muse-crew 0.7.8 → 0.7.9

package/docs/publish-verification.md

@@ -72,7 +72,7 @@ The parked message is stored as `Parked: publish: verification-requested
 `publish: verification-requested`. The `<commit>` is the merged commit whose
 content must be verified. The `(build …)` suffix carries the
 `build.agent_id` the workflow observed for this publish attempt (the
-artifact system's durable build identifier — the parent uses it for the
+artifact system's in-flight build correlation ID — the parent uses it for the
 build-ID correlation in step 4b); `agent_id unobserved` means the edit was
 accepted but the workflow never correlated it to a builder run. The merge
 lock is already released (post-deploy ran before the park), so the parked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/seed/cron-body-template.md

@@ -21,7 +21,7 @@ You are the dispatch trigger for Muse Crew. Run the authoritative dispatcher wor
 
 1. **Load tools:** Call tool_search_load_tool_namespace with paths ["workflow_launch"].
 
-2. **Load the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and parse it as JSON. If the file does not exist (the live release predates the registry), proceed without it — omit the `registry` arg and the dispatcher will load the registry the slow way and log a warning.
+2. **Load the workflow registry:** Read the file "{crewHome}/workflows/registry.json" with the read tool and parse it as JSON. If the file does not exist (the live release predates the registry), proceed without it — omit the `registry` arg and the dispatcher will load the registry the slow way and log a warning. If the read FAILS on a file that exists (transient read error — observed 2026-09-13; the file itself was healthy and later ticks read it fine), retry the read once; if it still fails, write the error text into your run summary (observability — never silently swallow a failed read) and proceed without the registry the same way.
 
 3. **Run the dispatcher:** Call workflow_launch with scriptPath "{crewHome}/workflows/crew-dispatch.js" and args {"crewHome": "{crewHome}", "registry": <parsed registry JSON, or omit the key when the file was missing>}.
 

