muse-crew 0.6.2 → 0.6.3

package/API.md

@@ -294,6 +294,15 @@ Artifact Publish passes only when both are true:
 
 Verification fails closed. If the provenance is missing, unreadable, or points at a different commit than the integrated HEAD, the workflow parks the task — it does not trust the worker's prose. Narrative remains useful but cannot independently establish deployment truth.
 
+### Integrate merge verification
+
+Integrate passes only when both are true:
+
+1. The worker declares success.
+2. Mechanical verification confirms the task branch tip is an ancestor of `main`: the workflow runs the lifecycle script's `verify-merge` command, which resolves the branch through the crew registry (never by reconstructing `task/<id>`), and matches the `VERIFIED:` marker on the script's own stdout with a regex — never by reading agent prose.
+
+A genuine empty-diff Integrate (no commits ahead of `main` — a runtime-state deliverable) verifies vacuously: the branch tip is then an ancestor of `main`. Verification failure is an operational step failure, not a park: the dispatcher retries Integrate under its consecutive-failure cap, and the retry finds the commits still on the branch and performs the real merge.
+
 ---
 
 ## Not part of this API

package/lib/AGENTS.md

@@ -5,7 +5,7 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `build-registry.js` — deterministic extractor that generates `workflows/registry.json` (workflow step registry) from the workflow files' `meta` blocks at release time; invoked by `crew-release.sh` deploy
 - `crew-release.sh` — immutable release manager: deploy, rollback, prune
 - `merge-lock.sh` — serialized merge lock for concurrent agents: time-based holder lease (bug 2fc8f52f — an unexpired lease is held regardless of process liveness; only an expired lease may be broken). Lock file is key=value: task_id, opaque holder identity (never a PID), acquired_at epoch, lease_seconds (default 600, override via MERGE_LOCK_LEASE_SECONDS). acquire/refresh/release/status/force-release; holder-only refresh and release; every op appends to $CREW_HOME/.merge-lock.log
-- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/status/post-deploy/refresh-lock/lock-status over git worktrees (`.worktrees/<id>`, branch `task/<id>`). The crew registry (`<repo>/.worktrees/.registry/<id>`) is the source of truth for task→branch/path — never reconstruct it from git state. Prepare fails closed on dirty `main`; cleanup is forgiving. `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or `LOCKED by <holder> since <ts> (pid <pid>)`, always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
+- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/refresh-lock/lock-status over git worktrees (`.worktrees/<id>`, branch `task/<id>`). The crew registry (`<repo>/.worktrees/.registry/<id>`) is the source of truth for task→branch/path — never reconstruct it from git state. Prepare fails closed on dirty `main`; cleanup is forgiving. `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or `LOCKED by <holder> since <ts> (pid <pid>)`, always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
 - `test-worktree-backend.sh` — regression tests for the lifecycle script (validate, prepare/reuse, inspect, status, cleanup, idempotent cleanup, dirty-main preflight) on a scratch repo
 - `test-version-write.sh` — regression tests for the escape-preserving step-8 version write in publish-npm.sh (fixture: current package.json with the \\u2014 escape; extracts the shipped block by anchor)
 - `test-publish-verify.sh` — regression tests for the retry-tolerant step-12 verification in publish-npm.sh (canary 5a027278): extracts the shipped block by anchor and runs it against a fake npm whose read replica lags (non-zero exits, then the old version, then the target) — requires convergence on success, fail-closed `PUBLISH_FAILED=verify` on exhaustion, and `--prefer-online` on every read

