muse-crew 0.7.14 → 0.7.16

package/lib/crew-api.js

@@ -25,6 +25,7 @@
 import { readFileSync, existsSync, statSync, readlinkSync, readdirSync, appendFileSync } from "node:fs";
 import { join, resolve, sep, basename } from "node:path";
 import { randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import { DatabaseSync } from "node:sqlite";
 import { homedir } from "node:os";
 
@@ -1540,7 +1541,50 @@ commands["record-phase"] = (db, args) => {
   return { session: mapSession(sessionRow), event: mapEvent(eventRow) };
 };
 
-commands["create-project"] = (db, args) => {
+// Initial provenance stamp (2026-09-16, clean-room task ada95b71): the first
+// publish of an artifact project fell back to the empty-tree SHA as its diff
+// base because no provenance was ever stamped, turning the publish diff into
+// the whole repo tree (52 files / 4768 lines / 228KB) — unparseable through
+// the JSON transport and over the 200-line budget. The artifact is built from
+// the repo checkout at registration time, so create-project stamps
+// source_commit = repo HEAD for artifact-deploy projects; the first publish
+// then diffs only the task's own changes. The stamp never clobbers an
+// existing one (provenance storage is crew-home-global, so a second artifact
+// project keeps the first stamp — per-project provenance is a known gap this
+// does not introduce). A skipped stamp is reported, never silent, and never
+// fails project creation.
+function initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName }) {
+  if (deployType !== "artifact") return { stamped: false, reason: "deploy_type is not artifact" };
+  if (provenanceExists) return { stamped: false, reason: "provenance already stamped" };
+  if (!headSha) return { stamped: false, reason: "repo HEAD is unresolvable (unborn repo?)" };
+  if (!releaseName) return { stamped: false, reason: "active crew release is unresolvable" };
+  return { stamped: true, source_commit: headSha, crew_release: releaseName };
+}
+
+function tryStampInitialProvenance(db, crewHome, repoPath, deployType) {
+  const keys = db.prepare(
+    "SELECT key FROM config WHERE key IN ('provenance.source_commit','provenance.crew_release','provenance.published_at')"
+  ).all().map((r) => r.key);
+  const provenanceExists = keys.length === 3;
+  let headSha = null;
+  try {
+    headSha = execFileSync("git", ["rev-parse", "HEAD"],
+      { cwd: repoPath, encoding: "utf8", timeout: 10000 }).trim();
+    if (!/^[0-9a-f]{40}$/.test(headSha)) headSha = null;
+  } catch { headSha = null; }
+  let releaseName = null;
+  try { releaseName = resolveActiveRelease(crewHome); } catch { releaseName = null; }
+  const plan = initialProvenancePlan({ deployType, provenanceExists, headSha, releaseName });
+  if (!plan.stamped) return plan;
+  const upsert = db.prepare(
+    "INSERT INTO config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value");
+  upsert.run("provenance.source_commit", plan.source_commit);
+  upsert.run("provenance.crew_release", plan.crew_release);
+  upsert.run("provenance.published_at", now());
+  return plan;
+}
+
+commands["create-project"] = (db, args, ctx) => {
   const id = (args.id ?? "").trim();
   if (!/^[a-z0-9-]+$/.test(id)) throw usageError("id must be a slug.");
   const displayName = (args.display_name ?? "").trim();
@@ -1572,7 +1616,8 @@ commands["create-project"] = (db, args) => {
       description, simultaneity, quiesced, visual_protocol, created_at, updated_at)
      VALUES (@id, @display_name, @repo_path, @deploy_type, @deploy_slug,
       @description, @simultaneity, @quiesced, @visual_protocol, @created_at, @updated_at)`).run(row);
-  return { project: mapProject(row) };
+  const initialProvenance = tryStampInitialProvenance(db, ctx.crewHome, repoPath, deployType);
+  return { project: mapProject(row), initial_provenance: initialProvenance };
 };
 
