muse-crew 0.7.11 → 0.7.13

package/lib/read-ooda-verdict.js

@@ -0,0 +1,94 @@
+// read-ooda-verdict.js — deterministic cross-checker for the OODA terminal
+// verdict (2026-09-15).
+//
+// The prose VERDICT: line in an agent's report is the routing signal, but
+// verdict.json is the reason-carrying record the workflow closeout actually
+// reads. This script cross-checks the two: the caller passes the verdict it
+// read from prose (--expect) and the script fails loudly when the
+// machine-readable record disagrees or cannot back the verdict.
+//
+// Usage:
+//   node read-ooda-verdict.js --dir <phase-dir> --expect <PASS|FAIL>
+//
+// Reads <phase-dir>/verdict.json and prints exactly one JSON line to stdout.
+//
+// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt}
+// when the record exists, parses, has a verdict field, the verdict equals
+// --expect, and a FAIL carries a non-empty reason.
+//
+// Exit 2 with {ok:false, code, error} when:
+//   missing      — verdict.json is absent (the agent never wrote one)
+//   corrupt      — unparseable JSON, or parsed but no verdict field
+//   contradiction — the record's verdict !== --expect (NOT_POSSIBLE can
+//                  never equal PASS or FAIL, so it lands here)
+//   no_reason    — the record is FAIL with an empty or missing reason
+//
+// Determinism: no wall-clock reads, no randomness. The script never judges
+// report content — the agent states the reason; the machine enforces its
+// presence and its agreement with the prose verdict.
+"use strict";
+
+const { readFileSync, existsSync } = require("node:fs");
+const { join, resolve } = require("node:path");
+
+function fail(code, error) {
+  process.stdout.write(JSON.stringify({ ok: false, code: code, error: error }) + "\n");
+  process.exit(2);
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--dir") out.dir = argv[++i];
+    else if (a === "--expect") out.expect = argv[++i];
+    else fail("bad_input", "unknown flag: " + a);
+  }
+  return out;
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (!args.dir) fail("bad_input", "missing --dir <phase-dir>");
+  if (!args.expect) fail("bad_input", "missing --expect <PASS|FAIL>");
+  if (args.expect !== "PASS" && args.expect !== "FAIL") {
+    fail("bad_input", "unknown --expect: " + args.expect + " (PASS|FAIL)");
+  }
+
+  const verdictPath = join(resolve(args.dir), "verdict.json");
+  if (!existsSync(verdictPath)) {
+    fail("missing", "verdict.json not found: " + verdictPath);
+  }
+
+  let record;
+  try {
+    record = JSON.parse(readFileSync(verdictPath, "utf8"));
+  } catch (e) {
+    fail("corrupt", "verdict.json is unparseable: " + e.message);
+  }
+  if (!record || typeof record.verdict !== "string" || record.verdict === "") {
+    fail("corrupt", "verdict.json has no verdict field: " + verdictPath);
+  }
+
+  if (record.verdict !== args.expect) {
+    fail("contradiction", "verdict.json verdict is " + record.verdict + " but prose verdict was " + args.expect);
+  }
+
+  if (record.verdict === "FAIL") {
+    if (record.reason === undefined || String(record.reason).trim() === "") {
+      fail("no_reason", "verdict.json verdict is FAIL with no machine-readable reason");
+    }
+  }
+
+  process.stdout.write(JSON.stringify({
+    ok: true,
+    verdict: record.verdict,
+    reason: record.reason === undefined ? "" : record.reason,
+    summary: record.summary === undefined ? "" : record.summary,
+    expected: record.expected === undefined ? "" : record.expected,
+    actual: record.actual === undefined ? "" : record.actual,
+    attempt: record.attempt === undefined ? "" : record.attempt,
+  }) + "\n");
+}
+
+main();

