muse-crew 0.6.0 → 0.6.2

package/API.md

@@ -258,7 +258,7 @@ Set a global configuration value.
 
 ### `setprovenance`
 
-Stamp publication provenance. Called by the crew Publish phase after rebuilding the artifact.
+Stamp publication provenance. Called by the crew Publish phase after rebuilding the artifact, and after installing/activating a crew release (npm path): in the release case Publish refreshes `crew_release` to the live release identity while preserving the existing `source_commit`.
 
 | Field | Type | Required | Notes |
 |-------|------|----------|-------|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -22,6 +22,14 @@ const taskTitle = inputs.task_title || "";
 const taskDescription = inputs.task_description || "";
 const startStepIndex = inputs.start_step_index || 0;
 
+// Dispatcher-carried facts for the claim-time persist: the workflow name the
+// dispatcher actually resolved and launched, and whether the task record had
+// no workflow (the standard fallback). The launched workflow writes the
+// resolution back via updatetask in the self-claim below.
+const RESOLVED_WORKFLOW = inputs.resolved_workflow || null;
+const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
+const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"workflow\": \"" + RESOLVED_WORKFLOW + "\"" : "";
+
 // Config from args — backward-compatible fallbacks for manual launches
 const DASHBOARD_SLUG = inputs.dashboardSlug || "orchestra-dashboard";
 const crewHome = inputs.crewHome || "~/workspace/.jarvis";
@@ -315,8 +323,14 @@ function buildVisualCapturePlan(taskTitle, taskDescription, kind, captureTargets
 // opt-in — a missing or garbled line degrades to "unknown", which callers
 // treat as non-experiential. The task is never parked on a garbled line.
 async function resolveExperiential() {
-  if (isExperiential === true) return "yes";
-  if (isExperiential === false) return "no";
+  // Triage notes are immutable within a run: cache the resolved outcome —
+  // yes, no, AND unknown — so the dashboard lookup runs at most once per
+  // run. Without the unknown branch a missing experiential marker would
+  // re-fire the same "resolve-experiential-<taskId>" agent key on every
+  // Capture/Map entry and throw a duplicate replay key error.
+  if (experientialResolved !== null) return experientialResolved;
+  if (isExperiential === true) return (experientialResolved = "yes");
+  if (isExperiential === false) return (experientialResolved = "no");
   var expCheck = null;
   try {
     expCheck = await agent(
@@ -332,12 +346,14 @@ async function resolveExperiential() {
     );
   } catch (e) {
     log("resolveExperiential: agent call failed (" + (e && e.message ? e.message : e) + ") — treating as unknown");
-    return "unknown";
+    experientialResolved = "unknown";
+    return experientialResolved;
   }
   var marker = extractExperiential(expCheck && expCheck.experiential_line ? expCheck.experiential_line : "");
-  if (marker === true) return "yes";
-  if (marker === false) return "no";
-  return "unknown";
+  if (marker === true) experientialResolved = "yes";
+  else if (marker === false) experientialResolved = "no";
+  else experientialResolved = "unknown";
+  return experientialResolved;
 }
 // Baseline evidence status: reads the task's note events for the exact
 // protocol prefixes (explicit state, never English matching). Returns
@@ -448,6 +464,9 @@ let mapperSpec = "";
 // plan, and the Map-gate bounce counter (keeps agent stable-keys unique when
 // a Map-gate bounce re-runs Capture/Map in the same run).
 let isExperiential = null;
+// Caches all three resolveExperiential() outcomes (yes/no/unknown); Triage
+// notes are immutable within a run, so the lookup runs at most once.
+let experientialResolved = null;
 let captureTargets = "";
 let mapGateBounceCount = 0;
 // Merge-time versioning: the release decision is extracted deterministically
@@ -536,7 +555,7 @@ while (i < STEPS.length) {
       "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
       "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
       {
-        key: "project-check-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""),
+        key: "project-check-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + (mapGateBounceCount > 0 ? "-g" + mapGateBounceCount : ""),
         label: "Checking project before " + step.name,
         schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
       }
@@ -660,7 +679,7 @@ while (i < STEPS.length) {
   if (isFirstClaim) {
     const claimResult = await agent(
       "Claim this task for the " + step.name + " step.\n" +
-      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\" }.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\"" + CLAIM_WORKFLOW_PERSIST + " }.\n" +
       "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"claimtask\", args:\n" +
       "{ \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"notes\": \"" + step.name + " step started\" }.\n" +
       "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +
@@ -1357,8 +1376,39 @@ while (i < STEPS.length) {
         return await parkTask("Publish verification failed: registry shows " + regVer + " but the release decision required " +
           publishTarget.target + " (" + publishTarget.base + " + " + publishTarget.scope + "). The publish did not land.");
       }
-      log("Publish verified for task " + taskId + ": registry at " + regVer);
       publishVerified = true;
+      // Provenance refresh for self-publishes (task 7946d2a4): the npm path
+      // installs and activates a new immutable release (crew-release.sh deploy
+      // swaps the `current` symlink inside publish-npm.sh) but never stamped
+      // the dashboard's provenance record — every crew release left
+      // crew_release pointing at a pruned release. After a verified landed
+      // publish, refresh the record's crew_release to the now-live release
+      // identity, preserving the existing source_commit (the dashboard
+      // artifact's build source — a crew-repo commit here would fail the
+      // dashboard QA source check).
+      try {
+        var provRefresh = await agent(
+          "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getprovenance\", args: {}. " +
+          "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
+          "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
+          "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
+          "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"setprovenance\", args: " +
+          "{ \"source_commit\": \"<existing provenance.source_commit>\", \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\", \"task_id\": \"" + taskId + "\" }. " +
+          "Return JSON { \"refreshed\": <true if the setprovenance response contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
+          { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",
+            schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
+        );
+        if (provRefresh.refreshed) {
+          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
+        } else if (provRefresh.reason === "no-record") {
+          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
+        } else {
+          return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
+        }
+      } catch (e) {
+        return await parkTask("Provenance refresh failed: could not refresh dashboard provenance after a verified npm publish (" + (e && e.message ? e.message : e) + "). Fail-closed.");
+      }
+
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }

package/workflows/chore.js

@@ -20,6 +20,14 @@ const taskTitle = inputs.task_title || "";
 const taskDescription = inputs.task_description || "";
 const startStepIndex = inputs.start_step_index || 0;
 
+// Dispatcher-carried facts for the claim-time persist: the workflow name the
+// dispatcher actually resolved and launched, and whether the task record had
+// no workflow (the standard fallback). The launched workflow writes the
+// resolution back via updatetask in the self-claim below.
+const RESOLVED_WORKFLOW = inputs.resolved_workflow || null;
+const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
+const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"workflow\": \"" + RESOLVED_WORKFLOW + "\"" : "";
+
 // Config from args — backward-compatible fallbacks for manual launches
 const DASHBOARD_SLUG = inputs.dashboardSlug || "orchestra-dashboard";
 const crewHome = inputs.crewHome || "~/workspace/.jarvis";
@@ -313,8 +321,14 @@ function buildVisualCapturePlan(taskTitle, taskDescription, kind, captureTargets
 // opt-in — a missing or garbled line degrades to "unknown", which callers
 // treat as non-experiential. The task is never parked on a garbled line.
 async function resolveExperiential() {
-  if (isExperiential === true) return "yes";
-  if (isExperiential === false) return "no";
+  // Triage notes are immutable within a run: cache the resolved outcome —
+  // yes, no, AND unknown — so the dashboard lookup runs at most once per
+  // run. Without the unknown branch a missing experiential marker would
+  // re-fire the same "resolve-experiential-<taskId>" agent key on every
+  // Capture/Map entry and throw a duplicate replay key error.
+  if (experientialResolved !== null) return experientialResolved;
+  if (isExperiential === true) return (experientialResolved = "yes");
+  if (isExperiential === false) return (experientialResolved = "no");
   var expCheck = null;
   try {
     expCheck = await agent(
@@ -330,12 +344,14 @@ async function resolveExperiential() {
     );
   } catch (e) {
     log("resolveExperiential: agent call failed (" + (e && e.message ? e.message : e) + ") — treating as unknown");
-    return "unknown";
+    experientialResolved = "unknown";
+    return experientialResolved;
   }
   var marker = extractExperiential(expCheck && expCheck.experiential_line ? expCheck.experiential_line : "");
-  if (marker === true) return "yes";
-  if (marker === false) return "no";
-  return "unknown";
+  if (marker === true) experientialResolved = "yes";
+  else if (marker === false) experientialResolved = "no";
+  else experientialResolved = "unknown";
+  return experientialResolved;
 }
 // Baseline evidence status: reads the task's note events for the exact
 // protocol prefixes (explicit state, never English matching). Returns
@@ -406,6 +422,9 @@ let mapperSpec = "";
 // a Map-gate bounce re-runs Capture/Map in the same run). Chore has no QA
 // phase, so there is no visual-verdict function — Capture only.
 let isExperiential = null;
+// Caches all three resolveExperiential() outcomes (yes/no/unknown); Triage
+// notes are immutable within a run, so the lookup runs at most once.
+let experientialResolved = null;
 let captureTargets = "";
 let mapGateBounceCount = 0;
 // Merge-time versioning: the release decision is extracted deterministically
@@ -494,7 +513,7 @@ while (i < STEPS.length) {
       "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
       "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
       {
-        key: "project-check-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : ""),
+        key: "project-check-" + step.name + (reworkCount > 0 ? "-r" + reworkCount : "") + (mapGateBounceCount > 0 ? "-g" + mapGateBounceCount : ""),
         label: "Checking project before " + step.name,
         schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
       }
@@ -618,7 +637,7 @@ while (i < STEPS.length) {
   if (isFirstClaim) {
     const claimResult = await agent(
       "Claim this task for the " + step.name + " step.\n" +
-      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\" }.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\"" + CLAIM_WORKFLOW_PERSIST + " }.\n" +
       "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"claimtask\", args:\n" +
       "{ \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"notes\": \"" + step.name + " step started\" }.\n" +
       "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +
@@ -1232,8 +1251,39 @@ while (i < STEPS.length) {
         return await parkTask("Publish verification failed: registry shows " + regVer + " but the release decision required " +
           publishTarget.target + " (" + publishTarget.base + " + " + publishTarget.scope + "). The publish did not land.");
       }
-      log("Publish verified for task " + taskId + ": registry at " + regVer);
       publishVerified = true;
+      // Provenance refresh for self-publishes (task 7946d2a4): the npm path
+      // installs and activates a new immutable release (crew-release.sh deploy
+      // swaps the `current` symlink inside publish-npm.sh) but never stamped
+      // the dashboard's provenance record — every crew release left
+      // crew_release pointing at a pruned release. After a verified landed
+      // publish, refresh the record's crew_release to the now-live release
+      // identity, preserving the existing source_commit (the dashboard
+      // artifact's build source — a crew-repo commit here would fail the
+      // dashboard QA source check).
+      try {
+        var provRefresh = await agent(
+          "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getprovenance\", args: {}. " +
+          "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
+          "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
+          "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
+          "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"setprovenance\", args: " +
+          "{ \"source_commit\": \"<existing provenance.source_commit>\", \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\", \"task_id\": \"" + taskId + "\" }. " +
+          "Return JSON { \"refreshed\": <true if the setprovenance response contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
+          { key: attemptKey("publish-provenance-refresh-" + taskId, reworkCount), label: "Refreshing dashboard provenance after crew release",
+            schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
+        );
+        if (provRefresh.refreshed) {
+          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
+        } else if (provRefresh.reason === "no-record") {
+          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
+        } else {
+          return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
+        }
+      } catch (e) {
+        return await parkTask("Provenance refresh failed: could not refresh dashboard provenance after a verified npm publish (" + (e && e.message ? e.message : e) + "). Fail-closed.");
+      }
+
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }

package/workflows/crew-dispatch.js

@@ -593,7 +593,13 @@ for (var p = 0; p < toProcess.length; p++) {
     project_config: projectCfg,
     project_id: taskProject,
     dashboardSlug: DASHBOARD_SLUG,
-    crewHome: crewHome
+    crewHome: crewHome,
+    // Facts the launched workflow needs to persist the resolution at claim time:
+    // the workflow name the dispatcher actually resolved and is launching, and
+    // whether the task record had no workflow (playtest filings carry explicit
+    // workflow:'standard', so they correctly get false).
+    resolved_workflow: iworkflow,
+    workflow_was_null: (itask.workflow == null)
   };
 
   log("Recommended " + iworkflow + " for \"" + itask.title + "\" [" + taskProject + "] at step " + nextStepName);

package/workflows/docs.js

@@ -16,6 +16,14 @@ const taskTitle = inputs.task_title || "";
 const taskDescription = inputs.task_description || "";
 const startStepIndex = inputs.start_step_index || 0;
 
