muse-crew 0.14.0 → 0.14.2

package/workflows/crew-dispatch.js

@@ -794,13 +794,44 @@ if (eligible.length === 0) {
     );
 
     if (fileResult.task_id) {
-      eligible.push({
-        task: { id: fileResult.task_id, title: ptTitle, description: ptDesc, project: ptProject, workflow: "standard", state: "todo" },
-        startStep: qaStepIndex("standard"),
-        reason: "playtest",
-        workflow: "standard"
-      });
-      log("Filed idle playtest \"" + ptTitle + "\" [" + ptProject + "] journey " + pti + "/" + J + ", persona " + ppi + "/" + P + ", max_filings " + maxFilings);
+      // Razor: the filed task_id is testimony. Do an independent witness
+      // re-read of the board before entering eligible — the task must be
+      // observed in todo state, not assumed. The downstream atomic claim
+      // remains the authoritative guard; this is fail-fast, fail-closed.
+      var ptWitnessOk = false;
+      try {
+        var ptBoardRaw = await agent(
+          "Re-read the dispatch state to verify the filed playtest task.\\n" +
+          "Run in shell and return the stdout as a raw string:\\n" + crewCmd("get-dispatch-state", {}) + "\\n" +
+          "Return the command's stdout JSON as a plain string, byte-for-byte, unmodified. " +
+          "Do NOT parse the JSON — your return value must be the raw stdout string, never an object.",
+          {
+            key: "verify-playtest",
+            label: "Verifying filed playtest task"
+          }
+        );
+        var ptBoard = unwrapBoardResult(parseBoardJson(ptBoardRaw));
+        var ptTasks = (ptBoard.ready_tasks || []).map(projectTaskRecord).filter(function (t) { return t !== null; });
+        for (var pti2 = 0; pti2 < ptTasks.length; pti2++) {
+          if (ptTasks[pti2].id === fileResult.task_id && ptTasks[pti2].state === "todo") {
+            ptWitnessOk = true;
+            break;
+          }
+        }
+      } catch (e) {
+        log("Playtest witness re-read failed (" + String(e.message || e) + ") — task not verified, skipping eligible");
+      }
+      if (ptWitnessOk) {
+        eligible.push({
+          task: { id: fileResult.task_id, title: ptTitle, description: ptDesc, project: ptProject, workflow: "standard", state: "todo" },
+          startStep: qaStepIndex("standard"),
+          reason: "playtest",
+          workflow: "standard"
+        });
+        log("Filed idle playtest \"" + ptTitle + "\" [" + ptProject + "] journey " + pti + "/" + J + ", persona " + ppi + "/" + P + ", max_filings " + maxFilings + " (witness observed todo)");
+      } else {
+        log("Idle playtest task " + fileResult.task_id + " not observed in todo state on re-read — skipping eligible (fail-closed)");
+      }
     } else {
       log("Idle playtest filing failed — cursors already advanced, assignment skipped");
     }
@@ -1022,7 +1053,11 @@ if (recommended.length > 0) {
       );
       var reserveParsed = extractJsonObject(reserveOut);
       if (reserveParsed && reserveParsed.acquired) {
-        log("Reserved task " + rec.task_id.slice(0, 8));
+        // Razor: the acquired flag is testimony from the reservation agent's
+        // stdout ferry, not proof. The downstream atomic claim-task remains
+        // the authoritative guard. We route on the flag (fail-closed if
+        // absent) but do not assert the reservation as established fact.
+        log("Reservation agent returned acquired=true for task " + rec.task_id.slice(0, 8) + " (not independently verified; claim-task is authoritative)");
         acquired.push(rec);
       } else {
         // FAIL CLOSED: Another dispatcher owns this task. Do not recommend it.

package/workflows/crew-init.js

@@ -6,7 +6,8 @@ export const meta = {
     { name: "scaffold", title: "Scaffold orchestration directory" },
     { name: "project", title: "Register first project" },
     { name: "crons", title: "Create and converge cron jobs" },
-    { name: "policy", title: "Persist update policy" }
+    { name: "policy", title: "Persist update policy" },
+    { name: "verify", title: "Independently verify init end state" }
   ]
 };
 
@@ -248,7 +249,8 @@ try {
 } catch (e) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Release bootstrap failed", message: String(e.message || e) } };
 }
-log("Release: " + (releaseResult.existed ? "existing" : "bootstrapped") + " at " + releaseResult.hash);
+log("Release: bootstrap agent reported " + (releaseResult.existed ? "existing" : "bootstrapped") +
+    " release at " + releaseResult.hash + " (testimony — the verify phase re-reads the release identity)");
 
 // ── Dependency node_modules symlink ───────────────────────────────────
 // The release bootstrap (crew-release.sh init -> deploy) already links
@@ -287,7 +289,9 @@ try {
       }
     }
   );
-  log("Dependency node_modules: " + (depLinkResult.note || "unknown") + " -> " + depNodeModules);
+  // Testimony only — the verify phase re-reads the symlink target independently.
