muse-crew 0.13.3 → 0.14.1

package/lib/verify-publish.js

@@ -39,9 +39,18 @@
 
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
-
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+// Shared content-judgment primitives (2026-09-18, blocker 15): the same
+// diff parser, findings parser, and collision-exemption rules the
+// unknown-recovery classifier uses — one judgment, never two copies.
+import {
+  EMPTY_TREE,
+  parseDiff,
+  parseFindings,
+  makeOldCounter,
+  discriminatingLines,
+} from "./publish-content.js";
 
 function arg(name, required = true) {
   const i = process.argv.indexOf(name);
@@ -67,6 +76,8 @@ const resultFile = arg("--result-file");
 const crewRelease = arg("--crew-release");
 const buildAgentId = arg("--build-agent-id", false);
 const projectId = arg("--project-id");
+const attempt = arg("--attempt", false);  // 2026-09-18, blocker 4: exact attempt binding
+const spacesRoot = arg("--spaces-root", false) || join(homedir(), "workspace", "ts-spaces");
 
 if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
 if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
@@ -135,33 +146,7 @@ try {
 //   ADDED: <line> :: PRESENT|ABSENT
 //   REMOVED: <line> :: PRESENT|ABSENT
 //   END_FILE
-function parseFindings(text) {
-  const findings = new Map(); // path -> { added: Map(line->verdict), removed: Map(line->verdict) }
-  let cur = null;
-  let malformed = null;
-  for (const rawLine of text.split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line.startsWith("FILE: ")) {
-      cur = { added: new Map(), removed: new Map() };
-      findings.set(line.slice(6).trim(), cur);
-    } else if (line === "END_FILE") {
-      cur = null;
-    } else if (cur && (line.startsWith("ADDED: ") || line.startsWith("REMOVED: "))) {
-      const kind = line.startsWith("ADDED: ") ? "added" : "removed";
-      const rest = line.slice(kind === "added" ? 7 : 9);
-      const sep = rest.lastIndexOf(" :: ");
-      if (sep < 0) { malformed = `malformed finding line: ${line.slice(0, 80)}`; break; }
-      const content = rest.slice(0, sep);
-      const verdict = rest.slice(sep + 4).trim();
-      if (verdict !== "PRESENT" && verdict !== "ABSENT") {
-        malformed = `bad verdict: ${verdict}`;
-        break;
-      }
-      cur[kind].set(content, verdict);
-    }
-  }
-  return { findings, malformed };
-}
+// (parsed by the shared parseFindings in lib/publish-content.js)
 
 // --- 2. Expected diff from git (never from the builder's report) -----------
 // The expected change is the publish delta base..commit, using the SAME
@@ -183,21 +168,7 @@ try {
 } catch (e) {
   terminal("read-back-unavailable", `git diff failed: ${e.message}`);
 }
-const expected = new Map(); // path -> { added: [], removed: [], isBinary: bool }
-let curFile = null;
-for (const line of diff.split("\n")) {
-  if (line.startsWith("diff --git")) {
-    const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
-    curFile = m ? m[2] : "unknown";
-    expected.set(curFile, { added: [], removed: [], isBinary: false });
-  } else if (curFile && line.startsWith("Binary files ")) {
-    expected.get(curFile).isBinary = true;
-  } else if (curFile && line.startsWith("+") && !line.startsWith("+++")) {
-    expected.get(curFile).added.push(line.slice(1));
-  } else if (curFile && line.startsWith("-") && !line.startsWith("---")) {
-    expected.get(curFile).removed.push(line.slice(1));
-  }
-}
+const expected = parseDiff(diff); // path -> { added: [], removed: [], isBinary: bool }
 