package/lib/readback-disk.js

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+// readback-disk.js — deterministic disk read-back sensor for parent publish
+// verification (docs/publish-verification.md).
+//
+// The read-back gap (2026-09-14): the platform removed `artifact_inspect`
+// and no agent-callable content read-back existed, so every artifact publish
+// parked at `publish: verification-requested` permanently. The platform's
+// artifact edits land in its on-disk working copy of the artifact source
+// (~/workspace/ts-spaces/<slug>/ — verified empirically 2026-09-15: added
+// lines present, removed lines absent across real platform commits), so a
+// deterministic local sensor can replace the removed inspection tool: no
+// LLM, no async handoff, no prose to parse.
+//
+// This script is the SENSOR; lib/verify-publish.js stays the judge. It
+// emits the exact machine-readable findings block the verifier already
+// parses:
+//
+//   FILE: <path>
+//   ADDED: <exact added line from the diff> :: PRESENT|ABSENT
+//   REMOVED: <exact removed line from the diff> :: PRESENT|ABSENT
+//   END_FILE
+//
+// one ADDED line per (+) diff line and one REMOVED line per (-) diff line,
+// in diff order. The verdict is PRESENT iff that exact line occurs in the
+// file's CURRENT on-disk source (whole-line match), ABSENT otherwise.
+//
+// Authority boundary: the sensor reads the platform's working copy of the
+// artifact source — the tree the hosted artifact is built/served from. If
+// the working copy is stale relative to a just-applied edit, the findings
+// honestly report ABSENT and the verifier fails CLOSED (parked, never a
+// false stamp). Staleness can only park, never certify.
+//
+// Usage:
+//   node readback-disk.js --repo-path <path> --commit <sha> --base <sha>
+//       --slug <artifact-slug> --task-id <uuid> [--spaces-root <dir>]
+//
+// --base is the previously-stamped provenance source_commit (or the
+// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
+// publish) — the SAME base the verifier uses. --spaces-root defaults to
+// ~/workspace/ts-spaces.
+//
+// Exit codes: 0 ok (findings block on stdout) · 2 usage/validation ·
+// 1 git/diff/read failure. On non-zero exit NOTHING is printed to stdout,
+// so a caller must never save stdout as a findings file.
+//
+// Security: the slug is charset-validated and the resolved space directory
+// must stay under the spaces root (realpath containment); every file path
+// from the diff is likewise contained before reading. A path that escapes
+// is a validation failure (exit 2), never a read.
+
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
+function arg(name) {
+  const i = process.argv.indexOf(name);
+  if (i < 0 || i + 1 >= process.argv.length) {
+    fail("usage", `${name} is required.`, 2);
+  }
+  return process.argv[i + 1];
+}
+function fail(code, message, exitCode) {
+  // stderr only — stdout must stay empty on failure.
+  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
+  process.exit(exitCode);
+}
+
+const repoPath = arg("--repo-path");
+const commit = arg("--commit");
+const base = arg("--base");
+const slug = arg("--slug");
+const taskId = arg("--task-id");
+const spacesRoot = process.argv.includes("--spaces-root")
+  ? arg("--spaces-root")
+  : join(homedir(), "workspace", "ts-spaces");
+
+if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
+if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
+if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(slug)) {
+  fail("usage", `slug ${JSON.stringify(slug)} is not a safe artifact slug.`, 2);
+}
+
+// Resolve the space directory with realpath containment: the slug must not
+// escape the spaces root (no "..", no symlinks pointing out).
+let spaceDir;
+try {
