muse-crew 0.4.6 → 0.5.0

package/workflows/bugfix.js

@@ -916,13 +916,17 @@ while (i < STEPS.length) {
       instructions = "Publish the npm package by running exactly ONE command — the deterministic publish script.\n" +
         "The release decision is already made and recorded: release: yes, version_bump: " + publishTarget.scope +
         ", target version " + publishTarget.target + " (computed as " + publishTarget.base + " + " + publishTarget.scope +
-        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make and no skip path.\n\n" +
+        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make; the script itself skips gracefully when no merge lock is held.\n\n" +
         "Run exactly this command and no other publish-related commands:\n" +
         "TASK_ID=" + taskId + " REPO_PATH=" + REPO_PATH + " PKG=muse-crew TARGET_VERSION=" + publishTarget.target +
         " CREW_HOME=" + crewHome + " LIFECYCLE=" + LIFECYCLE + " RELEASE_SCRIPT=" + RELEASE_SCRIPT +
         " bash " + PUBLISH_NPM + "\n\n" +
         "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
         "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -941,20 +945,34 @@ while (i < STEPS.length) {
       // getprovenance-vs-HEAD verification below stays as the final gate.
       var artifactPublish = null;
       var publishLockRefreshed = false;
+      var publishSkippedNoLock = false;
       try {
-        // STEP 0 (mechanical): refresh the merge lock so a long build cannot
-        // go stale mid-publish.
-        var lockRefresh = await agent(
-          "Run: "+ LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
-          "Return JSON { \"refreshed\": <true if the command exited zero, false otherwise>, \"output\": \"<trimmed stdout>\" } and nothing else.",
-          { key: attemptKey("publish-lock-refresh-" + taskId, totalReworkCount), label: "Refreshing merge lock for publish",
-            schema: { type: "object", properties: { refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["refreshed"] } }
+        // STEP 0 (mechanical): read the merge-lock state explicitly — never
+        // infer it from prose. An empty-diff Integrate (MERGED_EMPTY)
+        // intentionally takes no lock: nothing merged, nothing to ship. When
+        // no lock is held, Publish skips the publish path gracefully instead
+        // of failing closed on refresh-lock (park 2026-09-11).
+        var lockState = await agent(
+          "Run: "+ LIFECYCLE_ENV + " lock-status " + taskId + "\n" +
+          "If the output is exactly UNLOCKED, return JSON { \"state\": \"UNLOCKED\" } and run nothing else.\n" +
+          "Otherwise the lock is held: run "+ LIFECYCLE_ENV + " refresh-lock " + taskId + " (a long build must not silently lose the lock to the orphan sweep), then return JSON { \"state\": \"LOCKED\", \"refreshed\": <true if the refresh exited zero, false otherwise>, \"output\": \"<trimmed refresh stdout>\" } and nothing else.",
+          { key: attemptKey("publish-lock-refresh-" + taskId, totalReworkCount), label: "Reading merge lock state for publish",
+            schema: { type: "object", properties: { state: { type: "string" }, refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["state"] } }
         );
-        if (!lockRefresh.refreshed) {
-          return await parkTask("Publish lock refresh failed: " + (lockRefresh.output || "no output") + ". Fail-closed — lock state unknown.");
+        if ((lockState.state || "").trim() === "UNLOCKED") {
+          publishSkippedNoLock = true;
+          log("Publish skipped for task " + taskId + ": no merge lock held (empty-diff Integrate) — nothing to ship");
+        } else {
+          if (!lockState.refreshed) {
+            return await parkTask("Publish lock refresh failed: " + (lockState.output || "no output") + ". Fail-closed — lock state unknown.");
+          }
+          publishLockRefreshed = true;
         }
-        publishLockRefreshed = true;
-        // STEP 1 (mechanical): trigger the rebuild with one narrow call. The
+        // STEP 1 (mechanical): trigger the rebuild with one narrow call.
+        // Skipped entirely when no lock was held — nothing merged, nothing
+        // to ship.
