muse-crew 0.2.1 → 0.4.0

package/API.md

@@ -16,7 +16,7 @@ Create a new task on the board.
 |-------|------|----------|-------|
 | `title` | string (1–160 chars) | yes | |
 | `description` | string (≤ 5000) | no | Defaults to `""` |
-| `project` | slug | no | Defaults to the service's default project |
+| `project` | slug | no | Implicit project resolution: an explicit `project` wins; otherwise the service resolves `config.default_project` (set by `setdefaultproject`, `crew-init`, or automatically for the first registered project); as a last resort it falls back to the legacy `"orchestra-dashboard"` project id. Agents filing tasks normally omit `project` and inherit the dashboard's default. |
 | `workflow` | slug or null | no | Routing label (e.g. `standard`, `bugfix`, `chore`, `docs`) |
 | `priority` | `high` · `normal` · `low` | no | Defaults to `normal` |
 | `state` | `todo` · `in_progress` · `parked` · `done` | no | Defaults to `todo` |
@@ -33,7 +33,7 @@ Update an existing task's fields. Only `id` is required; all other fields are op
 | `description` | string (≤ 3000) | no | |
 | `state` | `todo` · `in_progress` · `parked` · `done` | no | |
 | `priority` | `high` · `normal` · `low` | no | |
-| `project` | slug | no | |
+| `project` | slug | no | **Project-move guard:** changing this to a different project throws while the task has an active run (an agent session with status `running` that started within the last hour), because the live run keeps the old project's repo context and moving it mid-phase would work on the wrong repo. Wait for the run to finish, or recover/park the task first, then move it. |
 | `workflow` | slug or null | no | |
 | `deps` | string[] | no | |
 
@@ -143,17 +143,31 @@ Register a new project.
 | `simultaneity` | integer (1–100) | no | Max concurrent tasks; defaults to 2 |
 | `quiesced` | boolean | no | Start paused; defaults to false |
 
+The first registered project automatically becomes the `default_project` (see State) when no default is set yet.
+
 ### `updateproject`
 
 Update project fields. Only `id` is required; all others are optional patch fields. Same fields as `createproject`, except `simultaneity` minimum is 0 (for kill switch state).
 
+**Context-change guard:** changing `repo_path`, `deploy_type`, or `deploy_slug` is blocked while any task in the project has an active run (an agent session with status `running` that started within the last hour): the call throws, because live runs keep the old project config and the change would split the project context mid-run. Wait for the runs to finish, or recover/park those tasks first, then retry.
+
+### `setdefaultproject`
+
+Set the dashboard's default project — the project the CLI and agents use implicitly when no explicit project is given. The dispatcher resolves a task's project as its explicit label first, then this default, then the first registered project as a last resort.
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `project_id` | slug | yes | Must be a registered project id, else the call throws `"Project not found."` |
+
+Returns `{ "ok": true, "project_id": "<slug>" }`. Idempotent: sets the `default_project` config key via upsert.
+
 ### `deleteproject`
 
 Remove a project registration.
 
 | Field | Type | Required | Notes |
 |-------|------|----------|-------|
-| `id` | slug | yes | |
+| `id` | slug | yes | If this project was the `default_project`, the default pointer is cleared so it never aims at a missing project. |
 
 ### `listprojects`
 
@@ -201,6 +215,14 @@ Read the full dashboard state: tasks, sessions, events, and projects. Used by wo
 
 Read global configuration. Takes no arguments.
 
+**Known keys:**
+
+| Key | Value | Set by |
+|-----|-------|--------|
+| `default_project` | project slug | `setdefaultproject` (explicit upsert), `createproject` (first project only), `crew-init` (the dashboard's own project) |
+
+`default_project` is the dashboard's configured default project: agents and the CLI inherit it when no explicit project is given. Deleting the project it points at clears it. No migration is needed — the key simply appears once set, and the dispatcher reads it from `getdispatchstate`'s `config` object.
+
 ### `updateconfig`
 
 Set a global configuration value.

package/docs/guide.md

@@ -213,7 +213,7 @@ Each phase has an assigned identity — a character with a defined personality:
 | Map | **Mara** | Designer |
 | Build | **Wren** | Quietest one, trusts the plan |
 | Review | **Cass** | Fair but exacting — holds the spec as the contract |
-| Integrate | **Wren** | Merges the work, pushes `main` to the repo |
+| Integrate | **Wren** | Merges the work, pushes `main` to the repo (succeeds vacuously when the task branch is empty — runtime-state deliverable) |
 | Publish | **Wren** | Ships the merged code to the publish target (skipped when none) |
 | QA | **Hazel** | Code-blind, persistent, wears persona costumes |
 | Reproduce | **Hazel** | Reproduces bugs before fixing |

package/lib/crew-release.sh

@@ -6,10 +6,13 @@
 #
 # Layout:
 #   ~/.jarvis/
-#     releases/<full-commit-hash>/   # immutable snapshot (workflows/ + lib/)
+#     releases/<full-commit-hash>/   # immutable snapshot (workflows/ + lib/ + seed/workflows/ docs)
 #     current -> releases/<hash>     # active release
 #     workflows -> current/workflows # convenience (cron/dispatcher reads this)
 #     lib -> current/lib             # convenience
+#     .orchestration/workflows/      # live workflow documents the dashboard
+#                                    # reads; re-synced from the activated
+#                                    # release on every deploy/rollback
 #
 # The Muse workflow runtime snapshots .js scripts at launch.
 # /tmp/crew-lib-* pins lifecycle scripts per run.
@@ -91,6 +94,37 @@ _validate_workflows() {
   echo "VALIDATED: workflow scripts parse"
 }
 
+# ── workflow doc sync ───────────────────────────────────────────────
+# Decision (2026-09-09): the dashboard reads the workflow documents live
+# from $CREW_HOME/.orchestration/workflows/, and `recovertask` validates
+# target_phase against them — so those documents must always reflect the
+# phases the dispatcher actually runs. Both the workflow scripts and the
+# .md docs ship in the same repo commit, so we re-sync the docs from the
+# activated release on every release activation (deploy AND rollback),
+# automatically. A manual re-sync step is exactly what drifted here: the
+# copy was seeded once by crew-init's `cp -n` and never refreshed, leaving
+# the dashboard on pre-publish-architecture phases (no Integrate, no
+# Publish) while the dispatcher ran the current phase lists.
+_sync_workflow_docs() {
+  local home="${1:?usage: _sync_workflow_docs <jarvis-home>}"
+  local src="$home/current/seed/workflows"
+  local dest="$home/.orchestration/workflows"
+  if [ ! -d "$src" ]; then
+    echo "WORKFLOW-DOCS: no seed/workflows in activated release; skipping sync" >&2
+    return 0
+  fi
+  mkdir -p "$dest"
+  local f base copied=0
+  for f in "$src"/*.md; do
+    [ -f "$f" ] || continue
+    base="$(basename "$f")"
+    [ "$base" = "AGENTS.md" ] && continue  # folder docs, not a workflow
+    cp -f "$f" "$dest/$base"
+    copied=$((copied + 1))
+  done
+  echo "WORKFLOW-DOCS: synced $copied workflow docs to $dest"
+}
+
 # ── deploy ────────────────────────────────────────────────────────────
 # Build, validate, and atomically activate a release from repo HEAD.
 # Single command — no cross-step lock needed.
@@ -124,11 +158,18 @@ cmd_deploy() {
     mkdir -p "$staging_dir"
     if [ -d .git ]; then
       # Extract from committed tree (not working directory)
-      git archive HEAD -- workflows lib | tar -xC "$staging_dir"
+      _seed=""
+      git cat-file -e "HEAD:seed/workflows" 2>/dev/null && _seed="seed/workflows" || true
+      # shellcheck disable=SC2086
+      git archive HEAD -- workflows lib $_seed | tar -xC "$staging_dir"
     else
       # Plain directory (npm install): copy directly
       [ -d workflows ] && cp -r workflows "$staging_dir/"
       [ -d lib ]       && cp -r lib "$staging_dir/"
+      if [ -d seed/workflows ]; then
+        mkdir -p "$staging_dir/seed"
+        cp -r seed/workflows "$staging_dir/seed/"
+      fi
     fi
     # Gate: refuse to install a release whose workflow scripts don't parse.
     if ! _validate_workflows "$staging_dir"; then
@@ -147,6 +188,9 @@ cmd_deploy() {
 
