muse-crew 0.15.0 → 0.17.0

package/workflows/bugfix.js

@@ -72,8 +72,14 @@ const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
 const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
 const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
+const QA_DEPLOY_SRC = crewHome + "/current/lib/qa-deploy.mjs";
+const QA_DEPLOY = RUN_LIB + "/qa-deploy.mjs";
+const SERVE_ARTIFACT_SRC = crewHome + "/current/lib/serve-artifact.js";
+const SERVE_ARTIFACT = RUN_LIB + "/serve-artifact.js";
+const QA_DB_SRC = crewHome + "/current/lib/qa-db.js";
+const QA_DB = RUN_LIB + "/qa-db.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB, QA_DEPLOY, SERVE_ARTIFACT, QA_DB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -265,7 +271,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && cp " + QA_DEPLOY_SRC + " " + QA_DEPLOY + " && cp " + SERVE_ARTIFACT_SRC + " " + SERVE_ARTIFACT + " && cp " + QA_DB_SRC + " " + QA_DB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -563,17 +569,28 @@ function decideIntegrateRetry(o) {
   if (rec.malformed) return "park";
   return ancestor ? "skip-to-publish" : "proceed";
 }
-// QA version gate (issue #3): S=footer build, R=required. S>=R proves the
-// bundle is at/past the merge (single-branch: version order = containment).
-// Pure — pinned by tests/version-gate.test.js. Null = unreadable/missing.
-function decideVersionGate(S, R) {
-  if (!(R > 0)) return { proceed: false, reason: "qa-version-missing",
-    remedy: "no build version recorded — re-run Integrate or record dashboard-version." };
-  if (!(S > 0)) return { proceed: false, reason: "qa-version-unreadable",
-    remedy: "no readable build number in bundle footer — rebuild from versioned source." };
-  if (S >= R) return { proceed: true };
-  return { proceed: false, reason: "qa-bundle-stale",
-    remedy: "bundle build " + S + " behind required " + R + " — builder did not rebuild from current source." };
+// parseDeployResult: pure, fails closed. Ferry returns qa-deploy.mjs stdout
+// verbatim; the marker line is the only machine-read signal.
+function parseDeployResult(output) {
+  var m = /^DEPLOY_OK ([0-9a-f]{7})$/m.exec(String(output || "").trim());
+  if (m) return { ok: true, hash: m[1] };
+  var f = /^DEPLOY_FAIL ([a-z-]+):(.{1,200})$/m.exec(String(output || "").trim());
+  if (f) return { ok: false, reason: f[1] + ": " + f[2].trim() };
+  return { ok: false, reason: "unrecognized deploy output" };
+}
+// QA_ENV_DIR: pipeline-owned, under the crew home. Never the web artifact dir.
+var QA_ENV_DIR = crewHome + "/qa-envs/" + LAUNCH_PROJECT_ID;
+// runDeployFerry: thin mechanical agent, one pinned command, stdout verbatim
+function runDeployFerry(mode) {
+  var cmd = "node " + QA_DEPLOY + " --repo " + REPO_PATH + " --qa-dir " + QA_ENV_DIR +
+    " --task " + taskId + " --crew-home " + crewHome + " --crew-api " + CREW_API_PINNED +
+    " --serve-artifact " + SERVE_ARTIFACT + (mode === "--ensure" ? " --ensure" : "") + " 2>&1";
+  return agent(
+    "Run in shell and return the stdout verbatim:\n" + cmd + "\n" +
+    "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+    { key: "qa-deploy-" + mode.replace(/-/g, "") + "-" + taskId, label: "Deploying QA environment",
+      schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+  );
 }
 // On a dispatcher retry resumed at Integrate, the run-local releaseDecision
 // is null (Build doesn't re-run). Hydrate it from the merge record so the
@@ -1367,25 +1384,28 @@ while (i < STEPS.length) {
   // verdicts.jsonl). No parent verdict gate remains.
