muse-crew 0.7.16 → 0.7.18

package/docs/ooda-report.md

@@ -132,13 +132,18 @@ The report is the evidence. A QA claim without its OODA report is an unverified
 ## Reading the verdict back (2026-09-15)
 
 `lib/read-ooda-verdict.js --dir <phase-dir> --expect <PASS|FAIL>` is the
-deterministic cross-checker the bugfix QA closeout runs after extracting the
-prose `VERDICT:` line. It prints one JSON line to stdout and never touches
-the clock or randomness:
-
-- Exit 0, `{ok:true, verdict, reason, summary, expected, actual, attempt}` —
-  the record exists, parses, carries a `verdict` field, agrees with the
-  prose expectation, and a FAIL carries a non-empty reason.
+deterministic cross-checker the Standard and Bugfix QA closeouts run after
+extracting the prose `VERDICT:` line. It prints one JSON line to stdout and
+never touches the clock or randomness:
+
+- Exit 0, `{ok:true, verdict, reason, summary, expected, actual, attempt,
+  visual_loop_unavailable}` — the record exists, parses, carries a `verdict`
+  field, agrees with the prose expectation, and a FAIL carries a non-empty
+  reason. `visual_loop_unavailable` reports whether the experiential browser
+  loop could not run: a see-act browser step exited 3 with `NOT POSSIBLE`
+  (unresolvable tooling), and/or `verdict.json`'s `missing_evidence` names
+  tool unavailability (playwright, see-act, not installed, could not
+  run/drive/launch, no browser).
 - Exit 2, `{ok:false, code}` — `missing` (no verdict.json), `corrupt`
   (unparseable or no verdict field), `contradiction` (record disagrees with
   the prose line), `no_reason` (FAIL with no machine-readable reason).
@@ -148,3 +153,18 @@ workflow reads. On a cross-check failure the QA phase is recorded as failed
 and retried at the same step — an unreasoned or contradictory verdict never
 routes to rework. No LLM judges report-prose consistency; the machine only
 enforces that the reason is present and the records agree.
+
+## A PASS without visual evidence never completes (2026-09-16)
+
+A PASS verdict with an unavailable visual loop is not terminal. When the
+cross-checker reports `visual_loop_unavailable` (the see-act loop never ran —
+e.g. `playwright-core` was unresolvable from the release layout, a 2026-09-16
+clean-room incident), the Standard and Bugfix QA closeouts park the task
+fail-closed with `unattributable_reason=qa-visual-loop-unavailable` instead
+of transitioning to done. The same park fires when the cross-check itself is
+unreadable: unknown or unverifiable experiential evidence is never a PASS.
+
+The dependency must resolve from the release layout for the loop to run at
+all: `$CREW_HOME/node_modules` is a symlink into the npm install's
+`node_modules`, resolved mechanically from the deploy source and repaired
+on every `crew-release.sh deploy` (and re-established by `crew-init`).

package/lib/crew-release.sh

@@ -136,6 +136,47 @@ _sync_workflow_docs() {
   echo "WORKFLOW-DOCS: synced $copied workflow docs to $dest"
 }
 
