muse-crew 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -320,6 +320,7 @@ while (i < STEPS.length) {
         "Run: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
         "If NOT_FOUND, use the local package.json version as the base instead.\n\n" +
         "STEP 3: Apply the version_bump scope (" + releaseDecision.version_bump + ") to the base version: patch increments the last segment; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0. Example: base 1.2.3 + minor → 1.3.0. Call the result <new-version>.\n" +
+        "STEP 3B: Make the version math auditable. State the computed target version explicitly — your summary MUST include the line: TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (example: TARGET_VERSION=0.3.1 computed as 0.3.0 + patch → 0.3.1). Every later step uses exactly this version. Do not improvise the arithmetic: 0.3.0 + patch is 0.3.1, never 0.4.0.\n" +
         "STEP 4: Write <new-version> into package.json (only the `version` field), then commit it under the still-held merge lock: cd " + REPO_PATH + " && git add package.json && git commit -m \"release: muse-crew@<new-version>\". The lock serializes Publish per repo, so two tasks can never pick the same version.\n" +
         "STEP 5: Pack and publish.\n" +
         "Run: cd " + REPO_PATH + " && npm pack\n" +
@@ -333,7 +334,9 @@ while (i < STEPS.length) {
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, finalization is complete.\n\n" +
         "Do NOT compare the local package.json version to the registry version: with versions assigned at publish time, local==registry is the normal steady state before assignment — not a signal to skip. Execute every step above.\n\n" +
-        "End your summary with exactly this line: published: muse-crew@<new-version>\n\n" +
+        "End your summary with exactly these two lines, in this order — lowercase, no trailing period, do not rephrase (the QA backstop extracts them by pattern):\n" +
+        "TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version>\n" +
+        "published: muse-crew@<new-version>\n\n" +
         "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true }.\n" +
         "No prose, no markdown, just the JSON object.";
     } else if (PUBLISH_TYPE === "artifact") {
@@ -374,7 +377,10 @@ while (i < STEPS.length) {
     // declared release: yes, QA verifies the registry actually moved. A silent
     // publish skip becomes a loud QA failure with evidence, not a pass.
     var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
-      ? "NPM PUBLISH CHECK: the accepted Build summary declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and extract its `published: muse-crew@<version>` line from the session notes (the Publish agent ends its summary with exactly that line — event history does NOT carry it). Then run: npm view muse-crew version. The registry version MUST equal the published version. If there is no completed Publish session with a published: line, or the registry version does not match, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: [details]\" }.\n"
+      ? "NPM PUBLISH CHECK: the accepted Build summary declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
+      "Extract the line matching TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version>. If the line is missing, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: Publish summary did not echo its computed target version (STEP 3B)\" }.\n" +
+      "Verify the bump SCOPE: the <scope> in that line MUST equal the accepted version_bump scope \"" + releaseDecision.version_bump + "\" — if the Publish agent applied a different scope, FAIL. Verify the ARITHMETIC: <base> + <scope> must equal <new-version> (patch increments the last segment only, e.g. 0.3.0 + patch → 0.3.1; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0) — if the math is wrong, FAIL.\n" +
+      "Extract the published version from the notes line matching published: muse-crew@<version> (match case-insensitively and ignore any trailing period — agents sometimes rephrase it). It MUST equal <new-version> from the TARGET_VERSION line. Then run: npm view muse-crew version. The registry version MUST equal <new-version>. If any of these checks fails, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: [details]\" }.\n"
       : "";
     instructions = "Final QA testing. You are CODE-BLIND — do NOT read source code.\n" +
       "Public docs (API.md, README, published action schemas) are NOT source code — read them freely, exactly as a user would.\n" +

package/workflows/chore.js

@@ -302,6 +302,7 @@ while (i < STEPS.length) {
         "Run: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
         "If NOT_FOUND, use the local package.json version as the base instead.\n\n" +
         "STEP 3: Apply the version_bump scope (" + releaseDecision.version_bump + ") to the base version: patch increments the last segment; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0. Example: base 1.2.3 + minor → 1.3.0. Call the result <new-version>.\n" +
+        "STEP 3B: Make the version math auditable. State the computed target version explicitly — your summary MUST include the line: TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (example: TARGET_VERSION=0.3.1 computed as 0.3.0 + patch → 0.3.1). Every later step uses exactly this version. Do not improvise the arithmetic: 0.3.0 + patch is 0.3.1, never 0.4.0.\n" +
         "STEP 4: Write <new-version> into package.json (only the `version` field), then commit it under the still-held merge lock: cd " + REPO_PATH + " && git add package.json && git commit -m \"release: muse-crew@<new-version>\". The lock serializes Publish per repo, so two tasks can never pick the same version.\n" +
         "STEP 5: Pack and publish.\n" +
         "Run: cd " + REPO_PATH + " && npm pack\n" +
@@ -315,7 +316,9 @@ while (i < STEPS.length) {
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, finalization is complete.\n\n" +
         "Do NOT compare the local package.json version to the registry version: with versions assigned at publish time, local==registry is the normal steady state before assignment — not a signal to skip. Execute every step above.\n\n" +
-        "End your summary with exactly this line: published: muse-crew@<new-version>\n\n" +
+        "End your summary with exactly these two lines, in this order — lowercase, no trailing period, do not rephrase (the QA backstop extracts them by pattern):\n" +
+        "TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version>\n" +
+        "published: muse-crew@<new-version>\n\n" +
         "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true }.\n" +
         "No prose, no markdown, just the JSON object.";
     } else if (PUBLISH_TYPE === "artifact") {