   echo "ACTIVATED: $hash"
 
+  # Keep the dashboard's workflow documents in sync with the release.
+  _sync_workflow_docs "$CREW_HOME"
+
   # Prune old releases — keep the 5 most recent
   _prune_releases "$home" 5
 }
@@ -172,6 +216,9 @@ cmd_rollback() {
   mv -T "$tmp_link" "$CREW_HOME/current"
 
   echo "ROLLED_BACK: $current_hash -> $prev"
+
+  # Keep the dashboard's workflow documents in sync with the release.
+  _sync_workflow_docs "$CREW_HOME"
 }
 
 # ── current ───────────────────────────────────────────────────────────

package/lib/worktree-lifecycle.sh

@@ -158,8 +158,11 @@ cmd_integrate() {
   local ahead
   ahead=$(git rev-list --count "main..task/$task_id")
   if [ "$ahead" -eq 0 ]; then
-    echo "ERROR: task/$task_id has no commits ahead of main — nothing to merge"
-    return 1
+    # Approved empty diff: the deliverable was runtime state (cron,
+    # scheduler, dashboard config), not a repo change. Nothing to merge,
+    # nothing to serialize — the merge lock is intentionally not taken.
+    echo "MERGED_EMPTY: task/$task_id has no commits ahead of main — runtime-state deliverable, nothing to merge"
+    return 0
   fi
 
   # Acquire merge lock
@@ -174,7 +177,6 @@ cmd_integrate() {
   if ! git merge --no-ff "task/$task_id" -m "$commit_msg" 2>&1; then
     echo "CONFLICT: merge failed — aborting"
     git merge --abort 2>/dev/null || true
-    "$MERGE_LOCK" release "$task_id" >/dev/null 2>&1
     exit 3
   fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -78,6 +78,24 @@ const MAX_TOTAL_REWORK = 2;
 let totalReworkCount = 0;
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
+// Merge-time versioning: the release decision is extracted deterministically
+// from the accepted Build summary (extractReleaseDecision) so the Publish
+// agent never decides whether to publish. Two consecutive Publish runs
+// rationalized a skip against explicit instruction text — text alone did not
+// hold, so the decision now lives in workflow code, not agent judgment.
+let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"minor"|"major"|null }
+function extractReleaseDecision(text) {
+  const t = text || "";
+  const r = /^release:\s*(yes|no)\s*$/im.exec(t);
+  if (!r) return null;
+  const b = /^version_bump:\s*(patch|minor|major)\s*$/im.exec(t);
+  if (r[1].toLowerCase() === "yes" && !b) return null;
+  return { release: r[1].toLowerCase(), version_bump: b ? b[1].toLowerCase() : null };
+}
+function releaseDecisionText() {
+  if (!releaseDecision) return "no parseable release:/version_bump: decision";
+  return "release: " + releaseDecision.release + (releaseDecision.version_bump ? ", version_bump: " + releaseDecision.version_bump : " (no version_bump line)");
+}
 let i = startStepIndex;
 
 // Pin lifecycle scripts
@@ -150,6 +168,28 @@ while (i < STEPS.length) {
     return { status: "blocked", task_id: taskId, reason: "Unknown publish target '" + PUBLISH_TYPE + "' — expected 'npm', 'artifact', 'vercel', or empty (skip publish)." };
   }
 
+  // Merge-time versioning, decided deterministically: the release decision was
+  // extracted from the accepted Build summary above. release: no never reaches
+  // the Publish agent (the workflow skips it here, exactly like the no-target
+  // case); an unparseable decision blocks fail-closed. The Publish agent below
+  // therefore has no decision point to rationalize into a skip.
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm") {
+    if (!releaseDecision) {
+      return { status: "blocked", task_id: taskId, reason: "Build summary has no parseable release:/version_bump: lines — cannot assign version at publish time." };
+    }
+    if (releaseDecision.release === "no") {
+      log("Publish skipped for task " + taskId + " — accepted Build summary declared release: no");
+      await agent(
+        "Release the merge lock and clean up without publishing.\n" +
+        "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
+        "If the output contains DEPLOYED, the lock is released and the worktree is cleaned up.",
+        { key: "publish-skip-release-no", label: "Skipping Publish (release: no)", schema: { type: "object" } }
+      );
+      i++;
+      continue;
+    }
+  }
+
   // Claim session
   let activeSessionId;
   if (isFirstClaim && firstSessionId) {
@@ -204,11 +244,15 @@ while (i < STEPS.length) {
       "Edit the TypeScript source files directly. Do NOT use artifact_edit — that happens in the Publish phase.\n" +
       "Do not add unrequested features. Build exactly what the spec calls for.\n" +
       "PUBLIC DOCS: If your change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), update the public docs in the same commit — API.md for API changes. Documentation and implementation ship together.\n\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, so you choose the package version. If this change warrants a published release (anything a consumer can observe: workflow behavior, phase lists, identities, published docs, API), bump the version in package.json with semver (patch for fixes, minor for new behavior, major for breaking changes) and state the chosen version and why in your summary. If the change is internal-only, leave the version unchanged and say so. Check the registry first — npm view muse-crew version — and never re-publish an existing version.\n\n" : "") +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry. Versions are assigned at PUBLISH time — never in your branch. Do NOT touch the `version` field in package.json (or package-lock). Instead, end your summary with exactly these two lines:\n" +
+      "release: yes|no — 'yes' if this change warrants a published release (anything a consumer can observe: workflow behavior, phase lists, identities, published docs, API); 'no' if internal-only.\n" +
+      "version_bump: patch|minor|major — patch for fixes (default), minor for new behavior, major for breaking changes. Omit this line only when release is no.\n" +
+      "Example: release: yes\\nversion_bump: minor\n\n" : "") +
       "STEP 3: Commit your changes.\n" +
       "cd " + REPO_PATH + "/.worktrees/" + taskId + "\n" +
       "git add -A\n" +
       "git commit -m \"fix: " + safeTitle + "\"\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your summary, naming the runtime-state deliverable. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "This is REWORK after rejection. Address these specific issues:\n" + rejectionNotes + "\n\n" : "") +
       "Your final response MUST be valid JSON and nothing else: { \"summary\": \"what you built\", \"passed\": true }. No prose, no markdown, just the JSON object.";
 
@@ -222,7 +266,13 @@ while (i < STEPS.length) {
       REPO_PATH + "/.worktrees/" + taskId + "/\n\n" +
       "Check quality, correctness, and spec compliance.\n" +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, reject with notes on what is stale.\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry. Validate the builder's version choice: package.json must hold valid semver; if the version was bumped it must be greater than the registry version (npm view muse-crew version), the bump scope (patch/minor/major) must fit the change, and exactly one version field may change. If the version is invalid, already published, or mis-scoped, reject with notes.\n" : "") +
+      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with a plausible runtime-state deliverable (e.g. a cron created via the cron tool). Otherwise reject: 'no commits ahead of main and no repo_diff: none declaration — the builder likely forgot to commit'.\n" +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
+      "(a) The task branch must NOT have changed package.json's `version` field. Check: cd " + REPO_PATH + " && git diff main...task/" + taskId + " -- package.json. If the branch touched `version` in any way, REJECT with notes: 'versions are assigned at publish time, never in branches — remove the version change'.\n" +
+      "(b) The accepted Build summary declares: " + releaseDecisionText() + ". " +
+      (releaseDecision
+        ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, reject with notes."
+        : "The decision is missing or malformed — REJECT with notes: 'Build summary must end with release: yes|no and (when release is yes) version_bump: patch|minor|major lines'.") + "\n" : "") +
       "If the work passes review, your final response MUST be valid JSON and nothing else: { \"passed\": true, \"summary\": \"approval notes\" }.\n" +
       "If the work fails review, your final response MUST be valid JSON and nothing else: { \"passed\": false, \"summary\": \"rejection notes explaining what needs to change\" }.\n" +
       "No prose, no markdown, just the JSON object.";
@@ -232,8 +282,17 @@ while (i < STEPS.length) {
       "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " integrate " + taskId + " \"merge: fix: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
+      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Set passed to true with summary 'merged empty: no repo changes — deliverable was runtime state'. SKIP STEP 2 (push): there is no new commit to push.\n" +
       "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish). Set passed to false.\n" +
-      "- If it contains CONFLICT, a merge conflict occurred. Set passed to false with details.\n" +
+      "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
+      "RESOLUTION:\n" +
+      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge task/" + taskId + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch task/" + taskId + " is never modified.\n" +
+      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = main), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
+      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock (CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "), then retry the resolution using the failure output as context — max 3 attempts total.\n" +
+      "R4. Commit the resolution on resolve/" + taskId + ": git add -A && git commit -m \"resolve conflicts: " + taskId + "\".\n" +
+      "R5. Back in " + REPO_PATH + ": git checkout main && git merge --ff-only resolve/" + taskId + ". This fast-forwards — main has not moved while the lock was held. Then STEP 2 applies: git push origin main. Report the merged commit hash.\n" +
+      "R6. Clean up: cd " + REPO_PATH + " && git worktree remove --force /tmp/crew-resolve-" + taskId + " && git branch -D resolve/" + taskId + ".\n" +
+      "ESCALATE — return {\"passed\": false, \"summary\": \"conflict needs human resolution\"} — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- If it contains ERROR, something else failed. Set passed to false.\n\n" +
       "\n" +
       "STEP 2: Push the merged main to the remote repository.\n" +
@@ -247,28 +306,34 @@ while (i < STEPS.length) {
   } else if (step.name === "Publish") {
     if (PUBLISH_TYPE === "npm") {
       // npm packages: immutable release + pack + publish to the registry (push is universal in Integrate)
+      // The release decision arrived deterministically from the workflow (release: yes) —
+      // these steps are unconditional. There is no decision to make and no skip path.
       instructions = "Publish the npm package to the registry.\n\n" +
-        "The repo push already happened in Integrate — do NOT push to git in this phase, and NEVER force-push.\n" +
-        "Version discipline: publish ships the exact version merged in Integrate (Build applied it, Review validated it). Do not bump the version here.\n\n" +
+        "The release decision is already made and recorded — it is not yours to make: the accepted Build summary (validated by Review) declares " + releaseDecisionText() + ". Execute every step below in order.\n\n" +
+        "The repo push already happened in Integrate — do NOT push to git in this phase except STEP 7, and NEVER force-push.\n\n" +
         "STEP 0: Refresh the merge lock to prevent stale-lock breaking during publish.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "\n\n" +
         "STEP 1: Install and activate the immutable release.\n" +
         "Run: " + RELEASE_SCRIPT + " deploy " + REPO_PATH + "\n" +
         "Verify the output contains INSTALLED and ACTIVATED (or EXISTS and ACTIVATED if unchanged).\n\n" +
-        "STEP 2: Check whether the package version needs publishing.\n" +
-        "Read the version from: cd " + REPO_PATH + " && node -p \"require('./package.json').version\"\n" +
-        "Check the registry: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
-        "If the local version matches the registry version, the version is already live — skip to STEP 5.\n\n" +
-        "STEP 3: Pack and publish.\n" +
+        "STEP 2: Read the registry base version.\n" +
+        "Run: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
+        "If NOT_FOUND, use the local package.json version as the base instead.\n\n" +
+        "STEP 3: Apply the version_bump scope (" + releaseDecision.version_bump + ") to the base version: patch increments the last segment; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0. Example: base 1.2.3 + minor → 1.3.0. Call the result <new-version>.\n" +
+        "STEP 4: Write <new-version> into package.json (only the `version` field), then commit it under the still-held merge lock: cd " + REPO_PATH + " && git add package.json && git commit -m \"release: muse-crew@<new-version>\". The lock serializes Publish per repo, so two tasks can never pick the same version.\n" +
+        "STEP 5: Pack and publish.\n" +
         "Run: cd " + REPO_PATH + " && npm pack\n" +
-        "Then publish: python3 ~/workspace/skills/npm/bin/npm-publish.py " + REPO_PATH + "/muse-crew-$(node -p \"require('" + REPO_PATH + "/package.json').version\").tgz\n" +
-        "If publish fails with 'You cannot publish over the previously published versions', the version is already live — continue to STEP 4.\n\n" +
-        "STEP 4: Verify.\n" +
+        "Then publish: python3 ~/workspace/skills/npm/bin/npm-publish.py " + REPO_PATH + "/muse-crew-<new-version>.tgz\n" +
+        "If publish fails with 'You cannot publish over the previously published versions', <new-version> is already on the registry (a retried Publish — the merge lock guarantees no other task picked this version): continue to STEP 6 verification. Any other publish failure: set passed to false with the failure details.\n\n" +
+        "STEP 6: Verify.\n" +
         "Run: npm view muse-crew version\n" +
-        "Confirm it matches the local package.json version.\n\n" +
-        "STEP 5: Finalize.\n" +
+        "It must equal <new-version>. If not, set passed to false with the mismatch details.\n\n" +
+        "STEP 7: Push the version-bump commit: cd " + REPO_PATH + " && git push origin main. Never use --force.\n\n" +
+        "STEP 8: Finalize.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, finalization is complete.\n\n" +
+        "Do NOT compare the local package.json version to the registry version: with versions assigned at publish time, local==registry is the normal steady state before assignment — not a signal to skip. Execute every step above.\n\n" +
+        "End your summary with exactly this line: published: muse-crew@<new-version>\n\n" +
         "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true }.\n" +
         "No prose, no markdown, just the JSON object.";
     } else if (PUBLISH_TYPE === "artifact") {
@@ -305,6 +370,12 @@ while (i < STEPS.length) {
         "No prose, no markdown, just the JSON object.";
     }
   } else if (step.name === "QA") {
+    // Backstop for merge-time versioning: when the accepted Build summary
+    // declared release: yes, QA verifies the registry actually moved. A silent
+    // publish skip becomes a loud QA failure with evidence, not a pass.
+    var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
+      ? "NPM PUBLISH CHECK: the accepted Build summary declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and extract its `published: muse-crew@<version>` line from the session notes (the Publish agent ends its summary with exactly that line — event history does NOT carry it). Then run: npm view muse-crew version. The registry version MUST equal the published version. If there is no completed Publish session with a published: line, or the registry version does not match, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: [details]\" }.\n"
+      : "";
     instructions = "Final QA testing. You are CODE-BLIND — do NOT read source code.\n" +
       "Public docs (API.md, README, published action schemas) are NOT source code — read them freely, exactly as a user would.\n" +
       "DOCS GATE: If the fix is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), verify the public docs describe it. If public docs are missing or stale, FAIL with { \"passed\": false, \"summary\": \"public docs missing/stale for [the change]\" }. QA always fails when public-affecting changes lack public docs. Guide/tutorial gaps are lower priority — file a follow-up task for those instead of failing.\n" +
@@ -313,6 +384,7 @@ while (i < STEPS.length) {
       "You can also check specific data with the getevents action.\n" +
       "Do NOT use artifact_inspect — it is async and will not return results inline.\n" +
       "File follow-up tasks via artifact_invoke_action createtask on slug \"" + DASHBOARD_SLUG + "\" for related issues.\n" +
+      npmPublishCheck +
       "If testing passes, your final response MUST be valid JSON and nothing else: { \"passed\": true, \"summary\": \"test results\" }.\n" +
       "If testing fails, your final response MUST be valid JSON and nothing else: { \"passed\": false, \"summary\": \"failure details\" }.\n" +
       "No prose, no markdown, just the JSON object.";
@@ -327,9 +399,12 @@ while (i < STEPS.length) {
     }
   }
 
-  // Task event history — all phases except Review see the comment log
+  // Task event history — Review and Publish are excluded. Review is cold by
+  // design; Publish receives its release decision deterministically from the
+  // workflow, and prior rounds' history contains the exact skip deviation being
+  // eliminated — agents imitate recorded precedent.
   var eventPreamble = "";
-  if (step.name !== "Review") {
+  if (step.name !== "Review" && step.name !== "Publish") {
     eventPreamble = "CONTEXT: First, fetch this task's event history for background.\n" +
       "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getevents\", args: { \"task_id\": \"" + taskId + "\" }.\n" +
       "The returned events are filtered to this task. They contain notes and decisions from prior phases.\n\n";
@@ -390,6 +465,13 @@ while (i < STEPS.length) {
     mapperSpec = summary;
   }
 
+  // Capture the accepted Build summary's machine-readable release decision.
+  // Parsed from the RAW summary (before the 2000-char slice above) — the
+  // release:/version_bump: lines sit at the very end and must survive truncation.
+  if (step.name === "Build" && passed) {
+    releaseDecision = extractReleaseDecision(stepResult.summary || "");
+  }
+
   await agent(
     "Update the session and log the event.\n" +
     "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +

package/workflows/chore.js

@@ -72,6 +72,24 @@ const MAX_REWORK = 2;
 let reworkCount = 0;
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
+// Merge-time versioning: the release decision is extracted deterministically
+// from the accepted Build summary (extractReleaseDecision) so the Publish
+// agent never decides whether to publish. Two consecutive Publish runs
+// rationalized a skip against explicit instruction text — text alone did not
+// hold, so the decision now lives in workflow code, not agent judgment.
+let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"minor"|"major"|null }
+function extractReleaseDecision(text) {
+  const t = text || "";
+  const r = /^release:\s*(yes|no)\s*$/im.exec(t);
+  if (!r) return null;
+  const b = /^version_bump:\s*(patch|minor|major)\s*$/im.exec(t);
+  if (r[1].toLowerCase() === "yes" && !b) return null;
+  return { release: r[1].toLowerCase(), version_bump: b ? b[1].toLowerCase() : null };
+}
+function releaseDecisionText() {
+  if (!releaseDecision) return "no parseable release:/version_bump: decision";
+  return "release: " + releaseDecision.release + (releaseDecision.version_bump ? ", version_bump: " + releaseDecision.version_bump : " (no version_bump line)");
+}
 let i = startStepIndex;
 
 // Pin lifecycle scripts
@@ -144,6 +162,28 @@ while (i < STEPS.length) {
     return { status: "blocked", task_id: taskId, reason: "Unknown publish target '" + PUBLISH_TYPE + "' — expected 'npm', 'artifact', 'vercel', or empty (skip publish)." };
   }
 
+  // Merge-time versioning, decided deterministically: the release decision was
+  // extracted from the accepted Build summary above. release: no never reaches
+  // the Publish agent (the workflow skips it here, exactly like the no-target
+  // case); an unparseable decision blocks fail-closed. The Publish agent below
+  // therefore has no decision point to rationalize into a skip.
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm") {
+    if (!releaseDecision) {
+      return { status: "blocked", task_id: taskId, reason: "Build summary has no parseable release:/version_bump: lines — cannot assign version at publish time." };
+    }
+    if (releaseDecision.release === "no") {
+      log("Publish skipped for task " + taskId + " — accepted Build summary declared release: no");
+      await agent(
+        "Release the merge lock and clean up without publishing.\n" +
+        "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
+        "If the output contains DEPLOYED, the lock is released and the worktree is cleaned up.",
+        { key: "publish-skip-release-no", label: "Skipping Publish (release: no)", schema: { type: "object" } }
+      );
+      i++;
+      continue;
+    }
+  }
+
   let activeSessionId;
   if (isFirstClaim && firstSessionId) {
     activeSessionId = firstSessionId;
@@ -186,11 +226,15 @@ while (i < STEPS.length) {
       "Edit the TypeScript source files directly. Do NOT use artifact_edit — that happens in the Publish phase.\n" +
       "Do not add unrequested features.\n" +
       "PUBLIC DOCS: If your change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), update the public docs in the same commit — API.md for API changes. Documentation and implementation ship together.\n\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, so you choose the package version. If this change warrants a published release (anything a consumer can observe: workflow behavior, phase lists, identities, published docs, API), bump the version in package.json with semver (patch for fixes, minor for new behavior, major for breaking changes) and state the chosen version and why in your summary. If the change is internal-only, leave the version unchanged and say so. Check the registry first — npm view muse-crew version — and never re-publish an existing version.\n\n" : "") +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry. Versions are assigned at PUBLISH time — never in your branch. Do NOT touch the `version` field in package.json (or package-lock). Instead, end your summary with exactly these two lines:\n" +
+      "release: yes|no — 'yes' if this change warrants a published release (anything a consumer can observe: workflow behavior, phase lists, identities, published docs, API); 'no' if internal-only.\n" +
+      "version_bump: patch|minor|major — patch for fixes (default), minor for new behavior, major for breaking changes. Omit this line only when release is no.\n" +
+      "Example: release: yes\\nversion_bump: minor\n\n" : "") +
       "STEP 3: Commit your changes.\n" +
       "cd " + REPO_PATH + "/.worktrees/" + taskId + "\n" +
       "git add -A\n" +
       "git commit -m \"chore: " + safeTitle + "\"\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your summary, naming the runtime-state deliverable. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "REWORK after rejection. Address:\n" + rejectionNotes + "\n\n" : "") +
       "Your final response MUST be valid JSON and nothing else: { \"summary\": \"what you built\", \"passed\": true }. No prose, no markdown, just the JSON object.";
 