+        if (!publishSkippedNoLock) {
+        // (below) the rebuild trigger, bounded poll, and provenance stamp
         // agent only makes the artifact_edit call and reports whether it was
         // accepted — no prose claim to trust. If the artifact tool namespace
         // is missing from this child it reports honestly and the workflow
@@ -1038,25 +1056,34 @@ while (i < STEPS.length) {
         } else {
           publishFailure = "Artifact rebuild trigger failed: " + (rebuildTrigger.error || "artifact_edit not accepted") + ". The publish did not land.";
         }
-        // STEP 2 (mechanical, always once the lock was refreshed): post-deploy
+        } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
+        // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
-        // the merge lock — even when the publish itself failed, so a skipped
-        // or failed publish can never leave the lock held (canary b5efd1b1).
+        // the merge lock (forgiving when none is held) — even when the publish
+        // itself failed, so a skipped or failed publish can never leave the
+        // lock held (canary b5efd1b1).
         var postDeploy = await agent(
           "Run: "+ LIFECYCLE_ENV + " post-deploy " + taskId + "\n" +
           "Return JSON { \"deployed\": <true if the output contains DEPLOYED, false otherwise>, \"output\": \"<trimmed output>\" } and nothing else.",
           { key: attemptKey("publish-postdeploy-" + taskId, totalReworkCount), label: "Finalizing publish (post-deploy)",
             schema: { type: "object", properties: { deployed: { type: "boolean" }, output: { type: "string" } }, required: ["deployed"] } }
         );
-        if (publishFailure) {
-          return await parkTask(publishFailure + (postDeploy.deployed
-            ? " Post-deploy finalized cleanup."
-            : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
-        }
-        if (!postDeploy.deployed) {
-          return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+        if (publishSkippedNoLock) {
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
+          }
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+        } else {
+          if (publishFailure) {
+            return await parkTask(publishFailure + (postDeploy.deployed
+              ? " Post-deploy finalized cleanup."
+              : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
+          }
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+          }
+          log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
         }
-        log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
       } catch (pubErr) {
         // Best-effort cleanup: if the lock was refreshed, try to release it
         // before parking so the failure cannot wedge the next run.
@@ -1077,6 +1104,12 @@ while (i < STEPS.length) {
       // The work agent no longer performs the publish — it reports on the
       // mechanical outcome above. It must not rebuild or re-stamp: a second
       // artifact_edit would trigger a duplicate build.
+      if (publishSkippedNoLock) {
+        instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
+          "The VERDICT line must be the last line of your report.";
+      } else {
       instructions = "Publish the merged code to the live artifact.\n\n" +
         "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
         "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
@@ -1089,6 +1122,7 @@ while (i < STEPS.length) {
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
         "The VERDICT line must be the last line of your report.";
+      }
 } else if (PUBLISH_TYPE === "vercel") {
       // vercel publish is not yet implemented — block without inventing behavior
       instructions = "The project's publish target is \"vercel\", which is not yet implemented.\n" +
@@ -1100,7 +1134,9 @@ while (i < STEPS.length) {
     // declared release: yes, QA verifies the registry actually moved. A silent
     // publish skip becomes a loud QA failure with evidence, not a pass.