+// Dispatcher-carried facts for the claim-time persist: the workflow name the
+// dispatcher actually resolved and launched, and whether the task record had
+// no workflow (the standard fallback). The launched workflow writes the
+// resolution back via updatetask in the self-claim below.
+const RESOLVED_WORKFLOW = inputs.resolved_workflow || null;
+const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
+const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"workflow\": \"" + RESOLVED_WORKFLOW + "\"" : "";
+
 // Config from args — backward-compatible fallbacks for manual launches
 const DASHBOARD_SLUG = inputs.dashboardSlug || "orchestra-dashboard";
 const crewHome = inputs.crewHome || "~/workspace/.jarvis";
@@ -125,7 +133,7 @@ while (i < STEPS.length) {
   if (isFirstClaim) {
     const claimResult = await agent(
       "Claim this task for the " + step.name + " step.\n" +
-      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\" }.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\"" + CLAIM_WORKFLOW_PERSIST + " }.\n" +
       "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"claimtask\", args:\n" +
       "{ \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"notes\": \"" + step.name + " step started\" }.\n" +
       "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +

package/workflows/standard.js

@@ -21,6 +21,14 @@ const taskTitle = inputs.task_title || "";
 const taskDescription = inputs.task_description || "";
 const startStepIndex = inputs.start_step_index || 0;
 
