muse-crew 0.7.20 → 0.8.0

package/workflows/bugfix.js

@@ -58,7 +58,10 @@ if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew ho
 const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
-const CREW_API = crewHome + "/current/lib/crew-api.js";
+const CREW_API_SRC = crewHome + "/current/lib/crew-api.js";
+// Pinned at pinLifecycle: after the pin, CREW_API points into RUN_LIB so a
+// mid-flight release swap cannot change the CLI under a running workflow.
+let CREW_API = CREW_API_SRC;
 // Build a shell command invoking the CLI. Args are JSON-encoded and
 // single-quote-wrapped for safe shell passing. The agent runs this and
 // returns the stdout verbatim (the CLI emits JSON on stdout).
@@ -75,9 +78,12 @@ const LIFECYCLE = RUN_LIB + "/worktree-lifecycle.sh";
 const MERGE_LOCK = RUN_LIB + "/merge-lock.sh";
 const PUBLISH_NPM_SRC = crewHome + "/lib/publish-npm.sh";
 const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
-// The four basenames the pin step must materialize — asserted mechanically
+const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
+const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
+const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
+// The five basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -223,7 +229,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the four pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -231,7 +237,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -522,7 +528,7 @@ function extractMarkerLines(workerText) {
   var markers = [];
   for (var i = 0; i < lines.length; i++) {
     var line = lines[i].trim();
-    if (/^(repo_diff:|release:|version_bump:|VERDICT:|TARGET_VERSION=|published:|experiential:|capture_targets:|worktree:)/i.test(line)) {
+    if (/^(repo_diff:|release:|version_bump:|VERDICT:|TARGET_VERSION=|published:|experiential:|layer:|capture_targets:|worktree:)/i.test(line)) {
       markers.push(line);
     }
   }
@@ -577,6 +583,16 @@ function extractExperiential(workerText) {
   if (!r) return null;
   return r[1].toLowerCase() === "yes";
 }
+// Layer flag: reads Sage's layer: artifact|engine|docs marker line.
+// Missing or malformed degrades to null (unknown) — callers degrade to
+// "artifact" (today's single-strategy behavior), never park a task on a
+// garbled line.
+function extractLayer(workerText) {
+  var t = workerText || "";
+  var r = /layer:\s*(artifact|engine|docs)\b/i.exec(t);
+  if (!r) return null;
+  return r[1].toLowerCase();
+}
 function buildVisualCapturePlan(taskTitle, taskDescription, kind, captureTargets) {
   // Deterministic visual-capture frame. kind: "baseline" | "postchange".
   // This string IS the capture script: fixed viewport matrix, scroll
@@ -634,6 +650,41 @@ async function resolveExperiential() {
   else experientialResolved = "unknown";
   return experientialResolved;
 }
+// Layer resolution: the task's layer is "artifact", "engine", or "docs" —
+// the machine-read "layer:" marker Sage's Triage report ends with. Unknown
+// (missing/garbled line, failed lookup) degrades to "artifact": today's
+// single-strategy behavior, never a park. Mirrors resolveExperiential()
+// (same cache shape, same Triage-notes re-read); the layer flag is captured
+// at Triage closeout (bugLayer) so the common path needs no extra agent call.
+async function resolveLayer() {
+  // Triage notes are immutable within a run: cache the resolved layer so
+  // the dashboard lookup runs at most once per run.
+  if (layerResolved !== null) return layerResolved;
+  if (bugLayer) return (layerResolved = bugLayer);
+  var layerCheck = null;
+  try {
+    layerCheck = await agent(
+      "Find this task's Triage step session notes from the crew API.\n" +
+      "Run in shell and return the stdout verbatim:\n" + crewCmd("get-state", { events_limit: 1 }) + "\n" +
+      "Find the session with task_id \"" + taskId + "\" and step \"Triage\" (status completed) in the returned sessions array and read its notes field.\n" +
+      "Return JSON { \"layer_line\": \"<the exact text of the layer: marker line from the notes, or empty string if absent>\" } and nothing else.",
+      {
+        key: "resolve-layer-" + taskId,
+        label: "Resolving bug layer from Triage notes",
+        schema: { type: "object", properties: { layer_line: { type: "string" } }, required: ["layer_line"] }
+      }
+    );
+  } catch (e) {
+    log("resolveLayer: agent call failed (" + (e && e.message ? e.message : e) + ") — treating as unknown");
+    layerResolved = "artifact";
+    return layerResolved;
+  }
+  var layer = extractLayer(layerCheck && layerCheck.layer_line ? layerCheck.layer_line : "");
+  // Unknown degrades to "artifact" (today's behavior) — never park a task
+  // on a garbled line.
