muse-crew 0.7.20 → 0.8.0

package/workflows/crew-dispatch.js

@@ -53,13 +53,14 @@ var registryResult = inputs.registry;
 if (!registryResult) {
   log("WARNING: no registry in args — falling back to slow registry load");
   registryResult = await agent(
-    "Read the following 4 workflow files using the read tool and extract the `steps` array and `reworkTarget` string from each file's `export const meta` block at the top of the file.\n\n" +
+    "Read the following 5 workflow files using the read tool and extract the `steps` array and `reworkTarget` string from each file's `export const meta` block at the top of the file.\n\n" +
     "Files:\n" +
     "1. " + WORKFLOW_DIR + "/standard.js\n" +
     "2. " + WORKFLOW_DIR + "/bugfix.js\n" +
     "3. " + WORKFLOW_DIR + "/chore.js\n" +
-    "4. " + WORKFLOW_DIR + "/docs.js\n\n" +
-    "Return an object with keys: standard, bugfix, chore, docs. Each value has { steps: [{name, identity}], reworkTarget: string }.",
+    "4. " + WORKFLOW_DIR + "/docs.js\n" +
+    "5. " + WORKFLOW_DIR + "/upgrade.js\n\n" +
+    "Return an object with keys: standard, bugfix, chore, docs, upgrade. Each value has { steps: [{name, identity}], reworkTarget: string }.",
     {
       key: "load-registry",
       label: "Loading workflow step registry",
@@ -69,9 +70,10 @@ if (!registryResult) {
           standard: { type: "object" },
           bugfix: { type: "object" },
           chore: { type: "object" },
-          docs: { type: "object" }
+          docs: { type: "object" },
+          upgrade: { type: "object" }
         },
-        required: ["standard", "bugfix", "chore", "docs"]
+        required: ["standard", "bugfix", "chore", "docs", "upgrade"]
       }
     }
   );
@@ -80,7 +82,7 @@ if (!registryResult) {
 // Derive lookup tables from canonical definitions
 const WORKFLOWS = {};
 const BUILD_STEPS = {};
-var wfNames = ["standard", "bugfix", "chore", "docs"];
+var wfNames = ["standard", "bugfix", "chore", "docs", "upgrade"];
 for (var wi = 0; wi < wfNames.length; wi++) {
   var wfName = wfNames[wi];
   var wfData = registryResult[wfName];
@@ -927,6 +929,41 @@ await agent(
   { key: "ack", label: "Acknowledging poll" }
 );
 
+// ── 4b. Tick release-identity log ──────────────────────────────────
+// Observable proof of which release each scheduler tick ran on, for the
+// self-upgrade proof: one append-only line per dispatcher run in
+// $CREW_HOME/.tick-releases.jsonl: {"seq": <n>, "release": "<active release id>"}.
+// seq is the non-empty line count + 1. The file's ordering is the proof,
+// not timestamps — no wall-clock calls (see tests/determinism.test.js).
+// Fire-and-forget: the script swallows its own errors and exits 0, the
+// agent call carries no schema, and the whole call is wrapped in
+// try/catch — a failed write can never fail the tick. Placement: every run
+// that completes the poll (dispatching, NO_DISPATCH, partial-cap) reaches
+// this point. Concurrency edge: overlapping ticks could duplicate seq
+// (count+append is not atomic) but appends are atomic, so lines never
+// interleave — seq is advisory, file order is the proof.
+var tickReleaseScript = [
+  "var crewHome=process.argv[1];",
+  "try{",
+  "var fs=require(\"fs\"),path=require(\"path\");",
+  "var release=path.basename(path.resolve(crewHome,fs.readlinkSync(path.join(crewHome,\"current\"))));",
+  "var file=path.join(crewHome,\".tick-releases.jsonl\");",
+  "var count=0;",
+  "try{var lines=fs.readFileSync(file,\"utf8\").split(\"\\n\");for(var i=0;i<lines.length;i++){if(lines[i].trim()!==\"\"){count++;}}}catch(e){}",
+  "fs.appendFileSync(file,JSON.stringify({seq:count+1,release:release})+\"\\n\");",
+  "}catch(e){}",
+  "process.exit(0);"
+].join("");
+var tickReleaseCmd = "node -e '" + tickReleaseScript + "' '" + crewHome.replace(/'/g, "'\\''") + "'";
+try {
+  await agent(
+    "Record this tick's release identity.\nRun in shell and return the stdout verbatim:\n" + tickReleaseCmd,
+    { key: "tick-release", label: "Recording tick release identity" }
+  );
+} catch (e) {
+  log("WARNING: tick release-identity log write failed (tick continues): " + e.message);
+}
+
 var recommended = [];
 var seenClaims = {};
 results.forEach(function(r) {

