muse-crew 0.14.5 → 0.14.6

package/workflows/bugfix.js

@@ -237,14 +237,6 @@ var TOOL_CHECK_PREAMBLE =
   "2. Write exactly one line: artifact_tools: ok - or artifact_tools: missing if the call failed or the tool does not exist.\n" +
   "3. Run the shell command: echo tool-probe-ok - then write exactly one line: shell_transport: ok - or shell_transport: unavailable if you cannot run shell commands.\n" +
   "Then do the assignment below.\n\n";
-// ARTIFACT_LOAD_PREAMBLE - the one-line load instruction that precedes every
-// special-purpose prompt calling artifact tools (rebuild trigger, provenance
-// stamp, publish verification). The artifact tool namespace is deferred for
-// workflow children: present but invisible until the child loads it via
-// tool_search.load_tool_namespace (bug 3472bf36 root cause). Byte-identical
-// across standard/bugfix/chore - pinned by tests/artifact-tools.test.js.
-var ARTIFACT_LOAD_PREAMBLE =
-  "First call tool_search.load_tool_namespace with paths [\"artifact\"] - the artifact tool namespace is deferred and invisible until loaded.\n";
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
   // reason: "discarded" (the runtime threw the output away - it could not be
   // machine-read), "empty" (agent() returned without throwing but produced
@@ -422,6 +414,11 @@ async function recordPublishLedger(entry, rework) {
       diff_path: entry.diff_path || null,
       diff_sha256: entry.diff_sha256 || null,
       base: entry.base || null,
+      // (0.14.6) Numeric publication attempt + the attempt's deterministic
+      // version. Attempt 1 is staged here by the workflow; attempts 2-3 are
+      // staged by scan-ack-pending's re-issue path with fresh versions.
+      publish_attempt: entry.publish_attempt || null,
+      version: entry.version || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -433,9 +430,15 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
+    // (2026-09-20 REVIEW) The intent entry is the machine's anchor — the
+    // caller gates on this return. LEDGER_OK in the agent's verbatim output
+    // is the only mechanical proof the line landed.
+    var ok = res && typeof res.result === "string" && res.result.indexOf("LEDGER_OK") !== -1;
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger" + (ok ? "" : " (WRITE UNCONFIRMED)"));
+    return ok;
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
+    return false;
   }
 }
 
@@ -1485,7 +1488,7 @@ while (i < STEPS.length) {
         var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + ".diff";
         var diffResult = await agent(
           "Run exactly one command and nothing else:\n" +
-          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --task-id \"" + taskId + "\" --attempt 1 --out \"" + publishDiffFile + "\"\n" +
           "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, totalReworkCount), label: "Computing publish diff from stamped base",
             schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
@@ -1508,6 +1511,18 @@ while (i < STEPS.length) {
         var mergeCommitForPublish = String(diffSummary.commit || "").trim();
         var mergeCommitShortForPublish = String(mergeCommitForPublish).substring(0, 7) || "unknown";
         var publishDiffSha256 = String(diffSummary.sha256 || "");
+        // (0.14.6) The per-attempt publish version, synthesized into the
+        // staged diff as .crew-publish-version-<task_id> (per-task receipt —
+        // two same-project tasks can publish concurrently) by the
+        // deterministic script.
+        // The workflow never invents it: the script derives it from
+        // task+commit+attempt, and the intent scan re-derives it before
+        // claiming. A missing/malformed version parks — never publish blind.
+        var publishVersion = String(diffSummary.version || "");
+        // Mirrors isPublishVersion() in lib/crew-api.js: <40-hex commit>:<attempt>.
+        if (!/^[0-9a-f]{40}:[1-9][0-9]*$/.test(publishVersion)) {
+          return await parkTask("Publish diff for commit " + (mergeCommitForPublish || "unknown") + " carries no usable publish version — cannot stage a verifiable intent. Human attention needed.");
+        }
         if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
@@ -1535,131 +1550,53 @@ while (i < STEPS.length) {
         // worker verifies the sha256 from the intent entry before issuing;
         // a mismatch stops issuance. (2026-09-20, one-party worker-owned
         // publish: the workflow no longer issues the edit itself.)
