muse-crew 0.14.5 → 0.14.6

package/workflows/standard.js

@@ -245,14 +245,6 @@ var TOOL_CHECK_PREAMBLE =
   "2. Write exactly one line: artifact_tools: ok - or artifact_tools: missing if the call failed or the tool does not exist.\n" +
   "3. Run the shell command: echo tool-probe-ok - then write exactly one line: shell_transport: ok - or shell_transport: unavailable if you cannot run shell commands.\n" +
   "Then do the assignment below.\n\n";
-// ARTIFACT_LOAD_PREAMBLE - the one-line load instruction that precedes every
-// special-purpose prompt calling artifact tools (rebuild trigger, provenance
-// stamp, publish verification). The artifact tool namespace is deferred for
-// workflow children: present but invisible until the child loads it via
-// tool_search.load_tool_namespace (bug 3472bf36 root cause). Byte-identical
-// across standard/bugfix/chore - pinned by tests/artifact-tools.test.js.
-var ARTIFACT_LOAD_PREAMBLE =
-  "First call tool_search.load_tool_namespace with paths [\"artifact\"] - the artifact tool namespace is deferred and invisible until loaded.\n";
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
   // reason: "discarded" (the runtime threw the output away - it could not be
   // machine-read), "empty" (agent() returned without throwing but produced
@@ -399,28 +391,6 @@ function hydrateReleaseDecision(rec) {
   return null;
 }
 
-// Publish read-back request (agent path currently unavailable): the
-// verbatim_request the parent protocol (docs/publish-verification.md) would
-// hand to an independent read-back tool after the artifact build lands.
-// artifact_inspect was removed by the platform (2026-09-14);
-// artifact.inspect is malfunction diagnosis, not a substitute — so no
-// agent-callable read-back tool exists and this LLM-inspector request
-// cannot currently be issued. The primary sensor is now the deterministic
-// lib/readback-disk.js (reads the on-disk tree the artifact is served
-// from); this request builder is retained only as the manual fallback.
-// Pure function — no I/O, no clock. The request carries the merged diff as the expected change and asks
-// for an independent read of the artifact's actual source: for each file, the
-// exact current text of the changed regions plus a per-line present/absent
-// finding. The primary sensor is the deterministic lib/readback-disk.js;
-// after the tick worker issues the edit, the parent's scan mirrors the
-// verification request park note and the verifier certifies content
-// before stamping (see docs/publish-verification.md). This preserves the
-// circularity break that hollowed canary run 8 (2026-09-11): the old
-// verifyAppliedChanges compared the builder's applied-report against the
-// diff the report was derived from — a fabricated report passed by
-// construction. Independent read-back cannot be fabricated from the diff;
-// it must match the artifact's real content.
-
 // See docs/decisions/publish-path.md#publish-attempt-ledger: every trigger outcome is recorded in the durable ledger.
 // (2026-09-20, one-party worker-owned publish) No keyTag: every ledger
 // write in a Publish pass is followed by a return, so no pass can write two
@@ -452,6 +422,11 @@ async function recordPublishLedger(entry, rework) {
       diff_path: entry.diff_path || null,
       diff_sha256: entry.diff_sha256 || null,
       base: entry.base || null,
+      // (0.14.6) Numeric publication attempt + the attempt's deterministic
+      // version. Attempt 1 is staged here by the workflow; attempts 2-3 are
+      // staged by scan-ack-pending's re-issue path with fresh versions.
+      publish_attempt: entry.publish_attempt || null,
+      version: entry.version || null,
     });
     var sq = function(s) { return "'" + String(s).split("'").join("'\\''") + "'"; };
     var res = await agent(
@@ -463,9 +438,15 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
+    // (2026-09-20 REVIEW) The intent entry is the machine's anchor — the
+    // caller gates on this return. LEDGER_OK in the agent's verbatim output
+    // is the only mechanical proof the line landed.