+  layerResolved = layer || "artifact";
+  return layerResolved;
+}
 // Baseline evidence status: reads the task's note events for the exact
 // protocol prefixes (explicit state, never English matching). Returns
 // { baseline_found, baseline_kind, baseline_refs, requested_count, evidence_count }.
@@ -718,6 +769,12 @@ let mapperSpec = "";
 // plan, and the Map-gate bounce counter (keeps agent stable-keys unique when
 // a Map-gate bounce re-runs Capture/Map in the same run).
 let isExperiential = null;
+// Sage's bug-layer flag ("artifact"|"engine"|"docs", null until the Triage
+// report is read). Drives the Reproduce phase's strategy dispatch.
+let bugLayer = null;
+// Caches the resolveLayer() outcome; Triage notes are immutable within a
+// run, so the lookup runs at most once.
+let layerResolved = null;
 // Caches all three resolveExperiential() outcomes (yes/no/unknown); Triage
 // notes are immutable within a run, so the lookup runs at most once.
 let experientialResolved = null;
@@ -803,7 +860,7 @@ let i = startStepIndex;
 // ── Pin lifecycle scripts ────────────────────────────────────────────
 // Copy lifecycle scripts into a per-task temp dir so this run is immune
 // to upgrades that land while it's in flight. Verified mechanically:
-// workflow code asserts the four basenames from the verbatim listing —
+// workflow code asserts the five basenames from the verbatim listing —
 // the agent cannot self-certify. Any miss parks the task before Triage.
 const initialPins = parsePinListing(await pinLifecycle("pin-lifecycle"));
 const missingInitialPins = PIN_BASENAMES.filter(function (b) { return initialPins.indexOf(b) === -1; });
@@ -811,6 +868,10 @@ if (missingInitialPins.length > 0) {
   return await parkTask("Lifecycle pin incomplete before Triage — missing " + missingInitialPins.join(", ") + " in " + RUN_LIB + ".");
 }
 log("Lifecycle scripts pinned to " + RUN_LIB);
+// From here on, every crew-api.js invocation uses the pinned copy: immune
+// to a release swap landing mid-flight.
+CREW_API = CREW_API_PINNED;
+log("Crew API pinned to " + CREW_API);
 
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
@@ -1128,7 +1189,9 @@ while (i < STEPS.length) {
   var mapBaselineRefs = "";
   var mapBaselineNone = false;
   if (step.name === "Map") {
-    if ((await resolveExperiential()) === "yes") {
+    // Must match Capture's run condition (experiential + artifact publish):
+    // when Capture skips, no baseline notes exist, so the gate must not apply.
+    if ((await resolveExperiential()) === "yes" && PUBLISH_TYPE === "artifact") {
       var gateStatus = await baselineStatus();
       if (!gateStatus.baseline_found) {
         log("Map gate: no baseline evidence for experiential task " + taskId + " — bouncing to Capture");
@@ -1161,14 +1224,26 @@ while (i < STEPS.length) {
     qaVisual = (await resolveExperiential()) === "yes" && PUBLISH_TYPE === "artifact";
   }
 
+  // Reproduce-layer routing (2026-09-16): Sage's Triage classifies the bug's
+  // layer (artifact|engine|docs) with the machine-read "layer:" marker; the
+  // workflow dispatches the Reproduce strategy mechanically on it. Unknown
+  // degrades to "artifact" (today's single-strategy behavior). resolveLayer
+  // caches per run, so Reproduce entry costs one agent call at most.