package/workflows/standard.js

@@ -318,6 +318,7 @@ while (i < STEPS.length) {
         "Run: npm view muse-crew version 2>/dev/null || echo NOT_FOUND\n" +
         "If NOT_FOUND, use the local package.json version as the base instead.\n\n" +
         "STEP 3: Apply the version_bump scope (" + releaseDecision.version_bump + ") to the base version: patch increments the last segment; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0. Example: base 1.2.3 + minor → 1.3.0. Call the result <new-version>.\n" +
+        "STEP 3B: Make the version math auditable. State the computed target version explicitly — your summary MUST include the line: TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (example: TARGET_VERSION=0.3.1 computed as 0.3.0 + patch → 0.3.1). Every later step uses exactly this version. Do not improvise the arithmetic: 0.3.0 + patch is 0.3.1, never 0.4.0.\n" +
         "STEP 4: Write <new-version> into package.json (only the `version` field), then commit it under the still-held merge lock: cd " + REPO_PATH + " && git add package.json && git commit -m \"release: muse-crew@<new-version>\". The lock serializes Publish per repo, so two tasks can never pick the same version.\n" +
         "STEP 5: Pack and publish.\n" +
         "Run: cd " + REPO_PATH + " && npm pack\n" +
@@ -331,7 +332,9 @@ while (i < STEPS.length) {
         "Run: CREW_REPO=" + REPO_PATH + " " + LIFECYCLE + " post-deploy " + taskId + "\n" +
         "If the output contains DEPLOYED, finalization is complete.\n\n" +
         "Do NOT compare the local package.json version to the registry version: with versions assigned at publish time, local==registry is the normal steady state before assignment — not a signal to skip. Execute every step above.\n\n" +
-        "End your summary with exactly this line: published: muse-crew@<new-version>\n\n" +
+        "End your summary with exactly these two lines, in this order — lowercase, no trailing period, do not rephrase (the QA backstop extracts them by pattern):\n" +
+        "TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version>\n" +
+        "published: muse-crew@<new-version>\n\n" +
         "Your final response MUST be valid JSON and nothing else: { \"summary\": \"result\", \"passed\": true }.\n" +
         "No prose, no markdown, just the JSON object.";
     } else if (PUBLISH_TYPE === "artifact") {
@@ -372,7 +375,10 @@ while (i < STEPS.length) {
     // declared release: yes, QA verifies the registry actually moved. A silent
     // publish skip becomes a loud QA failure with evidence, not a pass.
     var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
-      ? "NPM PUBLISH CHECK: the accepted Build summary declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and extract its `published: muse-crew@<version>` line from the session notes (the Publish agent ends its summary with exactly that line — event history does NOT carry it). Then run: npm view muse-crew version. The registry version MUST equal the published version. If there is no completed Publish session with a published: line, or the registry version does not match, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: [details]\" }.\n"
+      ? "NPM PUBLISH CHECK: the accepted Build summary declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
+      "Extract the line matching TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version>. If the line is missing, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: Publish summary did not echo its computed target version (STEP 3B)\" }.\n" +
+      "Verify the bump SCOPE: the <scope> in that line MUST equal the accepted version_bump scope \"" + releaseDecision.version_bump + "\" — if the Publish agent applied a different scope, FAIL. Verify the ARITHMETIC: <base> + <scope> must equal <new-version> (patch increments the last segment only, e.g. 0.3.0 + patch → 0.3.1; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0) — if the math is wrong, FAIL.\n" +
+      "Extract the published version from the notes line matching published: muse-crew@<version> (match case-insensitively and ignore any trailing period — agents sometimes rephrase it). It MUST equal <new-version> from the TARGET_VERSION line. Then run: npm view muse-crew version. The registry version MUST equal <new-version>. If any of these checks fails, FAIL with { \"passed\": false, \"summary\": \"npm publish verification failed: [details]\" }.\n"
       : "";
     if (PUBLISH_TYPE === "artifact") {
       var safeDesc = taskDescription.replace(/"/g, "'").replace(/\\/g, "\\\\").slice(0, 500);