muse-crew 0.4.5 → 0.4.7

package/workflows/chore.js

@@ -468,6 +468,12 @@ if (missingInitialPins.length > 0) {
 }
 log("Lifecycle scripts pinned to " + RUN_LIB);
 
+// Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
+// minted at this run's first claim (never a PID — short-lived agent PIDs
+// made every concurrent acquire take the stale path). Set exactly once on
+// the first claim; stable for the rest of the run's lifetime.
+let lockHolder = taskId;
+
 while (i < STEPS.length) {
   const step = STEPS[i];
   const isFirstClaim = (i === startStepIndex && reworkCount === 0);
@@ -651,6 +657,13 @@ while (i < STEPS.length) {
     activeSessionId = claimResult.session_id;
   }
 
+  // Mint the merge-lock holder identity once: task+session of this run's
+  // first claim. The task ID alone cannot distinguish two runs of the same
+  // task (re-dispatch after park), and a PID is not a valid holder at all.
+  if (lockHolder === taskId && activeSessionId) {
+    lockHolder = taskId + "/" + activeSessionId;
+  }
+
   // ── Capture: baseline evidence for experiential tasks ─────────────
   // Hazel's QA capture pass runs right after Triage, before Map, for tasks
   // Sage flagged experiential. The capture itself is parent-driven (the
@@ -807,11 +820,11 @@ while (i < STEPS.length) {
 