package/lib/test-verify-merge.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# test-verify-merge.sh — regression tests for the verify-merge lifecycle
+# command (bug b1b1f919: Integrate completed on empty merge while approved
+# commits were still stranded on the task branch).
+#
+# Fixture: a scratch repo with main + prepared task branches.
+#   1. missing branch → ERROR, non-zero
+#   2. empty-diff branch (no commits ahead of main) → VERIFIED, exit 0
+#   3. branch with commits ahead, not merged → NOT_MERGED, non-zero
+#   4. after merging the branch → VERIFIED, exit 0
+#   5. registry-divergent branch name → resolves via registry, not via
+#      reconstructed "task/<id>" (verifying the wrong branch is the same
+#      bug in different clothes)
+#   6. invalid task id → rejected
+set -u
+
+REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+LIFECYCLE="$REPO_DIR/lib/worktree-lifecycle.sh"
+
+fail() { echo "FAIL: $1"; exit 1; }
+
+T=/tmp/crew-verify-merge-test
+rm -rf "$T"
+mkdir -p "$T"
+cd "$T"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo x > f.txt
+echo ".worktrees/" > .gitignore
+git add -A
+git commit -qm init
+
+export CREW_REPO="$T"
+tid="verifytest1"
+
+# 1. missing branch → ERROR, non-zero
+out=$(bash "$LIFECYCLE" verify-merge "$tid" 2>&1) && fail "verify-merge on missing branch exited 0"
+echo "$out" | grep -q '^ERROR: branch task/verifytest1 does not exist' || fail "missing branch: expected ERROR, got: $out"
+
+# 2. prepare (empty diff) → VERIFIED, exit 0
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "prepare exited non-zero: $out"
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "verify-merge on empty-diff branch exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "empty-diff: expected VERIFIED, got: $out"
+
+# 3. commit on the branch, not merged → NOT_MERGED, non-zero
+echo change >> "$T/.worktrees/$tid/f.txt"
+(cd "$T/.worktrees/$tid" && git commit -qam work)
+out=$(bash "$LIFECYCLE" verify-merge "$tid" 2>&1) && fail "verify-merge on unmerged branch exited 0"
+echo "$out" | grep -q '^NOT_MERGED:' || fail "unmerged: expected NOT_MERGED, got: $out"
+echo "$out" | grep -q '1 commit(s) still ahead of main' || fail "unmerged: expected ahead count, got: $out"
+
+# 4. merge the branch → VERIFIED, exit 0
+(cd "$T" && git merge -q --no-ff "task/$tid" -m "merge: $tid")
+out=$(bash "$LIFECYCLE" verify-merge "$tid") || fail "verify-merge after merge exited non-zero: $out"
+echo "$out" | grep -q '^VERIFIED:' || fail "merged: expected VERIFIED, got: $out"
+
+# 5. registry-divergent branch name → resolve_branch wins over reconstruction
+tid2="verifytest2"
+out=$(bash "$LIFECYCLE" prepare "$tid2") || fail "prepare 2 exited non-zero: $out"
+(cd "$T" && git branch -m "task/$tid2" "custom/$tid2")
+sed -i "s|^branch=task/$tid2\$|branch=custom/$tid2|" "$T/.worktrees/.registry/$tid2"
+echo change2 >> "$T/.worktrees/$tid2/f.txt"
+(cd "$T/.worktrees/$tid2" && git commit -qam work2)
+out=$(bash "$LIFECYCLE" verify-merge "$tid2" 2>&1) && fail "verify-merge on divergent unmerged branch exited 0"
+echo "$out" | grep -q '^NOT_MERGED: custom/verifytest2 ' || fail "divergent: expected NOT_MERGED on custom/verifytest2, got: $out"
+
+# 6. invalid task id rejected
+bash "$LIFECYCLE" verify-merge "bad id!" >/dev/null 2>&1 && fail "verify-merge accepted a bad id"
+
+bash "$LIFECYCLE" cleanup "$tid" >/dev/null 2>&1 || true
+(cd "$T" && git branch -D "custom/$tid2" >/dev/null 2>&1) || true
+rm -rf "$T/.worktrees/$tid2" "$T/.worktrees/.registry/$tid2"
+rm -rf "$T"
+echo "verify-merge: OK"

package/lib/worktree-lifecycle.sh

@@ -15,6 +15,7 @@
 #   prepare   <task_id>                  — create worktree + branch, register ownership
 #   inspect   <task_id>                  — diff against main for review
 #   integrate <task_id> <commit_msg>     — merge lock → merge into main → report commit
+#   verify-merge <task_id>              — confirm the task branch tip is an ancestor of main (post-step merge check)
 #   post-deploy <task_id>                — commit builder artifacts, cleanup, release lock
 #   cleanup   <task_id>                  — remove worktree + branch (no lock)
 #   status    <task_id>                  — report worktree state
@@ -250,6 +251,41 @@ cmd_integrate() {
   echo "LOCK: held by $task_id — release after deploy with post-deploy"
 }
 