+  log("Dependency node_modules: agent reported " + (depLinkResult.note || "unknown") + " -> " + depNodeModules +
+      " (witness verification pending)");
 } catch (e) {
   log("Dependency node_modules link step errored (non-fatal): " + String(e.message || e));
 }
@@ -295,47 +299,51 @@ try {
 // ── Phase 2: Scaffold ─────────────────────────────────────────────────
 // Copies identities (with portraits), personas, workflow docs, and
 // feedback convention from the crew repo into .orchestration/ under crewHome.
-// Uses cp --no-clobber so existing files are never overwritten.
+// (2026-09-19, Room #19 D1 step-back): copying files is deterministic work —
+// no agent holds our data. The deterministic lib/scaffold-crew.js does the
+// copies, counts them, verifies every file on disk, and writes
+// .scaffold-receipt.json. The agent below is a byte courier only: it runs
+// the exact command and prints the receipt file's exact bytes. The receipt
+// bytes are script-authored (a paraphrased ferry fails the mechanical parse
+// loudly — explicit ferry failure, never a fabricated 0/0), but the ferry
+// itself is the agent's REPORT that the script ran: it does not prove the
+// side effect. The verify phase re-runs this same idempotent composer and
+// its disk-verification holds the end state; the ferry's counts are logged
+// as reported, the witness's counts are the state. Init is idempotent, so
+// re-running retries cheaply.
 phase("scaffold");
-var scaffoldResult;
+var scaffoldCreated = 0;
+var scaffoldSkipped = 0;
+var scaffoldReceiptPath = orchDir + "/.scaffold-receipt.json";
+var safeScaffoldRepo = String(crewRepoPath).split('"').join('\\"');
+var safeScaffoldOrch = String(orchDir).split('"').join('\\"');
 try {
-  scaffoldResult = await agent(
-    "Scaffold the .orchestration directory from the crew repo.\n\n" +
-    "Source repo: " + crewRepoPath + "\n" +
-    "Destination: " + orchDir + "\n\n" +
-    "Steps:\n" +
-    "1. Create directories:\n" +
-    "   mkdir -p " + orchDir + "/identities " + orchDir + "/personas " + orchDir + "/workflows " + orchDir + "/feedback\n" +
-    "2. Copy identities (.md AND .png — portraits are in the repo):\n" +
-    "   cp -n " + crewRepoPath + "/identities/*.md " + crewRepoPath + "/identities/*.png " + orchDir + "/identities/\n" +
-    "   Also copy personality-notes.md if it exists.\n" +
-    "3. Copy personas:\n" +
-    "   cp -n " + crewRepoPath + "/personas/*.md " + orchDir + "/personas/\n" +
-    "4. Copy workflow documentation (markdown descriptions, not JS scripts):\n" +
-    "   cp -n " + crewRepoPath + "/seed/workflows/*.md " + orchDir + "/workflows/\n" +
-    "5. Copy feedback convention:\n" +
-    "   cp -n " + crewRepoPath + "/seed/feedback/README.md " + orchDir + "/feedback/README.md\n" +
-    "6. List what ended up in " + orchDir + " to confirm.\n\n" +
-    "Return JSON with created (array of relative paths that were newly copied) and skipped (array that already existed).",
+  var scaffoldFerry = await agent(
+    "Run the deterministic scaffold composer. Do not decide anything — run the exact command below, then print the exact bytes of the receipt file it writes, and nothing else.\n\n" +
+    "Command:\n" +
+    "node \"" + crewHome + "/current/lib/scaffold-crew.js\" --repo \"" + safeScaffoldRepo + "\" --orch-dir \"" + safeScaffoldOrch + "\"\n\n" +
+    "The script copies the crew's identities, personas, workflow docs, and feedback convention into " + orchDir + " (never overwriting existing files), verifies every file on disk, and writes " + scaffoldReceiptPath + " containing { created, skipped } (integer counts).\n" +
+    "Print the exact bytes of " + scaffoldReceiptPath + " and nothing else.",
     {
       key: "scaffold-1",
-      label: "Scaffold .orchestration directory",
-      schema: {
-        type: "object",
-        properties: {
-          created: { type: "array", items: { type: "string" } },
-          skipped: { type: "array", items: { type: "string" } }
-        },
-        required: ["created", "skipped"]
-      }
+      label: "Scaffold .orchestration directory"
     }
   );
+  var scaffoldReceipt = JSON.parse(String(scaffoldFerry).trim());
+  if (!scaffoldReceipt || !Number.isInteger(scaffoldReceipt.created) || !Number.isInteger(scaffoldReceipt.skipped)) {
+    throw new Error("scaffold receipt did not carry integer created/skipped counts");
+  }
+  if (scaffoldReceipt.created < 0 || scaffoldReceipt.skipped < 0) {
+    throw new Error("scaffold receipt carried a negative count (created=" +
+      scaffoldReceipt.created + ", skipped=" + scaffoldReceipt.skipped + ")");
+  }
+  // Reported counts only — the verify phase corroborates the side effect.