package/workflows/crew-init.js

@@ -1,11 +1,12 @@
 export const meta = {
   name: "crew-init",
-  description: "Initialize Muse Crew: bootstrap release, scaffold orchestration, register the first project, set up cron jobs. Idempotent — safe to re-run. The dashboard is optional: omit dashboardSlug/dashboardRepoPath for a CLI-only install. Takes an optional crewName (the human's chosen name for the crew), stored at $CREW_HOME/crew-name.",
+  description: "Initialize Muse Crew: bootstrap release, scaffold orchestration, register the first project, set up cron jobs, and persist the automatic-update policy. Idempotent — safe to re-run. The dashboard is optional: omit dashboardSlug/dashboardRepoPath for a CLI-only install. Takes an optional crewName (the human's chosen name for the crew), stored at $CREW_HOME/crew-name. Takes optional autoUpdateCrew/autoUpdateDashboard/updateChannel (defaults true/true/latest) for the automatic update watcher policy.",
   phases: [
     { name: "release", title: "Bootstrap release system" },
     { name: "scaffold", title: "Scaffold orchestration directory" },
     { name: "project", title: "Register first project" },
-    { name: "crons", title: "Create and converge cron jobs" }
+    { name: "crons", title: "Create and converge cron jobs" },
+    { name: "policy", title: "Persist update policy" }
   ]
 };
 
@@ -19,6 +20,28 @@ const dashboardName = inputs.dashboardName || "Muse Crew";
 const crewName = inputs.crewName || null;
 const cronIds = inputs.cronIds || {};
 
+// ── Automatic-update policy inputs ──────────────────────────────────
+// All optional. autoUpdateCrew/autoUpdateDashboard default to true (the
+// update watcher files upgrade tasks through the loop); updateChannel
+// defaults to "latest" ("patch" narrows crew upgrades to patch releases).
+// Explicit inputs win on every run; existing config values survive a
+// re-init that passes no inputs; defaults apply only on first init —
+// never silently resurrect a human's deliberate opt-out.
+const autoUpdateCrew = inputs.autoUpdateCrew !== undefined ? !!inputs.autoUpdateCrew : true;
+const autoUpdateDashboard = inputs.autoUpdateDashboard !== undefined ? !!inputs.autoUpdateDashboard : true;
+const updateChannel = inputs.updateChannel || "latest";
+
+// Validation in workflow code, before any agent call — fail closed.
+if (updateChannel !== "latest" && updateChannel !== "patch") {
+  return {
+    __hatchWorkflowControl: "blocked",
+    result: {
+      blocked_reason: "Invalid updateChannel",
+      message: "updateChannel must be \"latest\" or \"patch\" — got " + JSON.stringify(updateChannel) + ". Re-run init with a valid channel."
+    }
+  };
+}
+
 if (!crewRepoPath) throw new Error("crewRepoPath is required — path to muse-crew (git checkout or npm install)");
 if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew (must be inside the workspace)");
 // The dashboard is optional. Provide both dashboardSlug and dashboardRepoPath
@@ -367,19 +390,76 @@ try {
 log("Project: " + dashboardSlug + " " + projectResult.action + " (repo_path=" + gateFacts.dashboardRepoExpanded + ")");
 } // end dashboard-mode project registration
 