+  var reproLayer = "artifact";
+  if (step.name === "Reproduce") {
+    reproLayer = await resolveLayer();
+    log("Reproduce dispatching at the bug's layer for task " + taskId + ": " + reproLayer);
+  }
+
   var safeTitle = taskTitle.replace(/"/g, "'").replace(/\\/g, "\\\\").replace(/`/g, "'");
   var instructions = "";
 
   if (step.name === "Triage") {
-    instructions = "Validate the task against the project's repo at " + REPO_PATH + " — that exact checkout, not any other copy of the project on disk. If you run git commands, cd " + REPO_PATH + " first.\nCheck clarity, note dependencies, confirm the bugfix workflow assignment.\nIf the task needs decomposition, note that in your assessment.\nReport back in plain prose — what you found.\nEXPERIENTIAL FLAG: does this task change anything rendered and visible in the project's user-facing artifact (pages, components, styles, layout, copy, visual states)? If yes it is experiential and gets baseline captures (plus a visual verdict where the workflow has a QA phase). End your report with exactly one line on its own, lowercase, unrephrased: experiential: yes — or experiential: no. This line is machine-read.";
+    instructions = "Validate the task against the project's repo at " + REPO_PATH + " — that exact checkout, not any other copy of the project on disk. If you run git commands, cd " + REPO_PATH + " first.\nCheck clarity, note dependencies, confirm the bugfix workflow assignment.\nIf the task needs decomposition, note that in your assessment.\nReport back in plain prose — what you found.\nEXPERIENTIAL FLAG: does this task change anything rendered and visible in the project's user-facing artifact (pages, components, styles, layout, copy, visual states)? If yes it is experiential and gets baseline captures (plus a visual verdict where the workflow has a QA phase). End your report with exactly one line on its own, lowercase, unrephrased: experiential: yes — or experiential: no. This line is machine-read.\nLAYER FLAG: classify the bug's layer — where the reported misbehavior lives. artifact: user-facing behavior of the project's rendered artifact (something a user sees or clicks). engine: the crew's own machinery — workflows, lib scripts, shell scripts, tests, scheduler. docs: a documentation gap or error. End your report with exactly one line on its own, lowercase, unrephrased: layer: artifact — or layer: engine — or layer: docs. This line is machine-read. If the bug genuinely spans layers, pick the layer where reproduction must happen and note the ambiguity in prose.";
 
   } else if (step.name === "Reproduce") {
-    instructions = "Reproduce the bug from a user's perspective — by USING the artifact, not by reading data. You are CODE-BLIND — do NOT read source code.\n" +
+    if (reproLayer !== "engine" && reproLayer !== "docs") {
+      instructions = "Reproduce the bug from a user's perspective — by USING the artifact, not by reading data. You are CODE-BLIND — do NOT read source code.\n" +
       "You have a see-act driver: " + crewHome + "/current/lib/see-act.js (a node script; one browser action per invocation; it prints one JSON line to stdout). It launches its own Chromium through a self-contained loopback proxy — the ONLY url you may give it is the local artifact server you start below. Never point it at any other URL.\n" +
       "Actions: aria | shot [--out <png>] [--full] | click [--out <png>] --selector <css> | scroll [--out <png>] --y <pixels|bottom> | type [--out <png>] --selector <css> --text <text>. Add --viewport mobile for a 390x844 frame. The JSON reports console_errors — treat any as a defect signal. Exit code 3 with not_possible set (a \"NOT POSSIBLE: <reason>\" string) means this environment cannot drive a browser: report NOT POSSIBLE: <reason> and fall back to the data-level investigation at the end.\n" +
       "a. Verify the built artifact exists: test -d ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/client/dist && test -f ~/workspace/ts-spaces/" + PUBLISH_SLUG + "/server/dist/actions.js — if either is missing, report NOT POSSIBLE: built artifact not present at ~/workspace/ts-spaces/" + PUBLISH_SLUG + " and fall back to the data-level investigation.\n" +
@@ -1184,6 +1259,18 @@ while (i < STEPS.length) {
       "This returns current sessions, events, and tasks — capture concrete evidence from the data you retrieve.\n" +
       "Report your reproduction steps and evidence as plain prose.\n" +
       "End your report with exactly one line: VERDICT: PASS if you reproduced the reported bug (your frames show the reported misbehavior), VERDICT: FAIL if you could not. --expected names the bug as reported (its visible manifestation); --actual names what your frames actually showed. Checks you could not run are evidence gaps, not silent drops: name every one in --missing. First ensure the OODA log exists even if you logged zero steps (touch " + crewHome + "/task-evidence/" + taskId + "/repro/ooda-log.jsonl — an empty log is honest, an absent one is a broken report). Also write the same verdict machine-readably: node " + crewHome + "/current/lib/write-ooda-verdict.js --dir " + crewHome + "/task-evidence/" + taskId + "/repro/ --attempt \"1\" --verdict <PASS|FAIL|NOT_POSSIBLE> --summary \"<one line>\" --expected \"<the bug as reported — its visible manifestation>\" --actual \"<what your frames actually showed>\" --missing '[\"honest evidence gap, if any\"]' [--reason \"<why it failed — REQUIRED and non-empty when verdict is FAIL or NOT_POSSIBLE; the script rejects a reason-less negative verdict with exit 2>\"] — this writes verdict.json (the latest verdict) and appends to verdicts.jsonl (the append-only ledger: every attempt's verdict is preserved, never overwritten). A FAIL or NOT_POSSIBLE verdict without a machine-readable --reason cannot be written — state the reason.";