+  scaffoldCreated = scaffoldReceipt.created;
+  scaffoldSkipped = scaffoldReceipt.skipped;
 } catch (e) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Scaffold failed", message: String(e.message || e) } };
 }
-var scaffoldCreated = scaffoldResult.created ? scaffoldResult.created.length : 0;
-var scaffoldSkipped = scaffoldResult.skipped ? scaffoldResult.skipped.length : 0;
-log("Scaffold: " + scaffoldCreated + " created, " + scaffoldSkipped + " skipped");
+log("Scaffold: ferry reported " + scaffoldCreated + " created, " + scaffoldSkipped + " skipped (witness verification pending)");
 
 // ── Phase 3: Project registration ─────────────────────────────────────
 // Registers the first project in crew-state.db via the Crew API. In
@@ -414,19 +422,12 @@ try {
 } catch (e) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Project registration failed", message: String(e.message || e) } };
 }
-log("Project: " + dashboardSlug + " " + projectResult.action + " (repo_path=" + gateFacts.dashboardRepoExpanded + ")");
-if (projectResult && projectResult.action === "created" &&
-    projectResult.initial_provenance && !projectResult.initial_provenance.stamped) {
-  // Room #15 (reliability): create-project's initial stamp is best-effort,
-  // but "reported" used to mean "returned into the void" — zero production
-  // code read it, so a skipped stamp (the J1/J2 shape) stayed invisible.
-  // Surface it here; the publish-base advance below re-stamps right after,
-  // and fails loudly (exit 1) if the re-stamp itself cannot stamp.
-  initialProvenanceWarning = "Project created but its initial provenance stamp was skipped (" +
-    (projectResult.initial_provenance.reason || "unknown reason") +
-    ") — the publish-base advance re-stamps it next; if that also fails, the first task's publish diffs from the empty tree.";
-  log("WARNING: " + initialProvenanceWarning);
-}
+// Testimony only: the registration agent's report. The verify phase re-reads
+// the project row (and its provenance) independently; the reported action is
+// never used as a gate — the publish-base advance below decides from the
+// deterministic task_id invariant inside lib/advance-publish-base.js.
+log("Project: registration agent reported action=" + projectResult.action + " for " + dashboardSlug +
+    " (repo_path=" + gateFacts.dashboardRepoExpanded + ") — witness verification pending");
 } // end dashboard-mode project registration
 
 // ── Artifact target verification (room #16 blocker 10, 2026-09-18) ──
@@ -465,7 +466,10 @@ if (dashboardSlug) {
       message: "The dashboard project is registered with deploy_slug \"" + dashboardSlug + "\", but the artifact target directory ~/workspace/ts-spaces/" + dashboardSlug + "/ does not exist. An artifact is a Muse platform primitive (a hosted web app) — the crew never creates artifacts, it only edits existing ones. Create the artifact from your dashboard repo via the Muse UI first (see docs/guide.md prerequisites), then re-run init. Init will not complete with a deploy_slug that points to nothing: the first task's Publish would otherwise fail with a confusing error."
     } };
   }
-  log("Artifact target verified: ~/workspace/ts-spaces/" + dashboardSlug + "/ exists");
+  // Fail-closed in the safe direction: a false "missing" blocks init
+  // unnecessarily, but a false "present" is re-checked by the verify-phase
+  // witness before the summary asserts anything.