+# ── dependency node_modules symlink ───────────────────────────────────
+# lib/see-act.js and lib/render-html.js resolve playwright-core by name.
+# The release layout (releases/<name>/lib/) is severed from the npm install
+# that provides it: Node's upward module walk from the release lib/ dir
+# never passes the install dir's node_modules, so require("playwright-core")
+# threw and QA degraded to a mechanical-only PASS that still stamped done
+# (clean-room defect, 2026-09-16 — a rubber stamp). The crew home therefore
+# carries a top-level node_modules symlink into the install's node_modules,
+# resolved mechanically from the deploy source repo:
+#   npm flow: <repo> is <install>/node_modules/muse-crew -> <install>/node_modules
+#   git flow:  <repo> is a checkout (npm install run inside) -> <repo>/node_modules
+# Repaired on every deploy like the lib/workflows symlinks; immutable
+# releases stay untouched (the link lives at the crew-home top level, never
+# inside a release dir). A missing source node_modules is a loud warning,
+# never a deploy failure — the QA visual-loop guard parks instead of
+# stamping when the tooling is unresolvable.
+_link_dep_node_modules() {
+  local repo="${1:?usage: _link_dep_node_modules <repo-path> <crew-home>}"
+  local home="${2:?usage: _link_dep_node_modules <repo-path> <crew-home>}"
+  local src=""
+  local parent base
+  parent="$(dirname "$repo")"
+  base="$(basename "$parent")"
+  if [ "$base" = "node_modules" ] && [ -d "$parent" ]; then
+    src="$parent"
+  elif [ -d "$repo/node_modules" ]; then
+    src="$repo/node_modules"
+  fi
+  if [ -z "$src" ]; then
+    echo "DEP-NODE-MODULES: WARNING — no node_modules resolvable from $repo; skipping symlink (QA visual loop will park, not stamp)" >&2
+    return 0
+  fi
+  local link="$home/node_modules"
+  if [ -e "$link" ] && [ ! -L "$link" ]; then
+    echo "DEP-NODE-MODULES: $link exists as a real directory — leaving it (Node resolves from it directly)" >&2
+    return 0
+  fi
+  ln -sfn "$src" "$link"
+  echo "DEP-NODE-MODULES: $link -> $src"
+}
+
 # ── deploy ────────────────────────────────────────────────────────────
 # Build, validate, and atomically activate a release from repo HEAD.
 # Single command — no cross-step lock needed.
@@ -143,6 +184,8 @@ cmd_deploy() {
   local repo="${1:?usage: deploy <repo-path> [<jarvis-home>]}"
   local home="${2:-$CREW_HOME}"
   CREW_HOME="$home"
+  # Absolute repo path before cd: the dependency symlink is resolved from it.
+  repo="$(realpath "$repo")"
 
   # Self-update: the stable script is installed once by cmd_init and would
   # otherwise go stale (2026-09-12: the stable copies predated the
@@ -233,6 +276,12 @@ cmd_deploy() {
   ln -sfn current/workflows "$CREW_HOME/workflows"
   ln -sfn current/lib "$CREW_HOME/lib"
 
+  # Dependency node_modules symlink (clean-room defect, 2026-09-16): keep the
+  # package next to its deps so lib/see-act.js and lib/render-html.js resolve
+  # playwright-core by name from the release lib/ dir. Repaired on every
+  # deploy; a missing source is a warning, never a failure.
+  _link_dep_node_modules "$repo" "$CREW_HOME"
+
   # Keep the dashboard's workflow documents in sync with the release.
   _sync_workflow_docs "$CREW_HOME"
 

package/lib/read-ooda-verdict.js

@@ -12,9 +12,22 @@
 //
 // Reads <phase-dir>/verdict.json and prints exactly one JSON line to stdout.
 //
-// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt}
-// when the record exists, parses, has a verdict field, the verdict equals
-// --expect, and a FAIL carries a non-empty reason.
+// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt,
+// visual_loop_unavailable} when the record exists, parses, has a verdict
+// field, the verdict equals --expect, and a FAIL carries a non-empty reason.
+//
+// visual_loop_unavailable (2026-09-16): a PASS verdict with missing
+// experiential evidence must never be terminal — the QA closeout parks
+// instead of stamping done (the clean-room rubber stamp: the see-act loop
+// never ran because playwright-core was unresolvable from the release
+// layout, yet the task stamped done on a mechanical-only PASS). Two
+// mechanical signals, no judgment:
+//   (1) the OODA log in the same dir has a browser-action step
+//       (aria|shot|click|scroll|type) with exit 3 and NOT POSSIBLE in the
+//       observation — the see-act contract for "tooling unresolvable";
+//   (2) verdict.json's missing_evidence names tool-unavailability
+//       (playwright, see-act, not possible, not installed, unavailable,
+//       could not run/drive/launch, no browser).
 //
 // Exit 2 with {ok:false, code, error} when:
 //   missing      — verdict.json is absent (the agent never wrote one)
@@ -55,7 +68,8 @@ function main() {
     fail("bad_input", "unknown --expect: " + args.expect + " (PASS|FAIL)");
   }
 
