muse-crew 0.7.14 → 0.7.15

package/lib/crew-api.js

@@ -25,6 +25,7 @@
 import { readFileSync, existsSync, statSync, readlinkSync, readdirSync, appendFileSync } from "node:fs";
 import { join, resolve, sep, basename } from "node:path";
 import { randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { homedir } from "node:os";
 
@@ -1540,7 +1541,50 @@ commands["record-phase"] = (db, args) => {
   return { session: mapSession(sessionRow), event: mapEvent(eventRow) };
 };
 
-commands["create-project"] = (db, args) => {
+// Initial provenance stamp (2026-09-16, clean-room task ada95b71): the first
+// publish of an artifact project fell back to the empty-tree SHA as its diff
+// base because no provenance was ever stamped, turning the publish diff into
+// the whole repo tree (52 files / 4768 lines / 228KB) — unparseable through
+// the JSON transport and over the 200-line budget. The artifact is built from
+// the repo checkout at registration time, so create-project stamps
+// source_commit = repo HEAD for artifact-deploy projects; the first publish
+// then diffs only the task's own changes. The stamp never clobbers an
+// existing one (provenance storage is crew-home-global, so a second artifact
+// project keeps the first stamp — per-project provenance is a known gap this
+// does not introduce). A skipped stamp is reported, never silent, and never
+// fails project creation.
+function initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName }) {
+  if (deployType !== "artifact") return { stamped: false, reason: "deploy_type is not artifact" };
+  if (provenanceExists) return { stamped: false, reason: "provenance already stamped" };
+  if (!headSha) return { stamped: false, reason: "repo HEAD is unresolvable (unborn repo?)" };
+  if (!releaseName) return { stamped: false, reason: "active crew release is unresolvable" };
+  return { stamped: true, source_commit: headSha, crew_release: releaseName };
+}
+
+function tryStampInitialProvenance(db, crewHome, repoPath, deployType) {
+  const keys = db.prepare(
+    "SELECT key FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at')"
+  ).all().map((r) => r.key);
+  const provenanceExists = keys.length === 3;
+  let headSha = null;
+  try {
+    headSha = execFileSync("git", ["rev-parse", "HEAD"],
+      { cwd: repoPath, encoding: "utf8", timeout: 10000 }).trim();
+    if (!/^[0-9a-f]{40}$/.test(headSha)) headSha = null;
+  } catch { headSha = null; }
+  let releaseName = null;
+  try { releaseName = resolveActiveRelease(crewHome); } catch { releaseName = null; }
+  const plan = initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName });
+  if (!plan.stamped) return plan;
+  const upsert = db.prepare(
+    "INSERT INTO config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value");
+  upsert.run("provenance.source_commit", plan.source_commit);
+  upsert.run("provenance.crew_release", plan.crew_release);
+  upsert.run("provenance.published_at", now());
+  return plan;
+}
+
+commands["create-project"] = (db, args, ctx) => {
   const id = (args.id ?? "").trim();
   if (!/^[a-z0-9-]+$/.test(id)) throw usageError("id must be a slug.");
   const displayName = (args.display_name ?? "").trim();
@@ -1572,7 +1616,8 @@ commands["create-project"] = (db, args) => {
       description, simultaneity, quiesced, visual_protocol, created_at, updated_at)
      VALUES (@id, @display_name, @repo_path, @deploy_type, @deploy_slug,
       @description, @simultaneity, @quiesced, @visual_protocol, @created_at, @updated_at)`).run(row);
-  return { project: mapProject(row) };
+  const initialProvenance = tryStampInitialProvenance(db, ctx.crewHome, repoPath, deployType);
+  return { project: mapProject(row), initial_provenance: initialProvenance };
 };
 
 commands["get-project"] = (db, args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -50,8 +50,12 @@ const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"w
 // Manual launches without the arg default to off (previous behavior).
 var VISUAL_PROTOCOL_AVAILABLE = inputs.visual_protocol === true;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";

package/workflows/chore.js

@@ -47,8 +47,12 @@ const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_
 // Manual launches without the arg default to off (previous behavior).
 var VISUAL_PROTOCOL_AVAILABLE = inputs.visual_protocol === true;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";

package/workflows/docs.js

@@ -32,8 +32,12 @@ const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
 // what the dispatcher routed on.
 const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_phase.length > 0) ? inputs.next_phase : null;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";

package/workflows/standard.js

@@ -49,8 +49,12 @@ const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"w
 // Manual launches without the arg default to off (previous behavior).
 var VISUAL_PROTOCOL_AVAILABLE = inputs.visual_protocol === true;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";
@@ -67,6 +71,14 @@ const ORCH_PATH = crewHome + "/.orchestration";
 const LIFECYCLE_SRC = crewHome + "/lib/worktree-lifecycle.sh";
 const MERGE_LOCK_SRC = crewHome + "/lib/merge-lock.sh";
 const RUN_LIB = crewHome + "/.pins/" + taskId; // persistent disk, NOT /tmp (tmpfs wiped by cell reboots — canary b5efd1b1)
+// Deterministic spec path — computed by the workflow, never by the agent.
+// Map writes the spec to exactly SPEC_PATH; the path is handed to the agent
+// as a fact and verified mechanically after the step. Agents must never
+// compose crew-home paths themselves (2026-09-16: a Map agent saved the spec
+// under the platform's ~/workspace/.jarvis/workflow-runs/ run dir because the
+// prompt named a directory and the agent invented the rest of the path).
+const SPEC_DIR = crewHome + "/task-evidence/" + taskId + "/map";
+const SPEC_PATH = SPEC_DIR + "/spec.md";
 const LIFECYCLE = RUN_LIB + "/worktree-lifecycle.sh";
 const MERGE_LOCK = RUN_LIB + "/merge-lock.sh";
 const PUBLISH_NPM_SRC = crewHome + "/lib/publish-npm.sh";
@@ -1213,7 +1225,7 @@ while (i < STEPS.length) {
         " If the baseline evidence is missing with no baseline:none recorded, do not write the spec — report 'baseline evidence missing — Map gate bounce required' and stop.\n" +
         "Declare capture targets for the post-change visual capture: end your report with a line `capture_targets: <comma-separated views/controls this change affects>` (optional; falls back to the task description).";
     }
-    instructions = "Research the problem space, evaluate options, pick the shortest path.\nWrite a clear spec that a builder can execute without asking questions.\nThe builder will edit source files in a git worktree.\nProject: " + PROJECT_DESC + "\nSave the spec to a file under " + crewHome + "/ if needed.\nReport back in plain prose — what you specified." + mapGatePara;
+    instructions = "Research the problem space, evaluate options, pick the shortest path.\nWrite a clear spec that a builder can execute without asking questions.\nThe builder will edit source files in a git worktree.\nProject: " + PROJECT_DESC + "\nSave the spec to exactly this file: " + SPEC_PATH + " — run mkdir -p \"" + SPEC_DIR + "\" first. Do not save the spec anywhere else; this exact path is fixed and will be checked mechanically after your step.\nReport back in plain prose — what you specified." + mapGatePara;
 
   } else if (step.name === "Build") {
     instructions = "STEP 1: Prepare your worktree.\n" +
@@ -1265,7 +1277,7 @@ while (i < STEPS.length) {
       }
     }
     instructions = "Review independently and cold. You have NOT seen any reasoning from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
-      (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec (from the task description or spec files under " + crewHome + "/).\n\n") +
+      (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec at exactly " + SPEC_PATH + " (fall back to the task description if the file is absent).\n\n") +
       "Examine the code changes by running:\n" +
       LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
       "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
@@ -2427,11 +2439,40 @@ while (i < STEPS.length) {
     }
   }
 
+  // Deterministic spec-path verification: the agent cannot self-certify where
+  // it saved the spec. After Map passes, the workflow confirms mechanically
+  // that the spec file exists at the workflow-computed SPEC_PATH (2026-09-16:
+  // a Map agent saved the spec under the platform's
+  // ~/workspace/.jarvis/workflow-runs/ run dir instead of the crew home,
+  // because the prompt named a directory and the agent composed the path).
+  // A missing spec file is an operational step failure, not a park.
+  if (step.name === "Map" && passed) {
+    var specVerifyOut = "";
+    try {
+      var specVerifyResult = await agent(
+        "Run: test -f \"" + SPEC_PATH + "\" && echo SPEC_PRESENT || echo SPEC_MISSING\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("verify-spec-" + taskId, totalReworkCount), label: "Verifying spec file landed",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      specVerifyOut = (specVerifyResult.output || "").trim();
+    } catch (e) {
+      specVerifyOut = "";
+    }
+    if (/^SPEC_PRESENT/m.test(specVerifyOut)) {
+      log("Spec verified for task " + taskId + " at " + SPEC_PATH);
+    } else {
+      log("Spec verification failed for task " + taskId + ": no spec file at " + SPEC_PATH + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nspec_verify: FAILED — no spec file at " + SPEC_PATH;
+      passed = false;
+    }
+  }
+
   // "rejected" is an explicit phase verdict routed through rework (Review/QA,
   // and the Build/Reproduce reports that feed them). Integrate/Publish work
   // that did not finish is operational — "failed", retryable under the
   // dispatcher's consecutive-failure cap.
-  const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" ? "failed" : "rejected");
+  const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" || step.name === "Map" ? "failed" : "rejected");
 
   // Deterministic publish verification: the agent cannot self-certify a publish.
   // Skip-aware (park 2026-09-11): when the deterministic publish script found
@@ -2616,6 +2657,16 @@ while (i < STEPS.length) {
     return { status: "failed", task_id: taskId, reason: "Publish failed: " + summary };
   }
 
+  // Map spec failure is operational (the spec file did not land at the
+  // workflow-computed SPEC_PATH), not a verdict: the session above is
+  // recorded "failed" and the dispatcher retries at Map under its
+  // consecutive-failure cap, parking after the cap. The retry re-runs Map
+  // with the same exact-path instructions against the same SPEC_PATH.
+  if (!passed && step.name === "Map") {
+    log("Map spec verification failed for task " + taskId + " — returning failed for dispatcher retry");
+    return { status: "failed", task_id: taskId, reason: "Map spec verification failed: no spec file at " + SPEC_PATH };
+  }
+
   // Publish verification park: the build landed and post-deploy finalized,
   // but provenance is UNSTAMPED until the parent's independent read-back
   // (docs/publish-verification.md) confirms the artifact's actual content