 // --- 3. Pick the findings candidate that covers the expected diff -----------
 let findings = null;
@@ -232,33 +203,30 @@ if (!findings || bestScore <= 0) {
 // removal into a pass. No change to the sensor: build-readback-request.js
 // still reports whole-file PRESENT/ABSENT honestly; only this judge gets
 // smarter.
-function oldTreeLines(path) {
-  // Exact whole-line contents of <path> at <base>; [] when the base is the
-  // empty tree or the file did not exist there (a new file has no removed
-  // lines, so the exemption is vacuous for it).
-  if (base === EMPTY_TREE) return [];
-  let text;
-  try {
-    text = execFileSync("git", ["-C", repoPath, "show", `${base}:${path}`], {
-      encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-    });
-  } catch {
-    return [];
-  }
-  if (text === "") return [];
-  const lines = text.split("\n");
-  if (lines[lines.length - 1] === "") lines.pop(); // drop the trailing-newline artifact
-  return lines;
-}
-const oldTreeCounts = new Map(); // path -> Map(line -> occurrences in old tree)
-function oldCount(path, line) {
-  let counts = oldTreeCounts.get(path);
-  if (counts === undefined) {
-    counts = new Map();
-    for (const l of oldTreeLines(path)) counts.set(l, (counts.get(l) || 0) + 1);
-    oldTreeCounts.set(path, counts);
-  }
-  return counts.get(line) || 0;
+// Collision exemption (2026-09-15, task 00bca4b8) — decided once by the
+// shared lib/publish-content.js so the verifier and the unknown-recovery
+// classifier can never disagree about what a diff proves:
+//
+// - a removed diff line that also occurs verbatim in untouched code has
+//   zero discriminating power — its presence in the new file cannot tell
+//   "old block removed" from "old block present";
+// - an added line that already occurs in the old tree is reported PRESENT
+//   whether or not the new hunk actually landed — same zero power.
+//
+// Exempting a line can never turn a missed change into a pass: an exempted
+// line must survive in untouched code no matter what. No change to the
+// sensor: build-readback-request.js still reports whole-file PRESENT/ABSENT
+// honestly; only this judge gets smarter. The occurrence counts are
+// computed from `git show <base>:<path>` (never the working tree) by the
+// shared makeOldCounter; the diff may remove the same line more than once
+// and the budget accounting lives in the shared discriminatingLines.
+const oldCount = makeOldCounter(repoPath, base);
+const disc = discriminatingLines(expected, oldCount);
+const discAdded = new Map(); // path -> Set(line): discriminating added lines
+const discRemoved = new Map(); // path -> Set(line): discriminating removed lines
+for (const [p, d] of disc) {
+  discAdded.set(p, new Set(d.addedDisc));
+  discRemoved.set(p, new Set(d.removedDisc));
 }
 
 let exempted = 0;
@@ -277,18 +245,14 @@ for (const [path, exp] of expected) {
       "the diff carries no added/removed lines for this file, so the line-based read-back checked nothing — " +
       "provenance NOT stamped; human verification needed");
   }
-  // (2026-09-16, critic finding 5) Added-line collisions: an added line
-  // that already occurs verbatim in the old tree is reported PRESENT
-  // whether or not the new hunk actually landed — zero discriminating
-  // power (the sensor is membership-only, not count-sensitive). Exempt
-  // such lines from the pass criteria, symmetric to the removed-side
-  // exemption below — and require at least one discriminating added line
-  // per file, or the added-side check is vacuous (finding 1's class).
+  // (2026-09-16, critic finding 5) Added-line collisions: require at least
+  // one discriminating added line per file, or the added-side check is
+  // vacuous (finding 1's class).
   let discriminatingAdded = 0;
   for (const line of exp.added) {
     const v = found.added.get(line);
     if (v === undefined) terminal("unreadable-result", `no ADDED finding for line in ${path}: ${line.slice(0, 60)}`);
-    if (oldCount(path, line) > 0) {
+    if (!discAdded.get(path).has(line)) {
       exempted += 1; // colliding pre-existing line: zero signal, cannot fail a good publish
       continue;
     }
@@ -301,15 +265,11 @@ for (const [path, exp] of expected) {
       "their PRESENT findings cannot tell \"hunk landed\" from \"hunk dropped\" — " +
       "provenance NOT stamped; human verification needed");
   }
-  // The diff may remove the same line more than once; the old tree must
-  // account for every removal before a line counts as a collision.
-  const removedBudget = new Map();
-  for (const line of exp.removed) removedBudget.set(line, (removedBudget.get(line) || 0) + 1);
   for (const line of exp.removed) {
     const v = found.removed.get(line);
     if (v === undefined) terminal("unreadable-result", `no REMOVED finding for line in ${path}: ${line.slice(0, 60)}`);
     if (v === "ABSENT") continue;
-    if (oldCount(path, line) > removedBudget.get(line)) {
+    if (!discRemoved.get(path).has(line)) {
       exempted += 1; // colliding pre-existing line: zero signal, cannot fail a good publish
       continue;
     }
@@ -328,6 +288,63 @@ if (head !== commit) {
   terminal("superseded", `HEAD is ${head}, not ${commit} — a newer publish supersedes this one`);
 }
 