-  const verdictPath = join(resolve(args.dir), "verdict.json");
+  const dir = resolve(args.dir);
+  const verdictPath = join(dir, "verdict.json");
   if (!existsSync(verdictPath)) {
     fail("missing", "verdict.json not found: " + verdictPath);
   }
@@ -88,7 +102,54 @@ function main() {
     expected: record.expected === undefined ? "" : record.expected,
     actual: record.actual === undefined ? "" : record.actual,
     attempt: record.attempt === undefined ? "" : record.attempt,
+    visual_loop_unavailable: visualLoopUnavailable(dir, record),
   }) + "\n");
 }
 
+// Visual-loop availability: true when the experiential browser loop could
+// not run. Signal 1 — a browser-action OODA step (the see-act actions)
+// exited 3 with NOT POSSIBLE in its observation (the driver's contract for
+// unresolvable tooling). Signal 2 — the verdict's own missing_evidence
+// names tool-unavailability. Both are string matches on machine-written
+// records, never a judgment about report prose.
+const BROWSER_ACTIONS = { aria: true, shot: true, click: true, scroll: true, type: true };
+const TOOL_UNAVAILABLE = /(playwright|see-act|not possible|not installed|unavailable|could not (run|drive|launch)|no browser)/i;
+
+function oodaLogUnavailable(dir) {
+  let text;
+  try {
+    text = readFileSync(join(dir, "ooda-log.jsonl"), "utf8");
+  } catch (e) {
+    return false;
+  }
+  const lines = text.split("\n");
+  for (let k = 0; k < lines.length; k++) {
+    const line = lines[k].trim();
+    if (!line) continue;
+    let step;
+    try {
+      step = JSON.parse(line);
+    } catch (e) {
+      continue;
+    }
+    if (!step || !BROWSER_ACTIONS[step.action]) continue;
+    if (step.exit === 3 && /not possible/i.test(String(step.observation || ""))) return true;
+  }
+  return false;
+}
+
+function missingEvidenceUnavailable(record) {
+  let me = record.missing_evidence;
+  if (me === undefined) me = record.missing;
+  if (!Array.isArray(me)) return false;
+  for (let k = 0; k < me.length; k++) {
+    if (TOOL_UNAVAILABLE.test(String(me[k]))) return true;
+  }
+  return false;
+}
+
+function visualLoopUnavailable(dir, record) {
+  return oodaLogUnavailable(dir) || missingEvidenceUnavailable(record);
+}
+
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.16",
+  "version": "0.7.18",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -1894,6 +1894,13 @@ while (i < STEPS.length) {
           // agent calls that threw instead of returning a verdict —
           // recorded for the post-poll diagnosis, never terminal alone.
           var chunkFailures = [];
+          // Poll status-read error count (2026-09-16): a failed
+          // artifact_status read (rate limiting / TOO_MANY_REQUESTS /
+          // 429, network error, or any non-build response) is
+          // inconclusive — it is NOT evidence of absence and must never
+          // be folded into the no-build-observed signal. Counted for
+          // the post-poll diagnosis only; never terminal alone.
+          var pollStatusErrors = 0;
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1917,14 +1924,15 @@ while (i < STEPS.length) {
             try {
               buildPoll = await agent(
                 "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+                "If an artifact_status call itself FAILS (rate limiting / TOO_MANY_REQUESTS / 429, network error, or any response that is not a build object): that check is inconclusive \u2014 do NOT record it as \"no build\". Stop polling immediately and return with status_error: true. A failed read is not evidence of absence and must never be folded into the no-build-observed signal.\n" +
                 "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
                 "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
                 "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
                 "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
                 "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
-                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\", \"status_error\": <true ONLY when a status read failed as described above, false or omitted otherwise> } and nothing else.",
                 { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] }, status_error: { type: "boolean" } }, required: ["build_done"] },
                   timeoutMs: 270000 }
               );
             } catch (chunkErr) {
@@ -1942,6 +1950,7 @@ while (i < STEPS.length) {
               pollSawOurBuild = pollSawOurBuild || (buildPoll.saw_our_build === true);
               pollSawStranger = pollSawStranger || (buildPoll.saw_stranger === true);
               lastObservedAgentId = buildPoll.observed_agent_id || null;
+              if (buildPoll.status_error === true) { pollStatusErrors++; log("Artifact build poll chunk " + chunk + " of 3 hit a status-read error \u2014 recorded as inconclusive, continuing to the next chunk; a failed read is not evidence of absence."); }
               if (buildPoll.build_done) { break; }
             }
           }
@@ -2064,9 +2073,10 @@ while (i < STEPS.length) {
               }, totalReworkCount);
             } else {
               var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
+                : ((pollStatusErrors > 0 && !pollSawOurBuild) ? "status-read-errors-during-poll"
                 : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
-                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
-              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing")));
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + "; poll_status_errors=" + pollStatusErrors + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
               await recordPublishLedger({
                 commit: mergeCommitForPublish,
                 attempt: rebuildAttemptKey,
@@ -2431,6 +2441,24 @@ while (i < STEPS.length) {
       };
     }
     log("QA verdict.json closeout gate passed: verdict.json agrees with prose VERDICT: " + qaVerdictExpect);
+
+    // QA visual-loop guard (clean-room defect 2026-09-16): Hazel's
+    // verdict.json is honest about missing visual evidence, but the closeout
+    // treated a PASS as terminal done even when the see-act loop never ran
+    // (playwright-core was unresolvable from the release layout — the
+    // dependency lived in the npm install dir, severed from the crew home).
+    // A PASS verdict with missing experiential evidence must never be
+    // terminal: the task parks fail-closed with
+    // unattributable_reason=qa-visual-loop-unavailable instead of
+    // transitioning to done. Code, not prompt text: visual_loop_unavailable
+    // comes from lib/read-ooda-verdict.js (the OODA log's NOT POSSIBLE
+    // browser steps and the verdict's missing_evidence tool-unavailability
+    // notes), already parsed into qaVerdictGate above.
+    if (verdictPassed === true && qaVerdictGate.visual_loop_unavailable === true) {
+      log("QA visual loop unavailable — parking fail-closed (unattributable_reason=qa-visual-loop-unavailable), never done");
+      return await parkTask("QA visual loop unavailable (unattributable_reason=qa-visual-loop-unavailable): the see-act browser loop could not run — verdict.json records missing visual evidence. A PASS without experiential evidence is never terminal. Human attention needed: repair the crew home's dependency symlink ($CREW_HOME/node_modules) or the npm install, then re-queue QA.");
+    }
+    log("QA visual-loop guard passed: experiential evidence present");
   }
 
