muse-crew 0.17.1 → 0.17.3

package/lib/chore/phases/publish.js

@@ -0,0 +1,543 @@
+// lib/chore/phases/publish.js — Publish (Wren) phase module (sandbox
+// exit, Piece 2). Import-safe: no side effects on import, bare `node`
+// exits 0.
+//
+// P4 RESOLVED (2026-09-26, Eric's call): the artifact ledger `commit`
+// field used to be null for the early (pre-diff) ledger entries — the
+// source declared `var mergeCommitForPublish` AFTER those entries
+// (hoisting), so the early references were `undefined` and
+// recordPublishLedger wrote `commit: null`. That defect was preserved
+// through the mechanical port; it is now fixed in the pilot: the merged
+// commit is resolved up front from the durable merge record
+// ($CREW_HOME/.merge-records/<task>, newest merge_commit= wins), so the
+// early preflight ledger entries carry the real commit. The later
+// diff-derived `mergeCommitForPublish` declaration is unchanged and still
+// feeds everything downstream of the diff computation.
+//
+// npm path: the workflow computes the target version deterministically
+// (registry base + bump); the work agent runs exactly one command (the
+// pinned publish script); the workflow verifies the registry version
+// and refreshes provenance mechanically.
+// artifact path: fully mechanical before the work agent — re-entry guard,
+// lock-status/refresh, artifact preflight, provenance base, checksummed
+// diff, intent ledger anchor — then parks at publish intent for the tick
+// worker. The work agent only reports on the mechanical outcome.
+
+import {
+  runWorkBoundary, recordPhase, buildEventPreamble, summarizeReport,
+  closeoutPassed, ensureClaimed, latestSessionNotes, verifyPin,
+  pinLifecycle, parkTask, lifecycle, crewApi, recordPublishLedger,
+  runCmd, log,
+} from "../phase-lib.js";
+import {
+  extractPublishSkipped, extractReleaseDecision, bumpVersion,
+} from "../extract.js";
+import { attemptKey } from "../spawn-keys.js";
+import { homedir } from "os";
+import { statSync } from "fs";
+import { join } from "path";
+
+export const PHASE = { name: "Publish", identity: "wren" };
+const EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
+// buildNpmInstructions — verbatim from workflows/chore.js (Publish/npm).
+export function buildNpmInstructions(ctx, publishTarget) {
+  var env = ctx.env;
+  var taskId = env.taskId;
+  return "Publish the npm package by running exactly ONE command — the deterministic publish script.\n" +
+    "The release decision is already made and recorded: release: yes, version_bump: " + publishTarget.scope +
+    ", target version " + publishTarget.target + " (computed as " + publishTarget.base + " + " + publishTarget.scope +
+    " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make; the script itself skips gracefully when no merge lock is held.\n\n" +
+    "Run exactly this command and no other publish-related commands:\n" +
+    "TASK_ID=" + taskId + " REPO_PATH=" + env.repoPath + " PKG=muse-crew TARGET_VERSION=" + publishTarget.target +
+    " CREW_HOME=" + env.crewHome + " LIFECYCLE=" + env.lifecycle + " RELEASE_SCRIPT=" + env.releaseScript +
+    " bash " + env.publishNpm + "\n\n" +
+    "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
+    "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
+    "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of the integration target), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+    "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+    "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
+    "VERDICT: PASS\n\n" +
+    "If the script's output contains PUBLISH_SKIPPED=no-npm-publish, the publish was skipped gracefully: npm publish is not configured on this machine (helper or credential absent) — the merge stands, the version was not cut, nothing was shipped. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+    "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+    "skipped: no-npm-publish (npm publish not configured — helper or credential missing; nothing versioned or published)\n" +
+    "VERDICT: PASS\n\n" +
+    "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+    "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+    "published: muse-crew@" + publishTarget.target + "\n" +
+    "VERDICT: PASS\n\n";
+}
+
+// Artifact-path instruction framings (verbatim from the source).
