muse-crew 0.14.2 → 0.14.4

package/lib/retry-publish.js

@@ -31,7 +31,7 @@
 //
 // Exit codes: 0 = success, 1 = terminal stop (no retry), 2 = usage error.
 
-import { readFileSync, writeFileSync, appendFileSync, existsSync } from "fs";
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
 import { join } from "path";
 import { execFileSync } from "child_process";
 import { randomUUID as uuid } from "crypto";
@@ -50,6 +50,19 @@ function fail(code, msg, exitCode = 1) {
   process.exit(exitCode);
 }
 
+// --help: handled before any required-arg parsing so
+// `node retry-publish.js --help` always exits 0 (entry-gate contract).
+if (args.includes("--help")) {
+  console.log(
+    "usage: node retry-publish.js --crew-home <path> --task-id <uuid> --phase <prepare|complete>\n" +
+    "  prepare:  acquire the merge lock, re-check HEAD, re-classify, journal intent, emit the diff\n" +
+    "  complete: --edit-outcome <accepted|refused> [--refusal-text <text>] — write the outcome,\n" +
+    "            append the ledger entry, mirror verification, and release the lock\n" +
+    "exit 0 = success, 1 = terminal stop, 2 = usage error"
+  );
+  process.exit(0);
+}
+
 const crewHome = arg("--crew-home");
 const taskId = arg("--task-id");
 const phase = arg("--phase");
@@ -59,6 +72,18 @@ if (!["prepare", "complete"].includes(phase)) {
   process.exit(2);
 }
 
+// Retry protocol: phase-1 state is a persistent-disk pin
+// ($CREW_HOME/.pins/ — never /tmp: tmpfs is wiped on cell reboot, and the
+// lock release depends on phase 2 reading this state).
+function pinsDir() {
+  const dir = join(crewHome, ".pins");
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function retryStatePath() {
+  return join(pinsDir(), `retry-publish-${taskId}.json`);
+}
+
 // --- Shared helpers ---------------------------------------------------------
 
 function nowISO() { return new Date().toISOString(); }
@@ -180,9 +205,17 @@ if (phase === "prepare") {
     }
 
     const classifierPath = join(crewHome, "lib", "classify-publish-absence.js");
-    // Find the trigger entry for the manifest baseline.
-    const trigger = [...entries].reverse().find((e) =>
+    // Find the trigger entry for the manifest baseline: the OLDEST submitted
+    // entry by ts (D1, 2026-09-19; entry_kind cut 2026-09-20 — the retired
+    // kind-preference could never change the bound anchor) — it binds
+    // issued_at (falling back to its ts when the capture was unobserved),
+    // the same anchor verify-publish.js and findTriggerEntry use.
+    // agent_id is null on the issuance entry (no receipt observed at trigger
+    // time) — the baseline comes from manifest_before, never agent_id.
+    const submitted = entries.filter((e) =>
       e.outcome === "submitted" && e.commit === commit && (attempt == null || e.attempt === attempt));
+    submitted.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
+    const trigger = submitted[0] || null;
     const manifestBefore = trigger && trigger.manifest_before ? JSON.stringify(trigger.manifest_before) : null;
 
     // Find the park note timestamp for quiesce calculation.
@@ -201,7 +234,7 @@ if (phase === "prepare") {
       "--slug", slug,
       "--commit", commit,
       "--base", base,
-      "--trigger-ts", trigger ? trigger.ts : parkNote.timestamp,
+      "--trigger-ts", trigger ? (trigger.issued_at || trigger.ts) : parkNote.timestamp,
       "--park-ts", parkNote.timestamp,
       "--repo-path", repoPath,
     ];
@@ -266,7 +299,7 @@ if (phase === "prepare") {
     // with the diff, then calls phase 2 (complete) to finish.
     // Persist the phase-1 state for phase 2 (crash recovery reads the notes,
     // but phase 2 needs the exact commit/attempt/baseline/ledger path).
-    const statePath = `/tmp/retry-publish-${taskId}.json`;
+    const statePath = retryStatePath();
     writeFileSync(statePath, JSON.stringify({
       task_id: taskId, commit, attempt, slug, repoPath,
       project_id: project.id, ledger_path: ledgerPath,
@@ -301,7 +334,7 @@ if (phase === "complete") {
   }
   const refusalText = arg("--refusal-text", false, "");
 
