muse-crew 0.14.2 → 0.14.4

package/workflows/chore.js

@@ -127,8 +127,10 @@ const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -250,19 +252,12 @@ async function reaskVerdict(stepName, reworkSuffix, workerText) {
   return verdict;
 }
 // Transport retry: the work-agent agent() call can throw even when the agent
-// did the work. Stochastic envelope non-compliance (bare prose instead of
-// the native {"status":"ok","result":"..."} envelope) trips the runtime's
-// JSON-candidate heuristic when the prose contains a {...}-looking
-// substring — canary 39457ee9's QA report quoted the change's own
-// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
-// and the workflow discarded a complete VERDICT: PASS report as "no output".
-// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
-// this covers the report never arriving. The assignment is retried boundedly
-// with fresh keys (never a cached replay) before failing closed. Re-entry is
-// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
-// retry trailer tells the agent to check existing state first and report
-// rather than duplicate completed side effects, and the rework path already
-// re-runs Build after rejection — Build re-entry is an established pattern.
+// did the work — the runtime's JSON-candidate heuristic trips on brace-shaped
+// prose. Retry the assignment boundedly with fresh keys (never a cached
+// replay) before failing closed. Re-entry is safe: lifecycle scripts answer
+// REUSED for existing worktrees/branches, the retry trailer tells the agent
+// to check existing state first, and Build re-entry after rejection is an
+// established pattern. Full history: docs/decisions/workflow-core.md.
 function workRetryKey(stepName, reworkSuffix, attempt) {
   return "work-" + stepName + reworkSuffix + "-t" + attempt;
 }
@@ -274,7 +269,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -455,27 +450,11 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish read-back request (currently unavailable): the verbatim_request
-// the parent protocol (docs/publish-verification.md) would hand to an
-// independent read-back tool after the artifact build lands. artifact_inspect
-// was removed by the platform (2026-09-14); artifact.inspect is malfunction
-// diagnosis, not a substitute — so no agent-callable read-back tool exists
-// and this request cannot currently be issued. Pure function — no I/O, no
-// clock. The request carries the merged diff as the expected change and asks
-// for an independent read of the artifact's actual source: for each file, the
-// exact current text of the changed regions plus a per-line present/absent
-// finding. Until a read-back path exists, the parent cannot independently
-// confirm content and verification parks at "publish: verification-requested"
-// (see docs/publish-verification.md). This preserves the circularity break
-// that hollowed canary run 8 (2026-09-11): the old verifyAppliedChanges
-// compared the builder's applied-report against the diff the report was
-// derived from — a fabricated report passed by construction. The report
-// itself is gone now (2026-09-16 fire-and-forget trigger). Independent
-// read-back cannot be
-// fabricated from the diff; it must match the artifact's real content.
-
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -489,7 +468,10 @@ async function recordPublishLedger(entry, rework) {
       applied_report: entry.applied_report || null,
       manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
-      detail: entry.detail || ""
+      detail: entry.detail || "",
+      // D1 (2026-09-19): issued_at = upper bound on the trigger-issuance
+      // instant (null when no trigger); ts = ledger-write instant.
+      issued_at: entry.issued_at || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -497,7 +479,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -1195,7 +1177,7 @@ while (i < STEPS.length) {
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
       "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
-      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1208,7 +1190,7 @@ while (i < STEPS.length) {
       "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- ERROR: report it. VERDICT: FAIL.\n\n" +
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
-      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
@@ -1546,7 +1528,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1566,7 +1548,36 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // D1 (2026-09-19; F-A1 upper-bound 2026-09-20): issued_at is an UPPER
+        // bound on issuance — captured AFTER the trigger-agent call returns,
+        // ferried from one shell date call (workflows have no clock) and
+        // validated mechanically; null when unobserved (fallback: ts).
+        // See docs/decisions/publish-path.md#d1-issuance-time.
+        var triggerIssuedAt = null;
+        try {
+          var issuedAtFerry = await agent(
+            "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+            "Return JSON { \"ts\": \"<the date output, verbatim>\" } and nothing else.",
+            { key: attemptKey("publish-issued-at-" + taskId, reworkCount), label: "Capturing post-trigger instant (upper bound on issuance)",
+              schema: { type: "object", properties: { ts: { type: "string" } }, required: ["ts"] } }
+          );
+          var issuedAtRaw = String((issuedAtFerry && issuedAtFerry.ts) || "").trim();
+          if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(issuedAtRaw)) triggerIssuedAt = issuedAtRaw;
+        } catch (issuedAtErr) { /* issued_at stays null: the verifier falls back to ts */ }
+        if (!triggerIssuedAt) log("Publish issuance instant unobserved for task " + taskId + " — issued_at null; the freshness gate falls back to ledger-write ts");
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          issued_at: triggerIssuedAt,
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, reworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1686,8 +1697,9 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, reworkCount);
+            issued_at: triggerIssuedAt,
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, reworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1818,10 +1830,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -1955,21 +1963,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check

