muse-crew 0.14.3 → 0.14.4

package/workflows/bugfix.js

@@ -70,8 +70,10 @@ const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -191,19 +193,12 @@ async function reaskVerdict(stepName, reworkSuffix, workerText) {
   return verdict;
 }
 // Transport retry: the work-agent agent() call can throw even when the agent
-// did the work. Stochastic envelope non-compliance (bare prose instead of
-// the native {"status":"ok","result":"..."} envelope) trips the runtime's
-// JSON-candidate heuristic when the prose contains a {...}-looking
-// substring — canary 39457ee9's QA report quoted the change's own
-// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
-// and the workflow discarded a complete VERDICT: PASS report as "no output".
-// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
-// this covers the report never arriving. The assignment is retried boundedly
-// with fresh keys (never a cached replay) before failing closed. Re-entry is
-// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
-// retry trailer tells the agent to check existing state first and report
-// rather than duplicate completed side effects, and the rework path already
-// re-runs Build after rejection — Build re-entry is an established pattern.
+// did the work — the runtime's JSON-candidate heuristic trips on brace-shaped
+// prose. Retry the assignment boundedly with fresh keys (never a cached
+// replay) before failing closed. Re-entry is safe: lifecycle scripts answer
+// REUSED for existing worktrees/branches, the retry trailer tells the agent
+// to check existing state first, and Build re-entry after rejection is an
+// established pattern. Full history: docs/decisions/workflow-core.md.
 function workRetryKey(stepName, reworkSuffix, attempt) {
   return "work-" + stepName + reworkSuffix + "-t" + attempt;
 }
@@ -215,7 +210,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -396,25 +391,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish read-back request (currently unavailable): the verbatim_request
-// the parent protocol (docs/publish-verification.md) would hand to an
-// independent read-back tool after the artifact build lands. artifact_inspect
-// was removed by the platform (2026-09-14); artifact.inspect is malfunction
-// diagnosis, not a substitute — so no agent-callable read-back tool exists
-// and this request cannot currently be issued. Pure function — no I/O, no
-// clock. The request carries the merged diff as the expected change and asks
-// for an independent read of the artifact's actual source: for each file, the
-// exact current text of the changed regions plus a per-line present/absent
-// finding. Until a read-back path exists, the parent cannot independently
-// confirm content and verification parks at "publish: verification-requested"
-// (see docs/publish-verification.md). This preserves the circularity break
-// that hollowed canary run 8 (2026-09-11): the old verifyAppliedChanges
-// compared the builder's applied-report against the diff the report was
-// derived from — a fabricated report passed by construction. The report
-// itself is gone now (2026-09-16 fire-and-forget trigger). Independent
-// read-back cannot be
-// fabricated from the diff; it must match the artifact's real content.
-
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
 // keyTag (optional): same-outcome ledger writes in one pass need distinct
 // agent-call keys — the runtime replays cached calls by key, so a shared key
@@ -433,7 +409,10 @@ async function recordPublishLedger(entry, rework, keyTag) {
       applied_report: entry.applied_report || null,
       manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
-      detail: entry.detail || ""
+      detail: entry.detail || "",
+      // D1 (2026-09-19): issued_at = upper bound on the trigger-issuance
+      // instant (null when no trigger); ts = ledger-write instant.
+      issued_at: entry.issued_at || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -1665,6 +1644,23 @@ while (i < STEPS.length) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
           triggerThrew = true;
         }
+        // D1 (2026-09-19; F-A1 upper-bound 2026-09-20): issued_at is an UPPER
+        // bound on issuance — captured AFTER the trigger-agent call returns,
+        // ferried from one shell date call (workflows have no clock) and
+        // validated mechanically; null when unobserved (fallback: ts).
+        // See docs/decisions/publish-path.md#d1-issuance-time.
+        var triggerIssuedAt = null;
+        try {
+          var issuedAtFerry = await agent(
+            "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+            "Return JSON { \"ts\": \"<the date output, verbatim>\" } and nothing else.",
+            { key: attemptKey("publish-issued-at-" + taskId, totalReworkCount), label: "Capturing post-trigger instant (upper bound on issuance)",
+              schema: { type: "object", properties: { ts: { type: "string" } }, required: ["ts"] } }
+          );
+          var issuedAtRaw = String((issuedAtFerry && issuedAtFerry.ts) || "").trim();
+          if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(issuedAtRaw)) triggerIssuedAt = issuedAtRaw;
+        } catch (issuedAtErr) { /* issued_at stays null: the verifier falls back to ts */ }
+        if (!triggerIssuedAt) log("Publish issuance instant unobserved for task " + taskId + " — issued_at null; the freshness gate falls back to ledger-write ts");
         // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
         await recordPublishLedger({
           commit: mergeCommitForPublish,
@@ -1673,6 +1669,7 @@ while (i < STEPS.length) {
           applied_report: publishAppliedObservation,
           manifest_before: preTriggerManifest,
           outcome: "submitted",
+          issued_at: triggerIssuedAt,
           detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
         }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
@@ -1794,6 +1791,7 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
+            issued_at: triggerIssuedAt,
             detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
           }, totalReworkCount, "receipt");
         } else {