   var qaArtifact = false;
   var qaTerminal = false;
-  var qaRequiredVersion = null;
+  var qaBundleHash = null;
   if (step.name === "QA") {
     var qaExp = (await resolveExperiential()) === "yes";
     qaArtifact = qaExp && SURFACE_ARTIFACT;
     qaTerminal = qaExp && SURFACE_TERMINAL;
     if (qaArtifact && projectConfig.versioned_build === true) {
-      var vfile = projectConfig.version_file || "client/src/buildNumber.ts";
-      var vgPre = await agent(
-        "Return ONLY JSON. 1. Run, return stdout verbatim:\n" + crewCmd("get-events", { task_id: taskId }) + "\n" +
-        "R = integer after `dashboard-version: ` in newest matching note. 2. If none, run, return stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
-        "R = BUILD_NUMBER from: cd " + REPO_PATH + " && git show <source_commit>:" + vfile + " | grep -o 'BUILD_NUMBER = [0-9]*'. If unknown: {\"ok\":false,\"park\":\"qa-version-missing: no build version recorded — re-run Integrate or record dashboard-version.\"}. " +
-        "3. cd " + REPO_PATH + " && git fetch origin && V=$(grep -o 'BUILD_NUMBER = [0-9]*' " + vfile + " | grep -o '[0-9]*'|head -1); if [ $V -lt R ]; then git pull --ff-only; V=$(grep -o 'BUILD_NUMBER = [0-9]*' " + vfile + " | grep -o '[0-9]*'|head -1); fi; " +
-        "if [ $V -lt R ]: {\"ok\":false,\"park\":\"qa-bundle-stale: checkout \" + V + \" < required \" + R + \" — sync past the merge, re-run QA.\"}. 4. Else {\"ok\":true,\"R\":R}.",
-        { key: "qa-version-pre-" + taskId, label: "QA version-gate pre-check",
-          schema: { type: "object", required: ["ok"],
-            properties: { ok: { type: "boolean" }, R: { type: "integer" }, park: { type: "string" } } } }
-      );
-      if (!vgPre.ok) return await parkTask(vgPre.park);
-      qaRequiredVersion = vgPre.R;
+      // ensure-deployed: idempotent precondition. Fast path when bundle is
+      // current. Failed deploy = operational failure (retryable), never a park.
+      var ensureOut = "";
+      try {
+        var ensureResult = await runDeployFerry("--ensure");
+        ensureOut = (ensureResult.output || "").trim();
+      } catch (e) {
+        ensureOut = "";
+      }
+      var ensureParsed = parseDeployResult(ensureOut);
+      if (!ensureParsed.ok) {
+        log("QA ensure-deployed failed for task " + taskId + ": " + ensureParsed.reason + " — returning failed for dispatcher retry");
+        return { status: "failed", task_id: taskId, reason: "QA ensure-deployed failed: " + ensureParsed.reason };
+      }
+      qaBundleHash = ensureParsed.hash;
+      log("QA ensure-deployed ok for task " + taskId + ": bundle " + qaBundleHash);
     }
   }
 
@@ -1715,14 +1735,6 @@ while (i < STEPS.length) {
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
       "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
-      (projectConfig.versioned_build === true ?
-      "VERSION BUMP (issue #3): after MERGED+PUSHED, bump so QA can prove the bundle contains this fix — QA parks without it.\n" +
-      "1. cd " + REPO_PATH + " && git fetch origin; BR=<branch-from-integration-target>; F=" + (projectConfig.version_file || "client/src/buildNumber.ts") + "\n" +
-      "2. N=$(git show origin/$BR:$F | grep -o 'BUILD_NUMBER = [0-9]*' | grep -o '[0-9]*'); if missing/unparsable: VERDICT: FAIL.\n" +
-      "3. Edit $F: `export const BUILD_NUMBER = $N;` → `export const BUILD_NUMBER = $((N+1));` (keep header comment).\n" +
-      "4. git add $F && git commit -m \"build-number: $((N+1)) - QA version gate\" (SEPARATE commit, never amend).\n" +
-      "5. git push origin $BR; if rejected retry 3x (fetch, re-read N, re-bump, re-commit, push). NEVER force-push. Push MUST succeed or VERDICT: FAIL.\n" +
-      "6. Run, return stdout verbatim:\n" + crewCmd("log-event", { task_id: taskId, type: "note", identity: step.identity, message: "dashboard-version: <new> — QA must test a bundle built from source at or after the merge that recorded this (build <new> or later)." }) + "\n(substitute <new>).\n\n" : "") +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
