muse-crew 0.14.8 → 0.14.10

package/workflows/standard.js

@@ -139,7 +139,7 @@ if (!taskId) {
   throw new Error("task_id is required in args");
 }
 
-// See docs/decisions/workflow-core.md#closeout-envelope: the work agent returns the runtime's native envelope; verdict extracted mechanically.
+// See docs/decisions/workflow-core.md#closeout-envelope: the schema-less work courier returns prose, consumed as a plain string; verdict extracted mechanically.
 const VERDICT_STEPS = ["Build", "Review", "QA", "Reproduce", "Integrate", "Publish"];
 function extractVerdict(workerText) {
   // The verdict is the LAST VERDICT: PASS/FAIL in the report (contract: end
@@ -229,7 +229,6 @@ function buildVerdictReaskPrompt(stepName, workerText) {
     "Decide from the report's own content whether the " + stepName + " step clearly describes successful completion: " +
     "if it does, the verdict is PASS; otherwise — failure, error, unfinished work, or unclear — the verdict is FAIL. " +
     "Do NOT copy any VERDICT line from the report — decide from the content.\n\n" +
-    "Return your work as JSON in exactly this shape: {\"status\": \"ok\", \"result\": \"your verdict line here\"}. " +
     "The result must be exactly one line and nothing else: VERDICT: PASS or VERDICT: FAIL.";
 }
 async function reaskVerdict(stepName, reworkSuffix, workerText) {
@@ -302,8 +301,8 @@ var TOOL_CHECK_PREAMBLE =
   "3. Run the shell command: echo tool-probe-ok - then write exactly one line: shell_transport: ok - or shell_transport: unavailable if you cannot run shell commands.\n" +
   "Then do the assignment below.\n\n";
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
-  // reason: "discarded" (the runtime threw the output away - it could not be
-  // machine-read), "empty" (agent() returned without throwing but produced
+  // reason: "discarded" (the runtime threw the output away — the JSON-candidate
+  // scan found {...}-shaped fragments it could not parse), "empty" (agent() returned without throwing but produced
   // nothing usable), "no-tools" (the worker's TOOL CHECK reported
   // artifact_tools: missing), or "no-transport" (the worker's TOOL CHECK
   // reported shell_transport: unavailable).
@@ -314,11 +313,11 @@ function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason)
     ? "your previous attempt's TOOL CHECK reported artifact_tools: missing (this is a fresh launch, so run the TOOL CHECK's load step again before the work)"
     : reason === "no-transport"
     ? "your previous attempt's TOOL CHECK reported shell_transport: unavailable (this is a fresh launch, so run the TOOL CHECK's shell probe again before the work)"
-    : "your previous attempt's output could not be machine-read as JSON and was discarded";
+    : "your previous attempt's output was discarded by the transport because it contained {...}-shaped fragments the transport could not parse; write plain prose with no JSON-shaped fragments";
   return "\n\nTRANSPORT RETRY (attempt " + attempt + " of 2): " + why + ". " +
     "First check existing state (worktree/branch at " + repoPath + "/.worktrees/" + taskId + ", the task branch, dashboard sessions for this task) - " +
     "if the " + stepName + " work is already complete, report on what was done rather than duplicating side effects. " +
-    "Then return your report as JSON in exactly the shape specified above.";
+    "Then return your report in exactly the shape specified above.";
 }
 // parseClassifyFerry — room #26 blocker 42 (2026-09-21). Shape-constrained
 // ferry parser for the classify-branch agent() call. The schema buys SHAPE,
@@ -791,8 +790,52 @@ if (CAPTURE_INDEX < 0) throw new Error("STEPS missing 'Capture' step");
 const REWORK_STEP = STEPS[BUILD_INDEX].name;
 // Shared rework budget: Review and QA rejections draw from the SAME pool of 2.
 // E.g. 2 Review bounces + 1 QA bounce = 3 total > budget -> task blocks.
+// Blocker 46 (2026-09-22): the budget is task-durable, not per-run. A run
+// ends on every operational failure (agent timeout, worktree-confinement
+// failure) and the dispatcher launches a fresh run — the old `let ... = 0`
+// reset the counter on each launch, so a task whose runs kept ending
+// operationally between rejections reworked unboundedly while the designed
+// park stayed unreachable (room #29 J1: 3 rejections across 4 runs, never
+// parked). The counter is seeded from the task's durable event stream at
+// run start (seedReworkCount, after the pin block); in-run increments are
+// unchanged.
 const MAX_TOTAL_REWORK = 2;
 let totalReworkCount = 0;
+// Blocker 46: the first-claim test used totalReworkCount === 0 as a proxy
+// for "this run is entering its first step". The counter is now seeded from
+// task history, so the proxy lies on re-run launches — use an explicit
+// run-local flag instead. The first claim (self-claim with raced-duplicate
+// stand-down) must fire exactly once per run.
+let firstClaimDone = false;
+
+// Blocker 46: count verdict-level `rejected` events (Review/QA rejections —
+// record-phase writes the event type equal to the session status) in the
+// task's durable event stream. Operational failure ends are `failed`, never
+// `rejected`, so they must not spend retry headroom. A failed seed must not
+// strand the run: start at 0 and let the in-run budget govern this run; the
+// seed is retried on the next run.
+async function seedReworkCount() {
+  try {
+    var seed = await agent(
+      "Read this task's event history.\n" +
+      "Run in shell and return the stdout verbatim:\n" + crewCmd("get-events", { task_id: taskId, limit: 100 }) + "\n" +
+      "Count the events whose type is exactly \"rejected\".\n" +
+      "Return JSON { \"rejected_count\": <integer> } and nothing else.",
+      {
+        key: "rework-seed-" + taskId,
+        label: "Seeding shared rework budget from task history",
+        schema: { type: "object", properties: { rejected_count: { type: "number" } }, required: ["rejected_count"] }
+      }
+    );
+    var n = Math.floor(Number(seed && seed.rejected_count) || 0);
+    if (!(n >= 0)) n = 0;
+    if (n > 0) log("Shared rework budget seeded from task history: " + n + " prior rejection(s)");
+    return n;
+  } catch (e) {
+    log("Rework-budget seed unavailable (" + ((e && e.message) || String(e)).slice(0, 120) + ") — starting at 0");
+    return 0;
+  }
+}
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
 // Visual verdict state: Sage's experiential flag (true/false/null until the
@@ -900,6 +943,11 @@ log("Lifecycle scripts pinned to " + RUN_LIB);
 CREW_API = CREW_API_PINNED;
 log("Crew API pinned to " + CREW_API);
 
