muse-crew 0.14.0 → 0.14.1

package/lib/AGENTS.md

@@ -36,4 +36,7 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `sample-project.js` — optional sample-project setup (2026-09-17): extracts `seed/sample-project.tar.gz` (stripping the `sample-project/` prefix), `git init`, initial commit. No remote required. Registration happens via the existing `create-project` action — no sample-specific endpoint. CLI: `--tarball <path> --dest <dir> --name <project-name>`.
 - `compute-publish-diff.js` — deterministic publish-diff computer (2026-09-18, room #14): replaces the agent-ferried `git diff` JSON string field (the JSON ferry dropped a valid 700-line diff — "Publish diff parsed to zero files"). Runs `git diff <base> <HEAD>` via argv (no shell), writes the raw diff bytes to `--out`, and prints only a small JSON summary (`commit`, `base`, `diff_file`, `sha256`, `bytes`, `file_count`, `changed_lines` = added+removed, never raw diff output lines, `files`, `has_binary`, `has_rename`). Empty-tree base is the first-publish ancestor (hardcoded, never `merge-base` on the empty tree); non-ancestor is semantic JSON (`ok:false, error:"not-ancestor"`, exit 0); usage errors exit 2 with nothing on stdout. Pinned per-run alongside the other lifecycle files (`COMPUTE_DIFF` in `PIN_BASENAMES`) so a mid-run release swap cannot change it under the workflow.
 - `classify-surface.js` — deterministic project-surface classifier (2026-09-18, room #14 defect): a pure, never-throwing scan of the registered repo — `space.json` present → `artifact` surface (deploy_slug suggestion = `space.json`'s valid slug, verbatim — presence alone still means "web app"), `package.json` with a non-empty `bin` → `terminal` surface, otherwise null (unclassified); artifact wins conflicts (the deployed artifact is what users see, same rule as workflows/standard.js). CLI `--repo-path` prints one JSON object (`{surface, deploy_slug, signals}`), always exit 0 (classification failure is a null result, exit 2 only for usage). `create-project` fills omitted `environment_type`/`deploy_type`/`deploy_slug` from the classification; explicit values (including explicit null) always win and drive the effective surface.
-- `advance-publish-base.js` — publish-base advance past the setup scaffold (2026-09-18, room #14): `create-project` stamps provenance at the pre-scaffold repo HEAD, then crew-init commits `.orchestration/` (+ the consented `.gitignore`) on top — the first task's publish diff would carry the whole scaffold (517 insertions) and blow the 200-line diff-transport budget. The script moves `source_commit` to the scaffold commit only when `--project-created` (the stamp is this init's, never a real publish's), the scaffold commit's parent is exactly the stamped base, and the scaffold touches only crew-owned paths (`.orchestration/`, `.gitignore`); no provenance + root scaffold commit stamps fresh. Every other case skips without touching provenance; `published_at` is preserved on advance. Called from crew-init.js (best-effort, non-fatal). Provenance is per-project (room #15 blocker 8): `--project-id` is required and every read/stamp is project-scoped. CLI: `--crew-home <path> --repo <path> --scaffold-sha <sha> --project-id <id> [--project-created]`.
+- `advance-publish-base.js` — publish-base advance past the setup scaffold (2026-09-18, room #14; testimony-free 2026-09-19 REVIEW): `create-project` stamps provenance at the pre-scaffold repo HEAD, then crew-init commits `.orchestration/` (+ the consented `.gitignore`) on top — the first task's publish diff would carry the whole scaffold (517 insertions) and blow the 200-line diff-transport budget. The script resolves the scaffold commit itself (`git rev-parse HEAD` in `--repo`; `--scaffold-sha` is an explicit override only) and moves `source_commit` to it only when every fail-closed condition holds deterministically: the existing stamp is not a real publish's (provenance.task_id is set by every real publish and null for initial stamps/base advances — the task_id invariant documented on stampProvenance; the old `--project-created` testimony flag is gone), the scaffold commit's parent is exactly the stamped base, and the scaffold touches only crew-owned paths (`.orchestration/`, `.gitignore`); no provenance + root scaffold commit stamps fresh. Every other case skips without touching provenance; `published_at` is preserved on advance. Every stdout JSON object also carries `repo_clean` (informational — whether `git status --porcelain` is empty — so the caller can warn loudly about a dirty tree; the first task's Integrate refuses to merge onto one). Called from crew-init.js (best-effort, non-fatal). Provenance is per-project (room #15 blocker 8): `--project-id` is required and every read/stamp is project-scoped. CLI: `--crew-home <path> --repo <path> --project-id <id> [--scaffold-sha <sha>]`.
+- `scaffold-crew.js` — deterministic crew-home scaffold composer (2026-09-19, Room #19 D1): replaces the agent-authored scaffold report (the agent returned prose instead of the schema'd JSON and the platform rejected it, killing room #19's init on minute one — the copying itself always succeeded). The script copies the fixed file sets (identities *.md+*.png, personas *.md, seed/workflows *.md, seed/feedback/README.md) into `<orchDir>/{identities,personas,workflows,feedback}/` with mkdir -p + no-clobber semantics (existing files never overwritten), verifies every expected file on disk (the decision rule), then writes `<orchDir>/.scaffold-receipt.json` `{created, skipped}` (integer counts, durable evidence) and prints the same JSON to stdout. Idempotent: all-skipped is exit 0. Exit 1 with the reason on stderr on any failure; exit 2 on usage errors. crew-init's scaffold-1 call is a byte courier only — it runs this script and prints the receipt's exact bytes; a paraphrased ferry fails the mechanical parse loudly as a blocked init (tripwire, never a fabricated 0/0). The receipt bytes are the agent's report of script output, not proof the script ran: crew-init corroborates with a witness re-run of this same idempotent composer (a witness that still has files to create proves the ferry's work didn't land; the witness's own disk-verification then holds the end state). Fail-closed source guards (2026-09-19 REVIEW): a missing
+or empty identities/, personas/, or seed/workflows/ source refuses loudly (exit 1,
+naming the source) before creating anything — never an empty 0/0 receipt. No wall-clock reads, no randomness.

