muse-crew 0.13.3 → 0.14.1

package/workflows/chore.js

@@ -70,7 +70,7 @@ let telemetryBuffer = [];
 async function telemetryStart(workflowName) {
   try {
     const out = await agent(crewCmd("record-run-start", {
-      task_id: taskId, workflow: workflowName, launched_by: "cron"
+      task_id: taskId, workflow: workflowName, launched_by: inputs.launched_by
     }), { key: "telemetry-start", label: "Recording run start" });
     const parsed = typeof out === "string" ? JSON.parse(out) : out;
     if (parsed && parsed.run_id) telemetryRunId = parsed.run_id;
@@ -487,6 +487,7 @@ async function recordPublishLedger(entry, rework) {
       attempt: entry.attempt || null,
       agent_id: entry.agent_id || null,
       applied_report: entry.applied_report || null,
+      manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
       detail: entry.detail || ""
     });
@@ -500,9 +501,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -1455,20 +1454,36 @@ while (i < STEPS.length) {
         // See docs/decisions/publish-path.md#durable-evidence-snapshot: snapshot the audit-dir listing BEFORE the trigger; fallback diffs before/after.
         var auditDirsBeforeTrigger = [];
         var auditBeforeOk = false;
+        // Pre-trigger baselines (design §1.9): the audit-dir listing and the
+        // manifest snapshot. The verified-path freshness check compares the
+        // post-trigger manifest against the baseline (built_at advance +
+        // content_sha256 change). Best-effort, never gates — a missing
+        // manifest baseline fails the verified path closed.
+        var preTriggerManifest = null;
         try {
           var auditBefore = await agent(
-            "List the artifact audit directories for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshot, never a gate).\n" +
-            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null\n" +
-            "Return JSON { \"dirs\": \"<newline-separated names, empty string when the audits directory does not exist or is empty>\" } and nothing else.",
-            { key: attemptKey("publish-audit-before-" + taskId, reworkCount), label: "Snapshotting audit dirs before rebuild trigger",
-              schema: { type: "object", properties: { dirs: { type: "string" } }, required: ["dirs"] } }
+            "Capture pre-trigger baselines for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshots, never gates).\n" +
+            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null; echo ---MANIFEST---; cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/.space-build/manifest.json 2>/dev/null\n" +
+            "Return JSON { \"dirs\": \"<newline-separated names, empty string when missing>\", \"manifest\": \"<the manifest's full text, or empty string when missing/unreadable>\" } and nothing else.",
+            { key: attemptKey("publish-baseline-before-" + taskId, reworkCount), label: "Snapshotting baselines before rebuild trigger",
+              schema: { type: "object", properties: { dirs: { type: "string" }, manifest: { type: "string" } }, required: ["dirs", "manifest"] } }
           );
           auditDirsBeforeTrigger = String((auditBefore && auditBefore.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+          var manifestText = String((auditBefore && auditBefore.manifest) || "").trim();
+          if (manifestText) {
+            var manifestJson = JSON.parse(manifestText);
+            preTriggerManifest = {
+              built_at: typeof manifestJson.built_at === "string" ? manifestJson.built_at : null,
+              content_sha256: typeof manifestJson.content_sha256 === "string" ? manifestJson.content_sha256 : null,
+            };
+          }
+          // Arm only after both baselines parse.
           auditBeforeOk = true;
-          log("Publish audit-dir snapshot before trigger for task " + taskId + ": " + auditDirsBeforeTrigger.length + " entries");
+          log("Publish pre-trigger baselines for task " + taskId + ": " + auditDirsBeforeTrigger.length + " audit dirs, manifest " + (preTriggerManifest ? "built_at=" + preTriggerManifest.built_at : "none"));
         } catch (auditBeforeErr) {
-          log("Publish audit-dir snapshot before trigger failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
+          log("Publish pre-trigger baselines failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
         }
+
         // See docs/decisions/publish-path.md#fire-and-forget-trigger: the trigger child returns immediately; the workflow owns observation and verdict.
         var publishToolsOk = false;
         var publishToolsMissing = false;
@@ -1673,6 +1688,7 @@ while (i < STEPS.length) {
             attempt: rebuildAttemptKey,
             agent_id: rebuildAgentId,
             applied_report: publishAppliedObservation,
+            manifest_before: preTriggerManifest,
             outcome: "submitted",
             detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
           }, reworkCount);
@@ -1743,7 +1759,8 @@ while (i < STEPS.length) {
                 attempt: rebuildAttemptKey,
                 agent_id: null,
                 applied_report: publishAppliedObservation,
-                outcome: "submitted",
+                manifest_before: preTriggerManifest,
+            outcome: "build-observed",
                 detail: "durable audit evidence shows a build completed during the attempt window (no receipt agent_id — attribution by window, not identity; receipt poll bypassed (verdict decided), routed to parent verification)"
               }, reworkCount);
               log("Publish verdict LANDED for task " + taskId + ": a completed build was observed during the attempt window — receipt poll bypassed (verdict decided, no receipt to chain to), routing directly to parent verification.");
@@ -2015,7 +2032,8 @@ while (i < STEPS.length) {
                 attempt: rebuildAttemptKey,
                 agent_id: rebuildAgentId,
                 applied_report: publishAppliedObservation,
-                outcome: "submitted",
+                manifest_before: preTriggerManifest,
+            outcome: "build-observed",
                 detail: "durable audit evidence shows a build completed during the attempt window (audit dir " + newestAuditDirAfterPoll + ", report ok=true); routed to parent verification"
               }, reworkCount);
             } else if (auditOkAfterPoll === false) {
@@ -2078,11 +2096,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2095,7 +2113,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2124,7 +2142,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2438,11 +2456,7 @@ while (i < STEPS.length) {
           { key: attemptKey("publish-provenance-refresh-" + taskId, reworkCount), label: "Refreshing dashboard provenance after crew release",
             schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
         );
-        if (provRefresh.refreshed) {
-          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
-        } else if (provRefresh.reason === "no-record") {
-          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
-        } else {
+        if (!provRefresh.refreshed && provRefresh.reason !== "no-record") {
           return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
         }
       } catch (e) {
@@ -2552,6 +2566,7 @@ while (i < STEPS.length) {
     // means the parent's independent read-back has not happened yet; this
     // park is NOT proof the content is correct.
     return await parkTask("publish: verification-requested " + mergeCommitForPublish +
+      " attempt=" + rebuildAttemptKey +
       " Do NOT republish: a duplicate build would re-publish the same change. " +
       "Artifact build landed, post-deploy finalized, provenance not stamped — the crew has not yet independently confirmed the live artifact contains exactly the change; waiting on the manual read-back in docs/publish-verification.md. " +
       "Appendix: build=" + (rebuildAgentId || "agent_id unobserved") + "; provenance=unstamped; content_check=pending.");