+cmd_verify_merge() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+
+  # Resolve through the registry — never reconstruct "task/<id>" here. The
+  # workflow's TASK_BRANCH constant and the registry can diverge, and
+  # verifying the wrong branch is the same bug in different clothes
+  # (b1b1f919).
+  local branch
+  branch=$(resolve_branch "$task_id")
+
+  cd "$REPO"
+
+  if ! git rev-parse --verify "$branch" >/dev/null 2>&1; then
+    echo "ERROR: branch $branch does not exist"
+    return 1
+  fi
+
+  local tip
+  tip=$(git rev-parse "$branch")
+
+  # The merge landed iff the task branch tip is an ancestor of main. A
+  # genuine empty-diff Integrate (MERGED_EMPTY: no commits ahead of main)
+  # verifies vacuously — the tip is then main itself or behind it.
+  if git merge-base --is-ancestor "$branch" main 2>/dev/null; then
+    echo "VERIFIED: $branch tip $tip is an ancestor of main — merge landed"
+    return 0
+  fi
+
+  local ahead
+  ahead=$(git rev-list --count "main..$branch")
+  echo "NOT_MERGED: $branch tip $tip is not an ancestor of main — $ahead commit(s) still ahead of main"
+  return 1
+}
+
 cmd_post_deploy() {
   local task_id="$1"
   validate_task_id "$task_id"
@@ -388,6 +424,7 @@ case "$cmd" in
   prepare)      cmd_prepare "${1:?task_id required}" ;;
   inspect)      cmd_inspect "${1:?task_id required}" ;;
   integrate)    cmd_integrate "${1:?task_id required}" "${2:-}" ;;
+  verify-merge) cmd_verify_merge "${1:?task_id required}" ;;
   post-deploy)  cmd_post_deploy "${1:?task_id required}" ;;
   cleanup)      cmd_cleanup "${1:?task_id required}" ;;
   status)       cmd_status "${1:?task_id required}" ;;
@@ -396,7 +433,7 @@ case "$cmd" in
   sweep)        cmd_sweep "${1:-report}" ;;
   *)
     echo "Usage: worktree-lifecycle.sh <command> [args]"
-    echo "Commands: validate, prepare, inspect, integrate, post-deploy, cleanup, status, refresh-lock, lock-status, sweep"
+    echo "Commands: validate, prepare, inspect, integrate, verify-merge, post-deploy, cleanup, status, refresh-lock, lock-status, sweep"
     exit 1
     ;;
 esac

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -1342,7 +1342,47 @@ while (i < STEPS.length) {
     passed: verdictPassed !== null ? verdictPassed : true,
     summary: workerText
   };
-  const passed = stepResult.passed === true;
+  let passed = stepResult.passed === true;
+
+  // Deterministic integrate verification: the agent cannot self-certify a
+  // merge. After the Integrate agent claims success, the workflow confirms
+  // mechanically that the task branch tip is an ancestor of main via the
+  // lifecycle script's verify-merge command (which resolves the branch
+  // through the crew registry — never by reconstructing "task/"+taskId — so
+  // the check cannot verify the wrong branch). The VERIFIED marker is matched
+  // by regex on the script's own stdout; agent prose is never read. This
+  // closes the hole where an agent reported "merged empty" while approved
+  // commits were still stranded on the task branch (bug b1b1f919). A genuine
+  // empty-diff Integrate (MERGED_EMPTY: no commits ahead of main) verifies
+  // vacuously — the tip is then an ancestor of main. Verification failure is
+  // an operational step failure, not a park: the dispatcher retries Integrate
+  // under its consecutive-failure cap, and the retry finds the commits still
+  // on the branch and performs the real merge — self-healing.
+  if (step.name === "Integrate" && passed) {
+    var integrateVerifyOut = "";
+    try {
+      var integrateVerifyResult = await agent(
+        "Run: " + LIFECYCLE_ENV + LIFECYCLE + " verify-merge " + taskId + " 2>&1 || true\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("verify-merge-" + taskId, totalReworkCount), label: "Verifying merge landed",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      integrateVerifyOut = (integrateVerifyResult.output || "").trim();
+    } catch (e) {
+      integrateVerifyOut = "";
+    }
+    if (/^VERIFIED:/m.test(integrateVerifyOut)) {
+      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of main");
+    } else {
+      var integrateVerifyReason = integrateVerifyOut
+        ? integrateVerifyOut.split("\n")[0].slice(0, 200)
+        : "verify-merge produced no usable output";
+      log("Integrate verification failed for task " + taskId + ": " + integrateVerifyReason + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nintegrate_verify: FAILED — " + integrateVerifyReason;
+      passed = false;
+    }
+  }
+
   // "rejected" is an explicit phase verdict routed through rework (Review/QA,
   // and the Build/Reproduce reports that feed them). Integrate/Publish work
   // that did not finish is operational — "failed", retryable under the