-  const statePath = `/tmp/retry-publish-${taskId}.json`;
+  const statePath = retryStatePath();
   if (!existsSync(statePath)) {
     fail("no-prepare-state", `no phase-1 state at ${statePath} — the prepare phase did not complete or the state was cleaned`);
   }
@@ -322,49 +355,51 @@ if (phase === "complete") {
       writePublishNote(db, taskId,
         `publish: retry-refused ${commit} — the platform refused the re-issued edit (${refusalText.split("\n")[0].slice(0, 200)}); not retrying again.`);
       process.stdout.write(JSON.stringify({ ok: true, phase: "complete", outcome: "refused", commit }) + "\n");
-      return;
-    }
-
-    // The child ended after the edit call with no explicit refusal —
-    // fire-and-forget, same shape as the first attempt.
-    writePublishNote(db, taskId,
-      `publish: retry-issued ${commit} — the dropped edit was re-issued once; no explicit refusal was observed.`);
-
-    // Mirror verification with a settle window.
-    const notBefore = new Date(Date.now() + 20 * 60 * 1000).toISOString();
-    const retryAttempt = attempt ? `${attempt}-retry1` : "retry1";
-    writePublishNote(db, taskId,
-      `publish: verification-requested ${commit} attempt=${retryAttempt} not-before=${notBefore} — unknown-recovery retried the dropped edit once; content verification is the arbiter. Waiting on the manual read-back in docs/publish-verification.md.`);
+    } else {
+      // The child ended after the edit call with no explicit refusal —
+      // fire-and-forget, same shape as the first attempt.
+      writePublishNote(db, taskId,
+        `publish: retry-issued ${commit} — the dropped edit was re-issued once; no explicit refusal was observed.`);
+
+      // Mirror verification with a settle window.
+      const settleMs = Number(process.env.CREW_RETRY_SETTLE_MS) > 0
+        ? Number(process.env.CREW_RETRY_SETTLE_MS)
+        : 20 * 60 * 1000;
+      const notBefore = new Date(Date.now() + settleMs).toISOString();
+      const retryAttempt = attempt ? `${attempt}-retry1` : "retry1";
+      writePublishNote(db, taskId,
+        `publish: verification-requested ${commit} attempt=${retryAttempt} not-before=${notBefore} — unknown-recovery retried the dropped edit once; content verification is the arbiter. Waiting on the manual read-back in docs/publish-verification.md.`);
+
+      // Append the -retry1 ledger entry with the pre-retry baseline (required).
+      const ledgerEntry = {
+        ts: nowISO(),
+        task_id: taskId,
+        workflow: "unknown-recovery",
+        slug,
+        commit,
+        attempt: retryAttempt,
+        agent_id: null,
+        applied_report: null,
+        outcome: "submitted",
+        manifest_before: retryBaseline,
+        detail: "retry trigger re-issued after provably-dropped classification",
+      };
+      try {
+        appendFileSync(ledgerPath, JSON.stringify(ledgerEntry) + "\n");
+      } catch (e) {
+        // Best-effort: the note journal is the source of truth, not the ledger.
+        console.error(`ledger append failed (non-fatal): ${e.message}`);
+      }
 
