muse-crew 0.14.11 → 0.14.13

package/docs/decisions/AGENTS.md

@@ -6,6 +6,12 @@ history lives here. One canonical section per `<a id>` anchor — a critic
 re-verified that every `docs/decisions/*.md#anchor` reference in
 `workflows/*.js` resolves (45 unique references).
 
+## dispatch-decision-log.md — Decision history: dispatch decision log (hoverboat)
+
+- `#checksum-vs-hoverboat` — The ferry-corruption problem and the two candidates
+- `#why-hoverboat-won` — Availability, trust, subtraction, primary-source rationale
+- `#what-was-built` — Declaration shape, skip counters, observer ingestion, retirements
+
 ## publish-path.md — Decision history: publish path
 
 - `#fire-and-forget-trigger` — Fire-and-forget trigger + workflow-owned observation

package/docs/decisions/dispatch-decision-log.md

@@ -0,0 +1,69 @@
+# Dispatch decision log (hoverboat) — 2026-09-24
+
+<a id="checksum-vs-hoverboat"></a>
+## The problem
+
+The Gate 2 observer attributed dispatch decisions by ferrying platform
+`scheduler.job_runs` rows through an LLM paste (tick worker: `muse.db`
+result → heredoc → `record_platform.sh --dispatch` → `dispatch_sample`
+rows → `attribute_dispatch.sh` → `dispatch_decision` rows). The paste
+mutated plausible values: a 2026-09-24 consistency scan found 275
+same-`run_id` contradictory `dispatch_sample` rows and 65 derived
+`dispatch_decision` rows based on corrupt data (5.7% of samples
+quarantined; 63.6% of ticks touched). The older `quarantine_suspects.sh`
+handled near-neighbor UUID mutations, not plausible value mutation.
+
+## The two candidates
+
+**Checksum ferry** (containment): keep the ferry; the worker checksums the
+raw tool-result JSON before the paste and `record_platform.sh` verifies
+after. Corrupt pastes become loud absences instead of silent corruption.
+
+**Hoverboat** (local declaration): the dispatcher writes its decision to
+`$CREW_HOME/.dispatch-decisions.jsonl` in its own bytes (deterministic JS,
+same courier shape as the proven §4b tick-release writer); the observer
+reads the file directly and verifies launch declarations mechanically
+against crew DB effects (`platform_run_tasks`, `dispatch_reservations`).
+
+<a id="why-hoverboat-won"></a>
+## Why hoverboat won
+
+1. **Availability.** Corruption touched ~63.6% of ticks. Checksum converts
+   corruption into absence, but the entry demo needs ten consecutive ticks
+   each recording a decision — absence fails the demo as surely as
+   corruption. Hoverboat's channel has no LLM re-emission at all.
+2. **Trust.** The checksum would be computed by the same worker agent that
+   corrupts the paste — asking the corrupting agent to honestly report its
+   own corruption. Hoverboat's declaration is composed by deterministic
+   workflow JS and checked against independent DB effects.
+3. **Subtraction.** Checksum keeps the ferry, the rolling 25h re-record
+   window, and the quarantine machinery permanently busy. Hoverboat deletes
+   the sample→decision attribution entirely; the platform ferry remains
+   only as platform-health telemetry.
+4. **The crew already knows.** Having the platform tell the observer what
+   the crew decided, through an LLM paste, when the crew can write it
+   directly, is the ferry. The declaration is the primary source; the DB
+   effects are the independent verification.
+
+Rejected alternative considered: a deterministic Crew API action for the
+write. It would not remove the agent from the path (workflows reach the
+CLI only through `agent()` shell calls), so it adds API surface for no
+integrity gain. The embedded courier is the proven seam.
+
+<a id="what-was-built"></a>
+## What was built
+
+- `workflows/crew-dispatch.js` §4c: per-tick declaration
+  `{seq, tick_seq, release, decision, launched[], completed[], parked[],
+  board{seen,eligible}, skipped{reason:count sparse}, partial}`.
+  `tick_seq` couples each line to the `.tick-releases.jsonl` line for the
+  same poll — a tick-release line with no decision line means the tick died
+  after poll-ack, visibly.
+- Per-reason ineligibility counters (`countSkipped`) at every skip site in
+  the eligibility loop + the simultaneity-limit skip, so stand-downs are
+  auditable without re-deriving eligibility.
+- Observer: `ingest_decisions.sh` replaces `attribute_dispatch.sh`;
+  `snapshot.sh` dispatch section rewritten around decision rows.
+- Retired: sample→decision attribution, `state/attributed.json` watermark.
+  Kept: `record_platform.sh --dispatch` as platform-health telemetry,
+  `quarantine_suspects.sh` for the health samples' ID mutations.

