muse-crew 0.17.2 → 0.17.3

package/lib/workflow-spec.js

@@ -0,0 +1,187 @@
+// lib/workflow-spec.js — workflow spec loader/validator (composition
+// machinery, Phase B, 2026-09-26). Import-safe ESM: no side effects on
+// import, bare `node` exits 0.
+//
+// A workflow spec is JSON declaring COMPOSITION: the ordered phases, the
+// named non-sequential transitions (rework loops), and guard references.
+// Phases stay code — the spec names the module, never the implementation.
+// The future composition UI edits specs; the generic driver
+// (lib/workflow-driver.js) runs them.
+//
+// Spec shape:
+//   {
+//     "workflow": "chore",
+//     "phases": [
+//       { "name": "Triage",
+//         "module": "../lib/chore/phases/triage.js",
+//         "contract": "Reads: ... Writes: ..." }
+//     ],
+//     "transitions": [
+//       { "from": "Review", "on": "rework", "to": "Build" }
+//     ],
+//     "guards": [],
+//     "rejectedResume": "Build"
+//   }
+//
+// Module refs resolve against the spec file's own directory (so the spec
+// is self-contained and relocatable). Validation fails closed: any
+// malformed spec throws with a clear reason — the driver never runs a
+// half-understood workflow. No wall-clock reads, no randomness.
+
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+function fail(msg) { throw new Error("workflow spec: " + msg); }
+
+function isObj(v) { return v !== null && typeof v === "object" && !Array.isArray(v); }
+
+// Closed schema: unknown keys are almost certainly typos (a misspelled
+// "rejectedResume" must not silently load). Fail closed on them.
+function rejectUnknown(obj, known, where) {
+  for (var k in obj) {
+    if (Object.prototype.hasOwnProperty.call(obj, k) && known.indexOf(k) === -1) {
+      fail(where + ": unknown key \"" + k + "\" — must be one of: " + known.join(", ") + ".");
+    }
+  }
+}
+
+// validateSpec — pure: takes a parsed value, returns the normalized spec
+// or throws. Normalized: { workflow, phases, phaseNames, phaseIndex,
+// transitions, guards, rejectedResume, projectDescFallback, promptsDir }.
+// projectDescFallback/promptsDir are optional workflow-declared runtime
+// values: the generic driver threads them into the run environment so a
+// workflow keeps its own project description fallback and prompt-template
+// directory without workflow-shaped conditionals in the driver.
+export function validateSpec(spec) {
+  if (!isObj(spec)) fail("top level must be an object.");
+  rejectUnknown(spec, ["workflow", "phases", "transitions", "guards", "rejectedResume", "projectDescFallback", "promptsDir", "reworkPhases"], "spec");
+  if (typeof spec.workflow !== "string" || spec.workflow.trim() === "")
+    fail("\"workflow\" must be a non-empty string.");
+  if (!Array.isArray(spec.phases) || spec.phases.length === 0)
+    fail("\"phases\" must be a non-empty array.");
+  var phases = [];
+  var seen = {};
+  for (var i = 0; i < spec.phases.length; i++) {
+    var p = spec.phases[i];
+    if (!isObj(p)) fail("phases[" + i + "] must be an object.");
+    rejectUnknown(p, ["name", "module", "contract"], "phases[" + i + "]");
+    if (typeof p.name !== "string" || p.name.trim() === "")
+      fail("phases[" + i + "].name must be a non-empty string.");
+    if (seen[p.name]) fail("duplicate phase name \"" + p.name + "\".");
+    seen[p.name] = true;
+    if (typeof p.module !== "string" || p.module.trim() === "")
+      fail("phases[" + i + "].module must be a non-empty string.");
+    phases.push({
+      name: p.name,
+      module: p.module,
+      contract: typeof p.contract === "string" ? p.contract : "",
+    });
+  }
+  var transitions = [];
+  if (spec.transitions !== undefined) {
+    if (!Array.isArray(spec.transitions)) fail("\"transitions\" must be an array.");
+    for (var t = 0; t < spec.transitions.length; t++) {
+      var tr = spec.transitions[t];
+      if (!isObj(tr)) fail("transitions[" + t + "] must be an object.");
+      rejectUnknown(tr, ["from", "to", "on"], "transitions[" + t + "]");
+      if (typeof tr.from !== "string" || !seen[tr.from])
+        fail("transitions[" + t + "].from must name a declared phase.");
+      if (typeof tr.to !== "string" || !seen[tr.to])