+    var ok = res && typeof res.result === "string" && res.result.indexOf("LEDGER_OK") !== -1;
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger" + (ok ? "" : " (WRITE UNCONFIRMED)"));
+    return ok;
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
+    return false;
   }
 }
 
@@ -1396,7 +1377,7 @@ while (i < STEPS.length) {
         var publishDiffFile = crewHome + "/.publish-diffs/" + taskId + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + ".diff";
         var diffResult = await agent(
           "Run exactly one command and nothing else:\n" +
-          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --out \"" + publishDiffFile + "\"\n" +
+          "node " + COMPUTE_DIFF + " --repo-path \"" + REPO_PATH + "\" --base " + publishBase + " --task-id \"" + taskId + "\" --attempt 1 --out \"" + publishDiffFile + "\"\n" +
           "The script prints one small JSON object to stdout. Return the stdout verbatim as { \"output\": \"<verbatim stdout>\" } and nothing else. Do not interpret it.",
           { key: attemptKey("publish-artifact-diff-" + taskId, totalReworkCount), label: "Computing publish diff from stamped base",
             schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
@@ -1419,6 +1400,18 @@ while (i < STEPS.length) {
         var mergeCommitForPublish = String(diffSummary.commit || "").trim();
         var mergeCommitShortForPublish = String(mergeCommitForPublish).substring(0, 7) || "unknown";
         var publishDiffSha256 = String(diffSummary.sha256 || "");
+        // (0.14.6) The per-attempt publish version, synthesized into the
+        // staged diff as .crew-publish-version-<task_id> (per-task receipt —
+        // two same-project tasks can publish concurrently) by the
+        // deterministic script.
+        // The workflow never invents it: the script derives it from
+        // task+commit+attempt, and the intent scan re-derives it before
+        // claiming. A missing/malformed version parks — never publish blind.
+        var publishVersion = String(diffSummary.version || "");
+        // Mirrors isPublishVersion() in lib/crew-api.js: <40-hex commit>:<attempt>.
+        if (!/^[0-9a-f]{40}:[1-9][0-9]*$/.test(publishVersion)) {
+          return await parkTask("Publish diff for commit " + (mergeCommitForPublish || "unknown") + " carries no usable publish version — cannot stage a verifiable intent. Human attention needed.");
+        }
         if (!diffSummary.bytes) {
           return await parkTask("Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
         }
@@ -1446,131 +1439,53 @@ while (i < STEPS.length) {
         // worker verifies the sha256 from the intent entry before issuing;
         // a mismatch stops issuance. (2026-09-20, one-party worker-owned
         // publish: the workflow no longer issues the edit itself.)
-        // See docs/decisions/publish-path.md#durable-evidence-snapshot: snapshot the audit-dir listing BEFORE the trigger; fallback diffs before/after.
-        var auditDirsBeforeTrigger = [];
-        var auditBeforeOk = false;
-        // Pre-trigger baselines (design §1.9): the audit-dir listing and the
-        // manifest snapshot. The verified-path freshness check compares the
-        // post-trigger manifest against the baseline (built_at advance +
-        // content_sha256 change). Best-effort, never gates — a missing
-        // manifest baseline fails the verified path closed.
-        var preTriggerManifest = null;
-        try {
-          var auditBefore = await agent(
-            "Capture pre-trigger baselines for slug \"" + PUBLISH_SLUG + "\" (best-effort snapshots, never gates).\n" +
-            "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null; echo ---MANIFEST---; cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/.space-build/manifest.json 2>/dev/null\n" +
-            "Return JSON { \"dirs\": \"<newline-separated names, empty string when missing>\", \"manifest\": \"<the manifest's full text, or empty string when missing/unreadable>\" } and nothing else.",
-            { key: attemptKey("publish-baseline-before-" + taskId, totalReworkCount), label: "Snapshotting baselines before rebuild trigger",
-              schema: { type: "object", properties: { dirs: { type: "string" }, manifest: { type: "string" } }, required: ["dirs", "manifest"] } }
-          );
-          auditDirsBeforeTrigger = String((auditBefore && auditBefore.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
-          var manifestText = String((auditBefore && auditBefore.manifest) || "").trim();
-          if (manifestText) {
-            var manifestJson = JSON.parse(manifestText);
-            preTriggerManifest = {
-              built_at: typeof manifestJson.built_at === "string" ? manifestJson.built_at : null,
-              content_sha256: typeof manifestJson.content_sha256 === "string" ? manifestJson.content_sha256 : null,
-            };
-          }
-          // Arm only after both baselines parse.