package/lib/worktree-lifecycle.sh

@@ -988,7 +988,8 @@ cmd_integration_target() {
   integration_target
 }
 
-# Branch-state classification for Review entry (blocker 34, 2026-09-21).
+# Branch-state classification for Review entry (blocker 34, 2026-09-21;
+# no-branch path blocker 50, 2026-09-23).
 # Usage: classify-branch <task_id>
 # Stdout: exactly one successful line —
 #   BRANCH_STATE: has-work | already-merged:<40-hex> | empty-no-work
@@ -1005,17 +1006,72 @@ cmd_integration_target() {
 #   1. current-tip identity — the live merge carrying the current branch
 #      tip (current_branch_merge, blocker 35's identity primitive). If the
 #      tip is on the live line via a merge, that merge IS the deliverable.
+#      Branch-present path only — a gone branch has no tip to identify.
 #   2. the task's own durable merge records, newest first (at most 20
 #      candidates scanned; garbage/unresolvable entries skipped). The
 #      first record that resolves to a MERGE commit and is an ancestor of
 #      the live target wins; the SHA is canonicalized to full 40-hex.
 # Poison rule: the newest RESOLVABLE non-ancestor record poisons the
 # fallback — an older record is never accepted beneath a newer known-
-# stale one. The answer then is empty-no-work (stderr notes the poison),
-# never a fabricated already-merged.
+# stale one. On the branch-present path the answer is empty-no-work
+# (stderr notes the poison), never a fabricated already-merged. On the
+# no-branch path the poison fails closed (exit 1): without a branch,
+# "empty" is indistinguishable from evidence loss.
 # The branch is empty here, so the blocker-35 identity/ancestry
 # distinction does not apply: there is no moved branch to go stale
 # against, and every candidate is this task's own record.
+#
+# No-branch path (blocker 50): a missing branch is the normal
+# post-integrate state — Integrate merges, the worktree lifecycle reclaims
+# the branch, and QA/rework run after. The classifier resolves the
+# integration target independently of the branch and runs the durable
+# merge-record scan (step 2 below). A hit prints already-merged:<sha> with
+# the real DIAG counts, exit 0. No hit — no records, none resolvable, none
+# an ancestor, or poisoned — exits 1 with diagnostics, never empty-no-work.
+
+# Durable merge-record scan, shared by classify-branch's branch-present
+# and no-branch paths (blocker 50). Newest first, at most 20 candidates:
+# valid-hex merge_commit= lines only; a candidate must resolve to a MERGE
+# commit (^2 exists) to count as resolvable. The first resolvable record
+# that is an ancestor of $2 wins. Results in SCAN_MERGED (full 40-hex or
+# empty) and SCAN_POISONED (1 when the newest resolvable record is a
+# non-ancestor — an older ancestor beneath it is refused, stderr-noted).
+# Updates the caller's diag_records/diag_resolvable (dynamic scope; the
+# defaults keep set -u safe). No stdout of its own.
+scan_merge_records() {
+  local task_id="$1" target="$2"
+  SCAN_MERGED=""; SCAN_POISONED=0
+  : "${diag_records:=0}" "${diag_resolvable:=0}"
+  local rec="$MERGE_RECORDS_DIR/$task_id"
+  [ -f "$rec" ] || return 0
+  local count=0 sha full poisoned=""
+  while IFS= read -r line && [ "$count" -lt 20 ]; do
+    case "$line" in
+      merge_commit=*) sha="${line#merge_commit=}" ;;
+      *) continue ;;
+    esac
+    case "$sha" in ""|*[!0-9a-f]*) continue ;; esac
+    count=$((count + 1))
+    diag_records=$((diag_records + 1))
+    full=$(git rev-parse --verify --quiet "$sha" 2>/dev/null) || continue
+    # A merge commit: the frozen first-parent diff the workflow reviews
+    # only exists for merges. A non-merge ancestor is never the task's
+    # merge — skipped, not poison (garbage must not veto delivery).
+    git rev-parse --verify --quiet "$full^2" >/dev/null 2>&1 || continue
+    diag_resolvable=$((diag_resolvable + 1))
+    if git merge-base --is-ancestor "$full" "$target" 2>/dev/null; then
+      if [ -n "$poisoned" ]; then
+        echo "classify-branch: newest resolvable record $poisoned is stale (not an ancestor of $target); refusing older record $full" >&2
+        SCAN_POISONED=1
+        return 0
+      fi
+      SCAN_MERGED="$full"
+      return 0
+    fi
+    [ -z "$poisoned" ] && poisoned="$full"
+  done < <(tac "$rec" 2>/dev/null)
+  return 0
+}
 cmd_classify_branch() {
   local task_id="$1"
   validate_task_id "$task_id"
@@ -1035,7 +1091,29 @@ cmd_classify_branch() {
   branch=$(resolve_branch "$task_id") || { echo "classify-branch: cannot resolve task branch" >&2; diag; return 1; }
 