package/workflows/standard.js

@@ -78,8 +78,10 @@ const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -199,19 +201,12 @@ async function reaskVerdict(stepName, reworkSuffix, workerText) {
   return verdict;
 }
 // Transport retry: the work-agent agent() call can throw even when the agent
-// did the work. Stochastic envelope non-compliance (bare prose instead of
-// the native {"status":"ok","result":"..."} envelope) trips the runtime's
-// JSON-candidate heuristic when the prose contains a {...}-looking
-// substring — canary 39457ee9's QA report quoted the change's own
-// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
-// and the workflow discarded a complete VERDICT: PASS report as "no output".
-// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
-// this covers the report never arriving. The assignment is retried boundedly
-// with fresh keys (never a cached replay) before failing closed. Re-entry is
-// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
-// retry trailer tells the agent to check existing state first and report
-// rather than duplicate completed side effects, and the rework path already
-// re-runs Build after rejection — Build re-entry is an established pattern.
+// did the work — the runtime's JSON-candidate heuristic trips on brace-shaped
+// prose. Retry the assignment boundedly with fresh keys (never a cached
+// replay) before failing closed. Re-entry is safe: lifecycle scripts answer
+// REUSED for existing worktrees/branches, the retry trailer tells the agent
+// to check existing state first, and Build re-entry after rejection is an
+// established pattern. Full history: docs/decisions/workflow-core.md.
 function workRetryKey(stepName, reworkSuffix, attempt) {
   return "work-" + stepName + reworkSuffix + "-t" + attempt;
 }
@@ -223,7 +218,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -428,7 +423,10 @@ function hydrateReleaseDecision(rec) {
 // it must match the artifact's real content.
 