-          auditBeforeOk = true;
-          log("Publish pre-trigger baselines for task " + taskId + ": " + auditDirsBeforeTrigger.length + " audit dirs, manifest " + (preTriggerManifest ? "built_at=" + preTriggerManifest.built_at : "none"));
-        } catch (auditBeforeErr) {
-          log("Publish pre-trigger baselines failed for task " + taskId + " (non-fatal): audit fallback DISABLED for this attempt — without a baseline, historical dirs would look new: " + (auditBeforeErr && auditBeforeErr.message ? auditBeforeErr.message : auditBeforeErr));
-        }
-
-        // See docs/decisions/publish-path.md#fire-and-forget-trigger: the trigger child returns immediately; the workflow owns observation and verdict.
-        var publishToolsOk = false;
-        var publishToolsMissing = false;
-        for (var toolcheckAttempt = 1; toolcheckAttempt <= 2 && !publishToolsOk; toolcheckAttempt++) {
-          try {
-            var toolcheckResult = await agent(
-              "Check whether the artifact tool namespace is available.\n" +
-              "Call tool_search.load_tool_namespace with paths [\"artifact\"].\n" +
-              "Then emit exactly one line and nothing else: ARTIFACT_TOOLS: <ok if the load succeeded and artifact_edit and artifact_status are now functions, missing otherwise>.\n" +
-              "Return JSON { \"signal\": \"<the exact ARTIFACT_TOOLS line>\" } and nothing else.",
-              { key: attemptKey("publish-artifact-toolcheck-" + taskId + (toolcheckAttempt === 1 ? "" : "-retry2"), totalReworkCount),
-                label: "Checking artifact tool availability" + (toolcheckAttempt === 1 ? "" : " (retry)"),
-                schema: { type: "object", properties: { signal: { type: "string" } }, required: ["signal"] } }
-            );
-            var toolSignal = String((toolcheckResult && toolcheckResult.signal) || "");
-            if (/ARTIFACT_TOOLS:\s*ok/.test(toolSignal)) {
-              publishToolsOk = true;
-            } else if (/ARTIFACT_TOOLS:\s*missing/.test(toolSignal)) {
-              publishToolsMissing = true;
-            }
-            log("Publish artifact toolcheck for task " + taskId + " (attempt " + toolcheckAttempt + " of 2): " +
-              (publishToolsOk ? "tools ok" : publishToolsMissing ? "tools missing (explicit parsed signal)" : "inconclusive (no ARTIFACT_TOOLS signal parsed)"));
-          } catch (toolcheckErr) {
-            log("Publish artifact toolcheck for task " + taskId + " (attempt " + toolcheckAttempt + " of 2) threw (" + (toolcheckErr && toolcheckErr.message ? toolcheckErr.message : toolcheckErr) + ") — inconclusive: a throw proves nothing about tool availability, never counted as missing");
-          }
-        }
-        if (!publishToolsOk && !publishToolsMissing) {
-          await recordPublishLedger({
-            commit: mergeCommitForPublish,
-            attempt: rebuildAttemptKey,
-            agent_id: null,
-            applied_report: null,
-            outcome: "unknown",
-            detail: "artifact toolcheck inconclusive after two attempts (throws or unparseable signals — never an explicit ARTIFACT_TOOLS: missing): tool availability unproven, so the trigger was NOT issued; unknown parks fail closed with no blind retry"
-          }, totalReworkCount);
-          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact toolcheck was inconclusive after two attempts (no explicit ARTIFACT_TOOLS signal parsed — a throw is transport noise, not evidence). Tool availability is unproven, so no edit was issued and nothing was retried blindly. Human attention needed.");
-        }
-        if (!publishToolsOk) {
-          await recordPublishLedger({
-            commit: mergeCommitForPublish,
-            attempt: rebuildAttemptKey,
-            agent_id: null,
-            applied_report: null,
-            outcome: "rejected",
-            detail: "artifact tool namespace explicitly missing (parsed ARTIFACT_TOOLS: missing signal, one bounded retry spent): the edit provably did not go through — no trigger issued, no blind retry"
-          }, totalReworkCount);
-          return await parkTask("Publish cannot proceed for task " + taskId + ": the artifact tool namespace was explicitly missing (parsed signal — the edit provably did not go through, so no trigger was issued and nothing was retried blindly). Human attention needed.");
-        }
-        // See docs/decisions/publish-path.md#pretrigger-baseline: a tiny schema'd baseline is captured before the trigger.