+  const rootReal = realpathSync(spacesRoot);
+  const candReal = realpathSync(join(spacesRoot, slug));
+  if (candReal !== rootReal && !candReal.startsWith(rootReal + "/")) {
+    fail("usage", `slug ${JSON.stringify(slug)} resolves outside the spaces root.`, 2);
+  }
+  spaceDir = candReal;
+} catch (e) {
+  fail("usage", `cannot resolve space dir for slug ${JSON.stringify(slug)}: ${e.message}`, 2);
+}
+try {
+  if (!statSync(spaceDir).isDirectory()) fail("usage", `space dir ${spaceDir} is not a directory.`, 2);
+} catch (e) {
+  fail("usage", `space dir ${spaceDir} unreadable: ${e.message}`, 2);
+}
+
+// The publish delta is base..commit — the same diff the verifier checks the
+// findings against. Refuse a base that is not an ancestor: certifying a
+// diff against an unrelated tree is worse than no read-back.
+if (base !== EMPTY_TREE) {
+  try {
+    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
+  } catch (e) {
+    fail("usage", `base ${base} is not an ancestor of commit ${commit} — refusing to read back an unrelated tree.`, 2);
+  }
+}
+
+let diff;
+try {
+  diff = execFileSync("git", ["-C", repoPath, "diff", base, commit, "--"], {
+    encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
+  });
+} catch (e) {
+  fail("git", `git diff failed: ${e.message}`, 1);
+}
+if (!diff.trim()) {
+  fail("git", "empty diff for commit — nothing to read back.", 1);
+}
+
+// Parse the diff into per-file added/removed lines (byte-identical parser
+// to build-readback-request.js and verify-publish.js: the verifier looks
+// the raw lines up verbatim, so all three must agree on the split).
+const files = [];
+let current = null;
+for (const line of diff.split("\n")) {
+  if (line.startsWith("diff --git")) {
+    const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
+    current = { path: m ? m[2] : "unknown", added: [], removed: [] };
+    files.push(current);
+  } else if (current && line.startsWith("+") && !line.startsWith("+++")) {
+    current.added.push(line.slice(1));
+  } else if (current && line.startsWith("-") && !line.startsWith("---")) {
+    current.removed.push(line.slice(1));
+  }
+}
+
+// Whole-line content of a disk file, normalized for the membership test.
+// Trailing-newline artifact popped (same convention as verify-publish.js
+// oldTreeLines); one trailing CR stripped per line so CRLF working copies
+// compare honestly against LF diffs. The RAW diff lines are still what get
+// emitted — the verifier looks those up verbatim.
+const norm = (s) => (s.endsWith("\r") ? s.slice(0, -1) : s);
+function diskLines(absPath) {
+  if (!existsSync(absPath)) return new Set(); // missing file: every line ABSENT
+  let text;
+  try {
+    text = readFileSync(absPath, "utf8");
+  } catch (e) {
+    fail("read", `cannot read ${absPath}: ${e.message}`, 1);
+  }
+  const lines = text.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  return new Set(lines.map(norm));
+}
+
+const out = [];
+for (const f of files) {
+  // Contain every diff path inside the space dir before reading.
+  const abs = resolve(spaceDir, f.path);
+  if (abs !== spaceDir && !abs.startsWith(spaceDir + "/")) {
+    fail("usage", `diff path ${JSON.stringify(f.path)} escapes the space dir.`, 2);
+  }
+  const present = diskLines(abs);
+  out.push(`FILE: ${f.path}`);
+  for (const line of f.added) {
+    out.push(`ADDED: ${line} :: ${present.has(norm(line)) ? "PRESENT" : "ABSENT"}`);
+  }
+  for (const line of f.removed) {
+    out.push(`REMOVED: ${line} :: ${present.has(norm(line)) ? "PRESENT" : "ABSENT"}`);
+  }
+  out.push("END_FILE");
+}
+
+process.stdout.write(out.join("\n") + "\n");
+process.stderr.write(JSON.stringify({
+  ok: true, slug, task_id: taskId, commit, base,
+  files: files.map((f) => f.path),
+} ) + "\n");