@@ -204,7 +248,13 @@ while (i < STEPS.length) {
       REPO_PATH + "/.worktrees/" + taskId + "/\n\n" +
       "Check quality, correctness, spec compliance.\n" +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, reject with notes on what is stale.\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry. Validate the builder's version choice: package.json must hold valid semver; if the version was bumped it must be greater than the registry version (npm view muse-crew version), the bump scope (patch/minor/major) must fit the change, and exactly one version field may change. If the version is invalid, already published, or mis-scoped, reject with notes.\n" : "") +
+      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with a plausible runtime-state deliverable (e.g. a cron created via the cron tool). Otherwise reject: 'no commits ahead of main and no repo_diff: none declaration — the builder likely forgot to commit'.\n" +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
+      "(a) The task branch must NOT have changed package.json's `version` field. Check: cd " + REPO_PATH + " && git diff main...task/" + taskId + " -- package.json. If the branch touched `version` in any way, REJECT with notes: 'versions are assigned at publish time, never in branches — remove the version change'.\n" +
+      "(b) The accepted Build summary declares: " + releaseDecisionText() + ". " +
+      (releaseDecision
+        ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, reject with notes."
+        : "The decision is missing or malformed — REJECT with notes: 'Build summary must end with release: yes|no and (when release is yes) version_bump: patch|minor|major lines'.") + "\n" : "") +
       "If it passes, your final response MUST be valid JSON and nothing else: { \"passed\": true, \"summary\": \"approval notes\" }.\n" +
       "If it fails, your final response MUST be valid JSON and nothing else: { \"passed\": false, \"summary\": \"rejection notes\" }.\n" +
       "No prose, no markdown, just the JSON object.";
@@ -214,8 +264,17 @@ while (i < STEPS.length) {
       "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " integrate " + taskId + " \"merge: chore: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
+      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Set passed to true with summary 'merged empty: no repo changes — deliverable was runtime state'. SKIP STEP 2 (push): there is no new commit to push.\n" +
       "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish). Set passed to false.\n" +
-      "- If it contains CONFLICT, a merge conflict occurred. Set passed to false with details.\n" +
+      "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
+      "RESOLUTION:\n" +
+      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge task/" + taskId + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch task/" + taskId + " is never modified.\n" +
+      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = main), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
+      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock (CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "), then retry the resolution using the failure output as context — max 3 attempts total.\n" +
+      "R4. Commit the resolution on resolve/" + taskId + ": git add -A && git commit -m \"resolve conflicts: " + taskId + "\".\n" +
+      "R5. Back in " + REPO_PATH + ": git checkout main && git merge --ff-only resolve/" + taskId + ". This fast-forwards — main has not moved while the lock was held. Then STEP 2 applies: git push origin main. Report the merged commit hash.\n" +
+      "R6. Clean up: cd " + REPO_PATH + " && git worktree remove --force /tmp/crew-resolve-" + taskId + " && git branch -D resolve/" + taskId + ".\n" +
+      "ESCALATE — return {\"passed\": false, \"summary\": \"conflict needs human resolution\"} — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- If it contains ERROR, something else failed. Set passed to false.\n\n" +
       "\n" +
       "STEP 2: Push the merged main to the remote repository.\n" +
@@ -229,28 +288,34 @@ while (i < STEPS.length) {
   } else if (step.name === "Publish") {
     if (PUBLISH_TYPE === "npm") {
       // npm packages: immutable release + pack + publish to the registry (push is universal in Integrate)
+      // The release decision arrived deterministically from the workflow (release: yes) —
+      // these steps are unconditional. There is no decision to make and no skip path.
       instructions = "Publish the npm package to the registry.\n\n" +
-        "The repo push already happened in Integrate — do NOT push to git in this phase, and NEVER force-push.\n" +
-        "Version discipline: publish ships the exact version merged in Integrate (Build applied it, Review validated it). Do not bump the version here.\n\n" +
+        "The release decision is already made and recorded — it is not yours to make: the accepted Build summary (validated by Review) declares " + releaseDecisionText() + ". Execute every step below in order.\n\n" +
+        "The repo push already happened in Integrate — do NOT push to git in this phase except STEP 7, and NEVER force-push.\n\n" +
         "STEP 0: Refresh the merge lock to prevent stale-lock breaking during publish.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "\n\n" +
         "STEP 1: Install and activate the immutable release.\n" +
         "Run: " + RELEASE_SCRIPT + " deploy " + REPO_PATH + "\n" +
         "Verify the output contains INSTALLED and ACTIVATED (or EXISTS and ACTIVATED if unchanged).\n\n" +
-        "STEP 2: Check whether the package version needs publishing.\n" +
-        "Read the version from: cd " + REPO_PATH + " && node -p \"require('./package.json').version\"\n" +
-        "Check the registry: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
-        "If the local version matches the registry version, the version is already live — skip to STEP 5.\n\n" +
-        "STEP 3: Pack and publish.\n" +
+        "STEP 2: Read the registry base version.\n" +
+        "Run: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
+        "If NOT_FOUND, use the local package.json version as the base instead.\n\n" +
+        "STEP 3: Apply the version_bump scope (" + releaseDecision.version_bump + ") to the base version: patch increments the last segment; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0. Example: base 1.2.3 + minor → 1.3.0. Call the result <new-version>.\n" +
+        "STEP 4: Write <new-version> into package.json (only the `version` field), then commit it under the still-held merge lock: cd " + REPO_PATH + " && git add package.json && git commit -m \"release: muse-crew@<new-version>\". The lock serializes Publish per repo, so two tasks can never pick the same version.\n" +
+        "STEP 5: Pack and publish.\n" +
         "Run: cd " + REPO_PATH + " && npm pack\n" +
-        "Then publish: python3 ~/workspace/skills/npm/bin/npm-publish.py " + REPO_PATH + "/muse-crew-$(node -p \"require('" + REPO_PATH + "/package.json').version\").tgz\n" +
-        "If publish fails with 'You cannot publish over the previously published versions', the version is already live — continue to STEP 4.\n\n" +
-        "STEP 4: Verify.\n" +
+        "Then publish: python3 ~/workspace/skills/npm/bin/npm-publish.py " + REPO_PATH + "/muse-crew-<new-version>.tgz\n" +
+        "If publish fails with 'You cannot publish over the previously published versions', <new-version> is already on the registry (a retried Publish — the merge lock guarantees no other task picked this version): continue to STEP 6 verification. Any other publish failure: set passed to false with the failure details.\n\n" +
+        "STEP 6: Verify.\n" +
         "Run: npm view muse-crew version\n" +
-        "Confirm it matches the local package.json version.\n\n" +
-        "STEP 5: Finalize.\n" +
+        "It must equal <new-version>. If not, set passed to false with the mismatch details.\n\n" +
+        "STEP 7: Push the version-bump commit: cd " + REPO_PATH + " && git push origin main. Never use --force.\n\n" +
+        "STEP 8: Finalize.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, finalization is complete.\n\n" +
+        "Do NOT compare the local package.json version to the registry version: with versions assigned at publish time, local==registry is the normal steady state before assignment — not a signal to skip. Execute every step above.\n\n" +
+        "End your summary with exactly this line: published: muse-crew@<new-version>\n\n" +
         "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true }.\n" +
         "No prose, no markdown, just the JSON object.";
     } else if (PUBLISH_TYPE === "artifact") {
@@ -288,9 +353,12 @@ while (i < STEPS.length) {
     }
   }
 