+        fail("transitions[" + t + "].to must name a declared phase.");
+      if (tr.on !== undefined && (typeof tr.on !== "string" || tr.on.trim() === ""))
+        fail("transitions[" + t + "].on must be a non-empty string when present.");
+      transitions.push({ from: tr.from, to: tr.to, on: tr.on || null });
+    }
+  }
+  var guards = [];
+  if (spec.guards !== undefined) {
+    if (!Array.isArray(spec.guards)) fail("\"guards\" must be an array.");
+    for (var g = 0; g < spec.guards.length; g++) {
+      if (typeof spec.guards[g] !== "string" || spec.guards[g].trim() === "")
+        fail("guards[" + g + "] must be a non-empty string.");
+      guards.push(spec.guards[g]);
+    }
+  }
+  var phaseNames = phases.map(function (p) { return p.name; });
+  var phaseIndex = {};
+  for (var n = 0; n < phaseNames.length; n++) phaseIndex[phaseNames[n]] = n;
+  // rejectedResume — optional: the phase a rejected latest session resumes
+  // at (rework entry point; workflow knowledge, so spec-declared).
+  var rejectedResume = null;
+  if (spec.rejectedResume !== undefined) {
+    if (typeof spec.rejectedResume !== "string" || !seen[spec.rejectedResume])
+      fail("\"rejectedResume\" must name a declared phase.");
+    rejectedResume = spec.rejectedResume;
+  }
+  // projectDescFallback — optional: the project-description fallback the
+  // driver threads into deriveRunEnv (chore's dashboard description; other
+  // workflows leave it empty).
+  var projectDescFallback = "";
+  if (spec.projectDescFallback !== undefined) {
+    if (typeof spec.projectDescFallback !== "string")
+      fail("\"projectDescFallback\" must be a string when present.");
+    projectDescFallback = spec.projectDescFallback;
+  }
+  // promptsDir — optional: the prompt-template directory the driver threads
+  // into deriveRunEnv, resolved relative to the spec file's directory by the
+  // driver (phaseModuleUrl's rule). Unset keeps the run-lib default.
+  var promptsDir = null;
+  if (spec.promptsDir !== undefined) {
+    if (typeof spec.promptsDir !== "string" || spec.promptsDir.trim() === "")
+      fail("\"promptsDir\" must be a non-empty string when present.");
+    promptsDir = spec.promptsDir;
+  }
+  // reworkPhases — optional: the phases whose rejections consume the shared
+  // rework budget. When declared, deriveReworkCount counts rejected sessions
+  // for exactly these phases; when absent, it counts every rejected event
+  // (the pre-spec behavior Standard and Chore rely on). Bugfix declares
+  // ["Review", "QA"] — its Build and Reproduce failures record "rejected"
+  // but must not spend the shared Review/QA budget.
+  var reworkPhases = null;
+  if (spec.reworkPhases !== undefined) {
+    if (!Array.isArray(spec.reworkPhases) || spec.reworkPhases.length === 0)
+      fail("\"reworkPhases\" must be a non-empty array when present.");
+    for (var r = 0; r < spec.reworkPhases.length; r++) {
+      if (typeof spec.reworkPhases[r] !== "string" || !seen[spec.reworkPhases[r]])
+        fail("\"reworkPhases[" + r + "]\" must name a declared phase.");
+    }
+    reworkPhases = spec.reworkPhases.slice();
+  }
+  return {
+    workflow: spec.workflow,
+    phases: phases,
+    phaseNames: phaseNames,
+    phaseIndex: phaseIndex,
+    transitions: transitions,
+    guards: guards,
+    rejectedResume: rejectedResume,
+    projectDescFallback: projectDescFallback,
+    promptsDir: promptsDir,
+    reworkPhases: reworkPhases,
+  };
+}
+
+// loadSpec — read + JSON.parse + validate. IO and syntax errors fail
+// closed with the spec path named.
+export function loadSpec(specPath) {
+  var text;
+  try {
+    text = readFileSync(specPath, "utf8");
+  } catch (e) {
+    fail("cannot read " + specPath + ": " + (e && e.message ? e.message : String(e)));
+  }
+  var raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (e) {
+    fail(specPath + " is not valid JSON: " + (e && e.message ? e.message : String(e)));
+  }
+  return validateSpec(raw);
+}
+
+// phaseModuleUrl — resolve a phase's module ref against the spec file's
+// directory, as a file: URL string for dynamic import(). Pure path logic.
+export function phaseModuleUrl(specPath, moduleRef) {
+  return pathToFileURL(resolve(dirname(resolve(specPath)), moduleRef)).href;
+}

