muse-crew 0.14.2 → 0.14.3

package/lib/publish-npm.sh

@@ -82,7 +82,42 @@ if [ "$PREFLIGHT_CHECK_CODE" -ne 0 ] \
 fi
 # PREFLIGHT-END
 
-# 3. Dry run: markers only, no lock, no deploy, no mutation.
+# PUSH-TARGET-ANCHOR: resolve the push destination before ANY mutation.
+# The destination is the integration target resolved by the lifecycle, not a
+# hardcoded `main` (2026-09-19 REVIEW: the old `git push origin main` was a
+# stale clone of the same hardcoding the integrate fix removed). A detached
+# HEAD pushes as HEAD:<destination>, with the destination resolved explicitly
+# by the lifecycle's push-destination command (2026-09-19 detached-HEAD audit
+# REDO: the old code refused every detached checkout; detached publication
+# is legitimate and must work). Fail here, before the version-bump commit
+# and the registry publish, only when the destination is genuinely
+# unknowable -- never after a side effect you cannot roll back. (The old
+# position of this check -- step 13, after the npm publish -- left a shipped
+# version with a failed phase and a retry loop.)
+# No-origin is checked for BOTH shapes (2026-09-19 critic finding F-A1):
+# step 13 pushes unconditionally, so an attached checkout with no origin
+# would otherwise fail PUBLISH_FAILED=push after the version-bump commit
+# and the registry publish. A version-bump commit with nowhere to record it
+# would ship an npm version with no git provenance, so no-remote fails
+# closed here rather than skipping like the integrate path (F-F6).
+[ -n "${LIFECYCLE:-}" ] || fail "env" "LIFECYCLE is not set -- cannot resolve the push destination before mutation (F-R4)"
+PUSH_TARGET="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "$LIFECYCLE" integration-target 2>&1)" \
+  || fail "integration-target" "$PUSH_TARGET"
+if ! git -C "$REPO_PATH" remote get-url origin >/dev/null 2>&1; then
+  fail "env" "no origin remote configured: the version-bump commit could not be pushed anywhere -- no version-bump commit was created and nothing was published"
+fi
+PUSH_REFSPEC="$PUSH_TARGET"
+if [ "$PUSH_TARGET" = "HEAD" ]; then
+  PUSH_DEST="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "$LIFECYCLE" push-destination 2>&1)" \
+    || fail "env" "$PUSH_DEST"
+  PUSH_REFSPEC="HEAD:$PUSH_DEST"
+fi
+# PUSH-TARGET-END
+
+# 3. Dry run: markers only, no lock, no deploy, no mutation. The push
+# preflight above already ran, so even a dry run fails closed on a
+# genuinely unknowable push destination (see case 7 in
+# lib/test-publish-preflight.sh -- F-R9).
 if [ "${DRY_RUN:-0}" = "1" ]; then
   echo "PUBLISH_DRY_RUN=1"
   exit 0
@@ -281,15 +316,9 @@ LOCK_OUT2="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "${LIFECYCLE
   || fail "lock-refresh" "$LOCK_OUT2"
 
 # 13. Push the version-bump commit (idempotent: no-op if already pushed).
-# The destination is the integration target resolved by the lifecycle, not a
-# hardcoded `main` (2026-09-19 REVIEW: the old `git push origin main` was a
-# stale clone of the same hardcoding the integrate fix removed).
-PUSH_TARGET="$(CREW_HOME="${CREW_HOME:-}" CREW_REPO="$REPO_PATH" bash "${LIFECYCLE:?LIFECYCLE is required}" integration-target 2>&1)" \
-  || fail "integration-target" "$PUSH_TARGET"
-if [ "$PUSH_TARGET" = "HEAD" ]; then
-  fail "push" "detached HEAD: publish-npm cannot push a version-bump commit from a detached checkout"
-fi
-PUSH_OUT="$(git -C "$REPO_PATH" push origin "$PUSH_TARGET" 2>&1)" \
+# PUSH_REFSPEC was resolved in the preflight above -- a branch name, or
+# HEAD:<destination> on a detached checkout (never a bare HEAD).
+PUSH_OUT="$(git -C "$REPO_PATH" push origin "$PUSH_REFSPEC" 2>&1)" \
   || fail "push" "$PUSH_OUT"
 echo "PUBLISH_PUSHED=1"
 

