muse-crew 0.14.1 → 0.14.3

package/lib/test-publish-preflight.sh

@@ -21,6 +21,17 @@
 #       * old helper that does not know --check (usage to stderr, exit 1,
 #         no CREDENTIAL markers) with DRY_RUN=1 -> no skip (fall-through
 #         preserved: unknown is not absent)
+#   - detached fixtures (detached-HEAD audit REDO, 2026-09-19): a detached
+#     checkout with a local origin. Case 6 (origin/HEAD set, DRY_RUN=1) ->
+#     preflight passes through to PUBLISH_DRY_RUN=1 (no refusal — detached
+#     publication is legitimate). Case 7 (origin/HEAD deleted, DRY_RUN=1) ->
+#     PUBLISH_FAILED=env before any mutation, repo untouched (the genuinely
+#     unknowable destination fails in the preflight, ahead of the DRY_RUN
+#     block).
+#   - Case 8: attached checkout with no origin (DRY_RUN=1) -> PUBLISH_FAILED=env
+#     pre-mutation, repo untouched (2026-09-19 critic F-A1: the anchor used to
+#     check no-origin only on the detached branch, so attached+no-origin
+#     failed post-mutation after the version-bump commit and registry publish).
 #   - --check probe unit test against the real helper: on the author
 #     machine this expects exit 0 and exactly CREDENTIAL_OK=custom.npm.
 #     NOTE: this case depends on the `custom.npm` credential existing in
@@ -52,6 +63,13 @@ git -C "$SCRATCH" config user.email "test@crew"
 git -C "$SCRATCH" config user.name "crew-test"
 echo x > "$SCRATCH/f.txt"
 git -C "$SCRATCH" add -A && git -C "$SCRATCH" commit -qm init
+# The scratch repo needs an origin for the DRY_RUN pass-through cases
+# (2026-09-19 critic F-A1: the push-destination anchor fails closed
+# pre-mutation when origin is absent, attached or detached).
+git init -q --bare "$TMPBASE/origin.git"
+git -C "$SCRATCH" remote add origin "$TMPBASE/origin.git"
+git -C "$SCRATCH" push -q origin main
+git -C "$SCRATCH" remote set-head origin -a
 
 # --- Fake helpers ---
 cat > "$TMPBASE/helper-ok.py" <<'EOF'
@@ -78,6 +96,32 @@ print("Usage: helper-old.py <tarball-path>", file=sys.stderr)
 sys.exit(1)
 EOF
 
+# --- Detached fixtures (detached-HEAD audit REDO, 2026-09-19): a detached
+# checkout with a local origin. Case 6 runs with origin/HEAD set; Case 7
+# deletes origin/HEAD first, exercising push-destination's genuinely-
+# unknowable branch. ---
+ORIGIN="$TMPBASE/origin-det.git"
+git init -q --bare "$ORIGIN"
+SCRATCH_DET="$TMPBASE/repo-detached"
+git init -q -b main "$SCRATCH_DET"
+git -C "$SCRATCH_DET" config user.email "test@crew"
+git -C "$SCRATCH_DET" config user.name "crew-test"
+echo x > "$SCRATCH_DET/f.txt"
+git -C "$SCRATCH_DET" add -A && git -C "$SCRATCH_DET" commit -qm init
+git -C "$SCRATCH_DET" remote add origin "$ORIGIN"
+git -C "$SCRATCH_DET" push -q origin main
+git -C "$SCRATCH_DET" remote set-head origin -a
+git -C "$SCRATCH_DET" checkout -q --detach HEAD
+
+# --- Attached no-origin fixture (F-A1): an attached checkout with no origin
+# fails closed in the anchor, attached or detached. ---
+SCRATCH_NOORIGIN="$TMPBASE/repo-no-origin"
+git init -q -b main "$SCRATCH_NOORIGIN"
+git -C "$SCRATCH_NOORIGIN" config user.email "test@crew"
+git -C "$SCRATCH_NOORIGIN" config user.name "crew-test"
+echo x > "$SCRATCH_NOORIGIN/f.txt"
+git -C "$SCRATCH_NOORIGIN" add -A && git -C "$SCRATCH_NOORIGIN" commit -qm init
+
 ACTIONABLE="npm publish not configured on this machine — see docs/guide.md#npm-releases; code changes are merged, nothing was versioned or published"
 