package/workflows/bugfix.js

@@ -486,8 +486,8 @@ function verifyAppliedChanges(expected, applied) {
 // it must match the artifact's real content.
 function buildPublishReadbackRequest(taskId, commit, diff, buildAgentId) {
   // Build-ID correlation (2026-09-12): buildAgentId is the build.agent_id the
-  // workflow observed for the publish attempt (the artifact system's durable
-  // build identifier). The read-back request carries it so the parent can
+  // workflow observed for the publish attempt (the artifact system's in-flight
+  // build correlation ID — not a durable post-completion identifier). The read-back request carries it so the parent can
   // prove the read-back inspected the live build of THIS attempt — not a
   // different build's output. Null/empty means the edit was accepted but
   // never correlated to a builder run. Pure function of inputs — no I/O,
@@ -1521,12 +1521,22 @@ while (i < STEPS.length) {
           "- Report, for each file you changed: its path, the exact lines you added, and the exact lines you removed.\n" +
           buildPreHashInstruction(expectedChanges) + "'\n" +
           ARTIFACT_LOAD_PREAMBLE +
-          "If artifact_edit is still not available after the load, do NOT improvise — return { \"edit_started\": false, \"error\": \"artifact_tools missing after load\", \"applied\": [] }.\n" +
-          "Make no other calls. Return JSON { \"edit_started\": <true if the edit was accepted, false otherwise>, \"error\": \"<details or empty string>\", \"applied\": [{\"path\": \"<file path>\", \"added\": [\"<added lines>\"], \"removed\": [\"<removed lines>\"]}], \"pre_hashes\": {\"<file path>\": \"<sha256 of that file's content BEFORE you applied the diff, or \"MISSING\">\"} } and nothing else.";
+          "If artifact_edit is still not available after the load, do NOT improvise — return { \"edit_started\": false, \"build_agent_id\": null, \"error\": \"artifact_tools missing after load\", \"applied\": [] }.\n" +
+          "RECEIPT CAPTURE (receipt-chained publish, 2026-09-13): the edit is only half the contract — you must also capture the platform build's receipt, the in-flight correlation ID the follow-up poll chains to.\n" +
+          "- The artifact namespace is already loaded (see below). BEFORE calling artifact_edit, call artifact_status with slug \"" + PUBLISH_SLUG + "\" and note the running build's agent_id (or null when no build is running). This is the pre-edit baseline.\n" +
+          "- Call artifact_edit as instructed above.\n" +
+          "- IMMEDIATELY after artifact_edit returns, call artifact_status again. If a build is running whose agent_id DIFFERS from the pre-edit baseline (or the baseline was null), that build is this edit's — its agent_id is the receipt.\n" +
+          "- If the post-edit status shows the SAME agent_id as the baseline, or no build at all, wait about 15 seconds and check artifact_status again, up to 4 more times. If a build with a NEW agent_id appears, that is the receipt.\n" +
+          "- If no new build appears, the receipt is null: the build may be pending_init-invisible, may have finished before the capture, or may be queued behind the earlier build. Return null — do NOT guess, and do NOT substitute the baseline build's agent_id.\n" +
+          "Make no other calls. Return JSON { \"edit_started\": <true if the edit was accepted, false otherwise>, \"build_agent_id\": <the receipt agent_id string, or null when no build could be attributed to this edit>, \"error\": \"<details or empty string>\", \"applied\": [{\"path\": \"<file path>\", \"added\": [\"<added lines>\"], \"removed\": [\"<removed lines>\"]}], \"pre_hashes\": {\"<file path>\": \"<sha256 of that file's content BEFORE you applied the diff, or \"MISSING\">\"} } and nothing else.";
         var rebuildSchema =
           { type: "object",
             properties: {
               edit_started: { type: "boolean" },
+              build_agent_id: {
+                type: ["string", "null"],
+                description: "Receipt-chained publish (2026-09-13): the platform build's in-flight correlation ID (build.agent_id from artifact_status) captured immediately after the edit was accepted — the receipt the follow-up poll chains to. Null when no build could be attributed to this edit. Required: an accepted edit with a null receipt parks fail-closed as unknown."
+              },
               error: { type: "string" },
               applied: {
                 type: "array",
@@ -1545,7 +1555,7 @@ while (i < STEPS.length) {
                 description: "Diagnostic (2026-09-12): sha256 of each touched file's content BEFORE the builder applied the diff, as reported by the builder. Compared against the workflow-computed expected base hashes (merge parent) — observation only, never gating."
               }
             },
-            required: ["edit_started", "applied"] };
+            required: ["edit_started", "build_agent_id", "applied"] };
         var rebuildTrigger = null;
         var rebuildReportMissing = false; // true if the edit went through but the agent returned no applied report (structured-output failure) — the smoke-check is skipped; the parent's independent read-back is the verification
         // The trigger key of the attempt that last ran, for the publish ledger.
@@ -1579,8 +1589,9 @@ while (i < STEPS.length) {
           //
           // Build-ID research (2026-09-12) corrected the model: artifact.edit
           // returns pending_init with NO agent_id, but artifact_status exposes
-          // the build's agent_id (the artifact system's durable build
-          // identifier, stable across polls) immediately after acceptance.
+          // the build's agent_id (the artifact system's in-flight build
+          // correlation ID, stable across polls while the build runs)