package/workflows/chore.js

@@ -1218,7 +1218,47 @@ while (i < STEPS.length) {
     passed: verdictPassed !== null ? verdictPassed : true,
     summary: workerText
   };
-  const passed = stepResult.passed === true;
+  let passed = stepResult.passed === true;
+
+  // Deterministic integrate verification: the agent cannot self-certify a
+  // merge. After the Integrate agent claims success, the workflow confirms
+  // mechanically that the task branch tip is an ancestor of main via the
+  // lifecycle script's verify-merge command (which resolves the branch
+  // through the crew registry — never by reconstructing "task/"+taskId — so
+  // the check cannot verify the wrong branch). The VERIFIED marker is matched
+  // by regex on the script's own stdout; agent prose is never read. This
+  // closes the hole where an agent reported "merged empty" while approved
+  // commits were still stranded on the task branch (bug b1b1f919). A genuine
+  // empty-diff Integrate (MERGED_EMPTY: no commits ahead of main) verifies
+  // vacuously — the tip is then an ancestor of main. Verification failure is
+  // an operational step failure, not a park: the dispatcher retries Integrate
+  // under its consecutive-failure cap, and the retry finds the commits still
+  // on the branch and performs the real merge — self-healing.
+  if (step.name === "Integrate" && passed) {
+    var integrateVerifyOut = "";
+    try {
+      var integrateVerifyResult = await agent(
+        "Run: " + LIFECYCLE_ENV + LIFECYCLE + " verify-merge " + taskId + " 2>&1 || true\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("verify-merge-" + taskId, reworkCount), label: "Verifying merge landed",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      integrateVerifyOut = (integrateVerifyResult.output || "").trim();
+    } catch (e) {
+      integrateVerifyOut = "";
+    }
+    if (/^VERIFIED:/m.test(integrateVerifyOut)) {
+      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of main");
+    } else {
+      var integrateVerifyReason = integrateVerifyOut
+        ? integrateVerifyOut.split("\n")[0].slice(0, 200)
+        : "verify-merge produced no usable output";
+      log("Integrate verification failed for task " + taskId + ": " + integrateVerifyReason + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nintegrate_verify: FAILED — " + integrateVerifyReason;
+      passed = false;
+    }
+  }
+
   // "rejected" is an explicit phase verdict routed through rework (Review).
   // Integrate/Publish work that did not finish is operational — "failed",
   // retryable under the dispatcher's consecutive-failure cap.

package/workflows/standard.js

@@ -1352,7 +1352,47 @@ while (i < STEPS.length) {
     passed: verdictPassed !== null ? verdictPassed : true,
     summary: workerText
   };
-  const passed = stepResult.passed === true;
+  let passed = stepResult.passed === true;
+
+  // Deterministic integrate verification: the agent cannot self-certify a
+  // merge. After the Integrate agent claims success, the workflow confirms
+  // mechanically that the task branch tip is an ancestor of main via the
+  // lifecycle script's verify-merge command (which resolves the branch
+  // through the crew registry — never by reconstructing "task/"+taskId — so
+  // the check cannot verify the wrong branch). The VERIFIED marker is matched
+  // by regex on the script's own stdout; agent prose is never read. This
+  // closes the hole where an agent reported "merged empty" while approved
+  // commits were still stranded on the task branch (bug b1b1f919). A genuine
+  // empty-diff Integrate (MERGED_EMPTY: no commits ahead of main) verifies
+  // vacuously — the tip is then an ancestor of main. Verification failure is
+  // an operational step failure, not a park: the dispatcher retries Integrate
+  // under its consecutive-failure cap, and the retry finds the commits still
+  // on the branch and performs the real merge — self-healing.
+  if (step.name === "Integrate" && passed) {
+    var integrateVerifyOut = "";
+    try {
+      var integrateVerifyResult = await agent(
+        "Run: " + LIFECYCLE_ENV + LIFECYCLE + " verify-merge " + taskId + " 2>&1 || true\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("verify-merge-" + taskId, totalReworkCount), label: "Verifying merge landed",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      integrateVerifyOut = (integrateVerifyResult.output || "").trim();
+    } catch (e) {
+      integrateVerifyOut = "";
+    }
+    if (/^VERIFIED:/m.test(integrateVerifyOut)) {
+      log("Integrate verified for task " + taskId + ": task branch tip is an ancestor of main");
+    } else {
+      var integrateVerifyReason = integrateVerifyOut
+        ? integrateVerifyOut.split("\n")[0].slice(0, 200)
+        : "verify-merge produced no usable output";
+      log("Integrate verification failed for task " + taskId + ": " + integrateVerifyReason + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nintegrate_verify: FAILED — " + integrateVerifyReason;
+      passed = false;
+    }
+  }
+
   // "rejected" is an explicit phase verdict routed through rework (Review/QA,
   // and the Build/Reproduce reports that feed them). Integrate/Publish work
   // that did not finish is operational — "failed", retryable under the