package/lib/retry-publish.js

@@ -180,8 +180,11 @@ if (phase === "prepare") {
     }
 
     const classifierPath = join(crewHome, "lib", "classify-publish-absence.js");
-    // Find the trigger entry for the manifest baseline.
-    const trigger = [...entries].reverse().find((e) =>
+    // Find the trigger entry for the manifest baseline: the OLDEST matching
+    // "submitted" (the trigger issuance), matching verify-publish.js's anchor.
+    // agent_id is null on the issuance entry (no receipt observed at trigger
+    // time) — the baseline comes from manifest_before, never agent_id.
+    const trigger = entries.find((e) =>
       e.outcome === "submitted" && e.commit === commit && (attempt == null || e.attempt === attempt));
     const manifestBefore = trigger && trigger.manifest_before ? JSON.stringify(trigger.manifest_before) : null;
 

package/lib/test-detached-integrate.sh

@@ -22,7 +22,8 @@
 #   6. NOT move the main branch (it still points at A)
 #   7. write integration_target=HEAD in the merge record
 #   8. verify-merge → VERIFIED
-#   9. push-target → PUSH_SKIPPED (detached HEAD has no remote counterpart)
+#   9. push-target → NO_REMOTE_PUSH (fixture A has no origin; a detached
+#      line with no remote has nowhere to push -- loud, not silent)
 #
 # Fixture B (branch — the old behavior is preserved):
 #   repo on main with a local bare origin. Integrate merges, reconciles,
@@ -49,6 +50,14 @@
 #   crash): re-running integrate takes the lock and pushes instead of
 #   parking on MERGED_EMPTY.
 #
+# Fixture H (detached HEAD with an origin — 2026-09-19 detached-HEAD audit
+# REDO): H1 proves push-destination fails closed when origin/HEAD is unset
+# (genuinely unknowable destination); H2-H5 prove the detached line pushes
+# explicitly as HEAD:main — inline push reports
+# `PUSHED: origin/main (refspec HEAD:main)`, the remote ref advances to the
+# merge commit, local main stays at the reviewed base, HEAD stays detached,
+# verify-merge VERIFIEDs, and push-target re-pushes idempotently.
+#
 # Hermetic: scratch dirs under /tmp only, removed at start (and end).
 set -u
 
@@ -126,9 +135,9 @@ echo "$rec" | grep -q '^integration_target=HEAD$' || fail "merge record missing
 out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "verify-merge exited non-zero: $out"
 echo "$out" | grep -q '^VERIFIED:' || fail "verify-merge: expected VERIFIED, got: $out"
 
-# 9. push-target skips loudly on a detached HEAD
+# 9. push-target on a detached HEAD with no remote: loud NO_REMOTE_PUSH
 out=$(bash "$LIFECYCLE" push-target "$tid") || fail "push-target exited non-zero: $out"
-echo "$out" | grep -q '^PUSH_SKIPPED: detached HEAD' || fail "push-target: expected PUSH_SKIPPED, got: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH: no origin remote configured' || fail "push-target: expected NO_REMOTE_PUSH, got: $out"
 
 echo "fixture A (detached HEAD): all checks passed"
 
@@ -336,5 +345,72 @@ echo "$out" | grep -qi 'lock lost' && fail "G: misleading lock-lost error: $out"
 
 echo "fixture G (push-target after MERGED_EMPTY): all checks passed"
 