-        var baselineAgentId = null;
-        var baselineFailed = false;
-        try {
-          var publishBaseline = await agent(
-            ARTIFACT_LOAD_PREAMBLE +
-            "Call artifact_status with slug \"" + PUBLISH_SLUG + "\" once.\n" +
-            "Return JSON { \"build\": <the raw \"build\" value exactly as returned, or null when there is none> } and nothing else.",
-            { key: attemptKey("publish-artifact-baseline-" + taskId, totalReworkCount), label: "Reading pre-trigger build state",
-              schema: { type: "object", properties: { build: { type: ["object", "null"] } }, required: ["build"] } }
-          );
-          baselineAgentId = (publishBaseline && publishBaseline.build && typeof publishBaseline.build.agent_id === "string" && publishBaseline.build.agent_id) || null;
-          log("Publish pre-trigger baseline for task " + taskId + ": " + (baselineAgentId ? "build " + baselineAgentId + " already in flight (predates the trigger — never attributed to this edit)" : "no build in flight"));
-        } catch (baselineErr) {
-          baselineFailed = true;
-          log("Publish pre-trigger baseline read failed for task " + taskId + " (" + (baselineErr && baselineErr.message ? baselineErr.message : baselineErr) + ") — receipt attribution skipped; durable audit-dir evidence is the only positive signal");
-        }
         // (2026-09-20, one-party worker-owned publish) The workflow exits
         // Publish at intent. Everything above — preflight, provenance base,
+        // checksummed diff — is read-only. (2026-09-20 REVIEW: the
+        // pre-trigger baselines, artifact toolcheck, and pre-trigger build
+        // state agent steps were deleted — their outputs fed only the
+        // retired content-verdict/receipt-attribution machinery, and the
+        // toolcheck ran in a workflow child that cannot reach artifact_edit.
+        // Issuance belongs to the session-carrying tick worker, which
+        // handles tool-unavailability as inconclusive per the tick protocol.)
+        // Publish at intent. Everything above — preflight, provenance base,
         // checksummed diff, toolcheck, pre-trigger baselines — is read-only.
         // Issuance belongs to the session-carrying tick worker
-        // (scan-publish-unknown's intent bucket), the only caller class that
+        // (scan-publish-intent's intent bucket), the only caller class that
         // can reach artifact_edit. This entry is issuer-written BY THE
         // WORKFLOW and names the intent: outcome "publish-intent", never
         // "submitted" — the workflow issued nothing. The worker claims it
         // via the park note below.
-        await recordPublishLedger({
+        // (2026-09-20 REVIEW) The intent ledger entry is the anchor the
+        // whole machine depends on. If the ferry drops it, the task would
+        // park with publish-requested and no anchor — unclaimable forever.
+        // Fail loudly instead of parking an orphan intent.
+        var intentAnchored = await recordPublishLedger({
           commit: mergeCommitForPublish,
           attempt: rebuildAttemptKey,
+          // (0.14.6) Attempt 1, staged here. The version is the attempt's
+          // deterministic receipt string, synthesized into the staged diff;
+          // the ack scan re-derives it from task+commit+attempt before the
+          // tick worker may issue the edit.
+          publish_attempt: 1,
+          version: publishVersion,
           agent_id: null,
           applied_report: null,
-          manifest_before: preTriggerManifest,
           outcome: "publish-intent",
           issuer: "workflow",
           diff_path: publishDiffFile,
           diff_sha256: publishDiffSha256,
           // (2026-09-20, critic-0145 F-A4) The base the diff was computed
-          // against: scan-publish-unknown's intent branch compares it with
+          // against: scan-publish-intent's intent branch compares it with
           // current stamped provenance and re-queues the task when it went
           // stale — never issues the stale diff.
           base: publishBase,
-          detail: "publish intent: preflight, checksummed diff, toolcheck, and pre-trigger baselines are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
+          detail: "publish intent: preflight and checksummed diff are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
         }, totalReworkCount);
-        return await parkTask("publish: publish-requested " + mergeCommitForPublish + " " + rebuildAttemptKey + " — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") for the crew's publish worker to issue. The worker verifies the build and stamps provenance before this task resumes; no action needed.");
+        if (!intentAnchored) {
+          throw new Error("publish-intent ledger anchor write unconfirmed for task " + taskId + " — refusing to park an unclaimable intent; the Publish phase fails loudly instead");
+        }
+        return await parkTask("publish: publish-requested " + mergeCommitForPublish + " attempt=1 — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") carrying the per-attempt publish version for the crew's publish worker to issue. The worker issues the edit directly and the acknowledgement scan owns the task from there; no action needed.");
         } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
         // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
@@ -2127,10 +2042,10 @@ while (i < STEPS.length) {
     } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
-  // Parent-owned verification (docs/publish-verification.md): the parent's
-  // scan builds the request via lib/build-readback-request.js and ferries
-  // the inspection; a skipped or failed publish has nothing to verify.