+export function buildArtifactInstructions(env, framing) {
+  var taskId = env.taskId;
+  if (framing === "verified") {
+    return "Publish was already completed and verified for this task — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
+      "Provenance stamps this task's merge commit as published (docs/publish-verification.md): the tick worker issued the edit, the ack scan observed the artifact's exact version acknowledgement — the sole positive completion criterion — and the publish was stamped. Already verified, nothing to issue and nothing to re-verify.\n\n" +
+      "For the change summary, run: cd " + env.repoPath + " && git log -1 --stat\n\n" +
+      "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
+      "The VERDICT line must be the last line of your report.";
+  }
+  if (framing === "skipped") {
+    return "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
+      "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of the integration target), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
+      "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
+      "The VERDICT line must be the last line of your report.";
+  }
+  return "Publish the merged code to the live artifact.\n\n" +
+    "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
+    "For the change summary, run: cd " + env.repoPath + " && git log -1 --stat\n\n" +
+    "Mechanical outcome (the workflow's mechanical steps; the ack scan's version-acknowledgement check is still pending):\n" +
+    "- merge lock refreshed: yes\n" +
+    "- artifact rebuild triggered and completed: yes\n" +
+    "- provenance stamped: NO — not yet, and you must NOT stamp it. The ack scan stamps it when it observes the artifact's exact on-disk acknowledgement of this attempt's version — version acknowledgement is the sole positive completion criterion (docs/publish-verification.md). A stamped-but-hollow build is exactly how canary run 8 (2026-09-11) went green on stale content.\n" +
+    "- post-deploy finalized: yes (worktree removed, merge lock released)\n\n" +
+    "POLICY: The live artifact is rebuilt only in this phase, from the repo. Never use artifact_edit to change the artifact directly — fixes go through the repo and the loop. A source fix is not done until the artifact is rebuilt from it here.\n\n" +
+    "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
+    "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
+    "The VERDICT line must be the last line of your report.";
+}
+
+// runArtifactPath — the deterministic artifact publish (source: the
+// PUBLISH_TYPE === "artifact" instructions branch). Runs after the claim,
+// before the work agent. Returns a PARK result, or {mechanical, framing}
+// for the work-agent report step.
+async function runArtifactPath(env, state) {
+  var taskId = env.taskId;
+
+  // Blocker 22 (one-party publish, room #24): verified re-entry guard.
+  var publishAlreadyVerified = false;
+  try {
+    var reentryProv = await crewApi(env, "get-provenance", { project_id: env.projectId });
+    var reentryP = (reentryProv && reentryProv.provenance) || null;
+    var reentrySC = String((reentryP && reentryP.source_commit) || "").trim();
+    var reentryTID = String((reentryP && reentryP.task_id) || "").trim();
+    var headOut = await runCmd(["git", "rev-parse", "HEAD"], { cwd: env.repoPath });
+    var reentryHEAD = String(headOut.stdout || "").trim();
+    if (reentrySC && reentryHEAD && reentrySC === reentryHEAD && reentryTID === taskId) {
+      publishAlreadyVerified = true;
+      log("Publish verified re-entry for task " + taskId + ": provenance stamps " + reentrySC + " == HEAD for this task — the parent already published and verified it; issuance skipped");
+    }
+  } catch (reentryErr) {
+    log("Publish re-entry guard threw for task " + taskId + " (" + (reentryErr && reentryErr.message ? reentryErr.message : reentryErr) + ") — proceeding with the normal publish path; a guard failure never claims verification");
+  }
+
+  var publishLockRefreshed = false;
+  var publishSkippedNoLock = false;
+  try {
+    // STEP 0 (mechanical): read the merge-lock state explicitly — never
+    // infer it from prose. An empty-diff Integrate (MERGED_EMPTY)
+    // intentionally takes no lock: nothing merged, nothing to ship.
+    var lockOut = await lifecycle(env, "lock-status", [taskId]);
+    if (String(lockOut.stdout || "").trim() === "UNLOCKED") {
+      publishSkippedNoLock = true;
+      log("Publish skipped for task " + taskId + ": no merge lock held (empty-diff Integrate) — nothing to ship");
+    } else {
+      var refreshOut = "";
+      var refreshed = false;
+      try {
+        var rr = await lifecycle(env, "refresh-lock", [taskId]);
+        refreshed = true;
+        refreshOut = String(rr.stdout || "").trim();
+      } catch (e) {
+        refreshed = false;
+        refreshOut = String((e && e.message) || e);
+      }
+      if (!refreshed) {
+        return await parkTask(env, "Publish lock refresh failed: " + (refreshOut || "no output") + ". Fail-closed — lock state unknown.");
+      }
+      publishLockRefreshed = true;
+    }
+
+    if (!publishSkippedNoLock && !publishAlreadyVerified) {
+      // The trigger key of the attempt that last ran, for the publish
+      // ledger. Minted once here (not re-minted per use site).