+// ── Scheduler identity (2026-09-16) ──────────────────────────────────
+// The crew's scheduler identity is dashboard-independent and chosen once.
+// First init uses the crew-home basename; a re-run keeps the instanceId
+// recorded in .cron-registry.json. A registry that exists but is corrupt,
+// or parses but carries no usable instanceId, fails closed — init will not
+// guess the previous identity, because a wrong guess would orphan the old
+// cron jobs and create duplicates. Attaching or removing a dashboard
+// is a project registration, never an identity change, so it can neither
+// orphan nor duplicate the polling loop. The loop is cli-owned: deleting a
+// dashboard artifact must not stop the crew (the crew never requires a
+// dashboard); crew removal is crew-uninstall's job (registry + discovery).
+// The sensor reports raw; the decision below is pure JS.
+function priorInstanceId(cronRegistryJson, registryPath) {
+  if (cronRegistryJson == null) return null;
+  var reg;
+  try {
+    reg = JSON.parse(cronRegistryJson);
+  } catch (e) {
+    throw new Error("existing " + registryPath + " is not valid JSON (" + String(e.message || e) + "). Inspect or remove it, then re-run init — init will not guess the previous scheduler identity.");
+  }
+  var id = reg && reg.instanceId;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error("existing " + registryPath + " has no usable instanceId. Repair the registry or remove it, then re-run init — init will not guess the previous scheduler identity.");
+  }
+  return id;
+}
+
 // ── Phase 4: Cron jobs (declarative manifest) ──────────────────────────
 // The manifest lives in the repo at seed/crons.json. Body templates live
 // in seed/ with {crewHome} placeholders. Missing jobs are
 // created from the manifest; existing jobs converge to it — except `enabled`,
 // which is a creation-time default only and is never touched on update.
-// Instance identity: in dashboard mode the dashboard slug scopes cron ids
-// and ownership (space:<slug>); in CLI-only mode the crew-home basename
-// scopes them instead, so two crew instances never share a cron id and no
-// dashboard is required.
+// Live ids are entry.id + '-' + instanceId (instance-safe by construction —
+// two crew instances never share a cron id) unless overridden via cronIds.
 phase("crons");
-var crewHomeBase = gateFacts.crewHomeExpanded.split("/").pop().replace(/^\./, "") || "crew";
-var instanceId = dashboardSlug || crewHomeBase;
-var cronOwner = inputs.cronOwner || (dashboardSlug ? "space:" + dashboardSlug : "cli:" + instanceId);
+var registryPath = gateFacts.crewHomeExpanded + "/.cron-registry.json";
+var identityFacts;
+try {
+  identityFacts = await agent(
+    "Read this crew's existing scheduler identity, if any. Report raw facts.\\n\\n" +
+    "Crew home: " + gateFacts.crewHomeExpanded + "\\n\\n" +
+    "Steps (run in shell):\\n" +
+    "1. If " + registryPath + " exists, print its exact bytes with cat.\\n" +
+    "2. If it does not exist, print nothing.\\n" +
+    "3. Return JSON { registryJson }: registryJson is the file's exact text, or null when the file does not exist. Do not judge, summarize, or repair — report raw.",
+    {
+      key: "crons-identity-1",
+      label: "Read existing scheduler identity",
+      schema: {
+        type: "object",
+        properties: {
+          registryJson: { type: ["string", "null"] }
+        },
+        required: ["registryJson"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Scheduler identity read failed", message: String(e.message || e) } };
+}
+var instanceId;
+try {
+  instanceId = priorInstanceId(identityFacts.registryJson, registryPath) ||
+    gateFacts.crewHomeExpanded.split("/").pop().replace(/^\./, "") || "crew";
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Scheduler identity unreadable", message: String(e.message || e) } };
+}
+var cronOwner = inputs.cronOwner || ("cli:" + instanceId);
+log("Scheduler identity: instanceId=" + instanceId + " owner=" + cronOwner +
+  (identityFacts.registryJson ? " (kept from existing registry)" : " (first init; crew-home basename)"));
 var cronsResult;
 try {
   cronsResult = await agent(
@@ -480,6 +560,83 @@ log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" +
     "; registry: " + cronsResult.summary.registry.path + " (" + cronsResult.summary.registry.ids.join(", ") + ")");
 