-    // Append the -retry1 ledger entry with the pre-retry baseline (required).
-    const ledgerEntry = {
-      ts: nowISO(),
-      task_id: taskId,
-      workflow: "unknown-recovery",
-      slug,
-      commit,
-      attempt: retryAttempt,
-      agent_id: null,
-      applied_report: null,
-      outcome: "submitted",
-      manifest_before: retryBaseline,
-      detail: "retry trigger re-issued after provably-dropped classification",
-    };
-    try {
-      appendFileSync(ledgerPath, JSON.stringify(ledgerEntry) + "\n");
-    } catch (e) {
-      // Best-effort: the note journal is the source of truth, not the ledger.
-      console.error(`ledger append failed (non-fatal): ${e.message}`);
+      process.stdout.write(JSON.stringify({
+        ok: true, phase: "complete", outcome: "issued",
+        commit, attempt: retryAttempt, not_before: notBefore,
+      }) + "\n");
     }
-
-    process.stdout.write(JSON.stringify({
-      ok: true, phase: "complete", outcome: "issued",
-      commit, attempt: retryAttempt, not_before: notBefore,
-    }) + "\n");
   } finally {
     releaseLock();
     // Clean up the phase-1 state file (best-effort).
-    try { (await import("fs")).unlinkSync(statePath); } catch {}
+    try { unlinkSync(statePath); } catch {}
   }
   process.exit(0);
 }

package/lib/sample-project.js

@@ -15,9 +15,11 @@
 //   --name:    directory/project name (e.g. "flashcards")
 // Prints JSON: { path, committed, commitSha }
 
-const fs = require("fs");
-const path = require("path");
-const { execFileSync } = require("child_process");
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 function run(cmd, args, cwd) {
   return execFileSync(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -60,10 +62,24 @@ function setupSampleProject(tarballPath, destParent, name) {
   return { path: destDir, committed: true, commitSha: sha };
 }
 
-module.exports = { setupSampleProject };
+export { setupSampleProject };
 
-if (require.main === module) {
+const USAGE = "Usage: node lib/sample-project.js --tarball <path> --dest <dir> --name <project-name>";
+
+const isMainModule = (() => {
+  try {
+    return !!process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+})();
+
+if (isMainModule) {
   const argv = process.argv.slice(2);
+  if (argv.includes("--help")) {
+    console.log(USAGE);
+    process.exit(0);
+  }
   const get = (flag) => {
     const i = argv.indexOf(flag);
     return i >= 0 ? argv[i + 1] : null;
@@ -72,7 +88,7 @@ if (require.main === module) {
   const dest = get("--dest");
   const name = get("--name");
   if (!tarball || !dest || !name) {
-    console.error("Usage: node lib/sample-project.js --tarball <path> --dest <dir> --name <project-name>");
+    console.error(USAGE);
     process.exit(2);
   }
   try {

package/lib/scaffold-crew.js

@@ -18,8 +18,8 @@
 // source (fail-closed: never stamp an empty 0/0 receipt). Exit 2 on usage
 // errors. No wall-clock reads, no randomness.
 
-const fs = require("node:fs");
-const path = require("node:path");
+import fs from "node:fs";
+import path from "node:path";
 
 function usageError(msg) {
   process.stderr.write("scaffold-crew.js usage: --repo <crewRepoPath> --orch-dir <orchDir>\n" + msg + "\n");
@@ -27,6 +27,15 @@ function usageError(msg) {
 }
 
 const args = process.argv.slice(2);
+// --help: before required-arg parsing (shebang⇔CLI contract).
+if (args.includes("--help")) {
+  console.log(
+    "usage: node scaffold-crew.js --repo <crewRepoPath> --orch-dir <orchDir>\n" +
+    "copies the fixed scaffold file sets (no-clobber), verifies every file on disk,\n" +
+    "writes <orchDir>/.scaffold-receipt.json and prints {created, skipped}"
+  );
+  process.exit(0);
+}
 let repo = null;
 let orchDir = null;
 for (let i = 0; i < args.length; i++) {

package/lib/see-act.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 // see-act.js — single-step browser driver for experiential QA.
 //
 // The agent closes the OODA loop: run one step, READ the screenshot or aria
@@ -30,12 +31,14 @@
 // Determinism: no wall-clock reads, no randomness. Archive names are sequential.
 //
 // Dependencies: playwright-core (resolved below), a Chromium binary.
-"use strict";
 