+      var rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId, state.reworkCount);
+
+      // The merged commit is knowable before the diff is computed: the
+      // Integrate phase recorded it durably in the merge record
+      // ($CREW_HOME/.merge-records/<task>). The early preflight ledger
+      // writes below used to carry commit: null (the P4 hoisted-var
+      // defect, preserved from the source through the mechanical port);
+      // resolving the commit here gives them the real value. Newest
+      // merge_commit= block wins, per the record's own convention. A
+      // missing/unreadable record falls back to "" — recordPublishLedger
+      // writes commit: null for it, exactly today's behavior.
+      var mergedCommitForPublish = "";
+      try {
+        var mrOut = await lifecycle(env, "merge-record", [taskId]);
+        var mrText = String((mrOut && mrOut.stdout) || "");
+        var mrMatch;
+        var mrRe = /^merge_commit=([0-9a-f]{40})$/gm;
+        while ((mrMatch = mrRe.exec(mrText)) !== null) mergedCommitForPublish = mrMatch[1];
+      } catch (e) {
+        log("Publish could not read the merge record for task " + taskId + " — early ledger entries will carry commit: null");
+      }
+
+      // STEP 0.5 (mechanical, room #16 blocker 10): assert the artifact
+      // target exists before any publish.
+      var artifactTargetDir = join(homedir(), "workspace", "ts-spaces", env.publishSlug) + "/";
+      var preflightSignal = "";
+      var preflightInconclusive = false;
+      if (!env.publishSlug) {
+        await recordPublishLedger(env, {
+          commit: mergedCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: null,
+          outcome: "rejected",
+          detail: "artifact surface with empty deploy_slug (preflight): the project is classified as artifact but has no deploy_slug — misconfiguration, not a missing artifact. No edit was issued."
+        });
+        return await parkTask(env, "Publish cannot proceed for task " + taskId + ": the project is classified as an artifact surface but has no deploy_slug. This is a project configuration defect — set a deploy_slug for the project, then re-run Publish. Human attention needed.");
+      }
+      if (!/^[a-zA-Z0-9_-]+$/.test(env.publishSlug)) {
+        preflightInconclusive = true;
+        log("Publish artifact preflight for task " + taskId + ": PUBLISH_SLUG has an unsafe shape — inconclusive, fail-closed");
+      } else {
+        try {
+          var st = statSync(join(homedir(), "workspace", "ts-spaces", env.publishSlug));
+          preflightSignal = st.isDirectory() ? "ARTIFACT_TARGET: present" : "ARTIFACT_TARGET: missing";
+        } catch (e) {
+          if (e && e.code === "ENOENT") {
+            preflightSignal = "ARTIFACT_TARGET: missing";
+          } else {
+            preflightInconclusive = true;
+            log("Publish artifact preflight for task " + taskId + " threw (" + (e && e.message ? e.message : e) + ") — inconclusive, fail-closed");
+          }
+        }
+      }
+      if (!preflightInconclusive && /ARTIFACT_TARGET:\s*missing/.test(preflightSignal)) {
+        await recordPublishLedger(env, {
+          commit: mergedCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: null,
+          outcome: "rejected",
+          detail: "artifact target directory missing (preflight): " + artifactTargetDir + " does not exist — setup never provisioned the artifact for deploy_slug " + env.publishSlug + ". The edit provably did not go through: no trigger issued, no blind retry"
+        });
+        return await parkTask(env, "Publish cannot proceed for task " + taskId + ": the artifact target directory " + artifactTargetDir + " does not exist. The project is classified as an artifact surface (deploy_slug " + env.publishSlug + ") but setup never provisioned the artifact — this is conclusive (rejected, not unknown): no edit was issued. Create the artifact via the Muse UI (Publish edits an existing artifact; it never creates one), then re-run init and Publish. Human attention needed.");
+      }
+      if (preflightInconclusive || !/ARTIFACT_TARGET:\s*present/.test(preflightSignal)) {
+        await recordPublishLedger(env, {
+          commit: mergedCommitForPublish,
+          attempt: rebuildAttemptKey,
+          agent_id: null,
+          applied_report: null,
+          outcome: "unknown",
+          detail: "artifact preflight inconclusive (no parsable ARTIFACT_TARGET signal): target existence unproven, so the trigger was NOT issued; unknown parks fail closed with no blind retry"
+        });
+        return await parkTask(env, "Publish cannot proceed for task " + taskId + ": the artifact target preflight was inconclusive (no parsable signal). Target existence is unproven, so no edit was issued and nothing was retried blindly. Human attention needed.");
+      }
+      log("Publish artifact preflight for task " + taskId + ": target " + artifactTargetDir + " present");
+
+      // Provenance base + checksummed diff (docs/decisions/publish-path.md).