 
+// ── Phase 5: Update policy ────────────────────────────────────────────
+// Persists the automatic-update policy (auto_update_crew,
+// auto_update_dashboard, update_channel) via the Crew API's update-config,
+// and seeds $CREW_HOME/.update-watch.json as {} only when it does not
+// exist. Re-init semantics mirror the crons manifest rule: explicit inputs
+// win; existing config values are kept; defaults apply only on first init —
+// a re-init with no inputs never silently resurrects a human's opt-out.
+// No wall-clock reads anywhere in this phase or its prompt.
+phase("policy");
+var policyInputCrew = inputs.autoUpdateCrew !== undefined ? (!!inputs.autoUpdateCrew ? "true" : "false") : null;
+var policyInputDashboard = inputs.autoUpdateDashboard !== undefined ? (!!inputs.autoUpdateDashboard ? "true" : "false") : null;
+var policyInputChannel = inputs.updateChannel !== undefined ? updateChannel : null;
+var safeExpandedHome = gateFacts.crewHomeExpanded.split('"').join('\\"');
+var policyResult;
+try {
+  policyResult = await agent(
+    "Persist the automatic-update policy for the crew's update watcher.\n\n" +
+    "Crew home (expanded): " + gateFacts.crewHomeExpanded + "\n" +
+    "Crew API: " + gateFacts.crewHomeExpanded + "/current/lib/crew-api.js\n\n" +
+    "Explicit inputs for this run (null means the human gave no input):\n" +
+    "- auto_update_crew: " + policyInputCrew + " (default true)\n" +
+    "- auto_update_dashboard: " + policyInputDashboard + " (default true)\n" +
+    "- update_channel: " + policyInputChannel + " (default latest)\n\n" +
+    "Steps:\n" +
+    "1. Read the current config:\n" +
+    "   node " + gateFacts.crewHomeExpanded + "/current/lib/crew-api.js --crew-home " + gateFacts.crewHomeExpanded + " get-config\n" +
+    "   The response carries { config: { key: value, ... } }.\n" +
+    "2. For each key in (auto_update_crew, auto_update_dashboard, update_channel):\n" +
+    "   - When an explicit input is present for the key, write the input value.\n" +
+    "   - Otherwise, when the config already holds a value for the key, keep it —\n" +
+    "     do NOT overwrite it with the default. A human's deliberate opt-out\n" +
+    "     (e.g. auto_update_crew=false) must survive a re-init that passes no inputs.\n" +
+    "   - Otherwise write the default (true / true / latest).\n" +
+    "   Write via:\n" +
+    "   node " + gateFacts.crewHomeExpanded + "/current/lib/crew-api.js --crew-home " + gateFacts.crewHomeExpanded + " update-config --json '{\"key\": \"<key>\", \"value\": \"<value>\"}'\n" +
+    "   Values are the strings \"true\"/\"false\" for the booleans and \"latest\"/\"patch\"\n" +
+    "   for the channel. Only issue update-config for a key whose final value\n" +
+    "   differs from the current config value.\n" +
+    "3. Seed the watcher state file only when absent — never overwrite it,\n" +
+    "   it is the idempotency record for filed upgrade tasks:\n" +
+    "   test -f \"" + safeExpandedHome + "/.update-watch.json\" && echo STATE_EXISTS || (printf '%s' '{}' > \"" + safeExpandedHome + "/.update-watch.json\" && echo STATE_SEEDED)\n" +
+    "4. Return JSON { persisted: { auto_update_crew: \"<value>\", auto_update_dashboard: \"<value>\", update_channel: \"<value>\" }, state_file: \"seeded\" | \"exists\" }\n" +
+    "   with the values that are in effect after this run (explicit input,\n" +
+    "   kept config value, or default — whichever applied).",
+    {
+      key: "policy-1",
+      label: "Persist update policy",
+      schema: {
+        type: "object",
+        properties: {
+          persisted: {
+            type: "object",
+            properties: {
+              auto_update_crew: { type: "string" },
+              auto_update_dashboard: { type: "string" },
+              update_channel: { type: "string" }
+            },
+            required: ["auto_update_crew", "auto_update_dashboard", "update_channel"]
+          },
+          state_file: { type: "string", enum: ["seeded", "exists"] }
+        },
+        required: ["persisted", "state_file"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Update policy persist failed", message: String(e.message || e) } };
+}
+var persistedPolicy = policyResult.persisted || {};
+if (!persistedPolicy.auto_update_crew || !persistedPolicy.auto_update_dashboard || !persistedPolicy.update_channel) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Update policy incomplete", message: "policy phase returned no persisted policy values" } };
+}
+log("Update policy: auto_update_crew=" + persistedPolicy.auto_update_crew +
+  " auto_update_dashboard=" + persistedPolicy.auto_update_dashboard +
+  " update_channel=" + persistedPolicy.update_channel +
+  " state_file=" + policyResult.state_file);
+
 // ── Summary ───────────────────────────────────────────────────────────
 return {
   message: "Muse Crew initialized.",
@@ -492,5 +649,11 @@ return {
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
   crons: cronsResult.summary.crons,
-  registry: cronsResult.summary.registry
+  registry: cronsResult.summary.registry,
+  autoUpdate: {
+    crew: persistedPolicy.auto_update_crew === "true",
+    dashboard: persistedPolicy.auto_update_dashboard === "true",
+    channel: persistedPolicy.update_channel
+  },
+  announcement: "Your crew and dashboard will update themselves automatically; say the word if you'd rather approve each one."
 };

package/workflows/standard.js

@@ -57,7 +57,10 @@ if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew ho
 const crewHome = inputs.crewHome;
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
-const CREW_API = crewHome + "/current/lib/crew-api.js";
+const CREW_API_SRC = crewHome + "/current/lib/crew-api.js";
+// Pinned at pinLifecycle: after the pin, CREW_API points into RUN_LIB so a
+// mid-flight release swap cannot change the CLI under a running workflow.
+let CREW_API = CREW_API_SRC;
 // Build a shell command invoking the CLI. Args are JSON-encoded and
 // single-quote-wrapped for safe shell passing. The agent runs this and
 // returns the stdout verbatim (the CLI emits JSON on stdout).
@@ -83,9 +86,12 @@ const LIFECYCLE = RUN_LIB + "/worktree-lifecycle.sh";
 const MERGE_LOCK = RUN_LIB + "/merge-lock.sh";
 const PUBLISH_NPM_SRC = crewHome + "/lib/publish-npm.sh";
 const PUBLISH_NPM = RUN_LIB + "/publish-npm.sh";
-// The three basenames the pin step must materialize — asserted mechanically
+const CREW_API_PINNED = RUN_LIB + "/crew-api.js";
+const SCHEMA_SQL_SRC = crewHome + "/lib/schema.sql";
+const SCHEMA_SQL_PINNED = RUN_LIB + "/schema.sql";
+// The five basenames the pin step must materialize — asserted mechanically
 // by workflow code from the verbatim listing, never from agent prose.
-const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM].map(function (p) { return p.split("/").pop(); });
+const PIN_BASENAMES = [LIFECYCLE, MERGE_LOCK, PUBLISH_NPM, CREW_API_PINNED, SCHEMA_SQL_PINNED].map(function (p) { return p.split("/").pop(); });
 