 } else if (step.name === "Publish") {
@@ -2176,8 +2188,6 @@ while (i < STEPS.length) {
         "c3. Start with: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ aria — read the JSON, log the step. Then: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ shot — READ the screenshot, log the step. Act on what you see: click, scroll, type, then re-observe, logging each step. Prefer aria (cheap text) to find controls; screenshot when the view changes and for your final verdict frames (one desktop, one mobile). If a click exits non-zero, do NOT retry the same ref blindly: re-run aria first (refs go stale between invocations), then click the fresh ref exactly once. If it still fails, log the failure and move on — a flaky control is a finding, not a loop.\n" +
         "d. Reach: with the session protocol, any flow reachable by N in-page actions is drivable — open the dialog, then confirm it, then judge the result. Without a session (one-shot invocations), anything reachable by (navigate, one action) is testable and sequences needing prior in-page state are not — use a session for those. Report NOT POSSIBLE only when the tooling itself fails (session-start exits 3): a flow you could not reach is not NOT POSSIBLE — name the exact step that stopped you in verdict.json's missing evidence and continue with the mechanical checks.\n" +
         "e. Judge as a user against the task description: is the reported bug fixed AND is nothing else visibly broken? Look for broken layout, overflow, missing or wrong content, stale data, and console errors. Compare against the task's expected behavior, never against source code (you are code-blind). Every frame you captured is already archived under " + crewHome + "/task-evidence/" + taskId + "/postchange/ and indexed in ooda-log.jsonl. A frame you did not read is not evidence. Loading, error, or blank frames never pass. If you cannot complete the loop, say exactly which steps are missing — unknown is not PASS.\n" +
-        (projectConfig.versioned_build === true ?
-        "e2. VERSION (issue #3): footer shows `build <n>` — report `footer_build: <n>` on its own line, or `footer_build: unreadable`. Required — the gate cannot pass without it.\n" : "") +
         "f. Kill ONLY the server you started: pkill -f 'serve-artifact[.]js.*--tag " + taskId + "-qa' — never another task's server. (The [.] keeps pkill from matching its own command line.) Do not leave it running.\n" +
         "Then continue with the mechanical checks below. Your VERDICT covers both the visual and the mechanical checks.\n\n" +
         "MECHANICAL CHECKS:\n" +
@@ -2659,20 +2669,24 @@ while (i < STEPS.length) {
   // never a park. No automatic FAIL override: if the QA agent still
   // reports FAIL, it stands — finding attribution informs follow-up
   // filing only.
-  if (step.name === "QA") {
-    if (projectConfig.versioned_build === true && qaArtifact && qaRequiredVersion !== null) {
-      var vgM = /footer_build:\s*(\d+|unreadable)/i.exec(workerText || "");
-      var vgS = (vgM && /^\d+$/.test(vgM[1])) ? parseInt(vgM[1], 10) : null;
-      var vgD = decideVersionGate(vgS, qaRequiredVersion);
-      if (!vgD.proceed) {
-        return await parkTask(vgD.reason + ": " + vgD.remedy + " [built=" + vgS + " required=" + qaRequiredVersion + "]");
-      }
-      await agent(
-        "Run in shell and return the stdout verbatim:\n" + crewCmd("log-event", {
-          task_id: taskId, type: "note", identity: step.identity,
-          message: "version-check: built=" + vgS + " >= required=" + qaRequiredVersion + " → testing now" }),
-        { key: "record-version-check-" + taskId, label: "Recording version-gate pass" }
+  if (step.name === "QA" && qaBundleHash !== null) {
+    // Closeout: bundle Hazel tested must match ensure-deployed hash from QA
+    // start. Mismatch/unreadable = operational failure, never a park.
