muse-crew 0.7.11 → 0.7.13

package/workflows/chore.js

@@ -26,6 +26,15 @@ const startStepIndex = inputs.start_step_index || 0;
 // resolution back via updatetask in the self-claim below.
 const RESOLVED_WORKFLOW = inputs.resolved_workflow || null;
 const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
+// One-shot recovery routing: the dispatcher sets inputs.next_phase when it
+// routes this run via an explicit recover-task redirect. The value is
+// consumed (cleared) atomically by the successful self-claim below:
+// claim-task takes expected_next_phase and clears the matching next_phase in
+// the same transaction as the winning session insert, so no platform death
+// can slip between claim and consumption and replay the routing. A stale or
+// superseded routing survives — only an exact match clears.
+// what the dispatcher routed on.
+const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_phase.length > 0) ? inputs.next_phase : null;
 
 // Visual verdict protocol availability — the workflow parks for parent-run
 // baseline capture ONLY when the protocol is fully shipped. The protocol
@@ -638,6 +647,18 @@ function extractMarkerLines(workerText) {
   return markers.join("\n");
 }
 
+// Already-merged idempotency (canary 2026-09-15, task 1d692d91): when the
+// builder correctly makes no commit because the deliverable is already on
+// main (a prior merge or hand-repair landed it), it declares
+// `repo_diff: none (already-merged: <sha>)` naming the main commit that
+// carries the work. The sha is hex-only (7-40 chars) so the workflow can
+// interpolate it into the mechanical ancestor check without injection
+// risk. Pure — pinned byte-identical across standard/bugfix/chore.
+function extractAlreadyMerged(workerText) {
+  var m = /^repo_diff:\s*none\s*\(already-merged:\s*([0-9a-f]{7,40})\)/im.exec(workerText || "");
+  return m ? { sha: m[1].toLowerCase() } : { sha: null };
+}
+
 // Worktree confinement: the Build agent must declare the exact worktree
 // path it built in on a `worktree:` marker line. The workflow compares it
 // against WORKTREE_HINT mechanically (exact string match) — never by
@@ -815,6 +836,12 @@ let mapGateBounceCount = 0;
 // rationalized a skip against explicit instruction text — text alone did not
 // hold, so the decision now lives in workflow code, not agent judgment.
 let releaseDecision = null; // { release: "yes"|"no", version_bump: "patch"|"minor"|"major"|null }
+// Already-merged idempotency: the verified sha from the builder's
+// `repo_diff: none (already-merged: <sha>)` declaration (null when the
+// builder made commits or declared a runtime-state deliverable). The
+// workflow verifies the sha is an ancestor of main at Build closeout;
+// Review's no-diff branch reads this, never the builder's prose.
+let alreadyMergedSha = null;
 // Deterministic publish target — computed by the workflow (registry base +
 // bumpVersion), never by the Publish agent.
 let publishTarget = null; // { base, scope, target }
@@ -1054,7 +1081,7 @@ while (i < STEPS.length) {
     const claimResult = await agent(
       "Claim this task for the " + step.name + " step.\n" +
       "Run in shell and return the stdout verbatim:\n" + crewCmd("update-task", firstClaimUpdateArgs) + "\n" +
-      "Then run in shell and return the stdout verbatim:\n" + crewCmd("claim-task", { task_id: taskId, identity: step.identity, step: step.name, notes: step.name + " step started" }) + "\n" +
+      "Then run in shell and return the stdout verbatim:\n" + crewCmd("claim-task", { task_id: taskId, identity: step.identity, step: step.name, notes: step.name + " step started", ...(NEXT_PHASE_ROUTED ? { expected_next_phase: NEXT_PHASE_ROUTED } : {}) }) + "\n" +
       "If the claim response has claimed=true, then run in shell and return the stdout verbatim:\n" + crewCmd("clear-reservation", { task_id: taskId }) + "\n" +
       "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +
       "Return { claimed: <verbatim>, session_id: \"<...>\" }. If claimed is false there is no session_id; return { claimed: false, session_id: \"\" }.",
@@ -1266,12 +1293,33 @@ while (i < STEPS.length) {
       "cd " + WORKTREE_HINT + "\n" +
       "git add -A\n" +
       "git commit -m \"chore: " + safeTitle + "\"\n\n" +
-      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your report, naming the runtime-state deliverable. Otherwise commit your changes normally.\n\n" +
+      "If the task's deliverable is runtime state (a cron definition, scheduler change, or dashboard/config state created outside the repo) and the repository genuinely needs no change, do NOT fabricate a commit: leave the branch with no commits ahead of main and declare `repo_diff: none` in your report, naming the runtime-state deliverable. If you verified the deliverable is already on main (a prior merge or hand-repair landed it — do NOT re-implement working code), make no commit and declare `repo_diff: none (already-merged: <sha>)` naming the main commit that carries the work; the workflow verifies the sha is an ancestor of main, and a false declaration fails the phase. Otherwise commit your changes normally.\n\n" +
       (rejectionNotes ? "REWORK after rejection. Address:\n" + rejectionNotes + "\n\n" : "") +
       "Report back in plain prose: what you built and the outcome." +
       (PUBLISH_TYPE === "npm" ? " End your report with the release: and version_bump: lines exactly as specified above — keep them on their own lines, lowercase, unrephrased — then a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then a final line with exactly: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not." : " End your report with a line `worktree: ` followed by the exact working directory path from above (copy it verbatim \u2014 it must match character-for-character), then exactly one line: VERDICT: PASS if the build is complete, VERDICT: FAIL if it is not.");
 