-        // See docs/decisions/publish-path.md#durable-evidence-snapshot: snapshot the audit-dir listing BEFORE the trigger; fallback diffs before/after.
-        var auditDirsBeforeTrigger = [];
-        var auditBeforeOk = false;
-        // Pre-trigger baselines (design §1.9): the audit-dir listing and the
-        // manifest snapshot. The verified-path freshness check compares the
-        // post-trigger manifest against the baseline (built_at advance +
-        // content_sha256 change). Best-effort, never gates — a missing
-        // manifest baseline fails the verified path closed.
-        var preTriggerManifest = null;
-        try {
-          var auditBefore = await agent(
-            "Capture pre-trigger baselines for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshots, never gates).\n" +
-            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null; echo ---MANIFEST---; cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/.space-build/manifest.json 2>/dev/null\n" +
-            "Return JSON { \"dirs\": \"<newline-separated names, empty string when missing>\", \"manifest\": \"<the manifest's full text, or empty string when missing/unreadable>\" } and nothing else.",
-            { key: attemptKey("publish-baseline-before-" + taskId, totalReworkCount), label: "Snapshotting baselines before rebuild trigger",
-              schema: { type: "object", properties: { dirs: { type: "string" }, manifest: { type: "string" } }, required: ["dirs", "manifest"] } }
-          );
-          auditDirsBeforeTrigger = String((auditBefore && auditBefore.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
-          var manifestText = String((auditBefore && auditBefore.manifest) || "").trim();
-          if (manifestText) {
-            var manifestJson = JSON.parse(manifestText);
-            preTriggerManifest = {
-              built_at: typeof manifestJson.built_at === "string" ? manifestJson.built_at : null,
-              content_sha256: typeof manifestJson.content_sha256 === "string" ? manifestJson.content_sha256 : null,
-            };
-          }
-          // Arm only after both baselines parse.
-          auditBeforeOk = true;
-          log("Publish pre-trigger baselines for task " + taskId + ": " + auditDirsBeforeTrigger.length + " audit dirs, manifest " + (preTriggerManifest ? "built_at=" + preTriggerManifest.built_at : "none"));
-        } catch (auditBeforeErr) {
-          log("Publish pre-trigger baselines failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
-        }
-
-        // See docs/decisions/publish-path.md#fire-and-forget-trigger: the trigger child returns immediately; the workflow owns observation and verdict.
-        var publishToolsOk = false;
-        var publishToolsMissing = false;
-        for (var toolcheckAttempt = 1; toolcheckAttempt <= 2 && !publishToolsOk; toolcheckAttempt++) {
-          try {
-            var toolcheckResult = await agent(
-              "Check whether the artifact tool namespace is available.\n" +
-              "Call tool_search.load_tool_namespace with paths [\"artifact\"].\n" +
-              "Then emit exactly one line and nothing else: ARTIFACT_TOOLS: <ok if the load succeeded and artifact_edit and artifact_status are now functions, missing otherwise>.\n" +
-              "Return JSON { \"signal\": \"<the exact ARTIFACT_TOOLS line>\" } and nothing else.",
-              { key: attemptKey("publish-artifact-toolcheck-" + taskId + (toolcheckAttempt === 1 ? "" : "-retry2"), totalReworkCount),
-                label: "Checking artifact tool availability" + (toolcheckAttempt === 1 ? "" : " (retry)"),
-                schema: { type: "object", properties: { signal: { type: "string" } }, required: ["signal"] } }
-            );
-            var toolSignal = String((toolcheckResult && toolcheckResult.signal) || "");
-            if (/ARTIFACT_TOOLS:\s*ok/.test(toolSignal)) {
-              publishToolsOk = true;
-            } else if (/ARTIFACT_TOOLS:\s*missing/.test(toolSignal)) {
-              publishToolsMissing = true;
-            }
-            log("Publish artifact toolcheck for task " + taskId + " (attempt " + toolcheckAttempt + " of 2): " +
-              (publishToolsOk ? "tools ok" : publishToolsMissing ? "tools missing (explicit parsed signal)" : "inconclusive (no ARTIFACT_TOOLS signal parsed)"));
-          } catch (toolcheckErr) {
-            log("Publish artifact toolcheck for task " + taskId + " (attempt " + toolcheckAttempt + " of 2) threw (" + (toolcheckErr && toolcheckErr.message ? toolcheckErr.message : toolcheckErr) + ") — inconclusive: a throw proves nothing about tool availability, never counted as missing");