+    var closeHash = "";
+    try {
+      var closeResult = await agent(
+        "Run: node " + QA_DEPLOY + " --hash-only --qa-dir " + QA_ENV_DIR + " 2>&1\n" +
+        "Return JSON { \"output\": \"<stdout, trimmed>\" } and nothing else.",
+        { key: "qa-closeout-hash-" + taskId, label: "Reading QA bundle hash",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
       );
+      var chm = /BUNDLE_HASH ([0-9a-f]{40})/.exec(String(closeResult.output || ""));
+      closeHash = chm ? chm[1].slice(0, 7) : "";
+    } catch (e) {}
+    if (closeHash !== qaBundleHash) {
+      log("QA closeout hash mismatch for task " + taskId + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nqa_closeout: FAILED — bundle hash " + (closeHash ? "changed during QA" : "unreadable");
+      passed = false;
     }
     var contentFindings = extractContentFindings(workerText);
     if (!contentFindings.ok) {
@@ -2803,6 +2817,26 @@ while (i < STEPS.length) {
     }
     if (/^VERIFIED:/m.test(integrateVerifyOut)) {
       log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of the integration target");
+      // QA deploy: after verified merge, ensure QA env serves a bundle from
+      // merged source. Failed deploy = operational failure, never a park.
+      if (projectConfig.versioned_build === true && SURFACE_ARTIFACT) {
+        var deployOut = "";
+        try {
+          var deployResult = await runDeployFerry("");
+          deployOut = (deployResult.output || "").trim();
+        } catch (e) {
+          deployOut = "";
+        }
+        var deployParsed = parseDeployResult(deployOut);
+        if (deployParsed.ok) {
+          log("QA deploy ok for task " + taskId + ": bundle " + deployParsed.hash);
+          stepResult.summary = (stepResult.summary || "") + "\ndeploy: ok " + deployParsed.hash;
+        } else {
+          log("QA deploy failed for task " + taskId + ": " + deployParsed.reason + " — marking failed for retry");
+          stepResult.summary = (stepResult.summary || "") + "\ndeploy: FAILED — " + deployParsed.reason;
+          passed = false;
+        }
+      }
     } else {
       var integrateVerifyReason = integrateVerifyOut
         ? integrateVerifyOut.split("\n")[0].slice(0, 200)

package/workflows/chore.js

@@ -136,8 +136,14 @@ const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
 const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
 const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
+const QA_DEPLOY_SRC = crewHome + "/current/lib/qa-deploy.mjs";
+const QA_DEPLOY = RUN_LIB + "/qa-deploy.mjs";
+const SERVE_ARTIFACT_SRC = crewHome + "/current/lib/serve-artifact.js";
+const SERVE_ARTIFACT = RUN_LIB + "/serve-artifact.js";
+const QA_DB_SRC = crewHome + "/current/lib/qa-db.js";
+const QA_DB = RUN_LIB + "/qa-db.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB, QA_DEPLOY, SERVE_ARTIFACT, QA_DB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -275,7 +281,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && cp " + QA_DEPLOY_SRC + " " + QA_DEPLOY + " && cp " + SERVE_ARTIFACT_SRC + " " + SERVE_ARTIFACT + " && cp " + QA_DB_SRC + " " + QA_DB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }

package/workflows/crew-dispatch.js

@@ -477,10 +477,9 @@ for (var pi = 0; pi < projects.length; pi++) {
     // terminal | null=unclassified). Carried alongside deploy_type — it is a
     // separate axis, not a redeclaration of the deployment target.
     environment_type: proj.environment_type || null,
-    // QA staleness gate (emojimanegg1/muse-crew#3): versioned_build opts the
-    // project into the Integrate version bump + QA bundle-freshness gate;
-    // version_file is the repo-relative path of the TS file exporting
-    // BUILD_NUMBER (null when unversioned).
+    // QA deploy (replaces the issue #3 version gate): versioned_build opts the
+    // project into the post-Integrate QA deploy + pre-QA ensure-deployed;
+    // version_file is retained for compatibility but no longer consumed.
     versioned_build: !!proj.versioned_build,
     version_file: proj.version_file || null
   };
@@ -1055,7 +1054,11 @@ for (var p = 0; p < toProcess.length; p++) {
   };
 
   log("Recommended " + iworkflow + " for \"" + itask.title + "\" [" + taskProject + "] at step " + nextStepName);
-  results.push({ task_id: itask.id, workflow: iworkflow, step: nextStepName, action: "recommended", scriptPath: scriptPath, args: launchArgs });
+  // executor tag (Piece 1, 2026-09-26): the sandboxed dispatcher claims
+  // "sandbox"; the worker-layer dispatcher (lib/crew-dispatch-worker.js)
+  // claims "worker". Piece 2 routes launches on this tag. The shadow
+  // comparison ignores it.