+    } else if (reproLayer === "engine") {
+      instructions = "REPRODUCE AT THE BUG'S LAYER. Triage classified this bug as layer: engine — it lives in the crew's own machinery (workflows, lib scripts, shell scripts, tests, scheduler), not in the rendered artifact. Reproduce it deterministically with shell commands in the repo checkout at " + REPO_PATH + " — that exact checkout, not any other copy of the project on disk. You are NOT code-blind here: reading source to find the failing mechanism is expected.\n" +
+      "Do NOT start an artifact server. Do NOT invoke see-act.js or any browser loop — the experiential loop is for artifact-layer bugs only, and driving it here fails the phase loudly. If you cannot reproduce without a browser, say so and FAIL with a reason naming the layer you tried.\n" +
+      "Reproduce with the commands that match the bug: run the failing script directly, re-run the failing test suite (bash tests/run.sh), grep the workflow source, query scheduler/crew state via the crew API. Concrete evidence only: the command lines you ran, their verbatim stdout, and their exit codes.\n" +
+      "Report your reproduction steps and evidence as plain prose.\n" +
+      "End your report with exactly one line: VERDICT: PASS if you reproduced the reported bug (your command output shows the reported misbehavior), VERDICT: FAIL if you could not. --expected names the bug as reported; --actual names what your commands actually showed. Checks you could not run are evidence gaps, not silent drops: name every one in --missing. Also write the same verdict machine-readably: node " + crewHome + "/current/lib/write-ooda-verdict.js --dir " + crewHome + "/task-evidence/" + taskId + "/repro/ --attempt \"1\" --verdict <PASS|FAIL|NOT_POSSIBLE> --summary \"<one line>\" --expected \"<the bug as reported>\" --actual \"<what your commands actually showed>\" --missing '[\"honest evidence gap, if any\"]' [--reason \"<why it failed — REQUIRED and non-empty when verdict is FAIL or NOT_POSSIBLE; the script rejects a reason-less negative verdict with exit 2>\"] — this writes verdict.json (the latest verdict) and appends to verdicts.jsonl (the append-only ledger: every attempt's verdict is preserved, never overwritten). A FAIL or NOT_POSSIBLE verdict without a machine-readable --reason cannot be written — state the reason.";
+    } else {
+      instructions = "REPRODUCE AT THE BUG'S LAYER. Triage classified this bug as layer: docs — a documentation gap or error. Reproduce it by reading the file, not the browser: open the document in the repo checkout at " + REPO_PATH + " (that exact checkout, not any other copy of the project on disk) and verify the reported gap or error is actually there (a missing section, a stale instruction, a wrong claim). Quote the exact lines you found — or their absence.\n" +
+      "Do NOT start an artifact server. Do NOT invoke see-act.js or any browser loop — the experiential loop is for artifact-layer bugs only, and driving it here fails the phase loudly. If you cannot verify the gap without a browser, say so and FAIL with a reason naming the layer you tried.\n" +
+      "Report your findings as plain prose: what the document says today versus what it should say.\n" +
+      "End your report with exactly one line: VERDICT: PASS if you confirmed the reported docs gap, VERDICT: FAIL if you could not. Also write the same verdict machine-readably: node " + crewHome + "/current/lib/write-ooda-verdict.js --dir " + crewHome + "/task-evidence/" + taskId + "/repro/ --attempt \"1\" --verdict <PASS|FAIL|NOT_POSSIBLE> --summary \"<one line>\" --expected \"<the bug as reported>\" --actual \"<what the document actually says>\" --missing '[\"honest evidence gap, if any\"]' [--reason \"<why it failed — REQUIRED and non-empty when verdict is FAIL or NOT_POSSIBLE; the script rejects a reason-less negative verdict with exit 2>\"] — this writes verdict.json (the latest verdict) and appends to verdicts.jsonl (the append-only ledger: every attempt's verdict is preserved, never overwritten). A FAIL or NOT_POSSIBLE verdict without a machine-readable --reason cannot be written — state the reason.";
+    }
 
   } else if (step.name === "Map") {
     var mapGatePara = "";
@@ -1315,6 +1402,10 @@ while (i < STEPS.length) {
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
         "VERDICT: PASS\n\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-npm-publish, the publish was skipped gracefully: npm publish is not configured on this machine (helper or credential absent) — the merge stands, the version was not cut, nothing was shipped. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-npm-publish (npm publish not configured — helper or credential missing; nothing versioned or published)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -1409,9 +1500,17 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
+        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
+        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
+        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
+        // to execute the conditional (clean-room 2026-09-16: the agent ran
+        // merge-base on the empty tree directly and parked).
