muse-crew 0.7.17 → 0.7.18

package/docs/ooda-report.md

@@ -132,13 +132,18 @@ The report is the evidence. A QA claim without its OODA report is an unverified
 ## Reading the verdict back (2026-09-15)
 
 `lib/read-ooda-verdict.js --dir <phase-dir> --expect <PASS|FAIL>` is the
-deterministic cross-checker the bugfix QA closeout runs after extracting the
-prose `VERDICT:` line. It prints one JSON line to stdout and never touches
-the clock or randomness:
-
-- Exit 0, `{ok:true, verdict, reason, summary, expected, actual, attempt}` —
-  the record exists, parses, carries a `verdict` field, agrees with the
-  prose expectation, and a FAIL carries a non-empty reason.
+deterministic cross-checker the Standard and Bugfix QA closeouts run after
+extracting the prose `VERDICT:` line. It prints one JSON line to stdout and
+never touches the clock or randomness:
+
+- Exit 0, `{ok:true, verdict, reason, summary, expected, actual, attempt,
+  visual_loop_unavailable}` — the record exists, parses, carries a `verdict`
+  field, agrees with the prose expectation, and a FAIL carries a non-empty
+  reason. `visual_loop_unavailable` reports whether the experiential browser
+  loop could not run: a see-act browser step exited 3 with `NOT POSSIBLE`
+  (unresolvable tooling), and/or `verdict.json`'s `missing_evidence` names
+  tool unavailability (playwright, see-act, not installed, could not
+  run/drive/launch, no browser).
 - Exit 2, `{ok:false, code}` — `missing` (no verdict.json), `corrupt`
   (unparseable or no verdict field), `contradiction` (record disagrees with
   the prose line), `no_reason` (FAIL with no machine-readable reason).
@@ -148,3 +153,18 @@ workflow reads. On a cross-check failure the QA phase is recorded as failed
 and retried at the same step — an unreasoned or contradictory verdict never
 routes to rework. No LLM judges report-prose consistency; the machine only
 enforces that the reason is present and the records agree.
+
+## A PASS without visual evidence never completes (2026-09-16)
+
+A PASS verdict with an unavailable visual loop is not terminal. When the
+cross-checker reports `visual_loop_unavailable` (the see-act loop never ran —
+e.g. `playwright-core` was unresolvable from the release layout, a 2026-09-16
+clean-room incident), the Standard and Bugfix QA closeouts park the task
+fail-closed with `unattributable_reason=qa-visual-loop-unavailable` instead
+of transitioning to done. The same park fires when the cross-check itself is
+unreadable: unknown or unverifiable experiential evidence is never a PASS.
+
+The dependency must resolve from the release layout for the loop to run at
+all: `$CREW_HOME/node_modules` is a symlink into the npm install's
+`node_modules`, resolved mechanically from the deploy source and repaired
+on every `crew-release.sh deploy` (and re-established by `crew-init`).

package/lib/crew-release.sh

@@ -136,6 +136,47 @@ _sync_workflow_docs() {
   echo "WORKFLOW-DOCS: synced $copied workflow docs to $dest"
 }
 