-          }
-        }
-        if (!publishToolsOk && !publishToolsMissing) {
-          await recordPublishLedger({
-            commit: mergeCommitForPublish,
-            attempt: rebuildAttemptKey,
-            agent_id: null,
-            applied_report: null,
-            outcome: "unknown",
-            detail: "artifact toolcheck inconclusive after two attempts (throws or unparseable signals — never an explicit ARTIFACT_TOOLS: missing): tool availability unproven, so the trigger was NOT issued; unknown parks fail closed with no blind retry"
-          }, totalReworkCount);
-          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact toolcheck was inconclusive after two attempts (no explicit ARTIFACT_TOOLS signal parsed — a throw is transport noise, not evidence). Tool availability is unproven, so no edit was issued and nothing was retried blindly. Human attention needed.");
-        }
-        if (!publishToolsOk) {
-          await recordPublishLedger({
-            commit: mergeCommitForPublish,
-            attempt: rebuildAttemptKey,
-            agent_id: null,
-            applied_report: null,
-            outcome: "rejected",
-            detail: "artifact tool namespace explicitly missing (parsed ARTIFACT_TOOLS: missing signal, one bounded retry spent): the edit provably did not go through — no trigger issued, no blind retry"
-          }, totalReworkCount);
-          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact tool namespace was explicitly missing (parsed signal — the edit provably did not go through, so no trigger was issued and nothing was retried blindly). Human attention needed.");
-        }
-        // See docs/decisions/publish-path.md#pretrigger-baseline: a tiny schema'd baseline is captured before the trigger.
-        var baselineAgentId = null;
-        var baselineFailed = false;
-        try {
-          var publishBaseline = await agent(
-            ARTIFACT_LOAD_PREAMBLE +
-            "Call artifact_status with slug \"" + PUBLISH_SLUG + "\" once.\n" +
-            "Return JSON { \"build\": <the raw \"build\" value exactly as returned, or null when there is none> } and nothing else.",
-            { key: attemptKey("publish-artifact-baseline-" + taskId, totalReworkCount), label: "Reading pre-trigger build state",
-              schema: { type: "object", properties: { build: { type: ["object", "null"] } }, required: ["build"] } }
-          );
-          baselineAgentId = (publishBaseline && publishBaseline.build && typeof publishBaseline.build.agent_id === "string" && publishBaseline.build.agent_id) || null;
-          log("Publish pre-trigger baseline for task " + taskId + ": " + (baselineAgentId ? "build " + baselineAgentId + " already in flight (predates the trigger — never attributed to this edit)" : "no build in flight"));
-        } catch (baselineErr) {
-          baselineFailed = true;
-          log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
-        }
         // (2026-09-20, one-party worker-owned publish) The workflow exits
         // Publish at intent. Everything above — preflight, provenance base,
+        // checksummed diff — is read-only. (2026-09-20 REVIEW: the
+        // pre-trigger baselines, artifact toolcheck, and pre-trigger build
+        // state agent steps were deleted — their outputs fed only the
+        // retired content-verdict/receipt-attribution machinery, and the
+        // toolcheck ran in a workflow child that cannot reach artifact_edit.
+        // Issuance belongs to the session-carrying tick worker, which
+        // handles tool-unavailability as inconclusive per the tick protocol.)
+        // Publish at intent. Everything above — preflight, provenance base,
         // checksummed diff, toolcheck, pre-trigger baselines — is read-only.
         // Issuance belongs to the session-carrying tick worker
-        // (scan-publish-unknown's intent bucket), the only caller class that
+        // (scan-publish-intent's intent bucket), the only caller class that
         // can reach artifact_edit. This entry is issuer-written BY THE
         // WORKFLOW and names the intent: outcome "publish-intent", never
         // "submitted" — the workflow issued nothing. The worker claims it
         // via the park note below.
-        await recordPublishLedger({
+        // (2026-09-20 REVIEW) The intent ledger entry is the anchor the
+        // whole machine depends on. If the ferry drops it, the task would
+        // park with publish-requested and no anchor — unclaimable forever.