+          // immediately after acceptance.
           // So the recovery no longer asks the child to derive booleans —
           // the layer where the 2026-09-12 signal was lost. It reads the RAW
           // build object and extracts build.agent_id mechanically in the
@@ -1647,6 +1658,42 @@ while (i < STEPS.length) {
             { key: attemptKey("publish-artifact-rebuild-" + taskId + "-retry2", totalReworkCount), label: "Triggering artifact rebuild (retry)", schema: rebuildSchema });
           rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId + "-retry2", totalReworkCount);
         }
+        // Receipt chaining (2026-09-13): adopt the trigger's build receipt,
+        // or park on an uncorrelated acceptance. The trigger's closeout schema
+        // requires build_agent_id — the platform build's in-flight correlation
+        // ID captured immediately after the edit was accepted.
+        // An accepted edit (edit_started=true) with a null receipt is UNKNOWN,
+        // not "did not go through": the build may be pending_init-invisible,
+        // may have finished before the capture window, or may be queued behind
+        // a still-running earlier build. No re-trigger is issued on unknown —
+        // a blind re-trigger duplicated the edit on 2026-09-12, and the platform
+        // offers no idempotency proof that would make re-issue safe.
+        // (Retry-semantics reconciliation, 2026-09-13: the "no receipt → safe
+        // re-trigger" sketch assumed the edit command idempotently publishes
+        // what's on git; the duplicate-edit incident disproves the assumption,
+        // and the standing rule retries only on explicit negative evidence.
+        // Re-trigger stays exactly where it was: the edit_started=false
+        // explicit-rejection path above.) Record the attempt and park
+        // fail-closed; correlate via the ledger and the parent's content
+        // read-back before re-driving Publish.
+        if (rebuildTrigger && rebuildTrigger.edit_started && !rebuildReportMissing) {
+          var triggerAgentId = (typeof rebuildTrigger.build_agent_id === "string" && rebuildTrigger.build_agent_id.length > 0) ? rebuildTrigger.build_agent_id : null;
+          if (!triggerAgentId) {
+            var uncorrelatedObservation = (function () { var c = verifyAppliedChanges(expectedChanges, rebuildTrigger.applied); return c.ok ? "match" : "mismatch: " + c.reason; })();
+            log("Publish receipt missing for task " + taskId + ": the trigger reported edit_started=true but captured no build receipt (build_agent_id null) — no build attributable to this edit. Parking fail-closed without re-triggering.");
+            await recordPublishLedger({
+              commit: mergeCommitForPublish,
+              attempt: rebuildAttemptKey,
+              agent_id: null,
+              applied_report: uncorrelatedObservation,
+              outcome: "unknown",
+              detail: "edit accepted (edit_started=true) but the trigger captured no build receipt in its capture window: no build attributable to this edit (pending_init-invisible, finished before capture, or queued behind an earlier build). No re-trigger issued — a blind re-trigger on an unknown outcome duplicated the edit on 2026-09-12 and the platform offers no idempotency proof."
+            }, totalReworkCount);
+            return await parkTask("Publish outcome unknown: the rebuild trigger reported the edit was accepted but captured no build receipt (build_agent_id null) — no build could be attributed to this edit in the capture window. The edit may be pending_init-invisible, already finished, or queued behind an earlier build, so no re-trigger was issued: a blind retry duplicated the edit on 2026-09-12. The attempt is recorded in the publish ledger at " + crewHome + "/.publish-ledger/" + PUBLISH_SLUG + ".jsonl (commit " + String(mergeCommitForPublish || "unknown").slice(0, 12) + "). Correlate via the ledger and re-drive Publish only after the parent's content read-back resolves what actually landed. Fail-closed.");
+          }
+          rebuildAgentId = triggerAgentId;
+          log("Publish receipt chained for task " + taskId + ": build " + triggerAgentId + " — the follow-up poll waits on this build only.");
+        }
         // Durable publish-attempt ledger: record the trigger outcome while the
         // attempt key and commit are in scope. Every attempt lands here with
         // its outcome — submitted, rejected, or unknown (unknown is recorded
@@ -1750,10 +1797,13 @@ while (i < STEPS.length) {
               ? attemptKey("publish-artifact-poll-" + taskId, totalReworkCount)
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, totalReworkCount);
             buildPoll = await agent(
-              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 7 checks (3.5 minutes max).\n" +
-              "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
+              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+              "- If no build is running (build is null): OUR build finished. Stop and report done.\n" +
+              "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
+              "- If the running build's agent_id is present but DIFFERENT: our build is gone (it finished before this one started). Do NOT wait on the stranger's build and do NOT attribute its completion to our attempt \u2014 stop and report done.\n" +
+              "Return JSON { \"build_done\": <true if our build is no longer running within budget, false on timeout>, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
               { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
                 timeoutMs: 270000 }
             );
             if (buildPoll && buildPoll.build_done) { break; }