+# ── dependency node_modules symlink ───────────────────────────────────
+# lib/see-act.js and lib/render-html.js resolve playwright-core by name.
+# The release layout (releases/<name>/lib/) is severed from the npm install
+# that provides it: Node's upward module walk from the release lib/ dir
+# never passes the install dir's node_modules, so require("playwright-core")
+# threw and QA degraded to a mechanical-only PASS that still stamped done
+# (clean-room defect, 2026-09-16 — a rubber stamp). The crew home therefore
+# carries a top-level node_modules symlink into the install's node_modules,
+# resolved mechanically from the deploy source repo:
+#   npm flow: <repo> is <install>/node_modules/muse-crew -> <install>/node_modules
+#   git flow:  <repo> is a checkout (npm install run inside) -> <repo>/node_modules
+# Repaired on every deploy like the lib/workflows symlinks; immutable
+# releases stay untouched (the link lives at the crew-home top level, never
+# inside a release dir). A missing source node_modules is a loud warning,
+# never a deploy failure — the QA visual-loop guard parks instead of
+# stamping when the tooling is unresolvable.
+_link_dep_node_modules() {
+  local repo="${1:?usage: _link_dep_node_modules <repo-path> <crew-home>}"
+  local home="${2:?usage: _link_dep_node_modules <repo-path> <crew-home>}"
+  local src=""
+  local parent base
+  parent="$(dirname "$repo")"
+  base="$(basename "$parent")"
+  if [ "$base" = "node_modules" ] && [ -d "$parent" ]; then
+    src="$parent"
+  elif [ -d "$repo/node_modules" ]; then
+    src="$repo/node_modules"
+  fi
+  if [ -z "$src" ]; then
+    echo "DEP-NODE-MODULES: WARNING — no node_modules resolvable from $repo; skipping symlink (QA visual loop will park, not stamp)" >&2
+    return 0
+  fi
+  local link="$home/node_modules"
+  if [ -e "$link" ] && [ ! -L "$link" ]; then
+    echo "DEP-NODE-MODULES: $link exists as a real directory — leaving it (Node resolves from it directly)" >&2
+    return 0
+  fi
+  ln -sfn "$src" "$link"
+  echo "DEP-NODE-MODULES: $link -> $src"
+}
+
 # ── deploy ────────────────────────────────────────────────────────────
 # Build, validate, and atomically activate a release from repo HEAD.
 # Single command — no cross-step lock needed.
@@ -143,6 +184,8 @@ cmd_deploy() {
   local repo="${1:?usage: deploy <repo-path> [<jarvis-home>]}"
   local home="${2:-$CREW_HOME}"
   CREW_HOME="$home"
+  # Absolute repo path before cd: the dependency symlink is resolved from it.
+  repo="$(realpath "$repo")"
 
   # Self-update: the stable script is installed once by cmd_init and would
   # otherwise go stale (2026-09-12: the stable copies predated the
@@ -233,6 +276,12 @@ cmd_deploy() {
   ln -sfn current/workflows "$CREW_HOME/workflows"
   ln -sfn current/lib "$CREW_HOME/lib"
 
+  # Dependency node_modules symlink (clean-room defect, 2026-09-16): keep the
+  # package next to its deps so lib/see-act.js and lib/render-html.js resolve
+  # playwright-core by name from the release lib/ dir. Repaired on every
+  # deploy; a missing source is a warning, never a failure.
+  _link_dep_node_modules "$repo" "$CREW_HOME"
+
   # Keep the dashboard's workflow documents in sync with the release.
   _sync_workflow_docs "$CREW_HOME"
 

package/lib/read-ooda-verdict.js

@@ -12,9 +12,22 @@
 //
 // Reads <phase-dir>/verdict.json and prints exactly one JSON line to stdout.
 //
-// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt}
-// when the record exists, parses, has a verdict field, the verdict equals
-// --expect, and a FAIL carries a non-empty reason.
+// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt,
+// visual_loop_unavailable} when the record exists, parses, has a verdict
+// field, the verdict equals --expect, and a FAIL carries a non-empty reason.
+//
+// visual_loop_unavailable (2026-09-16): a PASS verdict with missing
+// experiential evidence must never be terminal — the QA closeout parks
+// instead of stamping done (the clean-room rubber stamp: the see-act loop
+// never ran because playwright-core was unresolvable from the release
+// layout, yet the task stamped done on a mechanical-only PASS). Two
+// mechanical signals, no judgment:
+//   (1) the OODA log in the same dir has a browser-action step
+//       (aria|shot|click|scroll|type) with exit 3 and NOT POSSIBLE in the
+//       observation — the see-act contract for "tooling unresolvable";
+//   (2) verdict.json's missing_evidence names tool-unavailability
+//       (playwright, see-act, not possible, not installed, unavailable,
+//       could not run/drive/launch, no browser).
 //
 // Exit 2 with {ok:false, code, error} when:
 //   missing      — verdict.json is absent (the agent never wrote one)
@@ -55,7 +68,8 @@ function main() {
     fail("bad_input", "unknown --expect: " + args.expect + " (PASS|FAIL)");
   }
 