     var npmPublishCheck = (PUBLISH_TYPE === "npm" && releaseDecision && releaseDecision.release === "yes")
-      ? "NPM PUBLISH CHECK: the accepted Build report declared release: yes, so this run's Publish phase must have published. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
+      ? "NPM PUBLISH CHECK: the accepted Build report declared release: yes, so this run's Publish phase must have published — UNLESS it was skipped deterministically on an empty-diff Integrate. Find this task's recorded Publish result: call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getstate\", args: { \"events_limit\": 1 }, then find the session for this task_id with step \"Publish\" (status completed) in the returned sessions array and read its session notes (the Publish agent's summary — event history does NOT carry it).\n" +
+      "CHECK THE SKIP PATH FIRST: if the notes contain a line matching skipped: no-lock-held, Publish was skipped deterministically — Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there was nothing to ship. Verify the notes contain that skip-marker line and do NOT contain a line matching published: muse-crew@. Do NOT run npm view and do NOT demand registry movement — nothing was supposed to ship. Report 'npm publish check: Publish skipped deterministically (empty-diff Integrate — nothing to ship)' and PASS this check.\n" +
+      "Only when the notes contain no skip marker must the publish have landed — run the full verification below.\n" +
       "Extract the line matching TARGET_VERSION=<new-version> computed as <base> + <scope> → <new-version> (the workflow appends it to the Publish notes, so it is always present). If the line is missing, report 'npm publish verification failed: Publish notes did not carry the computed target version', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "Verify the bump SCOPE: the <scope> in that line MUST equal the accepted version_bump scope \"" + releaseDecision.version_bump + "\" — if it differs, report the mismatch, then end your report with exactly this line: VERDICT: FAIL. Verify the ARITHMETIC: <base> + <scope> must equal <new-version> (patch increments the last segment only, e.g. 0.3.0 + patch → 0.3.1; minor increments the middle and resets the last to 0; major increments the first and resets the rest to 0) — if the math is wrong, report it, then end your report with exactly this line: VERDICT: FAIL.\n" +
       "Extract the published version from the notes line matching published: muse-crew@<version>. It MUST equal <new-version> from the TARGET_VERSION line. Then run: npm view muse-crew version. The registry version MUST equal <new-version>. If any of these checks fails, report 'npm publish verification failed: [details]', then end your report with exactly this line: VERDICT: FAIL.\n"
@@ -1295,8 +1331,21 @@ while (i < STEPS.length) {
   const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" ? "failed" : "rejected");
 
   // Deterministic publish verification: the agent cannot self-certify a publish.
+  // Skip-aware (park 2026-09-11): when the deterministic publish script found
+  // no merge lock held (empty-diff Integrate), it skips the publish path
+  // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
+  // marker. Verification is then vacuous — nothing was shipped, and the
+  // registry must NOT have moved. The marker is script-emitted explicit state
+  // (pasted verbatim per the Publish agent instructions), not agent prose; a
+  // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
+  var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
+    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+      npmPublishSkipped = true;
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+    }
+    if (!npmPublishSkipped) {
     try {
       var verifyResult = await agent(
         "Run: npm view muse-crew version 2>/dev/null. Return JSON { \"registry_version\": \"<output trimmed>\" } and nothing else.",
@@ -1313,6 +1362,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
   // Artifact publish verification: the worker cannot self-certify a deploy.
@@ -1320,6 +1370,14 @@ while (i < STEPS.length) {
   // integrated commit. A stale or missing provenance means the publish did not
   // land — fail closed, do not trust the worker's prose.
   if (step.name === "Publish" && PUBLISH_TYPE === "artifact" && PUBLISH_SLUG) {
+    // Skip-aware (park 2026-09-11): an empty-diff Integrate takes no merge
+    // lock, and the deterministic publish path skips rebuild/stamp entirely —
+    // there is no new provenance to compare against HEAD, so verification is
+    // vacuous. publishSkippedNoLock is workflow-computed state from the
+    // explicit lock-status read in STEP 0, not agent prose.
+    if (publishSkippedNoLock) {
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): artifact verification vacuous, nothing was shipped");
+    } else {
     try {
       var headResult = await agent(
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD. Return JSON { \"head\": \"<output trimmed>\" } and nothing else.",
@@ -1343,6 +1401,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read artifact provenance (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !publishSkippedNoLock — a skipped publish has nothing to verify
   }
 
   // Session notes. Machine-readable marker lines are extracted from the full
@@ -1351,9 +1410,13 @@ while (i < STEPS.length) {
   // reading TARGET_VERSION=) depend on them.
   let summary;
   var workerMarkers = extractMarkerLines(workerText);
-  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && publishVerified) {
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {
+    // The skip path records the computed target and the explicit skip — never
+    // "published:", which would be a false claim (nothing was shipped).
