muse-crew 0.16.0 → 0.17.0

package/lib/schema.sql

@@ -281,3 +281,22 @@ CREATE TABLE IF NOT EXISTS builder_reports (
 );
 CREATE INDEX IF NOT EXISTS builder_reports_task_id_idx ON builder_reports(task_id);
 CREATE INDEX IF NOT EXISTS builder_reports_version_idx ON builder_reports(version);
+
+-- Worker-layer run ledger (Piece 1, 2026-09-26): every worker-layer
+-- orchestration run (dispatcher, and later workflow phases) records its
+-- start/finish here. The sandboxed workflow runtime keeps writing
+-- workflow_runs; this table is the worker-layer counterpart. Timestamps
+-- are written by SQLite (strftime), never by worker JS — the determinism
+-- guard forbids wall-clock in orchestration code (G3).
+CREATE TABLE IF NOT EXISTS worker_runs (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_id    TEXT REFERENCES tasks(id) ON DELETE CASCADE,
+  phase      TEXT NOT NULL,
+  executor   TEXT NOT NULL DEFAULT 'worker' CHECK (executor = 'worker'),
+  status     TEXT NOT NULL CHECK (status IN ('running', 'completed', 'failed')),
+  error      TEXT,
+  started_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  ended_at   TEXT
+);
+CREATE INDEX IF NOT EXISTS worker_runs_task_id_idx ON worker_runs(task_id);
+CREATE INDEX IF NOT EXISTS worker_runs_phase_idx ON worker_runs(phase);

package/lib/spawn-boundary.js

@@ -0,0 +1,101 @@
+// lib/spawn-boundary.js — fail-closed spawn bounds validator (G1a).
+//
+// Piece 1 of the sandbox exit. Every creative-agent spawn on the worker
+// layer goes through this module BEFORE the orchestrator emits NEED_SPAWN.
+// It does not perform the spawn — the worker agent does that — it validates
+// the bounds and FAILS CLOSED (throws, no spawn) unless every rule holds.
+//
+// Rules (DESIGN-v2 G1a):
+// - prompt_file, schema_file, cwd, env, workdir, crewHome must ALL be declared.
+//   No spawn without declared bounds. Ever.
+// - prompt_file and schema_file must be co-located (same directory).
+// - cwd must resolve inside workdir (the task's own worktree or a designated
+//   scratch dir). `..` escapes fail closed.
+// - cwd must NOT contain denied fragments (defense in depth): crew-state
+//   databases, crew homes, observer state, dispatch logs.
+// - env must be an object; no key may match a denied sensitive pattern.
+//
+// This module is import-safe: no side effects on import, bare `node` exits 0.
+
+import { resolve, dirname, relative } from "node:path";
+
+const DENIED_PATH_FRAGMENTS = [
+  "crew-state.db",
+  ".crew-soak-gate2",
+  ".observer",
+  ".tick-releases.jsonl",
+  ".dispatch-decisions.jsonl",
+];
+
+const DENIED_ENV_PATTERNS = [
+  "KEY",
+  "TOKEN",
+  "SECRET",
+  "PASSWORD",
+  "PRIVATE",
+  "CREDENTIAL",
+  "AUTH",
+];
+
+function fail(violation) {
+  const err = new Error("spawn-boundary: BOUNDS_REJECTED: " + violation);
+  err.code = "BOUNDS_REJECTED";
+  throw err;
+}
+
+// Validate spawn bounds. Returns { cwd, env } (resolved/normalized) on
+// success. Throws with code BOUNDS_REJECTED on any violation.
+export function validateSpawnBounds(bounds) {
+  if (!bounds || typeof bounds !== "object") fail("bounds must be an object");
+
+  const { prompt_file, schema_file, cwd, env, workdir, crewHome } = bounds;
+
+  if (typeof prompt_file !== "string" || prompt_file.length === 0)
+    fail("prompt_file must be a declared non-empty string");
+  if (typeof schema_file !== "string" || schema_file.length === 0)
+    fail("schema_file must be a declared non-empty string");
+  if (typeof cwd !== "string" || cwd.length === 0)
+    fail("cwd must be a declared non-empty string");
+  if (!env || typeof env !== "object" || Array.isArray(env))
+    fail("env must be a declared object");
+  if (typeof workdir !== "string" || workdir.length === 0)
+    fail("workdir must be a declared non-empty string");
+  if (typeof crewHome !== "string" || crewHome.length === 0)
+    fail("crewHome must be a declared non-empty string");
+
+  // Schema co-location: prompt and schema travel together.
+  if (dirname(resolve(prompt_file)) !== dirname(resolve(schema_file)))
+    fail("prompt_file and schema_file must be co-located (same directory)");
+
+  // cwd must resolve inside workdir — no `..` escapes.
+  const resolvedCwd = resolve(cwd);
+  const resolvedWorkdir = resolve(workdir);
+  const rel = relative(resolvedWorkdir, resolvedCwd);
+  if (rel === ".." || rel.startsWith("../") || resolve(resolvedWorkdir, rel) !== resolvedCwd)
+    fail("cwd must resolve inside workdir (got " + cwd + ")");
+
+  // Defense in depth: denied fragments anywhere in the resolved cwd.
+  for (const frag of DENIED_PATH_FRAGMENTS) {
+    if (resolvedCwd.includes(frag)) fail("cwd inside denied path: " + frag);
+  }
+  // The crew home itself is never a spawn cwd, even without a fragment hit.
+  const crewRel = relative(resolve(crewHome), resolvedCwd);
+  if (crewRel === "" || (!crewRel.startsWith("../") && crewRel !== ".."))
+    fail("cwd must not be inside crewHome");
+
+  // Sensitive environment denied by default.
+  for (const key of Object.keys(env)) {
+    const upper = String(key).toUpperCase();
+    for (const pat of DENIED_ENV_PATTERNS) {
+      if (upper.includes(pat)) fail("env key denied: " + key);
+    }
+  }
+
+  return { cwd: resolvedCwd, env: { ...env } };
+}
+
+// Declared constants for tests and for orchestrators that build bounds.
+export const BOUNDARY = {
+  DENIED_PATH_FRAGMENTS: [...DENIED_PATH_FRAGMENTS],
+  DENIED_ENV_PATTERNS: [...DENIED_ENV_PATTERNS],
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -43,6 +43,10 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
 
