muse-crew 0.17.1 → 0.17.2

package/lib/compare-dispatch-shadow.js

@@ -21,11 +21,20 @@
 // evidence, not a false alarm.
 //
 // Usage: node compare-dispatch-shadow.js --crew-home <path>
-// Prints one of SHADOW_MATCH / SHADOW_DIVERGE / SHADOW_UNPAIRED /
-// SHADOW_NO_EVIDENCE and appends the verdict to
-// $CREW_HOME/.dispatch-shadow-verdicts.jsonl. Exit 0 on a verdict (even a
-// diverge — divergence is evidence, not a failure); exit 2 on usage or IO
-// errors.
+// Prints per-shadow SHADOW_MATCH / SHADOW_DIVERGE / SHADOW_UNPAIRED /
+// SHADOW_PENDING lines plus a SHADOW_SUMMARY; SHADOW_NO_EVIDENCE when no
+// shadow lines exist yet, SHADOW_CURRENT when every shadow already has a
+// verdict. Appends verdicts to $CREW_HOME/.dispatch-shadow-verdicts.jsonl.
+// Exit 0 on a verdict (even a diverge — divergence is evidence, not a
+// failure); exit 2 on usage or IO errors.
+//
+// Retryability: a shadow with no matching decision is left PENDING (no
+// verdict written) unless the authoritative dispatcher has provably moved
+// past its tick — i.e. a decision exists with tick_seq greater than the
+// wanted one. Each tick's dispatcher appends exactly one tick-release line
+// and then writes its decision synchronously, so a later decision proves
+// the missing one will never be written. Pending shadows are retried on
+// every later run; only provably-dead ticks become terminal UNPAIRED.
 
 import { readFileSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
@@ -104,15 +113,31 @@ if (pending.length === 0) {
   process.exit(0);
 }
 
-let matched = 0, diverged = 0, unpaired = 0;
+let matched = 0, diverged = 0, unpaired = 0, pendingCount = 0;
+// The authoritative dispatcher appends one tick-release line and then writes
+// its decision synchronously in the same step, so decision tick_seqs advance
+// monotonically and each tick gets exactly one decision write. A decision
+// with tick_seq past a shadow's wanted tick therefore proves the missing
+// decision will never be written: the owning tick already spent its single
+// write. (The release-line append and the decision write are adjacent in one
+// process; a >15min stall between them — the only out-of-order path — would
+// cost one sample, not correctness.)
+const maxDecisionTickSeq = decisions.reduce((m, d) => Math.max(m, d.tick_seq || 0), 0);
 for (const shadow of pending) {
   const wantTickSeq = (shadow.tick_seq_before || 0) + 1;
   const decision = decisions.find((d) => d.tick_seq === wantTickSeq);
 
   if (!decision) {
-    emit({ verdict: "unpaired", shadow_seq: shadow.seq, want_tick_seq: wantTickSeq });
-    console.log(`SHADOW_UNPAIRED shadow_seq=${shadow.seq} want_tick_seq=${wantTickSeq} (authoritative decision not yet written)`);
-    unpaired++;
+    if (maxDecisionTickSeq > wantTickSeq) {
+      emit({ verdict: "unpaired", shadow_seq: shadow.seq, want_tick_seq: wantTickSeq });
+      console.log(`SHADOW_UNPAIRED shadow_seq=${shadow.seq} want_tick_seq=${wantTickSeq} (authoritative dispatcher advanced to tick_seq=${maxDecisionTickSeq} without writing this decision)`);
+      unpaired++;
+    } else {
+      // The authoritative decision simply hasn't been written yet — no
+      // verdict, the shadow stays pending and a later run retries.
+      console.log(`SHADOW_PENDING shadow_seq=${shadow.seq} want_tick_seq=${wantTickSeq} (authoritative decision not yet written; retrying next run)`);
+      pendingCount++;
+    }
     continue;
   }
 
@@ -146,5 +171,5 @@ for (const shadow of pending) {
     diverged++;
   }
 }
-console.log(`SHADOW_SUMMARY matched=${matched} diverged=${diverged} unpaired=${unpaired}`);
+console.log(`SHADOW_SUMMARY matched=${matched} diverged=${diverged} unpaired=${unpaired} pending=${pendingCount}`);
 process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -113,7 +113,7 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
 
 4.6. **Shadow verdict (Piece 1, 2026-09-26):** after the Step-3 dispatcher's decision is recorded, pair its decision with the Step-2.5 shadow evidence. Run in shell:
   `node {crewHome}/lib/compare-dispatch-shadow.js --crew-home {crewHome}`
-  Log every `SHADOW_*` line verbatim. `SHADOW_MATCH` means the worker layer agreed with the sandbox on this tick's claims. `SHADOW_DIVERGE` names the differing claim triples (`task_id|workflow|step`) — log them; divergence is evidence for the cutover review, not a tick failure, so continue the tick. `SHADOW_UNPAIRED` means the authoritative decision line is missing (the Step-3 dispatcher died after the shadow ran) — log it loudly and continue. `SHADOW_NO_EVIDENCE` on the first shadowed tick is normal. Verdicts append to `{crewHome}/.dispatch-shadow-verdicts.jsonl`; the cutover decision after ~100-200 ticks is made from that file, never from a single tick.
+  Log every `SHADOW_*` line verbatim. `SHADOW_MATCH` means the worker layer agreed with the sandbox on this tick's claims. `SHADOW_DIVERGE` names the differing claim triples (`task_id|workflow|step`) — log them; divergence is evidence for the cutover review, not a tick failure, so continue the tick. `SHADOW_UNPAIRED` means the authoritative decision line is missing (the Step-3 dispatcher died after the shadow ran) — log it loudly and continue. `SHADOW_PENDING` means the decision hasn't been written yet; the shadow stays pending and a later tick retries the pairing — log and continue. `SHADOW_NO_EVIDENCE` on the first shadowed tick is normal. Verdicts append to `{crewHome}/.dispatch-shadow-verdicts.jsonl`; the cutover decision after ~100-200 ticks is made from that file, never from a single tick.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The exact version string is the sole positive signal.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.