+  results.push({ task_id: itask.id, workflow: iworkflow, step: nextStepName, action: "recommended", scriptPath: scriptPath, args: launchArgs, executor: "sandbox" });
 
 } // end for (per-task loop)
 } // end processing block

package/workflows/standard.js

@@ -80,8 +80,14 @@ const CLASSIFY_SURFACE_SRC = crewHome + "/current/lib/classify-surface.js";
 const CLASSIFY_SURFACE = RUN_LIB + "/classify-surface.js";
 const NOTE_VOCAB_SRC = crewHome + "/current/lib/publish-note-vocabulary.js";
 const NOTE_VOCAB = RUN_LIB + "/publish-note-vocabulary.js";
+const QA_DEPLOY_SRC = crewHome + "/current/lib/qa-deploy.mjs";
+const QA_DEPLOY = RUN_LIB + "/qa-deploy.mjs";
+const SERVE_ARTIFACT_SRC = crewHome + "/current/lib/serve-artifact.js";
+const SERVE_ARTIFACT = RUN_LIB + "/serve-artifact.js";
+const QA_DB_SRC = crewHome + "/current/lib/qa-db.js";
+const QA_DB = RUN_LIB + "/qa-db.js";
 // See docs/decisions/qa-reproduce.md#pin-basenames: the pin step materializes the required scripts.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED, COMPUTE_DIFF, CLASSIFY_SURFACE, NOTE_VOCAB, QA_DEPLOY, SERVE_ARTIFACT, QA_DB].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -273,7 +279,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + COMPUTE_DIFF_SRC + " " + COMPUTE_DIFF + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && cp " + NOTE_VOCAB_SRC + " " + NOTE_VOCAB + " && cp " + QA_DEPLOY_SRC + " " + QA_DEPLOY + " && cp " + SERVE_ARTIFACT_SRC + " " + SERVE_ARTIFACT + " && cp " + QA_DB_SRC + " " + QA_DB + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -571,17 +577,37 @@ function decideIntegrateRetry(o) {
   if (rec.malformed) return "park";
   return ancestor ? "skip-to-publish" : "proceed";
 }
-// QA version gate (issue #3): S=footer build, R=required. S>=R proves the
-// bundle is at/past the merge (single-branch: version order = containment).
-// Pure — pinned by tests/version-gate.test.js. Null = unreadable/missing.
-function decideVersionGate(S, R) {
-  if (!(R > 0)) return { proceed: false, reason: "qa-version-missing",
-    remedy: "no build version recorded — re-run Integrate or record dashboard-version." };
-  if (!(S > 0)) return { proceed: false, reason: "qa-version-unreadable",
-    remedy: "no readable build number in bundle footer — rebuild from versioned source." };
-  if (S >= R) return { proceed: true };
-  return { proceed: false, reason: "qa-bundle-stale",
-    remedy: "bundle build " + S + " behind required " + R + " — builder did not rebuild from current source." };
+// QA deploy result parser (replaces the version gate, issue #3): the ferry
+// returns qa-deploy.mjs's stdout verbatim; the marker line is the only
+// machine-read signal. Pure — fails closed on anything unrecognized.
+// Returns { ok, hash } or { ok:false, reason }.
+function parseDeployResult(output) {
+  var m = /^DEPLOY_OK ([0-9a-f]{7})$/m.exec(String(output || "").trim());
+  if (m) return { ok: true, hash: m[1] };
+  var f = /^DEPLOY_FAIL ([a-z-]+):(.{1,200})$/m.exec(String(output || "").trim());
+  if (f) return { ok: false, reason: f[1] + ": " + f[2].trim() };
+  return { ok: false, reason: "unrecognized deploy output" };
+}
+// QA environment dir — pipeline-owned, under the crew home. The web artifact
+// directory (~/workspace/ts-spaces/<slug>/) is never built by hand (its own
+// AGENTS.md forbids it); this separate dir is cloned, synced, built, and
+// validated by qa-deploy.mjs. Named by project id (deploy_slug is an
+// artifact-system concern; the QA env is ours).
+var QA_ENV_DIR = crewHome + "/qa-envs/" + LAUNCH_PROJECT_ID;
+// Run the deploy ferry: a thin mechanical agent that runs one exact pinned
+// command and returns stdout verbatim. No identity, no judgment — the
+// module self-records the full evidence via the Crew API; the ferry carries
+// only the marker line.