-  // See docs/decisions/publish-path.md#parent-owned-verification for history.
+  // Version acknowledgement (docs/publish-verification.md): the tick worker
+  // issues the edit directly and the ack scan owns the task from there —
+  // the exact per-attempt version on the artifact's disk is the sole positive
+  // completion criterion. A skipped or failed publish has nothing to ack.
 
   // Session notes. Machine-readable marker lines are extracted from the full
   // worker report and appended AFTER the slice so a long report can never

package/lib/build-readback-request.js

@@ -1,140 +0,0 @@
-#!/usr/bin/env node
-// build-readback-request.js — deterministic builder for the parent publish
-// content read-back inspection request.
-//
-// The parent (tick worker) never hand-writes the inspection prompt: this
-// script builds the EXACT request from the merge commit's diff, so the
-// read-back asks about the real expected change, not an LLM's paraphrase.
-// Output is JSON on stdout: { verbatim_request }.
-//
-// Usage:
-//   node build-readback-request.js --repo-path <path> --commit <sha>
-//       --base <sha> --task-id <uuid> --slug <artifact-slug>
-//       [--build-agent-id <uuid>]
-//
-// --base is the previously-stamped provenance source_commit (the tree the
-// last verification certified), or the empty-tree sha
-// 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first publish with no
-// prior stamp. It is REQUIRED because the merge commit's first parent is
-// NOT necessarily the previously-published tree: push-time reconcile
-// merges (2026-09-14, task 0c53af4e) put the task's own changes behind an
-// intermediate merge, so `commit^1..commit` covers only the reconcile
-// delta and the request would certify content it never checked.
-//
-// Exit codes: 0 ok · 2 usage/validation · 1 git/diff failure.
-
-import { execFileSync } from "node:child_process";
-
-// --help: before required-arg parsing (shebang⇔CLI contract).
-if (process.argv.slice(2).includes("--help")) {
-  console.log(
-    "usage: node build-readback-request.js --repo-path <path> --commit <sha>\n" +
-    "       --base <sha> --task-id <uuid> --slug <artifact-slug> [--build-agent-id <uuid>]\n" +
-    "builds the read-back inspection request from the merge commit's diff"
-  );
-  process.exit(0);
-}
-
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-
-function arg(name) {
-  const i = process.argv.indexOf(name);
-  if (i < 0 || i + 1 >= process.argv.length) {
-    process.stderr.write(JSON.stringify({ ok: false, error: "usage", message: `${name} is required.` }) + "\n");
-    process.exit(2);
-  }
-  return process.argv[i + 1];
-}
-
-const repoPath = arg("--repo-path");
-const commit = arg("--commit");
-const base = arg("--base");
-const taskId = arg("--task-id");
-const slug = arg("--slug");
-const buildAgentId = process.argv.includes("--build-agent-id")
-  ? arg("--build-agent-id") : null;
-
-if (!/^[0-9a-f]{40}$/.test(commit)) {
-  process.stderr.write(JSON.stringify({ ok: false, error: "usage", message: "commit must be a 40-char hex sha." }) + "\n");
-  process.exit(2);
-}
-if (!/^[0-9a-f]{40}$/.test(base)) {
-  process.stderr.write(JSON.stringify({ ok: false, error: "usage", message: "base must be a 40-char hex sha." }) + "\n");
-  process.exit(2);
-}
-// The publish delta is base..commit. Refuse a base that is not an ancestor:
-// certifying a diff against an unrelated tree is worse than no request.
-if (base !== EMPTY_TREE) {
-  try {
-    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
-  } catch (e) {
-    process.stderr.write(JSON.stringify({ ok: false, error: "usage", message: `base ${base} is not an ancestor of commit ${commit} — refusing to build a request that could certify an unrelated tree.` }) + "\n");
-    process.exit(2);
-  }
-}
-
-let diff;
-try {
-  diff = execFileSync("git", ["-C", repoPath, "diff", base, commit, "--"], {
-    encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-  });
-} catch (e) {
-  process.stderr.write(JSON.stringify({ ok: false, error: "git", message: `git diff failed: ${e.message}` }) + "\n");
-  process.exit(1);
-}
-if (!diff.trim()) {
-  process.stderr.write(JSON.stringify({ ok: false, error: "git", message: "empty diff for commit." }) + "\n");
-  process.exit(1);
-}
-
-// Parse the diff into per-file added/removed lines (the contract the
-// verifier will check the inspector's findings against).