package/lib/advance-publish-base.js

@@ -10,8 +10,14 @@
 //
 // This script moves provenance.source_commit to the scaffold commit only when
 // every fail-closed condition holds:
-//   1. --project-created: this init created the project, so the existing stamp
-//      is this run's initial stamp — never a real publish's.
+//   1. The existing stamp is not a real publish's: provenance.task_id is set
+//      by every real publish (lib/verify-publish.js and the workflow
+//      provenance-refresh paths) and is null for initial stamps and for this
+//      script's own base advances. A stamp with task_id set is never moved.
+//      (2026-09-19 REVIEW: this deterministic check replaces the old
+//      --project-created flag, which was agent testimony ferried through the
+//      workflow. The task_id invariant is documented on stampProvenance in
+//      lib/crew-api.js.)
 //   2. The scaffold commit's parent IS the stamped source_commit: nothing
 //      slipped between the stamp and the scaffold, so no un-published task
 //      work can be silently dropped from a future diff.
@@ -19,10 +25,17 @@
 //      (.orchestration/ or .gitignore).
 //   4. Special case: no provenance was ever stamped (empty repo at create
 //      time) and the scaffold commit is the root commit -> stamp fresh.
+// The scaffold commit is resolved by this script itself (git rev-parse HEAD
+// in --repo) unless --scaffold-sha overrides it — the caller never ferries
+// the sha through agent testimony (2026-09-19 REVIEW: agent-mechanic boundary
+// razor — consequential parameters come from deterministic reads, not
+// testimony).
 // Anything else yields { ok: true, action: "skipped", reason } — never an
 // error, never a clobber. stdout carries exactly one JSON object; operational
 // failures go to stderr with a non-zero exit (the caller treats failure as
-// best-effort: init continues with the stamped base).
+// best-effort: init continues with the stamped base). Every JSON object also
+// carries repo_clean (boolean): whether `git status --porcelain` in --repo
+// is empty — informational for the caller, never a gate.
 //
 // No wall-clock reads, no randomness — the published_at on a fresh stamp is
 // left to crew-api's default; on an advance the existing published_at is
@@ -39,7 +52,7 @@ const RELEASE_RE = /^([0-9a-f]{40}|pkg-\d+\.\d+\.\d+)$/;
 
 function usage() {
   console.error(
-    "Usage: node lib/advance-publish-base.js --crew-home <path> --repo <path> --scaffold-sha <sha> --project-id <id> --project-created"
+    "Usage: node lib/advance-publish-base.js --crew-home <path> --repo <path> --project-id <id> [--scaffold-sha <sha>]"
   );
 }
 