+function runDeployFerry(mode) {
+  var cmd = "node " + QA_DEPLOY + " --repo " + REPO_PATH + " --qa-dir " + QA_ENV_DIR +
+    " --task " + taskId + " --crew-home " + crewHome + " --crew-api " + CREW_API_PINNED +
+    " --serve-artifact " + SERVE_ARTIFACT + (mode === "--ensure" ? " --ensure" : "") + " 2>&1";
+  return agent(
+    "Run in shell and return the stdout verbatim:\n" + cmd + "\n" +
+    "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+    { key: "qa-deploy-" + mode.replace(/-/g, "") + "-" + taskId, label: "Deploying QA environment",
+      schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+  );
 }
 // On a dispatcher retry resumed at Integrate, the run-local releaseDecision
 // is null (Build doesn't re-run). Hydrate it from the merge record so the
@@ -1310,23 +1336,27 @@ while (i < STEPS.length) {
   // experiential-loop guard (a PASS with missing experiential evidence is
   // never terminal).
   var qaExperiential = false;
+  var qaBundleHash = null;
   if (step.name === "QA") {
     qaExperiential = (await resolveExperiential()) === "yes" && SURFACE_CLASSIFIED;
-    var qaRequiredVersion = null;
     if (qaExperiential && SURFACE_ARTIFACT && projectConfig.versioned_build === true) {
-      var vfileStd = projectConfig.version_file || "client/src/buildNumber.ts";
-      var vgPreStd = await agent(
-        "Return ONLY JSON. 1. Run, return stdout verbatim:\n" + crewCmd("get-events", { task_id: taskId }) + "\n" +
-        "R = integer after `dashboard-version: ` in newest matching note. 2. If none, run, return stdout verbatim:\n" + crewCmd("get-provenance", { project_id: LAUNCH_PROJECT_ID }) + "\n" +
-        "R = BUILD_NUMBER from: cd " + REPO_PATH + " && git show <source_commit>:" + vfileStd + " | grep -o 'BUILD_NUMBER = [0-9]*'. If unknown: {\"ok\":false,\"park\":\"qa-version-missing: no build version recorded — re-run Integrate or record dashboard-version.\"}. " +
-        "3. cd " + REPO_PATH + " && git fetch origin && V=$(grep -o 'BUILD_NUMBER = [0-9]*' " + vfileStd + " | grep -o '[0-9]*'|head -1); if [ $V -lt R ]; then git pull --ff-only; V=$(grep -o 'BUILD_NUMBER = [0-9]*' " + vfileStd + " | grep -o '[0-9]*'|head -1); fi; " +
-        "if [ $V -lt R ]: {\"ok\":false,\"park\":\"qa-bundle-stale: checkout \" + V + \" < required \" + R + \" — sync past the merge, re-run QA.\"}. 4. Else {\"ok\":true,\"R\":R}.",
-        { key: "qa-version-pre-" + taskId, label: "QA version-gate pre-check",
-          schema: { type: "object", required: ["ok"],
-            properties: { ok: { type: "boolean" }, R: { type: "integer" }, park: { type: "string" } } } }
-      );
-      if (!vgPreStd.ok) return await parkTask(vgPreStd.park);
-      qaRequiredVersion = vgPreStd.R;
+      // ensure-deployed: idempotent precondition. Fast path when the bundle
+      // is already current. Failed deploy = operational failure (retryable),
+      // never a park. The module self-records the bundle hash to the event log.
