muse-crew 0.6.6 → 0.6.7

package/lib/worktree-lifecycle.sh

@@ -17,27 +17,49 @@
 #   integrate <task_id> <commit_msg>     — merge lock → merge into main → report commit
 #   verify-merge <task_id>              — confirm the task branch tip is an ancestor of main (post-step merge check)
 #   post-deploy <task_id>                — commit builder artifacts, cleanup, release lock
+#   terminal-cleanup <task_id>         — park/fail boundary: release lock (always), reclaim worktree+branch only when fully merged
 #   cleanup   <task_id>                  — remove worktree + branch (no lock)
 #   status    <task_id>                  — report worktree state
 #   refresh-lock <task_id>               — refresh merge lock timestamp (resets staleness clock)
 #   lock-status <task_id>                — report merge lock state: UNLOCKED, or key=value lock status (locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds)
-#   sweep     [report|clean]             — find/clean orphans + stale locks
+#   merge-record <task_id>               — print $CREW_HOME/.merge-records/<task_id>, or NO_RECORD
 #
 # Exit codes:
 #   0 — success
 #   1 — validation/usage error
-#   2 — merge lock held by another task
+#   2 — merge lock held by another task; also BLOCKED on unset
+#       CREW_HOME/CREW_REPO (prints a BLOCKED line, never proceeds silently)
 #   3 — merge conflict
 #   4 — dirty main (cannot merge)
 
 set -euo pipefail
 
-REPO="${CREW_REPO:-$HOME/workspace/ts-spaces/orchestra-dashboard}"
+# Fail closed: no stale dev-path defaults. Every caller (workflows thread
+# both through LIFECYCLE_ENV) provides them. An unset CREW_REPO would
+# prepare/integrate in the wrong checkout; an unset CREW_HOME would read
+# the wrong instance's pins and audit log.
+if [ -z "${CREW_REPO:-}" ]; then
+  echo "BLOCKED: CREW_REPO is not set — refusing to run (a default path would operate on the wrong repo)"
+  exit 2
+fi
+if [ -z "${CREW_HOME:-}" ]; then
+  echo "BLOCKED: CREW_HOME is not set — refusing to run (a default path would read the wrong instance's state)"
+  exit 2
+fi
+REPO="$CREW_REPO"
+export CREW_REPO  # internal merge-lock.sh calls inherit the repo being worked on
 WORKTREE_DIR="$REPO/.worktrees"
 REGISTRY_DIR="$WORKTREE_DIR/.registry"
-LIB_DIR="${CREW_LIB:-$HOME/workspace/.jarvis/lib}"
+LIB_DIR="${CREW_LIB:-$CREW_HOME/lib}"
 MERGE_LOCK="$LIB_DIR/merge-lock.sh"
-ORPHAN_SWEEP="$LIB_DIR/orphan-sweep.sh"
+
+# Merge records: $CREW_HOME/.merge-records/<task_id> (key=value, append-only,
+# on persistent disk — same durability class as $CREW_HOME/.pins/<task>).
+# Written by cmd_integrate (post-reconcile HEAD). Read by cmd_verify_merge
+# (branch-reclamation fallback) and the workflow. Consumers trust a record
+# only after verifying `git merge-base --is-ancestor <merge_commit> main` —
+# a stale record is inert. Removed by cmd_post_deploy (consumed).
+MERGE_RECORDS_DIR="$CREW_HOME/.merge-records"
 