   } else if (step.name === "Review") {
+    // Already-merged hydration: when this run did not execute Build itself
+    // (dispatcher resume at Review after a platform death between phases),
+    // recover the workflow-attested verification from the latest completed
+    // Build session notes. The `already_merged_verified:` line was written
+    // by the workflow after a mechanical ancestor check — it is trusted;
+    // the builder's bare declaration never is. Absent the line, the
+    // mechanical fact below reads "none declared" and Cass fails closed.
+    if (!alreadyMergedSha) {
+      var hydNotes = await agent(
+        "Read the latest completed Build session notes for task " + taskId + ".\n" +
+        "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
+        "In the returned sessions array, find the most recent session (by started_at) with task_id \"" + taskId + "\", step \"Build\", and status \"completed\". Return ONLY its notes field, verbatim, with no commentary.",
+        { key: "hydrate-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Hydrating already-merged verification" }
+      );
+      var hydStr = (typeof hydNotes === "string") ? hydNotes : JSON.stringify(hydNotes);
+      var hvm = /already_merged_verified:\s*([0-9a-f]{7,40})/i.exec(hydStr);
+      if (hvm) {
+        alreadyMergedSha = hvm[1].toLowerCase();
+        log("Hydrated already-merged verification from Build session notes: " + alreadyMergedSha);
+      }
+    }
     instructions = "Review independently and cold. No prior context from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
       (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec from the task description.\n\n") +
       "Examine the code changes by running:\n" +
@@ -1281,7 +1329,7 @@ while (i < STEPS.length) {
       WORKTREE_HINT + "/\n\n" +
       "Check quality, correctness, spec compliance.\n" +
       "Check that public-affecting changes have matching public doc updates (API.md or the published API contract). If the docs are missing or inaccurate, report what is stale, then end your report with exactly this line: VERDICT: FAIL.\n" +
-      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with a plausible runtime-state deliverable (e.g. a cron created via the cron tool). Otherwise report 'no commits ahead of main and no repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
+      "If the branch has no commits ahead of main (inspect shows an empty commit log), approve ONLY if the Build summary declares `repo_diff: none` with (a) a plausible runtime-state deliverable (e.g. a cron created via the cron tool), or (b) an already-merged declaration `repo_diff: none (already-merged: <sha>)` AND the mechanical fact below confirms the sha verified. MECHANICAL FACT (computed by the workflow, never by the builder): already_merged sha = " + (alreadyMergedSha ? alreadyMergedSha + " (verified ancestor of main: YES)" : "none declared") + ". Otherwise report 'no commits ahead of main and no valid repo_diff: none declaration — the builder likely forgot to commit', then end your report with exactly this line: VERDICT: FAIL.\n" +
       (PUBLISH_TYPE === "npm" ? "PACKAGE VERSION: this project publishes to the npm registry, and versions are assigned at publish time — never in branches. Two checks:\n" +
       "(a) The task branch must NOT have changed package.json's `version` field. Check: cd " + REPO_PATH + " && git diff main..." + TASK_BRANCH + " -- package.json. If the branch touched `version` in any way, report 'versions are assigned at publish time, never in branches — remove the version change' in your notes, then end your report with exactly this line: VERDICT: FAIL.\n" +
       "(b) The accepted Build report declares: " + releaseDecisionText() + ". " +
@@ -1295,7 +1343,7 @@ while (i < STEPS.length) {
       "Run: "+ LIFECYCLE_ENV + "WORKFLOW_RUN_ID=" + lockHolder + " integrate " + taskId + " \"merge: chore: " + safeTitle + "\"\n\n" +
       "Read the output:\n" +
       "- If it contains MERGED, integration succeeded. Report the merged commit hash.\n" +
-      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (a runtime-state deliverable, declared by Build as repo_diff: none). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
+      "- If it contains MERGED_EMPTY, the branch had no commits ahead of main (declared by Build as repo_diff: none — either a runtime-state deliverable or an already-merged sha the workflow verified). Integration succeeded vacuously: the merge lock was NOT taken and there is no new commit. Report 'merged empty: no repo changes — deliverable was runtime state or already on main', then end your report with exactly this line: VERDICT: PASS. SKIP STEP 2 (push): there is no new commit to push.\n" +
       "- If it contains LOCK_HELD, another task holds the merge lock (mid Integrate/Publish) and the 10-minute bounded backoff is exhausted. Report 'merge lock held after bounded backoff', then end your report with exactly this line: VERDICT: FAIL.\n" +
       "- If it contains CONFLICT, the plain merge failed — the merge was aborted, main is clean, and your task still holds the merge lock. Do NOT fail yet. Resolve it:\n" +
       "RESOLUTION:\n" +
@@ -1842,6 +1890,15 @@ while (i < STEPS.length) {
           // lock was lost: stop the run and park the task — never continue to
           // a provenance stamp or version assignment without holding the lock.
           var buildPoll = null;
+          // STEP 1b poll-signal accumulators (2026-09-15, task aadeccc3):
+          // the durable audit-dir fallback below needs the poll's own
+          // observations, not just its final verdict — whether our build was
+          // ever seen, whether a stranger's build was ever in flight, and
+          // what the last check observed. OR-ed across all three chunks so
+          // a signal seen in any chunk survives the chunk boundary.
+          var pollSawOurBuild = false;
+          var pollSawStranger = false;
+          var lastObservedAgentId = null;
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1864,20 +1921,25 @@ while (i < STEPS.length) {
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, reworkCount);
             buildPoll = await agent(
               "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
-              "- If no build is running (build is null): OUR build finished. Stop and report done.\n" +
+              "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
+              "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
+              "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
               "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