package/lib/worktree-lifecycle.sh

@@ -422,6 +422,26 @@ acquire_merge_lock() {
   done
 }
 
+# ff_integrated(branch, target): print the branch's current tip when it is
+# EXACTLY the integration target's tip — the branch was pushed by
+# fast-forward (or a prior recovery pushed it), so no merge commit exists
+# but the line carries precisely the branch's present state. Prints
+# nothing and returns 1 otherwise. Exact tip equality is the only shape
+# recognized: a branch reset backward after integration can remain an
+# ancestor of the target, so ancestry alone would defeat blocker-35's
+# fail-closed protection (fixture F3: backward rework after a recorded
+# merge). Anything less certain than tip == target tip stays fail-closed.
+ff_integrated() {
+  local branch="$1" target="$2" tip target_tip
+  tip=$(git rev-parse --verify "$branch" 2>/dev/null) || return 1
+  target_tip=$(git rev-parse --verify "$target" 2>/dev/null) || return 1
+  if [ "$tip" = "$target_tip" ]; then
+    printf '%s' "$tip"
+    return 0
+  fi
+  return 1
+}
+
 # current_branch_merge(branch): print the newest merge commit on live HEAD's
 # first-parent chain whose branch-side parent (^2) is the branch's CURRENT
 # tip — i.e. the merge that brought the branch's present state onto the
@@ -597,7 +617,28 @@ cmd_integrate() {
       echo "LOCK: held by $task_id — release after deploy with post-deploy"
       return 0
     fi
+    # Fast-forward recovery (2026-09-27): no merge commit exists, but the
+    # branch tip IS the target tip (pushed by fast-forward in a prior
+    # attempt) — ff_integrated recognizes only exact tip equality, so
+    # blocker-35's fail-closed protection is preserved (a branch moved
+    # backward after integration is still an ancestor of the target, and
+    # ancestry alone is not accepted). No merge record is appended:
+    # scan_merge_records skips non-merge commits, and the ff state is
+    # self-describing (tip == target tip).
     if [ -n "$recorded_commit" ]; then
+      local ff_tip
+      ff_tip=$(ff_integrated "$branch" "$target" 2>/dev/null) || ff_tip=""
+      if [ -n "$ff_tip" ]; then
+        acquire_merge_lock "$task_id" || exit 2
+        if do_push "$task_id"; then
+          echo "MERGED: $ff_tip (recovered: branch tip fast-forwarded onto $target in a prior attempt; push completed now)"
+        else
+          echo "ERROR: push recovery failed for fast-forwarded branch tip $ff_tip"
+          return 1
+        fi
+        echo "LOCK: held by $task_id — release after deploy with post-deploy"
+        return 0
+      fi
       echo "STALE_MERGE: recorded merge $recorded_commit no longer corresponds to $branch (tip $(git rev-parse --verify "$branch" 2>/dev/null)) — no merge of the current tip is on the live line; refusing to push possibly-stale state"
       return 1
     fi
@@ -1221,12 +1262,19 @@ cmd_push_target() {
   # branch's current tip was merged onto the live line before pushing.
   # Branch gone (merge-lease reclaim): no rework could have moved it, so
   # the recorded merge on the line is still the deliverable.
-  local branch live_merge recorded_commit
+  local branch live_merge recorded_commit ff_tip
   recorded_commit=$(grep "^merge_commit=" "$record_file" | tail -1 | cut -d= -f2-)
   live_merge=""
+  ff_tip=""
   if branch=$(resolve_branch "$task_id" 2>/dev/null); then
     if git rev-parse --verify "$branch" >/dev/null 2>&1; then
       live_merge=$(current_branch_merge "$branch") || live_merge=""
+      if [ -z "$live_merge" ]; then
+        # Fast-forward case (2026-09-27): no merge commit exists, but the
+        # branch tip is exactly the target tip — ff_integrated accepts only
+        # tip equality, so blocker-35's fail-closed protection is preserved.
+        ff_tip=$(ff_integrated "$branch" "HEAD" 2>/dev/null) || ff_tip=""
+      fi
     elif [ -n "$recorded_commit" ] && git merge-base --is-ancestor "$recorded_commit" "$(git rev-parse HEAD 2>/dev/null)" 2>/dev/null; then
       live_merge="$recorded_commit"
     fi
@@ -1234,11 +1282,15 @@ cmd_push_target() {
     echo "ERROR: cannot resolve task branch for $task_id — not pushing without a verifiable branch"
     return 1
   fi
-  if [ -z "$live_merge" ]; then
+  if [ -z "$live_merge" ] && [ -z "$ff_tip" ]; then
     echo "STALE_MERGE: no merge of the current ${branch:-unknown} tip is on the live line (recorded: ${recorded_commit:-none}) — the task branch changed since the recorded merge; refusing to push possibly-stale state"
     return 1
   fi
-  echo "PUSH_IDENTITY_OK: pushing merge $live_merge carrying the current $branch tip"
+  if [ -n "$ff_tip" ]; then
+    echo "PUSH_IDENTITY_OK: branch $branch tip $ff_tip is on the live line via fast-forward — pushing"
+  else
+    echo "PUSH_IDENTITY_OK: pushing merge $live_merge carrying the current $branch tip"
+  fi
 
   do_push "$task_id"
   return $?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -39,19 +39,38 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
    - Route each completed-run failure through the same two commands — `record-platform-failure`, then `retry-platform-failure` — exactly as above.
    - Log the results. This ensures transient platform failures don't strand tasks.
 
+0b. **Reap worker-layer spawn rows (cutover piece):** the worker-layer
+   Chore driver leaves `worker_runs` rows `running` when its tick dies
+   mid-spawn. Reap them before dispatch so a dead tick never strands a
+   spawn past its timeout. Run in shell:
+   `node {crewHome}/lib/reap-spawns.js --crew-home {crewHome}`
+   The last stdout line is one JSON object
+   `{closed:[...], kill_instructions:[...], errors:[]}`; log it verbatim.
+   - `closed` entries were finished by the reaper itself — no action.
+   - For each entry in `kill_instructions`: attempt the runtime close of
+     the named child (subagent handle or OS pid, as the instruction
+     specifies), then record the attempt in shell:
+     `node {crewHome}/lib/reap-spawns.js --crew-home {crewHome} --record-close --id <row_id> --result <killed|not_found|refused> [--detail <text>]`
+     Log the `{recorded:...}` result verbatim. A `refused` close leaves
+     the row for the kill-and-retry path — never force it.
+   - `errors` = log only; a reaper error never aborts the tick.
+   (Inert until worker spawn rows exist — pre-cutover this always returns
+   empty lists.)
+
 1. **Load tools:** Call tool_search_load_tool_namespace with paths ["workflow_launch"].
 
-2. **Load the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and keep its RAW TEXT — do NOT parse it, do NOT re-emit it as a JSON object. Pass the text verbatim: never reformat, summarize, or hand-transcribe it (room #26: 15+ launch rejections 09-19→09-21 from garbled nested-object args, and one hallucinated registry that passed validation). If the file does not exist (the live release predates the registry), proceed without it — omit the `registryText` arg and the dispatcher will load the registry the slow way and log a warning. If the read FAILS on a file that exists (transient read error — observed 2026-09-13; the file itself was healthy and later ticks read it fine), retry the read once; if it still fails, write the error text into your run summary (observability — never silently swallow a failed read) and proceed without the registry the same way.
+2. **Check the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and confirm it is valid JSON — do NOT hand-transcribe it anywhere (room #26: 15+ launch rejections 09-19→09-21 from garbled nested-object args, and one hallucinated registry that passed validation). The Step-3 dispatcher reads this file itself; you only verify it exists and parses. If the read FAILS on a file that exists (transient read error — observed 2026-09-13; the file itself was healthy and later ticks read it fine), retry the read once; if it still fails, write the error text into your run summary (observability — never silently swallow a failed read) and continue — the dispatcher will log its own registry warning.
 
-2.5. **Shadow dispatch (Piece 1, 2026-09-26):** the worker-layer dispatcher (`lib/crew-dispatch-worker.js`) is the sandbox exit's replacement for the sandboxed dispatcher in Step 3. It is NOT authoritative yet — Step 3's sandboxed dispatcher still owns every launch decision. Run the worker dispatcher in read-only shadow mode BEFORE Step 3 (both must read the same board state; the shadow never mutates it). Run in shell:
-  `node {crewHome}/lib/crew-dispatch-worker.js --crew-home {crewHome} --read-only`
-  The last stdout line is a JSON result (`{status, claims, ...}`); lines before it are the decision log. The script appends its own shadow evidence to `{crewHome}/.dispatch-shadow.jsonl` — do NOT transcribe or re-emit the claims yourself. If the script exits non-zero, log `SHADOW_FAIL <stderr tail>` and continue to Step 3 (the shadow is evidence, never a gate). A zero exit with claims is normal — the claims are recommendations only; NOTHING is launched from them. Every claim carries `executor: "worker"`; the shadow comparison ignores it.
+3. **Run the dispatcher (worker-layer, authoritative — cutover 2026-09-26):** the dispatcher is `lib/crew-dispatch-worker.js`, run in shell — NOT the sandboxed `workflows/crew-dispatch.js` (retired; two dispatchers would double-dispatch). Run:
+  `node {crewHome}/lib/crew-dispatch-worker.js --crew-home {crewHome} --authoritative`
+  The last stdout line is one JSON object (`{status, claims, ...}`); lines before it are the decision log. Read the `claims` array from the parsed JSON — do NOT transcribe claims by hand. (The dispatcher reads `{crewHome}/workflows/registry.json` itself; never pass the registry on the command line.)
 
-3. **Run the dispatcher:** Call workflow_launch with scriptPath "{crewHome}/workflows/crew-dispatch.js" and args {"crewHome": "{crewHome}", "registryText": <raw registry file text, or omit the key when the file was missing>}. The dispatcher parses the text itself — a nested-object `registry` arg is not accepted. If the launch is rejected, retry once with only {"crewHome": "{crewHome}"} (the sanctioned fallback — the dispatcher loads the registry the slow way); a second rejection is a platform problem, not an args problem — write it in your run summary and move on.
+   It reads the crew's task state, determines eligibility, reserves tasks through the atomic `reserve-dispatch` (a live reservation wins; the loser stands down), acknowledges the poll, and writes the tick-release and dispatch-decision logs. Every claim carries `executor: "worker"` and the launch contract (`task_id`, `workflow`, `step`, `scriptPath`, `args`).
 
-   Wait for it to complete. It reads the crew's task state, determines eligibility, claims tasks, acknowledges the poll, and returns structured results.
+   If the script exits non-zero, log the exit code and the stderr tail, then CONTINUE to Step 4.4 with zero claims — a failed dispatch means no launches this tick, but the intent scan, ack scan, and evidence steps still run. Do NOT fall back to the sandboxed dispatcher.
 