 # --- helpers ---
 
@@ -245,9 +267,41 @@ cmd_integrate() {
     exit 3
   fi
 
+  # Reconcile with the remote while the merge lock is still held. Another
+  # writer (a second crew instance, direct pushes) can land commits on
+  # origin/main outside this lock; pushing a stale main then fails
+  # non-fast-forward and the Integrate phase fails closed. Fetch and merge
+  # origin/main now so the agent's subsequent push is a fast-forward.
+  # Fail-soft when there is no remote; fail closed on a real conflict.
+  if git rev-parse --verify "origin/main" >/dev/null 2>&1; then
+    if git fetch origin main 2>&1; then
+      if ! git merge --no-edit "origin/main" -m "merge: reconcile with origin/main before push ($task_id)" 2>&1; then
+        echo "CONFLICT: origin/main diverged with conflicting changes — aborting"
+        git merge --abort 2>/dev/null || true
+        exit 3
+      fi
+      echo "RECONCILED: merged origin/main into main"
+    else
+      echo "WARNING: git fetch origin failed — pushing without remote reconcile; the push step may report non-fast-forward"
+    fi
+  else
+    echo "NO_REMOTE: no origin/main — skipping remote reconcile"
+  fi
+
   local merged_commit
   merged_commit=$(git rev-parse HEAD)
   echo "MERGED: $merged_commit"
+
+  # Record the merge commit (merge-lease fix, 2026-09-12): if the branch is
+  # later reclaimed (e.g. under an expired lease), verify-merge can still
+  # confirm the merge landed from this record. Append-only, on persistent disk.
+  mkdir -p "$MERGE_RECORDS_DIR"
+  {
+    echo "merge_commit=$merged_commit"
+    echo "merged_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  } >> "$MERGE_RECORDS_DIR/$task_id"
+  echo "RECORDED: merge commit $merged_commit in $MERGE_RECORDS_DIR/$task_id"
+
   echo "LOCK: held by $task_id — release after deploy with post-deploy"
 }
 
@@ -264,8 +318,21 @@ cmd_verify_merge() {
 
   cd "$REPO"
 
+  # If the branch is gone, fall back to the merge record (merge-lease fix,
+  # 2026-09-12): the branch may have been reclaimed under an expired lease
+  # after the merge landed. The record is trusted only if the recorded
+  # commit is actually an ancestor of main.
   if ! git rev-parse --verify "$branch" >/dev/null 2>&1; then
-    echo "ERROR: branch $branch does not exist"
+    local record_file="$MERGE_RECORDS_DIR/$task_id"
+    if [ -f "$record_file" ]; then
+      local recorded_commit
+      recorded_commit=$(grep "^merge_commit=" "$record_file" | tail -1 | cut -d= -f2)
+      if [ -n "$recorded_commit" ] && git merge-base --is-ancestor "$recorded_commit" main 2>/dev/null; then
+        echo "VERIFIED: branch $branch gone but recorded merge commit $recorded_commit is an ancestor of main — merge landed"
+        return 0
+      fi
+    fi
+    echo "ERROR: branch $branch does not exist (and no valid merge record)"
     return 1
   fi
 
@@ -305,10 +372,14 @@ cmd_post_deploy() {
   local final_commit
   final_commit=$(git rev-parse HEAD)
 
-  # Cleanup worktree + branch
+  # Cleanup worktree + branch — report honestly: a failed removal must
+  # never print success (a lying "removed" hid real leftovers).
   if [ -d "$WORKTREE_DIR/$task_id" ]; then
-    git worktree remove "$WORKTREE_DIR/$task_id" 2>/dev/null || true
-    echo "WORKTREE: removed"
+    if git worktree remove "$WORKTREE_DIR/$task_id" 2>/dev/null; then
+      echo "WORKTREE: removed"
+    else
+      echo "WORKTREE: remove-failed"
+    fi
   fi
   git worktree prune 2>/dev/null
   git branch -d "task/$task_id" 2>/dev/null && echo "BRANCH: deleted" || true
@@ -317,9 +388,79 @@ cmd_post_deploy() {
   # Release merge lock
   "$MERGE_LOCK" release "$task_id" 2>/dev/null && echo "LOCK: released" || true
 
+  # Consume the merge record — the merge is now deployed
+  rm -f "$MERGE_RECORDS_DIR/$task_id"
+
   echo "DEPLOYED: $final_commit"
 }
 