+        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
+          ? "ANCESTOR=yes && "
+          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
         var diffResult = await agent(
           "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          "if [ \"$BASE\" = '" + EMPTY_TREE_SHA + "' ]; then ANCESTOR=yes; else git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no; fi && " +
+          ancestorShell + 
           "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
           "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
           "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
@@ -2231,6 +2330,35 @@ while (i < STEPS.length) {
     "Return your work as JSON in exactly this shape: {\"status\": \"ok\", \"result\": \"your report here\"}. " +
     "The result is plain prose describing what you did and found. For verdict steps, end the report with exactly one line: VERDICT: PASS or VERDICT: FAIL.";
   var workKeyBase = "work-" + step.name + (totalReworkCount > 0 ? "-r" + totalReworkCount : "");
+  // Reproduce wrong-layer guard baseline (2026-09-17): snapshot the repro
+  // evidence dir listing BEFORE the Reproduce work agent runs. The guard
+  // after the run diffs against this baseline — only frames created by the
+  // current attempt count as a wrong-layer violation; stale frames from
+  // pre-fix attempts appear in both snapshots and are excluded (set diff,
+  // no wall-clock, deterministic). One snapshot per phase attempt covers
+  // all transport retries inside the dispatch loop. null = baseline
+  // unavailable; the guard then fails closed for retry.
+  var reproEvidenceDir = crewHome + "/task-evidence/" + taskId + "/repro";
+  var reproFramesBefore = null; // null = baseline unavailable (guard must fail closed)
+  if (step.name === "Reproduce" && (reproLayer === "engine" || reproLayer === "docs")) {
+    try {
+      var reproBefore = await agent(
+        "Run: ls " + reproEvidenceDir + " 2>/dev/null | grep -E -- '-(shot|click|scroll|type)-' || echo NONE\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("repro-layer-guard-before-" + taskId, totalReworkCount),
+          label: "Snapshotting repro evidence before Reproduce attempt",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      var reproBeforeOut = (reproBefore && reproBefore.output ? reproBefore.output : "").trim();
+      reproFramesBefore = (reproBeforeOut === "NONE" || reproBeforeOut === "")
+        ? []
+        : reproBeforeOut.split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+      log("Reproduce guard baseline for task " + taskId + ": " + reproFramesBefore.length + " pre-existing frame(s)");
+    } catch (e) {
+      reproFramesBefore = null;
+      log("Reproduce guard baseline snapshot failed for task " + taskId + " — guard will fail closed for retry");
+    }
+  }
   var workerResult = null;
   var workAttempts = [];
   for (var workAttempt = 0; workAttempt <= 2; workAttempt++) {
@@ -2432,6 +2560,91 @@ while (i < STEPS.length) {
     log("QA visual-loop guard passed: experiential evidence present");
   }
 
+  // Reproduce wrong-layer guard (2026-09-16): for engine/docs tasks the
+  // experiential see-act loop is forbidden — a reproducer that drives the
+  // browser burns the run and emits a wrong-layer verdict (three tasks
+  // parked on exactly this in the 2026-09-17 UTC shift). The workflow
+  // checks the repro evidence dir mechanically for see-act frame artifacts
+  // (the driver's archive naming: <n>-<action>-<desktop|mobile>.png).