+# ---------------- Fixture H: detached HEAD with an origin ----------------
+# (2026-09-19 detached-HEAD audit REDO: a detached line with a remote is
+# pushed explicitly as HEAD:<destination> -- the remote's default branch --
+# never silently skipped, never refused. The local branch the line
+# descends from is NOT moved; only the remote ref advances.)
+H_DIR="$T/fixture-h"
+H_REMOTE="$T/remote-h.git"
+git init -q --bare "$H_REMOTE"
+mkdir -p "$H_DIR"
+cd "$H_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed base"
+H_BASE=$(git rev-parse HEAD)
+git remote add origin "$H_REMOTE"
+git push -q origin main
+git fetch -q origin
+# Detach at the reviewed base, crew-init stamp on top -- the detached line
+# the REDO must push explicitly (set origin/HEAD only after H1).
+git checkout -q --detach HEAD
+echo crew-init >> f.txt
+git commit -qam "crew-init: stamp provenance"
+H_LINE=$(git rev-parse HEAD)
+git symbolic-ref -q HEAD >/dev/null && fail "fixture H: HEAD should be detached"
+export CREW_REPO="$H_DIR"
+export CREW_HOME="$H_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"
+# H1: origin/HEAD not set -- the destination is genuinely unknowable --
+# push-destination fails closed (never a silent skip, never a bare-HEAD push)
+out=$(bash "$LIFECYCLE" push-destination 2>&1) && fail "H1: push-destination should fail without origin/HEAD: $out"
+echo "$out" | grep -q 'genuinely unknowable' || fail "H1: expected unknowable error, got: $out"
+echo "fixture H1 (unknowable destination fails closed): passed"
+# Now set the remote default branch explicitly (hermetic: no `remote set-head -a` network round-trip)
+git symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
+tid="detachedorigin1"
+
+# H2: push-destination resolves the remote default branch
+out=$(bash "$LIFECYCLE" push-destination) || fail "H2 push-destination exited non-zero: $out"
+[ "$out" = "main" ] || fail "H2 push-destination: expected main, got: $out"
+
+# H3: prepare + task work, then integrate pushes inline as HEAD:main
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "H3 prepare exited non-zero: $out"
+echo task-work >> "$H_DIR/.worktrees/$tid/f.txt"
+(cd "$H_DIR/.worktrees/$tid" && git commit -qam "task work")
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "H3 integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "H3 integrate: expected MERGED, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main (refspec HEAD:main)' || fail "H3 integrate: expected explicit detached PUSHED, got: $out"
+
+# H4: HEAD still detached; the detached line survived; the remote advanced
+git symbolic-ref -q HEAD >/dev/null && fail "H4: HEAD should still be detached"
+H_MERGE=$(git rev-parse HEAD)
+git merge-base --is-ancestor "$H_BASE" HEAD || fail "H4: reviewed base abandoned"
+git merge-base --is-ancestor "$H_LINE" HEAD || fail "H4: detached line abandoned"
+[ "$(git rev-parse main)" = "$H_BASE" ] || fail "H4: local main moved (must stay at the reviewed base)"
+[ "$(git --git-dir="$H_REMOTE" rev-parse refs/heads/main)" = "$H_MERGE" ] || fail "H4: origin/main not updated to the merge commit"
+
+# H5: verify-merge VERIFIEDs; push-target re-pushes idempotently as HEAD:main
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "H5 verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "H5: expected VERIFIED, got: $out"
+out=$(bash "$LIFECYCLE" push-target "$tid") || fail "H5 push-target exited non-zero: $out"
+echo "$out" | grep -q '^PUSHED: origin/main (refspec HEAD:main)' || fail "H5 push-target: expected idempotent PUSHED, got: $out"
+
+echo "fixture H (detached HEAD + origin): all checks passed"
+
 rm -rf "$T"
 echo "PASS: detached-HEAD integrate fixtures"

package/lib/test-publish-preflight.sh

@@ -21,6 +21,17 @@
 #       * old helper that does not know --check (usage to stderr, exit 1,
 #         no CREDENTIAL markers) with DRY_RUN=1 -> no skip (fall-through
 #         preserved: unknown is not absent)
+#   - detached fixtures (detached-HEAD audit REDO, 2026-09-19): a detached
+#     checkout with a local origin. Case 6 (origin/HEAD set, DRY_RUN=1) ->
+#     preflight passes through to PUBLISH_DRY_RUN=1 (no refusal — detached
+#     publication is legitimate). Case 7 (origin/HEAD deleted, DRY_RUN=1) ->
+#     PUBLISH_FAILED=env before any mutation, repo untouched (the genuinely
+#     unknowable destination fails in the preflight, ahead of the DRY_RUN
+#     block).
+#   - Case 8: attached checkout with no origin (DRY_RUN=1) -> PUBLISH_FAILED=env
+#     pre-mutation, repo untouched (2026-09-19 critic F-A1: the anchor used to
+#     check no-origin only on the detached branch, so attached+no-origin
+#     failed post-mutation after the version-bump commit and registry publish).
 #   - --check probe unit test against the real helper: on the author
 #     machine this expects exit 0 and exactly CREDENTIAL_OK=custom.npm.
 #     NOTE: this case depends on the `custom.npm` credential existing in
@@ -52,6 +63,13 @@ git -C "$SCRATCH" config user.email "test@crew"
 git -C "$SCRATCH" config user.name "crew-test"
 echo x > "$SCRATCH/f.txt"
 git -C "$SCRATCH" add -A && git -C "$SCRATCH" commit -qm init
+# The scratch repo needs an origin for the DRY_RUN pass-through cases
+# (2026-09-19 critic F-A1: the push-destination anchor fails closed
+# pre-mutation when origin is absent, attached or detached).
+git init -q --bare "$TMPBASE/origin.git"
+git -C "$SCRATCH" remote add origin "$TMPBASE/origin.git"
+git -C "$SCRATCH" push -q origin main
+git -C "$SCRATCH" remote set-head origin -a
 