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
-async function recordPublishLedger(entry, rework) {
+// keyTag (optional): same-outcome ledger writes in one pass need distinct
+// agent-call keys — the runtime replays cached calls by key, so a shared key
+// silently drops the second write (2026-09-19, submitted-on-issuance).
+async function recordPublishLedger(entry, rework, keyTag) {
   try {
     var ledgerDir = crewHome + "/.publish-ledger";
     var line = JSON.stringify({
@@ -442,7 +440,10 @@ async function recordPublishLedger(entry, rework) {
       applied_report: entry.applied_report || null,
       manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
-      detail: entry.detail || ""
+      detail: entry.detail || "",
+      // D1 (2026-09-19): issued_at = upper bound on the trigger-issuance
+      // instant (null when no trigger); ts = ledger-write instant.
+      issued_at: entry.issued_at || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -450,7 +451,7 @@ async function recordPublishLedger(entry, rework) {
       "Run: mkdir -p " + sq(ledgerDir) + " && printf '%s\n' " + sq(line) +
       " | sed \"s/@LEDGER_TS@/$(date -u +%Y-%m-%dT%H:%M:%SZ)/\" >> " + sq(ledgerDir + "/" + PUBLISH_SLUG + ".jsonl") + " && echo LEDGER_OK\n" +
       "Return JSON { \"result\": \"<verbatim output>\" } and nothing else.",
-      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome, rework),
+      { key: attemptKey("publish-ledger-" + taskId + "-" + entry.outcome + (keyTag ? "-" + keyTag : ""), rework),
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
@@ -1182,7 +1183,7 @@ while (i < STEPS.length) {
       "The script merges, reconciles, records, and pushes under the merge lock. Informational only: RECONCILED, NO_REMOTE, NO_REMOTE_RECONCILE. Read the output:\n" +
       "- STAGED_BASE_MISMATCH: the line left the staged base (stray checkout). VERDICT: FAIL.\n" +
       "- MERGED_EMPTY — check FIRST (it contains the word MERGED): either a runtime-state deliverable or an already-merged sha the workflow verified (Build declared repo_diff: none). No lock taken, no new commit. Report 'merged empty: no repo changes'. VERDICT: PASS.\n" +
-      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash, VERDICT: PASS; PUSH_SKIPPED — the detached line is room-local (the merge commit + record are the evidence), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
+      "- MERGED: the merge landed; the script pushed inline. Read the push line: PUSHED — report the hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; NO_REMOTE_PUSH — no remote configured, VERDICT: PASS; ERROR after MERGED — a retry recovers the push; report it, VERDICT: FAIL.\n" +
       "- LOCK_HELD: 10-minute backoff exhausted. VERDICT: FAIL.\n" +
       "- CONFLICT: the plain merge failed — aborted, the target is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1195,7 +1196,7 @@ while (i < STEPS.length) {
       "ESCALATE — 'conflict needs human resolution', VERDICT: FAIL — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- ERROR: report it. VERDICT: FAIL.\n\n" +
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
-      "PUSHED — report the merged hash, VERDICT: PASS; PUSH_SKIPPED or NO_REMOTE_PUSH — nothing to push, VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
+      "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
@@ -1533,7 +1534,7 @@ while (i < STEPS.length) {
           log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
         }
         // See docs/decisions/publish-path.md#trigger-await: the artifact_edit call is awaited.
-        var rebuildTrigger = null;
+        var rebuildTrigger = null, triggerThrew = false;
         try {
           var triggerText = String(await agent(rebuildPrompt,
             { key: rebuildAttemptKey, label: "Triggering artifact rebuild" }) || "");
@@ -1553,7 +1554,36 @@ while (i < STEPS.length) {
           }
         } catch (triggerErr) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
+          triggerThrew = true;
         }
+        // D1 (2026-09-19; F-A1 upper-bound 2026-09-20): issued_at is an UPPER
+        // bound on issuance — captured AFTER the trigger-agent call returns,
+        // ferried from one shell date call (workflows have no clock) and
+        // validated mechanically; null when unobserved (fallback: ts).
+        // See docs/decisions/publish-path.md#d1-issuance-time.
+        var triggerIssuedAt = null;
+        try {
+          var issuedAtFerry = await agent(
+            "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+            "Return JSON { \"ts\": \"<the date output, verbatim>\" } and nothing else.",
+            { key: attemptKey("publish-issued-at-" + taskId, totalReworkCount), label: "Capturing post-trigger instant (upper bound on issuance)",
+              schema: { type: "object", properties: { ts: { type: "string" } }, required: ["ts"] } }
+          );
+          var issuedAtRaw = String((issuedAtFerry && issuedAtFerry.ts) || "").trim();
+          if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(issuedAtRaw)) triggerIssuedAt = issuedAtRaw;
+        } catch (issuedAtErr) { /* issued_at stays null: the verifier falls back to ts */ }
+        if (!triggerIssuedAt) log("Publish issuance instant unobserved for task " + taskId + " — issued_at null; the freshness gate falls back to ledger-write ts");
+        // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
+        await recordPublishLedger({
+          commit: mergeCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: publishAppliedObservation,
+          manifest_before: preTriggerManifest,
+          outcome: "submitted",
+          issued_at: triggerIssuedAt,
+          detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
+        }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
         // attributes the edit itself. First the in-flight build state — a
         // build whose agent_id is new relative to the pre-trigger baseline
@@ -1673,8 +1703,9 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
-            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff)"
-          }, totalReworkCount);
+            issued_at: triggerIssuedAt,
+            detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
+          }, totalReworkCount, "receipt");
         } else {
           var newAuditDirs = [];
           try {
@@ -1805,10 +1836,6 @@ while (i < STEPS.length) {
         // its outcome — submitted, rejected, or unknown (unknown is recorded
         // at the park site above). A later run or human matches commit hash +
         // attempt key against the builder's eventual completion.
-        // (2026-09-16) The trigger is fire-and-forget: the observation above
-        // already recorded the ledger's submitted line on both positive paths
-        // and parked on unknown — there is no applied report to observe and
-        // no rejection signal to record.
         // (2026-09-18, H2 verdict-first) The verdict was decided exactly
         // once above; dispatch on it. landed bypasses the receipt poll
         // (the audit evidence already proved completion); an explicit
@@ -1942,21 +1969,12 @@ while (i < STEPS.length) {
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
             // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
-            // the poll above only observes IN-FLIGHT builds. A build that
-            // finished between the receipt capture and the poll's first check
-            // leaves no in-flight trace — but the platform's audit harness
-            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
-            // <timestamp>-<id>/ per completed build). Diff the audit-dir
-            // listing against the pre-trigger snapshot: a timestamped dir
-            // that appeared during the attempt window is evidence a build
-            // completed. Attribution is by window, not by build identity:
-            // the poll's saw_stranger signal only catches stranger builds in
-            // flight AT a check — a stranger that finished entirely inside
-            // the window is indistinguishable, so any observed stranger
-            // blocks attribution and the outcome stays unknown. This never
-            // re-issues the edit and never stamps provenance — ok=true only
-            // routes to the parent's independent content read-back, which
-            // remains the real verification.
+            // the poll observes only in-flight builds; a build that finished
+            // inside the window leaves a durable audit dir. Diff the audit
+            // listing against the pre-trigger snapshot: a new timestamped dir
+            // is evidence a build completed. Attribution is by window, not by build identity: any
+            // observed stranger blocks it. Never re-issues, never stamps;
+            // ok=true routes to the parent's read-back (the verification).
             //
             // The poll end-state is read from the poll's own observations,
             // not from build_done alone: a build in flight at the last check

package/workflows/upgrade.js

@@ -165,12 +165,14 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
 // crew-api.js statically imports it, so the pin must carry it — a pin
 // without it kills every claim with ERR_MODULE_NOT_FOUND.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -201,7 +203,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
+    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && cp " + sq(NOTE_VOCAB_SRC) + " " + sq(NOTE_VOCAB) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }