v1.3.0 — the verification guarantee, enforced

The plugin's central claim is now enforced in code rather than stated in prose.

completed means the worker stopped. accept means a supervisor ran a check and the final one passed.

That sentence appeared in the README, the skill, the supervisor agent and the workflow reference. An adversarial review reproduced a task recorded as accept / verified whose acceptance check asserted the opposite of what the patch contained, and found the guarantee enforced nowhere. This release closes that gap and the twenty-one others the review and its follow-ups found.

The gate

finish --verdict accept now refuses unless three separate conditions hold — a check ran, the final one passed, and it ran against the patch being harvested. The refusal names which one failed and exits non-zero, and it returns before the cleanup branch, so a refusal never reaps the work the supervisor was just told to go verify.

--accept-unverified "<reason>" records the one legitimate exception — a correct patch that makes its check go red, a strict xfail being the usual shape — instead of hiding it. /muse:status prints the reason on the task's row.

The binding is a fingerprint of the patch, taken after the acceptance command. Both were corrections to a first attempt that hashed the whole worktree before the command: that version refused every check that builds, formats or generates, which is most of them.

The claim we retired

The code said the supervisor's toolset made hand-editing impossible. It does not — the supervisor has Bash, a shell redirect is a write, and the review produced an entire harvested patch with echo >. The false claims are gone. finish now fingerprints what muse produced, compares it with what it harvests, and reports out_of_band_edit with mutating_checks naming any acceptance check that accounts for part of the difference. The toolset is a strong default; the measurement is the enforcement.

Also fixed

• harvest failed on any repository with a .gitignore. git add -A -- ':(exclude,glob)__pycache__' exits 1 when git already ignores __pycache__, and the exclude list is precisely what a real repo gitignores. From the first moment a worker generated one, every harvest on that task failed and patch.diff stopped updating. Invisible because every fixture repo in the suite is created without a .gitignore.
• Three commands shipped with frontmatter that never parsed. /muse:ask, /muse:cleanup and /muse:doctor loaded with no description and no allowed-tools.
• A timed-out check left its grandchildren running, writing into a worktree about to be force-removed. Now killed as a tree — via taskkill /F /T on Windows, which the CI leg caught as a gap in the first fix.
• Every muse-side failure reported the same sentence. Exit code and stderr now reach the round record, so an unknown flag, a bad model id and an expired credential are three different problems.
• session_exists failed OPEN, and the credential scan stopped at 5000 files without saying so. Both now fail closed and say so.
• A relative --out moved with the current directory, so run from the repo root and verify from a subdirectory addressed different task directories. It resolves against the repository now.

Platform

The fleet workflow is registered (workflows/muse-supervised-fleet.js) and invoked by name, rather than shipped as a code fence the model had to transcribe — the most fragile step on the headline path. Five values are configurable at install time. SubagentStop backstops the central claim for the case where no record is written at all; SessionEnd names worktrees still holding unapplied patches. Only the fleet skill auto-triggers now. claude plugin validate --strict runs in CI.

How it was verified

The offline suite went from 99 checks to 147, and every new one was broken on purpose and confirmed to go red naming its own check. Six of those guards could not fail on the first attempt and were fixed before shipping.

CI is green on five legs: Python 3.9 / 3.11 / 3.13, Windows, and manifest validation.

The full paid live suite — real muse runs through the fleet, the supervised loop, seeding, re-run safety and session resume — is 190 passed, 0 failed.

Still unverified, and stated rather than papered over: live delegation on Windows (muse is never invoked on that leg), and whether a Bash tool call sees CLAUDE_PLUGIN_OPTION_* or a plugin-owned workflow gets ${CLAUDE_PLUGIN_ROOT} substituted — both are undocumented, so the code detects which case it is in rather than assuming.

Full detail in CHANGELOG.md.