@@ -51,7 +64,6 @@ function parseArgv(argv) {
     else if (a === "--repo") out.repo = argv[++i];
     else if (a === "--scaffold-sha") out.scaffoldSha = argv[++i];
     else if (a === "--project-id") out.projectId = argv[++i];
-    else if (a === "--project-created") out.projectCreated = true;
     else {
       console.error("unknown argument: " + a);
       usage();
@@ -90,25 +102,47 @@ function isCrewOwnedPath(p) {
   return p === ".gitignore" || p === ".orchestration" || p.startsWith(".orchestration/");
 }
 
-function skip(reason) {
-  console.log(JSON.stringify({ ok: true, action: "skipped", reason }));
+function skip(reason, repoClean) {
+  console.log(JSON.stringify({ ok: true, action: "skipped", reason, repo_clean: repoClean }));
 }
 
 function main() {
-  const { crewHome, repo, scaffoldSha, projectId, projectCreated } = parseArgv(
-    process.argv.slice(2)
-  );
-  if (!crewHome || !repo || !scaffoldSha || !projectId) {
+  const parsed = parseArgv(process.argv.slice(2));
+  const { crewHome, repo, projectId } = parsed;
+  let scaffoldSha = parsed.scaffoldSha || null;
+  if (!crewHome || !repo || !projectId) {
     usage();
     process.exit(2);
   }
-  if (!SHA_RE.test(scaffoldSha)) {
-    console.error("scaffold-sha is not a 40-char hex sha");
-    process.exit(2);
+  // The scaffold commit is resolved by this script, not ferried through the
+  // caller: --scaffold-sha is an explicit override; otherwise HEAD is read
+  // directly from the repo.
+  if (scaffoldSha) {
+    if (!SHA_RE.test(scaffoldSha)) {
+      console.error("scaffold-sha is not a 40-char hex sha");
+      process.exit(2);
+    }
+  } else {
+    try {
+      scaffoldSha = git(repo, ["rev-parse", "HEAD"]);
+    } catch (e) {
+      console.error("rev-parse HEAD failed: " + (e.message || e));
+      process.exit(1);
+    }
+    if (!SHA_RE.test(scaffoldSha)) {
+      console.error("rev-parse HEAD did not print a 40-char hex sha");
+      process.exit(1);
+    }
   }
-  if (!projectCreated) {
-    skip("project was not created by this init — provenance left untouched");
-    return;
+
+  // Informational for the caller (never a gate): whether the repo worktree
+  // is clean. The caller warns loudly on a dirty tree — the first task's
+  // Integrate refuses to merge onto one.
+  let repoClean = null;
+  try {
+    repoClean = git(repo, ["status", "--porcelain"]) === "";
+  } catch (e) {
+    repoClean = null;
   }
 
   let provenance;
@@ -119,6 +153,19 @@ function main() {
     process.exit(1);
   }
 
+  // Deterministic, not testimony: every real publish stamps provenance with
+  // its task_id (see the task_id invariant on stampProvenance in
+  // lib/crew-api.js); initial stamps and base advances leave it null. A
+  // publish's base is never moved.
+  if (provenance && provenance.task_id) {
+    skip(
+      "provenance was stamped by a real publish (task_id " + provenance.task_id +
+        ") — a publish's base is never moved",
+      repoClean
+    );
+    return;
+  }
+
   // The scaffold commit's parent: empty output means S is the root commit.
   let parent;
   try {
@@ -144,8 +191,7 @@ function main() {
     skip(
       "scaffold commit touches non-crew-owned paths (" +
         foreign.slice(0, 5).join(", ") +
-        ") — provenance left untouched"
-    );
+        ") — provenance left untouched", repoClean);
     return;
   }
 
@@ -154,18 +200,18 @@ function main() {
     // scaffold commit is the root commit — anything else means history we
     // did not create, and we do not invent a base over it.
     if (parent !== null) {
-      skip("no provenance stamped and scaffold commit is not the root commit — provenance left untouched");
+      skip("no provenance stamped and scaffold commit is not the root commit — provenance left untouched", repoClean);
       return;
     }
     let crewRelease = null;
     try {
       crewRelease = resolveActiveRelease(crewHome);
     } catch (e) {
-      skip("no provenance stamped and the active crew release is unresolvable (" + (e.message || e) + ")");
+      skip("no provenance stamped and the active crew release is unresolvable (" + (e.message || e) + ")", repoClean);
       return;
     }
     if (!RELEASE_RE.test(crewRelease)) {
-      skip("no provenance stamped and the active release name is not a valid crew_release (" + crewRelease + ")");
+      skip("no provenance stamped and the active release name is not a valid crew_release (" + crewRelease + ")", repoClean);
       return;
     }
     let stamped;
@@ -183,17 +229,17 @@ function main() {
       console.error("set-provenance did not return ok");
       process.exit(1);
     }
-    console.log(JSON.stringify({ ok: true, action: "stamped", to: scaffoldSha.slice(0, 12) }));
+    console.log(JSON.stringify({ ok: true, action: "stamped", to: scaffoldSha.slice(0, 12), repo_clean: repoClean }));
     return;
   }
 