 

package/workflows/chore.js

@@ -1907,6 +1907,13 @@ while (i < STEPS.length) {
           // agent calls that threw instead of returning a verdict —
           // recorded for the post-poll diagnosis, never terminal alone.
           var chunkFailures = [];
+          // Poll status-read error count (2026-09-16): a failed
+          // artifact_status read (rate limiting / TOO_MANY_REQUESTS /
+          // 429, network error, or any non-build response) is
+          // inconclusive — it is NOT evidence of absence and must never
+          // be folded into the no-build-observed signal. Counted for
+          // the post-poll diagnosis only; never terminal alone.
+          var pollStatusErrors = 0;
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1930,14 +1937,15 @@ while (i < STEPS.length) {
             try {
               buildPoll = await agent(
                 "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+                "If an artifact_status call itself FAILS (rate limiting / TOO_MANY_REQUESTS / 429, network error, or any response that is not a build object): that check is inconclusive \u2014 do NOT record it as \"no build\". Stop polling immediately and return with status_error: true. A failed read is not evidence of absence and must never be folded into the no-build-observed signal.\n" +
                 "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
                 "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
                 "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
                 "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
                 "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
-                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\", \"status_error\": <true ONLY when a status read failed as described above, false or omitted otherwise> } and nothing else.",
                 { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] }, status_error: { type: "boolean" } }, required: ["build_done"] },
                   timeoutMs: 270000 }
               );
             } catch (chunkErr) {
@@ -1955,6 +1963,7 @@ while (i < STEPS.length) {
               pollSawOurBuild = pollSawOurBuild || (buildPoll.saw_our_build === true);
               pollSawStranger = pollSawStranger || (buildPoll.saw_stranger === true);
               lastObservedAgentId = buildPoll.observed_agent_id || null;
+              if (buildPoll.status_error === true) { pollStatusErrors++; log("Artifact build poll chunk " + chunk + " of 3 hit a status-read error \u2014 recorded as inconclusive, continuing to the next chunk; a failed read is not evidence of absence."); }
               if (buildPoll.build_done) { break; }
             }
           }
@@ -2075,9 +2084,10 @@ while (i < STEPS.length) {
               }, reworkCount);
             } else {
               var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
+                : ((pollStatusErrors > 0 && !pollSawOurBuild) ? "status-read-errors-during-poll"
                 : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
-                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
-              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing")));
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + "; poll_status_errors=" + pollStatusErrors + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
               await recordPublishLedger({
                 commit: mergeCommitForPublish,
                 attempt: rebuildAttemptKey,

