muse-crew 0.4.4 → 0.4.6

package/workflows/standard.js

@@ -36,6 +36,9 @@ const PUBLISH_NPM_SRC = crewHome + "/lib/publish-npm.sh";
 const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
 const ORPHAN_SWEEP_SRC = crewHome + "/lib/orphan-sweep.sh";
 const ORPHAN_SWEEP = RUN_LIB + "/orphan-sweep.sh";
+// The four basenames the pin step must materialize — asserted mechanically
+// by workflow code from the verbatim listing, never from agent prose.
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, ORPHAN_SWEEP].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -172,6 +175,27 @@ function workRetryKey(stepName, reworkSuffix, attempt) {
 function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
+// pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the four pinned
+// basenames; the agent cannot self-certify. (The pin step was the one place
+// the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
+// empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
+// tests/pin-location.test.js.
+function pinLifecycle(key) {
+  return agent(
+    "Snapshot lifecycle scripts for version pinning.\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + ORPHAN_SWEEP_SRC + " " + ORPHAN_SWEEP + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " " + ORPHAN_SWEEP + " && ls -1 " + RUN_LIB + "\n" +
+    "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
+    { key: key, label: "Pinning lifecycle scripts",
+      schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
+  );
+}
+// parsePinListing(result) — basenames from a pin/verify listing.
+// Byte-identical across standard/bugfix/chore — pinned by
+// tests/pin-location.test.js.
+function parsePinListing(result) {
+  return (result && result.listing ? result.listing : "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+}
 function buildTransportRetryTrailer(stepName, repoPath, taskId, attempt, reason) {
   // reason: "discarded" (the runtime threw the output away — it could not be
   // machine-read) or "empty" (agent() returned without throwing but produced
@@ -475,21 +499,22 @@ let i = startStepIndex;
 
 // ── Pin lifecycle scripts ────────────────────────────────────────────
 // Copy lifecycle scripts into a per-task temp dir so this run is immune
-// to upgrades that land while it's in flight.
-await agent(
-  "Snapshot lifecycle scripts for version pinning.\n" +
-  "Run these shell commands:\n" +
-  "  mkdir -p " + RUN_LIB + "\n" +
-  "  cp " + LIFECYCLE_SRC + " " + LIFECYCLE + "\n" +
-  "  cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + "\n" +
-  "  cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + "\n" +
-  "  cp " + ORPHAN_SWEEP_SRC + " " + ORPHAN_SWEEP + "\n" +
-  "  chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " " + ORPHAN_SWEEP + "\n" +
-  "Confirm the files exist by listing " + RUN_LIB + ".",
-  { key: "pin-lifecycle", label: "Pinning lifecycle scripts", schema: { type: "object" } }
-);
+// to upgrades that land while it's in flight. Verified mechanically:
+// workflow code asserts the four basenames from the verbatim listing —
+// the agent cannot self-certify. Any miss parks the task before Triage.
+const initialPins = parsePinListing(await pinLifecycle("pin-lifecycle"));
+const missingInitialPins = PIN_BASENAMES.filter(function (b) { return initialPins.indexOf(b) === -1; });
+if (missingInitialPins.length > 0) {
+  return await parkTask("Lifecycle pin incomplete before Triage — missing " + missingInitialPins.join(", ") + " in " + RUN_LIB + ".");
+}
 log("Lifecycle scripts pinned to " + RUN_LIB);
 
+// Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
+// minted at this run's first claim (never a PID — short-lived agent PIDs
+// made every concurrent acquire take the stale path). Set exactly once on
+// the first claim; stable for the rest of the run's lifetime.
+let lockHolder = taskId;
+
 while (i < STEPS.length) {
   const step = STEPS[i];
   const isFirstClaim = (i === startStepIndex && totalReworkCount === 0);
@@ -534,6 +559,33 @@ while (i < STEPS.length) {
     }
   }
 
+  // ── Pre-Publish pin guard ──────────────────────────────────────────
+  // Verify the pinned lifecycle scripts still exist on every Publish
+  // pass (first pass and rework passes): the pin step trusted agent
+  // prose instead of a mechanical check, so task 24be1cd6 walked to
+  // Publish on an empty pin dir. One re-pin and re-verify on a miss;
+  // still missing parks the task. Keys are attemptKey-scoped so a
+  // rework Publish never re-mints a first-pass key.
+  if (step.name === "Publish") {
+    let publishPins = parsePinListing(await agent(
+      "Verify the pinned lifecycle scripts are present.\n" +
+      "Run: ls -1 " + RUN_LIB + " 2>/dev/null || echo PIN_DIR_MISSING\n" +
+      "Return the verbatim output as { \"listing\": \"<verbatim output>\" } and nothing else.",
+      { key: attemptKey("pins-verify-publish", totalReworkCount), label: "Verifying pinned lifecycle scripts",
+        schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
+    ));
+    let missingAtPublish = PIN_BASENAMES.filter(function (b) { return publishPins.indexOf(b) === -1; });
+    if (missingAtPublish.length > 0) {
+      log("Pin guard at Publish: missing " + missingAtPublish.join(", ") + " — re-pinning once");
+      publishPins = parsePinListing(await pinLifecycle(attemptKey("pin-lifecycle-republish", totalReworkCount)));
+      missingAtPublish = PIN_BASENAMES.filter(function (b) { return publishPins.indexOf(b) === -1; });
+    }
+    if (missingAtPublish.length > 0) {
+      return await parkTask("Pinned lifecycle scripts missing at Publish even after re-pin: " + missingAtPublish.join(", ") + " in " + RUN_LIB + ".");
+    }
+    log("Pin guard: all four lifecycle scripts present at Publish");
+  }
+
   // Publish is optional and target-based. Empty target = prototyping project: skip the phase.
   // Unknown target (incl. legacy "repo") = config error: block.
   if (step.name === "Publish" && !PUBLISH_TYPE) {
@@ -646,6 +698,13 @@ while (i < STEPS.length) {
     activeSessionId = claimResult.session_id;
   }
 