     const markerLines = "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
-      "published: muse-crew@" + publishTarget.target;
+      (npmPublishSkipped
+        ? "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)"
+        : "published: muse-crew@" + publishTarget.target);
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - markerLines.length - workerMarkers.length - 2) + "\n" + markerLines + (workerMarkers ? "\n" + workerMarkers : "");
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");

package/workflows/chore.js

@@ -853,13 +853,17 @@ while (i < STEPS.length) {
       instructions = "Publish the npm package by running exactly ONE command — the deterministic publish script.\n" +
         "The release decision is already made and recorded: release: yes, version_bump: " + publishTarget.scope +
         ", target version " + publishTarget.target + " (computed as " + publishTarget.base + " + " + publishTarget.scope +
-        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make and no skip path.\n\n" +
+        " → " + publishTarget.target + " by the workflow, not by you). There is no decision to make; the script itself skips gracefully when no merge lock is held.\n\n" +
         "Run exactly this command and no other publish-related commands:\n" +
         "TASK_ID=" + taskId + " REPO_PATH=" + REPO_PATH + " PKG=muse-crew TARGET_VERSION=" + publishTarget.target +
         " CREW_HOME=" + crewHome + " LIFECYCLE=" + LIFECYCLE + " RELEASE_SCRIPT=" + RELEASE_SCRIPT +
         " bash " + PUBLISH_NPM + "\n\n" +
         "Do NOT run npm, npm pack, npm publish, or the python publish script yourself. Do NOT compare local and registry versions. Do NOT decide whether to publish.\n\n" +
         "If the command exits nonzero, put the script's PUBLISH_FAILED line in your report, then end your report with exactly this line: VERDICT: FAIL.\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-lock-held, the publish was skipped gracefully: Integrate reported MERGED_EMPTY (no commits ahead of main), so no merge lock was taken and there is nothing to ship. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -878,20 +882,34 @@ while (i < STEPS.length) {
       // getprovenance-vs-HEAD verification below stays as the final gate.
       var artifactPublish = null;
       var publishLockRefreshed = false;
+      var publishSkippedNoLock = false;
       try {
-        // STEP 0 (mechanical): refresh the merge lock so a long build cannot
-        // go stale mid-publish.
-        var lockRefresh = await agent(
-          "Run: "+ LIFECYCLE_ENV + " refresh-lock " + taskId + "\n" +
-          "Return JSON { \"refreshed\": <true if the command exited zero, false otherwise>, \"output\": \"<trimmed stdout>\" } and nothing else.",
-          { key: attemptKey("publish-lock-refresh-" + taskId, reworkCount), label: "Refreshing merge lock for publish",
-            schema: { type: "object", properties: { refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["refreshed"] } }
+        // STEP 0 (mechanical): read the merge-lock state explicitly — never
+        // infer it from prose. An empty-diff Integrate (MERGED_EMPTY)
+        // intentionally takes no lock: nothing merged, nothing to ship. When
+        // no lock is held, Publish skips the publish path gracefully instead
+        // of failing closed on refresh-lock (park 2026-09-11).
+        var lockState = await agent(
+          "Run: "+ LIFECYCLE_ENV + " lock-status " + taskId + "\n" +
+          "If the output is exactly UNLOCKED, return JSON { \"state\": \"UNLOCKED\" } and run nothing else.\n" +
+          "Otherwise the lock is held: run "+ LIFECYCLE_ENV + " refresh-lock " + taskId + " (a long build must not silently lose the lock to the orphan sweep), then return JSON { \"state\": \"LOCKED\", \"refreshed\": <true if the refresh exited zero, false otherwise>, \"output\": \"<trimmed refresh stdout>\" } and nothing else.",
+          { key: attemptKey("publish-lock-refresh-" + taskId, reworkCount), label: "Reading merge lock state for publish",
+            schema: { type: "object", properties: { state: { type: "string" }, refreshed: { type: "boolean" }, output: { type: "string" } }, required: ["state"] } }
         );
-        if (!lockRefresh.refreshed) {
-          return await parkTask("Publish lock refresh failed: " + (lockRefresh.output || "no output") + ". Fail-closed — lock state unknown.");
+        if ((lockState.state || "").trim() === "UNLOCKED") {
+          publishSkippedNoLock = true;
+          log("Publish skipped for task " + taskId + ": no merge lock held (empty-diff Integrate) — nothing to ship");
+        } else {
+          if (!lockState.refreshed) {
+            return await parkTask("Publish lock refresh failed: " + (lockState.output || "no output") + ". Fail-closed — lock state unknown.");
+          }
+          publishLockRefreshed = true;
         }
-        publishLockRefreshed = true;
-        // STEP 1 (mechanical): trigger the rebuild with one narrow call. The
+        // STEP 1 (mechanical): trigger the rebuild with one narrow call.
