muse-crew 0.8.0 → 0.8.1

package/lib/publish-npm.sh

@@ -212,7 +212,13 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
 
     # 11. Publish. "previously published versions" means a retried Publish
     # already landed this version (the merge lock guarantees no other task
-    # picked it) — continue. Any other failure is fatal.
+    # picked it) — continue. A "staged version" 409 means npm accepted the
+    # publish but staged it: the PUT returned 2xx yet the version is
+    # invisible in the packument until it finalizes (~7 min observed
+    # 2026-09-17). Never re-PUT a staged version — the registry rejects it
+    # and the re-PUT proves nothing. Poll the registry at step 12 until it
+    # finalizes or the budget exhausts (fail closed). Any other failure is
+    # fatal.
     if PUB_OUT="$(python3 "$NPM_PUBLISH_PY" "$TGZ" 2>&1)"; then
       echo "PUBLISHED=$TARGET_VERSION"
     else
@@ -220,6 +226,10 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
         *"previously published versions"*)
           echo "PUBLISHED_ALREADY=$TARGET_VERSION"
           ;;
+        *"staged version"*)
+          echo "PUBLISHED_STAGED=$TARGET_VERSION"
+          echo "publish staged by registry — polling for visibility, not re-PUTting"
+          ;;
         *)
           rm -f "$TGZ"
           fail "publish" "$(printf '%s\n' "$PUB_OUT" | tail -5)"
@@ -231,12 +241,20 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
     # 12. Verify: ground truth is the registry, not any agent's summary.
     # The registry is eventually consistent: a publish followed by an
     # immediate read can observe the pre-publish version (canary 5a027278
-    # hit a stale read replica ~6s after publish). A single stale read must
-    # never park a landed publish, so this block retries with backoff and
-    # client cache-busting instead of failing on the first mismatch.
+    # hit a stale read replica ~6s after publish). Worse, npm may STAGE a
+    # publish: the PUT returns 2xx but the version stays invisible in the
+    # packument until it finalizes (~7 min observed 2026-09-17) — a
+    # re-PUT then 409s as "previously staged". A short budget would park
+    # a landed publish, so the default budget covers staged finalization
+    # with headroom (30 x 30s = 15 min, still bounded). A single stale
+    # read must never park a landed publish, so this block retries with
+    # backoff and client cache-busting instead of failing on the first
+    # mismatch. Budget exhaustion fails closed: a publish that never
+    # becomes visible is not claimed — a human with 2FA investigates
+    # (e.g. `npm stage approve`) and the version is never re-PUT blind.
     # STEP-12-ANCHOR: publish verification (retry-tolerant)
-    VERIFY_ATTEMPTS="${VERIFY_ATTEMPTS:-12}"
-    VERIFY_SLEEP_SECS="${VERIFY_SLEEP_SECS:-10}"
+    VERIFY_ATTEMPTS="${VERIFY_ATTEMPTS:-30}"
+    VERIFY_SLEEP_SECS="${VERIFY_SLEEP_SECS:-30}"
     REG=""
     for attempt in $(seq 1 "$VERIFY_ATTEMPTS"); do
       # --prefer-online busts npm's client-side packument cache; the retry

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,