muse-crew 0.14.12 → 0.14.13

package/docs/decisions/AGENTS.md

@@ -6,6 +6,12 @@ history lives here. One canonical section per `<a id>` anchor — a critic
 re-verified that every `docs/decisions/*.md#anchor` reference in
 `workflows/*.js` resolves (45 unique references).
 
+## dispatch-decision-log.md — Decision history: dispatch decision log (hoverboat)
+
+- `#checksum-vs-hoverboat` — The ferry-corruption problem and the two candidates
+- `#why-hoverboat-won` — Availability, trust, subtraction, primary-source rationale
+- `#what-was-built` — Declaration shape, skip counters, observer ingestion, retirements
+
 ## publish-path.md — Decision history: publish path
 
 - `#fire-and-forget-trigger` — Fire-and-forget trigger + workflow-owned observation

package/docs/decisions/dispatch-decision-log.md

@@ -0,0 +1,69 @@
+# Dispatch decision log (hoverboat) — 2026-09-24
+
+<a id="checksum-vs-hoverboat"></a>
+## The problem
+
+The Gate 2 observer attributed dispatch decisions by ferrying platform
+`scheduler.job_runs` rows through an LLM paste (tick worker: `muse.db`
+result → heredoc → `record_platform.sh --dispatch` → `dispatch_sample`
+rows → `attribute_dispatch.sh` → `dispatch_decision` rows). The paste
+mutated plausible values: a 2026-09-24 consistency scan found 275
+same-`run_id` contradictory `dispatch_sample` rows and 65 derived
+`dispatch_decision` rows based on corrupt data (5.7% of samples
+quarantined; 63.6% of ticks touched). The older `quarantine_suspects.sh`
+handled near-neighbor UUID mutations, not plausible value mutation.
+
+## The two candidates
+
+**Checksum ferry** (containment): keep the ferry; the worker checksums the
+raw tool-result JSON before the paste and `record_platform.sh` verifies
+after. Corrupt pastes become loud absences instead of silent corruption.
+
+**Hoverboat** (local declaration): the dispatcher writes its decision to
+`$CREW_HOME/.dispatch-decisions.jsonl` in its own bytes (deterministic JS,
+same courier shape as the proven §4b tick-release writer); the observer
+reads the file directly and verifies launch declarations mechanically
+against crew DB effects (`platform_run_tasks`, `dispatch_reservations`).
+
+<a id="why-hoverboat-won"></a>
+## Why hoverboat won
+
+1. **Availability.** Corruption touched ~63.6% of ticks. Checksum converts
+   corruption into absence, but the entry demo needs ten consecutive ticks
+   each recording a decision — absence fails the demo as surely as
+   corruption. Hoverboat's channel has no LLM re-emission at all.
+2. **Trust.** The checksum would be computed by the same worker agent that
+   corrupts the paste — asking the corrupting agent to honestly report its
+   own corruption. Hoverboat's declaration is composed by deterministic
+   workflow JS and checked against independent DB effects.
+3. **Subtraction.** Checksum keeps the ferry, the rolling 25h re-record
+   window, and the quarantine machinery permanently busy. Hoverboat deletes
+   the sample→decision attribution entirely; the platform ferry remains
+   only as platform-health telemetry.
+4. **The crew already knows.** Having the platform tell the observer what
+   the crew decided, through an LLM paste, when the crew can write it
+   directly, is the ferry. The declaration is the primary source; the DB
+   effects are the independent verification.
+
+Rejected alternative considered: a deterministic Crew API action for the
+write. It would not remove the agent from the path (workflows reach the
+CLI only through `agent()` shell calls), so it adds API surface for no
+integrity gain. The embedded courier is the proven seam.
+
+<a id="what-was-built"></a>
+## What was built
+
+- `workflows/crew-dispatch.js` §4c: per-tick declaration
+  `{seq, tick_seq, release, decision, launched[], completed[], parked[],
+  board{seen,eligible}, skipped{reason:count sparse}, partial}`.
+  `tick_seq` couples each line to the `.tick-releases.jsonl` line for the
+  same poll — a tick-release line with no decision line means the tick died
+  after poll-ack, visibly.
+- Per-reason ineligibility counters (`countSkipped`) at every skip site in
+  the eligibility loop + the simultaneity-limit skip, so stand-downs are
+  auditable without re-deriving eligibility.
+- Observer: `ingest_decisions.sh` replaces `attribute_dispatch.sh`;
+  `snapshot.sh` dispatch section rewritten around decision rows.
+- Retired: sample→decision attribution, `state/attributed.json` watermark.
+  Kept: `record_platform.sh --dispatch` as platform-health telemetry,
+  `quarantine_suspects.sh` for the health samples' ID mutations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.12",
+  "version": "0.14.13",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-dispatch.js

@@ -561,6 +561,12 @@ const eligible = [];
 const retryCandidates = [];
 const rejectionCandidates = [];
 