package/lib/render-html.js

@@ -52,6 +52,8 @@ function parseArgs(argv) {
 }
 
 function loadPlaywright() {
+  // playwright-core is a declared dependency (package.json), so a normal
+  // npm install resolves it from the package's own node_modules.
   try {
     return require("playwright-core");
   } catch (e) { /* fall through */ }
@@ -64,12 +66,6 @@ function loadPlaywright() {
       return require(envDir);
     } catch (e) { /* fall through */ }
   }
-  const conventional = "/home/hatch/workspace/crew-tools/node_modules/playwright-core";
-  if (existsSync(conventional)) {
-    try {
-      return require(conventional);
-    } catch (e) { /* fall through */ }
-  }
   fail(3, {
     ok: false,
     not_possible: "NOT POSSIBLE: playwright-core is not installed or not resolvable. " +

package/lib/see-act.js

@@ -70,6 +70,8 @@ function parseArgs(argv) {
 }
 
 function loadPlaywright() {
+  // playwright-core is a declared dependency (package.json), so a normal
+  // npm install resolves it from the package's own node_modules.
   try {
     return require("playwright-core");
   } catch (e) { /* fall through */ }
@@ -82,12 +84,6 @@ function loadPlaywright() {
       return require(envDir);
     } catch (e) { /* fall through */ }
   }
-  const conventional = "/home/hatch/workspace/crew-tools/node_modules/playwright-core";
-  if (existsSync(conventional)) {
-    try {
-      return require(conventional);
-    } catch (e) { /* fall through */ }
-  }
   fail(3, {
     ok: false,
     not_possible: "NOT POSSIBLE: playwright-core is not installed or not resolvable. " +

package/lib/verify-publish.js

@@ -5,8 +5,10 @@
 // async read-back inspection's result JSON and MECHANICALLY decides the
 // verdict: it parses the inspector's machine-readable findings block,
 // compares every added/removed diff line against the reported
-// present/absent verdicts, checks supersession via git, and only then
-// stamps provenance, logs the terminal event, and re-queues the task.
+// present/absent verdicts (with a mechanically computed collision
+// exemption for removed lines that also occur in untouched code),
+// checks supersession via git, and only then stamps provenance, logs
+// the terminal event, and re-queues the task.
 //
 // The LLM is the sensor (it reads the artifact source); this code is the
 // judge. Unparseable findings, content mismatches, supersession, and stamp
@@ -207,6 +209,51 @@ if (!findings || bestScore <= 0) {
 }
 
 // --- 4. Mechanical comparison ----------------------------------------------
+// Collision exemption (2026-09-15, task 00bca4b8): a removed diff line that
+// also occurs verbatim in untouched code has zero discriminating power —
+// its presence in the new file cannot tell "old block removed" from "old
+// block present". Task 1d692d91 parked a valid publish because two removed
+// lines (`          return (`, `              </div>`) occur identically in
+// the untouched WorkflowSteps component; the naive every-removed-line-ABSENT
+// rule failed closed on zero signal.
+//
+// The exemption is mechanically computed and signal-preserving: for file F,
+// line L is exempt iff L occurs in F's old tree (at <base>) strictly more
+// times than the expected diff removes it. An exempted line must survive in
+// untouched code no matter what, so exempting it can never turn a missed
+// removal into a pass. No change to the sensor: build-readback-request.js
+// still reports whole-file PRESENT/ABSENT honestly; only this judge gets
+// smarter.
+function oldTreeLines(path) {
+  // Exact whole-line contents of <path> at <base>; [] when the base is the
+  // empty tree or the file did not exist there (a new file has no removed
+  // lines, so the exemption is vacuous for it).
+  if (base === EMPTY_TREE) return [];
+  let text;
+  try {
+    text = execFileSync("git", ["-C", repoPath, "show", `${base}:${path}`], {
+      encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
+    });
+  } catch {
+    return [];
+  }
+  if (text === "") return [];
+  const lines = text.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop(); // drop the trailing-newline artifact
+  return lines;
+}
+const oldTreeCounts = new Map(); // path -> Map(line -> occurrences in old tree)
+function oldCount(path, line) {
+  let counts = oldTreeCounts.get(path);
+  if (counts === undefined) {
+    counts = new Map();
+    for (const l of oldTreeLines(path)) counts.set(l, (counts.get(l) || 0) + 1);
+    oldTreeCounts.set(path, counts);
+  }
+  return counts.get(line) || 0;
+}
+
+let exempted = 0;
 for (const [path, exp] of expected) {
   const found = findings.get(path);
   if (!found) terminal("content-mismatch", `no findings for changed file ${path}`);
@@ -215,10 +262,19 @@ for (const [path, exp] of expected) {
     if (v === undefined) terminal("unreadable-result", `no ADDED finding for line in ${path}: ${line.slice(0, 60)}`);
     if (v !== "PRESENT") terminal("content-mismatch", `added line ABSENT in ${path}: ${line.slice(0, 80)}`);
   }
+  // The diff may remove the same line more than once; the old tree must
+  // account for every removal before a line counts as a collision.
+  const removedBudget = new Map();
+  for (const line of exp.removed) removedBudget.set(line, (removedBudget.get(line) || 0) + 1);
   for (const line of exp.removed) {
     const v = found.removed.get(line);
     if (v === undefined) terminal("unreadable-result", `no REMOVED finding for line in ${path}: ${line.slice(0, 60)}`);
-    if (v !== "ABSENT") terminal("content-mismatch", `removed line PRESENT in ${path}: ${line.slice(0, 80)}`);
+    if (v === "ABSENT") continue;
+    if (oldCount(path, line) > removedBudget.get(line)) {
+      exempted += 1; // colliding pre-existing line: zero signal, cannot fail a good publish
+      continue;
+    }
+    terminal("content-mismatch", `removed line PRESENT in ${path}: ${line.slice(0, 80)}`);
   }
 }
 
