muse-crew 0.7.17 → 0.7.19

package/docs/ooda-report.md

@@ -132,13 +132,18 @@ The report is the evidence. A QA claim without its OODA report is an unverified
 ## Reading the verdict back (2026-09-15)
 
 `lib/read-ooda-verdict.js --dir <phase-dir> --expect <PASS|FAIL>` is the
-deterministic cross-checker the bugfix QA closeout runs after extracting the
-prose `VERDICT:` line. It prints one JSON line to stdout and never touches
-the clock or randomness:
-
-- Exit 0, `{ok:true, verdict, reason, summary, expected, actual, attempt}` —
-  the record exists, parses, carries a `verdict` field, agrees with the
-  prose expectation, and a FAIL carries a non-empty reason.
+deterministic cross-checker the Standard and Bugfix QA closeouts run after
+extracting the prose `VERDICT:` line. It prints one JSON line to stdout and
+never touches the clock or randomness:
+
+- Exit 0, `{ok:true, verdict, reason, summary, expected, actual, attempt,
+  visual_loop_unavailable}` — the record exists, parses, carries a `verdict`
+  field, agrees with the prose expectation, and a FAIL carries a non-empty
+  reason. `visual_loop_unavailable` reports whether the experiential browser
+  loop could not run: a see-act browser step exited 3 with `NOT POSSIBLE`
+  (unresolvable tooling), and/or `verdict.json`'s `missing_evidence` names
+  tool unavailability (playwright, see-act, not installed, could not
+  run/drive/launch, no browser).
 - Exit 2, `{ok:false, code}` — `missing` (no verdict.json), `corrupt`
   (unparseable or no verdict field), `contradiction` (record disagrees with
   the prose line), `no_reason` (FAIL with no machine-readable reason).
@@ -148,3 +153,18 @@ workflow reads. On a cross-check failure the QA phase is recorded as failed
 and retried at the same step — an unreasoned or contradictory verdict never
 routes to rework. No LLM judges report-prose consistency; the machine only
 enforces that the reason is present and the records agree.
+
+## A PASS without visual evidence never completes (2026-09-16)
+
+A PASS verdict with an unavailable visual loop is not terminal. When the
+cross-checker reports `visual_loop_unavailable` (the see-act loop never ran —
+e.g. `playwright-core` was unresolvable from the release layout, a 2026-09-16
+clean-room incident), the Standard and Bugfix QA closeouts park the task
+fail-closed with `unattributable_reason=qa-visual-loop-unavailable` instead
+of transitioning to done. The same park fires when the cross-check itself is
+unreadable: unknown or unverifiable experiential evidence is never a PASS.
+
+The dependency must resolve from the release layout for the loop to run at
+all: `$CREW_HOME/node_modules` is a symlink into the npm install's
+`node_modules`, resolved mechanically from the deploy source and repaired
+on every `crew-release.sh deploy` (and re-established by `crew-init`).

package/docs/publish-verification.md

@@ -42,18 +42,23 @@ The rule: **the builder's applied report is never a verification signal, in
 either direction.** A matching report certifies nothing (it is derived from
 the carried diff — circular by construction, canary run 8). A mismatching or
 empty report blocks nothing (false-negative mode demonstrated by `23ca8f3f`).
-The workflow computes the report comparison as an observation only — it
-never parks on it. The parent ignores the applied report entirely when
-deciding whether to stamp: an `applied:[]` or mismatched report with a
-matching independent read-back stamps normally.
+The workflow dropped the report entirely on 2026-09-16 (clean-room task
+`e2a8d9f8`): the trigger's JSON closeout contract traveled over the
+stochastic text channel and the runtime's JSON-candidate heuristic misfired
+on its prose ("workflow agent output was not JSON"), parking a task whose
+edit may have gone through. The trigger is now fire-and-forget — no schema,
+no consumed return value — and there is no builder report to observe:
+`applied_report` is a constant `missing-report` on the ledger line. The
+parent ignores the (absent) report entirely when deciding whether to stamp.
 