-  // Task event history — all phases except Review see the comment log
+  // Task event history — Review and Publish are excluded. Review is cold by
+  // design; Publish receives its release decision deterministically from the
+  // workflow, and prior rounds' history contains the exact skip deviation being
+  // eliminated — agents imitate recorded precedent.
   var eventPreamble = "";
-  if (step.name !== "Review") {
+  if (step.name !== "Review" && step.name !== "Publish") {
     eventPreamble = "CONTEXT: First, fetch this task's event history for background.\n" +
       "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getevents\", args: { \"task_id\": \"" + taskId + "\" }.\n" +
       "The returned events are filtered to this task. They contain notes and decisions from prior phases.\n\n";
@@ -346,6 +414,13 @@ while (i < STEPS.length) {
     mapperSpec = summary;
   }
 
+  // Capture the accepted Build summary's machine-readable release decision.
+  // Parsed from the RAW summary (before the 2000-char slice above) — the
+  // release:/version_bump: lines sit at the very end and must survive truncation.
+  if (step.name === "Build" && passed) {
+    releaseDecision = extractReleaseDecision(stepResult.summary || "");
+  }
+
   await agent(
     "Update session and log event.\n" +
     "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"upsertagentsession\", args:\n" +

package/workflows/crew-dispatch.js

@@ -83,8 +83,10 @@ const allTasks = boardResult.ready_tasks || [];
 const config = boardResult.config || {};
 const projects = boardResult.projects || [];
 
-// Default project: explicit arg, or first registered project
-const DEFAULT_PROJECT = inputs.defaultProject || (projects.length > 0 ? projects[0].id : "");
+// Default project: explicit arg wins, then the dashboard's configured default
+// project (config.default_project — set by crew-init or the dashboard UI),
+// then the first registered project as a last resort.
+const DEFAULT_PROJECT = inputs.defaultProject || config.default_project || (projects.length > 0 ? projects[0].id : "");
 
 // Per-project quiesce: build a set of quiesced project IDs
 const quiescedProjects = {};
@@ -290,7 +292,7 @@ for (var p = 0; p < toProcess.length; p++) {
     crewHome: crewHome
   };
 
-  log("Claimed " + iworkflow + " for \"" + itask.title + "\" at step " + nextStepName);
+  log("Claimed " + iworkflow + " for \"" + itask.title + "\" [" + taskProject + "] at step " + nextStepName);
   results.push({ task_id: itask.id, workflow: iworkflow, step: nextStepName, action: "claimed", scriptPath: scriptPath, args: launchArgs });
 }
 

package/workflows/crew-init.js

@@ -145,6 +145,39 @@ try {
 }
 log("Project: " + (projectResult.registered ? "registered" : "failed"));
 
+// ── Phase 3b: Set the dashboard's project as the default ─────────────
+// The CLI takes the project implicitly from the dashboard's configured
+// default (config.default_project). Idempotent: setdefaultproject upserts.
+phase("default-project");
+var defaultProjectResult;
+try {
+  defaultProjectResult = await agent(
+    "Set the dashboard's default project to the dashboard itself.\\n\\n" +
+    "Dashboard slug: " + dashboardSlug + "\\n\\n" +
+    "Steps:\\n" +
+    "1. Call artifact_invoke_action with:\\n" +
+    "   slug: '" + dashboardSlug + "'\\n" +
+    "   action_name: 'setdefaultproject'\\n" +
+    "   args: { project_id: '" + dashboardSlug + "' }\\n" +
+    "2. Return { defaulted: true } on success.\\n\\n" +
+    "Return JSON with defaulted (boolean).",
+    {
+      key: "project-2",
+      label: "Set default project",
+      schema: {
+        type: "object",
+        properties: {
+          defaulted: { type: "boolean" }
+        },
+        required: ["defaulted"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Default project could not be set", message: String(e.message || e) } };
+}
+log("Default project: " + (defaultProjectResult.defaulted ? "set" : "failed"));
+
 // ── Phase 4: Polling cron ─────────────────────────────────────────────
 // The cron body template lives in the repo at seed/cron-body-template.md.
 // Placeholders: {crewHome}, {dashboardSlug} are replaced with actual values.

package/workflows/standard.js

@@ -77,6 +77,24 @@ const MAX_TOTAL_REWORK = 2;
 let totalReworkCount = 0;
 let rejectionNotes = inputs.rejection_notes || "";
 let mapperSpec = "";
+// Merge-time versioning: the release decision is extracted deterministically
+// from the accepted Build summary (extractReleaseDecision) so the Publish
+// agent never decides whether to publish. Two consecutive Publish runs
+// rationalized a skip against explicit instruction text — text alone did not
+// hold, so the decision now lives in workflow code, not agent judgment.
+let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"minor"|"major"|null }
+function extractReleaseDecision(text) {
+  const t = text || "";
+  const r = /^release:\s*(yes|no)\s*$/im.exec(t);
+  if (!r) return null;
+  const b = /^version_bump:\s*(patch|minor|major)\s*$/im.exec(t);
+  if (r[1].toLowerCase() === "yes" && !b) return null;
+  return { release: r[1].toLowerCase(), version_bump: b ? b[1].toLowerCase() : null };
+}
+function releaseDecisionText() {
+  if (!releaseDecision) return "no parseable release:/version_bump: decision";
+  return "release: " + releaseDecision.release + (releaseDecision.version_bump ? ", version_bump: " + releaseDecision.version_bump : " (no version_bump line)");
+}
 let i = startStepIndex;
 
 // ── Pin lifecycle scripts ────────────────────────────────────────────
@@ -158,6 +176,28 @@ while (i < STEPS.length) {
     return { status: "blocked", task_id: taskId, reason: "Unknown publish target '" + PUBLISH_TYPE + "' — expected 'npm', 'artifact', 'vercel', or empty (skip publish)." };
   }
 
