pi-crew 0.11.54 → 0.11.55

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [0.11.55] — ask-park clobber fix + w1a dispatcher key distribution (2026-10-31)
+
+**Fixed (product, FINDING A — ask-park clobber).** Cross-process coalesce race on tasks.json: the HOST process's 50ms coalesced
+progress flush (per-process buffer) blindly overwrote the DETACHED BROKER's run-locked sync `waiting` park ~3ms after it landed
+(live incidents team_20261031084714 + team_20261031045633), losing BOTH the status and the questionId marker — every leader respond
+then rejected "is running, not waiting" and all asks timed out (silent degradation of the whole mailbox-interactive flow).
+
+- `atomic-write.ts`: flush-time staleness CAS — queue-time mtimeMs+size identity, re-stat at flush; an EXTERNAL write landing between
+  queue and flush discards the stale snapshot instead of clobbering (cross-process supersession was invisible to the same-process
+  `cancelPendingCoalescedWrite`). Live-proven: `coalesced-stale-drop` fired at the exact park moment in all three probe runs.
+- `respond.ts`: no-waiting fallback repairs a clobbered park from the surviving `manifest.waitState` pointer inside the same run-lock
+  section (`task.waiting_repaired` event), then the answer path runs verbatim — defense-in-depth backstop for the post-park re-queue
+  residual the CAS cannot see. Live-proven: repair + accept + mailbox delivery in one probe run.
+- contracts/event-reconstructor: `task.waiting_repaired` → waiting.
+- Tests: atomic-write CAS (external temp+rename sims), state-store clobber regression, respond clobber-repair — 9/9.
+
+**Fixed (product, FINDING B — w1a cross-process signing).** w1a per-process Ed25519 signing broke ALL cross-process ask/respond delivery in async runs: `respond.ts` writes the
+respond row with the LEADER session's keypair while the DETACHED RUNNER spawns the workers, so the worker's single spawner-key env
+(`PI_CREW_MAILBOX_VERIFY_KEY`) could never verify the row — it dropped as noise at `parseMailboxFile` and every `ask` poll timed out (480s
+hang, then "proceed with best judgment"). Same class for the leader-signed steering fs-fallback line (`team-tool.ts`). Fix = distribute the
+DISPATCHER'S PUBLIC key (hướng C):
+
+- `resolveCoordinationVerifyKeys()` (mailbox.ts) now merges + dedupes `[PI_CREW_MAILBOX_VERIFY_KEYS (plural env),
+  PI_CREW_MAILBOX_VERIFY_KEY (singular env — semantics unchanged), in-process keypair]` — no source shadows another; the old
+  `if (envKey) return [envKey]` early-return made an env key HIDE the writer's own keypair (shadow bug).
+- New `PI_CREW_MAILBOX_VERIFY_KEYS` env var (registered in env-vars.ts + env-allowlist-registry.ts): comma-separated base64 SPKI PUBLIC
+  verify keys handed to children by child-pi-spawn (deduped with the inherited set for same-run grandchildren via the existing
+  relay-match guard — never relayed across runs).
+- Threading: team-tool run/parallel dispatch stamps `TeamRunManifest.dispatcherVerifyKey` (new optional field, byte-compatible when
+  absent) via `ensureCoordinationPublicVerifyKey()`; goal-loop turn manifests inherit the OUTER manifest's key; child-executor threads it
+  into every worker spawn (`ChildPiRunInput.dispatcherVerifyKey`).
+- Docs: trust-model v1.4 documents the w1a sender binding + dispatcher key distribution with accepted residual gaps (leader restart
+  mid-run, foreign-session respond, scheduled no-leader runs, pre-fix manifests); hướng A (broker-RPC signing) noted as follow-up.
+- Tests: resolver merge/shadow-fix; cross-process delivery (foreign-process signer harness — dispatcher-signed respond row DELIVERS via
+  plural env, stranger-signed + unsigned stay dropped, steering entry verifies); spawn-env wiring (leader / nested relay dedupe /
+  no cross-run leak / legacy unchanged); manifest persistence + byte-compat.
+
 ## [0.11.54] — deep-review verified fix set, waves A–G + closing hardenings (2026-10-31)
 
 **Fixed (product).** The v0.11.53 deep review's 15 findings were cold-verified by three independent verifiers