+        // Fail loudly instead of parking an orphan intent.
+        var intentAnchored = await recordPublishLedger({
           commit: mergeCommitForPublish,
           attempt: rebuildAttemptKey,
+          // (0.14.6) Attempt 1, staged here. The version is the attempt's
+          // deterministic receipt string, synthesized into the staged diff;
+          // the ack scan re-derives it from task+commit+attempt before the
+          // tick worker may issue the edit.
+          publish_attempt: 1,
+          version: publishVersion,
           agent_id: null,
           applied_report: null,
-          manifest_before: preTriggerManifest,
           outcome: "publish-intent",
           issuer: "workflow",
           diff_path: publishDiffFile,
           diff_sha256: publishDiffSha256,
           // (2026-09-20, critic-0145 F-A4) The base the diff was computed
-          // against: scan-publish-unknown's intent branch compares it with
+          // against: scan-publish-intent's intent branch compares it with
           // current stamped provenance and re-queues the task when it went
           // stale — never issues the stale diff.
           base: publishBase,
-          detail: "publish intent: preflight, checksummed diff, toolcheck, and pre-trigger baselines are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
+          detail: "publish intent: preflight and checksummed diff are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
         }, totalReworkCount);
-        return await parkTask("publish: publish-requested " + mergeCommitForPublish + " " + rebuildAttemptKey + " — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") for the crew's publish worker to issue. The worker verifies the build and stamps provenance before this task resumes; no action needed.");
+        if (!intentAnchored) {
+          throw new Error("publish-intent ledger anchor write unconfirmed for task " + taskId + " — refusing to park an unclaimable intent; the Publish phase fails loudly instead");
+        }
+        return await parkTask("publish: publish-requested " + mergeCommitForPublish + " attempt=1 — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") carrying the per-attempt publish version for the crew's publish worker to issue. The worker issues the edit directly and the acknowledgement scan owns the task from there; no action needed.");
         } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
         // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
@@ -2320,10 +2257,10 @@ while (i < STEPS.length) {
     } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
-  // Parent-owned verification (docs/publish-verification.md): the parent's
-  // scan builds the request via lib/build-readback-request.js and ferries
-  // the inspection; a skipped or failed publish has nothing to verify.
-  // See docs/decisions/publish-path.md#parent-owned-verification for history.
+  // Version acknowledgement (docs/publish-verification.md): the tick worker
+  // issues the edit directly and the ack scan owns the task from there —
+  // the exact per-attempt version on the artifact's disk is the sole positive
+  // completion criterion. A skipped or failed publish has nothing to ack.
   let summary;
   var workerMarkers = extractMarkerLines(workerText);
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {

package/workflows/chore.js

@@ -296,14 +296,6 @@ var TOOL_CHECK_PREAMBLE =
   "2. Write exactly one line: artifact_tools: ok - or artifact_tools: missing if the call failed or the tool does not exist.\n" +
   "3. Run the shell command: echo tool-probe-ok - then write exactly one line: shell_transport: ok - or shell_transport: unavailable if you cannot run shell commands.\n" +
   "Then do the assignment below.\n\n";
-// ARTIFACT_LOAD_PREAMBLE - the one-line load instruction that precedes every
-// special-purpose prompt calling artifact tools (rebuild trigger, provenance
-// stamp, publish verification). The artifact tool namespace is deferred for
-// workflow children: present but invisible until the child loads it via
-// tool_search.load_tool_namespace (bug 3472bf36 root cause). Byte-identical
-// across standard/bugfix/chore - pinned by tests/artifact-tools.test.js.
-var ARTIFACT_LOAD_PREAMBLE =
-  "First call tool_search.load_tool_namespace with paths [\"artifact\"] - the artifact tool namespace is deferred and invisible until loaded.\n";
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
   // reason: "discarded" (the runtime threw the output away - it could not be
   // machine-read), "empty" (agent() returned without throwing but produced
@@ -481,6 +473,11 @@ async function recordPublishLedger(entry, rework) {
       diff_path: entry.diff_path || null,
       diff_sha256: entry.diff_sha256 || null,
       base: entry.base || null,
+      // (0.14.6) Numeric publication attempt + the attempt's deterministic
+      // version. Attempt 1 is staged here by the workflow; attempts 2-3 are
+      // staged by scan-ack-pending's re-issue path with fresh versions.