 commands["get-project"] = (db, args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.14",
+  "version": "0.7.16",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -50,8 +50,12 @@ const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"w
 // Manual launches without the arg default to off (previous behavior).
 var VISUAL_PROTOCOL_AVAILABLE = inputs.visual_protocol === true;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";
@@ -1886,6 +1890,10 @@ while (i < STEPS.length) {
           var pollSawOurBuild = false;
           var pollSawStranger = false;
           var lastObservedAgentId = null;
+          // Poll-chunk failure record (2026-09-16, task 1febe8eb): chunk
+          // agent calls that threw instead of returning a verdict —
+          // recorded for the post-poll diagnosis, never terminal alone.
+          var chunkFailures = [];
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1906,22 +1914,36 @@ while (i < STEPS.length) {
             var pollKey = (chunk === 1)
               ? attemptKey("publish-artifact-poll-" + taskId, totalReworkCount)
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, totalReworkCount);
-            buildPoll = await agent(
-              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
-              "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
-              "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
-              "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
-              "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
-              "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
-              "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
-              { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
-                timeoutMs: 270000 }
-            );
-            pollSawOurBuild = pollSawOurBuild || (buildPoll && buildPoll.saw_our_build === true);
-            pollSawStranger = pollSawStranger || (buildPoll && buildPoll.saw_stranger === true);
-            lastObservedAgentId = (buildPoll && buildPoll.observed_agent_id) || null;
-            if (buildPoll && buildPoll.build_done) { break; }
+            try {
+              buildPoll = await agent(
+                "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+                "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
+                "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
+                "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
+                "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
+                "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
+                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+                { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
+                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                  timeoutMs: 270000 }
+              );
+            } catch (chunkErr) {
+              // A hung or failed chunk is inconclusive, never terminal:
+              // record it and continue to the next chunk. (2026-09-16,
+              // clean-room task 1febe8eb: the platform's 270s agent
+              // timeout killed chunk 2, which threw out of this loop —
+              // skipping chunk 3 AND the STEP 1b audit-dir fallback and
+              // parking on the exception path.) Fail-closed still applies
+              // after chunk 3 and the fallback are exhausted.
+              chunkFailures.push("chunk " + chunk + ": " + (chunkErr && chunkErr.message ? chunkErr.message : chunkErr));
+              log("Artifact build poll chunk " + chunk + " of 3 failed (" + (chunkErr && chunkErr.message ? chunkErr.message : chunkErr) + ") \u2014 continuing to the next chunk; build completion still unproven.");
+            }
+            if (buildPoll) {
+              pollSawOurBuild = pollSawOurBuild || (buildPoll.saw_our_build === true);
+              pollSawStranger = pollSawStranger || (buildPoll.saw_stranger === true);
+              lastObservedAgentId = buildPoll.observed_agent_id || null;
+              if (buildPoll.build_done) { break; }
+            }
           }
           if (!buildPoll || !buildPoll.build_done) {
             buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
@@ -2044,7 +2066,7 @@ while (i < STEPS.length) {
               var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
                 : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
                 : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
-              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
               await recordPublishLedger({
                 commit: mergeCommitForPublish,
                 attempt: rebuildAttemptKey,