+  // Merge-time versioning, decided deterministically: the release decision was
+  // extracted from the accepted Build summary above. release: no never reaches
+  // the Publish agent (the workflow skips it here, exactly like the no-target
+  // case); an unparseable decision blocks fail-closed. The Publish agent below
+  // therefore has no decision point to rationalize into a skip.
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm") {
+    if (!releaseDecision) {
+      return { status: "blocked", task_id: taskId, reason: "Build summary has no parseable release:/version_bump: lines — cannot assign version at publish time." };
+    }
+    if (releaseDecision.release === "no") {
+      log("Publish skipped for task " + taskId + " — accepted Build summary declared release: no");
+      await agent(
+        "Release the merge lock and clean up without publishing.\n" +
+        "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
+        "If the output contains DEPLOYED, the lock is released and the worktree is cleaned up.",
+        { key: "publish-skip-release-no", label: "Skipping Publish (release: no)", schema: { type: "object" } }
+      );
+      i++;
+      continue;
+    }
+  }
+
   // Claim session — reuse dispatcher's session for the very first step
   let activeSessionId;
   if (isFirstClaim && firstSessionId) {
@@ -202,11 +242,15 @@ while (i < STEPS.length) {
       "Edit source files directly. Do NOT use artifact_edit — that happens in the Publish phase.\n" +
       "Do not add unrequested features. Build exactly what the spec calls for.\n" +
       "PUBLIC DOCS: If your change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), update the public docs in the same commit — API.md for API changes. Documentation and implementation ship together.\n\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, so you choose the package version. If this change warrants a published release (anything a consumer can observe: workflow behavior, phase lists, identities, published docs, API), bump the version in package.json with semver (patch for fixes, minor for new behavior, major for breaking changes) and state the chosen version and why in your summary. If the change is internal-only, leave the version unchanged and say so. Check the registry first — npm view muse-crew version — and never re-publish an existing version.\n\n" : "") +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry. Versions are assigned at PUBLISH time — never in your branch. Do NOT touch the `version` field in package.json (or package-lock). Instead, end your summary with exactly these two lines:\n" +
+      "release: yes|no — 'yes' if this change warrants a published release (anything a consumer can observe: workflow behavior, phase lists, identities, published docs, API); 'no' if internal-only.\n" +
+      "version_bump: patch|minor|major — patch for fixes (default), minor for new behavior, major for breaking changes. Omit this line only when release is no.\n" +
+      "Example: release: yes\\nversion_bump: minor\n\n" : "") +
       "STEP 3: Commit your changes.\n" +
       "cd " + REPO_PATH + "/.worktrees/" + taskId + "\n" +
       "git add -A\n" +
       "git commit -m \"" + safeTitle + "\"\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your summary, naming the runtime-state deliverable. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "This is REWORK after rejection. Address these specific issues:\n" + rejectionNotes + "\n\n" : "") +
       "Your final response MUST be valid JSON and nothing else: { \"summary\": \"what you built\", \"passed\": true }. No prose, no markdown, just the JSON object.";
 