+      publish_attempt: entry.publish_attempt || null,
+      version: entry.version || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -492,9 +489,15 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
+    // (2026-09-20 REVIEW) The intent entry is the machine's anchor — the
+    // caller gates on this return. LEDGER_OK in the agent's verbatim output
+    // is the only mechanical proof the line landed.
+    var ok = res && typeof res.result === "string" && res.result.indexOf("LEDGER_OK") !== -1;
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger" + (ok ? "" : " (WRITE UNCONFIRMED)"));
+    return ok;
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
+    return false;
   }
 }
 
@@ -1391,7 +1394,7 @@ while (i < STEPS.length) {
         var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (reworkCount > 0 ? "-r" + reworkCount : "") + ".diff";
         var diffResult = await agent(
           "Run exactly one command and nothing else:\n" +
-          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --task-id \"" + taskId + "\" --attempt 1 --out \"" + publishDiffFile + "\"\n" +
           "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, reworkCount), label: "Computing publish diff from stamped base",
             schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
@@ -1414,6 +1417,18 @@ while (i < STEPS.length) {
         var mergeCommitForPublish = String(diffSummary.commit || "").trim();
         var mergeCommitShortForPublish = String(mergeCommitForPublish).substring(0, 7) || "unknown";
         var publishDiffSha256 = String(diffSummary.sha256 || "");
+        // (0.14.6) The per-attempt publish version, synthesized into the
+        // staged diff as .crew-publish-version-<task_id> (per-task receipt —
+        // two same-project tasks can publish concurrently) by the
+        // deterministic script.
+        // The workflow never invents it: the script derives it from
+        // task+commit+attempt, and the intent scan re-derives it before
+        // claiming. A missing/malformed version parks — never publish blind.
+        var publishVersion = String(diffSummary.version || "");
+        // Mirrors isPublishVersion() in lib/crew-api.js: <40-hex commit>:<attempt>.
+        if (!/^[0-9a-f]{40}:[1-9][0-9]*$/.test(publishVersion)) {
+          return await parkTask("Publish diff for commit " + (mergeCommitForPublish || "unknown") + " carries no usable publish version — cannot stage a verifiable intent. Human attention needed.");
+        }
         if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
@@ -1441,131 +1456,53 @@ while (i < STEPS.length) {
         // worker verifies the sha256 from the intent entry before issuing;
         // a mismatch stops issuance. (2026-09-20, one-party worker-owned
         // publish: the workflow no longer issues the edit itself.)
-        // See docs/decisions/publish-path.md#durable-evidence-snapshot: snapshot the audit-dir listing BEFORE the trigger; fallback diffs before/after.
-        var auditDirsBeforeTrigger = [];
-        var auditBeforeOk = false;
-        // Pre-trigger baselines (design §1.9): the audit-dir listing and the
-        // manifest snapshot. The verified-path freshness check compares the
-        // post-trigger manifest against the baseline (built_at advance +
-        // content_sha256 change). Best-effort, never gates — a missing
-        // manifest baseline fails the verified path closed.
-        var preTriggerManifest = null;
-        try {
-          var auditBefore = await agent(
-            "Capture pre-trigger baselines for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshots, never gates).\n" +
-            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null; echo ---MANIFEST---; cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/.space-build/manifest.json 2>/dev/null\n" +
-            "Return JSON { \"dirs\": \"<newline-separated names, empty string when missing>\", \"manifest\": \"<the manifest's full text, or empty string when missing/unreadable>\" } and nothing else.",
-            { key: attemptKey("publish-baseline-before-" + taskId, reworkCount), label: "Snapshotting baselines before rebuild trigger",
-              schema: { type: "object", properties: { dirs: { type: "string" }, manifest: { type: "string" } }, required: ["dirs", "manifest"] } }
-          );
-          auditDirsBeforeTrigger = String((auditBefore && auditBefore.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
-          var manifestText = String((auditBefore && auditBefore.manifest) || "").trim();
-          if (manifestText) {
-            var manifestJson = JSON.parse(manifestText);
-            preTriggerManifest = {
-              built_at: typeof manifestJson.built_at === "string" ? manifestJson.built_at : null,
-              content_sha256: typeof manifestJson.content_sha256 === "string" ? manifestJson.content_sha256 : null,
-            };
-          }
-          // Arm only after both baselines parse.