+      var provResult = await crewApi(env, "get-provenance", { project_id: env.projectId });
+      var provP = (provResult && provResult.provenance) || null;
+      var publishBase = String((provP && provP.source_commit) || "").trim();
+      if (!publishBase) {
+        publishBase = EMPTY_TREE_SHA;
+        log("Publish base for task " + taskId + ": no provenance stamped yet — using empty tree (first publish)");
+      } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
+        return await parkTask(env, "Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
+      }
+      var publishDiffFile = join(env.crewHome, ".publish-diffs", taskId + (state.reworkCount > 0 ? "-r" + state.reworkCount : "") + ".diff");
+      var diffOut;
+      try {
+        diffOut = await runCmd(["node", env.computeDiff, "--repo-path", env.repoPath, "--base", publishBase, "--task-id", taskId, "--attempt", "1", "--out", publishDiffFile]);
+      } catch (e) {
+        throw new Error("publish diff computation failed: " + ((e && e.message) || e));
+      }
+      var diffSummary = null;
+      try {
+        diffSummary = JSON.parse(String(diffOut.stdout || "").trim());
+      } catch (e) {
+        return await parkTask(env, "Publish diff computation returned unparseable output — cannot verify application. Human attention needed.");
+      }
+      if (!diffSummary || diffSummary.ok !== true) {
+        if (diffSummary && diffSummary.error === "not-ancestor") {
+          return await parkTask(env, "Publish base " + publishBase.slice(0, 12) + " is not an ancestor of HEAD " + String(diffSummary.commit || "").slice(0, 12) + " — the stamped provenance does not lead to the integrated commit. Human attention needed.");
+        }
+        return await parkTask(env, "Publish diff computation failed (" + ((diffSummary && diffSummary.error) || "unknown error") + ") — cannot verify application. Human attention needed.");
+      }
+      if (diffSummary.base !== publishBase) {
+        return await parkTask(env, "Publish diff base mismatch: script reported '" + String(diffSummary.base || "").slice(0, 12) + "' but the stamped base is '" + publishBase.slice(0, 12) + "'. Human attention needed.");
+      }
+      // The diff-derived commit, used for everything downstream of the
+      // diff computation. (The early preflight ledger writes above now
+      // carry the merge-record commit resolved at the top of this block.)
+      var mergeCommitForPublish = String(diffSummary.commit || "").trim();
+      var mergeCommitShortForPublish = String(mergeCommitForPublish).substring(0, 7) || "unknown";
+      void mergeCommitShortForPublish;
+      var publishDiffSha256 = String(diffSummary.sha256 || "");
+      var publishVersion = String(diffSummary.version || "");
+      // Mirrors isPublishVersion() in lib/crew-api.js: <40-hex commit>:<attempt>.
+      if (!/^[0-9a-f]{40}:[1-9][0-9]*$/.test(publishVersion)) {
+        return await parkTask(env, "Publish diff for commit " + (mergeCommitForPublish || "unknown") + " carries no usable publish version — cannot stage a verifiable intent. Human attention needed.");
+      }
+      if (!diffSummary.bytes) {
+        return await parkTask(env, "Publish diff is empty for commit " + (mergeCommitForPublish || "unknown") + " — a merge lock was held but there is no change to carry. Human attention needed.");
+      }
+      if (diffSummary.has_binary) {
+        return await parkTask(env, "Publish diff contains binary files — the diff transport cannot carry them. Human attention needed.");
+      }
+      if (diffSummary.has_rename) {
+        return await parkTask(env, "Publish diff contains a rename — the diff transport cannot carry renames. Human attention needed.");
+      }
+      var mergeDiffChangedLines = diffSummary.changed_lines || 0;
+      if (mergeDiffChangedLines > 200) {
+        return await parkTask(env, "Publish diff changes " + mergeDiffChangedLines + " lines (budget 200) — too large for the diff transport. Human attention needed.");
+      }
+      if (!diffSummary.file_count) {
+        return await parkTask(env, "Publish diff parsed to zero files for commit " + (mergeCommitForPublish || "unknown") + " — cannot verify application. Human attention needed.");
+      }
+      // The intent ledger entry is the anchor the whole machine depends
+      // on. Fail loudly instead of parking an orphan intent.