-  const verdictPath = join(resolve(args.dir), "verdict.json");
+  const dir = resolve(args.dir);
+  const verdictPath = join(dir, "verdict.json");
   if (!existsSync(verdictPath)) {
     fail("missing", "verdict.json not found: " + verdictPath);
   }
@@ -88,7 +102,54 @@ function main() {
     expected: record.expected === undefined ? "" : record.expected,
     actual: record.actual === undefined ? "" : record.actual,
     attempt: record.attempt === undefined ? "" : record.attempt,
+    visual_loop_unavailable: visualLoopUnavailable(dir, record),
   }) + "\n");
 }
 
+// Visual-loop availability: true when the experiential browser loop could
+// not run. Signal 1 — a browser-action OODA step (the see-act actions)
+// exited 3 with NOT POSSIBLE in its observation (the driver's contract for
+// unresolvable tooling). Signal 2 — the verdict's own missing_evidence
+// names tool-unavailability. Both are string matches on machine-written
+// records, never a judgment about report prose.
+const BROWSER_ACTIONS = { aria: true, shot: true, click: true, scroll: true, type: true };
+const TOOL_UNAVAILABLE = /(playwright|see-act|not possible|not installed|unavailable|could not (run|drive|launch)|no browser)/i;
+
+function oodaLogUnavailable(dir) {
+  let text;
+  try {
+    text = readFileSync(join(dir, "ooda-log.jsonl"), "utf8");
+  } catch (e) {
+    return false;
+  }
+  const lines = text.split("\n");
+  for (let k = 0; k < lines.length; k++) {
+    const line = lines[k].trim();
+    if (!line) continue;
+    let step;
+    try {
+      step = JSON.parse(line);
+    } catch (e) {
+      continue;
+    }
+    if (!step || !BROWSER_ACTIONS[step.action]) continue;
+    if (step.exit === 3 && /not possible/i.test(String(step.observation || ""))) return true;
+  }
+  return false;
+}
+
+function missingEvidenceUnavailable(record) {
+  let me = record.missing_evidence;
+  if (me === undefined) me = record.missing;
+  if (!Array.isArray(me)) return false;
+  for (let k = 0; k < me.length; k++) {
+    if (TOOL_UNAVAILABLE.test(String(me[k]))) return true;
+  }
+  return false;
+}
+
+function visualLoopUnavailable(dir, record) {
+  return oodaLogUnavailable(dir) || missingEvidenceUnavailable(record);
+}
+
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.17",
+  "version": "0.7.18",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/bugfix.js

@@ -2441,6 +2441,24 @@ while (i < STEPS.length) {
       };
     }
     log("QA verdict.json closeout gate passed: verdict.json agrees with prose VERDICT: " + qaVerdictExpect);
+
+    // QA visual-loop guard (clean-room defect 2026-09-16): Hazel's
+    // verdict.json is honest about missing visual evidence, but the closeout
+    // treated a PASS as terminal done even when the see-act loop never ran
+    // (playwright-core was unresolvable from the release layout — the
+    // dependency lived in the npm install dir, severed from the crew home).
+    // A PASS verdict with missing experiential evidence must never be
+    // terminal: the task parks fail-closed with
+    // unattributable_reason=qa-visual-loop-unavailable instead of
+    // transitioning to done. Code, not prompt text: visual_loop_unavailable
+    // comes from lib/read-ooda-verdict.js (the OODA log's NOT POSSIBLE
+    // browser steps and the verdict's missing_evidence tool-unavailability
+    // notes), already parsed into qaVerdictGate above.
+    if (verdictPassed === true && qaVerdictGate.visual_loop_unavailable === true) {
+      log("QA visual loop unavailable — parking fail-closed (unattributable_reason=qa-visual-loop-unavailable), never done");
+      return await parkTask("QA visual loop unavailable (unattributable_reason=qa-visual-loop-unavailable): the see-act browser loop could not run — verdict.json records missing visual evidence. A PASS without experiential evidence is never terminal. Human attention needed: repair the crew home's dependency symlink ($CREW_HOME/node_modules) or the npm install, then re-queue QA.");
+    }
+    log("QA visual-loop guard passed: experiential evidence present");
   }
 