package/workflows/chore.js

@@ -47,8 +47,12 @@ const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_
 // Manual launches without the arg default to off (previous behavior).
 var VISUAL_PROTOCOL_AVAILABLE = inputs.visual_protocol === true;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";
@@ -1899,6 +1903,10 @@ while (i < STEPS.length) {
           var pollSawOurBuild = false;
           var pollSawStranger = false;
           var lastObservedAgentId = null;
+          // Poll-chunk failure record (2026-09-16, task 1febe8eb): chunk
+          // agent calls that threw instead of returning a verdict —
+          // recorded for the post-poll diagnosis, never terminal alone.
+          var chunkFailures = [];
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1919,22 +1927,36 @@ while (i < STEPS.length) {
             var pollKey = (chunk === 1)
               ? attemptKey("publish-artifact-poll-" + taskId, reworkCount)
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, reworkCount);
-            buildPoll = await agent(
-              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
-              "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
-              "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
-              "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
-              "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
-              "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
-              "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
-              { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
-                timeoutMs: 270000 }
-            );
-            pollSawOurBuild = pollSawOurBuild || (buildPoll && buildPoll.saw_our_build === true);
-            pollSawStranger = pollSawStranger || (buildPoll && buildPoll.saw_stranger === true);
-            lastObservedAgentId = (buildPoll && buildPoll.observed_agent_id) || null;
-            if (buildPoll && buildPoll.build_done) { break; }
+            try {
+              buildPoll = await agent(
+                "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+                "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
+                "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
+                "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
+                "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
+                "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
+                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+                { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
+                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                  timeoutMs: 270000 }
+              );
+            } catch (chunkErr) {
+              // A hung or failed chunk is inconclusive, never terminal:
+              // record it and continue to the next chunk. (2026-09-16,
+              // clean-room task 1febe8eb: the platform's 270s agent
+              // timeout killed chunk 2, which threw out of this loop —
+              // skipping chunk 3 AND the STEP 1b audit-dir fallback and
+              // parking on the exception path.) Fail-closed still applies
+              // after chunk 3 and the fallback are exhausted.
+              chunkFailures.push("chunk " + chunk + ": " + (chunkErr && chunkErr.message ? chunkErr.message : chunkErr));
+              log("Artifact build poll chunk " + chunk + " of 3 failed (" + (chunkErr && chunkErr.message ? chunkErr.message : chunkErr) + ") \u2014 continuing to the next chunk; build completion still unproven.");
+            }
+            if (buildPoll) {
+              pollSawOurBuild = pollSawOurBuild || (buildPoll.saw_our_build === true);
+              pollSawStranger = pollSawStranger || (buildPoll.saw_stranger === true);
+              lastObservedAgentId = buildPoll.observed_agent_id || null;
+              if (buildPoll.build_done) { break; }
+            }
           }
           if (!buildPoll || !buildPoll.build_done) {
             buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
@@ -2055,7 +2077,7 @@ while (i < STEPS.length) {
               var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
                 : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
                 : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
-              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
               await recordPublishLedger({
                 commit: mergeCommitForPublish,
                 attempt: rebuildAttemptKey,

package/workflows/docs.js

@@ -32,8 +32,12 @@ const WORKFLOW_WAS_NULL = inputs.workflow_was_null === true;
 // what the dispatcher routed on.
 const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_phase.length > 0) ? inputs.next_phase : null;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";

package/workflows/standard.js

@@ -49,8 +49,12 @@ const CLAIM_WORKFLOW_PERSIST = (WORKFLOW_WAS_NULL && RESOLVED_WORKFLOW) ? ", \"w
 // Manual launches without the arg default to off (previous behavior).
 var VISUAL_PROTOCOL_AVAILABLE = inputs.visual_protocol === true;
 
-// Config from args — backward-compatible fallbacks for manual launches
-const crewHome = inputs.crewHome || "~/workspace/.jarvis";
+// crewHome is required — the dispatcher always passes it (crew-dispatch.js
+// throws without it). Fail closed instead of silently defaulting to the dev
+// home: a missing home is a loud error, a wrong home is silent corruption
+// (2026-09-16: the silent default let a run resolve against the dev home).
+if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
+const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API = crewHome + "/current/lib/crew-api.js";
@@ -67,6 +71,14 @@ const ORCH_PATH = crewHome + "/.orchestration";
 const LIFECYCLE_SRC = crewHome + "/lib/worktree-lifecycle.sh";
 const MERGE_LOCK_SRC = crewHome + "/lib/merge-lock.sh";
 const RUN_LIB = crewHome + "/.pins/" + taskId; // persistent disk, NOT /tmp (tmpfs wiped by cell reboots — canary b5efd1b1)
+// Deterministic spec path — computed by the workflow, never by the agent.
+// Map writes the spec to exactly SPEC_PATH; the path is handed to the agent
+// as a fact and verified mechanically after the step. Agents must never
+// compose crew-home paths themselves (2026-09-16: a Map agent saved the spec
+// under the platform's ~/workspace/.jarvis/workflow-runs/ run dir because the
+// prompt named a directory and the agent invented the rest of the path).
+const SPEC_DIR = crewHome + "/task-evidence/" + taskId + "/map";
+const SPEC_PATH = SPEC_DIR + "/spec.md";
 const LIFECYCLE = RUN_LIB + "/worktree-lifecycle.sh";
 const MERGE_LOCK = RUN_LIB + "/merge-lock.sh";
 const PUBLISH_NPM_SRC = crewHome + "/lib/publish-npm.sh";
@@ -1213,7 +1225,7 @@ while (i < STEPS.length) {
         " If the baseline evidence is missing with no baseline:none recorded, do not write the spec — report 'baseline evidence missing — Map gate bounce required' and stop.\n" +
         "Declare capture targets for the post-change visual capture: end your report with a line `capture_targets: <comma-separated views/controls this change affects>` (optional; falls back to the task description).";
     }
-    instructions = "Research the problem space, evaluate options, pick the shortest path.\nWrite a clear spec that a builder can execute without asking questions.\nThe builder will edit source files in a git worktree.\nProject: " + PROJECT_DESC + "\nSave the spec to a file under " + crewHome + "/ if needed.\nReport back in plain prose — what you specified." + mapGatePara;
+    instructions = "Research the problem space, evaluate options, pick the shortest path.\nWrite a clear spec that a builder can execute without asking questions.\nThe builder will edit source files in a git worktree.\nProject: " + PROJECT_DESC + "\nSave the spec to exactly this file: " + SPEC_PATH + " — run mkdir -p \"" + SPEC_DIR + "\" first. Do not save the spec anywhere else; this exact path is fixed and will be checked mechanically after your step.\nReport back in plain prose — what you specified." + mapGatePara;
 