+        // Skipped entirely when no lock was held — nothing merged, nothing
+        // to ship.
+        if (!publishSkippedNoLock) {
+        // (below) the rebuild trigger, bounded poll, and provenance stamp
         // agent only makes the artifact_edit call and reports whether it was
         // accepted — no prose claim to trust. If the artifact tool namespace
         // is missing from this child it reports honestly and the workflow
@@ -975,25 +993,34 @@ while (i < STEPS.length) {
         } else {
           publishFailure = "Artifact rebuild trigger failed: " + (rebuildTrigger.error || "artifact_edit not accepted") + ". The publish did not land.";
         }
-        // STEP 2 (mechanical, always once the lock was refreshed): post-deploy
+        } // end: publishSkippedNoLock — no rebuild, no stamp, nothing to ship
+        // STEP 2 (mechanical, always — skip path included): post-deploy
         // commits builder leftovers if any, removes the worktree, and releases
-        // the merge lock — even when the publish itself failed, so a skipped
-        // or failed publish can never leave the lock held (canary b5efd1b1).
+        // the merge lock (forgiving when none is held) — even when the publish
+        // itself failed, so a skipped or failed publish can never leave the
+        // lock held (canary b5efd1b1).
         var postDeploy = await agent(
           "Run: "+ LIFECYCLE_ENV + " post-deploy " + taskId + "\n" +
           "Return JSON { \"deployed\": <true if the output contains DEPLOYED, false otherwise>, \"output\": \"<trimmed output>\" } and nothing else.",
           { key: attemptKey("publish-postdeploy-" + taskId, reworkCount), label: "Finalizing publish (post-deploy)",
             schema: { type: "object", properties: { deployed: { type: "boolean" }, output: { type: "string" } }, required: ["deployed"] } }
         );
-        if (publishFailure) {
-          return await parkTask(publishFailure + (postDeploy.deployed
-            ? " Post-deploy finalized cleanup."
-            : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
-        }
-        if (!postDeploy.deployed) {
-          return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+        if (publishSkippedNoLock) {
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
+          }
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+        } else {
+          if (publishFailure) {
+            return await parkTask(publishFailure + (postDeploy.deployed
+              ? " Post-deploy finalized cleanup."
+              : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
+          }
+          if (!postDeploy.deployed) {
+            return await parkTask("Post-deploy failed after a stamped publish: " + (postDeploy.output || "no output") + ". The publish landed but worktree cleanup and lock release are unknown — human attention needed.");
+          }
+          log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
         }
-        log("Deterministic artifact publish completed for task " + taskId + ": provenance at " + artifactPublish.source_commit);
       } catch (pubErr) {
         // Best-effort cleanup: if the lock was refreshed, try to release it
         // before parking so the failure cannot wedge the next run.
@@ -1014,6 +1041,12 @@ while (i < STEPS.length) {
       // The work agent no longer performs the publish — it reports on the
       // mechanical outcome above. It must not rebuild or re-stamp: a second
       // artifact_edit would trigger a duplicate build.