 4. **Launch claims autonomously:** Extract the `claims` array from the dispatcher result. For each claim (up to 3 per tick — if more than 3, launch the first 3 and log the rest as deferred):
+   - **Routing (cutover piece):** if `claim.workflow === "chore"` AND `claim.executor === "worker"`, do NOT launch it here — follow Step 4w (worker-layer Chore) instead. Every other claim follows this step unchanged. (Every claim now carries `executor: "worker"` — the worker-layer dispatcher is the sole launch authority since the 2026-09-26 cutover.)
    - Call workflow_launch_async with scriptPath={claim.scriptPath} and args={claim.args}. Record the returned run_id.
    - Immediately acknowledge the dispatch reservation with the real run_id (the dispatcher already created a placeholder reservation — this updates it). Run in shell:
      `node {crewHome}/lib/crew-api.js --crew-home {crewHome} acknowledge-dispatch-run --json '{"task_id": "{claim.task_id}", "run_id": "<run_id>"}'`
@@ -60,6 +79,42 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
 
    If the dispatcher returned no claims or the claims array is empty, log NO_DISPATCH and CONTINUE to Step 4.4 — do NOT exit. Intent scan (4.4), ack scan (4.5) and evidence (6) run independently of dispatch claims. A no-claims tick must still issue parked publish intents, scan for acknowledgements, and deliver evidence. (Fixed 2026-09-14: the old "exit on NO_DISPATCH" skipped publication permanently.)
 
+4w. **Worker-layer Chore claim (cutover piece — inert until a dispatcher
+   tags a chore claim `executor: "worker"`):** the worker-layer driver
+   (`lib/chore-run.js`) replaces `workflow_launch_async` for this claim.
+   You are the ferry: the driver decides, the bridge posts, you spawn.
+   The driver claims the task itself through the atomic `claim-task`
+   (claim-as-gate) — you do not claim, and you do not check the claim
+   first. If the sandbox dispatcher (or another tick) won the race, the
+   ferry returns `done` with outcome `stood-down`: log it and move on;
+   the task is already owned.
+   - Tick sequence: the `tick_seq` of the dispatch decision from this
+     tick's Step 3 — the last line of
+     `{crewHome}/.dispatch-decisions.jsonl`. Use it verbatim (no
+     arithmetic); it must be a positive integer. It becomes the spawn
+     rows' `owner_tick_seq`. If the file is missing or the last line
+     carries no `tick_seq`, stop and log — do not invent a sequence.
+   - Invoke the ferry in shell:
+     `node {crewHome}/lib/chore-tick.js --crew-home {crewHome} --task-id "<claim.task_id>" --tick-seq <N> --project-id "<claim.args.project_id>" [--visual-protocol|--no-visual-protocol from claim.args.visual_protocol] [--resolved-workflow <claim.args.resolved_workflow>] [--workflow-was-null when claim.args.workflow_was_null]`
+     Copy flag values verbatim from the claim's `args` — never re-derive them.
+   - Read the ferry's single stdout JSON line (`action`):
+     - `"spawn"`: perform the spawn ritual —
+       1. Spawn ONE subagent with `spawn.prompt` as its full instructions.
+          Convey the working directory (`spawn.cwd`) and environment
+          (`spawn.env`) in the spawn — if your spawn mechanism takes only
+          a message, state them explicitly at the top of the instructions;
+          never let the agent guess where to work.
+       2. Immediately record `child: {"kind":"subagent","agent_id":"<id>"}` into the existing session file at `spawn.session_path` (read-modify-write: preserve its fields, add `child`).
+       3. Wait up to `spawn.timeout_ms` for the agent's final report (the
+          report arrives asynchronously — do not poll; if the timeout
+          elapses first, treat it as a timeout). Update the session file: `outcome: "returned"` + `text` = the final report verbatim. On timeout: stop the agent if possible (your agent-close mechanism), then `outcome: "timeout"` (+ `kill_evidence: {"verified_dead": true, "method": "<how>", "detail": "<what>"}` only when a machine liveness check proved it dead — an unconfirmed kill leaves the row running for the Step-0b reaper, by design). On spawn failure: `outcome: "spawn_error"` + `error`.
+       4. Re-invoke the ferry with `--session "<spawn.session_path>"` appended. Repeat from the action read.
+     - `"wait"`: log `reason`; stop driving this task this tick. The next tick resumes (re-invocation is safe — a running spawn yields WAIT again; a lost claim race yields done/stood-down).
+     - `"done"`: log `outcome` (+ `reason`); stop. The driver already wrote the terminal task state.
+     - `"error"`: log `reason`; stop. Do not retry in a tight loop — the next tick retries.
+   - Loop within the tick until `wait`/`done`/`error`. The ferry enforces its own frame budget (20 frames; exhaustion yields `wait` with reason `frame-budget-exhausted` — never done/failed). If the tick's 90-minute ceiling (Step 5) is nearly exhausted, stop looping — the next tick resumes. Budgets end the tick's participation, never the task.
+   - Never build prompts, never write the ledger except through the ferry, never interpret agent output — `spawn-step.js post` classifies it.
+
 4.4. **Publish intent scan (0.14.6):** the workflow parks at Publish with a version-carrying publish-intent ledger entry; issuance belongs to the tick. Deterministic code owns every transition; you are the ferry (scan → issue → record). Run this BEFORE Step 4.5 so an issued edit's ack window is open to the acknowledgement scan on a later tick. Log every list the scan returns.
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-publish-intent`
      This atomically claims parked publish intents for this tick (1-hour lease, so a second tick cannot double-issue). It returns `{ intent: [...], skipped: [...], requeued: [...] }`. Each intent entry carries `task_id`, `commit`, `attempt`, `slug`, `repo_path`, `project_id`, `ledger_path`, `base`, `diff_path`, `diff_sha256`, `version` (`<commit>:<attempt>`), `files` (changed paths), `claimed_at`, `claim_expiry`, `reclaimed` (true when a previous tick died mid-issuance). Copy the entry's fields verbatim — never re-derive them.
@@ -111,9 +166,6 @@ The failures below are settled and recorded in the Gate 1 OODA state. The author
    - `reissued` = fresh intents for the next attempt — a 30-minute window expired with no acknowledgement, so code re-issued with a fresh version (by derivation), immediately claimable (no backoff). This tick does NOT issue them; the NEXT tick's `scan-publish-intent` claims them. Log only.
    - `skipped` = window still open or evidence absent — log only, take no action.
 