package/workflows/chore.js

@@ -543,8 +543,8 @@ function verifyAppliedChanges(expected, applied) {
 // it must match the artifact's real content.
 function buildPublishReadbackRequest(taskId, commit, diff, buildAgentId) {
   // Build-ID correlation (2026-09-12): buildAgentId is the build.agent_id the
-  // workflow observed for the publish attempt (the artifact system's durable
-  // build identifier). The read-back request carries it so the parent can
+  // workflow observed for the publish attempt (the artifact system's in-flight
+  // build correlation ID — not a durable post-completion identifier). The read-back request carries it so the parent can
   // prove the read-back inspected the live build of THIS attempt — not a
   // different build's output. Null/empty means the edit was accepted but
   // never correlated to a builder run. Pure function of inputs — no I/O,
@@ -1510,12 +1510,22 @@ while (i < STEPS.length) {
           "- Report, for each file you changed: its path, the exact lines you added, and the exact lines you removed.\n" +
           buildPreHashInstruction(expectedChanges) + "'\n" +
           ARTIFACT_LOAD_PREAMBLE +
-          "If artifact_edit is still not available after the load, do NOT improvise — return { \"edit_started\": false, \"error\": \"artifact_tools missing after load\", \"applied\": [] }.\n" +
-          "Make no other calls. Return JSON { \"edit_started\": <true if the edit was accepted, false otherwise>, \"error\": \"<details or empty string>\", \"applied\": [{\"path\": \"<file path>\", \"added\": [\"<added lines>\"], \"removed\": [\"<removed lines>\"]}], \"pre_hashes\": {\"<file path>\": \"<sha256 of that file's content BEFORE you applied the diff, or \"MISSING\">\"} } and nothing else.";
+          "If artifact_edit is still not available after the load, do NOT improvise — return { \"edit_started\": false, \"build_agent_id\": null, \"error\": \"artifact_tools missing after load\", \"applied\": [] }.\n" +
+          "RECEIPT CAPTURE (receipt-chained publish, 2026-09-13): the edit is only half the contract — you must also capture the platform build's receipt, the in-flight correlation ID the follow-up poll chains to.\n" +
+          "- The artifact namespace is already loaded (see below). BEFORE calling artifact_edit, call artifact_status with slug \"" + PUBLISH_SLUG + "\" and note the running build's agent_id (or null when no build is running). This is the pre-edit baseline.\n" +
+          "- Call artifact_edit as instructed above.\n" +
+          "- IMMEDIATELY after artifact_edit returns, call artifact_status again. If a build is running whose agent_id DIFFERS from the pre-edit baseline (or the baseline was null), that build is this edit's — its agent_id is the receipt.\n" +
+          "- If the post-edit status shows the SAME agent_id as the baseline, or no build at all, wait about 15 seconds and check artifact_status again, up to 4 more times. If a build with a NEW agent_id appears, that is the receipt.\n" +
+          "- If no new build appears, the receipt is null: the build may be pending_init-invisible, may have finished before the capture, or may be queued behind the earlier build. Return null — do NOT guess, and do NOT substitute the baseline build's agent_id.\n" +
+          "Make no other calls. Return JSON { \"edit_started\": <true if the edit was accepted, false otherwise>, \"build_agent_id\": <the receipt agent_id string, or null when no build could be attributed to this edit>, \"error\": \"<details or empty string>\", \"applied\": [{\"path\": \"<file path>\", \"added\": [\"<added lines>\"], \"removed\": [\"<removed lines>\"]}], \"pre_hashes\": {\"<file path>\": \"<sha256 of that file's content BEFORE you applied the diff, or \"MISSING\">\"} } and nothing else.";
         var rebuildSchema =
           { type: "object",
             properties: {
               edit_started: { type: "boolean" },
+              build_agent_id: {
+                type: ["string", "null"],
+                description: "Receipt-chained publish (2026-09-13): the platform build's in-flight correlation ID (build.agent_id from artifact_status) captured immediately after the edit was accepted — the receipt the follow-up poll chains to. Null when no build could be attributed to this edit. Required: an accepted edit with a null receipt parks fail-closed as unknown."
+              },
               error: { type: "string" },
               applied: {
                 type: "array",
@@ -1534,7 +1544,7 @@ while (i < STEPS.length) {
                 description: "Diagnostic (2026-09-12): sha256 of each touched file's content BEFORE the builder applied the diff, as reported by the builder. Compared against the workflow-computed expected base hashes (merge parent) — observation only, never gating."
               }
             },
-            required: ["edit_started", "applied"] };
+            required: ["edit_started", "build_agent_id", "applied"] };
         var rebuildTrigger = null;
         var rebuildReportMissing = false; // true if the edit went through but the agent returned no applied report (structured-output failure) — the smoke-check is skipped; the parent's independent read-back is the verification
         // The trigger key of the attempt that last ran, for the publish ledger.
@@ -1568,8 +1578,9 @@ while (i < STEPS.length) {
           //
           // Build-ID research (2026-09-12) corrected the model: artifact.edit
           // returns pending_init with NO agent_id, but artifact_status exposes
-          // the build's agent_id (the artifact system's durable build
-          // identifier, stable across polls) immediately after acceptance.
+          // the build's agent_id (the artifact system's in-flight build
+          // correlation ID, stable across polls while the build runs)
+          // immediately after acceptance.
           // So the recovery no longer asks the child to derive booleans —
           // the layer where the 2026-09-12 signal was lost. It reads the RAW
           // build object and extracts build.agent_id mechanically in the
@@ -1636,6 +1647,42 @@ while (i < STEPS.length) {
             { key: attemptKey("publish-artifact-rebuild-" + taskId + "-retry2", reworkCount), label: "Triggering artifact rebuild (retry)", schema: rebuildSchema });
           rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId + "-retry2", reworkCount);
         }
+        // Receipt chaining (2026-09-13): adopt the trigger's build receipt,
+        // or park on an uncorrelated acceptance. The trigger's closeout schema
+        // requires build_agent_id — the platform build's in-flight correlation
+        // ID captured immediately after the edit was accepted.
+        // An accepted edit (edit_started=true) with a null receipt is UNKNOWN,
+        // not "did not go through": the build may be pending_init-invisible,
+        // may have finished before the capture window, or may be queued behind
+        // a still-running earlier build. No re-trigger is issued on unknown —
+        // a blind re-trigger duplicated the edit on 2026-09-12, and the platform
+        // offers no idempotency proof that would make re-issue safe.
+        // (Retry-semantics reconciliation, 2026-09-13: the "no receipt → safe
+        // re-trigger" sketch assumed the edit command idempotently publishes
+        // what's on git; the duplicate-edit incident disproves the assumption,
+        // and the standing rule retries only on explicit negative evidence.
+        // Re-trigger stays exactly where it was: the edit_started=false
+        // explicit-rejection path above.) Record the attempt and park
+        // fail-closed; correlate via the ledger and the parent's content
+        // read-back before re-driving Publish.
+        if (rebuildTrigger && rebuildTrigger.edit_started && !rebuildReportMissing) {
+          var triggerAgentId = (typeof rebuildTrigger.build_agent_id === "string" && rebuildTrigger.build_agent_id.length > 0) ? rebuildTrigger.build_agent_id : null;
+          if (!triggerAgentId) {
+            var uncorrelatedObservation = (function () { var c = verifyAppliedChanges(expectedChanges, rebuildTrigger.applied); return c.ok ? "match" : "mismatch: " + c.reason; })();
+            log("Publish receipt missing for task " + taskId + ": the trigger reported edit_started=true but captured no build receipt (build_agent_id null) — no build attributable to this edit. Parking fail-closed without re-triggering.");
+            await recordPublishLedger({
+              commit: mergeCommitForPublish,
+              attempt: rebuildAttemptKey,
+              agent_id: null,
+              applied_report: uncorrelatedObservation,
+              outcome: "unknown",
+              detail: "edit accepted (edit_started=true) but the trigger captured no build receipt in its capture window: no build attributable to this edit (pending_init-invisible, finished before capture, or queued behind an earlier build). No re-trigger issued — a blind re-trigger on an unknown outcome duplicated the edit on 2026-09-12 and the platform offers no idempotency proof."
+            }, reworkCount);
+            return await parkTask("Publish outcome unknown: the rebuild trigger reported the edit was accepted but captured no build receipt (build_agent_id null) — no build could be attributed to this edit in the capture window. The edit may be pending_init-invisible, already finished, or queued behind an earlier build, so no re-trigger was issued: a blind retry duplicated the edit on 2026-09-12. The attempt is recorded in the publish ledger at " + crewHome + "/.publish-ledger/" + PUBLISH_SLUG + ".jsonl (commit " + String(mergeCommitForPublish || "unknown").slice(0, 12) + "). Correlate via the ledger and re-drive Publish only after the parent's content read-back resolves what actually landed. Fail-closed.");
+          }
+          rebuildAgentId = triggerAgentId;
+          log("Publish receipt chained for task " + taskId + ": build " + triggerAgentId + " — the follow-up poll waits on this build only.");
+        }
         // Durable publish-attempt ledger: record the trigger outcome while the
         // attempt key and commit are in scope. Every attempt lands here with
         // its outcome — submitted, rejected, or unknown (unknown is recorded
@@ -1739,10 +1786,13 @@ while (i < STEPS.length) {
               ? attemptKey("publish-artifact-poll-" + taskId, reworkCount)
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, reworkCount);
             buildPoll = await agent(
-              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 7 checks (3.5 minutes max).\n" +
-              "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
+              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+              "- If no build is running (build is null): OUR build finished. Stop and report done.\n" +
+              "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
+              "- If the running build's agent_id is present but DIFFERENT: our build is gone (it finished before this one started). Do NOT wait on the stranger's build and do NOT attribute its completion to our attempt \u2014 stop and report done.\n" +
+              "Return JSON { \"build_done\": <true if our build is no longer running within budget, false on timeout>, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
               { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
                 timeoutMs: 270000 }
             );
             if (buildPoll && buildPoll.build_done) { break; }