   const base = provenance.source_commit;
   if (!SHA_RE.test(base || "")) {
-    skip("existing provenance.source_commit is not a 40-char hex sha — provenance left untouched");
+    skip("existing provenance.source_commit is not a 40-char hex sha — provenance left untouched", repoClean);
     return;
   }
   if (base === scaffoldSha) {
-    skip("provenance already points at the scaffold commit");
+    skip("provenance already points at the scaffold commit", repoClean);
     return;
   }
   if (parent !== base) {
@@ -202,8 +248,7 @@ function main() {
         String(parent || "root").slice(0, 12) +
         ") is not the stamped base (" +
         base.slice(0, 12) +
-        ") — provenance left untouched"
-    );
+        ") — provenance left untouched", repoClean);
     return;
   }
 
@@ -219,7 +264,7 @@ function main() {
     }
   }
   if (!crewRelease) {
-    skip("no usable crew_release for the re-stamp — provenance left untouched");
+    skip("no usable crew_release for the re-stamp — provenance left untouched", repoClean);
     return;
   }
 
@@ -259,6 +304,7 @@ function main() {
       action: "advanced",
       from: base.slice(0, 12),
       to: scaffoldSha.slice(0, 12),
+      repo_clean: repoClean,
     })
   );
 }

package/lib/crew-api.js

@@ -2625,6 +2625,14 @@ commands["update-config"] = (db, args) => {
 // projects carries N independent publish bases, and stamping one project
 // never touches another's row.
 function stampProvenance(db, { project_id, source_commit, crew_release, published_at, task_id }) {
+  // task_id invariant (2026-09-19 REVIEW): task_id is set by every REAL
+  // publish (lib/verify-publish.js and the workflow provenance-refresh paths)
+  // and is null for initial stamps (tryStampInitialProvenance) and for
+  // publish-base advances (lib/advance-publish-base.js). So
+  // provenance.task_id != null ⟺ a real publish has stamped this project.
+  // lib/advance-publish-base.js relies on this to deterministically refuse to
+  // move a publish's base. Keep it true: any new real-publish path must pass
+  // its task_id; anything that is not a publish must leave it null.
   const pid = String(project_id ?? "").trim();
   if (!pid) throw usageError("project_id is required — pass the project's id (see list-projects).");
   requireProject(db, pid);