 # --- Fake helpers ---
 cat > "$TMPBASE/helper-ok.py" <<'EOF'
@@ -78,6 +96,32 @@ print("Usage: helper-old.py <tarball-path>", file=sys.stderr)
 sys.exit(1)
 EOF
 
+# --- Detached fixtures (detached-HEAD audit REDO, 2026-09-19): a detached
+# checkout with a local origin. Case 6 runs with origin/HEAD set; Case 7
+# deletes origin/HEAD first, exercising push-destination's genuinely-
+# unknowable branch. ---
+ORIGIN="$TMPBASE/origin-det.git"
+git init -q --bare "$ORIGIN"
+SCRATCH_DET="$TMPBASE/repo-detached"
+git init -q -b main "$SCRATCH_DET"
+git -C "$SCRATCH_DET" config user.email "test@crew"
+git -C "$SCRATCH_DET" config user.name "crew-test"
+echo x > "$SCRATCH_DET/f.txt"
+git -C "$SCRATCH_DET" add -A && git -C "$SCRATCH_DET" commit -qm init
+git -C "$SCRATCH_DET" remote add origin "$ORIGIN"
+git -C "$SCRATCH_DET" push -q origin main
+git -C "$SCRATCH_DET" remote set-head origin -a
+git -C "$SCRATCH_DET" checkout -q --detach HEAD
+
+# --- Attached no-origin fixture (F-A1): an attached checkout with no origin
+# fails closed in the anchor, attached or detached. ---
+SCRATCH_NOORIGIN="$TMPBASE/repo-no-origin"
+git init -q -b main "$SCRATCH_NOORIGIN"
+git -C "$SCRATCH_NOORIGIN" config user.email "test@crew"
+git -C "$SCRATCH_NOORIGIN" config user.name "crew-test"
+echo x > "$SCRATCH_NOORIGIN/f.txt"
+git -C "$SCRATCH_NOORIGIN" add -A && git -C "$SCRATCH_NOORIGIN" commit -qm init
+
 ACTIONABLE="npm publish not configured on this machine — see docs/guide.md#npm-releases; code changes are merged, nothing was versioned or published"
 
 # --- Structural: extract the shipped preflight block by anchor ---
@@ -123,13 +167,23 @@ fi
 
 # Runner: full publish-npm.sh against the scratch repo. The preflight exits
 # before any mutation, so the repo needs no package.json.
+# LIFECYCLE + CREW_HOME are exported because the preflight now resolves the
+# push destination up front (2026-09-19: the push-destination resolution moved
+# from step 13 to the preflight — fail before mutation, never after the
+# registry publish; 2026-09-19 detached-HEAD audit REDO: a detached checkout
+# resolves to HEAD:<destination>, refused only when genuinely unknowable).
+# The scratch repo sits on branch `main`, so integration-target
+# resolves cleanly and the npm-credential assertions are unaffected.
 run_full() { # run_full <helper_path> [extra_env...]
   local helper="$1"; shift
   local run="$TMPBASE/run-$RANDOM"
   mkdir -p "$run"
+  local crew_home="$TMPBASE/crew-home"
+  mkdir -p "$crew_home"
   (
     export TASK_ID="preflight-test" REPO_PATH="$SCRATCH" PKG="muse-crew" TARGET_VERSION="9.9.9"
     export NPM_PUBLISH_PY="$helper"
+    export LIFECYCLE="$SCRIPT_DIR/worktree-lifecycle.sh" CREW_HOME="$crew_home" CREW_REPO="$SCRATCH"
     # A bare `export` (empty "$@") would dump the environment to stdout and
     # corrupt the captured run path — only export when extras are given.
     if [ $# -gt 0 ]; then export "$@"; fi
@@ -140,11 +194,11 @@ run_full() { # run_full <helper_path> [extra_env...]
   echo "$run"
 }
 
-repo_state() { # prints "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
-  local head status tgz
-  head="$(git -C "$SCRATCH" rev-parse HEAD)"
-  status="$(git -C "$SCRATCH" status --porcelain | wc -l)"
-  tgz="$(find "$SCRATCH" -maxdepth 1 -name '*.tgz' | wc -l)"
+repo_state() { # repo_state [repo]: "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
+  local head status tgz repo="${1:-$SCRATCH}"
+  head="$(git -C "$repo" rev-parse HEAD)"
+  status="$(git -C "$repo" status --porcelain | wc -l)"
+  tgz="$(find "$repo" -maxdepth 1 -name '*.tgz' | wc -l)"
   echo "HEAD=$head STATUS=$status TGZ=$tgz"
 }
 
@@ -203,6 +257,41 @@ else
   no "real helper --check: code=$CHECK_CODE out='$CHECK_OUT' (expected CREDENTIAL_OK=custom.npm — this case is credential-dependent; see header)"
 fi
 
+# --- Case 6: detached + resolvable destination + DRY_RUN=1 -> pass-through, no refusal ---
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_DET")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_DRY_RUN=1"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_FAILED"* ]]; then
+  ok "detached + resolvable destination: preflight passes through to PUBLISH_DRY_RUN=1 (no refusal)"
+else
+  no "detached resolvable: code=$CODE out='$OUT'"
+fi
+
+# --- Case 7: detached + origin/HEAD unset -> PUBLISH_FAILED=env before any mutation ---
+git -C "$SCRATCH_DET" remote set-head origin -d
+BEFORE="$(repo_state "$SCRATCH_DET")"
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_DET")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state "$SCRATCH_DET")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=env"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_DRY_RUN=1"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "detached + unknowable destination: fails closed pre-mutation, repo untouched"
+else
+  no "detached unknowable: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
+# --- Case 8: attached + no origin -> PUBLISH_FAILED=env before any mutation ---
+BEFORE="$(repo_state "$SCRATCH_NOORIGIN")"
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_NOORIGIN")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state "$SCRATCH_NOORIGIN")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=env"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_DRY_RUN=1"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "attached + no origin: fails closed pre-mutation, repo untouched"
+else
+  no "attached no-origin: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
 bash -n "$PUBLISH" && ok "publish-npm.sh syntax OK" || no "publish-npm.sh syntax"
 
 echo ""

package/lib/verify-publish.js

@@ -298,8 +298,9 @@ if (head !== commit) {
 // 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
 // attempt is known — the original and retry attempts share a commit, and
 // positional selection is luck. Within one attempt, select the OLDEST
-// submitted entry (the trigger issuance; per blocker 2, audit observations
-// are now "build-observed", not "submitted").
+// submitted entry (the trigger issuance; a receipt-bearing second "submitted"
+// may follow it — the oldest binds the trigger instant, the latest carries
+// the observed agent_id).
 let triggerTs = null;
 let manifestBefore = null;
 try {
@@ -313,8 +314,6 @@ try {
     (attempt == null || e.attempt === attempt)
   );
   if (candidates.length > 0) {
-    // Oldest first: the trigger issuance is the first submitted entry for
-    // the attempt (observations are "build-observed" per blocker 2).
     candidates.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
     const e = candidates[0];
     triggerTs = e.ts || null;

package/lib/worktree-lifecycle.sh

@@ -150,6 +150,24 @@ integration_target() {
   git rev-parse --abbrev-ref HEAD 2>/dev/null || { echo "ERROR: cannot resolve HEAD"; return 1; }
 }
 
+# Resolve the remote branch a detached HEAD pushes to: the remote's default
+# branch (origin/HEAD). Prints the bare branch name (no origin/ prefix).
+# Attached checkouts never need this (their target IS the branch name).
+# Fails when the destination is genuinely unknowable -- the caller fails
+# closed (never a silent skip, never a refusal of a knowable push).
+# (2026-09-19 detached-HEAD audit REDO: the old code treated detached+remote
+# as PUSH_SKIPPED->PASS "by policy", hiding merged work that never reached
+# the remote. The contract is explicit HEAD:<destination> semantics.)
+resolve_push_destination() {
+  cd "$REPO"
+  local sym
+  sym=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null) || {
+    echo "ERROR: detached HEAD with an origin remote, but origin/HEAD is not set -- the push destination is genuinely unknowable; set it (git remote set-head origin -a) and retry -- not pushing"
+    return 1
+  }
+  printf '%s\n' "${sym#origin/}"
+}
+
 # (2026-09-19 REVIEW: the old integration_tip() helper is deleted — it had
 # zero call sites and cmd_verify_merge reimplemented tip resolution inline
 # with different semantics, a drift hazard. Tip resolution lives in exactly
@@ -323,8 +341,15 @@ acquire_merge_lock() {
 # refresh needed) and by cmd_push_target for the R5 manual-conflict path
 # (which refreshes the lock first). Never force-pushes.
 #
-# The caller must hold the merge lock. Prints one of PUSHED / PUSH_SKIPPED /
-# NO_REMOTE_PUSH and returns 0, or prints an ERROR line and returns 1.
+# The caller must hold the merge lock. Prints one of PUSHED /
+# NO_REMOTE_PUSH and returns 0, or prints PUSH_FAILED / CONFLICT / ERROR
+# and returns 1 as labeled. (PUSH_SKIPPED belongs to cmd_push_target's
+# nothing-merged path only -- F-R3.) The push
+# refspec is always explicit: a branch pushes as <branch>, a detached HEAD
+# pushes as HEAD:<destination> where the destination is the remote's
+# default branch resolved by resolve_push_destination() -- never a silent
+# skip (2026-09-19 detached-HEAD audit REDO: PUSH_SKIPPED->PASS on
+# detached+remote hid merged work that never reached the remote).
 do_push() {
   local task_id="$1"
   cd "$REPO"
@@ -332,17 +357,6 @@ do_push() {
   local target
   target=$(integration_target) || return 1
 
-  # Detached HEAD: by design the integration line is local to this checkout
-  # (clean-room staging pins the reviewed commit; no remote ref is claimed
-  # for the detached line), so there is nothing to push. This is a policy
-  # statement, not a git limitation — `git push origin HEAD:<ref>` would
-  # work; we choose not to push the detached line. Room evidence is
-  # preserved in room state; releases ship through the loop's Publish phase.
-  if [ "$target" = "HEAD" ]; then
-    echo "PUSH_SKIPPED: detached HEAD -- the integration line is local by design; nothing to push"
-    return 0
-  fi
-
   # No remote configured: fail soft, loudly. (2026-09-19 REVIEW: the old
   # code ran `git push origin` unconditionally, which exits 128 with no
   # origin, got mislabeled PUSH_REJECTED, and failed the phase — while
@@ -354,8 +368,20 @@ do_push() {
     return 0
   fi
 
-  if git push origin "$target" 2>&1; then
-    echo "PUSHED: origin/$target"
+  # Attached: branch name; detached: remote default branch via resolve_push_destination() (see header).
+  local dest refspec
+  if [ "$target" = "HEAD" ]; then
+    # Surface the resolver's reason: the caller cannot remediate a swallowed
+    # failure, and the retry-promise below must not lie about it (F-R1).
+    dest=$(resolve_push_destination) || { echo "$dest"; return 1; }
+    refspec="HEAD:$dest"
+  else
+    dest="$target"
+    refspec="$target"
+  fi
+
+  if git push origin "$refspec" 2>&1; then
+    echo "PUSHED: origin/$dest (refspec $refspec)"
     return 0
   fi
 
@@ -363,17 +389,17 @@ do_push() {
   # "non-fast-forward" — auth errors got the same label). Recover
   # mechanically while the lock is held: fetch, merge, retry once.
   echo "PUSH_FAILED: push did not complete -- reconciling once while the lock is held"
-  if ! git fetch origin "$target" 2>&1; then
-    echo "ERROR: git fetch origin $target failed -- push not completed"
+  if ! git fetch origin "$dest" 2>&1; then
+    echo "ERROR: git fetch origin $dest failed -- push not completed"
     return 1
   fi
-  if ! git merge --no-edit "origin/$target" -m "merge: push-time reconcile ($task_id)" 2>&1; then
-    echo "CONFLICT: origin/$target diverged with conflicting changes -- aborting"
+  if ! git merge --no-edit "origin/$dest" -m "merge: push-time reconcile ($task_id)" 2>&1; then
+    echo "CONFLICT: origin/$dest diverged with conflicting changes -- aborting"
     git merge --abort 2>/dev/null || true
     return 1
   fi
-  if git push origin "$target" 2>&1; then
-    echo "PUSHED: origin/$target (after reconcile)"
+  if git push origin "$refspec" 2>&1; then
+    echo "PUSHED: origin/$dest (refspec $refspec, after reconcile)"
     return 0
   fi
   echo "ERROR: push failed again after reconcile -- not pushing"
@@ -473,10 +499,12 @@ cmd_integrate() {
   # the Integrate phase fails closed. Fetch and merge the remote branch now
   # so the subsequent push is a fast-forward.
   # Fail-soft when there is no remote; fail closed on a real conflict.
-  # A detached HEAD is local by design (no remote ref is claimed for the
-  # detached line), so there is nothing to reconcile.
+  # Detached: there is no static branch target to reconcile against inline;
+  # do_push resolves the destination explicitly and reconciles on push
+  # failure, so the inline reconcile is skipped here (F-R2 -- the old
+  # "local by design" rationale is the rejected 0.14.2 policy).
   if [ "$target" = "HEAD" ]; then
-    echo "NO_REMOTE_RECONCILE: detached HEAD -- the integration line is local by design; skipping origin reconcile"
+    echo "NO_REMOTE_RECONCILE: detached HEAD -- destination resolved explicitly by do_push, skipping inline reconcile"
   elif git rev-parse --verify "origin/$target" >/dev/null 2>&1; then
     if git fetch origin "$target" 2>&1; then
       if ! git merge --no-edit "origin/$target" -m "merge: reconcile with origin/$target before push ($task_id)" 2>&1; then
@@ -512,7 +540,7 @@ cmd_integrate() {
   # agent run added only a lock refresh). R5's manual-conflict path uses the
   # push-target command instead.
   if ! do_push "$task_id"; then
-    echo "ERROR: push failed after merge $merged_commit -- merge is recorded; retry will recover the push"
+    echo "ERROR: push failed after merge $merged_commit -- merge is recorded; a re-run of push-target retries transient failures, but an unknowable destination needs 'git remote set-head origin -a' (see the ERROR line above -- F-R1)"
     return 1
   fi
 
@@ -834,6 +862,19 @@ cmd_integration_target() {
   integration_target
 }
 
+# Agent-side one-liner: prints the remote branch a push updates. Attached:
+# the branch name. Detached: the resolved destination from
+# resolve_push_destination() (fails when genuinely unknowable).
+cmd_push_destination() {
+  local target
+  target=$(integration_target) || exit 1
+  if [ "$target" = "HEAD" ]; then
+    resolve_push_destination
+  else
+    printf '%s\n' "$target"
+  fi
+}
+
 # Deterministic push of the integration target. Thin wrapper over do_push
 # for the R5 manual-conflict path (re-running `integrate` there misfires on
 # ahead=0 -> MERGED_EMPTY, so the manually-merged line still needs a
@@ -888,6 +929,7 @@ case "$cmd" in
   integrate)    cmd_integrate "${1:?task_id required}" "${2:-}" ;;
   verify-merge) cmd_verify_merge "${1:?task_id required}" ;;
   integration-target) cmd_integration_target ;;
+  push-destination) cmd_push_destination ;;
   push-target)   cmd_push_target "${1:?task_id required}" ;;
   post-deploy)  cmd_post_deploy "${1:?task_id required}" ;;
   terminal-cleanup) cmd_terminal_cleanup "${1:?task_id required}" ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,