-const files = [];
-let current = null;
-for (const line of diff.split("\n")) {
-  if (line.startsWith("diff --git")) {
-    const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
-    current = { path: m ? m[2] : "unknown", added: [], removed: [] };
-    files.push(current);
-  } else if (current && line.startsWith("+") && !line.startsWith("+++")) {
-    current.added.push(line.slice(1));
-  } else if (current && line.startsWith("-") && !line.startsWith("---")) {
-    current.removed.push(line.slice(1));
-  }
-}
-
-const buildIdLine = buildAgentId
-  ? `Expected builder build agent_id: ${buildAgentId} (the artifact system's in-flight correlation ID for this publish attempt — not a durable post-completion identifier).\nReport the live build's agent_id as seen in artifact_status (or state explicitly that no build/agent_id is visible). If an expected agent_id is given above and the live one differs, say so exactly — the read-back may be inspecting a different build's output.\n\n`
-  : "";
-
-const verbatim_request =
-`Publish content read-back for task ${taskId}, merge commit ${commit}.
-Expected change: the publish delta ${base}..${commit} (base = previously-stamped source commit, or the empty tree for a first publish).
-The unified diff below was supposed to be applied to this artifact's source tree and deployed. Do NOT modify anything.
-Do NOT rely on the builder's applied-changes report — it is derived from this same diff, so it cannot confirm the content. Read the artifact's CURRENT source directly.
-
-${buildIdLine}UNIFIED DIFF (expected change):
-\`\`\`diff
-${diff}\`\`\`
-
-For each file in the diff:
-1. Read the file's CURRENT content in the artifact source tree.
-2. Quote the exact current text of the regions around the changed lines.
-3. For every added (+) line in the diff, state whether that exact line is PRESENT in the current source.
-4. For every removed (-) line in the diff, state whether that exact line is ABSENT from the current source.
-5. Report build/deploy health and the console error count.
-
-MACHINE-READABLE FINDINGS (REQUIRED — the parent parses this block mechanically; if it is missing or malformed the verification FAILS CLOSED as blocked):
-For each file, emit exactly these lines, one per changed line, with the verdict at the end of the line:
-FILE: <path>
-ADDED: <exact added line from the diff> :: PRESENT
-ADDED: <exact added line from the diff> :: ABSENT
-REMOVED: <exact removed line from the diff> :: PRESENT
-REMOVED: <exact removed line from the diff> :: ABSENT
-END_FILE
-Emit one ADDED line per (+) diff line and one REMOVED line per (-) diff line — no more, no fewer. The verdict is PRESENT if that exact line occurs in the file's current source, ABSENT otherwise.
-
-Return the per-file present/absent findings with the quoted observed lines. Do not modify anything.
-This read-back feeds the parent content-verification protocol (docs/publish-verification.md): the parent stamps provenance only when every added line is present and every removed line is absent.`;
-
-process.stdout.write(JSON.stringify({ verbatim_request, files_changed: files.map((f) => f.path) }, null, 2) + "\n");

package/lib/check-intent-freshness.js

@@ -1,101 +0,0 @@
-#!/usr/bin/env node
-// check-intent-freshness.js — deterministic manifest-freshness check for a
-// re-claimed one-party publish intent (2026-09-20, critic-0145 F-O3/F-R2).
-//
-// A re-claiming tick must decide: did the dead tick issue the edit (record
-// "recovered") or not (issue it now)? The decision is mechanical, never
-// prose: read the on-disk artifact manifest at the same path the verifier
-// uses (<spaces-root>/<slug>/.space-build/manifest.json — see
-// lib/verify-publish.js) and compare its content_sha256 / built_at against
-// the intent entry's pre-issuance baseline (manifest_before).
-//
-// The manifest ADVANCED — a new build identity, so the dead tick issued —
-// when either:
-//   current.content_sha256 !== baseline.content_sha256  (a new content hash), OR
-//   Date.parse(current.built_at) > Date.parse(baseline.built_at)  (a later build).