package/workflows/crew-dispatch.js

@@ -794,13 +794,44 @@ if (eligible.length === 0) {
     );
 
     if (fileResult.task_id) {
-      eligible.push({
-        task: { id: fileResult.task_id, title: ptTitle, description: ptDesc, project: ptProject, workflow: "standard", state: "todo" },
-        startStep: qaStepIndex("standard"),
-        reason: "playtest",
-        workflow: "standard"
-      });
-      log("Filed idle playtest \"" + ptTitle + "\" [" + ptProject + "] journey " + pti + "/" + J + ", persona " + ppi + "/" + P + ", max_filings " + maxFilings);
+      // Razor: the filed task_id is testimony. Do an independent witness
+      // re-read of the board before entering eligible — the task must be
+      // observed in todo state, not assumed. The downstream atomic claim
+      // remains the authoritative guard; this is fail-fast, fail-closed.
+      var ptWitnessOk = false;
+      try {
+        var ptBoardRaw = await agent(
+          "Re-read the dispatch state to verify the filed playtest task.\\n" +
+          "Run in shell and return the stdout as a raw string:\\n" + crewCmd("get-dispatch-state", {}) + "\\n" +
+          "Return the command's stdout JSON as a plain string, byte-for-byte, unmodified. " +
+          "Do NOT parse the JSON — your return value must be the raw stdout string, never an object.",
+          {
+            key: "verify-playtest",
+            label: "Verifying filed playtest task"
+          }
+        );
+        var ptBoard = unwrapBoardResult(parseBoardJson(ptBoardRaw));
+        var ptTasks = (ptBoard.ready_tasks || []).map(projectTaskRecord).filter(function (t) { return t !== null; });
+        for (var pti2 = 0; pti2 < ptTasks.length; pti2++) {
+          if (ptTasks[pti2].id === fileResult.task_id && ptTasks[pti2].state === "todo") {
+            ptWitnessOk = true;
+            break;
+          }
+        }
+      } catch (e) {
+        log("Playtest witness re-read failed (" + String(e.message || e) + ") — task not verified, skipping eligible");
+      }
+      if (ptWitnessOk) {
+        eligible.push({
+          task: { id: fileResult.task_id, title: ptTitle, description: ptDesc, project: ptProject, workflow: "standard", state: "todo" },
+          startStep: qaStepIndex("standard"),
+          reason: "playtest",
+          workflow: "standard"
+        });
+        log("Filed idle playtest \"" + ptTitle + "\" [" + ptProject + "] journey " + pti + "/" + J + ", persona " + ppi + "/" + P + ", max_filings " + maxFilings + " (witness observed todo)");
+      } else {
+        log("Idle playtest task " + fileResult.task_id + " not observed in todo state on re-read — skipping eligible (fail-closed)");
+      }
     } else {
       log("Idle playtest filing failed — cursors already advanced, assignment skipped");
     }
@@ -1022,7 +1053,11 @@ if (recommended.length > 0) {
       );
       var reserveParsed = extractJsonObject(reserveOut);
       if (reserveParsed && reserveParsed.acquired) {
-        log("Reserved task " + rec.task_id.slice(0, 8));
+        // Razor: the acquired flag is testimony from the reservation agent's
+        // stdout ferry, not proof. The downstream atomic claim-task remains
+        // the authoritative guard. We route on the flag (fail-closed if
+        // absent) but do not assert the reservation as established fact.
+        log("Reservation agent returned acquired=true for task " + rec.task_id.slice(0, 8) + " (not independently verified; claim-task is authoritative)");
         acquired.push(rec);
       } else {
         // FAIL CLOSED: Another dispatcher owns this task. Do not recommend it.