 // Project config — passed by dispatcher, falls back to dashboard defaults
 const projectConfig = inputs.project_config || {};
@@ -231,7 +237,7 @@ function attemptKey(base, reworkCount) {
   return base + (reworkCount > 0 ? "-r" + reworkCount : "");
 }
 // pinLifecycle(key) — snapshot the lifecycle scripts into RUN_LIB and return
-// the verbatim `ls -1` listing so WORKFLOW CODE asserts the four pinned
+// the verbatim `ls -1` listing so WORKFLOW CODE asserts the five pinned
 // basenames; the agent cannot self-certify. (The pin step was the one place
 // the workflows trusted agent prose: task 24be1cd6 walked to Publish on an
 // empty pin dir.) Byte-identical across standard/bugfix/chore — pinned by
@@ -239,7 +245,7 @@ function attemptKey(base, reworkCount) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -534,7 +540,7 @@ function extractMarkerLines(workerText) {
   var markers = [];
   for (var i = 0; i < lines.length; i++) {
     var line = lines[i].trim();
-    if (/^(repo_diff:|release:|version_bump:|VERDICT:|TARGET_VERSION=|published:|experiential:|capture_targets:|worktree:)/i.test(line)) {
+    if (/^(repo_diff:|release:|version_bump:|VERDICT:|TARGET_VERSION=|published:|experiential:|layer:|capture_targets:|worktree:)/i.test(line)) {
       markers.push(line);
     }
   }
@@ -805,7 +811,7 @@ let i = startStepIndex;
 // ── Pin lifecycle scripts ────────────────────────────────────────────
 // Copy lifecycle scripts into a per-task temp dir so this run is immune
 // to upgrades that land while it's in flight. Verified mechanically:
-// workflow code asserts the four basenames from the verbatim listing —
+// workflow code asserts the five basenames from the verbatim listing —
 // the agent cannot self-certify. Any miss parks the task before Triage.
 const initialPins = parsePinListing(await pinLifecycle("pin-lifecycle"));
 const missingInitialPins = PIN_BASENAMES.filter(function (b) { return initialPins.indexOf(b) === -1; });
@@ -813,6 +819,10 @@ if (missingInitialPins.length > 0) {
   return await parkTask("Lifecycle pin incomplete before Triage — missing " + missingInitialPins.join(", ") + " in " + RUN_LIB + ".");
 }
 log("Lifecycle scripts pinned to " + RUN_LIB);
+// From here on, every crew-api.js invocation uses the pinned copy: immune
+// to a release swap landing mid-flight.
+CREW_API = CREW_API_PINNED;
+log("Crew API pinned to " + CREW_API);
 