@@ -220,7 +264,13 @@ while (i < STEPS.length) {
       REPO_PATH + "/.worktrees/" + taskId + "/\n\n" +
       "Check quality, correctness, and spec compliance.\n" +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, reject with notes on what is stale.\n" +
-      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry. Validate the builder's version choice: package.json must hold valid semver; if the version was bumped it must be greater than the registry version (npm view muse-crew version), the bump scope (patch/minor/major) must fit the change, and exactly one version field may change. If the version is invalid, already published, or mis-scoped, reject with notes.\n" : "") +
+      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with a plausible runtime-state deliverable (e.g. a cron created via the cron tool). Otherwise reject: 'no commits ahead of main and no repo_diff: none declaration — the builder likely forgot to commit'.\n" +
+      (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
+      "(a) The task branch must NOT have changed package.json's `version` field. Check: cd " + REPO_PATH + " && git diff main...task/" + taskId + " -- package.json. If the branch touched `version` in any way, REJECT with notes: 'versions are assigned at publish time, never in branches — remove the version change'.\n" +
+      "(b) The accepted Build summary declares: " + releaseDecisionText() + ". " +
+      (releaseDecision
+        ? "Validate this decision against the change: release must be 'yes' when the change is consumer-observable and 'no' when internal-only; the version_bump scope must fit the change (patch for fixes, minor for new behavior, major for breaking changes). If the decision is wrong or mis-scoped, reject with notes."
+        : "The decision is missing or malformed — REJECT with notes: 'Build summary must end with release: yes|no and (when release is yes) version_bump: patch|minor|major lines'.") + "\n" : "") +
       "If the work passes review, your final response MUST be valid JSON and nothing else: { \"passed\": true, \"summary\": \"approval notes\" }.\n" +
       "If the work fails review, your final response MUST be valid JSON and nothing else: { \"passed\": false, \"summary\": \"rejection notes explaining what needs to change\" }.\n" +
       "No prose, no markdown, just the JSON object.";
@@ -230,8 +280,17 @@ while (i < STEPS.length) {
       "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " integrate " + taskId + " \"merge: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
+      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Set passed to true with summary 'merged empty: no repo changes — deliverable was runtime state'. SKIP STEP 2 (push): there is no new commit to push.\n" +
       "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish). Set passed to false with summary 'merge lock held'.\n" +
-      "- If it contains CONFLICT, a merge conflict occurred. Set passed to false with the conflict details.\n" +
+      "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
+      "RESOLUTION:\n" +
+      "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge task/" + taskId + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch task/" + taskId + " is never modified.\n" +
+      "R2. For each conflicted file, read the three sides: git show :1:<file> (base), git show :2:<file> (ours = main), git show :3:<file> (theirs = task branch). Resolve each hunk by keeping both sides' changes when they do not semantically overlap. Version-only hunks resolve to the higher semver (safety net). Never invent new behavior. Leave no markers.\n" +
+      "R3. Verify in the scratch worktree, in this order: (a) git diff --check is clean; (b) git grep -n '^<<<<<<<' -- . returns nothing; (c) node --check every changed .js file (conflicted files plus everything listed by git diff --name-only). If any check fails, refresh the merge lock (CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "), then retry the resolution using the failure output as context — max 3 attempts total.\n" +
+      "R4. Commit the resolution on resolve/" + taskId + ": git add -A && git commit -m \"resolve conflicts: " + taskId + "\".\n" +
+      "R5. Back in " + REPO_PATH + ": git checkout main && git merge --ff-only resolve/" + taskId + ". This fast-forwards — main has not moved while the lock was held. Then STEP 2 applies: git push origin main. Report the merged commit hash.\n" +
+      "R6. Clean up: cd " + REPO_PATH + " && git worktree remove --force /tmp/crew-resolve-" + taskId + " && git branch -D resolve/" + taskId + ".\n" +
+      "ESCALATE — return {\"passed\": false, \"summary\": \"conflict needs human resolution\"} — when: 3 attempts are exhausted; the conflict touches generated files, migrations, or public API contracts; or 'looks right + checks pass' is not sufficient for any other reason. On escalation, RELEASE THE LOCK so the task can be reworked later: run CREW_REPO=" + REPO_PATH + " " + MERGE_LOCK + " release " + taskId + " (release is keyed on task id; no PID needed). Do NOT run post-deploy on escalation — it would delete the untouched task branch the human still needs.\n" +
       "- If it contains ERROR, something else failed. Set passed to false with the error.\n\n" +
       "\n" +
       "STEP 2: Push the merged main to the remote repository.\n" +
@@ -245,28 +304,34 @@ while (i < STEPS.length) {
   } else if (step.name === "Publish") {
     if (PUBLISH_TYPE === "npm") {
       // npm packages: immutable release + pack + publish to the registry (push is universal in Integrate)
+      // The release decision arrived deterministically from the workflow (release: yes) —
+      // these steps are unconditional. There is no decision to make and no skip path.
       instructions = "Publish the npm package to the registry.\n\n" +
-        "The repo push already happened in Integrate — do NOT push to git in this phase, and NEVER force-push.\n" +
-        "Version discipline: publish ships the exact version merged in Integrate (Build applied it, Review validated it). Do not bump the version here.\n\n" +
+        "The release decision is already made and recorded — it is not yours to make: the accepted Build summary (validated by Review) declares " + releaseDecisionText() + ". Execute every step below in order.\n\n" +
+        "The repo push already happened in Integrate — do NOT push to git in this phase except STEP 7, and NEVER force-push.\n\n" +
         "STEP 0: Refresh the merge lock to prevent stale-lock breaking during publish.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " refresh-lock " + taskId + "\n\n" +
         "STEP 1: Install and activate the immutable release.\n" +
         "Run: " + RELEASE_SCRIPT + " deploy " + REPO_PATH + "\n" +
         "Verify the output contains INSTALLED and ACTIVATED (or EXISTS and ACTIVATED if unchanged).\n\n" +
-        "STEP 2: Check whether the package version needs publishing.\n" +
-        "Read the version from: cd " + REPO_PATH + " && node -p \"require('./package.json').version\"\n" +
-        "Check the registry: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
-        "If the local version matches the registry version, the version is already live — skip to STEP 5.\n\n" +
-        "STEP 3: Pack and publish.\n" +
+        "STEP 2: Read the registry base version.\n" +
+        "Run: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
+        "If NOT_FOUND, use the local package.json version as the base instead.\n\n" +
+        "STEP 3: Apply the version_bump scope (" + releaseDecision.version_bump + ") to the base version: patch increments the last segment; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0. Example: base 1.2.3 + minor → 1.3.0. Call the result <new-version>.\n" +
+        "STEP 4: Write <new-version> into package.json (only the `version` field), then commit it under the still-held merge lock: cd " + REPO_PATH + " && git add package.json && git commit -m \"release: muse-crew@<new-version>\". The lock serializes Publish per repo, so two tasks can never pick the same version.\n" +
+        "STEP 5: Pack and publish.\n" +
         "Run: cd " + REPO_PATH + " && npm pack\n" +
-        "Then publish: python3 ~/workspace/skills/npm/bin/npm-publish.py " + REPO_PATH + "/muse-crew-$(node -p \"require('" + REPO_PATH + "/package.json').version\").tgz\n" +
-        "If publish fails with 'You cannot publish over the previously published versions', the version is already live — continue to STEP 4.\n\n" +
-        "STEP 4: Verify.\n" +
+        "Then publish: python3 ~/workspace/skills/npm/bin/npm-publish.py " + REPO_PATH + "/muse-crew-<new-version>.tgz\n" +
+        "If publish fails with 'You cannot publish over the previously published versions', <new-version> is already on the registry (a retried Publish — the merge lock guarantees no other task picked this version): continue to STEP 6 verification. Any other publish failure: set passed to false with the failure details.\n\n" +
+        "STEP 6: Verify.\n" +
         "Run: npm view muse-crew version\n" +
-        "Confirm it matches the local package.json version.\n\n" +
-        "STEP 5: Finalize.\n" +
+        "It must equal <new-version>. If not, set passed to false with the mismatch details.\n\n" +
+        "STEP 7: Push the version-bump commit: cd " + REPO_PATH + " && git push origin main. Never use --force.\n\n" +
+        "STEP 8: Finalize.\n" +
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, finalization is complete.\n\n" +
+        "Do NOT compare the local package.json version to the registry version: with versions assigned at publish time, local==registry is the normal steady state before assignment — not a signal to skip. Execute every step above.\n\n" +
+        "End your summary with exactly this line: published: muse-crew@<new-version>\n\n" +
         "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true }.\n" +
         "No prose, no markdown, just the JSON object.";
     } else if (PUBLISH_TYPE === "artifact") {
@@ -303,6 +368,12 @@ while (i < STEPS.length) {
         "No prose, no markdown, just the JSON object.";
     }
   } else if (step.name === "QA") {
+    // Backstop for merge-time versioning: when the accepted Build summary
+    // declared release: yes, QA verifies the registry actually moved. A silent
+    // publish skip becomes a loud QA failure with evidence, not a pass.
+    var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
+      ? "NPM PUBLISH CHECK: the accepted Build summary declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and extract its `published: muse-crew@<version>` line from the session notes (the Publish agent ends its summary with exactly that line — event history does NOT carry it). Then run: npm view muse-crew version. The registry version MUST equal the published version. If there is no completed Publish session with a published: line, or the registry version does not match, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: [details]\" }.\n"
+      : "";
     if (PUBLISH_TYPE === "artifact") {
       var safeDesc = taskDescription.replace(/"/g, "'").replace(/\\/g, "\\\\").slice(0, 500);
       instructions = "You are code-blind QA. You NEVER read source files.\n" +
@@ -332,14 +403,18 @@ while (i < STEPS.length) {
         "Verify the change is working as described in the task.\n" +
         "DOCS GATE: If the change is public-affecting (it alters anything a user or consumer can observe: API actions, parameters, behavior, or errors), verify the public docs describe it. If public docs are missing or stale, FAIL with { \"passed\": false, \"summary\": \"public docs missing/stale for [the change]\" }. QA always fails when public-affecting changes lack public docs. Guide/tutorial gaps are lower priority — file a follow-up task for those instead of failing.\n" +
         "File follow-up tasks via artifact_invoke_action createtask on slug \"" + DASHBOARD_SLUG + "\" for related issues found.\n\n" +
+        npmPublishCheck +
         "Your final response MUST be valid JSON and nothing else: { \"passed\": true/false, \"summary\": \"what you tested and found\" }.\n" +
         "No prose, no markdown, just the JSON object.";
     }
   }
 
-  // Task event history — all phases except Review see the comment log
+  // Task event history — Review and Publish are excluded. Review is cold by
+  // design; Publish receives its release decision deterministically from the
+  // workflow, and prior rounds' history contains the exact skip deviation being
+  // eliminated — agents imitate recorded precedent.
   var eventPreamble = "";
-  if (step.name !== "Review") {
+  if (step.name !== "Review" && step.name !== "Publish") {
     eventPreamble = "CONTEXT: First, fetch this task's event history for background.\n" +
       "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getevents\", args: { \"task_id\": \"" + taskId + "\" }.\n" +
       "The returned events are filtered to this task. They contain notes and decisions from prior phases.\n\n";
@@ -401,6 +476,13 @@ while (i < STEPS.length) {
     mapperSpec = summary;
   }
 
+  // Capture the accepted Build summary's machine-readable release decision.
+  // Parsed from the RAW summary (before the 2000-char slice above) — the
+  // release:/version_bump: lines sit at the very end and must survive truncation.
+  if (step.name === "Build" && passed) {
+    releaseDecision = extractReleaseDecision(stepResult.summary || "");
+  }
+
   // Record session result
   await agent(
     "Update the session and log the event.\n" +