+// Dispatch-decision log (2026-09-24): per-reason ineligibility counters for
+// the .dispatch-decisions.jsonl declaration. Sparse — only non-zero keys are
+// emitted. Additive only; the eligibility decisions below are unchanged.
+var decisionSkipped = {};
+function countSkipped(reason) { decisionSkipped[reason] = (decisionSkipped[reason] || 0) + 1; }
+
 // ── Retry cap ────────────────────────────────────────────────────────
 // Symphony owns phase-redispatch policy (coordination layer): the spec
 // defines backoff but no attempt cap ("implementation-defined"), so the
@@ -591,12 +597,13 @@ var MAX_CONSECUTIVE_REJECTIONS = configInt(config, "maxConsecutiveRejections", 2
 
 for (var t = 0; t < allTasks.length; t++) {
   var task = allTasks[t];
-  if (task.blocked) continue;
+  if (task.blocked) { countSkipped("blocked"); continue; }
 
   // Skip tasks with an active dispatch reservation: the worker launched a
   // workflow for this task on a previous tick, but the workflow has not yet
   // self-claimed (claims can take 15+ minutes for cron-launched runs).
   if (reservedTaskIds.has(task.id)) {
+    countSkipped("reserved");
     log("Skipped \"" + task.title + "\" — active dispatch reservation (workflow launched, claim pending)");
     continue;
   }
@@ -604,6 +611,7 @@ for (var t = 0; t < allTasks.length; t++) {
   // Skip tasks from quiesced projects
   var taskProject = task.project || DEFAULT_PROJECT;
   if (quiescedProjects[taskProject]) {
+    countSkipped("quiesced");
     log("Skipped \"" + task.title + "\" — project " + taskProject + " is quiesced");
     continue;
   }
@@ -614,6 +622,7 @@ for (var t = 0; t < allTasks.length; t++) {
   // task never moves. Set repo_path via updateproject to re-enable.
   var taskProjCfg = PROJECTS[taskProject];
   if (!taskProjCfg || !taskProjCfg.repo_path) {
+    countSkipped("no_repo");
     log("Skipped \"" + task.title + "\" — project " + taskProject + " has no repo_path configured");
     continue;
   }
@@ -633,12 +642,14 @@ for (var t = 0; t < allTasks.length; t++) {
   // (clears) next_phase on its successful self-claim, exactly once.
   if (task.next_phase) {
     if (task.state !== "todo" && task.state !== "in_progress") {
+      countSkipped("next_phase_state");
       log("Skipped \"" + task.title + "\" — next_phase \"" + task.next_phase + "\" set but state is " + task.state + "; left set for inspection");
       continue;
     }
-    if (latest && latest.status === "running") continue; // work in flight
+    if (latest && latest.status === "running") { countSkipped("in_flight"); continue; } // work in flight
     var npIdx = steps.indexOf(task.next_phase);
     if (npIdx < 0) {
+      countSkipped("next_phase_bad_step");
       log("Skipped \"" + task.title + "\" — next_phase \"" + task.next_phase + "\" not in " + workflow + " step registry; left set for a corrected recover-task");
       continue;
     }
@@ -654,19 +665,20 @@ for (var t = 0; t < allTasks.length; t++) {
     continue;
   }
 
-  if (task.state !== "in_progress") continue;
+  if (task.state !== "in_progress") { countSkipped("terminal_state"); continue; }
 
   if (!latest) {
     eligible.push({ task: task, startStep: 0, reason: "no_session", workflow: workflow });
     continue;
   }
 
-  if (latest.status === "running") continue; // work in flight
+  if (latest.status === "running") { countSkipped("in_flight"); continue; } // work in flight
 
   if (latest.status === "completed") {
     var stepName = latest.step || "";
     var stepIndex = steps.indexOf(stepName);
     if (stepIndex < 0) {
+      countSkipped("unknown_step");
       log("Skipped \"" + task.title + "\" — step \"" + stepName + "\" not in " + workflow + " step registry");
       continue;
     }
@@ -695,6 +707,7 @@ for (var t = 0; t < allTasks.length; t++) {
     var failedStep = latest.step || "";
     var retryIdx = steps.indexOf(failedStep);
     if (retryIdx < 0) {
+      countSkipped("unknown_step");
       log("Skipped \"" + task.title + "\" — step \"" + failedStep + "\" not in " + workflow + " step registry");
       continue;
     }
@@ -756,6 +769,7 @@ if (rejectionCandidates.length > 0) {
 // the task stays retryable and is re-parked next tick, so this is
 // fail-safe. The dashboard stamps retry_reset_at on parked→todo, which
 // restarts both counters mechanically.
+var parkedTaskIds = [];
 if (parkJobs.length > 0) {
   var parkSteps = [];
   for (var pji = 0; pji < parkJobs.length; pji++) {
@@ -775,6 +789,7 @@ if (parkJobs.length > 0) {
       { key: "park-batch", label: "Parking " + parkJobs.length + " task(s) at retry cap" }
     );
     log("Parked " + parkJobs.length + " task(s)");
+    parkedTaskIds = parkJobs.map(function(pj) { return pj.task.id; });
   } catch (parkErr) {
     log("WARNING: park batch failed (" + (parkErr.message || String(parkErr)).slice(0, 200) + ") — tasks remain retryable");
   }
@@ -959,6 +974,7 @@ for (var ei = 0; ei < eligible.length; ei++) {
     toProcess.push(eitem);
     inFlightByProject[ep] = current + 1;
   } else {
+    countSkipped("at_limit");
     log("Skipped \"" + eitem.task.title + "\" — project " + ep + " at simultaneity limit (" + limit + ")");
   }
 }
@@ -1164,6 +1180,63 @@ if (recommended.length > 0) {
   recommended = acquired;
 }
 