+      if (publishSkippedNoLock) {
+        instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
+          "The VERDICT line must be the last line of your report.";
+      } else {
       instructions = "Publish the merged code to the live artifact.\n\n" +
         "The publish was performed deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would trigger a duplicate build or disturb the finalized state. You perform no publish actions.\n\n" +
         "For the change summary, run: cd " + REPO_PATH + " && git log -1 --stat\n\n" +
@@ -1026,6 +1059,7 @@ while (i < STEPS.length) {
         "The repo push already happened in Integrate — do NOT push to git in this phase.\n\n" +
         "Write plain prose describing what was published, then on its own line: VERDICT: PASS\n" +
         "The VERDICT line must be the last line of your report.";
+      }
 } else if (PUBLISH_TYPE === "vercel") {
       // vercel publish is not yet implemented — block without inventing behavior
       instructions = "The project's publish target is \"vercel\", which is not yet implemented.\n" +
@@ -1172,8 +1206,21 @@ while (i < STEPS.length) {
   const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" ? "failed" : "rejected");
 
   // Deterministic publish verification: the agent cannot self-certify a publish.
+  // Skip-aware (park 2026-09-11): when the deterministic publish script found
+  // no merge lock held (empty-diff Integrate), it skips the publish path
+  // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
+  // marker. Verification is then vacuous — nothing was shipped, and the
+  // registry must NOT have moved. The marker is script-emitted explicit state
+  // (pasted verbatim per the Publish agent instructions), not agent prose; a
+  // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
+  var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
+    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+      npmPublishSkipped = true;
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+    }
+    if (!npmPublishSkipped) {
     try {
       var verifyResult = await agent(
         "Run: npm view muse-crew version 2>/dev/null. Return JSON { \"registry_version\": \"<output trimmed>\" } and nothing else.",
@@ -1190,6 +1237,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !npmPublishSkipped — a skipped publish has nothing to verify
   }
 
   // Artifact publish verification: the worker cannot self-certify a deploy.
@@ -1197,6 +1245,14 @@ while (i < STEPS.length) {
   // integrated commit. A stale or missing provenance means the publish did not
   // land — fail closed, do not trust the worker's prose.
   if (step.name === "Publish" && PUBLISH_TYPE === "artifact" && PUBLISH_SLUG) {
+    // Skip-aware (park 2026-09-11): an empty-diff Integrate takes no merge
+    // lock, and the deterministic publish path skips rebuild/stamp entirely —
+    // there is no new provenance to compare against HEAD, so verification is
+    // vacuous. publishSkippedNoLock is workflow-computed state from the
+    // explicit lock-status read in STEP 0, not agent prose.
+    if (publishSkippedNoLock) {
+      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): artifact verification vacuous, nothing was shipped");
+    } else {
     try {
       var headResult = await agent(
         "Run: cd " + REPO_PATH + " && git rev-parse HEAD. Return JSON { \"head\": \"<output trimmed>\" } and nothing else.",
@@ -1220,6 +1276,7 @@ while (i < STEPS.length) {
     } catch (e) {
       return await parkTask("Publish verification failed: could not read artifact provenance (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }
+    } // end: !publishSkippedNoLock — a skipped publish has nothing to verify
   }
 
   // Session notes. Machine-readable marker lines are extracted from the full
@@ -1228,9 +1285,13 @@ while (i < STEPS.length) {
   // reading TARGET_VERSION=) depend on them.
   let summary;
   var workerMarkers = extractMarkerLines(workerText);
-  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && publishVerified) {
+  if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget && (publishVerified || npmPublishSkipped)) {
+    // The skip path records the computed target and the explicit skip — never
+    // "published:", which would be a false claim (nothing was shipped).