+  // Attempt-scoped (2026-09-17): the after-listing is diffed against the
+  // baseline taken before this phase attempt's dispatch loop — only frames
+  // CREATED BY the current attempt count as a violation; stale frames from
+  // earlier attempts appear in both snapshots and are excluded. Without a
+  // baseline the guard is inconclusive and fails closed for retry (passing
+  // could route a genuinely wrong-layer verdict to Map).
+  if (step.name === "Reproduce" && (reproLayer === "engine" || reproLayer === "docs") && verdictPassed !== null) {
+    var reproEvidenceDir = crewHome + "/task-evidence/" + taskId + "/repro";
+    var reproFramesOut = "";
+    try {
+      var reproFramesCheck = await agent(
+        "Run: ls " + reproEvidenceDir + " 2>/dev/null | grep -E -- '-(shot|click|scroll|type)-' || echo NONE\n" +
+        "Return JSON { \"output\": \"<the command's full stdout, trimmed>\" } and nothing else.",
+        { key: attemptKey("repro-layer-guard-" + taskId, totalReworkCount), label: "Checking for wrong-layer driver invocation",
+          schema: { type: "object", properties: { output: { type: "string" } }, required: ["output"] } }
+      );
+      reproFramesOut = (reproFramesCheck && reproFramesCheck.output ? reproFramesCheck.output : "").trim();
+    } catch (e) {
+      reproFramesOut = "";
+    }
+    var reproAfterList = (reproFramesOut && reproFramesOut !== "NONE")
+      ? reproFramesOut.split("\n").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; })
+      : [];
+    var reproGuardFailKind = null; // "wrong-layer" | "baseline-unavailable" | null
+    var reproGuardDetail = "";
+    if (reproFramesBefore === null) {
+      reproGuardFailKind = "baseline-unavailable";
+    } else {
+      var reproBeforeSet = new Set(reproFramesBefore);
+      var reproNewFrames = reproAfterList.filter(function (f) { return !reproBeforeSet.has(f); });
+      if (reproNewFrames.length > 0) {
+        reproGuardFailKind = "wrong-layer";
+        reproGuardDetail = reproNewFrames.slice(0, 5).join(", ").slice(0, 300);
+      }
+    }
+    if (reproGuardFailKind !== null) {
+      var reproGuardNotes, reproGuardMessage;
+      if (reproGuardFailKind === "baseline-unavailable") {
+        log("Reproduce wrong-layer guard failed (baseline unavailable) — cannot attribute frames to this attempt on task " + taskId + " — marking failed for retry");
+        reproGuardNotes = "Reproduce wrong-layer guard baseline unavailable: task is classified layer: " + reproLayer + " and the before-snapshot of " + reproEvidenceDir + " failed, so frames cannot be attributed to this attempt (fail-closed — passing could route a wrong-layer verdict to Map). Phase failed for retry; the retry re-snapshots";
+        reproGuardMessage = "Reproduce wrong-layer guard baseline unavailable for a " + reproLayer + "-layer task — frames in " + reproEvidenceDir + " cannot be attributed to this attempt, phase failed, dispatcher will retry Reproduce";
+      } else {
+        log("Reproduce wrong-layer guard failed — see-act frames from THIS attempt on a " + reproLayer + "-layer task " + taskId + " (" + reproGuardDetail + ") — marking failed for retry");
+        reproGuardNotes = "Reproduce wrong-layer guard failed: task is classified layer: " + reproLayer + ", but the experiential see-act browser loop was invoked (frames attributable to this attempt in " + reproEvidenceDir + ": " + reproGuardDetail + "). Engine bugs reproduce with deterministic repo commands, docs bugs by reading the file — the browser loop is for artifact-layer bugs only. Phase failed for retry";
+        reproGuardMessage = "Reproduce wrong-layer guard failed — see-act loop invoked on a " + reproLayer + "-layer task (" + reproGuardDetail + " attributable to this attempt), phase failed, dispatcher will retry Reproduce";
+      }
+      await agent(
+        "Record wrong-layer driver invocation.\n" +
+        "Run in shell and return the stdout verbatim:\n" + crewCmd("record-phase", {
+          task_id: taskId,