+// --- 5b. Manifest freshness (design §1.9) ------------------------------------
+// The stamp certifies that a NEW build landed for this attempt — not a
+// replayed manifest. The workflow snapshots the pre-trigger manifest into
+// the submitted ledger entry; require (a) the current manifest's built_at
+// advanced past the trigger, and (b) its content_sha256 differs from the
+// pre-trigger baseline (a new build identity). A missing baseline fails
+// closed — without it, freshness cannot be proven.
+// 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
+// attempt is known — the original and retry attempts share a commit, and
+// positional selection is luck. Within one attempt, select the OLDEST
+// submitted entry (the trigger issuance; per blocker 2, audit observations
+// are now "build-observed", not "submitted").
+let triggerTs = null;
+let manifestBefore = null;
+try {
+  const ledgerText = readFileSync(join(crewHome, ".publish-ledger", slug + ".jsonl"), "utf8");
+  const entries = ledgerText.split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
+  // Collect all submitted entries matching (task_id, commit[, attempt]).
+  const candidates = entries.filter((e) =>
+    e.task_id === taskId &&
+    e.outcome === "submitted" &&
+    e.commit === commit &&
+    (attempt == null || e.attempt === attempt)
+  );
+  if (candidates.length > 0) {
+    // Oldest first: the trigger issuance is the first submitted entry for
+    // the attempt (observations are "build-observed" per blocker 2).
+    candidates.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
+    const e = candidates[0];
+    triggerTs = e.ts || null;
+    if (e.manifest_before && typeof e.manifest_before === "object") manifestBefore = e.manifest_before;
+  }
+} catch (e) {
+  terminal("read-back-unavailable", `cannot read publish ledger for freshness check: ${e.message}`);
+}
+if (!triggerTs) {
+  terminal("read-back-unavailable", `no submitted ledger entry for commit ${commit} — the trigger instant is unknowable; freshness cannot be proven`);
+}
+if (!manifestBefore || typeof manifestBefore.content_sha256 !== "string") {
+  terminal("unverifiable-content", `no pre-trigger manifest baseline in the submitted ledger entry — freshness cannot be proven; provenance NOT stamped; human verification needed`);
+}
+let currentManifest = null;
+try {
+  const manifestText = readFileSync(join(spacesRoot, slug, ".space-build", "manifest.json"), "utf8");
+  currentManifest = JSON.parse(manifestText);
+} catch (e) {
+  terminal("read-back-unavailable", `cannot read current manifest for freshness check: ${e.message}`);
+}
+const currentBuiltAtMs = currentManifest && currentManifest.built_at ? Date.parse(currentManifest.built_at) : NaN;
+const triggerMs = Date.parse(triggerTs);
+if (!(currentBuiltAtMs > triggerMs)) {
+  terminal("unverifiable-content", `current manifest built_at ${currentManifest && currentManifest.built_at} did not advance past trigger ${triggerTs} — no new build for this attempt; provenance NOT stamped`);
+}
+if (typeof currentManifest.content_sha256 !== "string" || currentManifest.content_sha256 === manifestBefore.content_sha256) {
+  terminal("unverifiable-content", `current manifest content_sha256 is unchanged from the pre-trigger baseline — a replayed manifest, not a new build; provenance NOT stamped; human verification needed`);
+}
+
 // --- 6. Build-ID correlation (informational; the stamp certifies content) ---
 let buildNote = "build-id-unobserved";
 if (buildAgentId && resultText.includes(buildAgentId)) buildNote = `build-id-correlated ${buildAgentId}`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "muse-crew",
-  "version": "0.13.3",
-  "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
+  "version": "0.14.1",
+  "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,
   "repository": {

package/seed/cron-body-template.md

@@ -35,7 +35,62 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
    - If the acknowledge fails (no reservation exists), DO NOT LAUNCH — the dispatcher did not acquire this task. This is a safety invariant.
    - The launched workflow self-claims the task and clears the reservation as its first actions. If the task was already claimed or is done, the claim fails closed and the run stands down quietly — this is the mechanical duplicate protection, not an error.
 