package/workflows/crew-init.js

@@ -29,6 +29,26 @@ if (!!dashboardSlug !== !!dashboardRepoPath) throw new Error("dashboardSlug and
 
 const orchDir = crewHome + "/.orchestration";
 
+// ── Dependency node_modules resolution (clean-room defect 2026-09-16) ──
+// lib/see-act.js and lib/render-html.js resolve playwright-core by name,
+// but the release layout severs releases/<name>/lib/ from the npm install
+// that provides node_modules — Node's upward walk never reaches it, so the
+// QA see-act loop degraded to NOT POSSIBLE and a mechanical-only PASS
+// stamped done (a rubber stamp). The crew home carries a top-level
+// node_modules symlink into the install's node_modules, resolved here
+// mechanically from crewRepoPath — no new parameters, no env vars, no
+// agent judgment:
+//   npm flow: crewRepoPath is <install>/node_modules/muse-crew -> parent
+//   git flow:  crewRepoPath is a checkout -> <repo>/node_modules
+// crew-release.sh deploy enforces the same link on every deploy; the init
+// step below is the belt-and-suspenders repeat for init.
+function resolveDepNodeModules(repoPath) {
+  var r = String(repoPath).replace(/\/+$/, "");
+  var parent = r.split("/").slice(0, -1).join("/") || "/";
+  if (parent.split("/").pop() === "node_modules") return parent;
+  return r + "/node_modules";
+}
+
 // ── Gate 0: Launchable-path validation ─────────────────────────────
 // workflow_launch only accepts workspace-contained scripts. A crewHome
 // outside the workspace would produce an instance whose workflows can
@@ -200,6 +220,48 @@ try {
 }
 log("Release: " + (releaseResult.existed ? "existing" : "bootstrapped") + " at " + releaseResult.hash);
 
+// ── Dependency node_modules symlink ───────────────────────────────────
+// The release bootstrap (crew-release.sh init -> deploy) already links
+// $CREW_HOME/node_modules into the install's node_modules; this step is the
+// explicit, mechanical belt-and-suspenders repeat. The target dir is
+// computed by resolveDepNodeModules above — the agent only runs the shell
+// verbatim, it judges nothing. A missing source dir is not fatal: the QA
+// visual-loop guard parks instead of stamping when the tooling is
+// unresolvable.
+var depNodeModules = resolveDepNodeModules(crewRepoPath);
+var safeDepNm = depNodeModules.split('"').join('\\"');
+var safeCrewHomeNm = crewHome.split('"').join('\\"');
+try {
+  var depLinkResult = await agent(
+    "Ensure the crew home's dependency node_modules symlink.\n\n" +
+    "Crew home: " + crewHome + "\n" +
+    "Dependency node_modules (computed, do not alter): " + depNodeModules + "\n\n" +
+    "Steps (run in shell exactly as written):\n" +
+    "if [ -d \"" + safeDepNm + "\" ]; then\n" +
+    "  if [ -e \"" + safeCrewHomeNm + "/node_modules\" ] && [ ! -L \"" + safeCrewHomeNm + "/node_modules\" ]; then echo REAL_DIR_KEPT;\n" +
+    "  else ln -sfn \"" + safeDepNm + "\" \"" + safeCrewHomeNm + "/node_modules\" && echo LINKED;\n" +
+    "  fi\n" +
+    "else echo MISSING_SOURCE;\n" +
+    "fi\n\n" +
+    "Return JSON { linked: <true when the symlink now resolves into the computed dir, false otherwise>, note: \"<LINKED|REAL_DIR_KEPT|MISSING_SOURCE>\" }.",
+    {
+      key: "dep-node-modules-1",
+      label: "Linking dependency node_modules",
+      schema: {
+        type: "object",
+        properties: {
+          linked: { type: "boolean" },
+          note: { type: "string" }
+        },
+        required: ["linked", "note"]
+      }
+    }
+  );
+  log("Dependency node_modules: " + (depLinkResult.note || "unknown") + " -> " + depNodeModules);
+} catch (e) {
+  log("Dependency node_modules link step errored (non-fatal): " + String(e.message || e));
+}
+
 // ── Phase 2: Scaffold ─────────────────────────────────────────────────
 // Copies identities (with portraits), personas, workflow docs, and
 // feedback convention from the crew repo into .orchestration/ under crewHome.