+          session: { id: activeSessionId, task_id: taskId, identity: step.identity, step: step.name,
+            status: "failed", notes: reproGuardNotes },
+          event: { task_id: taskId, type: "failed",
+            message: reproGuardMessage }
+        }),
+        { key: "record-repro-layer-guard-fail-" + step.name, label: "Recording wrong-layer guard failure" }
+      );
+      if (reproGuardFailKind === "baseline-unavailable") {
+        return {
+          __hatchWorkflowControl: "blocked",
+          result: {
+            "blocked_reason": "Reproduce wrong-layer guard baseline unavailable — cannot attribute frames to this attempt; retrying",
+            message: reproGuardMessage,
+            task_id: taskId
+          }
+        };
+      }
+      return {
+        __hatchWorkflowControl: "blocked",
+        result: {
+          "blocked_reason": "Reproduce invoked the experiential browser loop on a " + reproLayer + "-layer task",
+          message: reproGuardMessage,
+          task_id: taskId
+        }
+      };
+    }
+    log("Reproduce wrong-layer guard passed: no see-act frames from this attempt on " + reproLayer + "-layer task " + taskId);
+  }
+
 
   // Worktree confinement (Build only): the declared worktree path must
   // match WORKTREE_HINT exactly. A builder that worked in any other
@@ -2570,16 +2783,24 @@ while (i < STEPS.length) {
   // Skip-aware (park 2026-09-11): when the deterministic publish script found
   // no merge lock held (empty-diff Integrate), it skips the publish path
   // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
-  // marker. Verification is then vacuous — nothing was shipped, and the
+  // marker. The preflight (bugfix 2026-09-17) emits
+  // PUBLISH_SKIPPED=no-npm-publish when npm publish is not configured on
+  // this machine (helper or credential absent) — also before any mutation.
+  // Verification is then vacuous — nothing was shipped, and the
   // registry must NOT have moved. The marker is script-emitted explicit state
   // (pasted verbatim per the Publish agent instructions), not agent prose; a
   // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
   var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
-    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+    var publishSkipMatch = /^PUBLISH_SKIPPED=(no-lock-held|no-npm-publish)$/m.exec(workerText || "");
+    if (publishSkipMatch) {
       npmPublishSkipped = true;
-      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      if (publishSkipMatch[1] === "no-npm-publish") {
+        log("Publish skipped for task " + taskId + " (no-npm-publish — npm publish not configured): publish verification vacuous, nothing was shipped");
+      } else {
+        log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      }
     }
     if (!npmPublishSkipped) {
     try {
@@ -2699,6 +2920,10 @@ while (i < STEPS.length) {
   // Capture Sage's experiential flag (machine-read marker line).
   if (step.name === "Triage" && passed) {
     isExperiential = extractExperiential(workerText);
+    // Capture Sage's bug-layer flag (machine-read marker line): drives the
+    // Reproduce strategy dispatch. Unknown (null) degrades to "artifact" at
+    // resolveLayer — never parks on a garbled line.
+    bugLayer = extractLayer(workerText);
   }
 
   // Capture the accepted Build report's machine-readable release decision.

package/workflows/chore.js

@@ -55,7 +55,10 @@ if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew ho
 const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
-const CREW_API = crewHome + "/current/lib/crew-api.js";
+const CREW_API_SRC = crewHome + "/current/lib/crew-api.js";
+// Pinned at pinLifecycle: after the pin, CREW_API points into RUN_LIB so a
+// mid-flight release swap cannot change the CLI under a running workflow.
+let CREW_API = CREW_API_SRC;
 // Build a shell command invoking the CLI. Args are JSON-encoded and
 // single-quote-wrapped for safe shell passing. The agent runs this and
 // returns the stdout verbatim (the CLI emits JSON on stdout).