   } else if (step.name === "Integrate") {
     instructions = "Merge the approved task branch into main.\n\n" +
-      "Run: "+ LIFECYCLE_ENV + " integrate " + taskId + " \"merge: chore: " + safeTitle + "\"\n\n" +
+      "Run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " integrate " + taskId + " \"merge: chore: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
       "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
-      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish). Report 'merge lock held', then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish) and the 10-minute bounded backoff is exhausted. Report 'merge lock held after bounded backoff', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
       "R1. Refresh the merge lock FIRST (a long resolution must not silently lose the lock to the orphan sweep): "+ LIFECYCLE_ENV + " refresh-lock " + taskId + ". Create a scratch worktree WITH A NEW BRANCH (main is already checked out in the repo checkout, so git forbids checking it out a second time): cd " + REPO_PATH + " && git worktree add -b resolve/" + taskId + " /tmp/crew-resolve-" + taskId + " main. Reproduce the conflict in the scratch worktree: cd /tmp/crew-resolve-" + taskId + " && git merge " + TASK_BRANCH + ". This reproduces the exact conflict (main has not moved — the lock was held throughout). The task branch " + TASK_BRANCH + " is never modified.\n" +
@@ -840,13 +853,17 @@ while (i < STEPS.length) {
       instructions = "Publish the npm package by running exactly ONE command — the deterministic publish script.\n" +
         "The release decision is already made and recorded: release: yes, version_bump: " + publishTarget.scope +
         ", target version " + publishTarget.target + " (computed as " + publishTarget.base + " + " + publishTarget.scope +
-        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make and no skip path.\n\n" +
+        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make; the script itself skips gracefully when no merge lock is held.\n\n" +
         "Run exactly this command and no other publish-related commands:\n" +
         "TASK_ID=" + taskId + " REPO_PATH=" + REPO_PATH + " PKG=muse-crew TARGET_VERSION=" + publishTarget.target +
         " CREW_HOME=" + crewHome + " LIFECYCLE=" + LIFECYCLE + " RELEASE_SCRIPT=" + RELEASE_SCRIPT +
         " bash " + PUBLISH_NPM + "\n\n" +
         "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
         "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -865,20 +882,34 @@ while (i < STEPS.length) {
       // getprovenance-vs-HEAD verification below stays as the final gate.
       var artifactPublish = null;
       var publishLockRefreshed = false;
+      var publishSkippedNoLock = false;
       try {
-        // STEP 0 (mechanical): refresh the merge lock so a long build cannot
-        // go stale mid-publish.
-        var lockRefresh = await agent(
-          "Run: "+ LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
-          "Return JSON { \"refreshed\": <true if the command exited zero, false otherwise>, \"output\": \"<trimmed stdout>\" } and nothing else.",
-          { key: attemptKey("publish-lock-refresh-" + taskId, reworkCount), label: "Refreshing merge lock for publish",
-            schema: { type: "object", properties: { refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["refreshed"] } }
+        // STEP 0 (mechanical): read the merge-lock state explicitly — never
+        // infer it from prose. An empty-diff Integrate (MERGED_EMPTY)
+        // intentionally takes no lock: nothing merged, nothing to ship. When
+        // no lock is held, Publish skips the publish path gracefully instead
+        // of failing closed on refresh-lock (park 2026-09-11).
+        var lockState = await agent(
+          "Run: "+ LIFECYCLE_ENV + " lock-status " + taskId + "\n" +
+          "If the output is exactly UNLOCKED, return JSON { \"state\": \"UNLOCKED\" } and run nothing else.\n" +
+          "Otherwise the lock is held: run "+ LIFECYCLE_ENV + " refresh-lock " + taskId + " (a long build must not silently lose the lock to the orphan sweep), then return JSON { \"state\": \"LOCKED\", \"refreshed\": <true if the refresh exited zero, false otherwise>, \"output\": \"<trimmed refresh stdout>\" } and nothing else.",
+          { key: attemptKey("publish-lock-refresh-" + taskId, reworkCount), label: "Reading merge lock state for publish",
+            schema: { type: "object", properties: { state: { type: "string" }, refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["state"] } }
         );
-        if (!lockRefresh.refreshed) {
-          return await parkTask("Publish lock refresh failed: " + (lockRefresh.output || "no output") + ". Fail-closed — lock state unknown.");
+        if ((lockState.state || "").trim() === "UNLOCKED") {
+          publishSkippedNoLock = true;
+          log("Publish skipped for task " + taskId + ": no merge lock held (empty-diff Integrate) — nothing to ship");
+        } else {
+          if (!lockState.refreshed) {
+            return await parkTask("Publish lock refresh failed: " + (lockState.output || "no output") + ". Fail-closed — lock state unknown.");
+          }
+          publishLockRefreshed = true;
         }
-        publishLockRefreshed = true;
-        // STEP 1 (mechanical): trigger the rebuild with one narrow call. The
+        // STEP 1 (mechanical): trigger the rebuild with one narrow call.
+        // Skipped entirely when no lock was held — nothing merged, nothing
+        // to ship.
+        if (!publishSkippedNoLock) {
+        // (below) the rebuild trigger, bounded poll, and provenance stamp
         // agent only makes the artifact_edit call and reports whether it was
         // accepted — no prose claim to trust. If the artifact tool namespace
         // is missing from this child it reports honestly and the workflow
@@ -899,14 +930,46 @@ while (i < STEPS.length) {
         }
         var publishFailure = null;
         if (rebuildTrigger.edit_started) {
-          // STEP 1b (mechanical): bounded poll for build completion.
-          var buildPoll = await agent(
-            "Poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 20 checks (10 minutes max).\n" +
-            "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
-            { key: attemptKey("publish-artifact-poll-" + taskId, reworkCount), label: "Waiting for artifact build to complete",
-              schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
-              timeoutMs: 660000 }
-          );
+          // STEP 1b (mechanical): bounded poll for build completion, chunked so
+          // the merge-lock lease is refreshed before it can expire. The 600s
+          // lease is shorter than the worst-case 10-minute build poll, so the
+          // poll runs in three chunks (7 checks x 30s ~= 3.5 min each) with a
+          // holder-only lease refresh between chunks. If a refresh fails, the
+          // lock was lost: stop the run and park the task — never continue to
+          // a provenance stamp or version assignment without holding the lock.
+          var buildPoll = null;
+          for (var chunk = 1; chunk <= 3; chunk++) {
+            if (chunk > 1) {
+              var refreshPoll = await agent(
+                "Refresh the merge lock for task " + taskId + ".\n" +
+                "Run: " + LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
+                "If the output contains REFRESHED, return JSON { \"held\": true } and nothing else. Otherwise return JSON { \"held\": false, \"output\": \"<verbatim output>\" } and nothing else.",
+                { key: attemptKey("publish-lock-refresh-poll-" + taskId + "-c" + chunk, reworkCount), label: "Refreshing merge lock during build poll",
+                  schema: { type: "object", properties: { held: { type: "boolean" }, output: { type: "string" } }, required: ["held"] },
+                  timeoutMs: 60000 }
+              );
+              if (!refreshPoll || refreshPoll.held !== true) {
+                return await parkTask("Merge-lock lease lost during the artifact build poll (refresh before chunk " + chunk + " of 3 failed: " + ((refreshPoll && refreshPoll.output) || "no output") + "). Fail-closed: stopping before any provenance stamp or version assignment.");
+              }
+            }
+            // Chunk 1 keeps the original stable key; later chunks use -c<N>
+            // suffixed keys. All are attemptKey-scoped so rework passes stay
+            // disjoint (replay-key contract).
+            var pollKey = (chunk === 1)
+              ? attemptKey("publish-artifact-poll-" + taskId, reworkCount)
+              : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, reworkCount);
+            buildPoll = await agent(
+              "Poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 7 checks (3.5 minutes max).\n" +
+              "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
+              { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
+                timeoutMs: 270000 }
+            );
+            if (buildPoll && buildPoll.build_done) { break; }
+          }
+          if (!buildPoll || !buildPoll.build_done) {
+            buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
+          }
           if (buildPoll.build_done) {
             // STEP 1c (mechanical): stamp provenance from workflow-computed values.
             var provStamp = await agent(
@@ -930,25 +993,34 @@ while (i < STEPS.length) {
         } else {
           publishFailure = "Artifact rebuild trigger failed: " + (rebuildTrigger.error || "artifact_edit not accepted") + ". The publish did not land.";
         }
-        // STEP 2 (mechanical, always once the lock was refreshed): post-deploy
+        } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
+        // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
-        // the merge lock — even when the publish itself failed, so a skipped
-        // or failed publish can never leave the lock held (canary b5efd1b1).
+        // the merge lock (forgiving when none is held) — even when the publish
+        // itself failed, so a skipped or failed publish can never leave the
+        // lock held (canary b5efd1b1).
         var postDeploy = await agent(
           "Run: "+ LIFECYCLE_ENV + " post-deploy " + taskId + "\n" +
           "Return JSON { \"deployed\": <true if the output contains DEPLOYED, false otherwise>, \"output\": \"<trimmed output>\" } and nothing else.",
           { key: attemptKey("publish-postdeploy-" + taskId, reworkCount), label: "Finalizing publish (post-deploy)",
             schema: { type: "object", properties: { deployed: { type: "boolean" }, output: { type: "string" } }, required: ["deployed"] } }
         );
-        if (publishFailure) {
-          return await parkTask(publishFailure + (postDeploy.deployed
-            ? " Post-deploy finalized cleanup."
-            : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
-        }
-        if (!postDeploy.deployed) {
-          return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+        if (publishSkippedNoLock) {
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
+          }
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+        } else {
+          if (publishFailure) {
+            return await parkTask(publishFailure + (postDeploy.deployed
+              ? " Post-deploy finalized cleanup."
+              : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
+          }
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+          }
+          log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
         }
-        log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
       } catch (pubErr) {
         // Best-effort cleanup: if the lock was refreshed, try to release it
         // before parking so the failure cannot wedge the next run.
@@ -969,6 +1041,12 @@ while (i < STEPS.length) {
       // The work agent no longer performs the publish — it reports on the
       // mechanical outcome above. It must not rebuild or re-stamp: a second
       // artifact_edit would trigger a duplicate build.
+      if (publishSkippedNoLock) {
+        instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
+          "The VERDICT line must be the last line of your report.";
+      } else {
       instructions = "Publish the merged code to the live artifact.\n\n" +
         "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
         "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
@@ -981,6 +1059,7 @@ while (i < STEPS.length) {
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
         "The VERDICT line must be the last line of your report.";
+      }
 } else if (PUBLISH_TYPE === "vercel") {
       // vercel publish is not yet implemented — block without inventing behavior
       instructions = "The project's publish target is \"vercel\", which is not yet implemented.\n" +
@@ -1127,8 +1206,21 @@ while (i < STEPS.length) {
   const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" ? "failed" : "rejected");
 