package/workflows/crew-dispatch.js

@@ -248,6 +248,34 @@ function unwrapBoardResult(boardResult) {
       }
     }
   }
+  // The read-board agent may return the whole board stdout in a
+  // {"status":"ok","result":"<board JSON string>"} envelope — the
+  // get-dispatch-state stdout placed in .result as a string instead of a
+  // parsed object (17:00 PDT tick, 2026-09-13). Parse it deterministically
+  // in JS: a string that parses to an array is the ready_tasks array
+  // itself; a string that parses to an object is the whole board stdout,
+  // so re-run the unwrap on it. Unparseable or scalar strings fall through
+  // to the fail-closed throw below.
+  if (boardData && typeof boardData === 'object' && typeof boardData.result === 'string' && !Array.isArray(boardData.ready_tasks)) {
+    var parsedResult = null, resultParsed = false;
+    try {
+      parsedResult = JSON.parse(boardData.result);
+      resultParsed = true;
+    } catch (e) {
+      // Unparseable — fall through to fail-closed below.
+    }
+    if (resultParsed) {
+      if (Array.isArray(parsedResult)) {
+        boardData.ready_tasks = parsedResult;
+      } else if (parsedResult && typeof parsedResult === 'object') {
+        // Recursion happens outside the try: a fail-closed throw from the
+        // inner unwrap must propagate with its own precise message, not be
+        // swallowed into the generic throw below.
+        return unwrapBoardResult(parsedResult);
+      }
+      // Scalar — fall through to fail-closed below.
+    }
+  }
   // The read-board agent may hand back the envelope with ready_tasks as a
   // JSON string — {"ready_tasks": "<json string>"} — the get-dispatch-state
   // stdout placed in the envelope instead of parsed (14:24 PDT tick,
@@ -272,7 +300,7 @@ function unwrapBoardResult(boardResult) {
   if (!boardData || typeof boardData !== 'object' || !Array.isArray(boardData.ready_tasks)) {
     throw new Error(
       "unwrapBoardResult: unknown board envelope — expected ready_tasks at top level, " +
-      "in .data, in .result, in .result.data, or as a JSON string of a ready_tasks array " +
+      "in .data, in .result (object or JSON string), in .result.data, or as a JSON string of a ready_tasks array " +
       "or of a whole board object. Got keys: " +
       (boardData && typeof boardData === 'object' ? Object.keys(boardData).join(",") : typeof boardData)
     );