package/workflows/chore.js

@@ -127,8 +127,10 @@ const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -250,19 +252,12 @@ async function reaskVerdict(stepName, reworkSuffix, workerText) {
   return verdict;
 }
 // Transport retry: the work-agent agent() call can throw even when the agent
-// did the work. Stochastic envelope non-compliance (bare prose instead of
-// the native {"status":"ok","result":"..."} envelope) trips the runtime's
-// JSON-candidate heuristic when the prose contains a {...}-looking
-// substring — canary 39457ee9's QA report quoted the change's own
-// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
-// and the workflow discarded a complete VERDICT: PASS report as "no output".
-// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
-// this covers the report never arriving. The assignment is retried boundedly
-// with fresh keys (never a cached replay) before failing closed. Re-entry is
-// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
-// retry trailer tells the agent to check existing state first and report
-// rather than duplicate completed side effects, and the rework path already
-// re-runs Build after rejection — Build re-entry is an established pattern.
+// did the work — the runtime's JSON-candidate heuristic trips on brace-shaped
+// prose. Retry the assignment boundedly with fresh keys (never a cached
+// replay) before failing closed. Re-entry is safe: lifecycle scripts answer
+// REUSED for existing worktrees/branches, the retry trailer tells the agent
+// to check existing state first, and Build re-entry after rejection is an
+// established pattern. Full history: docs/decisions/workflow-core.md.
 function workRetryKey(stepName, reworkSuffix, attempt) {
   return "work-" + stepName + reworkSuffix + "-t" + attempt;
 }
@@ -274,7 +269,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -455,25 +450,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish read-back request (currently unavailable): the verbatim_request
-// the parent protocol (docs/publish-verification.md) would hand to an
-// independent read-back tool after the artifact build lands. artifact_inspect
-// was removed by the platform (2026-09-14); artifact.inspect is malfunction
-// diagnosis, not a substitute — so no agent-callable read-back tool exists
-// and this request cannot currently be issued. Pure function — no I/O, no
-// clock. The request carries the merged diff as the expected change and asks
-// for an independent read of the artifact's actual source: for each file, the
-// exact current text of the changed regions plus a per-line present/absent
-// finding. Until a read-back path exists, the parent cannot independently
-// confirm content and verification parks at "publish: verification-requested"
-// (see docs/publish-verification.md). This preserves the circularity break
-// that hollowed canary run 8 (2026-09-11): the old verifyAppliedChanges
-// compared the builder's applied-report against the diff the report was
-// derived from — a fabricated report passed by construction. The report
-// itself is gone now (2026-09-16 fire-and-forget trigger). Independent
-// read-back cannot be
-// fabricated from the diff; it must match the artifact's real content.
-
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
 // keyTag (optional): same-outcome ledger writes in one pass need distinct
 // agent-call keys — the runtime replays cached calls by key, so a shared key
@@ -492,7 +468,10 @@ async function recordPublishLedger(entry, rework, keyTag) {
       applied_report: entry.applied_report || null,
       manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
-      detail: entry.detail || ""
+      detail: entry.detail || "",
+      // D1 (2026-09-19): issued_at = upper bound on the trigger-issuance
+      // instant (null when no trigger); ts = ledger-write instant.
+      issued_at: entry.issued_at || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -1571,6 +1550,23 @@ while (i < STEPS.length) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
           triggerThrew = true;
         }
+        // D1 (2026-09-19; F-A1 upper-bound 2026-09-20): issued_at is an UPPER
+        // bound on issuance — captured AFTER the trigger-agent call returns,
+        // ferried from one shell date call (workflows have no clock) and
+        // validated mechanically; null when unobserved (fallback: ts).
+        // See docs/decisions/publish-path.md#d1-issuance-time.
+        var triggerIssuedAt = null;
+        try {
+          var issuedAtFerry = await agent(
+            "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+            "Return JSON { \"ts\": \"<the date output, verbatim>\" } and nothing else.",
+            { key: attemptKey("publish-issued-at-" + taskId, reworkCount), label: "Capturing post-trigger instant (upper bound on issuance)",
+              schema: { type: "object", properties: { ts: { type: "string" } }, required: ["ts"] } }
+          );
+          var issuedAtRaw = String((issuedAtFerry && issuedAtFerry.ts) || "").trim();
+          if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(issuedAtRaw)) triggerIssuedAt = issuedAtRaw;
+        } catch (issuedAtErr) { /* issued_at stays null: the verifier falls back to ts */ }
+        if (!triggerIssuedAt) log("Publish issuance instant unobserved for task " + taskId + " — issued_at null; the freshness gate falls back to ledger-write ts");
         // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
         await recordPublishLedger({
           commit: mergeCommitForPublish,
@@ -1579,6 +1575,7 @@ while (i < STEPS.length) {
           applied_report: publishAppliedObservation,
           manifest_before: preTriggerManifest,
           outcome: "submitted",
+          issued_at: triggerIssuedAt,
           detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
         }, reworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
@@ -1700,6 +1697,7 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
+            issued_at: triggerIssuedAt,
             detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
           }, reworkCount, "receipt");
         } else {