   // Deterministic publish verification: the agent cannot self-certify a publish.
+  // Skip-aware (park 2026-09-11): when the deterministic publish script found
+  // no merge lock held (empty-diff Integrate), it skips the publish path
+  // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
+  // marker. Verification is then vacuous — nothing was shipped, and the
+  // registry must NOT have moved. The marker is script-emitted explicit state
+  // (pasted verbatim per the Publish agent instructions), not agent prose; a
+  // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
+  var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
+    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+      npmPublishSkipped = true;
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+    }
+    if (!npmPublishSkipped) {
     try {
       var verifyResult = await agent(
         "Run: npm view muse-crew version 2>/dev/null. Return JSON { \"registry_version\": \"<output trimmed>\" } and nothing else.",
@@ -1145,6 +1237,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
   // Artifact publish verification: the worker cannot self-certify a deploy.
@@ -1152,6 +1245,14 @@ while (i < STEPS.length) {
   // integrated commit. A stale or missing provenance means the publish did not
   // land — fail closed, do not trust the worker's prose.
   if (step.name === "Publish" && PUBLISH_TYPE === "artifact" && PUBLISH_SLUG) {
+    // Skip-aware (park 2026-09-11): an empty-diff Integrate takes no merge
+    // lock, and the deterministic publish path skips rebuild/stamp entirely —
+    // there is no new provenance to compare against HEAD, so verification is
+    // vacuous. publishSkippedNoLock is workflow-computed state from the
+    // explicit lock-status read in STEP 0, not agent prose.
+    if (publishSkippedNoLock) {
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): artifact verification vacuous, nothing was shipped");
+    } else {
     try {
       var headResult = await agent(
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD. Return JSON { \"head\": \"<output trimmed>\" } and nothing else.",
@@ -1175,6 +1276,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read artifact provenance (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !publishSkippedNoLock — a skipped publish has nothing to verify
   }
 
   // Session notes. Machine-readable marker lines are extracted from the full
@@ -1183,9 +1285,13 @@ while (i < STEPS.length) {
   // reading TARGET_VERSION=) depend on them.
   let summary;
   var workerMarkers = extractMarkerLines(workerText);
-  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && publishVerified) {
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {
+    // The skip path records the computed target and the explicit skip — never
+    // "published:", which would be a false claim (nothing was shipped).
     const markerLines = "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
-      "published: muse-crew@" + publishTarget.target;
+      (npmPublishSkipped
+        ? "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)"
+        : "published: muse-crew@" + publishTarget.target);
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - markerLines.length - workerMarkers.length - 2) + "\n" + markerLines + (workerMarkers ? "\n" + workerMarkers : "");
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");