+      var ensureOut = "";
+      try {
+        var ensureResult = await runDeployFerry("--ensure");
+        ensureOut = (ensureResult.output || "").trim();
+      } catch (e) {
+        ensureOut = "";
+      }
+      var ensureParsed = parseDeployResult(ensureOut);
+      if (!ensureParsed.ok) {
+        log("QA ensure-deployed failed for task " + taskId + ": " + ensureParsed.reason + " — returning failed for dispatcher retry");
+        return { status: "failed", task_id: taskId, reason: "QA ensure-deployed failed: " + ensureParsed.reason };
+      }
+      qaBundleHash = ensureParsed.hash;
+      log("QA ensure-deployed ok for task " + taskId + ": bundle " + qaBundleHash);
     }
   }
 
@@ -1604,14 +1634,6 @@ while (i < STEPS.length) {
       "R5-PUSH (manual R5 resolution only — the normal path pushed inline). Run: " + LIFECYCLE_ENV + LIFECYCLE + " push-target " + taskId + "\n" +
       "PUSHED — report the merged hash (detached prints PUSHED: origin/main (refspec HEAD:main)), VERDICT: PASS; PUSH_SKIPPED — no push attempted (no record + no lock); NO_REMOTE_PUSH — no remote; VERDICT: PASS; ERROR or CONFLICT — report it, VERDICT: FAIL.\n" +
       "NEVER force-push.\n\n" +
-      (projectConfig.versioned_build === true ?
-      "VERSION BUMP (issue #3): after MERGED+PUSHED, bump so QA can prove the bundle contains this fix — QA parks without it.\n" +
-      "1. cd " + REPO_PATH + " && git fetch origin; BR=<branch-from-integration-target>; F=" + (projectConfig.version_file || "client/src/buildNumber.ts") + "\n" +
-      "2. N=$(git show origin/$BR:$F | grep -o 'BUILD_NUMBER = [0-9]*' | grep -o '[0-9]*'); if missing/unparsable: VERDICT: FAIL.\n" +
-      "3. Edit $F: `export const BUILD_NUMBER = $N;` → `export const BUILD_NUMBER = $((N+1));` (keep header comment).\n" +
-      "4. git add $F && git commit -m \"build-number: $((N+1)) - QA version gate\" (SEPARATE commit, never amend).\n" +
-      "5. git push origin $BR; if rejected retry 3x (fetch, re-read N, re-bump, re-commit, push). NEVER force-push. Push MUST succeed or VERDICT: FAIL.\n" +
-      "6. Run, return stdout verbatim:\n" + crewCmd("log-event", { task_id: taskId, type: "note", identity: step.identity, message: "dashboard-version: <new> — QA must test a bundle built from source at or after the merge that recorded this (build <new> or later)." }) + "\n(substitute <new>).\n\n" : "") +
       "Report what happened at each step, ending with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
 
 } else if (step.name === "Publish") {
@@ -2065,8 +2087,6 @@ while (i < STEPS.length) {
         "c3. Start with: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ aria — read the JSON, log the step. Then: SEE_ACT_ARCHIVE_DIR=" + crewHome + "/task-evidence/" + taskId + "/postchange/ node " + crewHome + "/current/lib/see-act.js --url http://localhost:<N>/ shot — READ the screenshot, log the step. Act on what you see: click, scroll, type, then re-observe, logging each step. Prefer aria (cheap text) to find controls; screenshot when the view changes and for your final verdict frames (one desktop, one mobile). If a click exits non-zero, do NOT retry the same ref blindly: re-run aria first (refs go stale between invocations), then click the fresh ref exactly once. If it still fails, log the failure and move on — a flaky control is a finding, not a loop.\n" +
         "d. Reach: with the session protocol, any flow reachable by N in-page actions is drivable — open the deck, then click Study, then judge the study view. Without a session (one-shot invocations), anything reachable by (navigate, one action) is testable and sequences needing prior in-page state are not — use a session for those. Report NOT POSSIBLE only when the tooling itself fails (session-start exits 3): a flow you could not reach is not NOT POSSIBLE — name the exact step that stopped you in verdict.json's missing evidence and judge what you did reach.\n" +
         "e. Judge as a user against the task description: does the change render correctly? Look for broken layout, overflow, missing or wrong content, stale data, and console errors. Compare against the task's expected behavior, never against source code (you are code-blind). Every frame you captured is already archived under " + crewHome + "/task-evidence/" + taskId + "/postchange/ and indexed in ooda-log.jsonl. A frame you did not read is not evidence. Loading, error, or blank frames never pass. If you cannot complete the loop, say exactly which steps are missing — unknown is not PASS.\n" +
-        (projectConfig.versioned_build === true ?