   cd "$REPO"
-  git rev-parse --verify "$branch" >/dev/null 2>&1 || { echo "classify-branch: branch $branch does not exist" >&2; diag; return 1; }
+
+  # Blocker 50: a missing branch is the normal post-integrate state, not a
+  # classification failure — Integrate merges, the worktree lifecycle
+  # reclaims the branch, and QA/rework run after. Resolve the target
+  # independently of the branch and let the durable merge records plus
+  # trunk ancestry decide. Never empty-no-work here: without a branch,
+  # "empty" is indistinguishable from evidence loss.
+  if ! git rev-parse --verify "$branch" >/dev/null 2>&1; then
+    echo "classify-branch: branch $branch does not exist; scanning durable merge records" >&2
+    local nb_target
+    nb_target=$(integration_target) || { echo "classify-branch: cannot resolve integration target" >&2; diag; return 1; }
+    scan_merge_records "$task_id" "$nb_target"
+    if [ -n "$SCAN_MERGED" ]; then
+      diag
+      echo "BRANCH_STATE: already-merged:$SCAN_MERGED"
+      return 0
+    fi
+    if [ "$SCAN_POISONED" != "1" ]; then
+      echo "classify-branch: no merge record for $task_id is an ancestor of $nb_target" >&2
+    fi
+    diag
+    return 1
+  fi
 
   local target
   target=$(integration_target) || { echo "classify-branch: cannot resolve integration target" >&2; diag; return 1; }
@@ -1059,36 +1137,13 @@ cmd_classify_branch() {
     fi
   fi
 