@@ -259,7 +315,9 @@ if (!p || p.source_commit !== commit || p.task_id !== taskId || p.crew_release !
 
 // --- 8. Terminal verified event + re-queue -----------------------------------
 const verifiedMsg =
-  `publish: verified ${commit} (${inspectionId}) — read-back: all added lines PRESENT, all removed lines ABSENT; ${buildNote}; no supersession (HEAD=${commit}).`;
+  `publish: verified ${commit} (${inspectionId}) — read-back: all added lines PRESENT, all removed lines ABSENT` +
+  (exempted > 0 ? ` (${exempted} colliding removed line${exempted === 1 ? "" : "s"} exempted)` : "") +
+  `; ${buildNote}; no supersession (HEAD=${commit}).`;
 api("log-event", { task_id: taskId, type: "note", message: verifiedMsg.slice(0, 1000) });
 api("update-task", { id: taskId, state: "in_progress" });
 process.stdout.write(JSON.stringify({ ok: true, verdict: "verified", commit, build_note: buildNote }) + "\n");

package/lib/write-ooda-verdict.js

@@ -9,6 +9,11 @@
 //     [--summary <text>] [--expected <text>] [--actual <text>]
 //     [--missing <json-array>] [--reason <text>] [--ts <iso>]
 //
+// --reason is REQUIRED and must be non-empty after trim when --verdict is
+// FAIL or NOT_POSSIBLE; a missing or empty --reason fails with exit 2 and
+// writes nothing (no verdict.json, no ledger line). A FAIL verdict must
+// carry a machine-readable reason — an unreasoned FAIL can never be written.
+//
 // Writes two records:
 //   <phase-dir>/verdict.json  — the LATEST verdict (what the workflow
 //     closeout reads). Overwritten on each call.
@@ -24,7 +29,8 @@
 //
 // missing_evidence names evidence that should exist but honestly does not
 // (e.g. "no pixel-visual of the footer element: infinite scroll").
-// reason carries the NOT POSSIBLE explanation when verdict is NOT_POSSIBLE.
+// reason carries the FAIL defect or the NOT POSSIBLE explanation — required
+// for both verdicts, never optional.
 //
 // Exit 0 on success, 2 on bad input. Determinism: no wall-clock reads, no
 // randomness; ts comes only from --ts and is omitted when not passed.
@@ -87,6 +93,17 @@ function main() {
   if (!args.verdict) fail("missing --verdict <PASS|FAIL|NOT_POSSIBLE>");
   if (!VERDICTS[args.verdict]) fail("unknown --verdict: " + args.verdict + " (PASS|FAIL|NOT_POSSIBLE)");
 