package/lib/scaffold-crew.js

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+// Deterministic crew-home scaffold composer (2026-09-19, Room #19 D1).
+//
+// The old crew-init scaffold phase asked an agent to copy files AND report
+// what it copied as JSON. The copying always worked; the JSON return didn't
+// (room #19: the agent returned prose, the platform rejected it as non-JSON,
+// init died on minute one). The step-back: copying files is deterministic
+// work — no agent should be holding our data. This script does the copies,
+// counts them, verifies every file on disk, and writes a receipt. The
+// workflow consumes only this script's bytes; the agent's return is never
+// parsed for data.
+//
+// CLI: node scaffold-crew.js --repo <crewRepoPath> --orch-dir <orchDir>
+// Prints the receipt JSON {"created":n,"skipped":m} to stdout and writes it
+// to <orchDir>/.scaffold-receipt.json (durable evidence). Exit 0 on success
+// (idempotent: all-skipped is success). Exit 1 with the reason on stderr on
+// any failure — including a missing or empty identities/personas/seed-workflows
+// source (fail-closed: never stamp an empty 0/0 receipt). Exit 2 on usage
+// errors. No wall-clock reads, no randomness.
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+function usageError(msg) {
+  process.stderr.write("scaffold-crew.js usage: --repo <crewRepoPath> --orch-dir <orchDir>\n" + msg + "\n");
+  process.exit(2);
+}
+
+const args = process.argv.slice(2);
+let repo = null;
+let orchDir = null;
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--repo" && i + 1 < args.length) repo = args[++i];
+  else if (args[i] === "--orch-dir" && i + 1 < args.length) orchDir = args[++i];
+  else usageError("unknown or incomplete argument: " + args[i]);
+}
+if (!repo) usageError("--repo is required");
+if (!orchDir) usageError("--orch-dir is required");
+
+function fail(msg) {
+  process.stderr.write("scaffold-crew: " + msg + "\n");
+  process.exit(1);
+}
+
+if (!fs.existsSync(repo) || !fs.statSync(repo).isDirectory()) {
+  fail("crew repo not found or not a directory: " + repo);
+}
+
+// Fixed file sets. No judgment here: these globs are the scaffold.
+//
+// Fail-closed source guards (2026-09-19 REVIEW): an empty or missing source
+// set used to sail through as a successful all-skipped scaffold (receipt
+// 0/0). A crew with no identities, no personas, or no seed workflows is not
+// a crew — refuse loudly (exit 1) before creating anything, instead of
+// stamping an empty receipt. The feedback README stays optional.
+function requireSource(dir, exts, label) {
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) {
+    fail("scaffold source missing: " + dir + " (" + label + " — refusing to scaffold an empty crew)");
+  }
+  const files = globFiles(dir, exts);
+  if (files.length === 0) {
+    fail("scaffold source empty: " + dir + " (no " + label + " files — refusing to scaffold an empty crew)");
+  }
+  return files;
+}
+
+const identityFiles = requireSource(path.join(repo, "identities"), [".md", ".png"], "identity");
+const personaFiles = requireSource(path.join(repo, "personas"), [".md"], "persona");
+const seedWorkflowFiles = requireSource(path.join(repo, "seed", "workflows"), [".md"], "seed workflow");
+
+const dirs = ["identities", "personas", "workflows", "feedback"];
+for (const d of dirs) {
+  fs.mkdirSync(path.join(orchDir, d), { recursive: true });
+}
+
+function globFiles(dir, exts) {
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) return [];
+  return fs.readdirSync(dir)
+    .filter((f) => exts.some((e) => f.endsWith(e)))
+    .sort()
+    .map((f) => path.join(dir, f));
+}
+
+const copies = [];
+for (const f of identityFiles) {
+  copies.push([f, path.join(orchDir, "identities", path.basename(f))]);
+}
+for (const f of personaFiles) {
+  copies.push([f, path.join(orchDir, "personas", path.basename(f))]);
+}
+for (const f of seedWorkflowFiles) {
+  copies.push([f, path.join(orchDir, "workflows", path.basename(f))]);
+}
+const feedbackReadme = path.join(repo, "seed", "feedback", "README.md");
+if (fs.existsSync(feedbackReadme)) {
+  copies.push([feedbackReadme, path.join(orchDir, "feedback", "README.md")]);
+}
+
+let created = 0;
+let skipped = 0;
+const expected = [];
+for (const [src, dest] of copies) {
+  expected.push(dest);
+  if (fs.existsSync(dest)) {
+    skipped += 1; // no-clobber: existing files are never overwritten
+    continue;
+  }
+  try {
+    fs.copyFileSync(src, dest);
+  } catch (e) {
+    fail("copy failed: " + src + " -> " + dest + " (" + String(e.message || e) + ")");
+  }
+  created += 1;
+}
+
+// Disk verification is the decision rule: every expected file must exist.
+const missing = expected.filter((f) => !fs.existsSync(f));
+if (missing.length > 0) {
+  fail("incomplete scaffold: " + missing.length + " expected file(s) missing after copy: " + missing[0]);
+}
+
+const receipt = { created, skipped };
+const receiptPath = path.join(orchDir, ".scaffold-receipt.json");
+try {
+  fs.writeFileSync(receiptPath, JSON.stringify(receipt) + "\n");
+} catch (e) {
+  fail("could not write receipt " + receiptPath + " (" + String(e.message || e) + ")");
+}
+process.stdout.write(JSON.stringify(receipt) + "\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -132,7 +132,7 @@ if (!taskId) {
 // See docs/decisions/workflow-core.md#closeout-envelope: the work agent returns the runtime's native envelope; verdict extracted mechanically.
 const VERDICT_STEPS = ["Build", "Review", "QA", "Reproduce", "Integrate", "Publish"];
 function extractVerdict(workerText) {
-  // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
+ // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
   // your report with the verdict). This ignores literal VERDICT strings echoed
   // from the worker's instructions (which contain quoted examples). Fail
   // closed if: no verdict found, the last verdict is not in the trailing 100
@@ -442,9 +442,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -2192,11 +2190,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2209,7 +2207,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2238,7 +2236,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2831,11 +2829,7 @@ while (i < STEPS.length) {
           { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",
             schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
         );
-        if (provRefresh.refreshed) {
-          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
-        } else if (provRefresh.reason === "no-record") {
-          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
-        } else {
+        if (!provRefresh.refreshed && provRefresh.reason !== "no-record") {
           return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
         }
       } catch (e) {