+// Blocker 46: seed the task-durable rework budget from the task's event
+// history before the phase loop. Pinned copy, so the seed reads the same
+// release this run executes.
+totalReworkCount = await seedReworkCount();
+
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
 // made every concurrent acquire take the stale path). Set exactly once on
@@ -908,7 +956,7 @@ let lockHolder = taskId;
 
 while (i < STEPS.length) {
   const step = STEPS[i];
-  const isFirstClaim = (i === startStepIndex && totalReworkCount === 0);
+  const isFirstClaim = (i === startStepIndex && !firstClaimDone);
 
   phase(step.name);
   log(step.name + " step (" + step.identity + ") for task " + taskId);
@@ -1073,6 +1121,7 @@ while (i < STEPS.length) {
       return { status: "duplicate", task_id: taskId, reason: "task already claimed by another run" };
     }
     activeSessionId = claimResult.session_id;
+    firstClaimDone = true; // blocker 46: exactly once per run
   } else {
     const claimResult = await agent(
       "Claim a session for this task step.\n" +
@@ -1970,14 +2019,15 @@ while (i < STEPS.length) {
         "Public docs (API.md, README, published action schemas) are NOT source code — read them freely, exactly as a user would.\n\n" +
         "STEP 1: Experiential visual inspection — drive the artifact as a user would, one browser step at a time.\n" +
         "You have a see-act driver: " + crewHome + "/current/lib/see-act.js (a node script; one browser action per invocation; it prints one JSON line to stdout). It launches its own Chromium through a self-contained loopback proxy — the ONLY url you may give it is the local artifact server you start below. Never point it at any other URL.\n" +
+        "SESSION PROTOCOL (multi-step flows): one-shot invocations launch a fresh browser each time, so they cannot drive flows where a later step needs an earlier step's living page state (open a deck, then click Study — the second step needs the first step's page state). For those, hold ONE browser alive: node " + crewHome + "/current/lib/see-act.js session-start --name qa --url http://localhost:<N>/ --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl — launches Chromium once in a detached daemon (its control server binds 127.0.0.1 only; the daemon exits after 10 min with no act). The --log path is the SAME ooda-log.jsonl the QA guard reads: every session-act appends its own JSON line in the exact step schema (step, attempt, action, args, exit, screenshot, observation), so you do NOT call append-ooda-step.js for session acts — READ each act's JSON result (the screenshot field is the path to READ with your read tool) and decide the next action. Then drive it: node " + crewHome + "/current/lib/see-act.js session-act --name qa --attempt \"1\" <aria|shot|click|scroll|type> [args] — one action inside the living page. Prefix EVERY session-act invocation with SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ (shell env vars do not persist between your commands, so prefix each one). When done: node " + crewHome + "/current/lib/see-act.js session-end --name qa — closes the browser, prints the session summary, and keeps the session dir as evidence. If session-start exits 3 with a \"NOT POSSIBLE: <reason>\" string, the environment cannot drive a browser: report NOT POSSIBLE: <reason> and judge what you can.\n" +
         "Actions: aria | shot [--out <png>] [--full] | click [--out <png>] --selector <css> | scroll [--out <png>] --y <pixels|bottom> | type [--out <png>] --selector <css> --text <text>. Add --viewport mobile for a 390x844 frame. The JSON reports console_errors — treat any as a defect signal. Exit code 3 with not_possible set (a \"NOT POSSIBLE: <reason>\" string) means this environment cannot drive a browser: report NOT POSSIBLE: <reason> and continue with the mechanical checks — your VERDICT then covers mechanical checks only.\n" +
         "a. Verify the built artifact exists: test -d ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/client/dist && test -f ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/server/dist/actions.js — if either is missing, report NOT POSSIBLE: built artifact not present at ~/workspace/ts-spaces/" + PUBLISH_SLUG + " and continue with the mechanical checks.\n" +
         "b. Start the local artifact server detached with a log file, then poll the log for readiness (single shell invocation): CREW_HOME=" + crewHome + " setsid nohup node " + crewHome + "/current/lib/serve-artifact.js --space-dir ~/workspace/ts-spaces/" + PUBLISH_SLUG + " --port 0 --tag " + taskId + "-qa > /tmp/qa-server-" + taskId + ".log 2>&1 < /dev/null & for i in $(seq 1 30); do grep -q READY /tmp/qa-server-" + taskId + ".log && break; sleep 1; done; grep -o 'READY port=[0-9]*' /tmp/qa-server-" + taskId + ".log | cut -d= -f2 — the printed number is <N>. If no READY appears, report NOT POSSIBLE: local artifact server did not start (see /tmp/qa-server-" + taskId + ".log) and continue with the mechanical checks.\n" +
         "c. Bounded see-act loop, at most 8 steps: drive the artifact as a user would, one browser step at a time. Prefix EVERY see-act invocation with SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ (shell env vars do not persist between your commands, so prefix each one) — every screenshot is then archived automatically as 001-shot-desktop.png, 002-click-desktop.png, ..., so no frame can be lost. Omit --out; the JSON's screenshot field is the path to READ with your read tool (you can see images).\n" +