 The contract is split on purpose:
 
-- **Workflow-owned:** carrying the merged diff to the builder, the
-  applied-report observation (logged, never a park), the build-completion
-  poll, post-deploy cleanup, recording the Publish session completed, and
-  parking with `publish: verification-requested <commit>` instead of
-  stamping. The workflow does NOT trigger the read-back inspection — an
+- **Workflow-owned:** carrying the merged diff to the builder, attributing
+  the edit itself (fire-and-forget trigger — no builder report — via
+  pre-trigger toolcheck, pre-trigger build-state baseline, and post-trigger
+  build-state diff), the build-completion poll, post-deploy cleanup,
+  recording the Publish session completed, and parking with `publish:
+  verification-requested <commit>` instead of stamping. The workflow does NOT trigger the read-back inspection — an
   async inspection triggered from inside a workflow run delivers its result
   to the root agent, never back into the run, so a workflow-side trigger is
   an orphan the verifier cannot consume. The parent triggers the one
@@ -313,24 +318,40 @@ For a task parked with `publish: verification-requested <commit>`:
   second scan sees the unexpired `publish: verification-claimed` note and
   skips. The lease expiry bounds the damage if a claimer dies.
 
-## Unknown-outcome recovery (2026-09-14, Gate 1 Journey 3 attempt 7)
+## Unknown-outcome recovery (2026-09-14, Gate 1 Journey 3 attempt 7; fire-and-forget 2026-09-16)
 
 Attempt 7 parked at Publish with outcome `unknown`: the rebuild trigger's
 child failed structured closeout and the in-flight-only build-state poll
 could not see the completed build — even though the build HAD run (a fresh
-platform audit directory existed). Two mechanisms close this gap.
-
-**1. Workflow-side durable evidence.** Before the rebuild trigger, the
+platform audit directory existed). 2026-09-16 (clean-room task `e2a8d9f8`)
+showed the failure is worse than a catchable throw: the runtime's
+JSON-candidate heuristic rejects the trigger call itself ("workflow agent
+output was not JSON") whenever the child returns prose, whether or not the
+edit went through. The trigger is therefore fire-and-forget — no schema, no
+consumed return value — and the workflow always attributes the edit itself.
+Two mechanisms close the gap.
+
+**1. Pre-trigger toolcheck + baseline.** Before the trigger, a tiny schema'd
+child proves the artifact tool namespace is available (one bounded retry on
+explicit negative evidence — the only safe retry on the publish path:
+without the tools the edit provably did not go through) and captures a
+pre-trigger build-state baseline. After the trigger, the workflow diffs the
+post-trigger build state against the baseline: a build whose `agent_id` is
+new relative to the baseline is this edit's receipt. The baseline build's
+`agent_id` is never substituted — a build already in flight at baseline
+predates the trigger and is never attributed to this edit.
+
+**2. Workflow-side durable evidence.** Before the rebuild trigger, the
 workflow snapshots the artifact's audit-directory listing
-(`~/workspace/ts-spaces/<slug>/audits/` — best-effort, never a gate). On a
-structured-output failure with no in-flight build observed, it re-lists and
-diffs: a timestamped directory that appeared during the trigger window is
-positive evidence the edit went through and the build completed. The
-fallback never re-issues the edit, never stamps provenance, and only routes
-to the parent's independent content read-back. No new directory still parks
-`unknown` fail-closed. The ledger distinguishes the two confirmations: `edit
-confirmed via durable audit evidence …` vs `edit confirmed via build-state
-poll …`.
+(`~/workspace/ts-spaces/<slug>/audits/` — best-effort, never a gate). When
+no in-flight receipt was observed, it re-lists and diffs: a timestamped
+directory that appeared during the trigger window is positive evidence the
+edit went through and the build completed. The fallback never re-issues the
+edit, never stamps provenance, and only routes to the parent's independent
+content read-back. No new directory still parks `unknown` fail-closed. The
+ledger's `detail` line distinguishes the two confirmations: `… edit
+confirmed via durable audit evidence (new audit dir …)` vs `… build receipt
+captured by workflow-owned build-state observation (pre/post-trigger diff)`.
 
