function main() {
       console.error("set-provenance did not return ok");
       process.exit(1);
     }
-    console.log(JSON.stringify({ ok: true, action: "stamped", to: scaffoldSha.slice(0, 12) }));
+    console.log(JSON.stringify({ ok: true, action: "stamped", to: scaffoldSha.slice(0, 12), repo_clean: repoClean }));
     return;
   }
 
   const base = provenance.source_commit;
   if (!SHA_RE.test(base || "")) {
-    skip("existing provenance.source_commit is not a 40-char hex sha — provenance left untouched");
+    skip("existing provenance.source_commit is not a 40-char hex sha — provenance left untouched", repoClean);
     return;
   }
   if (base === scaffoldSha) {
-    skip("provenance already points at the scaffold commit");
+    skip("provenance already points at the scaffold commit", repoClean);
     return;
   }
   if (parent !== base) {
@@ -202,8 +248,7 @@ function main() {
         String(parent || "root").slice(0, 12) +
         ") is not the stamped base (" +
         base.slice(0, 12) +
-        ") — provenance left untouched"
-    );
+        ") — provenance left untouched", repoClean);
     return;
   }
 
@@ -219,7 +264,7 @@ function main() {
     }
   }
   if (!crewRelease) {
-    skip("no usable crew_release for the re-stamp — provenance left untouched");
+    skip("no usable crew_release for the re-stamp — provenance left untouched", repoClean);
     return;
   }
 
@@ -259,6 +304,7 @@ function main() {
       action: "advanced",
       from: base.slice(0, 12),
       to: scaffoldSha.slice(0, 12),
+      repo_clean: repoClean,
     })
   );
 }