 # --- Structural: extract the shipped preflight block by anchor ---
@@ -123,13 +167,23 @@ fi
 
 # Runner: full publish-npm.sh against the scratch repo. The preflight exits
 # before any mutation, so the repo needs no package.json.
+# LIFECYCLE + CREW_HOME are exported because the preflight now resolves the
+# push destination up front (2026-09-19: the push-destination resolution moved
+# from step 13 to the preflight — fail before mutation, never after the
+# registry publish; 2026-09-19 detached-HEAD audit REDO: a detached checkout
+# resolves to HEAD:<destination>, refused only when genuinely unknowable).
+# The scratch repo sits on branch `main`, so integration-target
+# resolves cleanly and the npm-credential assertions are unaffected.
 run_full() { # run_full <helper_path> [extra_env...]
   local helper="$1"; shift
   local run="$TMPBASE/run-$RANDOM"
   mkdir -p "$run"
+  local crew_home="$TMPBASE/crew-home"
+  mkdir -p "$crew_home"
   (
     export TASK_ID="preflight-test" REPO_PATH="$SCRATCH" PKG="muse-crew" TARGET_VERSION="9.9.9"
     export NPM_PUBLISH_PY="$helper"
+    export LIFECYCLE="$SCRIPT_DIR/worktree-lifecycle.sh" CREW_HOME="$crew_home" CREW_REPO="$SCRATCH"
     # A bare `export` (empty "$@") would dump the environment to stdout and
     # corrupt the captured run path — only export when extras are given.
     if [ $# -gt 0 ]; then export "$@"; fi
@@ -140,11 +194,11 @@ run_full() { # run_full <helper_path> [extra_env...]
   echo "$run"
 }
 
-repo_state() { # prints "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
-  local head status tgz
-  head="$(git -C "$SCRATCH" rev-parse HEAD)"
-  status="$(git -C "$SCRATCH" status --porcelain | wc -l)"
-  tgz="$(find "$SCRATCH" -maxdepth 1 -name '*.tgz' | wc -l)"
+repo_state() { # repo_state [repo]: "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
+  local head status tgz repo="${1:-$SCRATCH}"
+  head="$(git -C "$repo" rev-parse HEAD)"
+  status="$(git -C "$repo" status --porcelain | wc -l)"
+  tgz="$(find "$repo" -maxdepth 1 -name '*.tgz' | wc -l)"
   echo "HEAD=$head STATUS=$status TGZ=$tgz"
 }
 
@@ -203,6 +257,41 @@ else
   no "real helper --check: code=$CHECK_CODE out='$CHECK_OUT' (expected CREDENTIAL_OK=custom.npm — this case is credential-dependent; see header)"
 fi
 
+# --- Case 6: detached + resolvable destination + DRY_RUN=1 -> pass-through, no refusal ---
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_DET")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_DRY_RUN=1"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_FAILED"* ]]; then
+  ok "detached + resolvable destination: preflight passes through to PUBLISH_DRY_RUN=1 (no refusal)"
+else
+  no "detached resolvable: code=$CODE out='$OUT'"
+fi
+
+# --- Case 7: detached + origin/HEAD unset -> PUBLISH_FAILED=env before any mutation ---
+git -C "$SCRATCH_DET" remote set-head origin -d
+BEFORE="$(repo_state "$SCRATCH_DET")"
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_DET")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state "$SCRATCH_DET")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=env"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_DRY_RUN=1"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "detached + unknowable destination: fails closed pre-mutation, repo untouched"
+else
+  no "detached unknowable: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
+# --- Case 8: attached + no origin -> PUBLISH_FAILED=env before any mutation ---
+BEFORE="$(repo_state "$SCRATCH_NOORIGIN")"
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_NOORIGIN")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state "$SCRATCH_NOORIGIN")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=env"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_DRY_RUN=1"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "attached + no origin: fails closed pre-mutation, repo untouched"
+else
+  no "attached no-origin: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
 bash -n "$PUBLISH" && ok "publish-npm.sh syntax OK" || no "publish-npm.sh syntax"
 
 echo ""

package/lib/verify-publish.js

@@ -298,8 +298,9 @@ if (head !== commit) {
 // 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
 // attempt is known — the original and retry attempts share a commit, and
 // positional selection is luck. Within one attempt, select the OLDEST
-// submitted entry (the trigger issuance; per blocker 2, audit observations
-// are now "build-observed", not "submitted").
+// submitted entry (the trigger issuance; a receipt-bearing second "submitted"
+// may follow it — the oldest binds the trigger instant, the latest carries
+// the observed agent_id).
 let triggerTs = null;
 let manifestBefore = null;
 try {
@@ -313,8 +314,6 @@ try {
     (attempt == null || e.attempt === attempt)
   );
   if (candidates.length > 0) {
-    // Oldest first: the trigger issuance is the first submitted entry for
-    // the attempt (observations are "build-observed" per blocker 2).
     candidates.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
     const e = candidates[0];
     triggerTs = e.ts || null;