-   If the dispatcher returned no claims or the claims array is empty, log NO_DISPATCH and CONTINUE to Step 4.5 — do NOT exit. Verification (4.5) and evidence (6) run independently of dispatch claims. A no-claims tick must still verify parked publishes and deliver evidence. (Fixed 2026-09-14: the old "exit on NO_DISPATCH" skipped verification permanently.)
+   If the dispatcher returned no claims or the claims array is empty, log NO_DISPATCH and CONTINUE to Step 4.4 — do NOT exit. Unknown-recovery (4.4), verification (4.5) and evidence (6) run independently of dispatch claims. A no-claims tick must still recover parked publishes, verify them, and deliver evidence. (Fixed 2026-09-14: the old "exit on NO_DISPATCH" skipped verification permanently.)
+
+4.4. **Unknown-recovery (docs/publish-unknown-recovery.md):** tasks parked with "Publish outcome unknown" are the receipt-less trigger gap (2026-09-18, blocker 15). The note is the state machine; deterministic code owns every transition; you are the ferry (scan → classifier → record / retry protocol). Run this BEFORE Step 4.5 so a re-triggered build's mirrored verification-requested is visible to the verification scan on a later tick. Log every list the scan returns.
+   - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-publish-unknown`
+     Returns `{ waiting: [...], due: [...], retry_due: [...], mirrored: [...], skipped: [...] }`. `waiting` = parked < 30m — leave alone, no claim. `mirrored`/`skipped` = already handled by code — log only, take no action.
+   - For each entry in `due`: classify (code), then record the decision (code). Use the entry's fields verbatim.
+     - `node {crewHome}/lib/classify-publish-absence.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<slug>" --trigger-ts "<trigger_ts>" --park-ts "<park_ts>" --task-id <task_id> --manifest-before '<manifest_before JSON>'`
+       Serialize the entry's `manifest_before` field to compact JSON for the `--manifest-before` value; when the entry's `manifest_before` is null, omit the flag (the classifier falls back to the time-based advance check and the Step 4.5 verifier fails closed without a baseline).
+       Exit 0 prints the decision JSON (`{ ok:true, decision, reasons, details }`) — or `{ ok:false, ... }` for a semantic non-verdict. Exit non-zero (usage/git/IO failure) → log the stderr line and LEAVE THE TASK: do NOT record anything; the claim expires and the next tick re-claims. A classifier crash is never a verdict.
+     - `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-unknown-classification --json '{"task_id": "<task_id>", "claim_expiry": "<claim_expiry>", "decision": <classifier stdout JSON>}'`
+       Paste the classifier's stdout verbatim as the decision value. If it returns `recorded: false` → log the reason and continue (another tick owns the task). The routes are the code's — log the returned decision and `routed` value:
+       verified → `publish: verification-requested` (no re-trigger); provably-dropped → `publish: dropped` (queues the retry protocol); applied-not-built / ambiguous → `publish: ambiguous` (terminal); superseded → `publish: superseded` (terminal); deferred → nothing (the claim expires; the next scan re-claims).
+     - Never invent a decision. Never re-trigger the edit for a `due` entry — classification only.
+   - For each entry in `retry_due` (a provably-dropped edit with a free retry budget — exactly one retry per task, enforced from note history; the scan only emits `retry_due` when no `publish: retry-issued` exists in the task's history): run the deterministic retry protocol via `lib/retry-publish.js`. The command owns all lock handling, journaling, diff generation, ledger writes, and cleanup with try/finally lock release — you only mediate the unavoidable `artifact_edit` tool call.
+     
+     Phase 1 — prepare (deterministic):
+     `node {crewHome}/lib/retry-publish.js --crew-home {crewHome} --task-id <task_id> --phase prepare`
+     - Exit 0 with `{"ok": true, "outcome": "ready", ...}`: the merge lock is HELD. The output carries `diff_path`, `diff_sha256`, and `slug`. Proceed to the trigger below.