+// ── 4c. Dispatch-decision log ──────────────────────────────────
+// Hoverboat (2026-09-24): the dispatcher declares its own decision, in its
+// own bytes, on crew-home disk — one append-only line per completed tick in
+// $CREW_HOME/.dispatch-decisions.jsonl. The observer reads the file
+// directly (no LLM re-emission, no platform ferry), so the plausible-value
+// mutation that poisoned the old dispatch_sample attribution cannot occur.
+// Launch declarations are verified mechanically against crew DB effects
+// (platform_run_tasks / dispatch_reservations); a stand-down is the
+// dispatcher's explicit declaration with board context, auditable without
+// re-deriving eligibility. tick_seq couples each line to the .tick-releases
+// line for the same poll — a tick-release line with no decision line means
+// the tick died after poll-ack and is visible as such.
+// seq is the non-empty line count + 1 of this file (file order is the
+// proof — no wall-clock calls, see tests/determinism.test.js).
+// Fire-and-forget: the script swallows its own errors and exits 0, the
+// agent call carries no schema, and the whole call is wrapped in
+// try/catch — a failed write can never fail the tick. The script echoes
+// the appended line (same rooms #12–#14 empty-result contract as §4b).
+var dispatchDecisionScript = [
+  "var crewHome=process.argv[1];",
+  "var decisionJson=process.argv[2];",
+  "try{",
+  "var fs=require(\"fs\"),path=require(\"path\");",
+  "var decision=JSON.parse(decisionJson);",
+  "if(!decision||typeof decision.decision!==\"string\"||!Array.isArray(decision.launched)){throw new Error(\"bad decision payload\");}",
+  "var release=path.basename(path.resolve(crewHome,fs.readlinkSync(path.join(crewHome,\"current\"))));",
+  "var file=path.join(crewHome,\".dispatch-decisions.jsonl\");",
+  "var count=0;",
+  "try{var lines=fs.readFileSync(file,\"utf8\").split(\"\\n\");for(var i=0;i<lines.length;i++){if(lines[i].trim()!==\"\"){count++;}}}catch(e){}",
+  "var tickSeq=0;",
+  "try{var tlines=fs.readFileSync(path.join(crewHome,\".tick-releases.jsonl\"),\"utf8\").split(\"\\n\");for(var j=0;j<tlines.length;j++){if(tlines[j].trim()!==\"\"){tickSeq++;}}}catch(e){}",
+  "var line=JSON.stringify({seq:count+1,tick_seq:tickSeq,release:release,decision:decision.decision,launched:decision.launched,completed:decision.completed||[],parked:decision.parked||[],board:decision.board||null,skipped:decision.skipped||{},partial:!!decision.partial});",
+  "fs.appendFileSync(file,line+\"\\n\");",
+  "process.stdout.write(line+\"\\n\");",
+  "}catch(e){}",
+  "process.exit(0);"
+].join("");
+var launchedRecs = recommended.map(function(r) { return { task_id: r.task_id, workflow: r.workflow, step: r.step }; });
+var decisionObj = {
+  decision: launchedRecs.length > 0 ? "launch" : "stand_down",
+  launched: launchedRecs,
+  completed: completed.map(function(r) { return r.task_id; }),
+  parked: parkedTaskIds,
+  board: { seen: allTasks.length, eligible: eligible.length },
+  skipped: decisionSkipped,
+  partial: partial
+};
+var dispatchDecisionCmd = "node -e '" + dispatchDecisionScript + "' '" + crewHome.replace(/'/g, "'\\''") + "' '" + JSON.stringify(decisionObj).replace(/'/g, "'\\''") + "'";
+try {
+  await agent(
+    "Record this tick's dispatch decision.\nRun in shell and return the stdout verbatim:\n" + dispatchDecisionCmd,
+    { key: "dispatch-decision", label: "Recording dispatch decision" }
+  );
+} catch (e) {
+  log("WARNING: dispatch-decision log write failed (tick continues): " + e.message);
+}
+
 var msg = "Dispatch complete.";
 if (recommended.length > 0) {
   msg += " Recommended: " + recommended.map(function(r) { return r.workflow + "/" + r.step + " for " + r.task_id; }).join(", ") + ".";