   } else if (step.name === "Build") {
     instructions = "STEP 1: Prepare your worktree.\n" +
@@ -1265,7 +1277,7 @@ while (i < STEPS.length) {
       }
     }
     instructions = "Review independently and cold. You have NOT seen any reasoning from the builder.\nDo NOT access the task dashboard, event log, or any comments. Your review is based solely on the spec and the code.\n\n" +
-      (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec (from the task description or spec files under " + crewHome + "/).\n\n") +
+      (mapperSpec ? "MAPPER'S SPEC (the builder was asked to implement exactly this):\n" + mapperSpec + "\n\n" : "Read the spec at exactly " + SPEC_PATH + " (fall back to the task description if the file is absent).\n\n") +
       "Examine the code changes by running:\n" +
       LIFECYCLE_ENV + LIFECYCLE + " inspect " + taskId + "\n\n" +
       "The inspect output is authoritative: it prints the task branch's actual tip commit (TIP) and every commit ahead of main. Base your review ONLY on this output — do NOT run git log yourself to pick commits, and do NOT discuss commit hashes from any other source (they may come from stale rework rounds or a different repo).\n\n" +
@@ -1843,6 +1855,10 @@ while (i < STEPS.length) {
           var pollSawOurBuild = false;
           var pollSawStranger = false;
           var lastObservedAgentId = null;
+          // Poll-chunk failure record (2026-09-16, task 1febe8eb): chunk
+          // agent calls that threw instead of returning a verdict —
+          // recorded for the post-poll diagnosis, never terminal alone.
+          var chunkFailures = [];
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1863,22 +1879,36 @@ while (i < STEPS.length) {
             var pollKey = (chunk === 1)
               ? attemptKey("publish-artifact-poll-" + taskId, totalReworkCount)
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, totalReworkCount);
-            buildPoll = await agent(
-              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
-              "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
-              "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
-              "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
-              "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
-              "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
-              "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
-              { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
-                timeoutMs: 270000 }
-            );
-            pollSawOurBuild = pollSawOurBuild || (buildPoll && buildPoll.saw_our_build === true);
-            pollSawStranger = pollSawStranger || (buildPoll && buildPoll.saw_stranger === true);
-            lastObservedAgentId = (buildPoll && buildPoll.observed_agent_id) || null;
-            if (buildPoll && buildPoll.build_done) { break; }
+            try {
+              buildPoll = await agent(
+                "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+                "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
+                "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
+                "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
+                "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
+                "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
+                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+                { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
+                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                  timeoutMs: 270000 }
+              );
+            } catch (chunkErr) {
+              // A hung or failed chunk is inconclusive, never terminal:
+              // record it and continue to the next chunk. (2026-09-16,
+              // clean-room task 1febe8eb: the platform's 270s agent
+              // timeout killed chunk 2, which threw out of this loop —
+              // skipping chunk 3 AND the STEP 1b audit-dir fallback and
+              // parking on the exception path.) Fail-closed still applies
+              // after chunk 3 and the fallback are exhausted.
+              chunkFailures.push("chunk " + chunk + ": " + (chunkErr && chunkErr.message ? chunkErr.message : chunkErr));
+              log("Artifact build poll chunk " + chunk + " of 3 failed (" + (chunkErr && chunkErr.message ? chunkErr.message : chunkErr) + ") \u2014 continuing to the next chunk; build completion still unproven.");
+            }
+            if (buildPoll) {
+              pollSawOurBuild = pollSawOurBuild || (buildPoll.saw_our_build === true);
+              pollSawStranger = pollSawStranger || (buildPoll.saw_stranger === true);
+              lastObservedAgentId = buildPoll.observed_agent_id || null;
+              if (buildPoll.build_done) { break; }
+            }
           }
           if (!buildPoll || !buildPoll.build_done) {
             buildPoll = { build_done: false, status: (buildPoll && buildPoll.status) || "build still running after the 10.5-minute bounded poll" };
@@ -2001,7 +2031,7 @@ while (i < STEPS.length) {
               var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
                 : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
                 : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
-              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
               await recordPublishLedger({
                 commit: mergeCommitForPublish,
                 attempt: rebuildAttemptKey,
@@ -2427,11 +2457,40 @@ while (i < STEPS.length) {
     }
   }
 