+     - Exit 0 with `{"ok": true, "outcome": "superseded"|"lock-held"|"not-dropped", ...}`: terminal for this tick. Do NOT proceed to the trigger. If `outcome` is `not-dropped`, the output carries the full `classification` — pass it to `record-retry-recheck`: `node {crewHome}/lib/crew-api.js --crew-home {crewHome} record-retry-recheck --json '{"task_id": "<task_id>", "decision": <classification JSON>}'` and STOP for this task.
+     - Exit non-zero: the command failed (lock released via try/finally). Log the stderr line and STOP — do NOT trigger.
+     
+     Trigger (agent-mediated — the ONLY prose-owned step):
+     Spawn ONE child (subagent) whose first instruction loads the artifact namespace (`tool_search.load_tool_namespace` with paths `["artifact"]`), with this exact brief — the same shape as the workflow's first attempt:
+        "The change to apply is the unified diff in the file \"<diff_path>\" (sha256 <diff_sha256>).
+        1. Verify the file: run sha256sum on it. If the printed hash is not exactly <diff_sha256>, STOP and end your turn — do not call artifact_edit.
+        2. Read the file's full content.
+        3. Call artifact_edit with slug \"<slug>\" and verbatim_request:
+        'Apply the following change to your source tree, then rebuild and deploy.
+
+        UNIFIED DIFF (relative to your source tree):
+        ```diff
+        <the full content of the verified file, pasted verbatim>
+        ```
+
+        Rules:
+        - For each file in the diff, apply its hunks to the same path in your source tree (use git apply or equivalent).
+        - For a new file (--- /dev/null), create it with the added (+) lines as its full content.
+        - For a deleted file (+++ /dev/null), delete it.
+        - If any hunk does not apply cleanly, STOP and report the failure — do not improvise or skip hunks.
+        - Do not make any other source changes.
+        - After applying, rebuild and deploy.'
+        Edit-request contract (read carefully):
+        - Call artifact_edit exactly once with the slug and verbatim_request above. Never retry the edit yourself: if the edit is not accepted, do NOT call artifact_edit again — end your turn.
+        - If artifact_edit explicitly refuses the edit (the call is rejected — e.g. the artifact does not exist), do NOT call artifact_edit again: end your turn with exactly one line and nothing else: ARTIFACT_EDIT_REFUSED: <the refusal text, one line>.
+        - If artifact_edit is not available after the load, do NOT improvise — end your turn.
+        - You do NOT call setprovenance, artifact_inspect, or post-deploy yourself.
+        No report is needed: do not return JSON, do not summarize what you did, do not echo the diff. End your turn after the artifact_edit call."
+        Wait for the child to finish. The child's final text is your only signal.
+     
+     Phase 2 — complete (deterministic):
+     `node {crewHome}/lib/retry-publish.js --crew-home {crewHome} --task-id <task_id> --phase complete --edit-outcome <accepted|refused> [--refusal-text "<first line>"]`
+     - If the child's final text starts with `ARTIFACT_EDIT_REFUSED`: `--edit-outcome refused --refusal-text "<first line of the refusal>"`.
+     - Otherwise: `--edit-outcome accepted`.
+     - The command writes the outcome notes, appends the `-retry1` ledger entry (with the pre-retry `manifest_before` baseline), mirrors verification-requested, and RELEASES the lock in a finally block. Exit 0 means the protocol completed.
+     
+   - Crash rules (fail closed, never re-trigger blind): if this tick dies anywhere in the retry protocol, the note journal is the recovery state. `publish: retry-intended` without `retry-issued` → the next scan mirrors `verification-requested` (never re-triggers). `publish: retry-issued` without a mirrored request → the next scan mirrors it. A leaked merge lock expires after 600s. The next tick's scan never emits `retry_due` for a task with `retry-issued` in history — exactly one retry, enforced from notes, not from the ledger.
 
