muse-crew 0.14.6 → 0.14.8

package/workflows/crew-dispatch.js

@@ -46,10 +46,43 @@ const MAX_TASKS_PER_POLL = inputs.maxTasksPerPoll || 6;
 
 // Workflow step registry: static per release. The poll cron body reads
 // <crewHome>/workflows/registry.json (generated at release time from the
-// workflow files, which stay the single source of truth) and passes it as
-// inputs.registry. Fall back to the agent() load only when the caller
-// predates the registry — slow, but never broken.
-var registryResult = inputs.registry;
+// workflow files, which stay the single source of truth) and ferries the
+// RAW FILE TEXT as inputs.registryText. The dispatcher parses it
+// deterministically — the poller LLM never parses-and-re-emits a nested
+// object into the tool call. (Room #26: 15+ "schema validation" launch
+// rejections 09-19→09-21 from the LLM garbling the nested object, plus one
+// hallucinated-but-shape-valid registry that silently drove dispatch with
+// wrong step tables.) A string arg is trivially well-formed at the
+// tool-call boundary — the same ferry pattern the board already uses.
+// Fall back to the agent() load only when the caller predates the registry
+// — slow, but never broken.
+function parseRegistryText(text) {
+  if (text === undefined || text === null) {
+    return { ok: false, reason: "registryText is missing" };
+  }
+  if (typeof text !== "string") {
+    return { ok: false, reason: "registryText is not a string" };
+  }
+  try {
+    return { ok: true, registry: JSON.parse(text) };
+  } catch (e) {
+    return { ok: false, reason: "registryText is not valid JSON: " + e.message };
+  }
+}
+var registryResult = null;
+var registryTextResult = parseRegistryText(inputs.registryText);
+if (registryTextResult.ok) {
+  registryResult = registryTextResult.registry;
+} else if (inputs.registryText !== undefined && inputs.registryText !== null) {
+  // Present but unusable: name the defect, then fall through to the slow load.
+  log("WARNING: " + registryTextResult.reason + " — falling back to slow registry load");
+} else if (inputs.registry !== undefined && inputs.registry !== null) {
+  // Legacy: pre-string-ferry poller prompts passed the parsed object.
+  // Same validation applies; a garbled object falls through to the slow
+  // load exactly like a missing one.
+  log("WARNING: legacy inputs.registry object received — prefer the registryText string ferry");
+  registryResult = inputs.registry;
+}
 // Nested-registry seam (2026-09-20): a malformed nested registry object
 // (e.g. a workflow key mapping to null/undefined, or a steps entry without
 // a name) used to die deep in the lookup tables with a cryptic TypeError
@@ -78,6 +111,18 @@ function validateRegistry(reg) {
     if (typeof wf.reworkTarget !== "string") {
       return { ok: false, reason: "workflow '" + wfNames[i] + "' has no reworkTarget string" };
     }
+    // Content pin (room #26): a shape-valid registry can still be
+    // hallucinated — 2026-09-21 a poller ferried docs.reworkTarget="Build"
+    // (docs.js has no Build step) and it passed shape validation, silently
+    // driving dispatch with wrong step tables. The rework target must name
+    // a real step of its own workflow; this invariant is release-independent.
+    var stepNames = {};
+    for (var j = 0; j < wf.steps.length; j++) {
+      stepNames[wf.steps[j].name] = true;
+    }
+    if (!stepNames[wf.reworkTarget]) {
+      return { ok: false, reason: "workflow '" + wfNames[i] + "' reworkTarget '" + wf.reworkTarget + "' names no step" };
+    }
   }
   return { ok: true };
 }
@@ -113,6 +158,14 @@ if (!registryResult) {
       }
     }
   );
+  // The slow agent load is the same untrusted ferry as the args path — a
+  // hallucinated registry would silently drive dispatch with wrong step
+  // tables. Re-run the existing validation on the slow-loaded result and
+  // fail closed with the same reason; there is no second fallback.
+  var slowCheck = validateRegistry(registryResult);
+  if (!slowCheck.ok) {
+    throw new Error("registry slow load failed validation (" + slowCheck.reason + ") — cannot derive step tables; aborting dispatch");
+  }
 }
 
 // Derive lookup tables from canonical definitions

package/workflows/docs.js

@@ -543,7 +543,17 @@ function describeWorkAgentFailure(stepName, identity, attempts) {
         "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
           task_id: taskId,
           session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed", notes: "Worker report had no single unambiguous VERDICT: PASS/FAIL line (bounded re-ask exhausted)" },
-          event: { task_id: taskId, type: "failed", message: step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry" }
+          event: { task_id: taskId, type: "failed", message: step.name + " verdict line missing or ambiguous, re-ask exhausted — phase failed, dispatcher will retry" },
+          // Room #26 blocker 33: INDETERMINATE verdict record — the report
+          // could not be read at all, but its full text is still preserved
+          // as grounds. (docs has Review as its only verdict step.)
+          verdict: {
+            step: "Review",
+            attempt: reworkCount,
+            reviewer: step.identity,
+            verdict: "INDETERMINATE",
+            grounds: workerText
+          }
         }) + "\n",
         { key: "record-block-" + step.name, label: "Recording verdict failure" }
       );
@@ -578,7 +588,19 @@ function describeWorkAgentFailure(stepName, identity, attempts) {
     "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
       task_id: taskId,
       session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: status, notes: summary },
-      event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity }
+      event: { task_id: taskId, type: status, identity: step.identity, message: step.name + " " + status + " by " + step.identity },
+      // Room #26 blocker 33: structured, non-lossy Review verdict record.
+      // The session note above is truncated; the verdict row carries the
+      // full worker report as grounds, written in the same transaction.
+      // attempt is the rework round (0 = first Review). (docs has Review
+      // as its only verdict step, so verdictPassed is always set here.)
+      verdict: (verdictPassed !== null ? {
+        step: "Review",
+        attempt: reworkCount,
+        reviewer: step.identity,
+        verdict: verdictPassed ? "PASS" : "FAIL",
+        grounds: workerText
+      } : null)
     }) + "\n",
     {
       key: "record-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : ""),