 // Merge-lock holder identity (bug 2fc8f52f): the opaque task+run identity
 // minted at this run's first claim (never a PID — short-lived agent PIDs
@@ -1115,7 +1125,9 @@ while (i < STEPS.length) {
   var mapBaselineRefs = "";
   var mapBaselineNone = false;
   if (step.name === "Map") {
-    if ((await resolveExperiential()) === "yes") {
+    // Must match Capture's run condition (experiential + artifact publish):
+    // when Capture skips, no baseline notes exist, so the gate must not apply.
+    if ((await resolveExperiential()) === "yes" && PUBLISH_TYPE === "artifact") {
       var gateStatus = await baselineStatus();
       if (!gateStatus.baseline_found) {
         log("Map gate: no baseline evidence for experiential task " + taskId + " — bouncing to Capture");
@@ -1283,6 +1295,10 @@ while (i < STEPS.length) {
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "skipped: no-lock-held (empty-diff Integrate — nothing merged, nothing to ship)\n" +
         "VERDICT: PASS\n\n" +
+        "If the script's output contains PUBLISH_SKIPPED=no-npm-publish, the publish was skipped gracefully: npm publish is not configured on this machine (helper or credential absent) — the merge stands, the version was not cut, nothing was shipped. Paste the marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
+        "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
+        "skipped: no-npm-publish (npm publish not configured — helper or credential missing; nothing versioned or published)\n" +
+        "VERDICT: PASS\n\n" +
         "If it exits zero, paste the script's COMPLETE marker block verbatim into your report, then end your report with exactly these three lines, in this order — lowercase, no trailing period, do not rephrase:\n" +
         "TARGET_VERSION=" + publishTarget.target + " computed as " + publishTarget.base + " + " + publishTarget.scope + " → " + publishTarget.target + "\n" +
         "published: muse-crew@" + publishTarget.target + "\n" +
@@ -1377,9 +1393,17 @@ while (i < STEPS.length) {
         } else if (!/^[0-9a-f]{40}$/.test(publishBase)) {
           return await parkTask("Publish base '" + publishBase + "' is not a valid commit SHA — cannot compute the publish diff. Human attention needed.");
         }
+        // The empty tree is not a commit: git merge-base --is-ancestor fails on it.
+        // The workflow knows publishBase == EMPTY_TREE_SHA (set above), so it
+        // hardcodes ANCESTOR=yes for a first publish instead of asking the agent
+        // to execute the conditional (clean-room 2026-09-16: the agent ran
+        // merge-base on the empty tree directly and parked).
+        var ancestorShell = (publishBase === EMPTY_TREE_SHA)
+          ? "ANCESTOR=yes && "
+          : "git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no && ";
         var diffResult = await agent(
           "Run: cd " + REPO_PATH + " && BASE='" + publishBase + "' && HEAD=$(git rev-parse HEAD) && " +
-          "if [ \"$BASE\" = '" + EMPTY_TREE_SHA + "' ]; then ANCESTOR=yes; else git merge-base --is-ancestor \"$BASE\" \"$HEAD\" && ANCESTOR=yes || ANCESTOR=no; fi && " +
+          ancestorShell + 
           "echo '---COMMIT---' && echo \"$HEAD\" && echo '---BASE---' && echo \"$BASE\" && echo '---ANCESTOR---' && echo \"$ANCESTOR\" && " +
           "if [ \"$ANCESTOR\" = yes ]; then echo '---DIFF---' && git diff \"$BASE\" \"$HEAD\" && echo '---NAMES---' && git diff-tree --no-commit-id --name-only -r \"$BASE\" \"$HEAD\"; fi\n" +
           "Return JSON { \"commit\": \"<HEAD trimmed>\", \"base\": \"<BASE trimmed>\", \"ancestor\": \"<yes|no>\", \"diff\": \"<raw unified diff, may be multi-line>\", \"files\": \"<newline-separated paths>\" } and nothing else.",
@@ -2526,16 +2550,24 @@ while (i < STEPS.length) {
   // Skip-aware (park 2026-09-11): when the deterministic publish script found
   // no merge lock held (empty-diff Integrate), it skips the publish path
   // gracefully and emits the machine-readable PUBLISH_SKIPPED=no-lock-held
-  // marker. Verification is then vacuous — nothing was shipped, and the
+  // marker. The preflight (bugfix 2026-09-17) emits
+  // PUBLISH_SKIPPED=no-npm-publish when npm publish is not configured on
+  // this machine (helper or credential absent) — also before any mutation.
+  // Verification is then vacuous — nothing was shipped, and the
   // registry must NOT have moved. The marker is script-emitted explicit state
   // (pasted verbatim per the Publish agent instructions), not agent prose; a
   // report without the marker still runs the full verification fail-closed.
   var publishVerified = false;
   var npmPublishSkipped = false;
   if (step.name === "Publish" && PUBLISH_TYPE === "npm" && publishTarget) {
-    if (/^PUBLISH_SKIPPED=no-lock-held$/m.test(workerText || "")) {
+    var publishSkipMatch = /^PUBLISH_SKIPPED=(no-lock-held|no-npm-publish)$/m.exec(workerText || "");
+    if (publishSkipMatch) {
       npmPublishSkipped = true;
-      log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      if (publishSkipMatch[1] === "no-npm-publish") {
+        log("Publish skipped for task " + taskId + " (no-npm-publish — npm publish not configured): publish verification vacuous, nothing was shipped");
+      } else {
+        log("Publish skipped for task " + taskId + " (no merge lock held — empty-diff Integrate): publish verification vacuous, nothing was shipped");
+      }
     }
     if (!npmPublishSkipped) {
     try {