-  # 2. Durable merge records, newest first. Empty-file-safe: no pipelines
-  # under set -e/pipefail, at most 20 candidate lines read.
-  local rec="$MERGE_RECORDS_DIR/$task_id"
-  if [ -f "$rec" ]; then
-    local count=0 sha full poisoned=""
-    while IFS= read -r line && [ "$count" -lt 20 ]; do
-      case "$line" in
-        merge_commit=*) sha="${line#merge_commit=}" ;;
-        *) continue ;;
-      esac
-      case "$sha" in ""|*[!0-9a-f]*) continue ;; esac
-      count=$((count + 1))
-      diag_records=$((diag_records + 1))
-      full=$(git rev-parse --verify --quiet "$sha" 2>/dev/null) || continue
-      # A merge commit: the frozen first-parent diff the workflow reviews
-      # only exists for merges. A non-merge ancestor is never the task's
-      # merge — skipped, not poison (garbage must not veto delivery).
-      git rev-parse --verify --quiet "$full^2" >/dev/null 2>&1 || continue
-      diag_resolvable=$((diag_resolvable + 1))
-      if git merge-base --is-ancestor "$full" "$target" 2>/dev/null; then
-        if [ -n "$poisoned" ]; then
-          echo "classify-branch: newest resolvable record $poisoned is stale (not an ancestor of $target); refusing older record $full" >&2
-          break
-        fi
-        diag
-        echo "BRANCH_STATE: already-merged:$full"
-        return 0
-      fi
-      [ -z "$poisoned" ] && poisoned="$full"
-    done < <(tac "$rec" 2>/dev/null)
+  # 2. Durable merge records, newest first (scan_merge_records; blocker 50
+  # shares this scan with the no-branch path).
+  scan_merge_records "$task_id" "$target"
+  if [ -n "$SCAN_MERGED" ]; then
+    diag
+    echo "BRANCH_STATE: already-merged:$SCAN_MERGED"
+    return 0
   fi
 
   diag

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.11",
+  "version": "0.14.13",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-dispatch.js

@@ -561,6 +561,12 @@ const eligible = [];
 const retryCandidates = [];
 const rejectionCandidates = [];
 
+// Dispatch-decision log (2026-09-24): per-reason ineligibility counters for
+// the .dispatch-decisions.jsonl declaration. Sparse — only non-zero keys are
+// emitted. Additive only; the eligibility decisions below are unchanged.
+var decisionSkipped = {};
+function countSkipped(reason) { decisionSkipped[reason] = (decisionSkipped[reason] || 0) + 1; }
+
 // ── Retry cap ────────────────────────────────────────────────────────
 // Symphony owns phase-redispatch policy (coordination layer): the spec
 // defines backoff but no attempt cap ("implementation-defined"), so the
@@ -591,12 +597,13 @@ var MAX_CONSECUTIVE_REJECTIONS = configInt(config, "maxConsecutiveRejections", 2
 
 for (var t = 0; t < allTasks.length; t++) {
   var task = allTasks[t];
-  if (task.blocked) continue;
+  if (task.blocked) { countSkipped("blocked"); continue; }
 
   // Skip tasks with an active dispatch reservation: the worker launched a
   // workflow for this task on a previous tick, but the workflow has not yet
   // self-claimed (claims can take 15+ minutes for cron-launched runs).
   if (reservedTaskIds.has(task.id)) {
+    countSkipped("reserved");
     log("Skipped \"" + task.title + "\" — active dispatch reservation (workflow launched, claim pending)");
     continue;
   }
@@ -604,6 +611,7 @@ for (var t = 0; t < allTasks.length; t++) {
   // Skip tasks from quiesced projects
   var taskProject = task.project || DEFAULT_PROJECT;
   if (quiescedProjects[taskProject]) {
+    countSkipped("quiesced");
     log("Skipped \"" + task.title + "\" — project " + taskProject + " is quiesced");
     continue;
   }
@@ -614,6 +622,7 @@ for (var t = 0; t < allTasks.length; t++) {
   // task never moves. Set repo_path via updateproject to re-enable.
   var taskProjCfg = PROJECTS[taskProject];
   if (!taskProjCfg || !taskProjCfg.repo_path) {
+    countSkipped("no_repo");
     log("Skipped \"" + task.title + "\" — project " + taskProject + " has no repo_path configured");
     continue;
   }
@@ -633,12 +642,14 @@ for (var t = 0; t < allTasks.length; t++) {
   // (clears) next_phase on its successful self-claim, exactly once.
   if (task.next_phase) {
     if (task.state !== "todo" && task.state !== "in_progress") {
+      countSkipped("next_phase_state");
       log("Skipped \"" + task.title + "\" — next_phase \"" + task.next_phase + "\" set but state is " + task.state + "; left set for inspection");
       continue;
     }
-    if (latest && latest.status === "running") continue; // work in flight
+    if (latest && latest.status === "running") { countSkipped("in_flight"); continue; } // work in flight
     var npIdx = steps.indexOf(task.next_phase);
     if (npIdx < 0) {
+      countSkipped("next_phase_bad_step");
       log("Skipped \"" + task.title + "\" — next_phase \"" + task.next_phase + "\" not in " + workflow + " step registry; left set for a corrected recover-task");
       continue;
     }
@@ -654,19 +665,20 @@ for (var t = 0; t < allTasks.length; t++) {
     continue;
   }
 