+  log("Artifact target: agent reported ~/workspace/ts-spaces/" + dashboardSlug + "/ present (witness re-confirms)");
 }
 
 // ── Project repo setup (2026-09-18) ─────────────────────────────────
@@ -521,19 +525,18 @@ if (dashboardRepoPath) {
         }
       }
     );
+    // Testimony only: the composer's report via the agent. The verify phase
+    // observes the repo state (HEAD, .orchestration/ present, clean tree)
+    // independently; the uncommitted-scaffold warning is driven by that
+    // observation, never by the reported commit flag.
     var orchDirs = (setupRepoResult.orchestration.dirsCreated || []).join(", ");
     var commitMsg = setupRepoResult.commit.committed
       ? "committed " + setupRepoResult.commit.sha
       : "not committed (" + setupRepoResult.commit.reason + ")";
-    log("Repo setup: scaffolded " + setupRepoResult.orchestration.orchDir +
+    log("Repo setup: composer agent reported scaffolded " + setupRepoResult.orchestration.orchDir +
         " (dirs: [" + orchDirs + "]); gitignore " +
         (gitignoreConsent ? "update consented" : "declined by user — add '.worktrees/' and '.orchestration/user/' manually") +
-        "; scaffold " + commitMsg);
-    if (!setupRepoResult.commit.committed && setupRepoResult.commit.reason !== "nothing-to-commit") {
-      setupRepoWarning = "Project repo setup left the scaffold uncommitted (" +
-        setupRepoResult.commit.reason + ") — the first task's Integrate will refuse to merge until it is committed.";
-      log("WARNING: " + setupRepoWarning);
-    }
+        "; scaffold " + commitMsg + " (witness verification pending)");
   } catch (e) {
     var setupErr = String(e.message || e);
     setupRepoWarning = "Project repo setup failed: " + setupErr + " — continuing without the repo scaffold.";
@@ -553,21 +556,31 @@ if (dashboardRepoPath) {
 // the whole scaffold (517 insertions in room #14) and blows the 200-line
 // diff-transport budget. The scaffold is crew-owned infrastructure the
 // dashboard artifact never consumes, so the correct publish base is the
-// scaffold commit itself. Advance it deterministically via
-// lib/advance-publish-base.js — only when this init created the project
-// (the stamp is ours, never a real publish's), the scaffold commit's parent
-// is exactly the stamped base (nothing slipped between), and the scaffold
-// touches only crew-owned paths. Best-effort: a failed advance never blocks
-// init — the first task then publishes from the stamped base as before.
+// scaffold commit itself.
+//
+// (2026-09-19 REVIEW, agent-boundary razor): the old invocation passed
+// --scaffold-sha and --project-created — both agent testimony (the ferried
+// commit sha, the registration agent's "created" action). The script now
+// resolves the scaffold commit itself (git rev-parse HEAD in --repo) and
+// decides from the deterministic task_id invariant (a real publish's
+// provenance carries task_id; initial stamps and base advances leave it
+// null — see stampProvenance in lib/crew-api.js). The workflow passes no
+// testimony into the script and gates only on "there is a dashboard repo";
+// the script's own fail-closed checks own every consequential decision.
+// The script's return is its report of those checks (logged honestly); the
+// verify phase confirms the stamped base independently.
+// Best-effort: a failed advance never blocks init — the first task then
+// publishes from the stamped base as before.
 var publishBaseResult = null;
-if (dashboardRepoPath && projectResult && projectResult.action === "created" &&
-    setupRepoResult && setupRepoResult.commit && setupRepoResult.commit.committed) {
+var safeAdvanceCrewHome = String(crewHome).split('"').join('\\"');
+var safeAdvanceRepo = String(gateFacts.dashboardRepoExpanded).split('"').join('\\"');
+if (dashboardRepoPath && projectResult && projectResult.project_id) {
   try {
     publishBaseResult = await agent(
       "Run the deterministic publish-base advance script. Do not decide anything — just run the command and return its JSON output.\n\n" +
       "Command:\n" +
-      "node " + crewHome + "/current/lib/advance-publish-base.js --crew-home \"" + crewHome + "\" --repo \"" + gateFacts.dashboardRepoExpanded + "\" --scaffold-sha " + setupRepoResult.commit.sha + " --project-id " + projectResult.project_id + " --project-created\n\n" +
-      "The script prints one JSON object: { ok, action, reason?, from?, to? }.\n" +
+      "node \"" + safeAdvanceCrewHome + "/current/lib/advance-publish-base.js\" --crew-home \"" + safeAdvanceCrewHome + "\" --repo \"" + safeAdvanceRepo + "\" --project-id " + projectResult.project_id + "\n\n" +