-          auditBeforeOk = true;
-          log("Publish pre-trigger baselines for task " + taskId + ": " + auditDirsBeforeTrigger.length + " audit dirs, manifest " + (preTriggerManifest ? "built_at=" + preTriggerManifest.built_at : "none"));
-        } catch (auditBeforeErr) {
-          log("Publish pre-trigger baselines failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
-        }
-
-        // See docs/decisions/publish-path.md#fire-and-forget-trigger: the trigger child returns immediately; the workflow owns observation and verdict.
-        var publishToolsOk = false;
-        var publishToolsMissing = false;
-        for (var toolcheckAttempt = 1; toolcheckAttempt <= 2 && !publishToolsOk; toolcheckAttempt++) {
-          try {
-            var toolcheckResult = await agent(
-              "Check whether the artifact tool namespace is available.\n" +
-              "Call tool_search.load_tool_namespace with paths [\"artifact\"].\n" +
-              "Then emit exactly one line and nothing else: ARTIFACT_TOOLS: <ok if the load succeeded and artifact_edit and artifact_status are now functions, missing otherwise>.\n" +
-              "Return JSON { \"signal\": \"<the exact ARTIFACT_TOOLS line>\" } and nothing else.",
-              { key: attemptKey("publish-artifact-toolcheck-" + taskId + (toolcheckAttempt === 1 ? "" : "-retry2"), reworkCount),
-                label: "Checking artifact tool availability" + (toolcheckAttempt === 1 ? "" : " (retry)"),
-                schema: { type: "object", properties: { signal: { type: "string" } }, required: ["signal"] } }
-            );
-            var toolSignal = String((toolcheckResult && toolcheckResult.signal) || "");
-            if (/ARTIFACT_TOOLS:\s*ok/.test(toolSignal)) {
-              publishToolsOk = true;
-            } else if (/ARTIFACT_TOOLS:\s*missing/.test(toolSignal)) {
-              publishToolsMissing = true;
-            }
-            log("Publish artifact toolcheck for task " + taskId + " (attempt " + toolcheckAttempt + " of 2): " +
-              (publishToolsOk ? "tools ok" : publishToolsMissing ? "tools missing (explicit parsed signal)" : "inconclusive (no ARTIFACT_TOOLS signal parsed)"));
-          } catch (toolcheckErr) {
-            log("Publish artifact toolcheck for task " + taskId + " (attempt " + toolcheckAttempt + " of 2) threw (" + (toolcheckErr && toolcheckErr.message ? toolcheckErr.message : toolcheckErr) + ") — inconclusive: a throw proves nothing about tool availability, never counted as missing");
-          }
-        }
-        if (!publishToolsOk && !publishToolsMissing) {
-          await recordPublishLedger({
-            commit: mergeCommitForPublish,
-            attempt: rebuildAttemptKey,
-            agent_id: null,
-            applied_report: null,
-            outcome: "unknown",
-            detail: "artifact toolcheck inconclusive after two attempts (throws or unparseable signals — never an explicit ARTIFACT_TOOLS: missing): tool availability unproven, so the trigger was NOT issued; unknown parks fail closed with no blind retry"
-          }, reworkCount);
-          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact toolcheck was inconclusive after two attempts (no explicit ARTIFACT_TOOLS signal parsed — a throw is transport noise, not evidence). Tool availability is unproven, so no edit was issued and nothing was retried blindly. Human attention needed.");
-        }
-        if (!publishToolsOk) {
-          await recordPublishLedger({
-            commit: mergeCommitForPublish,
-            attempt: rebuildAttemptKey,
-            agent_id: null,
-            applied_report: null,
-            outcome: "rejected",
-            detail: "artifact tool namespace explicitly missing (parsed ARTIFACT_TOOLS: missing signal, one bounded retry spent): the edit provably did not go through — no trigger issued, no blind retry"
-          }, reworkCount);
-          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact tool namespace was explicitly missing (parsed signal — the edit provably did not go through, so no trigger was issued and nothing was retried blindly). Human attention needed.");
-        }
-        // See docs/decisions/publish-path.md#pretrigger-baseline: a tiny schema'd baseline is captured before the trigger.