+  // Mint the merge-lock holder identity once: task+session of this run's
+  // first claim. The task ID alone cannot distinguish two runs of the same
+  // task (re-dispatch after park), and a PID is not a valid holder at all.
+  if (lockHolder === taskId && activeSessionId) {
+    lockHolder = taskId + "/" + activeSessionId;
+  }
+
   // ── Capture: baseline evidence for experiential tasks ─────────────
   // Hazel's QA capture pass runs right after Triage, before Map, for tasks
   // Sage flagged experiential. The capture itself is parent-driven (the
@@ -814,11 +873,11 @@ while (i < STEPS.length) {
 
   } else if (step.name === "Integrate") {
     instructions = "Merge the approved task branch into main.\n\n" +
-      "Run: "+ LIFECYCLE_ENV + " integrate " + taskId + " \"merge: " + safeTitle + "\"\n\n" +
+      "Run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " integrate " + taskId + " \"merge: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
       "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
-      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish). Report 'merge lock held', then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish) and the 10-minute bounded backoff is exhausted. Report 'merge lock held after bounded backoff', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
       "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
@@ -906,14 +965,46 @@ while (i < STEPS.length) {
         }
         var publishFailure = null;
         if (rebuildTrigger.edit_started) {
-          // STEP 1b (mechanical): bounded poll for build completion.
-          var buildPoll = await agent(
-            "Poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 20 checks (10 minutes max).\n" +
-            "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
-            { key: attemptKey("publish-artifact-poll-" + taskId, totalReworkCount), label: "Waiting for artifact build to complete",
-              schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
-              timeoutMs: 660000 }
-          );
+          // STEP 1b (mechanical): bounded poll for build completion, chunked so
+          // the merge-lock lease is refreshed before it can expire. The 600s
+          // lease is shorter than the worst-case 10-minute build poll, so the
+          // poll runs in three chunks (7 checks x 30s ~= 3.5 min each) with a
+          // holder-only lease refresh between chunks. If a refresh fails, the
+          // lock was lost: stop the run and park the task — never continue to
+          // a provenance stamp or version assignment without holding the lock.
+          var buildPoll = null;
+          for (var chunk = 1; chunk <= 3; chunk++) {
+            if (chunk > 1) {
+              var refreshPoll = await agent(
+                "Refresh the merge lock for task " + taskId + ".\n" +
+                "Run: " + LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
+                "If the output contains REFRESHED, return JSON { \"held\": true } and nothing else. Otherwise return JSON { \"held\": false, \"output\": \"<verbatim output>\" } and nothing else.",
+                { key: attemptKey("publish-lock-refresh-poll-" + taskId + "-c" + chunk, totalReworkCount), label: "Refreshing merge lock during build poll",
+                  schema: { type: "object", properties: { held: { type: "boolean" }, output: { type: "string" } }, required: ["held"] },
+                  timeoutMs: 60000 }
+              );
+              if (!refreshPoll || refreshPoll.held !== true) {
+                return await parkTask("Merge-lock lease lost during the artifact build poll (refresh before chunk " + chunk + " of 3 failed: " + ((refreshPoll && refreshPoll.output) || "no output") + "). Fail-closed: stopping before any provenance stamp or version assignment.");
+              }
+            }
+            // Chunk 1 keeps the original stable key; later chunks use -c<N>
+            // suffixed keys. All are attemptKey-scoped so rework passes stay
+            // disjoint (replay-key contract).
+            var pollKey = (chunk === 1)
+              ? attemptKey("publish-artifact-poll-" + taskId, totalReworkCount)
+              : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, totalReworkCount);
+            buildPoll = await agent(
+              "Poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 7 checks (3.5 minutes max).\n" +
+              "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
+              { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
+                timeoutMs: 270000 }
+            );
+            if (buildPoll && buildPoll.build_done) { break; }
+          }
+          if (!buildPoll || !buildPoll.build_done) {
+            buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
+          }
           if (buildPoll.build_done) {
             // STEP 1c (mechanical): stamp provenance from workflow-computed values.
             var provStamp = await agent(