+      var intentAnchored = await recordPublishLedger(env, {
+        commit: mergeCommitForPublish,
+        attempt: rebuildAttemptKey,
+        publish_attempt: 1,
+        version: publishVersion,
+        agent_id: null,
+        applied_report: null,
+        outcome: "publish-intent",
+        issuer: "workflow",
+        diff_path: publishDiffFile,
+        diff_sha256: publishDiffSha256,
+        base: publishBase,
+        detail: "publish intent: preflight and checksummed diff are complete; issuance is owned by the session-carrying tick worker. The workflow performed no artifact_edit and wrote no issuance."
+      });
+      if (!intentAnchored) {
+        throw new Error("publish-intent ledger anchor write unconfirmed for task " + taskId + " — refusing to park an unclaimable intent; the Publish phase fails loudly instead");
+      }
+      return await parkTask(env, "publish: publish-requested " + mergeCommitForPublish + " attempt=1 — Publish intent recorded for task " + taskId + ": the merged change is staged as a checksummed diff (" + publishDiffFile + ", sha256 " + publishDiffSha256 + ") carrying the per-attempt publish version for the crew's publish worker to issue. The worker issues the edit directly and the acknowledgement scan owns the task from there; no action needed.");
+    } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
+
+    // STEP 2 (mechanical, always — skip path included): post-deploy.
+    var pdOut = await lifecycle(env, "post-deploy", [taskId]);
+    var postDeploy = { deployed: /DEPLOYED/.test(String(pdOut.stdout || "")), output: String(pdOut.stdout || "").trim() };
+    if (publishAlreadyVerified) {
+      log("Publish verified re-entry for task " + taskId + " — post-deploy ran forgivingly; continuing to the verified work-agent framing");
+    } else if (publishSkippedNoLock) {
+      if (!postDeploy.deployed) {
+        return await parkTask(env, "Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
+      }
+      log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
+    }
+  } catch (pubErr) {
+    // Best-effort cleanup: if the lock was refreshed, try to release it
+    // before parking so the failure cannot wedge the next run.
+    if (publishLockRefreshed) {
+      try {
+        await lifecycle(env, "post-deploy", [taskId]);
+      } catch (cleanupErr) {
+        log("Publish cleanup post-deploy also failed: " + (cleanupErr && cleanupErr.message ? cleanupErr.message : cleanupErr));
+      }
+    }
+    return await parkTask(env, "Deterministic artifact publish failed: " + (pubErr && pubErr.message ? pubErr.message : pubErr) + ". Fail-closed.");
+  }
+
+  return {
+    mechanical: true,
+    framing: publishAlreadyVerified ? "verified" : (publishSkippedNoLock ? "skipped" : "normal"),
+  };
+}
+
+export async function runPhase(ctx) {
+  var env = ctx.env, state = ctx.state;
+  var taskId = env.taskId;
+
+  // ── Pre-claim ──
+  var pinCheck = verifyPin(env);
+  var missingAtPublish = pinCheck.missing;
+  if (missingAtPublish.length > 0) {
+    log("Pin guard at Publish: missing " + missingAtPublish.join(", ") + " — re-pinning once");
+    pinLifecycle(env);
+    missingAtPublish = verifyPin(env).missing;
+  }
+  if (missingAtPublish.length > 0) {
+    return await parkTask(env, "Pinned lifecycle scripts missing at Publish even after re-pin: " + missingAtPublish.join(", ") + " in " + env.runLib + ".");
+  }
+  log("Pin guard: all four lifecycle scripts present at Publish");
+
+  // Publish is optional and target-based. Empty target = prototyping
+  // project: skip the phase. Unknown target (incl. legacy "repo") =
+  // config error: block.