 2. **Load the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and keep its RAW TEXT — do NOT parse it, do NOT re-emit it as a JSON object. Pass the text verbatim: never reformat, summarize, or hand-transcribe it (room #26: 15+ launch rejections 09-19→09-21 from garbled nested-object args, and one hallucinated registry that passed validation). If the file does not exist (the live release predates the registry), proceed without it — omit the `registryText` arg and the dispatcher will load the registry the slow way and log a warning. If the read FAILS on a file that exists (transient read error — observed 2026-09-13; the file itself was healthy and later ticks read it fine), retry the read once; if it still fails, write the error text into your run summary (observability — never silently swallow a failed read) and proceed without the registry the same way.
 
+2.5. **Shadow dispatch (Piece 1, 2026-09-26):** the worker-layer dispatcher (`lib/crew-dispatch-worker.js`) is the sandbox exit's replacement for the sandboxed dispatcher in Step 3. It is NOT authoritative yet — Step 3's sandboxed dispatcher still owns every launch decision. Run the worker dispatcher in read-only shadow mode BEFORE Step 3 (both must read the same board state; the shadow never mutates it). Run in shell:
+  `node {crewHome}/lib/crew-dispatch-worker.js --crew-home {crewHome} --read-only`
+  The last stdout line is a JSON result (`{status, claims, ...}`); lines before it are the decision log. The script appends its own shadow evidence to `{crewHome}/.dispatch-shadow.jsonl` — do NOT transcribe or re-emit the claims yourself. If the script exits non-zero, log `SHADOW_FAIL <stderr tail>` and continue to Step 3 (the shadow is evidence, never a gate). A zero exit with claims is normal — the claims are recommendations only; NOTHING is launched from them. Every claim carries `executor: "worker"`; the shadow comparison ignores it.
+
 3. **Run the dispatcher:** Call workflow_launch with scriptPath "{crewHome}/workflows/crew-dispatch.js" and args {"crewHome": "{crewHome}", "registryText": <raw registry file text, or omit the key when the file was missing>}. The dispatcher parses the text itself — a nested-object `registry` arg is not accepted. If the launch is rejected, retry once with only {"crewHome": "{crewHome}"} (the sanctioned fallback — the dispatcher loads the registry the slow way); a second rejection is a platform problem, not an args problem — write it in your run summary and move on.
 
    Wait for it to complete. It reads the crew's task state, determines eligibility, claims tasks, acknowledges the poll, and returns structured results.
@@ -106,6 +110,10 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
    - `timeouts` = fully handled by code — take NO action, just log. The 2-hour total budget from first issuance is exhausted with no acknowledgement; code writes the terminal `publish: version-timeout` note — parked for human attention. `timeouts` is terminal-budget exhaustion only — a window expiry is a `reissued`, never a timeout.
    - `reissued` = fresh intents for the next attempt — a 30-minute window expired with no acknowledgement, so code re-issued with a fresh version (by derivation), immediately claimable (no backoff). This tick does NOT issue them; the NEXT tick's `scan-publish-intent` claims them. Log only.
    - `skipped` = window still open or evidence absent — log only, take no action.
+
+4.6. **Shadow verdict (Piece 1, 2026-09-26):** after the Step-3 dispatcher's decision is recorded, pair its decision with the Step-2.5 shadow evidence. Run in shell:
+  `node {crewHome}/lib/compare-dispatch-shadow.js --crew-home {crewHome}`
+  Log every `SHADOW_*` line verbatim. `SHADOW_MATCH` means the worker layer agreed with the sandbox on this tick's claims. `SHADOW_DIVERGE` names the differing claim triples (`task_id|workflow|step`) — log them; divergence is evidence for the cutover review, not a tick failure, so continue the tick. `SHADOW_UNPAIRED` means the authoritative decision line is missing (the Step-3 dispatcher died after the shadow ran) — log it loudly and continue. `SHADOW_NO_EVIDENCE` on the first shadowed tick is normal. Verdicts append to `{crewHome}/.dispatch-shadow-verdicts.jsonl`; the cutover decision after ~100-200 ticks is made from that file, never from a single tick.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The exact version string is the sole positive signal.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.

package/workflows/crew-dispatch.js

@@ -1054,7 +1054,11 @@ for (var p = 0; p < toProcess.length; p++) {
   };
 
   log("Recommended " + iworkflow + " for \"" + itask.title + "\" [" + taskProject + "] at step " + nextStepName);
-  results.push({ task_id: itask.id, workflow: iworkflow, step: nextStepName, action: "recommended", scriptPath: scriptPath, args: launchArgs });
+  // executor tag (Piece 1, 2026-09-26): the sandboxed dispatcher claims
+  // "sandbox"; the worker-layer dispatcher (lib/crew-dispatch-worker.js)
+  // claims "worker". Piece 2 routes launches on this tag. The shadow
+  // comparison ignores it.
+  results.push({ task_id: itask.id, workflow: iworkflow, step: nextStepName, action: "recommended", scriptPath: scriptPath, args: launchArgs, executor: "sandbox" });
 
 } // end for (per-task loop)
 } // end processing block