+  // Deterministic spec-path verification: the agent cannot self-certify where
+  // it saved the spec. After Map passes, the workflow confirms mechanically
+  // that the spec file exists at the workflow-computed SPEC_PATH (2026-09-16:
+  // a Map agent saved the spec under the platform's
+  // ~/workspace/.jarvis/workflow-runs/ run dir instead of the crew home,
+  // because the prompt named a directory and the agent composed the path).
+  // A missing spec file is an operational step failure, not a park.
+  if (step.name === "Map" && passed) {
+    var specVerifyOut = "";
+    try {
+      var specVerifyResult = await agent(
+        "Run: test -f \"" + SPEC_PATH + "\" && echo SPEC_PRESENT || echo SPEC_MISSING\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("verify-spec-" + taskId, totalReworkCount), label: "Verifying spec file landed",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      specVerifyOut = (specVerifyResult.output || "").trim();
+    } catch (e) {
+      specVerifyOut = "";
+    }
+    if (/^SPEC_PRESENT/m.test(specVerifyOut)) {
+      log("Spec verified for task " + taskId + " at " + SPEC_PATH);
+    } else {
+      log("Spec verification failed for task " + taskId + ": no spec file at " + SPEC_PATH + " — marking failed for retry");
+      stepResult.summary = (stepResult.summary || "") + "\nspec_verify: FAILED — no spec file at " + SPEC_PATH;
+      passed = false;
+    }
+  }
+
   // "rejected" is an explicit phase verdict routed through rework (Review/QA,
   // and the Build/Reproduce reports that feed them). Integrate/Publish work
   // that did not finish is operational — "failed", retryable under the
   // dispatcher's consecutive-failure cap.
-  const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" ? "failed" : "rejected");
+  const status = passed ? "completed" : (step.name === "Integrate" || step.name === "Publish" || step.name === "Map" ? "failed" : "rejected");
 
   // Deterministic publish verification: the agent cannot self-certify a publish.
   // Skip-aware (park 2026-09-11): when the deterministic publish script found
@@ -2616,6 +2675,16 @@ while (i < STEPS.length) {
     return { status: "failed", task_id: taskId, reason: "Publish failed: " + summary };
   }
 
+  // Map spec failure is operational (the spec file did not land at the
+  // workflow-computed SPEC_PATH), not a verdict: the session above is
+  // recorded "failed" and the dispatcher retries at Map under its
+  // consecutive-failure cap, parking after the cap. The retry re-runs Map
+  // with the same exact-path instructions against the same SPEC_PATH.
+  if (!passed && step.name === "Map") {
+    log("Map spec verification failed for task " + taskId + " — returning failed for dispatcher retry");
+    return { status: "failed", task_id: taskId, reason: "Map spec verification failed: no spec file at " + SPEC_PATH };
+  }
+
   // Publish verification park: the build landed and post-deploy finalized,
   // but provenance is UNSTAMPED until the parent's independent read-back
   // (docs/publish-verification.md) confirms the artifact's actual content