-              "- If the running build's agent_id is present but DIFFERENT: our build is gone (it finished before this one started). Do NOT wait on the stranger's build and do NOT attribute its completion to our attempt \u2014 stop and report done.\n" +
-              "Return JSON { \"build_done\": <true if our build is no longer running within budget, false on timeout>, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+              "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
+              "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
               { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
                 timeoutMs: 270000 }
             );
+            pollSawOurBuild = pollSawOurBuild || (buildPoll && buildPoll.saw_our_build === true);
+            pollSawStranger = pollSawStranger || (buildPoll && buildPoll.saw_stranger === true);
+            lastObservedAgentId = (buildPoll && buildPoll.observed_agent_id) || null;
             if (buildPoll && buildPoll.build_done) { break; }
           }
           if (!buildPoll || !buildPoll.build_done) {
             buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
           }
-          if (buildPoll.build_done) {
+          if (buildPoll.build_done && pollSawOurBuild) {
             // STEP 1c (mechanical): NO provenance stamp here. Canary run 8
             // (2026-09-11) proved the stamp cannot certify content: the
             // builder's applied-report is derived from the carried diff, so
@@ -1893,7 +1955,116 @@ while (i < STEPS.length) {
             artifactPublish = { source_commit: mergeCommitForPublish, pending_parent_verification: true };
             log("Publish build landed for task " + taskId + " — provenance stamp deferred to parent content verification");
           } else {
-            publishFailure = "Artifact build did not complete within budget: " + (buildPoll.status || "timeout") + ". The publish may or may not have landed — provenance was not stamped.";
+            // STEP 1b durable audit-dir fallback (2026-09-15, task aadeccc3):
+            // the poll above only observes IN-FLIGHT builds. A build that
+            // finished between the receipt capture and the poll's first check
+            // leaves no in-flight trace — but the platform's audit harness
+            // leaves a durable one (~/workspace/ts-spaces/<slug>/audits/
+            // <timestamp>-<id>/ per completed build). Diff the audit-dir
+            // listing against the pre-trigger snapshot: a timestamped dir
+            // that appeared during the attempt window is evidence a build
+            // completed. Attribution is by window, not by build identity:
+            // the poll's saw_stranger signal only catches stranger builds in
+            // flight AT a check — a stranger that finished entirely inside
+            // the window is indistinguishable, so any observed stranger
+            // blocks attribution and the outcome stays unknown. This never
+            // re-issues the edit and never stamps provenance — ok=true only
+            // routes to the parent's independent content read-back, which
+            // remains the real verification.
+            //
+            // The poll end-state is read from the poll's own observations,
+            // not from build_done alone: a build in flight at the last check
+            // means the budget was shorter than the latency (or the build is
+            // stuck) — NOT that no build ever started; nothing observed at
+            // any check is the never-started signal.
+            var pollEndState = lastObservedAgentId ? "build-still-running-at-poll-end"
+              : (pollSawOurBuild ? "our-build-observed-then-unconfirmed" : "no-build-observed-in-window");
+            var strangerObserved = pollSawStranger;
+            var newAuditDirsAfterPoll = [];
+            try {
+              var auditAfterPoll = await agent(
+                "List the artifact audit directories for slug \"" + PUBLISH_SLUG + "\" (best-effort, never a gate).\n" +
+                "Run: ls -1 ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/ 2>/dev/null\n" +
+                "Return JSON { \"dirs\": \"<newline-separated names, empty string when the audits directory does not exist or is empty>\" } and nothing else.",
+                { key: attemptKey("publish-audit-after-poll-" + taskId, reworkCount), label: "Re-listing audit dirs after build poll",
+                  schema: { type: "object", properties: { dirs: { type: "string" } }, required: ["dirs"] } }
+              );
+              var auditDirsAfterPollList = String((auditAfterPoll && auditAfterPoll.dirs) || "").split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+              newAuditDirsAfterPoll = auditDirsAfterPollList.filter(function (d) {
+                return auditDirsBeforeTrigger.indexOf(d) === -1 && /^20\d\d-\d\d-\d\dT\d\d-\d\d-\d\dZ-/.test(d);
+              });
+              log("Publish audit-dir re-list after build poll for task " + taskId + ": " + newAuditDirsAfterPoll.length + " new timestamped dir(s)");
+            } catch (auditAfterPollErr) {
+              log("Publish audit-dir re-list after build poll failed for task " + taskId + " (non-fatal, durable-evidence check degraded): " + (auditAfterPollErr && auditAfterPollErr.message ? auditAfterPollErr.message : auditAfterPollErr));
+            }
+            // auditReportOk: pure tri-state read of a report.json body —
+            // true (build ok), false (build failed), null (missing or
+            // unreadable — not evidence either way). The child returns the
+            // raw body verbatim; interpretation lives here, never in prose.
+            var auditReportOk = function (raw) {
+              if (typeof raw !== "string") return null;
+              var trimmed = raw.trim();
+              if (trimmed === "" || trimmed === "MISSING") return null;
+              var parsed;
+              try { parsed = JSON.parse(trimmed); } catch (e) { return null; }
+              if (parsed && typeof parsed.ok === "boolean") return parsed.ok;
+              return null;
+            };
+            var auditOkAfterPoll = null;
+            var newestAuditDirAfterPoll = null;
+            if (newAuditDirsAfterPoll.length > 0 && !strangerObserved) {
+              newAuditDirsAfterPoll.sort();
+              newestAuditDirAfterPoll = newAuditDirsAfterPoll[newAuditDirsAfterPoll.length - 1];
+              try {
+                var auditOkRead = await agent(
+                  "Read the build report for artifact slug \"" + PUBLISH_SLUG + "\", audit dir \"" + newestAuditDirAfterPoll + "\" (verbatim read, never interpreted, never a gate).\n" +
+                  "Run: cat ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/audits/" + newestAuditDirAfterPoll + "/report.json 2>/dev/null || echo MISSING\n" +