-        "e2. VERSION (issue #3): footer shows `build <n>` — report `footer_build: <n>` on its own line, or `footer_build: unreadable`. Required — the gate cannot pass without it.\n" : "") +
         "f. Kill ONLY the server you started: pkill -f 'serve-artifact[.]js.*--tag " + taskId + "-qa' — never another task's server. (The [.] keeps pkill from matching its own command line.) Do not leave it running.\n" +
         "Then continue with the mechanical checks below. Your VERDICT covers both the visual and the mechanical checks.\n\n" +
         "STEP 2: Verify data integrity via the crew API.\n" +
@@ -2411,20 +2431,24 @@ while (i < STEPS.length) {
   // never a park. No automatic FAIL override: if the QA agent still
   // reports FAIL, it stands — finding attribution informs follow-up
   // filing only.
-  if (step.name === "QA") {
-    if (projectConfig.versioned_build === true && SURFACE_ARTIFACT && qaRequiredVersion !== null) {
-      var vgM = /footer_build:\s*(\d+|unreadable)/i.exec(workerText || "");
-      var vgS = (vgM && /^\d+$/.test(vgM[1])) ? parseInt(vgM[1], 10) : null;
-      var vgD = decideVersionGate(vgS, qaRequiredVersion);
-      if (!vgD.proceed) {
-        return await parkTask(vgD.reason + ": " + vgD.remedy + " [built=" + vgS + " required=" + qaRequiredVersion + "]");
-      }
-      await agent(
-        "Run in shell and return the stdout verbatim:\n" + crewCmd("log-event", {
-          task_id: taskId, type: "note", identity: step.identity,
-          message: "version-check: built=" + vgS + " >= required=" + qaRequiredVersion + " → testing now" }),
-        { key: "record-version-check-" + taskId, label: "Recording version-gate pass" }
+  if (step.name === "QA" && qaBundleHash !== null) {
+    // Closeout: the bundle Hazel tested must match the ensure-deployed hash
+    // from QA start. Mismatch/unreadable = operational failure, never a park.
+    var closeHash = "";
+    try {
+      var closeResult = await agent(
+        "Run: node " + QA_DEPLOY + " --hash-only --qa-dir " + QA_ENV_DIR + " 2>&1\n" +
+        "Return JSON { \"output\": \"<stdout, trimmed>\" } and nothing else.",
+        { key: "qa-closeout-hash-" + taskId, label: "Reading QA bundle hash",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
       );
+      var hm = /BUNDLE_HASH ([0-9a-f]{40})/.exec(String(closeResult.output || ""));
+      closeHash = hm ? hm[1].slice(0, 7) : "";
+    } catch (e) {}
+    if (closeHash !== qaBundleHash) {
+      log("QA closeout hash mismatch for task " + taskId + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nqa_closeout: FAILED — bundle hash " + (closeHash ? "changed during QA" : "unreadable");
+      passed = false;
     }
     var contentFindings = extractContentFindings(workerText);
     if (!contentFindings.ok) {
@@ -2555,6 +2579,29 @@ while (i < STEPS.length) {
     }
     if (/^VERIFIED:/m.test(integrateVerifyOut)) {
       log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of the integration target");
+      // QA deploy (replaces the version gate): after a verified merge, ensure
+      // the QA environment serves a bundle built from merged source. Runs for
+      // versioned_build projects on a classified artifact surface; experiential
+      // tasks are the ones Hazel serves the bundle to. A failed deploy is an
+      // operational failure (retryable under the dispatcher's cap), never a park.
+      if (projectConfig.versioned_build === true && SURFACE_ARTIFACT) {
+        var deployOut = "";
+        try {
+          var deployResult = await runDeployFerry("");
+          deployOut = (deployResult.output || "").trim();
+        } catch (e) {
+          deployOut = "";
+        }
+        var deployParsed = parseDeployResult(deployOut);
+        if (deployParsed.ok) {
+          log("QA deploy ok for task " + taskId + ": bundle " + deployParsed.hash);
+          stepResult.summary = (stepResult.summary || "") + "\ndeploy: ok " + deployParsed.hash;
+        } else {
+          log("QA deploy failed for task " + taskId + ": " + deployParsed.reason + " — marking failed for retry");
+          stepResult.summary = (stepResult.summary || "") + "\ndeploy: FAILED — " + deployParsed.reason;
+          passed = false;
+        }
+      }
     } else {
       var integrateVerifyReason = integrateVerifyOut
         ? integrateVerifyOut.split("\n")[0].slice(0, 200)