package/workflows/standard.js

@@ -1859,6 +1859,13 @@ while (i < STEPS.length) {
           // agent calls that threw instead of returning a verdict —
           // recorded for the post-poll diagnosis, never terminal alone.
           var chunkFailures = [];
+          // Poll status-read error count (2026-09-16): a failed
+          // artifact_status read (rate limiting / TOO_MANY_REQUESTS /
+          // 429, network error, or any non-build response) is
+          // inconclusive — it is NOT evidence of absence and must never
+          // be folded into the no-build-observed signal. Counted for
+          // the post-poll diagnosis only; never terminal alone.
+          var pollStatusErrors = 0;
           for (var chunk = 1; chunk <= 3; chunk++) {
             if (chunk > 1) {
               var refreshPoll = await agent(
@@ -1882,14 +1889,15 @@ while (i < STEPS.length) {
             try {
               buildPoll = await agent(
                 "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+                "If an artifact_status call itself FAILS (rate limiting / TOO_MANY_REQUESTS / 429, network error, or any response that is not a build object): that check is inconclusive \u2014 do NOT record it as \"no build\". Stop polling immediately and return with status_error: true. A failed read is not evidence of absence and must never be folded into the no-build-observed signal.\n" +
                 "On every check, record whether you have positively OBSERVED our build: a running build whose agent_id equals \"" + rebuildAgentId + "\", or a completed-build record whose agent_id equals \"" + rebuildAgentId + "\" (if the tool surfaces one \u2014 match it mechanically, never assume).\n" +
                 "- If no build is running (build is null) and you have NOT observed our build: our build's completion is UNPROVEN. Absence of a running build is not evidence our build ran. Do NOT report done.\n" +
                 "- If no build is running (build is null) and you previously observed our build running: our build finished. Stop and report done.\n" +
                 "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
                 "- If the running build's agent_id is present but DIFFERENT: that is a stranger's build. Do NOT attribute its completion to our attempt and do NOT wait on it \u2014 keep checking within budget; if the budget expires without observing our build, report done=false. Record it in saw_stranger regardless of what else you observe.\n" +
-                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
+                "Return JSON { \"build_done\": <true ONLY when you positively observed our build and it is no longer running, false otherwise>, \"saw_our_build\": <true if you observed our build at any check, false if never>, \"saw_stranger\": true if at ANY check a running build had an agent_id different from ours (\"" + rebuildAgentId + "\"), false otherwise, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\", \"status_error\": <true ONLY when a status read failed as described above, false or omitted otherwise> } and nothing else.",
                 { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
+                  schema: { type: "object", properties: { build_done: { type: "boolean" }, saw_our_build: { type: "boolean" }, saw_stranger: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] }, status_error: { type: "boolean" } }, required: ["build_done"] },
                   timeoutMs: 270000 }
               );
             } catch (chunkErr) {
@@ -1907,6 +1915,7 @@ while (i < STEPS.length) {
               pollSawOurBuild = pollSawOurBuild || (buildPoll.saw_our_build === true);
               pollSawStranger = pollSawStranger || (buildPoll.saw_stranger === true);
               lastObservedAgentId = buildPoll.observed_agent_id || null;
+              if (buildPoll.status_error === true) { pollStatusErrors++; log("Artifact build poll chunk " + chunk + " of 3 hit a status-read error \u2014 recorded as inconclusive, continuing to the next chunk; a failed read is not evidence of absence."); }
               if (buildPoll.build_done) { break; }
             }
           }
@@ -2029,9 +2038,10 @@ while (i < STEPS.length) {
               }, totalReworkCount);
             } else {
               var unattributableReason = strangerObserved ? "stranger-build-observed-during-poll"
+                : ((pollStatusErrors > 0 && !pollSawOurBuild) ? "status-read-errors-during-poll"
                 : (pollEndState === "build-still-running-at-poll-end" ? "build-still-running-at-poll-end"
-                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing"));
-              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
+                : (newAuditDirsAfterPoll.length === 0 ? "no-new-audit-dir-in-window" : "audit-report-unreadable-or-missing")));
+              publishFailure = "Artifact build completion unproven (fail-closed, no provenance stamped): unattributable_reason=" + unattributableReason + "; poll_end_state=" + pollEndState + "; " + "saw_our_build=" + pollSawOurBuild + "; new_audit_dirs=" + newAuditDirsAfterPoll.length + "; poll_chunks_failed=" + chunkFailures.length + "; poll_status_errors=" + pollStatusErrors + ". Attribution is by window, not by build identity. The publish may or may not have landed. Fail-closed.";
               await recordPublishLedger({
                 commit: mergeCommitForPublish,
                 attempt: rebuildAttemptKey,
@@ -2408,6 +2418,52 @@ while (i < STEPS.length) {
     }
   }
 