-4.6. **Shadow verdict (Piece 1, 2026-09-26):** after the Step-3 dispatcher's decision is recorded, pair its decision with the Step-2.5 shadow evidence. Run in shell:
-  `node {crewHome}/lib/compare-dispatch-shadow.js --crew-home {crewHome}`
-  Log every `SHADOW_*` line verbatim. `SHADOW_MATCH` means the worker layer agreed with the sandbox on this tick's claims. `SHADOW_DIVERGE` names the differing claim triples (`task_id|workflow|step`) — log them; divergence is evidence for the cutover review, not a tick failure, so continue the tick. `SHADOW_UNPAIRED` means the authoritative decision line is missing (the Step-3 dispatcher died after the shadow ran) — log it loudly and continue. `SHADOW_PENDING` means the decision hasn't been written yet; the shadow stays pending and a later tick retries the pairing — log and continue. `SHADOW_NO_EVIDENCE` on the first shadowed tick is normal. Verdicts append to `{crewHome}/.dispatch-shadow-verdicts.jsonl`; the cutover decision after ~100-200 ticks is made from that file, never from a single tick.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The exact version string is the sole positive signal.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.

package/workflows/bugfix.js

@@ -300,13 +300,17 @@ var TOOL_CHECK_PREAMBLE =
   "Then do the assignment below.\n\n";
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
   // reason: "discarded" (the runtime threw the output away — the JSON-candidate
-  // scan found {...}-shaped fragments it could not parse), "empty" (agent() returned without throwing but produced
-  // nothing usable), "no-tools" (the worker's TOOL CHECK reported
-  // artifact_tools: missing), or "no-transport" (the worker's TOOL CHECK
-  // reported shell_transport: unavailable).
+  // scan found {...}-shaped fragments it could not parse), "errored" (the
+  // attempt errored — not a brace discard), "empty" (agent() returned
+  // without throwing but produced nothing usable), "no-tools" (the
+  // worker's TOOL CHECK reported artifact_tools: missing), or
+  // "no-transport" (the worker's TOOL CHECK reported shell_transport:
+  // unavailable).
   // The trailer tells the retry what to expect, not just to try again.
   var why = reason === "empty"
     ? "your previous attempt returned no usable output"
+    : reason === "errored"
+    ? "your previous attempt errored before producing a usable report (not a brace discard — diagnose the error and report the true state in plain prose)"
     : reason === "no-tools"
     ? "your previous attempt's TOOL CHECK reported artifact_tools: missing (this is a fresh launch, so run the TOOL CHECK's load step again before the work)"
     : reason === "no-transport"
@@ -474,12 +478,11 @@ function describeWorkAgentFailure(stepName, identity, attempts) {
   // Honest classification of a work-agent call that yielded no usable
   // report, with the per-attempt evidence preserved in the session notes.
   // Two distinct cases:
-  // - agent() THREW: the runtime discarded output it could not machine-read
-  //   (e.g. prose tripping the JSON-candidate heuristic). The raw output is
-  //   gone — the workflow never received it — so the surviving error text is
-  //   recorded here instead. (An earlier comment claimed the raw output was
-  //   "preserved in the run record"; that was false — nothing preserved it —
-  //   and the claim is removed.)
+  // - agent() THREW: either the runtime discarded output it could not
+  //   machine-read (prose tripping the JSON-candidate heuristic), or the
+  //   agent errored before producing a report. The raw output is gone —
+  //   the workflow never received it — so the surviving error text is
+  //   recorded here instead.
   // - agent() RETURNED EMPTY without throwing: the child produced nothing
   //   usable. Each attempt's outcome is the evidence.
   // attempts: [{threw, error, outcome}, ...], in order.
@@ -943,7 +946,7 @@ let alreadyMergedSha = null;
 // verified sha and no `repo_diff: none` claim fails mechanically without
 // dispatching Cass; reviewer prose is never parsed for git identity.
 let branchState = null; // "has-work" | "already-merged:<sha>" | "empty-no-work"
-let buildClaimedNoDiff = false; // Build declared plain `repo_diff: none` (no repo change — runtime-state deliverable, or believed already-merged). Same-process Build report only; there is no cross-process hydration — an empty branch on a fresh dispatch with no task-attributed merge fails mechanically.
+let buildClaimedNoDiff = false; // Build's `repo_diff: none` claim, from the same-process Build report only (no cross-process hydration).
 let versionTouched = false; // npm: branch changed package.json's `version` (mechanical git fact, blocker-34 follow-up)
 let branchStateErr = ""; // classifier failure detail (retry trailer + park note grounds)
 // Deterministic publish target — computed by the workflow (registry base +
@@ -2029,13 +2032,10 @@ while (i < STEPS.length) {
         // state agent steps were deleted — their outputs fed only the
         // retired content-verdict/receipt-attribution machinery, and the
         // toolcheck ran in a workflow child that cannot reach artifact_edit.
-        // Issuance belongs to the session-carrying tick worker, which
-        // handles tool-unavailability as inconclusive per the tick protocol.)
-        // Publish at intent. Everything above — preflight, provenance base,
-        // checksummed diff, toolcheck, pre-trigger baselines — is read-only.
         // Issuance belongs to the session-carrying tick worker
         // (scan-publish-intent's intent bucket), the only caller class that
-        // can reach artifact_edit. This entry is issuer-written BY THE
+        // can reach artifact_edit; it handles tool-unavailability as
+        // inconclusive per the tick protocol. This entry is issuer-written BY THE
         // WORKFLOW and names the intent: outcome "publish-intent", never
         // "submitted" — the workflow issued nothing. The worker claims it
         // via the park note below.
@@ -2341,7 +2341,7 @@ while (i < STEPS.length) {
   for (var workAttempt = 0; workAttempt <= 2 && !mechanicalReviewFail; workAttempt++) {
     var workKey = workAttempt === 0 ? workKeyBase : workRetryKey(step.name, (totalReworkCount > 0 ? "-r" + totalReworkCount : ""), workAttempt);
     var prevAttempt = workAttempt === 0 ? null : workAttempts[workAttempt - 1];
-    var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? "discarded" : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
+    var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? (/output was not JSON/.test(prevAttempt.error || "") ? "discarded" : "errored") : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
     try {
       workerResult = await agent(
         workPromptBase + (workAttempt === 0 ? "" : buildTransportRetryTrailer(step.name, REPO_PATH, taskId, workAttempt, retryReason)),