@@ -132,9 +135,12 @@ const LIFECYCLE = RUN_LIB + "/worktree-lifecycle.sh";
 const MERGE_LOCK = RUN_LIB + "/merge-lock.sh";
 const PUBLISH_NPM_SRC = crewHome + "/lib/publish-npm.sh";
 const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
-// The four basenames the pin step must materialize — asserted mechanically
+const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
+const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
+const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
+// The five basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -280,7 +286,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the four pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -288,7 +294,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -579,7 +585,7 @@ function extractMarkerLines(workerText) {
   var markers = [];
   for (var i = 0; i < lines.length; i++) {
     var line = lines[i].trim();
-    if (/^(repo_diff:|release:|version_bump:|VERDICT:|TARGET_VERSION=|published:|experiential:|capture_targets:|worktree:)/i.test(line)) {
+    if (/^(repo_diff:|release:|version_bump:|VERDICT:|TARGET_VERSION=|published:|experiential:|layer:|capture_targets:|worktree:)/i.test(line)) {
       markers.push(line);
     }
   }
@@ -854,7 +860,7 @@ await telemetryStart("chore");
 // ── Pin lifecycle scripts ────────────────────────────────────────────
 // Copy lifecycle scripts into a per-task temp dir so this run is immune
 // to upgrades that land while it's in flight. Verified mechanically:
-// workflow code asserts the four basenames from the verbatim listing —
+// workflow code asserts the five basenames from the verbatim listing —
 // the agent cannot self-certify. Any miss parks the task before Triage.
 await telemetryEvent("pin_start");
 const initialPins = parsePinListing(await pinLifecycle("pin-lifecycle"));
@@ -864,6 +870,10 @@ if (missingInitialPins.length > 0) {
   return await parkTask("Lifecycle pin incomplete before Triage — missing " + missingInitialPins.join(", ") + " in " + RUN_LIB + ".");
 }
 log("Lifecycle scripts pinned to " + RUN_LIB);
+// From here on, every crew-api.js invocation uses the pinned copy: immune
+// to a release swap landing mid-flight.
+CREW_API = CREW_API_PINNED;
+log("Crew API pinned to " + CREW_API);
 
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
@@ -1170,7 +1180,9 @@ while (i < STEPS.length) {
   var mapBaselineRefs = "";
   var mapBaselineNone = false;
   if (step.name === "Map") {
-    if ((await resolveExperiential()) === "yes") {
+    // Must match Capture's run condition (experiential + artifact publish):
+    // when Capture skips, no baseline notes exist, so the gate must not apply.
+    if ((await resolveExperiential()) === "yes" && PUBLISH_TYPE === "artifact") {
       var gateStatus = await baselineStatus();
       if (!gateStatus.baseline_found) {
         log("Map gate: no baseline evidence for experiential task " + taskId + " — bouncing to Capture");
@@ -1328,6 +1340,10 @@ while (i < STEPS.length) {
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
         "VERDICT: PASS\n\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-npm-publish, the publish was skipped gracefully: npm publish is not configured on this machine (helper or credential absent) — the merge stands, the version was not cut, nothing was shipped. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-npm-publish (npm publish not configured — helper or credential missing; nothing versioned or published)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -1422,9 +1438,17 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
+        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
+        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
+        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
+        // to execute the conditional (clean-room 2026-09-16: the agent ran
+        // merge-base on the empty tree directly and parked).
+        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
+          ? "ANCESTOR=yes && "
+          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
         var diffResult = await agent(
           "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          "if [ \"$BASE\" = '" + EMPTY_TREE_SHA + "' ]; then ANCESTOR=yes; else git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no; fi && " +
+          ancestorShell + 
           "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
           "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
           "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
@@ -2426,16 +2450,24 @@ while (i < STEPS.length) {
   // Skip-aware (park 2026-09-11): when the deterministic publish script found
   // no merge lock held (empty-diff Integrate), it skips the publish path
   // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
-  // marker. Verification is then vacuous — nothing was shipped, and the
+  // marker. The preflight (bugfix 2026-09-17) emits
+  // PUBLISH_SKIPPED=no-npm-publish when npm publish is not configured on
+  // this machine (helper or credential absent) — also before any mutation.
+  // Verification is then vacuous — nothing was shipped, and the
   // registry must NOT have moved. The marker is script-emitted explicit state
   // (pasted verbatim per the Publish agent instructions), not agent prose; a
   // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
   var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
-    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+    var publishSkipMatch = /^PUBLISH_SKIPPED=(no-lock-held|no-npm-publish)$/m.exec(workerText || "");
+    if (publishSkipMatch) {
       npmPublishSkipped = true;
-      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      if (publishSkipMatch[1] === "no-npm-publish") {
+        log("Publish skipped for task " + taskId + " (no-npm-publish — npm publish not configured): publish verification vacuous, nothing was shipped");
+      } else {
+        log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      }
     }
     if (!npmPublishSkipped) {
     try {