package/workflows/chore.js

@@ -501,9 +501,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -2098,11 +2096,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2115,7 +2113,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2144,7 +2142,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {
@@ -2458,11 +2456,7 @@ while (i < STEPS.length) {
           { key: attemptKey("publish-provenance-refresh-" + taskId, reworkCount), label: "Refreshing dashboard provenance after crew release",
             schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
         );
-        if (provRefresh.refreshed) {
-          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
-        } else if (provRefresh.reason === "no-record") {
-          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
-        } else {
+        if (!provRefresh.refreshed && provRefresh.reason !== "no-record") {
           return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
         }
       } catch (e) {

package/workflows/crew-dispatch.js

@@ -794,13 +794,44 @@ if (eligible.length === 0) {
     );
 
     if (fileResult.task_id) {
-      eligible.push({
-        task: { id: fileResult.task_id, title: ptTitle, description: ptDesc, project: ptProject, workflow: "standard", state: "todo" },
-        startStep: qaStepIndex("standard"),
-        reason: "playtest",
-        workflow: "standard"
-      });
-      log("Filed idle playtest \"" + ptTitle + "\" [" + ptProject + "] journey " + pti + "/" + J + ", persona " + ppi + "/" + P + ", max_filings " + maxFilings);
+      // Razor: the filed task_id is testimony. Do an independent witness
+      // re-read of the board before entering eligible — the task must be
+      // observed in todo state, not assumed. The downstream atomic claim
+      // remains the authoritative guard; this is fail-fast, fail-closed.
+      var ptWitnessOk = false;
+      try {
+        var ptBoardRaw = await agent(
+          "Re-read the dispatch state to verify the filed playtest task.\\n" +
+          "Run in shell and return the stdout as a raw string:\\n" + crewCmd("get-dispatch-state", {}) + "\\n" +
+          "Return the command's stdout JSON as a plain string, byte-for-byte, unmodified. " +
+          "Do NOT parse the JSON — your return value must be the raw stdout string, never an object.",
+          {
+            key: "verify-playtest",
+            label: "Verifying filed playtest task"
+          }
+        );
+        var ptBoard = unwrapBoardResult(parseBoardJson(ptBoardRaw));
+        var ptTasks = (ptBoard.ready_tasks || []).map(projectTaskRecord).filter(function (t) { return t !== null; });
+        for (var pti2 = 0; pti2 < ptTasks.length; pti2++) {
+          if (ptTasks[pti2].id === fileResult.task_id && ptTasks[pti2].state === "todo") {
+            ptWitnessOk = true;
+            break;
+          }
+        }
+      } catch (e) {
+        log("Playtest witness re-read failed (" + String(e.message || e) + ") — task not verified, skipping eligible");
+      }
+      if (ptWitnessOk) {
+        eligible.push({
+          task: { id: fileResult.task_id, title: ptTitle, description: ptDesc, project: ptProject, workflow: "standard", state: "todo" },
+          startStep: qaStepIndex("standard"),
+          reason: "playtest",
+          workflow: "standard"
+        });
+        log("Filed idle playtest \"" + ptTitle + "\" [" + ptProject + "] journey " + pti + "/" + J + ", persona " + ppi + "/" + P + ", max_filings " + maxFilings + " (witness observed todo)");
+      } else {
+        log("Idle playtest task " + fileResult.task_id + " not observed in todo state on re-read — skipping eligible (fail-closed)");
+      }
     } else {
       log("Idle playtest filing failed — cursors already advanced, assignment skipped");
     }
@@ -1022,7 +1053,11 @@ if (recommended.length > 0) {
       );
       var reserveParsed = extractJsonObject(reserveOut);
       if (reserveParsed && reserveParsed.acquired) {
-        log("Reserved task " + rec.task_id.slice(0, 8));
+        // Razor: the acquired flag is testimony from the reservation agent's
+        // stdout ferry, not proof. The downstream atomic claim-task remains
+        // the authoritative guard. We route on the flag (fail-closed if
+        // absent) but do not assert the reservation as established fact.
+        log("Reservation agent returned acquired=true for task " + rec.task_id.slice(0, 8) + " (not independently verified; claim-task is authoritative)");
         acquired.push(rec);
       } else {
         // FAIL CLOSED: Another dispatcher owns this task. Do not recommend it.