+// Dispatcher-carried facts for the claim-time persist: the workflow name the
+// dispatcher actually resolved and launched, and whether the task record had
+// no workflow (the standard fallback). The launched workflow writes the
+// resolution back via updatetask in the self-claim below.
+const RESOLVED_WORKFLOW = inputs.resolved_workflow || null;
+const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
+const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"workflow\": \"" + RESOLVED_WORKFLOW + "\"" : "";
+
 // Config from args — backward-compatible fallbacks for manual launches
 const DASHBOARD_SLUG = inputs.dashboardSlug || "orchestra-dashboard";
 const crewHome = inputs.crewHome || "~/workspace/.jarvis";
@@ -315,8 +323,14 @@ function buildVisualCapturePlan(taskTitle, taskDescription, kind, captureTargets
 // opt-in — a missing or garbled line degrades to "unknown", which callers
 // treat as non-experiential. The task is never parked on a garbled line.
 async function resolveExperiential() {
-  if (isExperiential === true) return "yes";
-  if (isExperiential === false) return "no";
+  // Triage notes are immutable within a run: cache the resolved outcome —
+  // yes, no, AND unknown — so the dashboard lookup runs at most once per
+  // run. Without the unknown branch a missing experiential marker would
+  // re-fire the same "resolve-experiential-<taskId>" agent key on every
+  // Capture/Map entry and throw a duplicate replay key error.
+  if (experientialResolved !== null) return experientialResolved;
+  if (isExperiential === true) return (experientialResolved = "yes");
+  if (isExperiential === false) return (experientialResolved = "no");
   var expCheck = null;
   try {
     expCheck = await agent(
@@ -332,12 +346,14 @@ async function resolveExperiential() {
     );
   } catch (e) {
     log("resolveExperiential: agent call failed (" + (e && e.message ? e.message : e) + ") — treating as unknown");
-    return "unknown";
+    experientialResolved = "unknown";
+    return experientialResolved;
   }
   var marker = extractExperiential(expCheck && expCheck.experiential_line ? expCheck.experiential_line : "");
-  if (marker === true) return "yes";
-  if (marker === false) return "no";
-  return "unknown";
+  if (marker === true) experientialResolved = "yes";
+  else if (marker === false) experientialResolved = "no";
+  else experientialResolved = "unknown";
+  return experientialResolved;
 }
 // Baseline evidence status: reads the task's note events for the exact
 // protocol prefixes (explicit state, never English matching). Returns
@@ -447,6 +463,9 @@ let mapperSpec = "";
 // plan, and the Map-gate bounce counter (keeps agent stable-keys unique when
 // a Map-gate bounce re-runs Capture/Map in the same run).
 let isExperiential = null;
+// Caches all three resolveExperiential() outcomes (yes/no/unknown); Triage
+// notes are immutable within a run, so the lookup runs at most once.
+let experientialResolved = null;
 let captureTargets = "";
 let mapGateBounceCount = 0;
 // Merge-time versioning: the release decision is extracted deterministically
@@ -535,7 +554,7 @@ while (i < STEPS.length) {
       "Find the task with id \"" + taskId + "\" in the returned tasks array.\n" +
       "Return exactly { \"project\": \"<the task's project field, or empty string if absent>\" } and nothing else.",
       {
-        key: "project-check-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : ""),
+        key: "project-check-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : "") + (mapGateBounceCount > 0 ? "-g" + mapGateBounceCount : ""),
         label: "Checking project before " + step.name,
         schema: { type: "object", properties: { project: { type: "string" } }, required: ["project"] }
       }
@@ -659,7 +678,7 @@ while (i < STEPS.length) {
   if (isFirstClaim) {
     const claimResult = await agent(
       "Claim this task for the " + step.name + " step.\n" +