+  // A FAIL or NOT_POSSIBLE verdict without a machine-readable reason cannot
+  // be written — the workflow closeout reads verdict.json for the reason,
+  // and an unreasoned negative verdict is a broken record.
+  var reason = "";
+  if (args.verdict === "FAIL" || args.verdict === "NOT_POSSIBLE") {
+    if (args.reason === undefined || String(args.reason).trim() === "") {
+      fail("--reason is required for a " + args.verdict + " verdict and must be non-empty");
+    }
+    reason = String(args.reason).trim();
+  }
+
   const attempt = String(args.attempt).trim();
 
   let missing = [];
@@ -109,7 +126,7 @@ function main() {
     actual: args.actual || "",
     missing_evidence: missing,
   };
-  if (args.verdict === "NOT_POSSIBLE") record.reason = args.reason || "";
+  if (args.verdict === "FAIL" || args.verdict === "NOT_POSSIBLE") record.reason = reason;
   if (args.ts) record.ts = args.ts;
 
   const dir = resolve(args.dir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.11",
+  "version": "0.7.13",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,
@@ -25,5 +25,8 @@
     "workflows",
     "software-development"
   ],
-  "author": "emojimanegg1"
+  "author": "emojimanegg1",
+  "dependencies": {
+    "playwright-core": "1.63.0"
+  }
 }

package/seed/cron-body-template.md

@@ -37,10 +37,14 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 
    If the dispatcher returned no claims or the claims array is empty, log NO_DISPATCH and CONTINUE to Step 4.5 — do NOT exit. Verification (4.5) and evidence (6) run independently of dispatch claims. A no-claims tick must still verify parked publishes and deliver evidence. (Fixed 2026-09-14: the old "exit on NO_DISPATCH" skipped verification permanently.)
 
-4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, claims, and certifies; you are only the async ferry for the inspection.
+4.5. **Parent publish verification (docs/publish-verification.md):** The publisher parks instead of stamping provenance; the parent — this tick, the live root agent — verifies content and stamps. Deterministic code detects, reads back, and certifies; you are only the ferry between the deterministic steps (scan → sensor → verifier).
    - Scan (code): `node {crewHome}/lib/crew-api.js --crew-home {crewHome} scan-verification-pending`
      This atomically claims each verification-pending task (1-hour lease, so a second tick cannot double-verify) and reconciles verified-but-still-parked tasks to `in_progress`. It returns `{ to_verify: [...], reconciled: [...] }`. Log both lists. If the scan exits 2 (e.g. the active release cannot be resolved), log the error loudly and continue — do NOT work around it.
-   - **READ-BACK BLOCKED (2026-09-14):** `artifact_inspect` was removed by the platform. No agent-callable replacement exists (`artifact.inspect` is malfunction diagnosis, not a read-back tool), so the inspection ferry step cannot run. For each entry in `to_verify`, log `verification-blocked: no agent-callable read-back tool <task_id> <commit>` and leave the task parked — do NOT attempt an inspection call, do NOT judge content yourself, and do NOT stamp provenance. The deterministic machinery (`build-readback-request.js`, `verify-publish.js`) is preserved in `lib/` for when a read-back path exists.
+   - **Read-back (deterministic sensor, 2026-09-15):** no platform inspection tool is needed — `lib/readback-disk.js` reads the platform's on-disk working copy of the artifact source (`~/workspace/ts-spaces/<slug>/`) and emits the machine-readable findings block the verifier parses. For each entry in `to_verify`, resolve the base via `get-provenance` (`source_commit`; the empty-tree sha `4b825dc642cb6eb9a060e54bf8d69288fbee4904` when nothing is stamped yet — a first publish), then run:
+     `node {crewHome}/lib/readback-disk.js --repo-path "<repo_path>" --commit <commit> --base <base> --slug "<deploy_slug>" --task-id <task_id> > /tmp/readback-<task_id>.txt 2> /tmp/readback-<task_id>.err`
+     Use the entry's `repo_path` and `deploy_slug` verbatim. If the sensor exits 0, the result file holds the findings block — hand it to the verify step below. If it exits non-zero, do NOT save or use stdout: log `publish: verification-procedural-error <commit> <first line of the .err file>` and leave the task parked — the next tick retries. A sensor failure is procedural (the read could not be performed), never a content verdict. Do NOT judge content yourself, and do NOT stamp provenance.
+   - **Verify (code):** `node {crewHome}/lib/verify-publish.js --crew-home {crewHome} --task-id <task_id> --commit <commit> --base <base> --repo-path "<repo_path>" --slug "<deploy_slug>" --crew-release <crew_release> --inspection-id <task_id>-disk --result-file /tmp/readback-<task_id>.txt`
+     Pass `--build-agent-id <id>` from the entry's `build_agent_id` when it is present. Use the SAME `<base>` the sensor ran with. The verifier parses the findings, compares mechanically against the base..commit diff, checks supersession, and stamps only on a match. Its terminal verdicts (`publish: verified` → task re-queued; `publish: verification-failed` → stays parked) are final — log them and continue.
    - Never stamp provenance from prose. Never infer a verdict from an inspector's summary text. The verify script's machine-checked comparison is the only certification.
 