+      "The script prints one JSON object: { ok, action, reason?, from?, to?, repo_clean? }.\n" +
       "Return that JSON verbatim.",
       {
         key: "advance-publish-base",
@@ -579,21 +592,22 @@ if (dashboardRepoPath && projectResult && projectResult.action === "created" &&
             action: { type: "string" },
             reason: {},
             from: {},
-            to: {}
+            to: {},
+            repo_clean: {}
           },
           required: ["ok", "action"]
         }
       }
     );
-    log("Publish base: " + publishBaseResult.action +
+    log("Publish base: advance script reported action=" + publishBaseResult.action +
         (publishBaseResult.reason ? " (" + publishBaseResult.reason + ")" : "") +
-        (publishBaseResult.from ? " " + publishBaseResult.from + " -> " + publishBaseResult.to : ""));
+        (publishBaseResult.from ? " " + publishBaseResult.from + " -> " + publishBaseResult.to : "") +
+        " (witness verification pending)");
   } catch (e) {
     log("Publish base: advance script failed (" + String(e.message || e) + ") — continuing with the stamped base (non-fatal).");
   }
 } else {
-  log("Publish base: no advance (project " + (projectResult ? projectResult.action : "unknown") +
-      ", scaffold " + (setupRepoResult && setupRepoResult.commit && setupRepoResult.commit.committed ? "committed" : "not committed") + ").");
+  log("Publish base: no advance (no dashboard repo — CLI-only mode).");
 }
 
 // ── Scheduler identity (2026-09-16) ──────────────────────────────────
@@ -762,8 +776,9 @@ if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.su
     !cronsResult.summary.registry || !Array.isArray(cronsResult.summary.registry.ids)) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron manifest invalid", message: "seed/crons.json failed validation, produced no crons list, or wrote no cron registry" } };
 }
-log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" + c.action; }).join(", ") +
-    "; registry: " + cronsResult.summary.registry.path + " (" + cronsResult.summary.registry.ids.join(", ") + ")");
+log("Crons: agent reported " + cronsResult.summary.crons.map(function (c) { return c.id + "=" + c.action; }).join(", ") +
+    "; registry: " + cronsResult.summary.registry.path + " (" + cronsResult.summary.registry.ids.join(", ") + ")" +
+    " (witness verification pending)");
 
 
 // ── Phase 5: Update policy ────────────────────────────────────────────
@@ -838,12 +853,229 @@ var persistedPolicy = policyResult.persisted || {};
 if (!persistedPolicy.auto_update_crew || !persistedPolicy.auto_update_dashboard || !persistedPolicy.update_channel) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Update policy incomplete", message: "policy phase returned no persisted policy values" } };
 }
-log("Update policy: auto_update_crew=" + persistedPolicy.auto_update_crew +
+log("Update policy: agent reported auto_update_crew=" + persistedPolicy.auto_update_crew +
   " auto_update_dashboard=" + persistedPolicy.auto_update_dashboard +
   " update_channel=" + persistedPolicy.update_channel +
-  " state_file=" + policyResult.state_file);
+  " state_file=" + policyResult.state_file + " (witness verification pending)");
+
+// ── Phase: verify — independent witness (2026-09-19) ────────────────────
+// Agent-boundary razor: every agent return above is testimony — routed,
+// never trusted. One fresh agent re-reads the end state deterministically;
+// the workflow checks each claim mechanically below. Fail-closed: a
+// mismatch on a phase that promised a state blocks init; the two
+// best-effort phases (repo setup, publish-base advance) warn loudly
+// instead of blocking.
+phase("verify");
+var wCrewHome = String(crewHome).split('"').join('\\"');
+var wCrewRepo = String(crewRepoPath).split('"').join('\\"');
+var wOrchDir = String(orchDir).split('"').join('\\"');
+var wDashRepo = String(gateFacts.dashboardRepoExpanded || "").split('"').join('\\"');
+var witnessResult;
+try {
+  witnessResult = await agent(
+    "Verify the Muse Crew installation end state. Do not decide anything — run each read exactly as written and return one JSON object with exactly the keys below.\n\n" +
+    (dashboardSlug
+      ? "There IS a dashboard project (id \"" + dashboardSlug + "\"). Run the dashboard-only checks.\n\n"
+      : "This is CLI-only mode (no dashboard project). Put null for every dashboard-only key without running its command.\n\n") +
+    "1. release_hash — run: \"" + wCrewHome + "/crew-release.sh\" current \"" + wCrewHome + "\" — put its stdout trimmed, or null when the command fails.\n" +
+    "2. node_modules_target — run: readlink \"" + wCrewHome + "/node_modules\" || echo NOT_A_SYMLINK — put its stdout trimmed.\n" +