+  if (!env.publishType) {
+    log("Publish skipped for task " + taskId + " — no publish target configured (deploy_type empty)");
+    await lifecycle(env, "post-deploy", [taskId]);
+    return { type: "ADVANCE", next: null };
+  }
+  if (env.publishType !== "npm" && env.publishType !== "artifact" && env.publishType !== "vercel") {
+    log("Unknown publish target for task " + taskId + ": " + env.publishType);
+    return await parkTask(env, "Unknown publish target '" + env.publishType + "' — expected 'npm', 'artifact', 'vercel', or empty (skip publish).");
+  }
+
+  // Merge-time versioning, decided deterministically: the release decision
+  // was extracted from the accepted Build report (re-derived here from
+  // the durable Build session notes). release: no never reaches the
+  // Publish agent (skipped here, exactly like the no-target case); an
+  // unparseable decision blocks fail-closed.
+  var publishTarget = null;
+  if (env.publishType === "npm") {
+    var buildNotes = await latestSessionNotes(env, "Build", "completed");
+    var releaseDecision = extractReleaseDecision(buildNotes);
+    if (!releaseDecision) {
+      return await parkTask(env, "Build report has no machine-readable release:/version_bump: declaration — cannot assign version at publish time.");
+    }
+    if (releaseDecision.release === "no") {
+      log("Publish skipped for task " + taskId + " — accepted Build report declared release: no");
+      await lifecycle(env, "post-deploy", [taskId]);
+      return { type: "ADVANCE", next: null };
+    }
+    // Deterministic pre-publish: the workflow reads the registry base and
+    // computes the target version. The Publish agent never does version
+    // math.
+    try {
+      var baseResult;
+      try {
+        baseResult = String((await runCmd(["npm", "view", "muse-crew", "version"])).stdout || "").trim();
+      } catch (e) {
+        baseResult = "NOT_FOUND";
+      }
+      if (baseResult === "NOT_FOUND") {
+        try {
+          baseResult = String((await runCmd(["node", "-p", "require('" + env.repoPath + "/package.json').version"])).stdout || "").trim();
+        } catch (e2) {
+          baseResult = "";
+        }
+      }
+      var pubScope = releaseDecision.version_bump || "patch";
+      var pubBase = (baseResult || "").trim();
+      if (!/^\d+\.\d+\.\d+$/.test(pubBase)) {
+        return await parkTask(env, "Publish base version unreadable: '" + pubBase + "'. Fail-closed.");
+      }
+      publishTarget = { base: pubBase, scope: pubScope, target: bumpVersion(pubBase, pubScope) };
+      log("Publish target for task " + taskId + ": " + pubBase + " + " + pubScope + " -> " + publishTarget.target);
+    } catch (e) {
+      return await parkTask(env, "Deterministic pre-publish failed: " + (e && e.message ? e.message : e) + ". Fail-closed.");
+    }
+  }
+
+  var claimed = await ensureClaimed(env, state, PHASE);
+  if (claimed.type !== "CLAIMED") return claimed;
+
+  // ── Instructions branch ──
+  var instructions;
+  var artifactFraming = null;
+  if (env.publishType === "npm") {
+    instructions = buildNpmInstructions(ctx, publishTarget);
+  } else if (env.publishType === "artifact") {
+    // See docs/decisions/publish-path.md#deterministic-artifact-publish:
+    // the work agent never publishes; the parent runs the deterministic
+    // publish script. The mechanical steps below run here, in the
+    // instructions branch — before the work agent.
+    var mech = await runArtifactPath(env, state);
+    if (mech.type) return mech; // PARK / PARK_FAILED
+    artifactFraming = mech.framing;
+    instructions = buildArtifactInstructions(env, artifactFraming);
+  } else {
+    // vercel publish is not yet implemented — block without inventing behavior
+    instructions = "The project's publish target is \"vercel\", which is not yet implemented.\n" +
+      "Do NOT invent publish behavior — do not guess CLI commands, APIs, or deployment steps.\n" +
+      "Report the situation in prose, then end your report with exactly this line: VERDICT: FAIL.";
+  }
+
+  var boundary = await runWorkBoundary(env, state, {
+    phase: PHASE.name, identity: PHASE.identity,
+    instructions: instructions,
+    eventPreamble: buildEventPreamble(env, PHASE.name),
+    crewApiLine: true, verdictStep: true,
+  });
+  if (boundary.type !== "BOUNDARY_DONE") return boundary;
+
+  var passed = closeoutPassed(boundary);
+  var workerText = boundary.workerText;
+
+  // See docs/decisions/publish-path.md#publish-verify: the agent cannot
+  // verify publish; the parent does.