+# Terminal cleanup: the run's last act at every park/fail boundary. The
+# merge lock is a shared resource, so its release is unconditional and
+# forgiving (only the holder can release; anyone else is a no-op). The
+# worktree and branch are reclaimed ONLY when the task branch is fully
+# merged into main — then they are redundant and safe to drop. Anything
+# else is preserved for the human by design: parked work awaiting
+# judgment must survive its run. Never force-removes a dirty worktree:
+# uncommitted work is reported loudly, never silently destroyed.
+cmd_terminal_cleanup() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+
+  cd "$REPO"
+
+  if "$MERGE_LOCK" release "$task_id" 2>/dev/null; then
+    echo "LOCK: released"
+  else
+    echo "LOCK: not-held"
+  fi
+
+  local branch
+  branch=$(resolve_branch "$task_id")
+  if ! git rev-parse --verify "$branch" >/dev/null 2>&1; then
+    echo "BRANCH: absent — nothing to reclaim"
+    echo "CLEANED: false"
+    return 0
+  fi
+  if ! git merge-base --is-ancestor "$branch" main 2>/dev/null; then
+    local ahead
+    ahead=$(git rev-list --count "main..$branch" 2>/dev/null || echo "?")
+    echo "PRESERVED: $branch holds $ahead unmerged commit(s) — left for human"
+    echo "CLEANED: false"
+    return 0
+  fi
+  local wt_path
+  wt_path=$(resolve_path "$task_id")
+  local cleaned=true
+  if [ -d "$wt_path" ]; then
+    if git worktree remove "$wt_path" 2>/dev/null; then
+      echo "WORKTREE: removed"
+    else
+      echo "WORKTREE: remove-failed (left in place)"
+      cleaned=false
+    fi
+  else
+    echo "WORKTREE: not-found"
+  fi
+  git worktree prune 2>/dev/null || true
+  if git branch -d "$branch" 2>/dev/null; then
+    echo "BRANCH: deleted"
+  else
+    echo "BRANCH: delete-failed"
+    cleaned=false
+  fi
+  # The registry is the source of truth for task→branch/path: it is
+  # unregistered only when the reclamation actually completed. A partial
+  # cleanup keeps the mapping so the leftovers stay visible.
+  if [ "$cleaned" = true ]; then
+    unregister "$task_id"
+    echo "REGISTRY: unregistered"
+    echo "CLEANED: true"
+  else
+    echo "REGISTRY: kept (cleanup incomplete)"
+    echo "CLEANED: false"
+  fi
+}
+
 cmd_cleanup() {
   local task_id="$1"
   validate_task_id "$task_id"
@@ -393,11 +534,6 @@ cmd_status() {
   "$MERGE_LOCK" status 2>/dev/null || true
 }
 
-cmd_sweep() {
-  local mode="${1:-report}"
-  "$ORPHAN_SWEEP" "$mode"
-}
-
 cmd_refresh_lock() {
   local task_id="$1"
   validate_task_id "$task_id"
@@ -414,6 +550,17 @@ cmd_lock_status() {
   "$MERGE_LOCK" status
 }
 
+cmd_merge_record() {
+  local task_id="$1"
+  validate_task_id "$task_id"
+  local record_file="$MERGE_RECORDS_DIR/$task_id"
+  if [ -f "$record_file" ]; then
+    cat "$record_file"
+  else
+    echo "NO_RECORD"
+  fi
+}
+
 # --- dispatch ---
 