-        "c2. After EVERY see-act invocation, append it to the OODA report: node " + crewHome + "/current/lib/append-ooda-step.js --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl --attempt \"1\" --step <N> --action <aria|shot|click|scroll|type> --exit <exit-code> --screenshot <screenshot-from-JSON> --observation \"<1-2 sentences: what the frame showed and what you concluded>\" (omit --screenshot for aria). Steps are strictly monotonic: your first step is --step 1, then 2, 3, ... — the script rejects anything else. If you run the loop again (a new idea, after a restart), that run is --attempt \"2\": attempts never overwrite, they accumulate. Your observation is the payload — say what you saw and what it means, not just what you did. A step you ran but did not log is invisible to everyone after you.\n" +
+        "c2. After EVERY one-shot see-act invocation, append it to the OODA report: node " + crewHome + "/current/lib/append-ooda-step.js --log " + crewHome + "/task-evidence/" + taskId + "/postchange/ooda-log.jsonl --attempt \"1\" --step <N> --action <aria|shot|click|scroll|type> --exit <exit-code> --screenshot <screenshot-from-JSON> --observation \"<1-2 sentences: what the frame showed and what you concluded>\" (omit --screenshot for aria). (Session acts are self-logging — session-act already appended its line; for those, READ the result instead of re-logging.) Steps are strictly monotonic: your first step is --step 1, then 2, 3, ... — the script rejects anything else. If you run the loop again (a new idea, after a restart), that run is --attempt \"2\": attempts never overwrite, they accumulate. Your observation is the payload — say what you saw and what it means, not just what you did. A step you ran but did not log is invisible to everyone after you.\n" +
 "c2b. IMAGE TOOLS (when a raw screenshot is not enough evidence): python3 " + crewHome + "/current/lib/edit-image.py crop --in <frame.png> --out <crop.png> --region x,y,w,h — pixel-exact crop; zoom --factor <f> --center x,y — pixel-crisp zoom back to the original frame size; label --text \"<caption>\" — caption bar; nup --cols 2 --in <a.png> --in <b.png> --labels \"before|after\" — side-by-side grid. Deterministic, no network. Log each with --action crop|zoom|label|nup, --attempt \"1\", and --screenshot <the derivative you READ>. For rich compositions (before/after with real typography, annotated callouts), write an HTML page and render it: node " + crewHome + "/current/lib/render-html.js --in <page.html> --out <composed.png> [--width 1200] — headless Chromium, hermetic (remote assets are blocked and fail the render), deterministic; log with --action compose and --screenshot <the composition you READ>. Derivatives supplement, never replace: keep the source frame archived and name it in --args. READ every derivative you log — an unread image is not evidence.\n" +
         "c3. Start with: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ aria — read the JSON, log the step. Then: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ shot — READ the screenshot, log the step. Act on what you see: click, scroll, type, then re-observe, logging each step. Prefer aria (cheap text) to find controls; screenshot when the view changes and for your final verdict frames (one desktop, one mobile). If a click exits non-zero, do NOT retry the same ref blindly: re-run aria first (refs go stale between invocations), then click the fresh ref exactly once. If it still fails, log the failure and move on — a flaky control is a finding, not a loop.\n" +
-        "d. One action per invocation, fresh browser each time: anything reachable by (navigate, one action) is testable — e.g. clicking any tab or button from the landing page. Sequences needing prior in-page state (open a dialog, then confirm it) are not; if the task's change needs such a sequence, report NOT POSSIBLE for that part and judge what you can.\n" +
+        "d. Reach: with the session protocol, any flow reachable by N in-page actions is drivable — open the deck, then click Study, then judge the study view. Without a session (one-shot invocations), anything reachable by (navigate, one action) is testable and sequences needing prior in-page state are not — use a session for those. Report NOT POSSIBLE only when the tooling itself fails (session-start exits 3): a flow you could not reach is not NOT POSSIBLE — name the exact step that stopped you in verdict.json's missing evidence and judge what you did reach.\n" +
         "e. Judge as a user against the task description: does the change render correctly? Look for broken layout, overflow, missing or wrong content, stale data, and console errors. Compare against the task's expected behavior, never against source code (you are code-blind). Every frame you captured is already archived under " + crewHome + "/task-evidence/" + taskId + "/postchange/ and indexed in ooda-log.jsonl. A frame you did not read is not evidence. Loading, error, or blank frames never pass. If you cannot complete the loop, say exactly which steps are missing — unknown is not PASS.\n" +
         "f. Kill ONLY the server you started: pkill -f 'serve-artifact[.]js.*--tag " + taskId + "-qa' — never another task's server. (The [.] keeps pkill from matching its own command line.) Do not leave it running.\n" +
         "Then continue with the mechanical checks below. Your VERDICT covers both the visual and the mechanical checks.\n\n" +
@@ -2061,12 +2111,12 @@ while (i < STEPS.length) {
       "The returned events are filtered to this task. They contain notes and decisions from prior phases.\n\n";
   }
 