 The fallback's known limitation: audit directories are not attributed to
 tasks, so two concurrent publishes to the same artifact could cross-read.

package/lib/crew-release.sh

@@ -136,6 +136,47 @@ _sync_workflow_docs() {
   echo "WORKFLOW-DOCS: synced $copied workflow docs to $dest"
 }
 
+# ── dependency node_modules symlink ───────────────────────────────────
+# lib/see-act.js and lib/render-html.js resolve playwright-core by name.
+# The release layout (releases/<name>/lib/) is severed from the npm install
+# that provides it: Node's upward module walk from the release lib/ dir
+# never passes the install dir's node_modules, so require("playwright-core")
+# threw and QA degraded to a mechanical-only PASS that still stamped done
+# (clean-room defect, 2026-09-16 — a rubber stamp). The crew home therefore
+# carries a top-level node_modules symlink into the install's node_modules,
+# resolved mechanically from the deploy source repo:
+#   npm flow: <repo> is <install>/node_modules/muse-crew -> <install>/node_modules
+#   git flow:  <repo> is a checkout (npm install run inside) -> <repo>/node_modules
+# Repaired on every deploy like the lib/workflows symlinks; immutable
+# releases stay untouched (the link lives at the crew-home top level, never
+# inside a release dir). A missing source node_modules is a loud warning,
+# never a deploy failure — the QA visual-loop guard parks instead of
+# stamping when the tooling is unresolvable.
+_link_dep_node_modules() {
+  local repo="${1:?usage: _link_dep_node_modules <repo-path> <crew-home>}"
+  local home="${2:?usage: _link_dep_node_modules <repo-path> <crew-home>}"
+  local src=""
+  local parent base
+  parent="$(dirname "$repo")"
+  base="$(basename "$parent")"
+  if [ "$base" = "node_modules" ] && [ -d "$parent" ]; then
+    src="$parent"
+  elif [ -d "$repo/node_modules" ]; then
+    src="$repo/node_modules"
+  fi
+  if [ -z "$src" ]; then
+    echo "DEP-NODE-MODULES: WARNING — no node_modules resolvable from $repo; skipping symlink (QA visual loop will park, not stamp)" >&2
+    return 0
+  fi
+  local link="$home/node_modules"
+  if [ -e "$link" ] && [ ! -L "$link" ]; then
+    echo "DEP-NODE-MODULES: $link exists as a real directory — leaving it (Node resolves from it directly)" >&2
+    return 0
+  fi
+  ln -sfn "$src" "$link"
+  echo "DEP-NODE-MODULES: $link -> $src"
+}
+
 # ── deploy ────────────────────────────────────────────────────────────
 # Build, validate, and atomically activate a release from repo HEAD.
 # Single command — no cross-step lock needed.
@@ -143,6 +184,8 @@ cmd_deploy() {
   local repo="${1:?usage: deploy <repo-path> [<jarvis-home>]}"
   local home="${2:-$CREW_HOME}"
   CREW_HOME="$home"
+  # Absolute repo path before cd: the dependency symlink is resolved from it.
+  repo="$(realpath "$repo")"
 
   # Self-update: the stable script is installed once by cmd_init and would
   # otherwise go stale (2026-09-12: the stable copies predated the
@@ -233,6 +276,12 @@ cmd_deploy() {
   ln -sfn current/workflows "$CREW_HOME/workflows"
   ln -sfn current/lib "$CREW_HOME/lib"
 