package/workflows/standard.js

@@ -486,8 +486,8 @@ function verifyAppliedChanges(expected, applied) {
 // it must match the artifact's real content.
 function buildPublishReadbackRequest(taskId, commit, diff, buildAgentId) {
   // Build-ID correlation (2026-09-12): buildAgentId is the build.agent_id the
-  // workflow observed for the publish attempt (the artifact system's durable
-  // build identifier). The read-back request carries it so the parent can
+  // workflow observed for the publish attempt (the artifact system's in-flight
+  // build correlation ID — not a durable post-completion identifier). The read-back request carries it so the parent can
   // prove the read-back inspected the live build of THIS attempt — not a
   // different build's output. Null/empty means the edit was accepted but
   // never correlated to a builder run. Pure function of inputs — no I/O,
@@ -1493,12 +1493,22 @@ while (i < STEPS.length) {
           "- Report, for each file you changed: its path, the exact lines you added, and the exact lines you removed.\n" +
           buildPreHashInstruction(expectedChanges) + "'\n" +
           ARTIFACT_LOAD_PREAMBLE +
-          "If artifact_edit is still not available after the load, do NOT improvise — return { \"edit_started\": false, \"error\": \"artifact_tools missing after load\", \"applied\": [] }.\n" +
-          "Make no other calls. Return JSON { \"edit_started\": <true if the edit was accepted, false otherwise>, \"error\": \"<details or empty string>\", \"applied\": [{\"path\": \"<file path>\", \"added\": [\"<added lines>\"], \"removed\": [\"<removed lines>\"]}], \"pre_hashes\": {\"<file path>\": \"<sha256 of that file's content BEFORE you applied the diff, or \"MISSING\">\"} } and nothing else.";
+          "If artifact_edit is still not available after the load, do NOT improvise — return { \"edit_started\": false, \"build_agent_id\": null, \"error\": \"artifact_tools missing after load\", \"applied\": [] }.\n" +
+          "RECEIPT CAPTURE (receipt-chained publish, 2026-09-13): the edit is only half the contract — you must also capture the platform build's receipt, the in-flight correlation ID the follow-up poll chains to.\n" +
+          "- The artifact namespace is already loaded (see below). BEFORE calling artifact_edit, call artifact_status with slug \"" + PUBLISH_SLUG + "\" and note the running build's agent_id (or null when no build is running). This is the pre-edit baseline.\n" +
+          "- Call artifact_edit as instructed above.\n" +
+          "- IMMEDIATELY after artifact_edit returns, call artifact_status again. If a build is running whose agent_id DIFFERS from the pre-edit baseline (or the baseline was null), that build is this edit's — its agent_id is the receipt.\n" +
+          "- If the post-edit status shows the SAME agent_id as the baseline, or no build at all, wait about 15 seconds and check artifact_status again, up to 4 more times. If a build with a NEW agent_id appears, that is the receipt.\n" +
+          "- If no new build appears, the receipt is null: the build may be pending_init-invisible, may have finished before the capture, or may be queued behind the earlier build. Return null — do NOT guess, and do NOT substitute the baseline build's agent_id.\n" +
+          "Make no other calls. Return JSON { \"edit_started\": <true if the edit was accepted, false otherwise>, \"build_agent_id\": <the receipt agent_id string, or null when no build could be attributed to this edit>, \"error\": \"<details or empty string>\", \"applied\": [{\"path\": \"<file path>\", \"added\": [\"<added lines>\"], \"removed\": [\"<removed lines>\"]}], \"pre_hashes\": {\"<file path>\": \"<sha256 of that file's content BEFORE you applied the diff, or \"MISSING\">\"} } and nothing else.";
         var rebuildSchema =
           { type: "object",
             properties: {
               edit_started: { type: "boolean" },
+              build_agent_id: {
+                type: ["string", "null"],
+                description: "Receipt-chained publish (2026-09-13): the platform build's in-flight correlation ID (build.agent_id from artifact_status) captured immediately after the edit was accepted — the receipt the follow-up poll chains to. Null when no build could be attributed to this edit. Required: an accepted edit with a null receipt parks fail-closed as unknown."
+              },
               error: { type: "string" },
               applied: {
                 type: "array",
@@ -1517,7 +1527,7 @@ while (i < STEPS.length) {
                 description: "Diagnostic (2026-09-12): sha256 of each touched file's content BEFORE the builder applied the diff, as reported by the builder. Compared against the workflow-computed expected base hashes (merge parent) — observation only, never gating."
               }
             },
-            required: ["edit_started", "applied"] };
+            required: ["edit_started", "build_agent_id", "applied"] };
         var rebuildTrigger = null;
         var rebuildReportMissing = false; // true if the edit went through but the agent returned no applied report (structured-output failure) — the smoke-check is skipped; the parent's independent read-back is the verification
         // The trigger key of the attempt that last ran, for the publish ledger.
@@ -1551,8 +1561,9 @@ while (i < STEPS.length) {
           //
           // Build-ID research (2026-09-12) corrected the model: artifact.edit
           // returns pending_init with NO agent_id, but artifact_status exposes
-          // the build's agent_id (the artifact system's durable build
-          // identifier, stable across polls) immediately after acceptance.
+          // the build's agent_id (the artifact system's in-flight build
+          // correlation ID, stable across polls while the build runs)
+          // immediately after acceptance.
           // So the recovery no longer asks the child to derive booleans —
           // the layer where the 2026-09-12 signal was lost. It reads the RAW
           // build object and extracts build.agent_id mechanically in the
@@ -1619,6 +1630,42 @@ while (i < STEPS.length) {
             { key: attemptKey("publish-artifact-rebuild-" + taskId + "-retry2", totalReworkCount), label: "Triggering artifact rebuild (retry)", schema: rebuildSchema });
           rebuildAttemptKey = attemptKey("publish-artifact-rebuild-" + taskId + "-retry2", totalReworkCount);
         }
+        // Receipt chaining (2026-09-13): adopt the trigger's build receipt,
+        // or park on an uncorrelated acceptance. The trigger's closeout schema
+        // requires build_agent_id — the platform build's in-flight correlation
+        // ID captured immediately after the edit was accepted.
+        // An accepted edit (edit_started=true) with a null receipt is UNKNOWN,
+        // not "did not go through": the build may be pending_init-invisible,
+        // may have finished before the capture window, or may be queued behind
+        // a still-running earlier build. No re-trigger is issued on unknown —
+        // a blind re-trigger duplicated the edit on 2026-09-12, and the platform
+        // offers no idempotency proof that would make re-issue safe.
+        // (Retry-semantics reconciliation, 2026-09-13: the "no receipt → safe
+        // re-trigger" sketch assumed the edit command idempotently publishes
+        // what's on git; the duplicate-edit incident disproves the assumption,
+        // and the standing rule retries only on explicit negative evidence.
+        // Re-trigger stays exactly where it was: the edit_started=false
+        // explicit-rejection path above.) Record the attempt and park
+        // fail-closed; correlate via the ledger and the parent's content
+        // read-back before re-driving Publish.
+        if (rebuildTrigger && rebuildTrigger.edit_started && !rebuildReportMissing) {
+          var triggerAgentId = (typeof rebuildTrigger.build_agent_id === "string" && rebuildTrigger.build_agent_id.length > 0) ? rebuildTrigger.build_agent_id : null;
+          if (!triggerAgentId) {
+            var uncorrelatedObservation = (function () { var c = verifyAppliedChanges(expectedChanges, rebuildTrigger.applied); return c.ok ? "match" : "mismatch: " + c.reason; })();
+            log("Publish receipt missing for task " + taskId + ": the trigger reported edit_started=true but captured no build receipt (build_agent_id null) — no build attributable to this edit. Parking fail-closed without re-triggering.");
+            await recordPublishLedger({
+              commit: mergeCommitForPublish,
+              attempt: rebuildAttemptKey,
+              agent_id: null,
+              applied_report: uncorrelatedObservation,
+              outcome: "unknown",
+              detail: "edit accepted (edit_started=true) but the trigger captured no build receipt in its capture window: no build attributable to this edit (pending_init-invisible, finished before capture, or queued behind an earlier build). No re-trigger issued — a blind re-trigger on an unknown outcome duplicated the edit on 2026-09-12 and the platform offers no idempotency proof."
+            }, totalReworkCount);
+            return await parkTask("Publish outcome unknown: the rebuild trigger reported the edit was accepted but captured no build receipt (build_agent_id null) — no build could be attributed to this edit in the capture window. The edit may be pending_init-invisible, already finished, or queued behind an earlier build, so no re-trigger was issued: a blind retry duplicated the edit on 2026-09-12. The attempt is recorded in the publish ledger at " + crewHome + "/.publish-ledger/" + PUBLISH_SLUG + ".jsonl (commit " + String(mergeCommitForPublish || "unknown").slice(0, 12) + "). Correlate via the ledger and re-drive Publish only after the parent's content read-back resolves what actually landed. Fail-closed.");
+          }
+          rebuildAgentId = triggerAgentId;
+          log("Publish receipt chained for task " + taskId + ": build " + triggerAgentId + " — the follow-up poll waits on this build only.");
+        }
         // Durable publish-attempt ledger: record the trigger outcome while the
         // attempt key and commit are in scope. Every attempt lands here with
         // its outcome — submitted, rejected, or unknown (unknown is recorded
@@ -1722,10 +1769,13 @@ while (i < STEPS.length) {
               ? attemptKey("publish-artifact-poll-" + taskId, totalReworkCount)
               : attemptKey("publish-artifact-poll-" + taskId + "-c" + chunk, totalReworkCount);
             buildPoll = await agent(
-              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" until no build is running. Check every 30 seconds, up to 7 checks (3.5 minutes max).\n" +
-              "Return JSON { \"build_done\": <true if no build is running within budget, false on timeout>, \"status\": \"<final status or timeout note>\" } and nothing else.",
+              "First call tool_search.load_tool_namespace with paths [\"artifact\"]. Then poll artifact_status for slug \"" + PUBLISH_SLUG + "\" \u2014 for OUR build only, the one whose agent_id is \"" + rebuildAgentId + "\" (the receipt captured when the edit was accepted; the agent_id is the artifact system's in-flight build correlation ID, stable across polls while the build runs). Check every 30 seconds, up to 7 checks (3.5 minutes max). On each check, read the raw build object:\n" +
+              "- If no build is running (build is null): OUR build finished. Stop and report done.\n" +
+              "- If the running build's agent_id equals \"" + rebuildAgentId + "\": still ours \u2014 keep waiting.\n" +
+              "- If the running build's agent_id is present but DIFFERENT: our build is gone (it finished before this one started). Do NOT wait on the stranger's build and do NOT attribute its completion to our attempt \u2014 stop and report done.\n" +
+              "Return JSON { \"build_done\": <true if our build is no longer running within budget, false on timeout>, \"status\": \"<final status or timeout note>\", \"observed_agent_id\": \"<the agent_id seen on the last check, or null when no build was running>\" } and nothing else.",
               { key: pollKey, label: "Waiting for artifact build to complete (chunk " + chunk + " of 3)",
-                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" } }, required: ["build_done"] },
+                schema: { type: "object", properties: { build_done: { type: "boolean" }, status: { type: "string" }, observed_agent_id: { type: ["string", "null"] } }, required: ["build_done"] },
                 timeoutMs: 270000 }
             );
             if (buildPoll && buildPoll.build_done) { break; }