+                  "Return JSON { \"raw\": \"<verbatim file contents, or the literal string MISSING when the file does not exist>\" } and nothing else.",
+                  { key: attemptKey("publish-audit-ok-after-poll-" + taskId, reworkCount), label: "Reading build report after build poll",
+                    schema: { type: "object", properties: { raw: { type: "string" } }, required: ["raw"] } }
+                );
+                auditOkAfterPoll = auditReportOk(auditOkRead && auditOkRead.raw);
+              } catch (auditOkReadErr) {
+                log("Publish build-report read after build poll failed for task " + taskId + " (non-fatal, treated as unknown): " + (auditOkReadErr && auditOkReadErr.message ? auditOkReadErr.message : auditOkReadErr));
+                auditOkAfterPoll = null;
+              }
+            }
+            if (auditOkAfterPoll === true) {
+              publishBuildLanded = true;
+              artifactPublish = { source_commit: mergeCommitForPublish, pending_parent_verification: true };
+              log("Publish build landed for task " + taskId + " via durable audit evidence — provenance stamp deferred to parent content verification");
+              await recordPublishLedger({
+                commit: mergeCommitForPublish,
+                attempt: rebuildAttemptKey,
+                agent_id: rebuildAgentId,
+                applied_report: publishAppliedObservation,
+                outcome: "submitted",
+                detail: "durable audit evidence shows a build completed during the attempt window (audit dir " + newestAuditDirAfterPoll + ", report ok=true); routed to parent verification"
+              }, reworkCount);
+            } else if (auditOkAfterPoll === false) {
+              publishFailure = "Artifact build FAILED for slug " + PUBLISH_SLUG + " (audit dir " + newestAuditDirAfterPoll + ", report ok=false). Explicit negative evidence: a build ran and failed (attribution by window, not by build identity — no stranger build was observed in flight during the poll). The publish did not land — provenance was not stamped. Fail-closed.";
+              await recordPublishLedger({
+                commit: mergeCommitForPublish,
+                attempt: rebuildAttemptKey,
+                agent_id: rebuildAgentId,
+                applied_report: publishAppliedObservation,
+                outcome: "failed",
+                detail: "a build ran and failed (attribution by window, not by build identity): audit dir " + newestAuditDirAfterPoll + " report ok=false; no stranger build observed in flight during the poll"
+              }, reworkCount);
+            } else {
+              var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
+                : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
+                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+              await recordPublishLedger({
+                commit: mergeCommitForPublish,
+                attempt: rebuildAttemptKey,
+                agent_id: rebuildAgentId,
+                applied_report: publishAppliedObservation,
+                outcome: "unknown",
+                detail: "durable audit-dir fallback could not attribute a completed build to this attempt (unattributable_reason=" + unattributableReason + ", poll_end_state=" + pollEndState + ")"
+              }, reworkCount);
+            }
           }
         } else {
           publishFailure = "Artifact rebuild trigger failed: " + (rebuildTrigger.error || "artifact_edit not accepted") + ". The publish did not land.";
@@ -2144,6 +2315,52 @@ while (i < STEPS.length) {
       };
     }
     log("Build worktree confinement passed: " + wt.path);
+
+    // Already-merged idempotency: a `repo_diff: none (already-merged:
+    // <sha>)` declaration is verified mechanically — <sha> must resolve
+    // and be an ancestor of main in the configured repo. A fabricated or
+    // mistaken declaration fails the phase here (the dispatcher retries
+    // Build under its consecutive-failure cap); a verified declaration is
+    // recorded in alreadyMergedSha for Review's no-diff branch. Without
+    // this guard, Build correctly doing nothing left Review with no
+    // mechanical way to accept an empty diff, and Cass rejected for "no
+    // commits ahead of main — the builder likely forgot to commit" while
+    // the deliverable sat on main (canary 2026-09-15, task 1d692d91).
+    // The sha is hex-only by construction (extractAlreadyMerged), so
+    // interpolating it into the shell command cannot inject.
+    var am = extractAlreadyMerged(workerText);
+    if (am.sha) {
+      var amCheck = await agent(
+        "Verify the builder's already-merged declaration.\n" +
+        "Run in shell and return the stdout verbatim:\n" +
+        "cd " + REPO_PATH + " && git rev-parse --verify --quiet " + am.sha + " >/dev/null && git merge-base --is-ancestor " + am.sha + " main && echo ALREADY_MERGED_YES || echo ALREADY_MERGED_NO",
+        { key: "verify-already-merged" + (reworkCount > 0 ? "-r" + reworkCount : ""), label: "Verifying already-merged declaration" }
+      );
+      var amOut = (typeof amCheck === "string") ? amCheck : JSON.stringify(amCheck);
+      if (!/ALREADY_MERGED_YES/.test(amOut)) {
+        log("Build already-merged declaration failed verification — " + am.sha + " is not an ancestor of main — marking failed for retry");
+        await agent(
+          "Record already-merged verification failure.\n" +
+          "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
+            task_id: taskId,
+            session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name, status: "failed",
+              notes: "Build declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of main in the configured repo. The declaration is fabricated or mistaken; the work is not on main. Phase failed for retry" },
+            event: { task_id: taskId, type: "failed", message: "Build already-merged declaration failed verification — " + am.sha + " not an ancestor of main, phase failed, dispatcher will retry" }
+          }),
+          { key: "record-already-merged-fail-" + step.name, label: "Recording already-merged verification failure" }
+        );
+        return {
+          __hatchWorkflowControl: "blocked",
+          result: {
+            blocked_reason: "Build already-merged declaration failed verification",
+            message: "The builder declared repo_diff: none (already-merged: " + am.sha + ") but " + am.sha + " is not an ancestor of main. The work is not on main; the phase is marked failed and the dispatcher will retry Build.",
+            task_id: taskId
+          }
+        };
+      }
+      alreadyMergedSha = am.sha;
+      log("Build already-merged declaration verified: " + am.sha + " is an ancestor of main");
+    }
   }
 
   // Deterministic closeout: no formatter agent. The verdict is mechanical
@@ -2304,6 +2521,15 @@ while (i < STEPS.length) {
   } else {
     summary = (stepResult.summary || "Step completed").slice(0, 2000 - workerMarkers.length - 1) + (workerMarkers ? "\n" + workerMarkers : "");
   }
+  // Already-merged attestation: when the Build gate verified the builder's
+  // already-merged declaration, the workflow records its own marker line in
+  // the session notes (like the builder markers above, it is appended after
+  // the slice so it can never be amputated). A later run resumed at Review
+  // hydrates alreadyMergedSha from this workflow-attested line — never from
+  // the builder's declaration alone.
+  if (step.name === "Build" && alreadyMergedSha) {
+    summary += "\nalready_merged_verified: " + alreadyMergedSha;
+  }
 
   // Capture mapper's spec for Build and Review
   if (step.name === "Map" && passed) {

package/workflows/crew-dispatch.js

@@ -103,18 +103,44 @@ phase("dispatch");
 // the schema demanded a top-level object with ready_tasks. The LLM resolved
 // the contradiction non-deterministically: some ticks validated, some
 // burned retries and blocked the whole dispatcher.)
-const boardReturn = await agent(
-  "Read the dispatch state.\n" +
-  "Run in shell and return the stdout as a raw string:\n" + crewCmd("get-dispatch-state", {}) + "\n" +
-  "Return the command's stdout JSON as a plain string, byte-for-byte, unmodified. " +
-  "Do NOT parse the JSON — your return value must be the raw stdout string, never an object. " +
-  "Do not select fields, do not rewrite, summarize, paraphrase, or reformat anything. " +
-  "The result has keys ready_tasks, projects, config, counts — ferry the string exactly as received.",
-  {
-    key: "read-board",
-    label: "Reading board state"
+// Bounded in-tick retry (canary 2026-09-15): the read-board agent
+// occasionally ferries malformed JSON (observed twice: a literal
+// `.replace()` code fragment appended to the dispatch-state string).
+// A malformed ferry used to abort the whole dispatcher tick; retrying
+// the identical dispatcher call recovered both times. Retry the read
+// in-tick instead of burning a tick — two attempts with distinct
+// replay keys, fail closed after that.
+var boardReturn = null;
+var boardReadError = null;
+for (var readAttempt = 1; readAttempt <= 2; readAttempt++) {
+  var readBoardKey = readAttempt === 1 ? "read-board" : "read-board-r" + readAttempt;
+  try {
+    boardReturn = await agent(
+      "Read the dispatch state.\n" +
+      "Run in shell and return the stdout as a raw string:\n" + crewCmd("get-dispatch-state", {}) + "\n" +
+      "Return the command's stdout JSON as a plain string, byte-for-byte, unmodified. " +
+      "Do NOT parse the JSON — your return value must be the raw stdout string, never an object. " +
+      "Do not select fields, do not rewrite, summarize, paraphrase, or reformat anything. " +
+      "The result has keys ready_tasks, projects, config, counts — ferry the string exactly as received.",
+      {
+        key: readBoardKey,
+        label: "Reading board state" + (readAttempt > 1 ? " (attempt " + readAttempt + ")" : "")
+      }
+    );
+    // Parse eagerly inside the attempt so a malformed ferry retries
+    // instead of aborting the tick. (function declarations hoist.)
+    parseBoardJson(boardReturn);
+    boardReadError = null;
+    break;
+  } catch (readErr) {
+    boardReadError = readErr;
+    log("WARNING: read-board attempt " + readAttempt + " failed (" + (readErr && readErr.message ? readErr.message : readErr) + ")" + (readAttempt < 2 ? " — retrying" : " — attempts exhausted"));
+    boardReturn = null;
   }
-);
+}
+if (boardReturn === null) {
+  throw new Error("read-board: all 2 attempts failed to ferry parseable board JSON: " + (boardReadError && boardReadError.message ? boardReadError.message : boardReadError));
+}
 
 // Deterministic board parse — the read-board agent is told to return the
 // CLI stdout as a raw string; the workflow parses it here. Fails closed:
@@ -210,6 +236,10 @@ function projectTaskRecord(t) {
     blocked: t.blocked,
     deps: Array.isArray(t.deps) ? t.deps.slice() : [],
     priority: t.priority,
+    // next_phase is the one-shot recovery routing set by recover-task. It is
+    // ferried verbatim here and consumed (validated, routed, cleared) by the
+    // deterministic eligibility logic below — never interpreted by the LLM.
+    next_phase: (typeof t.next_phase === "string" && t.next_phase.length > 0) ? t.next_phase : null,
     latest_session: ls ? { id: ls.id, status: ls.status, step: ls.step, notes: ls.notes } : null,
     retry: {
       consecutive_failures: (typeof cf === "number" && cf >= 0) ? cf : 0,
@@ -497,6 +527,30 @@ for (var t = 0; t < allTasks.length; t++) {
   var workflow = task.workflow || "standard";
   var steps = WORKFLOWS[workflow] || WORKFLOWS.standard;
 
+  // One-shot recovery routing: recover-task sets next_phase to an explicit
+  // human-chosen phase. It takes precedence over every session-derived path
+  // below — the human's redirect wins over the automatic resume — but never
+  // over work in flight, and never on a task in a terminal state.
+  // Invalid values fail closed: logged, skipped, and NOT cleared, so a
+  // human can fix it with a corrected recover-task. Valid values bypass
+  // the retry cap by design: an explicit redirect is not an automatic
+  // retry and must not consume retry budget. The launched workflow consumes
+  // (clears) next_phase on its successful self-claim, exactly once.
+  if (task.next_phase) {
+    if (task.state !== "todo" && task.state !== "in_progress") {
+      log("Skipped \"" + task.title + "\" — next_phase \"" + task.next_phase + "\" set but state is " + task.state + "; left set for inspection");
+      continue;
+    }
+    if (latest && latest.status === "running") continue; // work in flight
+    var npIdx = steps.indexOf(task.next_phase);
+    if (npIdx < 0) {
+      log("Skipped \"" + task.title + "\" — next_phase \"" + task.next_phase + "\" not in " + workflow + " step registry; left set for a corrected recover-task");
+      continue;
+    }
+    eligible.push({ task: task, startStep: npIdx, reason: "next_phase", workflow: workflow, nextPhase: task.next_phase });
+    continue;
+  }
+
   if (task.state === "todo") {
     // Idle playtests always enter at QA — the filing carries the full
     // assignment, so Triage/Map have nothing to add.
@@ -844,7 +898,12 @@ for (var p = 0; p < toProcess.length; p++) {
     // whether the task record had no workflow (playtest filings carry explicit
     // workflow:'standard', so they correctly get false).
     resolved_workflow: iworkflow,
-    workflow_was_null: (itask.workflow == null)
+    workflow_was_null: (itask.workflow == null),
+    // One-shot recovery routing: the value the dispatcher routed on. The
+    // workflow's successful self-claim consumes (clears) it atomically via
+    // claim-task's expected_next_phase — only an exact match clears, so a
+    // newer recover-task written in the race window survives.
+    next_phase: item.nextPhase || null
   };
 
   log("Recommended " + iworkflow + " for \"" + itask.title + "\" [" + taskProject + "] at step " + nextStepName);

package/workflows/crew-init.js

@@ -29,21 +29,28 @@ if (!!dashboardSlug !== !!dashboardRepoPath) throw new Error("dashboardSlug and
 
 const orchDir = crewHome + "/.orchestration";
 
-// ── Gate 0: Launchable-path + repo validation ───────────────────────
+// ── Gate 0: Launchable-path validation ─────────────────────────────
 // workflow_launch only accepts workspace-contained scripts. A crewHome
 // outside the workspace would produce an instance whose workflows can
 // never launch (the Gate 1 canary's /home/hatch/.crew-canary-gate1
 // defect, 2026-09-11: workers resorted to changing, manually staged
 // copies). Fail closed here so no such instance can ever be created.
+// The crew home is state, not a repository: it is NEVER git-initialized.
+// (2026-09-15: removed the old git-init — its unborn repo let a clean
+// room register the crew home itself as a project's repo_path, and the
+// worktree lifecycle then failed closed on the home's untracked state
+// files. A home with no .git can never pass create-project's
+// isGitRepoPath check, so the trap is structurally impossible. The
+// crew's own source repo remains fully registerable — that is how a
+// crew works on itself.)
 // The dashboard repo is validated too: init registers the dashboard
 // project against it, and a non-git path would only fail later at the
-// first Build (the canary's npm-package repo_path defect, 2026-09-13:
-// init registered the crew home itself as the dashboard repo_path).
-// Unlike the crew home, the dashboard repo is NEVER auto-created — it is
-// the user's own project repository; a non-git path is a user error.
+// first Build. Unlike the crew home, the dashboard repo is NEVER
+// auto-created — it is the user's own project repository; a non-git
+// path is a user error.
 // Gate 0 decision logic is pure JS — the agent is a sensor, not a judge.
-// It reports raw facts (HOME, expanded paths, the git rev-parse exit
-// codes); the launchable/repo_valid verdicts are computed here,
+// It reports raw facts (HOME, expanded paths, the dashboard repo's git
+// rev-parse exit code); the launchable verdicts are computed here,
 // deterministically. An agent asked for a verdict can mis-apply the
 // prefix rule (e.g. the "$ws-evil" trailing-slash trick); code cannot.
 // (Prompt hardening is a smell — this is the mechanical version.)
@@ -53,15 +60,15 @@ function expandTilde(p, home) {
   return p;
 }
 function gate0Decide(facts) {
-  // facts: { home, crewHomeExpanded, gitExitCode, dashboardRepoExpanded, dashboardRepoGitExitCode }
+  // facts: { home, crewHomeExpanded, dashboardRepoExpanded, dashboardRepoGitExitCode }
   // The dashboard fields are null in CLI-only mode (no dashboard) — the
   // dashboard verdicts are then vacuously true (nothing to validate).
+  // The crew home carries no repo verdict: homes are state, never repos.
   var workspace = facts.home + "/workspace";
   var launchable = facts.crewHomeExpanded.indexOf(workspace + "/") === 0;
-  var repoValid = facts.gitExitCode === 0;
   var dashboardRepoLaunchable = facts.dashboardRepoExpanded == null || facts.dashboardRepoExpanded.indexOf(workspace + "/") === 0;
   var dashboardRepoValid = facts.dashboardRepoGitExitCode == null || facts.dashboardRepoGitExitCode === 0;
-  return { workspace: workspace, launchable: launchable, repoValid: repoValid, dashboardRepoLaunchable: dashboardRepoLaunchable, dashboardRepoValid: dashboardRepoValid };
+  return { workspace: workspace, launchable: launchable, dashboardRepoLaunchable: dashboardRepoLaunchable, dashboardRepoValid: dashboardRepoValid };
 }
 var gateFacts;
 try {
@@ -73,19 +80,16 @@ try {
     "1. home=$(echo $HOME)\\n" +
     "2. Expand a leading ~/ in the requested crewHome against $HOME (leave other paths untouched).\\n" +
     "3. If the expanded crewHome does not exist: mkdir -p <expanded crewHome>\\n" +
-    "4. Run: git -C <expanded crewHome> rev-parse --git-dir; echo EXIT:$?\\n" +
-    "5. If EXIT is not 0: run git -C <expanded crewHome> init -b main (or git init if -b not supported)\\n" +
-    "6. Re-run: git -C <expanded crewHome> rev-parse --git-dir; echo EXIT:$?\\n" +
+    "4. If <expanded crewHome>/.git exists, remove it (rm -rf <expanded crewHome>/.git). The crew home is state, never a git repository — a vestigial .git would let the home be mistaken for a project repo.\\n" +
     (dashboardRepoPath ?
-      "7. Expand a leading ~/ in the requested dashboardRepoPath against $HOME (leave other paths untouched).\\n" +
-      "8. Run: git -C <expanded dashboardRepoPath> rev-parse --git-dir; echo EXIT:$?\\n" +
+      "5. Expand a leading ~/ in the requested dashboardRepoPath against $HOME (leave other paths untouched).\\n" +
+      "6. Run: git -C <expanded dashboardRepoPath> rev-parse --git-dir; echo EXIT:$?\\n" +
       "   Do NOT create or git-init the dashboard repo — it must already be a git repository.\\n" +
-      "9. Return JSON { home, crewHomeExpanded, gitExitCode, dashboardRepoExpanded, dashboardRepoGitExitCode }\\n" +
-      "   where gitExitCode is the FINAL crew-home exit code after init, and dashboardRepoGitExitCode\\n" +
-      "   is the dashboard repo's exit code (no init attempted).\\n" :
-      "7. Return JSON { home, crewHomeExpanded, gitExitCode, dashboardRepoExpanded: null, dashboardRepoGitExitCode: null }.\\n") +
+      "7. Return JSON { home, crewHomeExpanded, dashboardRepoExpanded, dashboardRepoGitExitCode }\\n" +
+      "   where dashboardRepoGitExitCode is the dashboard repo's exit code (no init attempted).\\n" :
+      "5. Return JSON { home, crewHomeExpanded, dashboardRepoExpanded: null, dashboardRepoGitExitCode: null }.\\n") +
     "\\n" +
-    "This ensures the crew home is a valid git repository" + (dashboardRepoPath ? " and the dashboard repo exists as one" : "") + ". Do not judge — just ensure and report.",
+    "This ensures the crew home exists inside the workspace and is not a git repository" + (dashboardRepoPath ? ", and that the dashboard repo exists as one" : "") + ". Do not judge — just ensure and report.",
     {
       key: "gate-0",
       label: "Validate crew home",
@@ -94,11 +98,10 @@ try {
         properties: {
           home: { type: "string" },
           crewHomeExpanded: { type: "string" },
-          gitExitCode: { type: "number" },
           dashboardRepoExpanded: { type: ["string", "null"] },
           dashboardRepoGitExitCode: { type: ["number", "null"] }
         },
-        required: ["home", "crewHomeExpanded", "gitExitCode", "dashboardRepoExpanded", "dashboardRepoGitExitCode"]
+        required: ["home", "crewHomeExpanded", "dashboardRepoExpanded", "dashboardRepoGitExitCode"]
       }
     }
   );
@@ -115,15 +118,6 @@ if (!gateResult.launchable) {
     }
   };
 }
-if (!gateResult.repoValid) {
-  return {
-    __hatchWorkflowControl: "blocked",
-    result: {
-      blocked_reason: "crewHome git init failed",
-      message: "crewHome (" + gateFacts.crewHomeExpanded + ") could not be initialized as a git repository (git exit code " + gateFacts.gitExitCode + "). Check permissions and try again."
-    }
-  };
-}
 if (!gateResult.dashboardRepoLaunchable) {
   return {
     __hatchWorkflowControl: "blocked",
@@ -142,7 +136,7 @@ if (!gateResult.dashboardRepoValid) {
     }
   };
 }
-log("Gate 0: crewHome " + gateFacts.crewHomeExpanded + " is workspace-contained and a valid git repo" + (gateFacts.dashboardRepoExpanded ? "; dashboard repo " + gateFacts.dashboardRepoExpanded + " is workspace-contained and a valid git repo" : " (CLI-only mode: no dashboard)"));
+log("Gate 0: crewHome " + gateFacts.crewHomeExpanded + " is workspace-contained (a state dir, never a git repo)" + (gateFacts.dashboardRepoExpanded ? "; dashboard repo " + gateFacts.dashboardRepoExpanded + " is workspace-contained and a valid git repo" : " (CLI-only mode: no dashboard)"));
 
 // ── Crew name ─────────────────────────────────────────────────────────
 // The human names their crew during setup (SETUP-EXPERIENCE.md). Stored as

package/workflows/docs.js

@@ -22,6 +22,15 @@ const startStepIndex = inputs.start_step_index || 0;
 // resolution back via updatetask in the self-claim below.
 const RESOLVED_WORKFLOW = inputs.resolved_workflow || null;
 const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
+// One-shot recovery routing: the dispatcher sets inputs.next_phase when it
+// routes this run via an explicit recover-task redirect. The value is
+// consumed (cleared) atomically by the successful self-claim below:
+// claim-task takes expected_next_phase and clears the matching next_phase in
+// the same transaction as the winning session insert, so no platform death
+// can slip between claim and consumption and replay the routing. A stale or
+// superseded routing survives — only an exact match clears.
+// what the dispatcher routed on.
+const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_phase.length > 0) ? inputs.next_phase : null;
 
 // Config from args — backward-compatible fallbacks for manual launches
 const crewHome = inputs.crewHome || "~/workspace/.jarvis";
@@ -148,7 +157,7 @@ while (i < STEPS.length) {
     const claimResult = await agent(
       "Claim this task for the " + step.name + " step.\n" +
       "Run in shell and return the stdout verbatim:\n" + crewCmd("update-task", firstClaimUpdateArgs) + "\n" +
-      "Then run in shell and return the stdout verbatim:\n" + crewCmd("claim-task", { task_id: taskId, identity: step.identity, step: step.name, notes: step.name + " step started" }) + "\n" +
+      "Then run in shell and return the stdout verbatim:\n" + crewCmd("claim-task", { task_id: taskId, identity: step.identity, step: step.name, notes: step.name + " step started", ...(NEXT_PHASE_ROUTED ? { expected_next_phase: NEXT_PHASE_ROUTED } : {}) }) + "\n" +
       "Do not interpret the claim response. It already contains an explicit \"claimed\" field — copy it verbatim.\n" +
       "Return { claimed: <verbatim>, session_id: \"<...>\" }. If claimed is false there is no session_id; return { claimed: false, session_id: \"\" }.",
       {