+  # Dependency node_modules symlink (clean-room defect, 2026-09-16): keep the
+  # package next to its deps so lib/see-act.js and lib/render-html.js resolve
+  # playwright-core by name from the release lib/ dir. Repaired on every
+  # deploy; a missing source is a warning, never a failure.
+  _link_dep_node_modules "$repo" "$CREW_HOME"
+
   # Keep the dashboard's workflow documents in sync with the release.
   _sync_workflow_docs "$CREW_HOME"
 

package/lib/read-ooda-verdict.js

@@ -12,9 +12,22 @@
 //
 // Reads <phase-dir>/verdict.json and prints exactly one JSON line to stdout.
 //
-// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt}
-// when the record exists, parses, has a verdict field, the verdict equals
-// --expect, and a FAIL carries a non-empty reason.
+// Exit 0 with {ok:true, verdict, reason, summary, expected, actual, attempt,
+// visual_loop_unavailable} when the record exists, parses, has a verdict
+// field, the verdict equals --expect, and a FAIL carries a non-empty reason.
+//
+// visual_loop_unavailable (2026-09-16): a PASS verdict with missing
+// experiential evidence must never be terminal — the QA closeout parks
+// instead of stamping done (the clean-room rubber stamp: the see-act loop
+// never ran because playwright-core was unresolvable from the release
+// layout, yet the task stamped done on a mechanical-only PASS). Two
+// mechanical signals, no judgment:
+//   (1) the OODA log in the same dir has a browser-action step
+//       (aria|shot|click|scroll|type) with exit 3 and NOT POSSIBLE in the
+//       observation — the see-act contract for "tooling unresolvable";
+//   (2) verdict.json's missing_evidence names tool-unavailability
+//       (playwright, see-act, not possible, not installed, unavailable,
+//       could not run/drive/launch, no browser).
 //
 // Exit 2 with {ok:false, code, error} when:
 //   missing      — verdict.json is absent (the agent never wrote one)
@@ -55,7 +68,8 @@ function main() {
     fail("bad_input", "unknown --expect: " + args.expect + " (PASS|FAIL)");
   }
 
-  const verdictPath = join(resolve(args.dir), "verdict.json");
+  const dir = resolve(args.dir);
+  const verdictPath = join(dir, "verdict.json");
   if (!existsSync(verdictPath)) {
     fail("missing", "verdict.json not found: " + verdictPath);
   }
@@ -88,7 +102,54 @@ function main() {
     expected: record.expected === undefined ? "" : record.expected,
     actual: record.actual === undefined ? "" : record.actual,
     attempt: record.attempt === undefined ? "" : record.attempt,
+    visual_loop_unavailable: visualLoopUnavailable(dir, record),
   }) + "\n");
 }
 
+// Visual-loop availability: true when the experiential browser loop could
+// not run. Signal 1 — a browser-action OODA step (the see-act actions)
+// exited 3 with NOT POSSIBLE in its observation (the driver's contract for
+// unresolvable tooling). Signal 2 — the verdict's own missing_evidence
+// names tool-unavailability. Both are string matches on machine-written
+// records, never a judgment about report prose.
+const BROWSER_ACTIONS = { aria: true, shot: true, click: true, scroll: true, type: true };
+const TOOL_UNAVAILABLE = /(playwright|see-act|not possible|not installed|unavailable|could not (run|drive|launch)|no browser)/i;
+
+function oodaLogUnavailable(dir) {
+  let text;
+  try {
+    text = readFileSync(join(dir, "ooda-log.jsonl"), "utf8");
+  } catch (e) {
+    return false;
+  }
+  const lines = text.split("\n");
+  for (let k = 0; k < lines.length; k++) {
+    const line = lines[k].trim();
+    if (!line) continue;
+    let step;
+    try {
+      step = JSON.parse(line);
+    } catch (e) {
+      continue;
+    }
+    if (!step || !BROWSER_ACTIONS[step.action]) continue;
+    if (step.exit === 3 && /not possible/i.test(String(step.observation || ""))) return true;
+  }
+  return false;
+}
+
+function missingEvidenceUnavailable(record) {
+  let me = record.missing_evidence;
+  if (me === undefined) me = record.missing;
+  if (!Array.isArray(me)) return false;
+  for (let k = 0; k < me.length; k++) {
+    if (TOOL_UNAVAILABLE.test(String(me[k]))) return true;
+  }
+  return false;
+}
+
+function visualLoopUnavailable(dir, record) {
+  return oodaLogUnavailable(dir) || missingEvidenceUnavailable(record);
+}
+
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.17",
+  "version": "0.7.19",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,