 4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
@@ -46,7 +101,7 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
      `node {crewHome}/lib/readback-disk.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<deploy_slug>" --task-id <task_id> > /tmp/readback-<task_id>.txt 2> /tmp/readback-<task_id>.err`
      Use the entry's `repo_path` and `deploy_slug` verbatim. If the sensor exits 0, the result file holds the findings block — hand it to the verify step below. If it exits non-zero, do NOT save or use stdout: log `publish: verification-procedural-error <commit> <first line of the .err file>` and leave the task parked — the next tick retries. A sensor failure is procedural (the read could not be performed), never a content verdict. Do NOT judge content yourself, and do NOT stamp provenance.
    - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --project-id <project_id> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
-     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with and the entry's `project_id` verbatim. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
+     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Pass `--attempt <attempt>` from the entry's `attempt` when it is present (2026-09-18, blocker 4: the verifier binds the ledger entry by exact (task_id, commit, attempt) — without the attempt, a retry's trigger is indistinguishable from the original's). Use the SAME `<base>` the sensor ran with and the entry's `project_id` verbatim. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The verify script's machine-checked comparison is the only certification.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.

package/workflows/bugfix.js

@@ -132,7 +132,7 @@ if (!taskId) {
 // See docs/decisions/workflow-core.md#closeout-envelope: the work agent returns the runtime's native envelope; verdict extracted mechanically.
 const VERDICT_STEPS = ["Build", "Review", "QA", "Reproduce", "Integrate", "Publish"];
 function extractVerdict(workerText) {
-  // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
+ // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
   // your report with the verdict). This ignores literal VERDICT strings echoed
   // from the worker's instructions (which contain quoted examples). Fail
   // closed if: no verdict found, the last verdict is not in the trailing 100
@@ -428,6 +428,7 @@ async function recordPublishLedger(entry, rework) {
       attempt: entry.attempt || null,
       agent_id: entry.agent_id || null,
       applied_report: entry.applied_report || null,
+      manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
       detail: entry.detail || ""
     });
@@ -441,9 +442,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -1549,20 +1548,36 @@ while (i < STEPS.length) {
         // See docs/decisions/publish-path.md#durable-evidence-snapshot: snapshot the audit-dir listing BEFORE the trigger; fallback diffs before/after.
         var auditDirsBeforeTrigger = [];
         var auditBeforeOk = false;
+        // Pre-trigger baselines (design §1.9): the audit-dir listing and the
+        // manifest snapshot. The verified-path freshness check compares the
+        // post-trigger manifest against the baseline (built_at advance +
+        // content_sha256 change). Best-effort, never gates — a missing
+        // manifest baseline fails the verified path closed.
+        var preTriggerManifest = null;
         try {
           var auditBefore = await agent(
-            "List the artifact audit directories for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshot, never a gate).\n" +
-            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null\n" +
-            "Return JSON { \"dirs\": \"<newline-separated names, empty string when the audits directory does not exist or is empty>\" } and nothing else.",
-            { key: attemptKey("publish-audit-before-" + taskId, totalReworkCount), label: "Snapshotting audit dirs before rebuild trigger",
-              schema: { type: "object", properties: { dirs: { type: "string" } }, required: ["dirs"] } }
+            "Capture pre-trigger baselines for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshots, never gates).\n" +
+            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null; echo ---MANIFEST---; cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/.space-build/manifest.json 2>/dev/null\n" +
+            "Return JSON { \"dirs\": \"<newline-separated names, empty string when missing>\", \"manifest\": \"<the manifest's full text, or empty string when missing/unreadable>\" } and nothing else.",
+            { key: attemptKey("publish-baseline-before-" + taskId, totalReworkCount), label: "Snapshotting baselines before rebuild trigger",
+              schema: { type: "object", properties: { dirs: { type: "string" }, manifest: { type: "string" } }, required: ["dirs", "manifest"] } }
           );
           auditDirsBeforeTrigger = String((auditBefore && auditBefore.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+          var manifestText = String((auditBefore && auditBefore.manifest) || "").trim();