 cmd="${1:-}"
@@ -426,14 +573,15 @@ case "$cmd" in
   integrate)    cmd_integrate "${1:?task_id required}" "${2:-}" ;;
   verify-merge) cmd_verify_merge "${1:?task_id required}" ;;
   post-deploy)  cmd_post_deploy "${1:?task_id required}" ;;
+  terminal-cleanup) cmd_terminal_cleanup "${1:?task_id required}" ;;
   cleanup)      cmd_cleanup "${1:?task_id required}" ;;
   status)       cmd_status "${1:?task_id required}" ;;
   refresh-lock) cmd_refresh_lock "${1:?task_id required}" ;;
   lock-status)  cmd_lock_status "${1:?task_id required}" ;;
-  sweep)        cmd_sweep "${1:-report}" ;;
+  merge-record) cmd_merge_record "${1:?task_id required}" ;;
   *)
     echo "Usage: worktree-lifecycle.sh <command> [args]"
-    echo "Commands: validate, prepare, inspect, integrate, verify-merge, post-deploy, cleanup, status, refresh-lock, lock-status, sweep"
+    echo "Commands: validate, prepare, inspect, integrate, verify-merge, post-deploy, terminal-cleanup, cleanup, status, refresh-lock, lock-status, merge-record"
     exit 1
     ;;
 esac

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "muse-crew",
-  "version": "0.6.6",
-  "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
+  "version": "0.6.7",
+  "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,
   "repository": {

package/seed/AGENTS.md

@@ -4,7 +4,6 @@ Init source data. Everything `crew-init.js` reads when setting up a new crew ins
 
 - `crons.json` — the declarative cron manifest; crew-init creates/updates each entry idempotently; `enabled` is a creation-time default only
 - `cron-body-template.md` — template for creating the dispatch cron job
-- `cron-sweep-body-template.md` — template for creating the orphan-sweep cron job
 - `posture.md` — PM posture that shapes the user's assistant for crew interaction
 - `feedback/` — feedback feature placeholder
 - `workflows/` — human-readable workflow definitions, copied to `$CREW_HOME/.orchestration/workflows/` during init

package/seed/crons.json

@@ -12,19 +12,6 @@
       },
       "timeout_secs": 120,
       "title": "Muse Crew polling loop"
-    },
-    {
-      "body_template": "cron-sweep-body-template.md",
-      "enabled": false,
-      "id": "crew-orphan-sweep",
-      "mode": "task",
-      "owner": "space:{dashboardSlug}",
-      "schedule": {
-        "every": "30m",
-        "kind": "interval"
-      },
-      "timeout_secs": 120,
-      "title": "Muse Crew orphan sweep"
     }
   ],
   "version": 1

package/workflows/AGENTS.md

@@ -2,8 +2,10 @@
 
 Executable Muse workflow scripts (JavaScript). These are what the workflow runtime actually runs.
 
-- `crew-dispatch.js` — reads the board, recommends eligible tasks, returns structured launch records (the launched workflow self-claims; the dispatcher never writes claims)
-- `crew-init.js` — sets up a new crew instance: orchestration folders, dashboard, cron, sample project
+- `crew-dispatch.js` — reads the board, recommends eligible tasks, returns structured launch records (the launched workflow self-claims; the dispatcher never writes claims). Skips tasks on quiesced projects and on projects with no repo_path configured.
+
+All four workflow scripts share byte-identical transport helpers (`workRetryKey`, `buildTransportRetryTrailer`, `describeWorkAgentFailure`, `workerMissingArtifactTools` — pinned by `tests/closeout.test.js`). The transport-retry loop treats a worker report naming the missing artifact tool namespace (bug 3472bf36, a per-launch platform flake) as a retryable attempt with a fresh launch rather than accepting a useless report.
+- `crew-init.js` — sets up a new crew instance: Gate 0 validates crewHome is workspace-contained and a valid git repo; bootstraps the release system; scaffolds orchestration folders; creates/converges cron jobs from the declarative manifest. Idempotent. The crew owns its state via the Crew API (lib/crew-api.js); the dashboard is a pure client and is never a dependency.
 - `standard.js` — default task workflow: Triage → Capture → Map → Build → Review → Integrate → Publish → QA
 - `bugfix.js` — adds Capture after Triage, then Reproduce
 - `chore.js` — adds Capture after Triage, drops QA (low-risk)