-  if (task.state !== "in_progress") continue;
+  if (task.state !== "in_progress") { countSkipped("terminal_state"); continue; }
 
   if (!latest) {
     eligible.push({ task: task, startStep: 0, reason: "no_session", workflow: workflow });
     continue;
   }
 
-  if (latest.status === "running") continue; // work in flight
+  if (latest.status === "running") { countSkipped("in_flight"); continue; } // work in flight
 
   if (latest.status === "completed") {
     var stepName = latest.step || "";
     var stepIndex = steps.indexOf(stepName);
     if (stepIndex < 0) {
+      countSkipped("unknown_step");
       log("Skipped \"" + task.title + "\" — step \"" + stepName + "\" not in " + workflow + " step registry");
       continue;
     }
@@ -695,6 +707,7 @@ for (var t = 0; t < allTasks.length; t++) {
     var failedStep = latest.step || "";
     var retryIdx = steps.indexOf(failedStep);
     if (retryIdx < 0) {
+      countSkipped("unknown_step");
       log("Skipped \"" + task.title + "\" — step \"" + failedStep + "\" not in " + workflow + " step registry");
       continue;
     }
@@ -756,6 +769,7 @@ if (rejectionCandidates.length > 0) {
 // the task stays retryable and is re-parked next tick, so this is
 // fail-safe. The dashboard stamps retry_reset_at on parked→todo, which
 // restarts both counters mechanically.
+var parkedTaskIds = [];
 if (parkJobs.length > 0) {
   var parkSteps = [];
   for (var pji = 0; pji < parkJobs.length; pji++) {
@@ -775,6 +789,7 @@ if (parkJobs.length > 0) {
       { key: "park-batch", label: "Parking " + parkJobs.length + " task(s) at retry cap" }
     );
     log("Parked " + parkJobs.length + " task(s)");
+    parkedTaskIds = parkJobs.map(function(pj) { return pj.task.id; });
   } catch (parkErr) {
     log("WARNING: park batch failed (" + (parkErr.message || String(parkErr)).slice(0, 200) + ") — tasks remain retryable");
   }
@@ -959,6 +974,7 @@ for (var ei = 0; ei < eligible.length; ei++) {
     toProcess.push(eitem);
     inFlightByProject[ep] = current + 1;
   } else {
+    countSkipped("at_limit");
     log("Skipped \"" + eitem.task.title + "\" — project " + ep + " at simultaneity limit (" + limit + ")");
   }
 }
@@ -1164,6 +1180,63 @@ if (recommended.length > 0) {
   recommended = acquired;
 }
 