+          if (manifestText) {
+            var manifestJson = JSON.parse(manifestText);
+            preTriggerManifest = {
+              built_at: typeof manifestJson.built_at === "string" ? manifestJson.built_at : null,
+              content_sha256: typeof manifestJson.content_sha256 === "string" ? manifestJson.content_sha256 : null,
+            };
+          }
+          // Arm only after both baselines parse.
           auditBeforeOk = true;
-          log("Publish audit-dir snapshot before trigger for task " + taskId + ": " + auditDirsBeforeTrigger.length + " entries");
+          log("Publish pre-trigger baselines for task " + taskId + ": " + auditDirsBeforeTrigger.length + " audit dirs, manifest " + (preTriggerManifest ? "built_at=" + preTriggerManifest.built_at : "none"));
         } catch (auditBeforeErr) {
-          log("Publish audit-dir snapshot before trigger failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
+          log("Publish pre-trigger baselines failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
         }
+
         // See docs/decisions/publish-path.md#fire-and-forget-trigger: the trigger child returns immediately; the workflow owns observation and verdict.
         var publishToolsOk = false;
         var publishToolsMissing = false;
@@ -1767,6 +1782,7 @@ while (i < STEPS.length) {
             attempt: rebuildAttemptKey,
             agent_id: rebuildAgentId,
             applied_report: publishAppliedObservation,
+            manifest_before: preTriggerManifest,
             outcome: "submitted",
             detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
           }, totalReworkCount);
@@ -1837,7 +1853,8 @@ while (i < STEPS.length) {
                 attempt: rebuildAttemptKey,
                 agent_id: null,
                 applied_report: publishAppliedObservation,
-                outcome: "submitted",
+                manifest_before: preTriggerManifest,
+            outcome: "build-observed",
                 detail: "durable audit evidence shows a build completed during the attempt window (no receipt agent_id — attribution by window, not identity; receipt poll bypassed (verdict decided), routed to parent verification)"
               }, totalReworkCount);
               log("Publish verdict LANDED for task " + taskId + ": a completed build was observed during the attempt window — receipt poll bypassed (verdict decided, no receipt to chain to), routing directly to parent verification.");
@@ -2109,7 +2126,8 @@ while (i < STEPS.length) {
                 attempt: rebuildAttemptKey,
                 agent_id: rebuildAgentId,
                 applied_report: publishAppliedObservation,
-                outcome: "submitted",
+                manifest_before: preTriggerManifest,
+            outcome: "build-observed",
                 detail: "durable audit evidence shows a build completed during the attempt window (audit dir " + newestAuditDirAfterPoll + ", report ok=true); routed to parent verification"
               }, totalReworkCount);
             } else if (auditOkAfterPoll === false) {
@@ -2172,11 +2190,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2189,7 +2207,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2218,7 +2236,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2811,11 +2829,7 @@ while (i < STEPS.length) {
           { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",
             schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
         );
-        if (provRefresh.refreshed) {
-          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
-        } else if (provRefresh.reason === "no-record") {
-          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
-        } else {
+        if (!provRefresh.refreshed && provRefresh.reason !== "no-record") {
           return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
         }
       } catch (e) {
@@ -2953,9 +2967,10 @@ while (i < STEPS.length) {
     // Success contract (2026-09-18, H2): the parent asked for exactly
     // one build for this publish. The build landed — do NOT republish: a
     // duplicate build would re-publish the same change. content_check=pending
-    // means the parent's independent read-back has not happened yet; this
+    // means parent read-back is pending; this
     // park is NOT proof the content is correct.
     return await parkTask("publish: verification-requested " + mergeCommitForPublish +
+      " attempt=" + rebuildAttemptKey +
       " Do NOT republish: a duplicate build would re-publish the same change. " +
       "Artifact build landed, post-deploy finalized, provenance not stamped — the crew has not yet independently confirmed the live artifact contains exactly the change; waiting on the manual read-back in docs/publish-verification.md. " +
       "Appendix: build=" + (rebuildAgentId || "agent_id unobserved") + "; provenance=unstamped; content_check=pending.");