-      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\" }.\n" +
+      "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"updatetask\", args: { \"id\": \"" + taskId + "\", \"state\": \"in_progress\"" + CLAIM_WORKFLOW_PERSIST + " }.\n" +
       "Then call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"claimtask\", args:\n" +
       "{ \"task_id\": \"" + taskId + "\", \"identity\": \"" + step.identity + "\", \"step\": \"" + step.name + "\", \"notes\": \"" + step.name + " step started\" }.\n" +
       "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +
@@ -1367,8 +1386,39 @@ while (i < STEPS.length) {
         return await parkTask("Publish verification failed: registry shows " + regVer + " but the release decision required " +
           publishTarget.target + " (" + publishTarget.base + " + " + publishTarget.scope + "). The publish did not land.");
       }
-      log("Publish verified for task " + taskId + ": registry at " + regVer);
       publishVerified = true;
+      // Provenance refresh for self-publishes (task 7946d2a4): the npm path
+      // installs and activates a new immutable release (crew-release.sh deploy
+      // swaps the `current` symlink inside publish-npm.sh) but never stamped
+      // the dashboard's provenance record — every crew release left
+      // crew_release pointing at a pruned release. After a verified landed
+      // publish, refresh the record's crew_release to the now-live release
+      // identity, preserving the existing source_commit (the dashboard
+      // artifact's build source — a crew-repo commit here would fail the
+      // dashboard QA source check).
+      try {
+        var provRefresh = await agent(
+          "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"getprovenance\", args: {}. " +
+          "If the response has no provenance (null), return JSON { \"refreshed\": false, \"reason\": \"no-record\" } and stop. " +
+          "Otherwise run: basename $(readlink " + crewHome + "/current) — call this REL; " +
+          "run: date -u +%Y-%m-%dT%H:%M:%SZ — call this TS. " +
+          "Call artifact_invoke_action on slug \"" + DASHBOARD_SLUG + "\", action \"setprovenance\", args: " +
+          "{ \"source_commit\": \"<existing provenance.source_commit>\", \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\", \"task_id\": \"" + taskId + "\" }. " +
+          "Return JSON { \"refreshed\": <true if the setprovenance response contains ok: true, false otherwise>, \"crew_release\": \"<REL trimmed>\", \"published_at\": \"<TS trimmed>\" } and nothing else.",
+          { key: attemptKey("publish-provenance-refresh-" + taskId, totalReworkCount), label: "Refreshing dashboard provenance after crew release",
+            schema: { type: "object", properties: { refreshed: { type: "boolean" }, reason: { type: "string" }, crew_release: { type: "string" }, published_at: { type: "string" } }, required: ["refreshed"] } }
+        );
+        if (provRefresh.refreshed) {
+          log("Provenance refreshed for task " + taskId + ": crew_release " + provRefresh.crew_release);
+        } else if (provRefresh.reason === "no-record") {
+          log("Provenance refresh skipped for task " + taskId + ": no existing record to refresh (fresh instance — the dashboard's first artifact publish will create it)");
+        } else {
+          return await parkTask("Provenance refresh failed after a verified npm publish (crew_release " + (provRefresh.crew_release || "unknown") + "). The release is live but the dashboard record is stale — fail-closed.");
+        }
+      } catch (e) {
+        return await parkTask("Provenance refresh failed: could not refresh dashboard provenance after a verified npm publish (" + (e && e.message ? e.message : e) + "). Fail-closed.");
+      }
+
     } catch (e) {
       return await parkTask("Publish verification failed: could not read the registry version (" + (e && e.message ? e.message : e) + "). Fail-closed.");
     }