+    "3. scaffold_receipt — re-run the idempotent composer: node \"" + wCrewHome + "/current/lib/scaffold-crew.js\" --repo \"" + wCrewRepo + "\" --orch-dir \"" + wOrchDir + "\" — then put the exact bytes of \"" + wOrchDir + "/.scaffold-receipt.json\".\n" +
+    "4. scaffold_error — null when step 3 exited 0; otherwise the failure message.\n" +
+    "5. project_row [dashboard-only] — run: node \"" + wCrewHome + "/current/lib/crew-api.js\" --crew-home \"" + wCrewHome + "\" get-project --json '{\"id\": \"" + dashboardSlug + "\"}' — put its stdout trimmed.\n" +
+    "6. repo_head [dashboard-only] — run: git -C \"" + wDashRepo + "\" rev-parse HEAD — put its stdout trimmed, or null on failure.\n" +
+    "7. repo_orch_present [dashboard-only] — put \"yes\" when \"" + wDashRepo + "/.orchestration\" is a directory, else \"no\".\n" +
+    "8. repo_clean [dashboard-only] — run: git -C \"" + wDashRepo + "\" status --porcelain — put \"yes\" when it prints nothing, else \"no\".\n" +
+    "9. provenance_row [dashboard-only] — run: node \"" + wCrewHome + "/current/lib/crew-api.js\" --crew-home \"" + wCrewHome + "\" get-provenance --json '{\"project_id\": \"" + dashboardSlug + "\"}' — put its stdout trimmed.\n" +
+    "10. artifact_target [dashboard-only] — run: test -d ~/workspace/ts-spaces/" + dashboardSlug + "/ && echo present || echo missing — put the word printed.\n" +
+    "11. cron_ids — call cron_list and put the JSON array of live job ids.\n" +
+    "12. config_row — run: node \"" + wCrewHome + "/current/lib/crew-api.js\" --crew-home \"" + wCrewHome + "\" get-config — put its stdout trimmed.\n\n" +
+    "Return the JSON object and nothing else.",
+    {
+      key: "init-verify",
+      label: "Independently verify init end state",
+      schema: {
+        type: "object",
+        properties: {
+          release_hash: { type: ["string", "null"] },
+          node_modules_target: { type: "string" },
+          scaffold_receipt: { type: ["string", "null"] },
+          scaffold_error: { type: ["string", "null"] },
+          project_row: { type: ["string", "null"] },
+          repo_head: { type: ["string", "null"] },
+          repo_orch_present: { type: ["string", "null"] },
+          repo_clean: { type: ["string", "null"] },
+          provenance_row: { type: ["string", "null"] },
+          artifact_target: { type: ["string", "null"] },
+          cron_ids: { type: "array", items: { type: "string" } },
+          config_row: { type: "string" }
+        },
+        required: ["release_hash", "node_modules_target", "scaffold_receipt", "scaffold_error",
+                   "project_row", "repo_head", "repo_orch_present", "repo_clean",
+                   "provenance_row", "artifact_target", "cron_ids", "config_row"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Init verification failed", message: String(e.message || e) } };
+}
+
+// 1. Release identity: the release system must self-identify with the hash
+// the bootstrap reported. A mismatch means the bootstrap report was fiction.
+if (String(witnessResult.release_hash || "").trim() !== String(releaseResult.hash || "").trim() ||
+    !witnessResult.release_hash) {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: release identity mismatch",
+    message: "The release bootstrap reported hash \"" + releaseResult.hash + "\", but the release system now self-identifies as \"" +
+      (witnessResult.release_hash || "null") + "\". The bootstrap report did not match reality — refusing to assert a release identity that cannot identify itself. Re-running init is safe (idempotent)."
+  } };
+}
+log("Verify: release identity matches (" + witnessResult.release_hash + ")");
+
+// 2. Dependency symlink: the observed target must match the reported outcome.
+var nmTarget = String(witnessResult.node_modules_target || "");
+if (depLinkResult && depLinkResult.note === "LINKED" && nmTarget !== depNodeModules) {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: node_modules symlink mismatch",
+    message: "The link step reported LINKED into \"" + depNodeModules + "\", but readlink now shows \"" + nmTarget + "\"."
+  } };
+}
+if (depLinkResult && depLinkResult.note === "REAL_DIR_KEPT" && nmTarget !== "NOT_A_SYMLINK") {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: node_modules is not a real dir",
+    message: "The link step reported REAL_DIR_KEPT, but readlink now shows \"" + nmTarget + "\"."
+  } };
+}
+log("Verify: node_modules link state matches report (" + nmTarget + ")");
+
+// 3. Scaffold: the witness re-ran the idempotent composer — its receipt is
+// the state. The composer's exit 0 is its own disk-verification.