 

package/workflows/crew-init.js

@@ -29,6 +29,26 @@ if (!!dashboardSlug !== !!dashboardRepoPath) throw new Error("dashboardSlug and
 
 const orchDir = crewHome + "/.orchestration";
 
+// ── Dependency node_modules resolution (clean-room defect 2026-09-16) ──
+// lib/see-act.js and lib/render-html.js resolve playwright-core by name,
+// but the release layout severs releases/<name>/lib/ from the npm install
+// that provides node_modules — Node's upward walk never reaches it, so the
+// QA see-act loop degraded to NOT POSSIBLE and a mechanical-only PASS
+// stamped done (a rubber stamp). The crew home carries a top-level
+// node_modules symlink into the install's node_modules, resolved here
+// mechanically from crewRepoPath — no new parameters, no env vars, no
+// agent judgment:
+//   npm flow: crewRepoPath is <install>/node_modules/muse-crew -> parent
+//   git flow:  crewRepoPath is a checkout -> <repo>/node_modules
+// crew-release.sh deploy enforces the same link on every deploy; the init
+// step below is the belt-and-suspenders repeat for init.
+function resolveDepNodeModules(repoPath) {
+  var r = String(repoPath).replace(/\/+$/, "");
+  var parent = r.split("/").slice(0, -1).join("/") || "/";
+  if (parent.split("/").pop() === "node_modules") return parent;
+  return r + "/node_modules";
+}
+
 // ── Gate 0: Launchable-path validation ─────────────────────────────
 // workflow_launch only accepts workspace-contained scripts. A crewHome
 // outside the workspace would produce an instance whose workflows can
@@ -200,6 +220,48 @@ try {
 }
 log("Release: " + (releaseResult.existed ? "existing" : "bootstrapped") + " at " + releaseResult.hash);
 
+// ── Dependency node_modules symlink ───────────────────────────────────
+// The release bootstrap (crew-release.sh init -> deploy) already links
+// $CREW_HOME/node_modules into the install's node_modules; this step is the
+// explicit, mechanical belt-and-suspenders repeat. The target dir is
+// computed by resolveDepNodeModules above — the agent only runs the shell
+// verbatim, it judges nothing. A missing source dir is not fatal: the QA
+// visual-loop guard parks instead of stamping when the tooling is
+// unresolvable.
+var depNodeModules = resolveDepNodeModules(crewRepoPath);
+var safeDepNm = depNodeModules.split('"').join('\\"');
+var safeCrewHomeNm = crewHome.split('"').join('\\"');
+try {
+  var depLinkResult = await agent(
+    "Ensure the crew home's dependency node_modules symlink.\n\n" +
+    "Crew home: " + crewHome + "\n" +
+    "Dependency node_modules (computed, do not alter): " + depNodeModules + "\n\n" +
+    "Steps (run in shell exactly as written):\n" +
+    "if [ -d \"" + safeDepNm + "\" ]; then\n" +
+    "  if [ -e \"" + safeCrewHomeNm + "/node_modules\" ] && [ ! -L \"" + safeCrewHomeNm + "/node_modules\" ]; then echo REAL_DIR_KEPT;\n" +
+    "  else ln -sfn \"" + safeDepNm + "\" \"" + safeCrewHomeNm + "/node_modules\" && echo LINKED;\n" +
+    "  fi\n" +
+    "else echo MISSING_SOURCE;\n" +
+    "fi\n\n" +
+    "Return JSON { linked: <true when the symlink now resolves into the computed dir, false otherwise>, note: \"<LINKED|REAL_DIR_KEPT|MISSING_SOURCE>\" }.",
+    {
+      key: "dep-node-modules-1",
+      label: "Linking dependency node_modules",
+      schema: {
+        type: "object",
+        properties: {
+          linked: { type: "boolean" },
+          note: { type: "string" }
+        },
+        required: ["linked", "note"]
+      }
+    }
+  );
+  log("Dependency node_modules: " + (depLinkResult.note || "unknown") + " -> " + depNodeModules);
+} catch (e) {
+  log("Dependency node_modules link step errored (non-fatal): " + String(e.message || e));
+}
+
 // ── Phase 2: Scaffold ─────────────────────────────────────────────────
 // Copies identities (with portraits), personas, workflow docs, and
 // feedback convention from the crew repo into .orchestration/ under crewHome.