package/workflows/chore.js

@@ -310,13 +310,17 @@ var TOOL_CHECK_PREAMBLE =
   "Then do the assignment below.\n\n";
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
   // reason: "discarded" (the runtime threw the output away — the JSON-candidate
-  // scan found {...}-shaped fragments it could not parse), "empty" (agent() returned without throwing but produced
-  // nothing usable), "no-tools" (the worker's TOOL CHECK reported
-  // artifact_tools: missing), or "no-transport" (the worker's TOOL CHECK
-  // reported shell_transport: unavailable).
+  // scan found {...}-shaped fragments it could not parse), "errored" (the
+  // attempt errored — not a brace discard), "empty" (agent() returned
+  // without throwing but produced nothing usable), "no-tools" (the
+  // worker's TOOL CHECK reported artifact_tools: missing), or
+  // "no-transport" (the worker's TOOL CHECK reported shell_transport:
+  // unavailable).
   // The trailer tells the retry what to expect, not just to try again.
   var why = reason === "empty"
     ? "your previous attempt returned no usable output"
+    : reason === "errored"
+    ? "your previous attempt errored before producing a usable report (not a brace discard — diagnose the error and report the true state in plain prose)"
     : reason === "no-tools"
     ? "your previous attempt's TOOL CHECK reported artifact_tools: missing (this is a fresh launch, so run the TOOL CHECK's load step again before the work)"
     : reason === "no-transport"
@@ -484,12 +488,11 @@ function describeWorkAgentFailure(stepName, identity, attempts) {
   // Honest classification of a work-agent call that yielded no usable
   // report, with the per-attempt evidence preserved in the session notes.
   // Two distinct cases:
-  // - agent() THREW: the runtime discarded output it could not machine-read
-  //   (e.g. prose tripping the JSON-candidate heuristic). The raw output is
-  //   gone — the workflow never received it — so the surviving error text is
-  //   recorded here instead. (An earlier comment claimed the raw output was
-  //   "preserved in the run record"; that was false — nothing preserved it —
-  //   and the claim is removed.)
+  // - agent() THREW: either the runtime discarded output it could not
+  //   machine-read (prose tripping the JSON-candidate heuristic), or the
+  //   agent errored before producing a report. The raw output is gone —
+  //   the workflow never received it — so the surviving error text is
+  //   recorded here instead.
   // - agent() RETURNED EMPTY without throwing: the child produced nothing
   //   usable. Each attempt's outcome is the evidence.
   // attempts: [{threw, error, outcome}, ...], in order.
@@ -1823,13 +1826,10 @@ while (i < STEPS.length) {
         // state agent steps were deleted — their outputs fed only the
         // retired content-verdict/receipt-attribution machinery, and the
         // toolcheck ran in a workflow child that cannot reach artifact_edit.
-        // Issuance belongs to the session-carrying tick worker, which
-        // handles tool-unavailability as inconclusive per the tick protocol.)
-        // Publish at intent. Everything above — preflight, provenance base,
-        // checksummed diff, toolcheck, pre-trigger baselines — is read-only.
         // Issuance belongs to the session-carrying tick worker
         // (scan-publish-intent's intent bucket), the only caller class that
-        // can reach artifact_edit. This entry is issuer-written BY THE
+        // can reach artifact_edit; it handles tool-unavailability as
+        // inconclusive per the tick protocol. This entry is issuer-written BY THE
         // WORKFLOW and names the intent: outcome "publish-intent", never
         // "submitted" — the workflow issued nothing. The worker claims it
         // via the park note below.
@@ -1999,7 +1999,7 @@ while (i < STEPS.length) {
   for (var workAttempt = 0; workAttempt <= 2 && !mechanicalReviewFail; workAttempt++) {
     var workKey = workAttempt === 0 ? workKeyBase : workRetryKey(step.name, (reworkCount > 0 ? "-r" + reworkCount : ""), workAttempt);
     var prevAttempt = workAttempt === 0 ? null : workAttempts[workAttempt - 1];
-    var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? "discarded" : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
+    var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? (/output was not JSON/.test(prevAttempt.error || "") ? "discarded" : "errored") : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
     try {
       workerResult = await agent(
         workPromptBase + (workAttempt === 0 ? "" : buildTransportRetryTrailer(step.name, REPO_PATH, taskId, workAttempt, retryReason)),