+if (witnessResult.scaffold_error) {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: scaffold re-run failed",
+    message: String(witnessResult.scaffold_error)
+  } };
+}
+var wScaffold = null;
+try {
+  wScaffold = JSON.parse(String(witnessResult.scaffold_receipt || "").trim());
+  if (!wScaffold || !Number.isInteger(wScaffold.created) || !Number.isInteger(wScaffold.skipped) ||
+      wScaffold.created < 0 || wScaffold.skipped < 0) throw new Error("bad receipt");
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: scaffold receipt unparseable",
+    message: "The scaffold witness re-run did not produce a parseable receipt with non-negative integer created/skipped counts."
+  } };
+}
+if (scaffoldCreated > 0 && wScaffold.created > 0) {
+  log("WARNING: the scaffold ferry reported " + scaffoldCreated + " created, but the witness re-run still created " +
+      wScaffold.created + " — the ferry's report did not match disk state. The end state is now verified; the ferry report is not trusted.");
+}
+log("Verify: scaffold composer re-run verified " + (wScaffold.created + wScaffold.skipped) + " files on disk");
+
+// 4-8. Project row, provenance, repo state, publish-base consistency,
+// artifact target (dashboard mode only).
+var wProject = null;
+var wProvenance = null;
+if (dashboardSlug) {
+  try {
+    wProject = JSON.parse(String(witnessResult.project_row || "").trim()).project;
+  } catch (e) { wProject = null; }
+  if (!wProject || wProject.id !== dashboardSlug ||
+      wProject.repo_path !== gateFacts.dashboardRepoExpanded ||
+      wProject.environment_type !== "artifact") {
+    return { __hatchWorkflowControl: "blocked", result: {
+      blocked_reason: "Init verification failed: project row mismatch",
+      message: "The project registration reported action=" + projectResult.action + " for \"" + dashboardSlug +
+        "\", but the re-read project row does not match (id, repo_path, or environment_type differ). The registration report did not land as specified."
+    } };
+  }
+  log("Verify: project row matches (id=" + wProject.id + ", repo_path and environment_type confirmed)");
+
+  try {
+    wProvenance = JSON.parse(String(witnessResult.provenance_row || "").trim()).provenance;
+  } catch (e) { wProvenance = null; }
+  // Room #15: a missing stamp used to stay invisible ("reported into the
+  // void"). The observable condition — no provenance row after init —
+  // warns loudly here, driven by the re-read, never by testimony.
+  if (!wProvenance) {
+    initialProvenanceWarning = "Init finished with no provenance stamp on project \"" + dashboardSlug +
+      "\" — the first task's publish diffs from the empty tree. Re-running init is safe (idempotent).";
+    log("WARNING: " + initialProvenanceWarning);
+  }
+
+  // Repo state: observation drives the warning (best-effort phase, never
+  // the composer's reported commit flag).
+  if (witnessResult.repo_orch_present !== "yes" || witnessResult.repo_clean !== "yes") {
+    var repoStateBits = [];
+    if (witnessResult.repo_orch_present !== "yes") repoStateBits.push(".orchestration/ not present");
+    if (witnessResult.repo_clean !== "yes") repoStateBits.push("working tree not clean");
+    if (witnessResult.repo_head) repoStateBits.push("HEAD=" + String(witnessResult.repo_head).slice(0, 12));
+    setupRepoWarning = "Project repo setup left the repo in an unexpected state (" + repoStateBits.join("; ") +
+      ") — the first task's Integrate will refuse to merge until the scaffold is committed and the tree is clean.";
+    log("WARNING: " + setupRepoWarning);
+  } else {
+    log("Verify: repo scaffold present at " + String(witnessResult.repo_head || "").slice(0, 12) + ", tree clean");
+  }
+
+  // Publish-base consistency: a reported "advanced" must be observable in
+  // provenance. Best-effort — warns loudly instead of blocking.
+  if (publishBaseResult && publishBaseResult.action === "advanced") {
+    var advTo = String(publishBaseResult.to || "");
+    var provSha = wProvenance && wProvenance.source_commit ? String(wProvenance.source_commit) : "";
+    if (!advTo || provSha.indexOf(advTo) !== 0) {
+      log("WARNING: the publish-base advance script reported action=advanced (-> " + advTo +
+          ") but provenance now points at " + (provSha ? provSha.slice(0, 12) : "nothing") +
+          " — the report did not match state. The first task's publish diff may carry the scaffold; watch its diff-transport budget.");
+    } else {
+      log("Verify: publish base advanced -> " + advTo + " (provenance confirms)");
+    }
+  }
+
+  // Artifact target: the early check's "present" is re-confirmed. A
+  // "missing" here means the early agent's report was fiction — block with
+  // the same guidance.