package/workflows/standard.js

@@ -2418,6 +2418,52 @@ while (i < STEPS.length) {
     }
   }
 
+  // QA visual-loop guard (clean-room defect 2026-09-16): Hazel's verdict.json
+  // is honest about missing visual evidence, but the closeout treated a PASS
+  // as terminal done even when the see-act loop never ran (playwright-core
+  // was unresolvable from the release layout — the dependency lived in the
+  // npm install dir, severed from the crew home). A PASS verdict with missing
+  // experiential evidence must never be terminal: the task parks fail-closed
+  // with unattributable_reason=qa-visual-loop-unavailable instead of
+  // transitioning to done. Code, not prompt text: the check reads the
+  // machine-readable verdict via lib/read-ooda-verdict.js, which reports
+  // visual_loop_unavailable from the OODA log's NOT POSSIBLE browser steps
+  // and the verdict's missing_evidence tool-unavailability notes.
+  if (step.name === "QA" && qaVisual && verdictPassed === true) {
+    var qaLoopDir = crewHome + "/task-evidence/" + taskId + "/postchange";
+    var qaLoopOut = "";
+    try {
+      var qaLoopCheck = await agent(
+        "Check the QA visual loop's availability.\n" +
+        "Run: node " + crewHome + "/current/lib/read-ooda-verdict.js --dir " + qaLoopDir + " --expect PASS\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("qa-visual-loop-check-" + taskId, totalReworkCount), label: "Checking QA visual-loop availability",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      qaLoopOut = (qaLoopCheck && qaLoopCheck.output ? qaLoopCheck.output : "").trim();
+    } catch (e) {
+      qaLoopOut = "";
+    }
+    // The script prints exactly one JSON line; exit info does not survive
+    // the schema'd return, so the parsed object is the gate signal.
+    var qaLoopGate = null;
+    try {
+      var qaLoopLines = qaLoopOut.split("\n");
+      qaLoopGate = JSON.parse(qaLoopLines[qaLoopLines.length - 1]);
+    } catch (e) {
+      qaLoopGate = null;
+    }
+    if (!qaLoopGate || qaLoopGate.ok !== true) {
+      log("QA visual-loop check unreadable — cannot confirm experiential evidence; parking fail-closed");
+      return await parkTask("QA visual loop unverifiable (unattributable_reason=qa-visual-loop-unavailable): lib/read-ooda-verdict.js could not confirm the QA verdict record — a PASS without a machine-readable experiential record is never terminal. Human attention needed.");
+    }
+    if (qaLoopGate.visual_loop_unavailable === true) {
+      log("QA visual loop unavailable — parking fail-closed (unattributable_reason=qa-visual-loop-unavailable), never done");
+      return await parkTask("QA visual loop unavailable (unattributable_reason=qa-visual-loop-unavailable): the see-act browser loop could not run — verdict.json records missing visual evidence. A PASS without experiential evidence is never terminal. Human attention needed: repair the crew home's dependency symlink ($CREW_HOME/node_modules) or the npm install, then re-queue QA.");
+    }
+    log("QA visual-loop guard passed: experiential evidence present");
+  }
+
   // Deterministic closeout: no formatter agent. The verdict is mechanical
   // (extractVerdict above); the summary is the worker's report truncated.
   // For verdict steps passed comes from the verdict; for non-verdict steps