-const { createServer, request: httpRequest } = require("node:http");
-const { request: httpsRequest } = require("node:https");
-const { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } = require("node:fs");
-const { join, dirname, resolve } = require("node:path");
+import { createServer, request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from "node:fs";
+import { join, dirname, resolve } from "node:path";
+import { createRequire } from "node:module";
+
+const cjsRequire = createRequire(import.meta.url);
 
 const VIEWPORTS = {
   desktop: { width: 1440, height: 900 },
@@ -73,15 +76,15 @@ function loadPlaywright() {
   // playwright-core is a declared dependency (package.json), so a normal
   // npm install resolves it from the package's own node_modules.
   try {
-    return require("playwright-core");
+    return cjsRequire("playwright-core");
   } catch (e) { /* fall through */ }
   const envDir = (process.env.PLAYWRIGHT_CORE_DIR || "").trim();
   if (envDir) {
     try {
-      return require(join(envDir, "playwright-core"));
+      return cjsRequire(join(envDir, "playwright-core"));
     } catch (e) { /* fall through */ }
     try {
-      return require(envDir);
+      return cjsRequire(envDir);
     } catch (e) { /* fall through */ }
   }
   fail(3, {
@@ -188,6 +191,12 @@ function startProxy() {
 }
 
 async function main() {
+  // --help: before required-arg parsing (shebang⇔CLI contract).
+  if (process.argv.slice(2).includes("--help")) {
+    console.log("usage: node see-act.js --url <url> [--viewport desktop|mobile] [--timeout-ms <n>] <action> [args]\n" +
+      "actions: aria | shot --out <png> [--full] | click --out <png> --selector <css> | scroll --out <png> --y <px|bottom> | type --out <png> --selector <css> --text <text>");
+    process.exit(0);
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!args.url) {
     fail(2, { ok: false, error: "usage: node see-act.js --url <url> [--viewport desktop|mobile] <aria|shot|click|scroll|type> [args]" });

package/lib/serve-artifact.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 // serve-artifact.js — serve a built TS space locally for experiential QA.
 //
 // Serves <space-dir>/client/dist statically and dispatches POST */actions
@@ -20,13 +21,12 @@
 //   what the artifact's server needs before starting this.
 //
 // Determinism: no wall-clock reads, no randomness.
-"use strict";
 
-const { createServer } = require("node:http");
-const { join, normalize, dirname, sep } = require("node:path");
-const { existsSync } = require("node:fs");
-const { readFile, writeFile, mkdir, mkdtemp } = require("node:fs/promises");
-const { tmpdir } = require("node:os");
+import { createServer } from "node:http";
+import { join, normalize, dirname, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile, writeFile, mkdir, mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
 
 function parseArgs(argv) {
   const out = { spaceDir: null, port: 0, tag: null };
@@ -57,6 +57,12 @@ const CONTENT_TYPES = {
 };
 
 async function main() {
+  // --help: before required-arg parsing (shebang⇔CLI contract).
+  if (process.argv.slice(2).includes("--help")) {
+    console.log("usage: node serve-artifact.js --space-dir <path> [--port <n>]\n" +
+      "serves <space-dir>/client/dist statically, dispatches POST */actions to the built server actions");
+    process.exit(0);
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!args.spaceDir) {
     process.stderr.write("serve-artifact.js: --space-dir <path> is required\n");

package/lib/setup-project-repo.js

@@ -30,14 +30,25 @@
 // Prints JSON: { orchestration: {...}, gitignore: {...} | { declined: true }, commit: {...} }
 // Exits non-zero on any failure (fail closed, loud).
 
-const fs = require("fs");
-const path = require("path");
-const { scaffoldRepoOrchestration } = require("./repo-orchestration");
-const { ensureGitignoreEntries, describeGitignoreChange } = require("./gitignore");
-const { commitScaffold, isPathDirty } = require("./commit-scaffold");
+import fs from "node:fs";
+import path from "node:path";
+import { scaffoldRepoOrchestration } from "./repo-orchestration.js";
+import { ensureGitignoreEntries, describeGitignoreChange } from "./gitignore.js";
+import { commitScaffold, isPathDirty } from "./commit-scaffold.js";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 
 function main() {
   const argv = process.argv.slice(2);
+  // --help: before required-arg parsing (shebang⇔CLI contract).
+  if (argv.includes("--help")) {
+    console.log(
+      "usage: node setup-project-repo.js --repo <path> --crew-repo <path> [--consent]\n" +
+      "--consent: user approved the .gitignore change (from the setup conversation)\n" +
+      "prints JSON: { orchestration, gitignore, commit }"
+    );
+    process.exit(0);
+  }
   const get = (flag) => {
     const i = argv.indexOf(flag);
     return i >= 0 ? argv[i + 1] : null;
@@ -91,6 +102,14 @@ function main() {
   }
 }
 