+  if (witnessResult.artifact_target !== "present") {
+    return { __hatchWorkflowControl: "blocked", result: {
+      blocked_reason: "Dashboard artifact target missing",
+      message: "The dashboard project is registered with deploy_slug \"" + dashboardSlug + "\", but the artifact target directory ~/workspace/ts-spaces/" + dashboardSlug + "/ does not exist. An artifact is a Muse platform primitive (a hosted web app) — the crew never creates artifacts, it only edits existing ones. Create the artifact from your dashboard repo via the Muse UI first (see docs/guide.md prerequisites), then re-run init."
+    } };
+  }
+}
+
+// 9. Crons: every reported live id must exist in cron_list.
+var liveIds = Array.isArray(witnessResult.cron_ids) ? witnessResult.cron_ids : [];
+var expectedIds = cronsResult.summary.registry.ids;
+var missingCrons = expectedIds.filter(function (id) { return liveIds.indexOf(id) === -1; });
+if (missingCrons.length > 0) {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: cron jobs missing",
+    message: "The cron setup reported " + missingCrons.join(", ") + " as installed, but cron_list does not show them. The setup report did not match the scheduler state."
+  } };
+}
+log("Verify: all " + expectedIds.length + " cron jobs present in cron_list");
+
+// 10. Policy: the persisted config must read back the reported values.
+var wConfig = {};
+try {
+  wConfig = JSON.parse(String(witnessResult.config_row || "").trim()).config || {};
+} catch (e) { wConfig = {}; }
+if (wConfig.auto_update_crew !== persistedPolicy.auto_update_crew ||
+    wConfig.auto_update_dashboard !== persistedPolicy.auto_update_dashboard ||
+    wConfig.update_channel !== persistedPolicy.update_channel) {
+  return { __hatchWorkflowControl: "blocked", result: {
+    blocked_reason: "Init verification failed: update policy mismatch",
+    message: "The policy phase reported auto_update_crew=" + persistedPolicy.auto_update_crew +
+      " auto_update_dashboard=" + persistedPolicy.auto_update_dashboard +
+      " update_channel=" + persistedPolicy.update_channel + ", but get-config reads back auto_update_crew=" +
+      wConfig.auto_update_crew + " auto_update_dashboard=" + wConfig.auto_update_dashboard +
+      " update_channel=" + wConfig.update_channel + "."
+  } };
+}
+log("Verify: update policy reads back as reported");
 
 // ── Summary ───────────────────────────────────────────────────────────
+// Built from the verify-phase witness's re-reads. Anything the witness
+// could not corroborate is labeled *_reported — testimony, not fact.
 return {
   message: "Muse Crew initialized.",
   crewHome: crewHome,
@@ -851,14 +1083,37 @@ return {
   dashboardSlug: dashboardSlug,
   dashboardRepoPath: gateFacts.dashboardRepoExpanded,
   dashboardName: dashboardName,
-  releaseHash: releaseResult.hash,
-  scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
-  project: projectResult.action,
+  releaseHash: witnessResult.release_hash,
+  releaseBootstrapReported: releaseResult.existed ? "existing" : "bootstrapped",
+  scaffold: { created: wScaffold.created, skipped: wScaffold.skipped },
+  scaffoldFerryReported: { created: scaffoldCreated, skipped: scaffoldSkipped },
+  project: dashboardSlug ? {
+    actionReported: projectResult.action,
+    id: wProject.id,
+    repo_path: wProject.repo_path,
+    environment_type: wProject.environment_type
+  } : { action: "skipped" },
+  repoSetup: dashboardRepoPath ? {
+    head: witnessResult.repo_head,
+    orch_dir_present: witnessResult.repo_orch_present === "yes",
+    tree_clean: witnessResult.repo_clean === "yes"
+  } : null,
   repoSetupWarning: setupRepoWarning,
   initialProvenanceWarning: initialProvenanceWarning,
+  publishBase: publishBaseResult ? {
+    actionReported: publishBaseResult.action,
+    reasonReported: publishBaseResult.reason || null,
+    verified_source_commit: wProvenance ? wProvenance.source_commit : null
+  } : { actionReported: "not attempted" },
   crons: cronsResult.summary.crons,
+  cronsVerifiedIds: liveIds,
   registry: cronsResult.summary.registry,
   autoUpdate: {
+    crew: wConfig.auto_update_crew === "true",
+    dashboard: wConfig.auto_update_dashboard === "true",
+    channel: wConfig.update_channel
+  },
+  autoUpdateReported: {
     crew: persistedPolicy.auto_update_crew === "true",
     dashboard: persistedPolicy.auto_update_dashboard === "true",
     channel: persistedPolicy.update_channel