+  var publishVerified = false;
+  var npmPublishSkipped = false;
+  var summary;
+  if (env.publishType === "npm" && publishTarget) {
+    var publishSkipped = extractPublishSkipped(workerText);
+    if (publishSkipped.ok) {
+      npmPublishSkipped = true;
+      if (publishSkipped.reason === "no-npm-publish") {
+        log("Publish skipped for task " + taskId + " (no-npm-publish — npm publish not configured): publish verification vacuous, nothing was shipped");
+      } else {
+        log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      }
+    }
+    if (!npmPublishSkipped) {
+      try {
+        var regOut = await runCmd(["npm", "view", "muse-crew", "version"]);
+        var regVer = String(regOut.stdout || "").trim();
+        if (regVer !== publishTarget.target) {
+          return await parkTask(env, "Publish verification failed: registry shows " + regVer + " but the release decision required " +
+            publishTarget.target + " (" + publishTarget.base + " + " + publishTarget.scope + "). The publish did not land.");
+        }
+        publishVerified = true;
+        // See docs/decisions/publish-path.md#provenance-refresh: refresh
+        // crew_release after landed publish, preserving source_commit.
+        try {
+          var provGet = await crewApi(env, "get-provenance", { project_id: env.projectId });
+          var provP = (provGet && provGet.provenance) || null;
+          if (provP) {
+            var relOut = await runCmd(["basename", (await runCmd(["readlink", join(env.crewHome, "current")])).stdout.trim()]);
+            var tsOut = await runCmd(["date", "-u", "+%Y-%m-%dT%H:%M:%SZ"]);
+            var rel = String(relOut.stdout || "").trim();
+            var ts = String(tsOut.stdout || "").trim();
+            var setRes = await crewApi(env, "set-provenance", {
+              project_id: env.projectId,
+              source_commit: provP.source_commit,
+              crew_release: rel,
+              published_at: ts,
+              task_id: taskId,
+            });
+            if (!(setRes && setRes.ok === true)) {
+              return await parkTask(env, "Provenance refresh failed after a verified npm publish (crew_release " + (rel || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
+            }
+          }
+          // No provenance record (null) → refreshed:false, reason
+          // "no-record" → not a park, exactly like the source.
+        } catch (e) {
+          return await parkTask(env, "Provenance refresh failed: could not refresh dashboard provenance after a verified npm publish (" + (e && e.message ? e.message : e) + "). Fail-closed.");
+        }
+      } catch (e) {
+        return await parkTask(env, "Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
+      }
+    }
+  }
+
+  // Version acknowledgement: the exact per-attempt version on the
+  // artifact's disk is the sole positive completion criterion. A skipped
+  // or failed publish has nothing to ack.
+  if (env.publishType === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {
+    // The skip path records the computed target and the explicit skip —
+    // never "published:", which would be a false claim (nothing was
+    // shipped).
+    var markerLines = "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+      (npmPublishSkipped
+        ? "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)"
+        : "published: muse-crew@" + publishTarget.target);
+    summary = summarizeReport(workerText, { markerLines: markerLines });
+  } else {
+    summary = summarizeReport(workerText);
+  }
+
+  // "rejected" is an explicit phase verdict routed through rework (Review).
+  // Publish work that did not finish is operational — "failed", retryable
+  // under the dispatcher's consecutive-failure cap.
+  var status = passed ? "completed" : "failed";
+  await recordPhase(env, {
+    task_id: taskId,
+    session: { id: state.activeSessionId, task_id: taskId, identity: PHASE.identity, step: PHASE.name, status: status, notes: summary },
+    event: { task_id: taskId, type: status, identity: PHASE.identity, message: PHASE.name + " " + status + " by " + PHASE.identity },
+  });
+  if (!passed) {
+    log("Publish failed for task " + taskId + ": " + summary);
+    return { type: "FAILED", reason: "Publish failed: " + summary, detail: "The publish step failed. The dispatcher will retry under its consecutive-failure cap." };
+  }
+  log("Publish completed for task " + taskId);
+  return { type: "ADVANCE", next: null, publishSuccess: true };
+}