-        var baselineAgentId = null;
-        var baselineFailed = false;
-        try {
-          var publishBaseline = await agent(
-            ARTIFACT_LOAD_PREAMBLE +
-            "Call artifact_status with slug \"" + PUBLISH_SLUG + "\" once.\n" +
-            "Return JSON { \"build\": <the raw \"build\" value exactly as returned, or null when there is none> } and nothing else.",
-            { key: attemptKey("publish-artifact-baseline-" + taskId, reworkCount), label: "Reading pre-trigger build state",
-              schema: { type: "object", properties: { build: { type: ["object", "null"] } }, required: ["build"] } }
-          );
-          baselineAgentId = (publishBaseline && publishBaseline.build && typeof publishBaseline.build.agent_id === "string" && publishBaseline.build.agent_id) || null;
-          log("Publish pre-trigger baseline for task " + taskId + ": " + (baselineAgentId ? "build " + baselineAgentId + " already in flight (predates the trigger — never attributed to this edit)" : "no build in flight"));
-        } catch (baselineErr) {
-          baselineFailed = true;
-          log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
-        }
         // (2026-09-20, one-party worker-owned publish) The workflow exits
         // Publish at intent. Everything above — preflight, provenance base,
+        // checksummed diff — is read-only. (2026-09-20 REVIEW: the
+        // pre-trigger baselines, artifact toolcheck, and pre-trigger build
+        // state agent steps were deleted — their outputs fed only the
+        // retired content-verdict/receipt-attribution machinery, and the
+        // toolcheck ran in a workflow child that cannot reach artifact_edit.
+        // Issuance belongs to the session-carrying tick worker, which
+        // handles tool-unavailability as inconclusive per the tick protocol.)
+        // Publish at intent. Everything above — preflight, provenance base,
         // checksummed diff, toolcheck, pre-trigger baselines — is read-only.
         // Issuance belongs to the session-carrying tick worker
-        // (scan-publish-unknown's intent bucket), the only caller class that
+        // (scan-publish-intent's intent bucket), the only caller class that
         // can reach artifact_edit. This entry is issuer-written BY THE
         // WORKFLOW and names the intent: outcome "publish-intent", never
         // "submitted" — the workflow issued nothing. The worker claims it
         // via the park note below.
-        await recordPublishLedger({
+                // (2026-09-20 REVIEW) The intent ledger entry is the anchor the
+        // whole machine depends on. If the ferry drops it, the task would
+        // park with publish-requested and no anchor — unclaimable forever.
+        // Fail loudly instead of parking an orphan intent.
+        var intentAnchored = await recordPublishLedger({
           commit: mergeCommitForPublish,
           attempt: rebuildAttemptKey,
+          // (0.14.6) Attempt 1, staged here. The version is the attempt's
+          // deterministic receipt string, synthesized into the staged diff;
+          // the ack scan re-derives it from task+commit+attempt before the
+          // tick worker may issue the edit.
+          publish_attempt: 1,
+          version: publishVersion,
           agent_id: null,
           applied_report: null,
-          manifest_before: preTriggerManifest,
           outcome: "publish-intent",
           issuer: "workflow",
           diff_path: publishDiffFile,
           diff_sha256: publishDiffSha256,
           // (2026-09-20, critic-0145 F-A4) The base the diff was computed
-          // against: scan-publish-unknown's intent branch compares it with
+          // against: scan-publish-intent's intent branch compares it with
           // current stamped provenance and re-queues the task when it went
           // stale — never issues the stale diff.