+  // QA visual-loop guard (clean-room defect 2026-09-16): Hazel's verdict.json
+  // is honest about missing visual evidence, but the closeout treated a PASS
+  // as terminal done even when the see-act loop never ran (playwright-core
+  // was unresolvable from the release layout — the dependency lived in the
+  // npm install dir, severed from the crew home). A PASS verdict with missing
+  // experiential evidence must never be terminal: the task parks fail-closed
+  // with unattributable_reason=qa-visual-loop-unavailable instead of
+  // transitioning to done. Code, not prompt text: the check reads the
+  // machine-readable verdict via lib/read-ooda-verdict.js, which reports
+  // visual_loop_unavailable from the OODA log's NOT POSSIBLE browser steps
+  // and the verdict's missing_evidence tool-unavailability notes.
+  if (step.name === "QA" && qaVisual && verdictPassed === true) {
+    var qaLoopDir = crewHome + "/task-evidence/" + taskId + "/postchange";
+    var qaLoopOut = "";
+    try {
+      var qaLoopCheck = await agent(
+        "Check the QA visual loop's availability.\n" +
+        "Run: node " + crewHome + "/current/lib/read-ooda-verdict.js --dir " + qaLoopDir + " --expect PASS\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("qa-visual-loop-check-" + taskId, totalReworkCount), label: "Checking QA visual-loop availability",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      qaLoopOut = (qaLoopCheck && qaLoopCheck.output ? qaLoopCheck.output : "").trim();
+    } catch (e) {
+      qaLoopOut = "";
+    }
+    // The script prints exactly one JSON line; exit info does not survive
+    // the schema'd return, so the parsed object is the gate signal.
+    var qaLoopGate = null;
+    try {
+      var qaLoopLines = qaLoopOut.split("\n");
+      qaLoopGate = JSON.parse(qaLoopLines[qaLoopLines.length - 1]);
+    } catch (e) {
+      qaLoopGate = null;
+    }
+    if (!qaLoopGate || qaLoopGate.ok !== true) {
+      log("QA visual-loop check unreadable — cannot confirm experiential evidence; parking fail-closed");
+      return await parkTask("QA visual loop unverifiable (unattributable_reason=qa-visual-loop-unavailable): lib/read-ooda-verdict.js could not confirm the QA verdict record — a PASS without a machine-readable experiential record is never terminal. Human attention needed.");
+    }
+    if (qaLoopGate.visual_loop_unavailable === true) {
+      log("QA visual loop unavailable — parking fail-closed (unattributable_reason=qa-visual-loop-unavailable), never done");
+      return await parkTask("QA visual loop unavailable (unattributable_reason=qa-visual-loop-unavailable): the see-act browser loop could not run — verdict.json records missing visual evidence. A PASS without experiential evidence is never terminal. Human attention needed: repair the crew home's dependency symlink ($CREW_HOME/node_modules) or the npm install, then re-queue QA.");
+    }
+    log("QA visual-loop guard passed: experiential evidence present");
+  }
+
   // Deterministic closeout: no formatter agent. The verdict is mechanical
   // (extractVerdict above); the summary is the worker's report truncated.
   // For verdict steps passed comes from the verdict; for non-verdict steps