 5. **Monitor launched workflows until terminal (stay-alive — 2026-09-13):** The platform ties async workflow `agent()` authorization to the launcher's lifetime: if THIS tick ends while a workflow is still running, the workflow's next `agent()` call fails with "subagent bootstrap is no longer authorized" / "subagent reservation owner is terminal". Prevention beats recovery here, so this tick is configured with a 90-minute execution timeout (`timeout_secs: 5400` in seed/crons.json) and you MUST stay alive until every launched run reaches a terminal state. Do not exit early while a launched run is still `running` — your death is what kills it.
@@ -58,7 +62,7 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
      - **Task-level error (not a platform error):** The workflow's own error handling applies. Stop monitoring this run.
    - **If status is `running` or `paused`:** Continue polling.
    - **Monitor ceiling:** 90 minutes from tick start. If a run is still not terminal then (pathological — the work phase caps each `agent()` call at 60 minutes), exit; the next tick's Step 0 continues recovery through the durable mapping.
-   - **Backstop (not the plan, the insurance):** If THIS launcher dies early for any reason (platform kill, cell recycle), the next tick's Step 0 detects the dead run through the durable platform run -> task mapping and retries it — at most ~3 minutes later. The mapping exists so a dead launcher never strands a task for an hour; the monitor exists so the launcher rarely dies mid-run in the first place.
+   - **Backstop (not the plan, the insurance):** If THIS launcher dies early for any reason (platform kill, cell recycle), the next tick's Step 0 detects the dead run through the durable platform run -> task mapping and retries it — at most ~15 minutes later. The mapping exists so a dead launcher never strands a task for an hour; the monitor exists so the launcher rarely dies mid-run in the first place.
    - When all launched workflows are terminal or retry-exhausted, continue to step 6 (evidence) — do not exit before delivering evidence for newly-done tasks.
 
 6. **Deliver QA evidence to chat (Eric's screenshots):** You are the crew's voice to Eric. Whenever a task completes QA, its evidence screenshots must land in this report automatically — Eric explicitly asked for them. This step is mechanical discovery, not judgment.

package/seed/crons.json

@@ -7,7 +7,7 @@
       "mode": "task",
       "owner": "space:{dashboardSlug}",
       "schedule": {
-        "every": "3m",
+        "every": "15m",
         "kind": "interval"
       },
       "timeout_secs": 5400,