           base: publishBase,
-          detail: "publish intent: preflight, checksummed diff, toolcheck, and pre-trigger baselines are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
+          detail: "publish intent: preflight and checksummed diff are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
         }, reworkCount);
-        return await parkTask("publish: publish-requested " + mergeCommitForPublish + " " + rebuildAttemptKey + " — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") for the crew's publish worker to issue. The worker verifies the build and stamps provenance before this task resumes; no action needed.");
+        if (!intentAnchored) {
+          throw new Error("publish-intent ledger anchor write unconfirmed for task " + taskId + " — refusing to park an unclaimable intent; the Publish phase fails loudly instead");
+        }
+        return await parkTask("publish: publish-requested " + mergeCommitForPublish + " attempt=1 — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") carrying the per-attempt publish version for the crew's publish worker to issue. The worker issues the edit directly and the acknowledgement scan owns the task from there; no action needed.");
         } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
         // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
@@ -1947,10 +1884,10 @@ while (i < STEPS.length) {
     } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
-  // Parent-owned verification (docs/publish-verification.md): the parent's
-  // scan builds the request via lib/build-readback-request.js and ferries
-  // the inspection; a skipped or failed publish has nothing to verify.
-  // See docs/decisions/publish-path.md#parent-owned-verification for history.
+  // Version acknowledgement (docs/publish-verification.md): the tick worker
+  // issues the edit directly and the ack scan owns the task from there —
+  // the exact per-attempt version on the artifact's disk is the sole positive
+  // completion criterion. A skipped or failed publish has nothing to ack.
   let summary;
   var workerMarkers = extractMarkerLines(workerText);
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {

package/workflows/crew-init.js

@@ -58,6 +58,29 @@ if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew
 // create projects later via crew-api.js). One without the other is an error.
 if (!!dashboardSlug !== !!dashboardRepoPath) throw new Error("dashboardSlug and dashboardRepoPath must be provided together, or neither (omit both for a CLI-only install without a dashboard)");
 
+// ── Cron id override validation (2026-09-20, 0.14.6 REVIEW) ──
+// Uninstall's discovery fallback only recognizes live ids that start with
+// a manifest entry id + "-" (crew-poll-, crew-ack-scan-,
+// crew-update-watch-). An override that breaks that convention would
+// survive uninstall if .cron-registry.json were ever lost — so overrides
+// must keep the manifest-id prefix. Fail closed at init, before any cron
+// is created.
+for (const manifestId of Object.keys(cronIds)) {
+  const liveId = cronIds[manifestId];
+  if (typeof liveId !== "string" || !liveId.startsWith(manifestId + "-")) {
+    return {
+      __hatchWorkflowControl: "blocked",
+      result: {
+        blocked_reason: "Invalid cronIds override",
+        message: "cronIds[\"" + manifestId + "\"] must start with \"" + manifestId + "-\" — got " +
+          JSON.stringify(liveId) + ". Uninstall's discovery fallback only recognizes live ids under " +
+          "the manifest-id prefix; an arbitrary id could survive uninstall if the cron registry " +
+          "were lost. Re-run init with a prefixed id."
+      }
+    };
+  }
+}
+
 const orchDir = crewHome + "/.orchestration";
 
 // ── Dependency node_modules resolution (clean-room defect 2026-09-16) ──

package/workflows/crew-uninstall.js

@@ -158,11 +158,14 @@ try {
     "Steps:\n" +
     "1. Registry: if " + sq(crewHomeExpanded + "/.cron-registry.json") + " exists, read it\n" +
     "   and take its crons[].id list as registry candidates.\n" +
-    "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
+    "2. Discovery: call cron_list. For every job whose id starts with one of\n" +
+    "   'crew-poll-', 'crew-ack-scan-', or 'crew-update-watch-' (the three\n" +
+    "   seed/crons.json manifest entry ids, each suffixed with the instance id),\n" +
     "   call cron_view and keep it as a discovery candidate when the job body\n" +
-    "   contains the crewHome string '" + crewHomeExpanded + "' (the poll body template\n" +
-    "   embeds the crew home path). The bare id 'crew-poll' with no instance suffix\n" +
-    "   is never a live crew job — never remove it.\n" +
+    "   contains the crewHome string '" + crewHomeExpanded + "' (the cron body templates\n" +
+    "   embed the crew home path). A bare manifest id ('crew-poll', 'crew-ack-scan',\n" +
+    "   'crew-update-watch') with no instance suffix is never a live crew job —\n" +
+    "   never remove it.\n" +
     "3. Removal list = registry candidates ∪ discovery candidates, deduped.\n" +
     "   SAFETY: remove only jobs on this list. When in doubt about any job, fail\n" +
     "   closed (passed: false) instead of guessing.\n" +