+// ── 4c. Dispatch-decision log ──────────────────────────────────
+// Hoverboat (2026-09-24): the dispatcher declares its own decision, in its
+// own bytes, on crew-home disk — one append-only line per completed tick in
+// $CREW_HOME/.dispatch-decisions.jsonl. The observer reads the file
+// directly (no LLM re-emission, no platform ferry), so the plausible-value
+// mutation that poisoned the old dispatch_sample attribution cannot occur.
+// Launch declarations are verified mechanically against crew DB effects
+// (platform_run_tasks / dispatch_reservations); a stand-down is the
+// dispatcher's explicit declaration with board context, auditable without
+// re-deriving eligibility. tick_seq couples each line to the .tick-releases
+// line for the same poll — a tick-release line with no decision line means
+// the tick died after poll-ack and is visible as such.
+// seq is the non-empty line count + 1 of this file (file order is the
+// proof — no wall-clock calls, see tests/determinism.test.js).
+// Fire-and-forget: the script swallows its own errors and exits 0, the
+// agent call carries no schema, and the whole call is wrapped in
+// try/catch — a failed write can never fail the tick. The script echoes
+// the appended line (same rooms #12–#14 empty-result contract as §4b).
+var dispatchDecisionScript = [
+  "var crewHome=process.argv[1];",
+  "var decisionJson=process.argv[2];",
+  "try{",
+  "var fs=require(\"fs\"),path=require(\"path\");",
+  "var decision=JSON.parse(decisionJson);",
+  "if(!decision||typeof decision.decision!==\"string\"||!Array.isArray(decision.launched)){throw new Error(\"bad decision payload\");}",
+  "var release=path.basename(path.resolve(crewHome,fs.readlinkSync(path.join(crewHome,\"current\"))));",
+  "var file=path.join(crewHome,\".dispatch-decisions.jsonl\");",
+  "var count=0;",
+  "try{var lines=fs.readFileSync(file,\"utf8\").split(\"\\n\");for(var i=0;i<lines.length;i++){if(lines[i].trim()!==\"\"){count++;}}}catch(e){}",
+  "var tickSeq=0;",
+  "try{var tlines=fs.readFileSync(path.join(crewHome,\".tick-releases.jsonl\"),\"utf8\").split(\"\\n\");for(var j=0;j<tlines.length;j++){if(tlines[j].trim()!==\"\"){tickSeq++;}}}catch(e){}",
+  "var line=JSON.stringify({seq:count+1,tick_seq:tickSeq,release:release,decision:decision.decision,launched:decision.launched,completed:decision.completed||[],parked:decision.parked||[],board:decision.board||null,skipped:decision.skipped||{},partial:!!decision.partial});",
+  "fs.appendFileSync(file,line+\"\\n\");",
+  "process.stdout.write(line+\"\\n\");",
+  "}catch(e){}",
+  "process.exit(0);"
+].join("");
+var launchedRecs = recommended.map(function(r) { return { task_id: r.task_id, workflow: r.workflow, step: r.step }; });
+var decisionObj = {
+  decision: launchedRecs.length > 0 ? "launch" : "stand_down",
+  launched: launchedRecs,
+  completed: completed.map(function(r) { return r.task_id; }),
+  parked: parkedTaskIds,
+  board: { seen: allTasks.length, eligible: eligible.length },
+  skipped: decisionSkipped,
+  partial: partial
+};
+var dispatchDecisionCmd = "node -e '" + dispatchDecisionScript + "' '" + crewHome.replace(/'/g, "'\\''") + "' '" + JSON.stringify(decisionObj).replace(/'/g, "'\\''") + "'";
+try {
+  await agent(
+    "Record this tick's dispatch decision.\nRun in shell and return the stdout verbatim:\n" + dispatchDecisionCmd,
+    { key: "dispatch-decision", label: "Recording dispatch decision" }
+  );
+} catch (e) {
+  log("WARNING: dispatch-decision log write failed (tick continues): " + e.message);
+}
+
 var msg = "Dispatch complete.";
 if (recommended.length > 0) {
   msg += " Recommended: " + recommended.map(function(r) { return r.workflow + "/" + r.step + " for " + r.task_id; }).join(", ") + ".";