     const markerLines = "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
-      "published: muse-crew@" + publishTarget.target;
+      (npmPublishSkipped
+        ? "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)"
+        : "published: muse-crew@" + publishTarget.target);
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - markerLines.length - workerMarkers.length - 2) + "\n" + markerLines + (workerMarkers ? "\n" + workerMarkers : "");
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");

package/workflows/crew-init.js

@@ -17,7 +17,7 @@ const crewHome = inputs.crewHome;
 const dashboardSlug = inputs.dashboardSlug;
 const dashboardName = inputs.dashboardName || "Muse Crew";
 const cronId = inputs.cronId || "crew-poll";
-const sweepCronId = inputs.sweepCronId || "crew-sweep";
+const sweepCronId = inputs.sweepCronId || "crew-orphan-sweep";
 
 if (!crewRepoPath) throw new Error("crewRepoPath is required — path to muse-crew (git checkout or npm install)");
 if (!crewHome) throw new Error("crewHome is required — e.g. ~/.crew");
@@ -198,35 +198,30 @@ phase("sweep-cron");
 var sweepResult;
 try {
   sweepResult = await agent(
-    "Check if the sweep cron exists and create it if not.\n\n" +
+    "Check if the orphan sweep cron exists and create it if not.\n\n" +
     "Cron id: " + sweepCronId + "\n" +
+    "Template: " + crewRepoPath + "/seed/cron-sweep-body-template.md\n" +
     "crewHome: " + crewHome + "\n" +
     "Dashboard slug: " + dashboardSlug + "\n\n" +
     "Steps:\n" +
     "1. Call cron_list and look for a job with id '" + sweepCronId + "'\n" +
-    "2. If it exists, return { existed: true }\n" +
-    "3. If not found, call cron_add with:\n" +
-    "   - id: '" + sweepCronId + "'\n" +
-    "   - title: 'Muse Crew orphan sweep'\n" +
-    "   - enabled: true\n" +
-    "   - mode: 'task'\n" +
-    "   - schedule: { kind: 'interval', every: '30m' }\n" +
-    "   - owner: 'space:" + dashboardSlug + "'\n" +
-    "   - timeout_secs: 120\n" +
-    "   - body: the body text below\n" +
-    "   Return { existed: false }\n\n" +
-    "Body text for the cron:\n" +
-    "---\n" +
-    "## Muse Crew Orphan Sweep\n\n" +
-    "1. Call artifact_invoke_action on slug \"" + dashboardSlug + "\", action \"getdispatchstate\", args {}.\n" +
-    "2. From the response, extract the `id` field of each `ready_tasks` entry whose\n" +
-    "   latest_session.status is \"running\", verbatim — copy the full ID exactly\n" +
-    "   as it appears; do not shorten, truncate, or reformat it. Return them as a\n" +
-    "   JSON array of strings. Do NOT reproduce any other part of the response.\n" +
-    "3. Run: CREW_ACTIVE_TASKS=\"<space-separated ids>\" " + crewHome + "/lib/orphan-sweep.sh clean\n" +
-    "   If the list is empty, pass an empty string — do NOT omit the variable (the sweep fails closed without it).\n" +
-    "4. Report the output. If it says CLEAN, no action was needed.\n" +
-    "---\n\n" +
+    "2. If it exists, return { existed: true } WITHOUT touching it — adopt means\n" +
+    "   adopt: do not enable it, rewrite its body, or change its schedule.\n" +
+    "3. If not found:\n" +
+    "   a. Read the template at " + crewRepoPath + "/seed/cron-sweep-body-template.md\n" +
+    "   b. Replace all occurrences of {crewHome} with: " + crewHome + "\n" +
+    "      Replace all occurrences of {dashboardSlug} with: " + dashboardSlug + "\n" +
+    "   c. Call cron_add with:\n" +
+    "      - id: '" + sweepCronId + "'\n" +
+    "      - title: 'Muse Crew orphan sweep'\n" +
+    "      - enabled: false (deliberate holding state — the sweep stays disabled\n" +
+    "        until explicitly enabled by a human; never resurrect it enabled)\n" +
+    "      - mode: 'task'\n" +
+    "      - schedule: { kind: 'interval', every: '30m' }\n" +
+    "      - owner: 'space:" + dashboardSlug + "'\n" +
+    "      - timeout_secs: 120\n" +
+    "      - body: the processed template text\n" +
+    "   d. Return { existed: false }\n\n" +
     "Return JSON with existed (boolean).",
     {
       key: "sweep-cron-1",