package/workflows/standard.js

@@ -78,8 +78,10 @@ const COMPUTE_DIFF_SRC = crewHome + "/current/lib/compute-publish-diff.js";
 const COMPUTE_DIFF = RUN_LIB + "/compute-publish-diff.js";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -199,19 +201,12 @@ async function reaskVerdict(stepName, reworkSuffix, workerText) {
   return verdict;
 }
 // Transport retry: the work-agent agent() call can throw even when the agent
-// did the work. Stochastic envelope non-compliance (bare prose instead of
-// the native {"status":"ok","result":"..."} envelope) trips the runtime's
-// JSON-candidate heuristic when the prose contains a {...}-looking
-// substring — canary 39457ee9's QA report quoted the change's own
-// {/* ... */} JSX comment, the runtime tried to parse it as JSON, threw,
-// and the workflow discarded a complete VERDICT: PASS report as "no output".
-// The verdict re-ask covers an unreadable verdict inside a RECEIVED report;
-// this covers the report never arriving. The assignment is retried boundedly
-// with fresh keys (never a cached replay) before failing closed. Re-entry is
-// safe: lifecycle scripts answer REUSED for existing worktrees/branches, the
-// retry trailer tells the agent to check existing state first and report
-// rather than duplicate completed side effects, and the rework path already
-// re-runs Build after rejection — Build re-entry is an established pattern.
+// did the work — the runtime's JSON-candidate heuristic trips on brace-shaped
+// prose. Retry the assignment boundedly with fresh keys (never a cached
+// replay) before failing closed. Re-entry is safe: lifecycle scripts answer
+// REUSED for existing worktrees/branches, the retry trailer tells the agent
+// to check existing state first, and Build re-entry after rejection is an
+// established pattern. Full history: docs/decisions/workflow-core.md.
 function workRetryKey(stepName, reworkSuffix, attempt) {
   return "work-" + stepName + reworkSuffix + "-t" + attempt;
 }
@@ -223,7 +218,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -445,7 +440,10 @@ async function recordPublishLedger(entry, rework, keyTag) {
       applied_report: entry.applied_report || null,
       manifest_before: entry.manifest_before || null,
       outcome: entry.outcome,
-      detail: entry.detail || ""
+      detail: entry.detail || "",
+      // D1 (2026-09-19): issued_at = upper bound on the trigger-issuance
+      // instant (null when no trigger); ts = ledger-write instant.
+      issued_at: entry.issued_at || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -1558,6 +1556,23 @@ while (i < STEPS.length) {
           log("Publish rebuild trigger for task " + taskId + " threw (" + (triggerErr && triggerErr.message ? triggerErr.message : triggerErr) + ") — outcome unknown until observation confirms it; the edit may have gone through");
           triggerThrew = true;
         }
+        // D1 (2026-09-19; F-A1 upper-bound 2026-09-20): issued_at is an UPPER
+        // bound on issuance — captured AFTER the trigger-agent call returns,
+        // ferried from one shell date call (workflows have no clock) and
+        // validated mechanically; null when unobserved (fallback: ts).