-if (require.main === module) main();
+const isMainModule = (() => {
+  try {
+    return !!process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+})();
+
+if (isMainModule) main();
 
-module.exports = { main };
+export { main };

package/lib/test-detached-integrate.sh

@@ -22,7 +22,8 @@
 #   6. NOT move the main branch (it still points at A)
 #   7. write integration_target=HEAD in the merge record
 #   8. verify-merge → VERIFIED
-#   9. push-target → PUSH_SKIPPED (detached HEAD has no remote counterpart)
+#   9. push-target → NO_REMOTE_PUSH (fixture A has no origin; a detached
+#      line with no remote has nowhere to push -- loud, not silent)
 #
 # Fixture B (branch — the old behavior is preserved):
 #   repo on main with a local bare origin. Integrate merges, reconciles,
@@ -49,6 +50,14 @@
 #   crash): re-running integrate takes the lock and pushes instead of
 #   parking on MERGED_EMPTY.
 #
+# Fixture H (detached HEAD with an origin — 2026-09-19 detached-HEAD audit
+# REDO): H1 proves push-destination fails closed when origin/HEAD is unset
+# (genuinely unknowable destination); H2-H5 prove the detached line pushes
+# explicitly as HEAD:main — inline push reports
+# `PUSHED: origin/main (refspec HEAD:main)`, the remote ref advances to the
+# merge commit, local main stays at the reviewed base, HEAD stays detached,
+# verify-merge VERIFIEDs, and push-target re-pushes idempotently.
+#
 # Hermetic: scratch dirs under /tmp only, removed at start (and end).
 set -u
 
@@ -126,9 +135,9 @@ echo "$rec" | grep -q '^integration_target=HEAD$' || fail "merge record missing
 out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "verify-merge exited non-zero: $out"
 echo "$out" | grep -q '^VERIFIED:' || fail "verify-merge: expected VERIFIED, got: $out"
 
-# 9. push-target skips loudly on a detached HEAD
+# 9. push-target on a detached HEAD with no remote: loud NO_REMOTE_PUSH
 out=$(bash "$LIFECYCLE" push-target "$tid") || fail "push-target exited non-zero: $out"
-echo "$out" | grep -q '^PUSH_SKIPPED: detached HEAD' || fail "push-target: expected PUSH_SKIPPED, got: $out"
+echo "$out" | grep -q '^NO_REMOTE_PUSH: no origin remote configured' || fail "push-target: expected NO_REMOTE_PUSH, got: $out"
 
 echo "fixture A (detached HEAD): all checks passed"
 
@@ -336,5 +345,72 @@ echo "$out" | grep -qi 'lock lost' && fail "G: misleading lock-lost error: $out"
 
 echo "fixture G (push-target after MERGED_EMPTY): all checks passed"
 
+# ---------------- Fixture H: detached HEAD with an origin ----------------
+# (2026-09-19 detached-HEAD audit REDO: a detached line with a remote is
+# pushed explicitly as HEAD:<destination> -- the remote's default branch --
+# never silently skipped, never refused. The local branch the line
+# descends from is NOT moved; only the remote ref advances.)
+H_DIR="$T/fixture-h"
+H_REMOTE="$T/remote-h.git"
+git init -q --bare "$H_REMOTE"
+mkdir -p "$H_DIR"
+cd "$H_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo reviewed > f.txt
+git add -A
+git commit -qm "reviewed base"
+H_BASE=$(git rev-parse HEAD)
+git remote add origin "$H_REMOTE"
+git push -q origin main
+git fetch -q origin
+# Detach at the reviewed base, crew-init stamp on top -- the detached line
+# the REDO must push explicitly (set origin/HEAD only after H1).
+git checkout -q --detach HEAD
+echo crew-init >> f.txt
+git commit -qam "crew-init: stamp provenance"
+H_LINE=$(git rev-parse HEAD)
+git symbolic-ref -q HEAD >/dev/null && fail "fixture H: HEAD should be detached"
+export CREW_REPO="$H_DIR"
+export CREW_HOME="$H_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"
+# H1: origin/HEAD not set -- the destination is genuinely unknowable --
+# push-destination fails closed (never a silent skip, never a bare-HEAD push)
+out=$(bash "$LIFECYCLE" push-destination 2>&1) && fail "H1: push-destination should fail without origin/HEAD: $out"
+echo "$out" | grep -q 'genuinely unknowable' || fail "H1: expected unknowable error, got: $out"
+echo "fixture H1 (unknowable destination fails closed): passed"
+# Now set the remote default branch explicitly (hermetic: no `remote set-head -a` network round-trip)
+git symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
+tid="detachedorigin1"
+
+# H2: push-destination resolves the remote default branch
+out=$(bash "$LIFECYCLE" push-destination) || fail "H2 push-destination exited non-zero: $out"
+[ "$out" = "main" ] || fail "H2 push-destination: expected main, got: $out"
+
+# H3: prepare + task work, then integrate pushes inline as HEAD:main
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "H3 prepare exited non-zero: $out"
+echo task-work >> "$H_DIR/.worktrees/$tid/f.txt"
+(cd "$H_DIR/.worktrees/$tid" && git commit -qam "task work")
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "H3 integrate exited non-zero: $out"
+echo "$out" | grep -q '^MERGED:' || fail "H3 integrate: expected MERGED, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main (refspec HEAD:main)' || fail "H3 integrate: expected explicit detached PUSHED, got: $out"
+
+# H4: HEAD still detached; the detached line survived; the remote advanced
+git symbolic-ref -q HEAD >/dev/null && fail "H4: HEAD should still be detached"
+H_MERGE=$(git rev-parse HEAD)
+git merge-base --is-ancestor "$H_BASE" HEAD || fail "H4: reviewed base abandoned"
+git merge-base --is-ancestor "$H_LINE" HEAD || fail "H4: detached line abandoned"
+[ "$(git rev-parse main)" = "$H_BASE" ] || fail "H4: local main moved (must stay at the reviewed base)"
+[ "$(git --git-dir="$H_REMOTE" rev-parse refs/heads/main)" = "$H_MERGE" ] || fail "H4: origin/main not updated to the merge commit"
+
+# H5: verify-merge VERIFIEDs; push-target re-pushes idempotently as HEAD:main
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "H5 verify-merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "H5: expected VERIFIED, got: $out"
+out=$(bash "$LIFECYCLE" push-target "$tid") || fail "H5 push-target exited non-zero: $out"
+echo "$out" | grep -q '^PUSHED: origin/main (refspec HEAD:main)' || fail "H5 push-target: expected idempotent PUSHED, got: $out"
+
+echo "fixture H (detached HEAD + origin): all checks passed"
+
 rm -rf "$T"
 echo "PASS: detached-HEAD integrate fixtures"

package/lib/test-publish-preflight.sh

@@ -21,6 +21,17 @@
 #       * old helper that does not know --check (usage to stderr, exit 1,
 #         no CREDENTIAL markers) with DRY_RUN=1 -> no skip (fall-through
 #         preserved: unknown is not absent)
+#   - detached fixtures (detached-HEAD audit REDO, 2026-09-19): a detached
+#     checkout with a local origin. Case 6 (origin/HEAD set, DRY_RUN=1) ->
+#     preflight passes through to PUBLISH_DRY_RUN=1 (no refusal — detached
+#     publication is legitimate). Case 7 (origin/HEAD deleted, DRY_RUN=1) ->
+#     PUBLISH_FAILED=env before any mutation, repo untouched (the genuinely
+#     unknowable destination fails in the preflight, ahead of the DRY_RUN
+#     block).
+#   - Case 8: attached checkout with no origin (DRY_RUN=1) -> PUBLISH_FAILED=env
+#     pre-mutation, repo untouched (2026-09-19 critic F-A1: the anchor used to
+#     check no-origin only on the detached branch, so attached+no-origin
+#     failed post-mutation after the version-bump commit and registry publish).
 #   - --check probe unit test against the real helper: on the author
 #     machine this expects exit 0 and exactly CREDENTIAL_OK=custom.npm.
 #     NOTE: this case depends on the `custom.npm` credential existing in
@@ -52,6 +63,13 @@ git -C "$SCRATCH" config user.email "test@crew"
 git -C "$SCRATCH" config user.name "crew-test"
 echo x > "$SCRATCH/f.txt"
 git -C "$SCRATCH" add -A && git -C "$SCRATCH" commit -qm init
+# The scratch repo needs an origin for the DRY_RUN pass-through cases
+# (2026-09-19 critic F-A1: the push-destination anchor fails closed
+# pre-mutation when origin is absent, attached or detached).
+git init -q --bare "$TMPBASE/origin.git"
+git -C "$SCRATCH" remote add origin "$TMPBASE/origin.git"
+git -C "$SCRATCH" push -q origin main
+git -C "$SCRATCH" remote set-head origin -a
 
 # --- Fake helpers ---
 cat > "$TMPBASE/helper-ok.py" <<'EOF'
@@ -78,6 +96,32 @@ print("Usage: helper-old.py <tarball-path>", file=sys.stderr)
 sys.exit(1)
 EOF
 
+# --- Detached fixtures (detached-HEAD audit REDO, 2026-09-19): a detached
+# checkout with a local origin. Case 6 runs with origin/HEAD set; Case 7
+# deletes origin/HEAD first, exercising push-destination's genuinely-
+# unknowable branch. ---
+ORIGIN="$TMPBASE/origin-det.git"
+git init -q --bare "$ORIGIN"
+SCRATCH_DET="$TMPBASE/repo-detached"
+git init -q -b main "$SCRATCH_DET"
+git -C "$SCRATCH_DET" config user.email "test@crew"
+git -C "$SCRATCH_DET" config user.name "crew-test"
+echo x > "$SCRATCH_DET/f.txt"
+git -C "$SCRATCH_DET" add -A && git -C "$SCRATCH_DET" commit -qm init
+git -C "$SCRATCH_DET" remote add origin "$ORIGIN"
+git -C "$SCRATCH_DET" push -q origin main
+git -C "$SCRATCH_DET" remote set-head origin -a
+git -C "$SCRATCH_DET" checkout -q --detach HEAD
+
+# --- Attached no-origin fixture (F-A1): an attached checkout with no origin
+# fails closed in the anchor, attached or detached. ---
+SCRATCH_NOORIGIN="$TMPBASE/repo-no-origin"
+git init -q -b main "$SCRATCH_NOORIGIN"
+git -C "$SCRATCH_NOORIGIN" config user.email "test@crew"
+git -C "$SCRATCH_NOORIGIN" config user.name "crew-test"
+echo x > "$SCRATCH_NOORIGIN/f.txt"
+git -C "$SCRATCH_NOORIGIN" add -A && git -C "$SCRATCH_NOORIGIN" commit -qm init
+
 ACTIONABLE="npm publish not configured on this machine — see docs/guide.md#npm-releases; code changes are merged, nothing was versioned or published"
 
 # --- Structural: extract the shipped preflight block by anchor ---
@@ -123,13 +167,23 @@ fi
 
 # Runner: full publish-npm.sh against the scratch repo. The preflight exits
 # before any mutation, so the repo needs no package.json.
+# LIFECYCLE + CREW_HOME are exported because the preflight now resolves the
+# push destination up front (2026-09-19: the push-destination resolution moved
+# from step 13 to the preflight — fail before mutation, never after the
+# registry publish; 2026-09-19 detached-HEAD audit REDO: a detached checkout
+# resolves to HEAD:<destination>, refused only when genuinely unknowable).
+# The scratch repo sits on branch `main`, so integration-target
+# resolves cleanly and the npm-credential assertions are unaffected.
 run_full() { # run_full <helper_path> [extra_env...]
   local helper="$1"; shift
   local run="$TMPBASE/run-$RANDOM"
   mkdir -p "$run"
+  local crew_home="$TMPBASE/crew-home"
+  mkdir -p "$crew_home"
   (
     export TASK_ID="preflight-test" REPO_PATH="$SCRATCH" PKG="muse-crew" TARGET_VERSION="9.9.9"
     export NPM_PUBLISH_PY="$helper"
+    export LIFECYCLE="$SCRIPT_DIR/worktree-lifecycle.sh" CREW_HOME="$crew_home" CREW_REPO="$SCRATCH"
     # A bare `export` (empty "$@") would dump the environment to stdout and
     # corrupt the captured run path — only export when extras are given.
     if [ $# -gt 0 ]; then export "$@"; fi
@@ -140,11 +194,11 @@ run_full() { # run_full <helper_path> [extra_env...]
   echo "$run"
 }
 
-repo_state() { # prints "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
-  local head status tgz
-  head="$(git -C "$SCRATCH" rev-parse HEAD)"
-  status="$(git -C "$SCRATCH" status --porcelain | wc -l)"
-  tgz="$(find "$SCRATCH" -maxdepth 1 -name '*.tgz' | wc -l)"
+repo_state() { # repo_state [repo]: "HEAD=<sha> STATUS=<porcelain-lines> TGZ=<count>"
+  local head status tgz repo="${1:-$SCRATCH}"
+  head="$(git -C "$repo" rev-parse HEAD)"
+  status="$(git -C "$repo" status --porcelain | wc -l)"
+  tgz="$(find "$repo" -maxdepth 1 -name '*.tgz' | wc -l)"
   echo "HEAD=$head STATUS=$status TGZ=$tgz"
 }
 
@@ -203,6 +257,41 @@ else
   no "real helper --check: code=$CHECK_CODE out='$CHECK_OUT' (expected CREDENTIAL_OK=custom.npm — this case is credential-dependent; see header)"
 fi
 
+# --- Case 6: detached + resolvable destination + DRY_RUN=1 -> pass-through, no refusal ---
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_DET")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"
+if [ "$CODE" -eq 0 ] && [[ "$OUT" == *"PUBLISH_DRY_RUN=1"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_FAILED"* ]]; then
+  ok "detached + resolvable destination: preflight passes through to PUBLISH_DRY_RUN=1 (no refusal)"
+else
+  no "detached resolvable: code=$CODE out='$OUT'"
+fi
+
+# --- Case 7: detached + origin/HEAD unset -> PUBLISH_FAILED=env before any mutation ---
+git -C "$SCRATCH_DET" remote set-head origin -d
+BEFORE="$(repo_state "$SCRATCH_DET")"
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_DET")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state "$SCRATCH_DET")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=env"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_DRY_RUN=1"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "detached + unknowable destination: fails closed pre-mutation, repo untouched"
+else
+  no "detached unknowable: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
+# --- Case 8: attached + no origin -> PUBLISH_FAILED=env before any mutation ---
+BEFORE="$(repo_state "$SCRATCH_NOORIGIN")"
+RUN="$(run_full "$TMPBASE/helper-ok.py" DRY_RUN=1 REPO_PATH="$SCRATCH_NOORIGIN")"
+CODE="$(cat "$RUN/code")"; OUT="$(cat "$RUN/out")"; AFTER="$(repo_state "$SCRATCH_NOORIGIN")"
+if [ "$CODE" -ne 0 ] && [[ "$OUT" == *"PUBLISH_FAILED=env"* ]] \
+   && [[ "$OUT" != *"PUBLISH_SKIPPED"* ]] && [[ "$OUT" != *"PUBLISH_DRY_RUN=1"* ]] \
+   && [ "$BEFORE" = "$AFTER" ]; then
+  ok "attached + no origin: fails closed pre-mutation, repo untouched"
+else
+  no "attached no-origin: code=$CODE state=$BEFORE/$AFTER out='$OUT'"
+fi
+
 bash -n "$PUBLISH" && ok "publish-npm.sh syntax OK" || no "publish-npm.sh syntax"
 
 echo ""