package/workflows/tests/read-board-parse.test.mjs

@@ -125,6 +125,40 @@ ok("string and object returns converge identically (deep equal)", () => {
   assert.deepStrictEqual(fromString, fromObject);
 });
 
+// ── result-as-string envelope (2026-09-13 17:00 PDT tick) ───────────
+// The read-board agent returned {"status":"ok","result":"<board JSON>"} —
+// the whole board stdout as a string in .result. unwrapBoardResult must
+// converge it the same way it converges every other envelope.
+ok("envelope string {status, result: board-JSON-string} converges", () => {
+  const boardData = converge(JSON.stringify({ status: "ok", result: JSON.stringify(BOARD) }));
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+  assert.deepStrictEqual(boardData.projects, PROJECTS);
+});
+
+ok("envelope object {status, result: board-JSON-string} converges", () => {
+  const boardData = converge({ status: "ok", result: JSON.stringify(BOARD) });
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+  assert.deepStrictEqual(boardData.projects, PROJECTS);
+});
+
+ok("envelope {status, result: tasks-array-JSON-string} converges", () => {
+  const boardData = converge({ status: "ok", result: JSON.stringify(TASKS) });
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+});
+
+ok("doubly-nested envelope {status, result: \"{result:{ready_tasks}}\"} converges", () => {
+  const inner = JSON.stringify({ result: { ready_tasks: TASKS } });
+  const boardData = converge(JSON.stringify({ status: "ok", result: inner }));
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+});
+
+throwsClosed("envelope {status, result: unparseable-string} throws", () =>
+  converge(JSON.stringify({ status: "ok", result: "{not json" })));
+throwsClosed("envelope {status, result: scalar-string} throws", () =>
+  converge(JSON.stringify({ status: "ok", result: "42" })));
+throwsClosed("envelope {status, result: JSON-without-ready_tasks} throws", () =>
+  converge(JSON.stringify({ status: "ok", result: JSON.stringify({ foo: 1 }) })));
+
 // ── Fail-closed: never a silent empty task set ──────────────────────
 throwsClosed("invalid JSON string throws", () => converge("{not json"));
 throwsClosed("truncated JSON throws", () => converge('{"ready_tasks": ['));