-// Otherwise it still shows the pre-edit state and the tick issues fresh.
-//
-// Stdout contract: exactly one JSON object, always small:
-//   { ok:true, advanced:<bool>, baseline:{built_at, content_sha256}, current:{built_at, content_sha256} }
-//   { ok:false, error:"no-baseline"|"unreadable-manifest"|"unparseable-manifest" }
-//
-// Exit codes: 0 ok (JSON on stdout) · 2 usage · 1 IO failure (nothing on
-// stdout — a caller must never treat stdout as a result). Errors go to
-// stderr as JSON.
-//
-// A non-ok result is never a verdict — the caller fails closed: record
-// nothing and let the claim expire into the reclaim path (the scan's F-R3
-// terminal park covers the null-baseline reclaim; an unreadable manifest
-// leaves the task parked for the next tick). Reclaim decisions never rest
-// on prose.
-
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-// --help: before required-arg parsing (shebang⇔CLI contract).
-if (process.argv.slice(2).includes("--help")) {
-  console.log(
-    "usage: node check-intent-freshness.js --slug <slug> --manifest-before '<json>' [--spaces-root <path>]\n" +
-    "compares the on-disk artifact manifest's content_sha256/built_at against the pre-issuance baseline; prints {ok, advanced} JSON on stdout"
-  );
-  process.exit(0);
-}
-
-function arg(name, required = true) {
-  const i = process.argv.indexOf(name);
-  if (i < 0 || i + 1 >= process.argv.length) {
-    if (!required) return null;
-    fail("usage", `${name} is required.`, 2);
-  }
-  return process.argv[i + 1];
-}
-function fail(code, message, exitCode) {
-  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
-  process.exit(exitCode);
-}
-
-const slug = arg("--slug");
-const baselineRaw = arg("--manifest-before");
-const spacesRoot = arg("--spaces-root", false) || join(homedir(), "workspace", "ts-spaces");
-
-if (!slug || /[/\\]/.test(slug)) fail("usage", "--slug must be a non-empty slug (no path separators).", 2);
-
-let baseline;
-try {
-  baseline = JSON.parse(baselineRaw);
-} catch {
-  fail("usage", "--manifest-before must be JSON.", 2);
-}
-if (!baseline || typeof baseline !== "object") fail("no-baseline", "--manifest-before is not an object.", 1);
-const baselineSha = typeof baseline.content_sha256 === "string" ? baseline.content_sha256 : null;
-const baselineBuiltAt = typeof baseline.built_at === "string" ? baseline.built_at : null;
-if (!baselineSha && !baselineBuiltAt) {
-  fail("no-baseline", "the baseline carries neither content_sha256 nor built_at — freshness is unprovable.", 1);
-}
-
-let currentManifest;
-try {
-  currentManifest = JSON.parse(readFileSync(join(spacesRoot, slug, ".space-build", "manifest.json"), "utf8"));
-} catch (e) {
-  const code = e && e.code === "ENOENT" ? "unreadable-manifest" : "unreadable-manifest";
-  fail(code, `cannot read the on-disk manifest: ${(e && e.message) || e}`.slice(0, 300), 1);
-}
-if (!currentManifest || typeof currentManifest !== "object") {
-  fail("unparseable-manifest", "the on-disk manifest is not a JSON object.", 1);
-}
-const currentSha = typeof currentManifest.content_sha256 === "string" ? currentManifest.content_sha256 : null;
-const currentBuiltAt = typeof currentManifest.built_at === "string" ? currentManifest.built_at : null;
-
-const hashAdvanced = !!(baselineSha && currentSha && currentSha !== baselineSha);
-const currentBuiltAtMs = currentBuiltAt ? Date.parse(currentBuiltAt) : NaN;
-const baselineBuiltAtMs = baselineBuiltAt ? Date.parse(baselineBuiltAt) : NaN;
-const timeAdvanced = !!(currentBuiltAtMs > 0 && baselineBuiltAtMs > 0 && currentBuiltAtMs > baselineBuiltAtMs);
-const advanced = hashAdvanced || timeAdvanced;
-
-process.stdout.write(JSON.stringify({
-  ok: true,
-  advanced,
-  baseline: { built_at: baselineBuiltAt, content_sha256: baselineSha },
-  current: { built_at: currentBuiltAt, content_sha256: currentSha },
-}) + "\n");