-  // Work agent returns the runtime's native envelope {"status": "ok",
-  // "result": "<prose>"} with no schema. The runtime requires JSON output;
-  // the envelope is its own documented shape, so there is nothing for the
-  // agent to improvise. The workflow receives the prose report as a plain
-  // string. The verdict is still extracted deterministically from the report
-  // text by extractVerdict below — never by an agent.
+  // Work agent returns prose on the schema-less courier; the workflow
+  // consumes the return as a plain string (blocker 43, 2026-09-22: the
+  // prompt names no JSON envelope — nothing parses one, and the runtime's
+  // JSON-candidate scan discards brace-shaped prose, which is what the
+  // transport retry guards). The verdict is still extracted deterministically
+  // from the report text by extractVerdict below — never by an agent.
   var workPromptBase =
       TOOL_CHECK_PREAMBLE +
       "Read the identity file at " + ORCH_PATH + "/identities/" + step.identity + ".md using the read tool, and embody that character fully.\n\n" +
@@ -2079,8 +2129,7 @@ while (i < STEPS.length) {
       "\n## Instructions\n\n" + eventPreamble + instructions + "\n\n" +
       "CONSTRAINT: Do NOT call logevent or upsertagentsession — the workflow handles all phase tracking after your step completes.\n\n" +
       "Stay in character. Do the work thoroughly.\n\n" +
-      "Return your work as JSON in exactly this shape: {\"status\": \"ok\", \"result\": \"your report here\"}. " +
-      "The result is plain prose describing what you did and found. For verdict steps, end the report with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
+      "Your report is plain prose describing what you did and found. For verdict steps, end the report with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
   var workKeyBase = "work-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : "");
   var workerResult = null;
   var workAttempts = [];