package/workflows/docs.js

@@ -329,13 +329,17 @@ while (i < STEPS.length) {
     "Then do the assignment below.\n\n";
   function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
     // reason: "discarded" (the runtime threw the output away — the JSON-candidate
-    // scan found {...}-shaped fragments it could not parse), "empty" (agent() returned without throwing but produced
-    // nothing usable), "no-tools" (the worker's TOOL CHECK reported
-    // artifact_tools: missing), or "no-transport" (the worker's TOOL CHECK
-    // reported shell_transport: unavailable).
+    // scan found {...}-shaped fragments it could not parse), "errored" (the
+    // attempt errored — not a brace discard), "empty" (agent() returned
+    // without throwing but produced nothing usable), "no-tools" (the
+    // worker's TOOL CHECK reported artifact_tools: missing), or
+    // "no-transport" (the worker's TOOL CHECK reported shell_transport:
+    // unavailable).
     // The trailer tells the retry what to expect, not just to try again.
     var why = reason === "empty"
       ? "your previous attempt returned no usable output"
+      : reason === "errored"
+      ? "your previous attempt errored before producing a usable report (not a brace discard — diagnose the error and report the true state in plain prose)"
       : reason === "no-tools"
       ? "your previous attempt's TOOL CHECK reported artifact_tools: missing (this is a fresh launch, so run the TOOL CHECK's load step again before the work)"
       : reason === "no-transport"
@@ -367,12 +371,11 @@ function describeWorkAgentFailure(stepName, identity, attempts) {
     // Honest classification of a work-agent call that yielded no usable
     // report, with the per-attempt evidence preserved in the session notes.
     // Two distinct cases:
-    // - agent() THREW: the runtime discarded output it could not machine-read
-    //   (e.g. prose tripping the JSON-candidate heuristic). The raw output is
-    //   gone — the workflow never received it — so the surviving error text is
-    //   recorded here instead. (An earlier comment claimed the raw output was
-    //   "preserved in the run record"; that was false — nothing preserved it —
-    //   and the claim is removed.)
+    // - agent() THREW: either the runtime discarded output it could not
+    //   machine-read (prose tripping the JSON-candidate heuristic), or the
+    //   agent errored before producing a report. The raw output is gone —
+    //   the workflow never received it — so the surviving error text is
+    //   recorded here instead.
     // - agent() RETURNED EMPTY without throwing: the child produced nothing
     //   usable. Each attempt's outcome is the evidence.
     // attempts: [{threw, error, outcome}, ...], in order.
@@ -450,7 +453,7 @@ function describeWorkAgentFailure(stepName, identity, attempts) {
   for (var workAttempt = 0; workAttempt <= 2; workAttempt++) {
     var workKey = workAttempt === 0 ? workKeyBase : workRetryKey(step.name, (reworkCount > 0 ? "-r" + reworkCount : ""), workAttempt);
     var prevAttempt = workAttempt === 0 ? null : workAttempts[workAttempt - 1];
-    var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? "discarded" : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
+    var retryReason = workAttempt === 0 ? null : (prevAttempt.threw ? (/output was not JSON/.test(prevAttempt.error || "") ? "discarded" : "errored") : (prevAttempt.outcome === "missing-artifact-tools" ? "no-tools" : (prevAttempt.outcome === "unavailable-shell-transport" ? "no-transport" : "empty")));
     try {
       workerResult = await agent(
         workPromptBase + (workAttempt === 0 ? "" : buildTransportRetryTrailer(step.name, REPO_PATH, taskId, workAttempt, retryReason)),