+        // See docs/decisions/publish-path.md#d1-issuance-time.
+        var triggerIssuedAt = null;
+        try {
+          var issuedAtFerry = await agent(
+            "Run: date -u +%Y-%m-%dT%H:%M:%SZ\n" +
+            "Return JSON { \"ts\": \"<the date output, verbatim>\" } and nothing else.",
+            { key: attemptKey("publish-issued-at-" + taskId, totalReworkCount), label: "Capturing post-trigger instant (upper bound on issuance)",
+              schema: { type: "object", properties: { ts: { type: "string" } }, required: ["ts"] } }
+          );
+          var issuedAtRaw = String((issuedAtFerry && issuedAtFerry.ts) || "").trim();
+          if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(issuedAtRaw)) triggerIssuedAt = issuedAtRaw;
+        } catch (issuedAtErr) { /* issued_at stays null: the verifier falls back to ts */ }
+        if (!triggerIssuedAt) log("Publish issuance instant unobserved for task " + taskId + " — issued_at null; the freshness gate falls back to ledger-write ts");
         // (2026-09-19, room #22) Submitted-on-issuance: see docs/decisions/publish-path.md#submitted-on-issuance.
         await recordPublishLedger({
           commit: mergeCommitForPublish,
@@ -1566,6 +1581,7 @@ while (i < STEPS.length) {
           applied_report: publishAppliedObservation,
           manifest_before: preTriggerManifest,
           outcome: "submitted",
+          issued_at: triggerIssuedAt,
           detail: "trigger issuance: rebuild-trigger agent invoked; receipt/observation pending. Invocation only - not evidence of artifact_edit or build acceptance." + (triggerThrew ? "; trigger-threw" : "; trigger-returned")
         }, totalReworkCount, "issuance");
         // Post-trigger observation (primary, not fallback): the workflow
@@ -1687,6 +1703,7 @@ while (i < STEPS.length) {
             applied_report: publishAppliedObservation,
             manifest_before: preTriggerManifest,
             outcome: "submitted",
+            issued_at: triggerIssuedAt,
             detail: "fire-and-forget trigger; build receipt captured by workflow-owned build-state observation (pre/post-trigger diff); observation, not re-issuance"
           }, totalReworkCount, "receipt");
         } else {

package/workflows/upgrade.js

@@ -165,12 +165,14 @@ const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
 const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
 const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
+const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
+const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
 // The six basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
 // CLASSIFY_SURFACE is the surface classifier (room #15, 2026-09-18):
 // crew-api.js statically imports it, so the pin must carry it — a pin
 // without it kills every claim with ERR_MODULE_NOT_FOUND.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, CLASSIFY_SURFACE].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -201,7 +203,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
+    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && cp " + sq(NOTE_VOCAB_SRC) + " " + sq(NOTE_VOCAB) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }