feat(bin): land the fork trunk and fix the Windows launcher fresh-session PATH - #1886
Closed
sbracewell64 wants to merge 47 commits into
Closed
feat(bin): land the fork trunk and fix the Windows launcher fresh-session PATH#1886sbracewell64 wants to merge 47 commits into
sbracewell64 wants to merge 47 commits into
Conversation
A fleet launcher will soon open PRIMARY firstmate sessions alongside the crewmate sessions fm-spawn.sh opens, so both need the same verified launch commands. Today that knowledge lives only inside bin/fm-spawn.sh, and the drift a second copy causes is not hypothetical: a downstream registry hand-copied claude's command as `claude --dangerously-skip-permissions`, dropping CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false - the ghost-text suppression that keeps firstmate from reading predicted-prompt text as real typed input when it captures a pane. Extract launch_template, model_flag_for_harness, and effort_flag_for_harness (plus the shell_quote both flag resolvers depend on) into a new sourced bin/fm-launch-lib.sh, and have fm-spawn.sh source it. Every crewmate, scout, and secondmate template is byte-identical to before, so spawn behavior is unchanged on all six verified adapters. launch_template also gains a `primary` kind for the launcher. A primary session has no task, no worktree, no brief, and no status file, so it launches bare and is greeted by the session-start adapters already installed in the home; each primary template keeps its adapter's verified autonomy flag and claude's ghost-text prefix. An unrecognized kind still resolves to the crewmate shape, and an unverified adapter still returns non-zero for every kind. tests/fm-launch-lib.test.sh pins both arms directly, including a proof that fm-spawn.sh redefines none of the functions and that no other script under bin/ hand-writes a launch command. Existing suites that read the template bytes now read them from their new owner.
…ighten launch-lib ownership
bin/fm-launch.sh is the captain's front door: it renders a five-entry harness menu, starts one firstmate primary session in this home, and attaches to it. The menu is derived and probed, never declared. An entry is available only when its harness binary resolves on PATH, or - for a Pi-routed entry - when the provider named in its model appears in pi's local auth record. Unavailable entries stay visible and dim, each with one actionable line, so the menu never changes shape under the captain's muscle memory. Both probes are local file reads, so the menu touches no network and executes no binary at all. Menu entries carry no launch command. They name a harness plus an optional model and effort, and the command is resolved through bin/fm-launch-lib.sh at launch time - the single owner a downstream registry has already drifted from once by hand-copying a launch string and dropping claude's ghost-text suppression prefix. The launcher states on every render, before the choice, that the session it starts runs without permission prompts. That discharges the consumer obligation bin/fm-launch-lib.sh's header binds on every consumer of a primary template. Herdr is mandatory with no silent fallback to a bare shell, and the gate runs after selection so no socket round trip sits on the critical path. Before creating anything the launcher looks for a primary already running in this home and offers to reattach, so two sessions can never contend for one home's session lock. Selection is one keypress. A human who mistypes gets a redrawn prompt; a scripted caller keeps the refuse-don't-reprompt behavior, and a blank line or EOF refuses rather than launching whatever the default happens to be - taking the default there once started an unattended session nobody chose. Presets live in gitignored config/launch-presets.json and the built-in five need no configuration. They are deliberately not inherited into secondmate homes: a secondmate is provisioned and launched by the primary through bin/fm-spawn.sh, never through this front door, so there would be no consumer for an inherited menu. The Windows entry point and WSL bridge are out of scope here and land separately.
…coverage tests/fm-launch-lib.test.sh's one-owner guards grepped bin/fm-spawn.sh for function definitions and its literal source line, and git-grepped bin/ for launch-command markers - implementation-source assertions the coding guidelines now forbid. Prove the same guarantee behaviorally instead: a sandboxed copy of bin/ shows fm-spawn's launch decision follows a swapped fm-launch-lib.sh in both directions and that fm-spawn cannot take a launch decision without the library, so the launch knowledge has exactly one live owner. The byte-for-byte template pins already go through the public launch_template interface and stay. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…esh evidence anchors
…#1288) feat(bin): add fleet launcher menu backed by a single-owner launch library
… briefs to read the marker (#9) * feat(bin): add verified pi-signed runtime adapter (kunchenguid#1145) * feat: add verified pi-signed adapter * no-mistakes(review): Correct pi-signed maintainer verification date * no-mistakes(review): Correct remaining pi-signed verification dates * no-mistakes(review): Preserve authoritative pi-signed runtime identity * no-mistakes(document): Document pi-signed shared adapter semantics * no-mistakes: apply CI fixes * fix(pi): rearm watcher across session transitions (kunchenguid#1166) * fix(pi): rearm watcher across same-process session transitions Pi emits session_shutdown for ordinary /new, /resume, and /fork replacement as well as terminal quit. The primary watcher extension latched a module-level stopping flag on every shutdown, so a replacement session in the same process could not arm monitoring until Pi restarted. Own arm authority per session generation so only the active live generation may start, stop, or rearm the child. Replacement sessions can arm again without restarting Pi, stale prior-generation callbacks cannot mutate the active cycle, and real quit still blocks late rearm. * no-mistakes(review): Preserve Pi generation isolation and exit cleanup * no-mistakes(document): Correct Pi watcher transition documentation * feat: route crew dispatch using quota-window pace (kunchenguid#1172) * Consume quota-axi pace signals in dispatch profile array selection. Add quota-array-dispatch as the single owner of the pace-aware candidate choice, keep AGENTS.md to the intake boundary and load trigger, and cover the acceptance cases with sanitized schemaVersion 3 fixtures. * no-mistakes(review): Stop and report genuine quota dispatch ties * no-mistakes(document): Document quota pace freshness and uncertainty * fix: adapt Grok Stop continuation and harden endpoint cleanup (kunchenguid#1171) * fix(grok): adapt Stop continuation to runtime capability * no-mistakes(review): Reject ambiguous Grok Stop payloads * no-mistakes(review): Reject duplicate Grok fields and accept spaced tmux sessions * no-mistakes(review): Enforce exact tmux cleanup selectors * no-mistakes(test): Fix historical tmux fixture and validate Grok Stop * no-mistakes: apply CI fixes * fix: restore stock macOS Bash 3.2 brief scaffolding (kunchenguid#1093) * fix(brief): make DOD scaffolding parse-safe on stock macOS Bash 3.2 fm-brief.sh built each Definition-of-done block and the not-enabled Herdr declaration with `VAR=$(cat <<EOF ... EOF)`. On Bash 3.2 (macOS /bin/bash) the lexer scans for the command substitution's closing `)` textually and tracks quote state through the heredoc body, so a single apostrophe, unbalanced quote, or unbalanced paren in that prose breaks parsing of the whole script. Every ship-brief scaffold (no-mistakes, direct-PR, local-only) failed with `unexpected EOF while looking for matching )`. Bash 4+ parses it fine, so the breakage stayed invisible everywhere except stock macOS. Replace all four command-substitution heredocs with `IFS= read -r -d '' VAR <<EOF || true`. That removes the `$(...)` wrapper and the entire defect class regardless of future prose, and preserves the variable expansion the direct-PR and local-only bodies need. `read` keeps the heredoc's trailing newline that `$(...)` used to strip, so trim one newline to keep every generated brief byte-identical to prior output. Guard the structure, not one historical phrase: a new test rejects any heredoc nested in a command substitution anywhere in fm-brief.sh, where the old assertion pinned a single apostrophe phrase and so missed the reintroduction. Extend the stock-macOS Bash CI job from parsing one script to the whole maintained shell surface (bin/*.sh, bin/backends/*.sh, tests/*.sh), matching bin/fm-lint.sh's canonical file set so parse scope and lint scope cannot drift apart. * no-mistakes(review): Captain: harden Bash structure and inventory guards * no-mistakes(document): Align stock macOS Bash contributor checks * no-mistakes(lint): Suppress deliberate SC2016 literal fixture warnings * test: stabilize tmux teardown conformance baseline (kunchenguid#1209) * fix(test): pin teardown tmux baseline to historical kill selectors merge-base HEAD main collapses to HEAD after the exact-selector change lands on the default branch, so the old teardown fixture was accidentally exercising current exact targets. Resolve a content-historical permissive tmux adapter from first-parent history and force that post-squash topology inside the conformance case so main and feature branches keep the same old-vs-new contract. * no-mistakes(lint): Suppress intentional literal-pattern ShellCheck warnings * docs: slim quota-array-dispatch to the pace selection core (kunchenguid#1197) Cut the runtime skill to the compact pace-aware selection procedure plus minimum owner pointers. Keep every distinct decision rule and move expanded acceptance scenarios to deterministic fixture ownership assertions. Size: 170/1374/10187 -> 63/544/4068 (about 63%/60%/60% reduction). * feat(bin): inherit backend config into secondmate homes (kunchenguid#1219) * Inherit config/backend into secondmate homes with deliberate-override preservation Add backend to the shared inheritable config allowlist so launch, locked bootstrap, and config-push converge a primary pin into secondmate homes as each home local future-spawn default. Track last-inherited bytes in a private state provenance marker so deliberate per-home overrides survive present and absent primary convergence, keep --backend and FM_BACKEND stronger, and extend the existing inheritance tests plus docs and skill claims. * no-mistakes(review): Preserve equal unprovenanced backend overrides * no-mistakes(review): Preserve symlink overrides and verify spawn precedence * no-mistakes(review): Snapshot backend inheritance for consistent provenance * no-mistakes(review): Simplify backend inheritance to primary-authoritative convergence * no-mistakes(document): Document inherited backend override preservation * fix: restore primary-authoritative backend inheritance after document regression The document step reintroduced provenance and deliberate per-home override semantics after review had simplified config/backend to plain primary-authoritative allowlist membership. Restore the primary-always-wins path: present overwrites, absent removes, no provenance marker, and docs/tests match that contract. * no-mistakes(review): Add divergent backend precedence regression fixtures * no-mistakes(document): Document backend inheritance contract * fix(pi): remove Calm's upper version ceiling (kunchenguid#1226) * fix(pi): remove Calm's exclusive Pi upper-version ceiling tests/fm-calm-pi-extension.test.sh gated on a closed PI_COMPAT_VERSIONS allowlist ("0.81.1 0.82.0") that refused any other installed Pi, and docs described that range as "supported" rather than verified evidence. The Calm CHANGELOG shows no API introduced at either version, so there is no evidence for a real minimum; the presentation adapters already probe the exact method they patch rather than checking a version. Replace the allowlist with dated version evidence that never rejects a newer Pi, and make each presentation adapter degrade independently with a diagnostic if a future Pi removes its API, instead of the whole Calm extension failing to load. Rewrite the feasibility doc's "Pi 0.81.1 through 0.82.0" phrasing to state it as verified evidence, not a ceiling. * no-mistakes(review): Probe missing Calm adapter exports safely * no-mistakes(document): Document Calm's unbounded Pi compatibility * fix(bin): allow session-local todo tools in the subagent guard (kunchenguid#1204) * fix(guard): allow session-local todo tools in the primary The delegation-shape guard denied TaskCreate and TaskUpdate because their normalized names contain the `task` stem. Those tools write only the harness's session-local todo list, which has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that outlives the session. That is not the unaccounted work the guard exists to stop, so the stem match was a false positive, and the deny text told the primary to run bin/fm-brief.sh and bin/fm-spawn.sh to create a todo entry. Add a separately-reasoned PLAN_ONLY_TOOLS exact-name exclusion rather than widening OBSERVE_ONLY_TOOLS, whose documented contract is tools that only observe or stop existing work. Both lists stay exact-name so neither can widen by substring. Tests cover the two allowed names and six near-miss names that a substring or shortened-stem widening would release; both mutations were watched red. * no-mistakes(review): drop session-local todo tools from recommended deny list * no-mistakes: apply CI fixes * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid (kunchenguid#1206) * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid fm_harness_ancestry_pid() previously returned the first ancestor process whose command matched a verified harness name. Claude Code's Stop hook fires as a bg-spare worker several levels below the session's actual lock-owning claude process (hook shell -> claude bg-spare -> claude bg-pty-host -> claude -> claude(lock)), so the first match was the bg-spare worker, not the lock owner. fm_session_lock_owned_by_self() then never matched state/.lock, and the Claude Stop auto-arm silently treated its own primary session as an unrelated live owner and never armed the watcher. The walk now keeps going past a claude-named match, looking for a still more ancestral claude-named match, and stops the instant a non-match follows an already-found match (bounding it to a contiguous run rather than the literal ancestry top, so an unrelated claude-named process further up the real process tree is never mistaken for part of this session's own nested chain). Every other harness keeps the original first-match-wins behavior, since e.g. Pi's shared signed-wrapper ancestry actually holds the session at the inner engine pid, not an outer wrapper pid. Hop limit raised from 8 to 16 to cover the deeper bg-spare chain. * no-mistakes(review): Add nested-claude-ancestry regression test; fix nudge doc depth claim * no-mistakes: apply CI fixes * fix: conferma l'avvio del watcher su Windows/MSYS (kunchenguid#1212) * fix: confirm watcher startup on MSYS * no-mistakes(review): gate MSYS arm ready timeout, cache uname, harden locale test * no-mistakes(review): validate OpenCode ready timeout, make uname cache internal * fix(spawn): forward CLAUDE_CONFIG_DIR to claude crewmates (kunchenguid#1195) * fix(spawn): forward firstmate's CLAUDE_CONFIG_DIR to claude crewmates Crewmate panes are created by a long-lived tmux/herdr daemon that does not inherit firstmate's current environment. When firstmate runs under a non-default CLAUDE_CONFIG_DIR (for example a work-vs-personal subscription split), a bare `claude` in the crewmate pane fell back to the default ~/.claude store and launched unauthenticated, blocking the crewmate before it could do any work. fm-spawn now prefixes the claude launch with firstmate's own resolved CLAUDE_CONFIG_DIR when set, so the crewmate uses the same credential/config store firstmate is authenticated with. An unset value is the single-store default and adds no prefix; non-claude harnesses are unaffected. Adds three tests in fm-spawn-dispatch-profile.test.sh (forwarded-when-set, omitted-when-unset, non-claude-ignored) and pins CLAUDE_CONFIG_DIR in the test helper so launch assertions no longer depend on the developer's environment. * no-mistakes: apply CI fixes * fix: preserve dispatch identity across authentication checks (kunchenguid#1233) * fix: preserve dispatch harness identity * no-mistakes(review): Fix Grok counterfactual tuple validation * no-mistakes(document): Scope dispatch authentication to selected tuple * fix: restore dispatch instruction budget * no-mistakes(review): Scope dispatch authentication after candidate selection * fix(bin): normalize relative durable paths (kunchenguid#1256) * fix(bin): handle dash-leading harness process names (#2) * fix: handle dash-leading harness process names * no-mistakes(review): Make dash-leading harness regression hermetic * fix: preserve secondmate reply routes across relative homes Resolve relative home, data, and state inputs before durable charter generation, and fail when caller-relative directories cannot be resolved. Use absolute paths at the related spawn, AFK daemon, and X-mode cross-process handoffs so later processes cannot reinterpret them from another working directory. * no-mistakes(review): Preserve absolute overrides and normalize relative durable paths * no-mistakes(review): Normalize relative home before deriving durable paths * no-mistakes(document): Document relative durable-path normalization * no-mistakes(review): Captain: Ignore inherited CDPATH during relative path normalization * no-mistakes(lint): Fix empty CDPATH assignments for ShellCheck * refactor(skills): make Bearings chat-only by default (kunchenguid#1136) * Add internal status skill * no-mistakes(document): register /status skill in documentation-audiences inventory * no-mistakes(lint): replace grep|wc -l with grep -c in status skill test * test: silence literal status skill patterns * Refactor bearings default to chat-only --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> * Clarify follow-up routing during validation (kunchenguid#1277) * fix: honor concrete approval for project operations (kunchenguid#1272) * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * no-mistakes(review): Align project removal preflight with approved exception * no-mistakes(document): Align project removal documentation with approved exception * fix: restore removal test byte-for-byte and preserve the default sentence tests/fm-instruction-owners.test.sh had been changed to assert different text; restore it byte-for-byte to origin/main. project-management SKILL.md's Remove section now keeps the exact default "Never issue a raw removal command from Firstmate." sentence that test still asserts, immediately followed by the already-approved captain-operation-or-scope exception, so the default and the exception both stay explicit and consistent. * no-mistakes(document): Align project-write boundary documentation * fix(skills): route new project intake through secondmate scopes (kunchenguid#1275) * Route project intake through secondmate scopes * no-mistakes(test): Guard all main-home project registry mutations * no-mistakes(document): Consolidate secondmate routing documentation * no-mistakes: apply CI fixes * Restore new-project routing scope * no-mistakes(document): Clarify secondmate routing for new-project intake * no-mistakes: apply CI fixes * fix: scope validation corrections by accepted behavior (kunchenguid#1281) * fix: scope validation corrections by accepted behavior * no-mistakes(review): Classify stale delivery evidence as an autonomous correction * test: replace source assertions with behavioral coverage (kunchenguid#1282) * test: remove source-content assertions * no-mistakes(review): Replace source assertions with runtime behavior coverage * no-mistakes(review): Isolate Kimi task temp runtime coverage * no-mistakes(document): Refresh test cleanup documentation * no-mistakes: apply CI fixes * fix(watch): escalate busy workers with no completed turn (kunchenguid#1286) * fix(watch): bound how long a busy pane may run with no completed turn A busy pane (backend busy state or the harness's rendered footer) was unconditional, unbounded proof of liveness in every escalation path, so a hung foreground tool call behind a busy signature could run for hours undetected (2026-07 hibit-agent-focus-nonsteal-r1 incident: a catastrophic- backtracking regex hung one bash call for 25h behind an unchanging "Working..." footer). FM_BUSY_TURN_MAX_SECS (default 3600s) now bounds how long a busy pane may run with no completed turn (state/<id>.turn-ended, or its spawn record before any turn has completed). Past the bound, busy_turn_over_age routes the pane through the existing wedge_timer_check, reusing the identical stale reason, escalation counter, and demand-deep-inspection marker for human inspection only - never an automatic interrupt, signal, or restart of the worker or its tool process. A completed turn resets the age. Reproduced end-to-end against the real installed Pi TUI: a foreground `sleep 999999` bash call with no timeout renders the actual busy footer, and two captures ~15s apart show the elapsed counter changing the pane hash while the same turn stays unfinished. Running the pre-fix watcher against the real captures showed it never starts a wedge timer no matter how long the pane stays busy; the fixed watcher starts and escalates the timer through the same mechanism, while the real hung process remained untouched and alive throughout. * no-mistakes(review): fix: parse enriched AFK stale reasons * no-mistakes(review): fix: preserve enriched wedges during AFK supervision * no-mistakes(review): fix: route all enriched AFK wedges * no-mistakes(document): Clarify busy-turn age supervision documentation * fix(gitignore): ignore config/ as a directory, not by exact filename (kunchenguid#1261) A name-by-name list of config/ entries silently stops ignoring any new or home-local file placed there, which makes the working tree read as dirty and blocks guarded sync paths that refuse to touch a dirty home. AGENTS.md already documents config/ as captain-private and gitignored as a category; this makes .gitignore match that contract. * fix(tests): replace source-content .gitignore assertion with behavioral coverage (kunchenguid#1304) The second assertion in fm-gitignore-config.test.sh (added by kunchenguid#1261) greps .gitignore for a specific spelling of the config/ ignore pattern. It fails on a semantically equivalent pattern like config/** and does not prove Git actually ignores anything, per the completed source-content-test audit. Replace it with a real git check-ignore control test on a generated unrelated path, and strengthen the existing directory-coverage test with generated unpredictable direct and nested config/ paths. * feat: bound and consolidate startup memory during stow (kunchenguid#1303) * Add bounded startup memory curation * no-mistakes(review): Record reproducible stow verification evidence * no-mistakes(review): Validate inherited secondmate stow evidence * no-mistakes(document): Document editable startup-memory budget propagation * feat(bin): mark crewmate and scout steers as from-firstmate A steer lands in the receiving agent's own chat, where nothing else told firstmate's instructions apart from a human typing into that pane. The gap was proven in both directions on 2026-07-26: the captain opened a crewmate pane believing it was firstmate and issued cross-lane instructions there, and a Pi crewmate at an ask-user gate addressed "Captain, ..." into its own pane and sat parked - nobody reads a crewmate pane, and a parked pipeline emits no wake, so that direction fails silently. AGENTS.md section 1 rule 4 already required workers to honor a distinction the system gave them no means to make. fm-send now applies the existing from-firstmate carrier to every text steer whose target resolves through this home's meta, not just kind=secondmate. A crewmate or scout carries the marker alone; the corr= correlation token and the parent pending-reply record stay secondmate-only, because a crewmate already answers on its own status file. Explicit backend targets and the --key path are unchanged. Command-shaped text is the one exclusion. A harness recognizes a slash command, or a codex $<skill> invocation, only at the very start of the composer line, so any prefix silently demotes it to prose. Verified on claude 2.1.220 and pi 0.82.0: with either marker shape prepended, /no-mistakes stops opening the completion popup entirely and would submit as ordinary text. Crewmate sends of that shape therefore stay unmarked and byte-identical, which also keeps every documented popup hazard out of this change's blast radius: the only bytes that move are plain text no harness parses specially. The exclusion deliberately does not reach a secondmate, whose marker is what creates its reply guarantee. The ship and scout scaffolds gain a "Who is speaking to you" section teaching the reader side: marked is firstmate, unmarked is a human who may believe the pane is firstmate, self-identify as a worker on this task before acting, and escalation is always the status file. AGENTS.md states the provenance principle once in rule 4; the away-mode stub and the secondmate charter keep their own distinct consequences. * no-mistakes(review): align brief's unmarked-message exception wording to fm-send predicate * no-mistakes(test): fix stale corr-less assertion in Pi/Herdr marker e2e * no-mistakes(document): generalize task-selector marker context to from-firstmate --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: Daniel Kuykendall IV <danielkuykendall23@gmail.com> Co-authored-by: Trillium Smith <Spiteless@gmail.com> Co-authored-by: Unknownzed <45267749+Unknownzed@users.noreply.github.com> Co-authored-by: lhalbert <lucashalbert@users.noreply.github.com> Co-authored-by: AG <ag@agw3.org> Co-authored-by: deeto15 <92119640+deeto15@users.noreply.github.com>
…spawn gate, and probe verification (#10) * feat(bin): enforce the zero-budget model rule at spawn and config-edit time The fleet's stated safety rule - "the budget for every API-key provider is ZERO ... this is a safety rule, not a preference" - was implemented as prose inside a JSON comment blob that no code read. It relied on the coordinator recalling it correctly at every intake and every failover, forever. That is load-bearing because one API key commonly reaches both free and metered models on the same provider, rendered identically in every catalogue listing (six columns, no cost column, no entitlement column). A single mistyped or well-meant model name is a charge. A separate incident had already shown the fleet will route from a plausible name without checking: a model was configured from a catalogue listing, never probed, and every dispatch to that tier failed at launch until an investigation found it. Add config/models.json (local, gitignored) as the enforced copy, plus the checks that read it: - fm-spawn refuses a model whose API-key provider is not on the verified-free allowlist, whose provider cost posture is unclassified, whose registry status is rejected or blocked, or whose concurrency cap is already met. The check sits at the first point where harness and model are both final and the last point before any mutation, so a refusal creates nothing. It is also the only gate that sees an explicit --model that bypassed the dispatch config, which bootstrap validation structurally cannot see. - bootstrap binds config/crew-dispatch.json to the registry, so a rule naming an unregistered, non-approved, or unprobed model fails at config-edit time. - fm-model-verify runs the entitlement probe and the price-drift comparison, interval-gated by observation level so the steady-state cost is one file read. Probes close stdin and run under a timeout; pi -p can otherwise hang unbounded, and a wedged probe on the session-start path would present to supervision as a stale session. Three axes are kept deliberately separate, because conflating any two of them is itself a failure mode: cost (can this call be billed), routability (is the account entitled to it), and availability (is it answering right now). A rate-limited model is unavailable, not demoted, so a transient outage cannot permanently degrade the routing table; availability lives in state/ and routing status in config/, written by different code. Enforcement is asymmetric about the registry's absence, by design. With no config/models.json the spawn check is inert and behavior is byte-identical to before, so nothing is forced on a home that never opted in; bootstrap then reports the unenforced state rather than leaving it silent. With the file present every unclear answer refuses - malformed JSON, an unsupported schema, an unclassified provider, a missing jq - because a broken safety file must never read as an absent one. The allowlist stores each price numerically rather than only a cost class, which is what makes a repricing detectable at all: a name-based allowlist is structurally blind to one, since the thing that makes a name safe is a number living in a catalogue the provider rewrites. Allowlist evidence must include a genuinely price-bearing source; a probe is deliberately not enough, because it proves the account gets an answer and says nothing about what that answer costs. The promotion system ships dormant behind a config flag and a named evidence instrument, so activation is a configuration and data change rather than a code change. Its authority is validated as a ceiling in each direction: Tier 4 to Tier 3 may be automatic, Tier 3 to Tier 2 needs captain confirmation, and Tier 1 and Tier 0 are never entered by accumulated evidence - Tier 1 is triggered by risk, not capability rank, and a spotless Tier 2 record demonstrates nothing about credential or destructive-operation judgment. config/models.json is inherited by secondmate homes alongside config/crew-dispatch.json and must not be separated from it: inheriting the rules without the registry would leave a secondmate's own crewmates outside enforcement and make every inherited model read as unregistered there. * no-mistakes(review): cost-gate probe paths, surface sweep stderr, fix test epoch * no-mistakes(document): docs: add models.json to inheritance allowlist and jq toolchain
…puted context telemetry (#11) * feat: add real context pressure telemetry * no-mistakes(review): decouple statusline display from snapshot writes, truncate percentages * no-mistakes(document): cover secondmate charter compaction trigger in fm-brief header * no-mistakes(document): record dated Claude 2.1.219 statusLine payload verification evidence * no-mistakes(review): require only trigger percentages, name missing optional telemetry fields
* feat: add fleet admission control stages 0 and 1 Adds the third layer above routing and scheduling: whether the fleet should accept another task at all right now. It ships inert - a home with no `_scheduling.admission_control` policy sees no behavior change and pays one cheap config read. The defining constraint is task independence. Admission reads only the fleet snapshot, never the incoming task, so the same snapshot returns the same band for every task; `bin/fm-admission.sh` enforces that structurally by refusing a task argument. Anything that varies per task stays in routing or scheduling. - `bin/fm-admission-lib.sh` is the single owner of the executable schema check, shared by bootstrap's startup diagnostic and the evaluator so the two cannot drift on the same config bytes. Unknown fields are refused rather than ignored, so a typo cannot silently disable a safety condition, and every rule from the accepted design refuses with an actionable reason. - `bin/fm-admission.sh` composes the existing read-only fleet snapshot into named signals, each with its own validity, and combines them into a preferred/soft/hard/unknown band. Every rule names the observed value, its source and freshness, the exact JSON config path, the configured value, and the resulting band. Exit status is the band, so a caller that ignores the output still stops safely. - Backlog consistency is a signal separate from worker-census integrity. A backlog row that contradicts task metadata is a bookkeeping fault to repair, not evidence of physical saturation; one aggregate health bit would close the fleet for the wrong reason. - The existing per-home session lock is the single-primary admission authority. No new process, daemon, reservation store, or second queue: deferred and refused requests stay in the owning backlog under a `load` hold, and capacity is re-examined at the two existing seams, successful cleanup and session start. - Nothing numeric enforces. Only the deterministic safety conditions - authority, census integrity, snapshot freshness - can set a band, and the schema refuses a configuration that tries to enable a threshold whose predictive value is unmeasured. Active workers, load-hold depth, and worker breakdown are recorded as observations with no cap. - Signals with no collector are recorded as unmeasured rather than assumed to be zero, and admission wait age stays explicitly uncollected because backlog age is task age. - The decision record is the named extension seam for the wake-outcome ledger, which does not expose one yet; nothing is persisted and no competing evidence store is opened. Dormant distributed machinery (reservations, remote nodes, a second intake authority) is settled as a validated schema contract rather than running code, so activating it later cannot change admission's semantics. `tests/fm-gotmp.test.sh` gains the new teardown dependency in its fake root, matching how its other sourced libs are already linked. * no-mistakes(review): fail closed on unmeasurable snapshot age; tighten band and trigger validation * no-mistakes(document): classify fleet-admission skill; fix bootstrap verbose-fact claim * test(fm-backend): copy fm-admission-lib.sh into the synthetic old bin test_teardown_conformance_old_vs_new pins BASE_REF=HEAD when building the old-bin fixture, so its "old" fm-teardown.sh is HEAD's teardown, which now sources fm-admission-lib.sh. The lib was missing from OLD_BIN_UNCHANGED_SIBLINGS, so the old teardown aborted at source time. Mirror teardown's real dependency set, exactly like its other sourced libs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(bin): add verified pi-signed runtime adapter (kunchenguid#1145) * feat: add verified pi-signed adapter * no-mistakes(review): Correct pi-signed maintainer verification date * no-mistakes(review): Correct remaining pi-signed verification dates * no-mistakes(review): Preserve authoritative pi-signed runtime identity * no-mistakes(document): Document pi-signed shared adapter semantics * no-mistakes: apply CI fixes * fix(pi): rearm watcher across session transitions (kunchenguid#1166) * fix(pi): rearm watcher across same-process session transitions Pi emits session_shutdown for ordinary /new, /resume, and /fork replacement as well as terminal quit. The primary watcher extension latched a module-level stopping flag on every shutdown, so a replacement session in the same process could not arm monitoring until Pi restarted. Own arm authority per session generation so only the active live generation may start, stop, or rearm the child. Replacement sessions can arm again without restarting Pi, stale prior-generation callbacks cannot mutate the active cycle, and real quit still blocks late rearm. * no-mistakes(review): Preserve Pi generation isolation and exit cleanup * no-mistakes(document): Correct Pi watcher transition documentation * feat: route crew dispatch using quota-window pace (kunchenguid#1172) * Consume quota-axi pace signals in dispatch profile array selection. Add quota-array-dispatch as the single owner of the pace-aware candidate choice, keep AGENTS.md to the intake boundary and load trigger, and cover the acceptance cases with sanitized schemaVersion 3 fixtures. * no-mistakes(review): Stop and report genuine quota dispatch ties * no-mistakes(document): Document quota pace freshness and uncertainty * fix: adapt Grok Stop continuation and harden endpoint cleanup (kunchenguid#1171) * fix(grok): adapt Stop continuation to runtime capability * no-mistakes(review): Reject ambiguous Grok Stop payloads * no-mistakes(review): Reject duplicate Grok fields and accept spaced tmux sessions * no-mistakes(review): Enforce exact tmux cleanup selectors * no-mistakes(test): Fix historical tmux fixture and validate Grok Stop * no-mistakes: apply CI fixes * fix: restore stock macOS Bash 3.2 brief scaffolding (kunchenguid#1093) * fix(brief): make DOD scaffolding parse-safe on stock macOS Bash 3.2 fm-brief.sh built each Definition-of-done block and the not-enabled Herdr declaration with `VAR=$(cat <<EOF ... EOF)`. On Bash 3.2 (macOS /bin/bash) the lexer scans for the command substitution's closing `)` textually and tracks quote state through the heredoc body, so a single apostrophe, unbalanced quote, or unbalanced paren in that prose breaks parsing of the whole script. Every ship-brief scaffold (no-mistakes, direct-PR, local-only) failed with `unexpected EOF while looking for matching )`. Bash 4+ parses it fine, so the breakage stayed invisible everywhere except stock macOS. Replace all four command-substitution heredocs with `IFS= read -r -d '' VAR <<EOF || true`. That removes the `$(...)` wrapper and the entire defect class regardless of future prose, and preserves the variable expansion the direct-PR and local-only bodies need. `read` keeps the heredoc's trailing newline that `$(...)` used to strip, so trim one newline to keep every generated brief byte-identical to prior output. Guard the structure, not one historical phrase: a new test rejects any heredoc nested in a command substitution anywhere in fm-brief.sh, where the old assertion pinned a single apostrophe phrase and so missed the reintroduction. Extend the stock-macOS Bash CI job from parsing one script to the whole maintained shell surface (bin/*.sh, bin/backends/*.sh, tests/*.sh), matching bin/fm-lint.sh's canonical file set so parse scope and lint scope cannot drift apart. * no-mistakes(review): Captain: harden Bash structure and inventory guards * no-mistakes(document): Align stock macOS Bash contributor checks * no-mistakes(lint): Suppress deliberate SC2016 literal fixture warnings * test: stabilize tmux teardown conformance baseline (kunchenguid#1209) * fix(test): pin teardown tmux baseline to historical kill selectors merge-base HEAD main collapses to HEAD after the exact-selector change lands on the default branch, so the old teardown fixture was accidentally exercising current exact targets. Resolve a content-historical permissive tmux adapter from first-parent history and force that post-squash topology inside the conformance case so main and feature branches keep the same old-vs-new contract. * no-mistakes(lint): Suppress intentional literal-pattern ShellCheck warnings * docs: slim quota-array-dispatch to the pace selection core (kunchenguid#1197) Cut the runtime skill to the compact pace-aware selection procedure plus minimum owner pointers. Keep every distinct decision rule and move expanded acceptance scenarios to deterministic fixture ownership assertions. Size: 170/1374/10187 -> 63/544/4068 (about 63%/60%/60% reduction). * feat(bin): inherit backend config into secondmate homes (kunchenguid#1219) * Inherit config/backend into secondmate homes with deliberate-override preservation Add backend to the shared inheritable config allowlist so launch, locked bootstrap, and config-push converge a primary pin into secondmate homes as each home local future-spawn default. Track last-inherited bytes in a private state provenance marker so deliberate per-home overrides survive present and absent primary convergence, keep --backend and FM_BACKEND stronger, and extend the existing inheritance tests plus docs and skill claims. * no-mistakes(review): Preserve equal unprovenanced backend overrides * no-mistakes(review): Preserve symlink overrides and verify spawn precedence * no-mistakes(review): Snapshot backend inheritance for consistent provenance * no-mistakes(review): Simplify backend inheritance to primary-authoritative convergence * no-mistakes(document): Document inherited backend override preservation * fix: restore primary-authoritative backend inheritance after document regression The document step reintroduced provenance and deliberate per-home override semantics after review had simplified config/backend to plain primary-authoritative allowlist membership. Restore the primary-always-wins path: present overwrites, absent removes, no provenance marker, and docs/tests match that contract. * no-mistakes(review): Add divergent backend precedence regression fixtures * no-mistakes(document): Document backend inheritance contract * fix(pi): remove Calm's upper version ceiling (kunchenguid#1226) * fix(pi): remove Calm's exclusive Pi upper-version ceiling tests/fm-calm-pi-extension.test.sh gated on a closed PI_COMPAT_VERSIONS allowlist ("0.81.1 0.82.0") that refused any other installed Pi, and docs described that range as "supported" rather than verified evidence. The Calm CHANGELOG shows no API introduced at either version, so there is no evidence for a real minimum; the presentation adapters already probe the exact method they patch rather than checking a version. Replace the allowlist with dated version evidence that never rejects a newer Pi, and make each presentation adapter degrade independently with a diagnostic if a future Pi removes its API, instead of the whole Calm extension failing to load. Rewrite the feasibility doc's "Pi 0.81.1 through 0.82.0" phrasing to state it as verified evidence, not a ceiling. * no-mistakes(review): Probe missing Calm adapter exports safely * no-mistakes(document): Document Calm's unbounded Pi compatibility * fix(bin): allow session-local todo tools in the subagent guard (kunchenguid#1204) * fix(guard): allow session-local todo tools in the primary The delegation-shape guard denied TaskCreate and TaskUpdate because their normalized names contain the `task` stem. Those tools write only the harness's session-local todo list, which has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that outlives the session. That is not the unaccounted work the guard exists to stop, so the stem match was a false positive, and the deny text told the primary to run bin/fm-brief.sh and bin/fm-spawn.sh to create a todo entry. Add a separately-reasoned PLAN_ONLY_TOOLS exact-name exclusion rather than widening OBSERVE_ONLY_TOOLS, whose documented contract is tools that only observe or stop existing work. Both lists stay exact-name so neither can widen by substring. Tests cover the two allowed names and six near-miss names that a substring or shortened-stem widening would release; both mutations were watched red. * no-mistakes(review): drop session-local todo tools from recommended deny list * no-mistakes: apply CI fixes * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid (kunchenguid#1206) * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid fm_harness_ancestry_pid() previously returned the first ancestor process whose command matched a verified harness name. Claude Code's Stop hook fires as a bg-spare worker several levels below the session's actual lock-owning claude process (hook shell -> claude bg-spare -> claude bg-pty-host -> claude -> claude(lock)), so the first match was the bg-spare worker, not the lock owner. fm_session_lock_owned_by_self() then never matched state/.lock, and the Claude Stop auto-arm silently treated its own primary session as an unrelated live owner and never armed the watcher. The walk now keeps going past a claude-named match, looking for a still more ancestral claude-named match, and stops the instant a non-match follows an already-found match (bounding it to a contiguous run rather than the literal ancestry top, so an unrelated claude-named process further up the real process tree is never mistaken for part of this session's own nested chain). Every other harness keeps the original first-match-wins behavior, since e.g. Pi's shared signed-wrapper ancestry actually holds the session at the inner engine pid, not an outer wrapper pid. Hop limit raised from 8 to 16 to cover the deeper bg-spare chain. * no-mistakes(review): Add nested-claude-ancestry regression test; fix nudge doc depth claim * no-mistakes: apply CI fixes * fix: conferma l'avvio del watcher su Windows/MSYS (kunchenguid#1212) * fix: confirm watcher startup on MSYS * no-mistakes(review): gate MSYS arm ready timeout, cache uname, harden locale test * no-mistakes(review): validate OpenCode ready timeout, make uname cache internal * fix(spawn): forward CLAUDE_CONFIG_DIR to claude crewmates (kunchenguid#1195) * fix(spawn): forward firstmate's CLAUDE_CONFIG_DIR to claude crewmates Crewmate panes are created by a long-lived tmux/herdr daemon that does not inherit firstmate's current environment. When firstmate runs under a non-default CLAUDE_CONFIG_DIR (for example a work-vs-personal subscription split), a bare `claude` in the crewmate pane fell back to the default ~/.claude store and launched unauthenticated, blocking the crewmate before it could do any work. fm-spawn now prefixes the claude launch with firstmate's own resolved CLAUDE_CONFIG_DIR when set, so the crewmate uses the same credential/config store firstmate is authenticated with. An unset value is the single-store default and adds no prefix; non-claude harnesses are unaffected. Adds three tests in fm-spawn-dispatch-profile.test.sh (forwarded-when-set, omitted-when-unset, non-claude-ignored) and pins CLAUDE_CONFIG_DIR in the test helper so launch assertions no longer depend on the developer's environment. * no-mistakes: apply CI fixes * fix: preserve dispatch identity across authentication checks (kunchenguid#1233) * fix: preserve dispatch harness identity * no-mistakes(review): Fix Grok counterfactual tuple validation * no-mistakes(document): Scope dispatch authentication to selected tuple * fix: restore dispatch instruction budget * no-mistakes(review): Scope dispatch authentication after candidate selection * fix(bin): normalize relative durable paths (kunchenguid#1256) * fix(bin): handle dash-leading harness process names (#2) * fix: handle dash-leading harness process names * no-mistakes(review): Make dash-leading harness regression hermetic * fix: preserve secondmate reply routes across relative homes Resolve relative home, data, and state inputs before durable charter generation, and fail when caller-relative directories cannot be resolved. Use absolute paths at the related spawn, AFK daemon, and X-mode cross-process handoffs so later processes cannot reinterpret them from another working directory. * no-mistakes(review): Preserve absolute overrides and normalize relative durable paths * no-mistakes(review): Normalize relative home before deriving durable paths * no-mistakes(document): Document relative durable-path normalization * no-mistakes(review): Captain: Ignore inherited CDPATH during relative path normalization * no-mistakes(lint): Fix empty CDPATH assignments for ShellCheck * refactor(skills): make Bearings chat-only by default (kunchenguid#1136) * Add internal status skill * no-mistakes(document): register /status skill in documentation-audiences inventory * no-mistakes(lint): replace grep|wc -l with grep -c in status skill test * test: silence literal status skill patterns * Refactor bearings default to chat-only --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> * Clarify follow-up routing during validation (kunchenguid#1277) * fix: honor concrete approval for project operations (kunchenguid#1272) * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * no-mistakes(review): Align project removal preflight with approved exception * no-mistakes(document): Align project removal documentation with approved exception * fix: restore removal test byte-for-byte and preserve the default sentence tests/fm-instruction-owners.test.sh had been changed to assert different text; restore it byte-for-byte to origin/main. project-management SKILL.md's Remove section now keeps the exact default "Never issue a raw removal command from Firstmate." sentence that test still asserts, immediately followed by the already-approved captain-operation-or-scope exception, so the default and the exception both stay explicit and consistent. * no-mistakes(document): Align project-write boundary documentation * fix(skills): route new project intake through secondmate scopes (kunchenguid#1275) * Route project intake through secondmate scopes * no-mistakes(test): Guard all main-home project registry mutations * no-mistakes(document): Consolidate secondmate routing documentation * no-mistakes: apply CI fixes * Restore new-project routing scope * no-mistakes(document): Clarify secondmate routing for new-project intake * no-mistakes: apply CI fixes * fix: scope validation corrections by accepted behavior (kunchenguid#1281) * fix: scope validation corrections by accepted behavior * no-mistakes(review): Classify stale delivery evidence as an autonomous correction * test: replace source assertions with behavioral coverage (kunchenguid#1282) * test: remove source-content assertions * no-mistakes(review): Replace source assertions with runtime behavior coverage * no-mistakes(review): Isolate Kimi task temp runtime coverage * no-mistakes(document): Refresh test cleanup documentation * no-mistakes: apply CI fixes * fix(watch): escalate busy workers with no completed turn (kunchenguid#1286) * fix(watch): bound how long a busy pane may run with no completed turn A busy pane (backend busy state or the harness's rendered footer) was unconditional, unbounded proof of liveness in every escalation path, so a hung foreground tool call behind a busy signature could run for hours undetected (2026-07 hibit-agent-focus-nonsteal-r1 incident: a catastrophic- backtracking regex hung one bash call for 25h behind an unchanging "Working..." footer). FM_BUSY_TURN_MAX_SECS (default 3600s) now bounds how long a busy pane may run with no completed turn (state/<id>.turn-ended, or its spawn record before any turn has completed). Past the bound, busy_turn_over_age routes the pane through the existing wedge_timer_check, reusing the identical stale reason, escalation counter, and demand-deep-inspection marker for human inspection only - never an automatic interrupt, signal, or restart of the worker or its tool process. A completed turn resets the age. Reproduced end-to-end against the real installed Pi TUI: a foreground `sleep 999999` bash call with no timeout renders the actual busy footer, and two captures ~15s apart show the elapsed counter changing the pane hash while the same turn stays unfinished. Running the pre-fix watcher against the real captures showed it never starts a wedge timer no matter how long the pane stays busy; the fixed watcher starts and escalates the timer through the same mechanism, while the real hung process remained untouched and alive throughout. * no-mistakes(review): fix: parse enriched AFK stale reasons * no-mistakes(review): fix: preserve enriched wedges during AFK supervision * no-mistakes(review): fix: route all enriched AFK wedges * no-mistakes(document): Clarify busy-turn age supervision documentation * fix(gitignore): ignore config/ as a directory, not by exact filename (kunchenguid#1261) A name-by-name list of config/ entries silently stops ignoring any new or home-local file placed there, which makes the working tree read as dirty and blocks guarded sync paths that refuse to touch a dirty home. AGENTS.md already documents config/ as captain-private and gitignored as a category; this makes .gitignore match that contract. * fix(tests): replace source-content .gitignore assertion with behavioral coverage (kunchenguid#1304) The second assertion in fm-gitignore-config.test.sh (added by kunchenguid#1261) greps .gitignore for a specific spelling of the config/ ignore pattern. It fails on a semantically equivalent pattern like config/** and does not prove Git actually ignores anything, per the completed source-content-test audit. Replace it with a real git check-ignore control test on a generated unrelated path, and strengthen the existing directory-coverage test with generated unpredictable direct and nested config/ paths. * feat: bound and consolidate startup memory during stow (kunchenguid#1303) * Add bounded startup memory curation * no-mistakes(review): Record reproducible stow verification evidence * no-mistakes(review): Validate inherited secondmate stow evidence * no-mistakes(document): Document editable startup-memory budget propagation * fix(herdr): place workers in the launching workspace (kunchenguid#1328) * fix(herdr): place workers in the launching agent's exact workspace Herdr enforces no workspace-label uniqueness, and spawn resolved its container by taking the FIRST workspace whose label matched the home label. With two workspaces both labeled "firstmate", a worker launched from the second one was created in the first, so it appeared in a different space than the Firstmate the captain was watching. Reproduced end to end on Herdr 0.7.5 protocol 17 by running the real bin/fm-spawn.sh inside a launcher pane in the second "firstmate" workspace: the worker landed in w1 while its launcher was in w2, with an unrelated third workspace focused throughout, which also rules out any dependence on the focused workspace. Placement now binds to the launching process's own Herdr identity. Herdr injects HERDR_PANE_ID, HERDR_SESSION, and HERDR_SOCKET_PATH into every process it manages a pane for, and fm_backend_herdr_launcher_identity resolves that pane's current owning tab and workspace live from Herdr, cross-checking the pane against its tab and confirming the workspace exists exactly once in the session. The injected HERDR_TAB_ID and HERDR_WORKSPACE_ID are creation-time snapshots and are deliberately not read as current identity. Labels are no longer placement authority. A claimed parent identity that is unreadable, contradictory, stale, or from another named session or Herdr server stops the spawn before any worker endpoint exists, rather than degrading to a label search. A launcher with no Herdr ancestry has no workspace to inherit and keeps the per-home labeled container, which must now resolve to exactly one workspace; two same-labeled candidates refuse instead of adopting either. A --secondmate launch keeps standing up that home's own workspace by design. With presentation spaces enabled, the projected child is created and bound under that same exact parent and anchors its ordering on it, so a duplicated home label no longer makes the layout ambiguous. Projection, focus restoration, restart binding, and quarantine rules are unchanged, and children are never collapsed into the parent. tmux, Zellij, cmux, Orca, and the away-mode daemon terminal were each inspected and are not affected: none resolves a container by searching mutable labels. tests/fm-backend-herdr-launcher-workspace-e2e.test.sh drives the real spawn and teardown against an isolated Herdr lab, with its headline case running fm-spawn.sh inside a real Herdr pane so the identity comes from Herdr's own injection. The refusal matrix and the ordering anchor are covered deterministically in tests/fm-backend-herdr.test.sh. Eight existing real-Herdr suites inherited the developer terminal's own Herdr pane into their isolated lab sessions, which the new cross-session check correctly refuses. tests/herdr-test-safety.sh now owns herdr_forget_inherited_pane and those suites call it, so what they assert no longer depends on where they were launched from. Two unrelated fixes found along the way. tests/fm-secondmate-harness.test.sh had the same class of environment leak through CLAUDECODE, which outranks PI_CODING_AGENT in bin/fm-harness.sh and made its pi-signed ancestry case resolve "claude" whenever the suite ran inside Claude Code. And fm-spawn.sh's usage() printed a fixed line range that had already been truncating its own help mid-sentence. * no-mistakes(review): Enforce exact Herdr launcher and projection identity * no-mistakes(document): Document exact Herdr launcher workspace placement * fix(calm): refine Calm working boat animation (kunchenguid#1339) * feat(calm): replace Pi's working row with an animated ship while Calm is on While Calm is active and one logical agent run is under way, Calm now hides Pi's built-in working row and renders a small two-row SSHHIP-derived boat in its place. When Calm is off, Pi's stock working row is left untouched. The presentation uses only public Pi extension API: setWorkingVisible(false) plus a temporary setWidget() component whose render(width) owns the responsive geometry and whose timer requests a TUI render. Visibility follows agent_start through agent_settled, so the boat does not flicker between tool calls, automatic continuations, retries, or compaction inside the same run, and settle, abort, and failure all reach the same cleanup. fm-calm.ts stays the sole owner of the presentation choice and the only caller of setWorkingVisible(); the new lib owns the sprite geometry and widget. * no-mistakes(review): Guarded Calm-off lifecycle visibility writes; focused tests pass * no-mistakes(test): Fixed Calm E2E wait to include tmux scrollback * no-mistakes(document): Document Calm working boat behavior * no-mistakes: apply CI fixes * feat(calm): slow the Calm boat, animate blue water, and make the sail directional The boat now moves one column every 880ms while a bounded fixed-cell water phase advances every 220ms, so the water ripples several times between boat steps and the presentation reads as calm. One scheduler drives both clocks and disposing the widget stops them together; ticks rather than wall-clock timestamps drive every state change, so tests seek animation time exactly. Colors are standard ANSI foreground codes instead of theme lookups: blue for every water cell and yellow for the complete boat, each run closed with a default-foreground reset so nothing bleeds into padding or later frames. ANSI bytes never enter geometry, so visible width stays exact. The mainsail is directional and trails aft of the mast: <| travelling right and |> travelling left. Direction reverses the moment the boat lands on an endpoint, so the endpoint frame already shows the new heading and no frame at or after a bounce shows the previous sail. * test(calm): wait for the Ctrl+O expansion redraw this block asserts * docs(calm): record the revised working-presentation verification evidence * no-mistakes(document): Fix Calm feasibility document EOF whitespace * fix(dispatch): preflight candidate auth before quota escalation (kunchenguid#1349) * fix(dispatch): scope candidate authentication to its own surface A locally expired timestamp in one credential store was reported to the captain as a sign-out, including for dispatch candidates that never read that store. A `harness=pi, model=xai/grok-*` candidate authenticates through Pi's own xAI credential, but the only Grok quota reading available was gated on the standalone Grok CLI's separate token, whose expiry clock drifts independently. The always-loaded intake rule then turned that unreadable quota into a mandatory captain escalation. Add `bin/fm-auth-preflight.sh` as the deterministic owner of the parts that must not depend on agent memory: it resolves a tuple's authentication surface from quota-axi's own emitted auth sources rather than from a harness or model name, so another harness's CLI can never gate a candidate that does not use it. A vendor CLI is launched only when the tuple's own harness owns the credential store under test and a non-destructive discovery command is registered for it, which today is `grok models` alone. That probe runs at most once with stdin closed and a hard timeout, reads its verdict from the first stdout line because the command exits 0 either way, treats unrecognized output as indeterminate, and never invokes login, logout, or the interactive TUI. Quota is read at most twice, and unknown headroom never makes a candidate ineligible on its own. Update the dispatch procedure to match: usable authentication with unmeasurable headroom stays eligible at lower preference with the unknown disclosed, and stop-and-report is reserved for unresolved authentication, an unresolved relationship, or malformed configuration. Record that Grok's `credits.remaining` is a prepaid balance rather than window headroom. Gate quota-axi at 0.1.16 in bootstrap, the first build reporting per-credential auth sources. A stale install previously passed the presence check silently, which is why a fix published two days earlier was still not in effect. Replace the orphaned quota-array-dispatch fixtures, which encoded a `provider: "xai"` shape the tool never emits and had no consumer, with fixtures shaped like real 0.1.16 output that the new suite drives the script against. The suite asserts the verdict and, separately, which vendor CLIs were launched, so a Pi/xAI candidate reaching the Grok CLI fails. Map `tests/fixtures/<dir>` to its consuming suite so a fixture change selects the right tests instead of refusing. * refactor(bootstrap): give the quota-axi floor one owner The floor was stated twice - once in bootstrap's gate and once inline in the auth preflight - so bumping it needed two edits that could drift. Move it to bin/fm-quota-axi-lib.sh alongside its rationale, matching the existing tasks-axi library, and derive the comparison from the constant so the number appears exactly once. Bootstrap turns a failing check into the operator diagnostic; the preflight refuses to emit an unscoped verdict. Map the new library to both consuming suites so a bump re-runs them, and record that any usable source means the surface authenticates. * no-mistakes(review): Captain: bound quota checks and removed Python dependency * no-mistakes(review): Captain: enforce conservative headroom and exact preflight retry * no-mistakes(review): Captain: preserve OpenCode eligibility without auth-surface guessing * no-mistakes(review): Captain: reject malformed OpenCode model relationships * no-mistakes(review): Captain: exempt verified unmodeled tuples from intake escalation * no-mistakes(document): Updated dispatch authentication documentation * no-mistakes: apply CI fixes * feat(x-mode): reconcile promised public replies deterministically (kunchenguid#1350) * feat(x-mode): reconcile promised public replies deterministically A promised final reply in an X or Discord thread was only kept while the primary remembered it. Compaction or restart erased that memory, so a typed public-followup obligation could sit at pending-work after its PR merged and the original thread never got its reply. Make the promise durable state instead: - bin/fm-public-followup-emit.sh reports a typed terminal work result (source home, work id, generation, outcome, safe deliverables, bounded public-safe text) into the owning home's private inbox. The event id is derived from that identity tuple, so duplicate reports and restart replay converge with no coordination, and nothing ever parses a free-form done: sentence. - bin/fm-public-followup.sh registers a commitment, reconciles events through tasks-axi public-followup, and runs the idempotent delivery sequence (begin-delivery with the payload hash, post, record the posted receipt or a typed error) against the stored platform and opaque thread binding. A delivery interrupted between post and receipt refuses rather than risk a second public reply. - Session start surfaces unresolved commitments from disk, the existing relay poll surfaces a new terminal-result set once, and teardown refuses while this home still owes a public reply for that exact work. tasks-axi public-followup remains the only owner of the obligation state machine, state/x-context/ the only owner of the private request context, and fm-x-reply.sh the only thing that posts. Its new optional --receipt-file is the one addition there, so a caller can record how many messages were sent. A home that never opted into the myfirstmate relay gates out on a single [ -f "$FM_HOME/.env" ] test: no tasks-axi call, no backlog or context scan, no output, and no artifact. Evidence in docs/verification/public-followup.md. * no-mistakes(review): Hardened public-followup reconciliation and ownership guards * no-mistakes(review): Hardened typed terminal cleanup and receipt reconciliation * no-mistakes(review): Automated typed-delivery cleanup and strict backlog validation * no-mistakes(review): Fail-closed parent resolution and registration-safe delivery * no-mistakes(review): Harden relay gating and validate secondmate bindings * no-mistakes(review): Use owner-aware single-gate teardown protection * no-mistakes(document): Correct public-followup documentation drift * no-mistakes(lint): Quote done literals to fix ShellCheck warnings * no-mistakes: apply CI fixes * feat(bin): replace busy heuristics with semantic lifecycle state (kunchenguid#1327) * feat: add semantic busy-state contract owner and event writer One owner (bin/fm-busy-lib.sh) for the captain-approved semantic busy-state redesign: a per-task gen-bound record written only by bin/fm-busy-event.sh, per-harness trusted-source classification with explicit source attribution, busy/idle/unknown/dead semantics where missing, malformed, stale, or untrusted semantic data is unknown - never idle - and endpoint death is the only process-level override. The Grok-only rendered-tail fallback and the standalone-Kimi verification gate live behind the same classifier. * feat: arm busy-state at spawn and convert Pi to the semantic extension path fm-spawn arms the busy-state contract for converted adapters and seeds busy/fm-spawn (the launch brief is a submitted turn). The Pi/pi-signed per-task extension now reports agent_start -> busy and agent_settled -> idle confirmed by ctx.isIdle(), covering auto-retries, compaction retries, tool loops, and queued continuations, while turn_end stays a wake notification touch. Teardown removes the new record, gen sidecar, and lock. Live-verified on Pi 0.82.0: seed -> agent-start busy -> agent-settled idle with the marker still touched. * feat: convert OpenCode to the semantic session.status plugin path The per-task plugin (renamed .opencode/plugins/fm-busy-state.js) now classifies from OpenCode's semantic session.status events - busy and retry are active, idle is inactive - latched to the worker's own session so a subagent child session can never clear the worker's busy state. The session.idle marker touch stays a wake notification. Teardown removes both the new and the legacy plugin filenames. Live-verified on OpenCode 1.17.18 in a real TUI pane: seed -> session-busy -> session-status-idle. * feat: convert Claude to the full lifecycle hooks path The per-task settings.local.json now wires UserPromptSubmit -> busy and Stop, StopFailure, and SessionEnd -> idle, so API-error and shutdown turn ends can never strand a busy record; Stop keeps the turn-ended notification touch. A refused (stale-gen) event exits 0 and stays silent so Claude's own lifecycle is never broken. Live-verified on Claude Code 2.1.220: UserPromptSubmit fires for the argv launch prompt, Stop closes each turn, a mid-stream Escape interrupt fires no closing hook, and the firstmate-controlled idle/fm-interrupt clear resolves it. * feat: gate Codex busy state behind verified semantic sources The approved contract prefers Codex's app-server turn lifecycle with capability negotiation and sanctions its lifecycle hooks as the intermediate. Live probes on codex-cli 0.145.0 show neither is usable for a pane worker: the app-server daemon is unreachable for a TUI thread and refuses to start outside the managed standalone install, and firstmate-written project hooks never fired (interactive with directory trust granted, and exec, both with --dangerously-bypass-hook-trust) while global hooks fired in the same runs. Codex therefore classifies unknown codex-unverified behind an explicit probe rather than falling back to idle or footer text, and fm-spawn installs no unverified Codex wiring. * feat: gate standalone Kimi busy state on live verification Standalone Kimi has no installed binary here, so per the approved contract its semantic path stays guarded and it classifies unknown kimi-unverified rather than idle - and never from its locale-sensitive moon-phase spinner, which the redesign forbids inventing as a state source. The gate records the preferred source order (Wire prompt request lifetime, which brackets a turn and reports cancellation, then the documented hooks including Interrupt because Stop does not fire on interrupts) and the exact evidence required to open it. Arming without wiring would seed a busy record nothing could clear, so both land together behind the same gate. * feat: route busy consumers through the contract and drop the global OR The watcher, crew-state reader, and away-mode daemon now decide busy state through bin/fm-busy-lib.sh: only an exact busy verdict counts as working, and unknown never becomes working or a silent idle, so a crew whose semantic state is missing, malformed, stale, or unverified surfaces instead of being absorbed. Crew-state reports the producing source in its detail. The watcher's global OR regex default is gone; Grok keeps its isolated fallback inside the contract. The daemon's supervisor-pane reader stays rendered-text - that pane is not a recorded task - but is now scoped to firstmate's own detected harness instead of every vendor signature. Secondmate pending-reply observation is deliberately unchanged and documented as a delivery-confirmation signal, not task state. * docs: point busy-state documentation at the single contract owner Adds a maintainer-architecture section naming bin/fm-busy-lib.sh as the owner of what busy means, with per-adapter sources, the unknown-never-idle rule, the endpoint-death override, and the two rendered-text readers that deliberately stay outside the contract. Replaces the stale regex-first prose in architecture, tmux-backend, herdr-backend, and configuration; converts the harness-adapters per-harness rows from UI signatures to the semantic source each harness uses; and records the live verification evidence, including why Codex and standalone Kimi stay unknown. * fix: arm away-launch signal handlers before acquiring the lifecycle lock fm_afk_launch_main acquired its lock and only then installed the EXIT, INT, and TERM traps. A signal arriving in that window terminated the process by default action and left the lock directory behind, which blocks the next away-mode launch until the stale-owner reclaim path clears it. The release helper only removes a lock this process owns, so the handlers are now armed first. The accompanying test also killed the child whether or not the lock had appeared and sampled cleanup the instant wait returned; it now requires the lock, then allows a bounded settle, so it proves the guarantee instead of racing it. * test: align fleet, Kimi, lifecycle, and detection suites with the contract The fleet snapshot and wake-daemon lifecycle fixtures now prove a working crew through its own semantic busy-state record instead of rendered pane text, which is what those consumers read. The Kimi watcher test asserts the approved contract directly: a standalone Kimi task classifies unknown rather than matching its moon-phase spinner, while Grok's isolated fallback still classifies only Grok. The pi-signed detection cases clear ambient harness markers, fixing a pre-existing failure where the running session's own CLAUDECODE outranked the fixture's marker. * fix: stop teardown from deleting a project's own Codex hooks file An intermediate revision wired Codex through a firstmate-written <worktree>/.codex/hooks.json, and teardown removed it alongside the other generated wiring. The Codex wiring was dropped when its probes came back unverified, so that removal now targets a file firstmate never creates - and a project may legitimately track its own .codex/hooks.json, which teardown would then delete from a pooled worktree. * fix: keep busy-record parsing from disturbing its sourcing caller The record parser split fields with set -- under a temporary noglob, which clobbers a sourcing caller's positional parameters and restores glob expansion even when the caller had disabled it. The watcher, the daemon, and the crew-state reader all source this library, so it now reads fields with read -a, which never globs and never touches caller state. * docs: state exactly which Claude hook paths were reproduced live The busy-state record listed all four wired Claude hooks in the source column, which could read as a claim that every one fired during the pass. UserPromptSubmit and Stop did; StopFailure and SessionEnd are wired from hook names confirmed present in the installed binary, but the abnormal turn ends they cover were not reproduced. * test: let reset_fakes own the crew-state busy-text fixture lifecycle The Grok fallback case set FM_FAKE_BUSY_TEXT and cleared it inline, so the variable's lifetime was owned by one test rather than by the shared reset that every other fake already uses. * no-mistakes(review): Fix semantic busy-state lifecycle races * no-mistakes(review): Make busy-state retirement idempotent * no-mistakes(review): Enforce semantic state boundaries for status and injection * no-mistakes(review): Restore harness-scoped away-mode busy guard * no-mistakes(document): Refresh semantic busy-state documentation * no-mistakes: apply CI fixes * fix: preserve Calm boat continuity across working periods (kunchenguid#1356) * fix(calm): resume working boat from frozen column across runs Keep one extension-owned boat animation for the Pi session so settling freezes column and direction, the next working period resumes there without hidden-time jumps, and only a fresh session resets to the left edge. * no-mistakes(review): Freeze Calm boat from last rendered state * no-mistakes(document): Document Calm boat continuity contract * fix: restore evidence-based dispatch eligibility (kunchenguid#1358) * fix(dispatch): judge candidate provider relations instead of rejecting them Firstmate deterministically dropped supported Pi candidates in the openai-codex family. bin/fm-auth-preflight.sh resolved a harness=pi tuple's credential surface by constructing the source id `pi:<model-prefix>`, so `pi + openai-codex/gpt-5.6-terra` looked for a `pi:openai-codex` source. That source does not exist, because Pi's Codex family authenticates through the Codex store quota-axi already lists as `auth-json`/`cli-rpc`. The tuple returned `eligible=no reason=surface-unresolved` while the Pi catalog listed the model and the Codex provider reported fresh, usable credentials with 64 effective percent remaining on its all-model scope. The prefix construction was only ever valid where Pi holds its own credential (`pi:xai`, `pi:kimi-coding`), which is why every previously configured Pi tuple resolved and the defect stayed hidden until a Codex-family Pi model was configured. Retire dispatch eligibility from deterministic shell. The dispatching first mate now establishes model support and provider family from each harness's authoritative catalog, applies quota at the granularity the vendor supplies, and shows that reasoning. Provider-level and all-model evidence bounds every model established in that family; a named-model window bounds only its own model. Missing model-level quota, a missing auth source, unmeasurable headroom, and unmodeled authentication are disclosed uncertainty. Only concrete contradictory evidence blocks a candidate. Replace the preflight with bin/fm-vendor-auth-probe.sh, which keeps the captain's approved bounded probe envelope without any routing knowledge: it takes no harness, model, or provider, reads no quota, renders no verdict, and holds only a fixed-argv safety allowlist. Its behavior suite proves the absent identity surface, the untouched quota, the uniform exit status, the fixed argv with stdin closed, and a real bound even when the configured bound is zero. Also fixed along the way: a zero FM_*_TIMEOUT silently removed the hard bound, the pinned Grok version had drifted to 0.2.117, and --changed selection refused outright on any deleted bin/ script. AGENTS.md section 4 and quota-array-dispatch own the corrected policy, harness-adapters gets the catalog-responsibility correction, and docs/verification/dispatch-auth.md records the 2026-07-30 evidence on Pi 0.82.0, quota-axi 0.1.16, and grok 0.2.117. * no-mistakes(review): Reject all-zero vendor probe timeouts * feat(watch): wake firstmate when a monitored PR goes conflicting An overtaken pull request sat conflicted until someone noticed the maintainer bot's comment: PR 1284 waited an hour, and PR 1267 was overtaken six times in a day. Nothing in the armed merge poll reported a conflict, so the only signal was a long-cadence recheck or a human read. The poll now reports conflicts on the same validated path as merges. Its single GitHub request carries state, mergeability, and the head commit instead of state alone, so a conflicting open pull request emits "dirty <head>" at no extra forge call. State is decided first and alone, so merged and closed pull requests keep exactly the result they had before. GitLab is untouched: plain glab field output carries no conflict field, and reading one would need the JSON processor firstmate deliberately does not depend on. The watcher dedupes by conflict episode, keyed on that head commit, and its wake carries the pull request URL so the worker can be steered to rebase without a lookup first. The head is the key because poll silence is ambiguous - clean, unknown, closed, and every error look identical - so silence can never clear it, while a changed head does mean the branch moved and went conflicting again. An untouched conflict re-surfaces no more often than FM_PR_DIRTY_RESURFACE_SECS. The marker retires with the rest of the poll artifacts at teardown and on merge. GitHub can briefly report mergeability as unknown while it recomputes after a base push. That is silence here and resolves on the following sweep, rather than adding a retry and a timing dependency to a static program; GitHub recomputes on the base push, so a sweep arriving minutes later normally reads a settled value. Changing the poll's bytes retires every armed check, which the existing content-based migration already handles: the next --checks-safe run quarantines the stale copies and rebuilds each poll from the recorded pr=, so homes see one PR_CHECK_MIGRATION line and lose no armed watch. * no-mistakes(review): record PR conflict episode only after wake enqueued * no-mistakes(document): correct stale gh field-selector claim in GitLab watch doc * no-mistakes(document): rename merge poll to PR poll in armed-check docs --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: Daniel Kuykendall IV <danielkuykendall23@gmail.com> Co-authored-by: Trillium Smith <Spiteless@gmail.com> Co-authored-by: Unknownzed <45267749+Unknownzed@users.noreply.github.com> Co-authored-by: lhalbert <lucashalbert@users.noreply.github.com> Co-authored-by: AG <ag@agw3.org> Co-authored-by: deeto15 <92119640+deeto15@users.noreply.github.com>
* feat(bin): add verified pi-signed runtime adapter (kunchenguid#1145) * feat: add verified pi-signed adapter * no-mistakes(review): Correct pi-signed maintainer verification date * no-mistakes(review): Correct remaining pi-signed verification dates * no-mistakes(review): Preserve authoritative pi-signed runtime identity * no-mistakes(document): Document pi-signed shared adapter semantics * no-mistakes: apply CI fixes * fix(pi): rearm watcher across session transitions (kunchenguid#1166) * fix(pi): rearm watcher across same-process session transitions Pi emits session_shutdown for ordinary /new, /resume, and /fork replacement as well as terminal quit. The primary watcher extension latched a module-level stopping flag on every shutdown, so a replacement session in the same process could not arm monitoring until Pi restarted. Own arm authority per session generation so only the active live generation may start, stop, or rearm the child. Replacement sessions can arm again without restarting Pi, stale prior-generation callbacks cannot mutate the active cycle, and real quit still blocks late rearm. * no-mistakes(review): Preserve Pi generation isolation and exit cleanup * no-mistakes(document): Correct Pi watcher transition documentation * feat: route crew dispatch using quota-window pace (kunchenguid#1172) * Consume quota-axi pace signals in dispatch profile array selection. Add quota-array-dispatch as the single owner of the pace-aware candidate choice, keep AGENTS.md to the intake boundary and load trigger, and cover the acceptance cases with sanitized schemaVersion 3 fixtures. * no-mistakes(review): Stop and report genuine quota dispatch ties * no-mistakes(document): Document quota pace freshness and uncertainty * fix: adapt Grok Stop continuation and harden endpoint cleanup (kunchenguid#1171) * fix(grok): adapt Stop continuation to runtime capability * no-mistakes(review): Reject ambiguous Grok Stop payloads * no-mistakes(review): Reject duplicate Grok fields and accept spaced tmux sessions * no-mistakes(review): Enforce exact tmux cleanup selectors * no-mistakes(test): Fix historical tmux fixture and validate Grok Stop * no-mistakes: apply CI fixes * fix: restore stock macOS Bash 3.2 brief scaffolding (kunchenguid#1093) * fix(brief): make DOD scaffolding parse-safe on stock macOS Bash 3.2 fm-brief.sh built each Definition-of-done block and the not-enabled Herdr declaration with `VAR=$(cat <<EOF ... EOF)`. On Bash 3.2 (macOS /bin/bash) the lexer scans for the command substitution's closing `)` textually and tracks quote state through the heredoc body, so a single apostrophe, unbalanced quote, or unbalanced paren in that prose breaks parsing of the whole script. Every ship-brief scaffold (no-mistakes, direct-PR, local-only) failed with `unexpected EOF while looking for matching )`. Bash 4+ parses it fine, so the breakage stayed invisible everywhere except stock macOS. Replace all four command-substitution heredocs with `IFS= read -r -d '' VAR <<EOF || true`. That removes the `$(...)` wrapper and the entire defect class regardless of future prose, and preserves the variable expansion the direct-PR and local-only bodies need. `read` keeps the heredoc's trailing newline that `$(...)` used to strip, so trim one newline to keep every generated brief byte-identical to prior output. Guard the structure, not one historical phrase: a new test rejects any heredoc nested in a command substitution anywhere in fm-brief.sh, where the old assertion pinned a single apostrophe phrase and so missed the reintroduction. Extend the stock-macOS Bash CI job from parsing one script to the whole maintained shell surface (bin/*.sh, bin/backends/*.sh, tests/*.sh), matching bin/fm-lint.sh's canonical file set so parse scope and lint scope cannot drift apart. * no-mistakes(review): Captain: harden Bash structure and inventory guards * no-mistakes(document): Align stock macOS Bash contributor checks * no-mistakes(lint): Suppress deliberate SC2016 literal fixture warnings * test: stabilize tmux teardown conformance baseline (kunchenguid#1209) * fix(test): pin teardown tmux baseline to historical kill selectors merge-base HEAD main collapses to HEAD after the exact-selector change lands on the default branch, so the old teardown fixture was accidentally exercising current exact targets. Resolve a content-historical permissive tmux adapter from first-parent history and force that post-squash topology inside the conformance case so main and feature branches keep the same old-vs-new contract. * no-mistakes(lint): Suppress intentional literal-pattern ShellCheck warnings * docs: slim quota-array-dispatch to the pace selection core (kunchenguid#1197) Cut the runtime skill to the compact pace-aware selection procedure plus minimum owner pointers. Keep every distinct decision rule and move expanded acceptance scenarios to deterministic fixture ownership assertions. Size: 170/1374/10187 -> 63/544/4068 (about 63%/60%/60% reduction). * feat(bin): inherit backend config into secondmate homes (kunchenguid#1219) * Inherit config/backend into secondmate homes with deliberate-override preservation Add backend to the shared inheritable config allowlist so launch, locked bootstrap, and config-push converge a primary pin into secondmate homes as each home local future-spawn default. Track last-inherited bytes in a private state provenance marker so deliberate per-home overrides survive present and absent primary convergence, keep --backend and FM_BACKEND stronger, and extend the existing inheritance tests plus docs and skill claims. * no-mistakes(review): Preserve equal unprovenanced backend overrides * no-mistakes(review): Preserve symlink overrides and verify spawn precedence * no-mistakes(review): Snapshot backend inheritance for consistent provenance * no-mistakes(review): Simplify backend inheritance to primary-authoritative convergence * no-mistakes(document): Document inherited backend override preservation * fix: restore primary-authoritative backend inheritance after document regression The document step reintroduced provenance and deliberate per-home override semantics after review had simplified config/backend to plain primary-authoritative allowlist membership. Restore the primary-always-wins path: present overwrites, absent removes, no provenance marker, and docs/tests match that contract. * no-mistakes(review): Add divergent backend precedence regression fixtures * no-mistakes(document): Document backend inheritance contract * fix(pi): remove Calm's upper version ceiling (kunchenguid#1226) * fix(pi): remove Calm's exclusive Pi upper-version ceiling tests/fm-calm-pi-extension.test.sh gated on a closed PI_COMPAT_VERSIONS allowlist ("0.81.1 0.82.0") that refused any other installed Pi, and docs described that range as "supported" rather than verified evidence. The Calm CHANGELOG shows no API introduced at either version, so there is no evidence for a real minimum; the presentation adapters already probe the exact method they patch rather than checking a version. Replace the allowlist with dated version evidence that never rejects a newer Pi, and make each presentation adapter degrade independently with a diagnostic if a future Pi removes its API, instead of the whole Calm extension failing to load. Rewrite the feasibility doc's "Pi 0.81.1 through 0.82.0" phrasing to state it as verified evidence, not a ceiling. * no-mistakes(review): Probe missing Calm adapter exports safely * no-mistakes(document): Document Calm's unbounded Pi compatibility * fix(bin): allow session-local todo tools in the subagent guard (kunchenguid#1204) * fix(guard): allow session-local todo tools in the primary The delegation-shape guard denied TaskCreate and TaskUpdate because their normalized names contain the `task` stem. Those tools write only the harness's session-local todo list, which has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that outlives the session. That is not the unaccounted work the guard exists to stop, so the stem match was a false positive, and the deny text told the primary to run bin/fm-brief.sh and bin/fm-spawn.sh to create a todo entry. Add a separately-reasoned PLAN_ONLY_TOOLS exact-name exclusion rather than widening OBSERVE_ONLY_TOOLS, whose documented contract is tools that only observe or stop existing work. Both lists stay exact-name so neither can widen by substring. Tests cover the two allowed names and six near-miss names that a substring or shortened-stem widening would release; both mutations were watched red. * no-mistakes(review): drop session-local todo tools from recommended deny list * no-mistakes: apply CI fixes * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid (kunchenguid#1206) * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid fm_harness_ancestry_pid() previously returned the first ancestor process whose command matched a verified harness name. Claude Code's Stop hook fires as a bg-spare worker several levels below the session's actual lock-owning claude process (hook shell -> claude bg-spare -> claude bg-pty-host -> claude -> claude(lock)), so the first match was the bg-spare worker, not the lock owner. fm_session_lock_owned_by_self() then never matched state/.lock, and the Claude Stop auto-arm silently treated its own primary session as an unrelated live owner and never armed the watcher. The walk now keeps going past a claude-named match, looking for a still more ancestral claude-named match, and stops the instant a non-match follows an already-found match (bounding it to a contiguous run rather than the literal ancestry top, so an unrelated claude-named process further up the real process tree is never mistaken for part of this session's own nested chain). Every other harness keeps the original first-match-wins behavior, since e.g. Pi's shared signed-wrapper ancestry actually holds the session at the inner engine pid, not an outer wrapper pid. Hop limit raised from 8 to 16 to cover the deeper bg-spare chain. * no-mistakes(review): Add nested-claude-ancestry regression test; fix nudge doc depth claim * no-mistakes: apply CI fixes * fix: conferma l'avvio del watcher su Windows/MSYS (kunchenguid#1212) * fix: confirm watcher startup on MSYS * no-mistakes(review): gate MSYS arm ready timeout, cache uname, harden locale test * no-mistakes(review): validate OpenCode ready timeout, make uname cache internal * fix(spawn): forward CLAUDE_CONFIG_DIR to claude crewmates (kunchenguid#1195) * fix(spawn): forward firstmate's CLAUDE_CONFIG_DIR to claude crewmates Crewmate panes are created by a long-lived tmux/herdr daemon that does not inherit firstmate's current environment. When firstmate runs under a non-default CLAUDE_CONFIG_DIR (for example a work-vs-personal subscription split), a bare `claude` in the crewmate pane fell back to the default ~/.claude store and launched unauthenticated, blocking the crewmate before it could do any work. fm-spawn now prefixes the claude launch with firstmate's own resolved CLAUDE_CONFIG_DIR when set, so the crewmate uses the same credential/config store firstmate is authenticated with. An unset value is the single-store default and adds no prefix; non-claude harnesses are unaffected. Adds three tests in fm-spawn-dispatch-profile.test.sh (forwarded-when-set, omitted-when-unset, non-claude-ignored) and pins CLAUDE_CONFIG_DIR in the test helper so launch assertions no longer depend on the developer's environment. * no-mistakes: apply CI fixes * fix: preserve dispatch identity across authentication checks (kunchenguid#1233) * fix: preserve dispatch harness identity * no-mistakes(review): Fix Grok counterfactual tuple validation * no-mistakes(document): Scope dispatch authentication to selected tuple * fix: restore dispatch instruction budget * no-mistakes(review): Scope dispatch authentication after candidate selection * fix(bin): normalize relative durable paths (kunchenguid#1256) * fix(bin): handle dash-leading harness process names (#2) * fix: handle dash-leading harness process names * no-mistakes(review): Make dash-leading harness regression hermetic * fix: preserve secondmate reply routes across relative homes Resolve relative home, data, and state inputs before durable charter generation, and fail when caller-relative directories cannot be resolved. Use absolute paths at the related spawn, AFK daemon, and X-mode cross-process handoffs so later processes cannot reinterpret them from another working directory. * no-mistakes(review): Preserve absolute overrides and normalize relative durable paths * no-mistakes(review): Normalize relative home before deriving durable paths * no-mistakes(document): Document relative durable-path normalization * no-mistakes(review): Captain: Ignore inherited CDPATH during relative path normalization * no-mistakes(lint): Fix empty CDPATH assignments for ShellCheck * refactor(skills): make Bearings chat-only by default (kunchenguid#1136) * Add internal status skill * no-mistakes(document): register /status skill in documentation-audiences inventory * no-mistakes(lint): replace grep|wc -l with grep -c in status skill test * test: silence literal status skill patterns * Refactor bearings default to chat-only --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> * Clarify follow-up routing during validation (kunchenguid#1277) * fix: honor concrete approval for project operations (kunchenguid#1272) * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * no-mistakes(review): Align project removal preflight with approved exception * no-mistakes(document): Align project removal documentation with approved exception * fix: restore removal test byte-for-byte and preserve the default sentence tests/fm-instruction-owners.test.sh had been changed to assert different text; restore it byte-for-byte to origin/main. project-management SKILL.md's Remove section now keeps the exact default "Never issue a raw removal command from Firstmate." sentence that test still asserts, immediately followed by the already-approved captain-operation-or-scope exception, so the default and the exception both stay explicit and consistent. * no-mistakes(document): Align project-write boundary documentation * fix(skills): route new project intake through secondmate scopes (kunchenguid#1275) * Route project intake through secondmate scopes * no-mistakes(test): Guard all main-home project registry mutations * no-mistakes(document): Consolidate secondmate routing documentation * no-mistakes: apply CI fixes * Restore new-project routing scope * no-mistakes(document): Clarify secondmate routing for new-project intake * no-mistakes: apply CI fixes * fix: scope validation corrections by accepted behavior (kunchenguid#1281) * fix: scope validation corrections by accepted behavior * no-mistakes(review): Classify stale delivery evidence as an autonomous correction * test: replace source assertions with behavioral coverage (kunchenguid#1282) * test: remove source-content assertions * no-mistakes(review): Replace source assertions with runtime behavior coverage * no-mistakes(review): Isolate Kimi task temp runtime coverage * no-mistakes(document): Refresh test cleanup documentation * no-mistakes: apply CI fixes * fix(tests): reap background processes on every suite ending tests/fm-watcher-lock.test.sh launches real watchers and arms in the background but only killed them on its happy path, so a failing assertion or a timeout(1) kill left them running. The worst case was test_watch_restart_attaches_to_healthy_peer: when it aborted, its bin/fm-watch-arm.sh --restart survived, and because an arm launches a successor whenever its child cycle ends, killing just the watcher brought another one back. Those orphans kept polling an already-deleted temp home, inflated the shell count of whatever checkout ran the suite, and polluted later liveness reads. tests/lib.sh now owns a reaper: fm_test_reap registers a pid, and fm_test_cleanup kills it together with the children it had at teardown time. The tree is snapshotted before the first kill because a dead parent's children are reparented beyond the reach of a ppid walk, and the kill is SIGKILL so a catchable signal cannot hand back a fresh successor. Cleanup is now installed for HUP/INT/TERM as well as EXIT, since a bare EXIT trap does not run for a signalled shell - the reason a hung case leaked. Every background launch in the suite registers its pid at launch. * no-mistakes(review): gate reaper kills by identity and survives ps loss * no-mistakes(document): document harness reaper coverage in watcher-lock test header --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: Daniel Kuykendall IV <danielkuykendall23@gmail.com> Co-authored-by: Trillium Smith <Spiteless@gmail.com> Co-authored-by: Unknownzed <45267749+Unknownzed@users.noreply.github.com> Co-authored-by: lhalbert <lucashalbert@users.noreply.github.com> Co-authored-by: AG <ag@agw3.org> Co-authored-by: deeto15 <92119640+deeto15@users.noreply.github.com>
…nshown herdr wedge alarms (#14) * feat(bin): add verified pi-signed runtime adapter (kunchenguid#1145) * feat: add verified pi-signed adapter * no-mistakes(review): Correct pi-signed maintainer verification date * no-mistakes(review): Correct remaining pi-signed verification dates * no-mistakes(review): Preserve authoritative pi-signed runtime identity * no-mistakes(document): Document pi-signed shared adapter semantics * no-mistakes: apply CI fixes * fix(pi): rearm watcher across session transitions (kunchenguid#1166) * fix(pi): rearm watcher across same-process session transitions Pi emits session_shutdown for ordinary /new, /resume, and /fork replacement as well as terminal quit. The primary watcher extension latched a module-level stopping flag on every shutdown, so a replacement session in the same process could not arm monitoring until Pi restarted. Own arm authority per session generation so only the active live generation may start, stop, or rearm the child. Replacement sessions can arm again without restarting Pi, stale prior-generation callbacks cannot mutate the active cycle, and real quit still blocks late rearm. * no-mistakes(review): Preserve Pi generation isolation and exit cleanup * no-mistakes(document): Correct Pi watcher transition documentation * feat: route crew dispatch using quota-window pace (kunchenguid#1172) * Consume quota-axi pace signals in dispatch profile array selection. Add quota-array-dispatch as the single owner of the pace-aware candidate choice, keep AGENTS.md to the intake boundary and load trigger, and cover the acceptance cases with sanitized schemaVersion 3 fixtures. * no-mistakes(review): Stop and report genuine quota dispatch ties * no-mistakes(document): Document quota pace freshness and uncertainty * fix: adapt Grok Stop continuation and harden endpoint cleanup (kunchenguid#1171) * fix(grok): adapt Stop continuation to runtime capability * no-mistakes(review): Reject ambiguous Grok Stop payloads * no-mistakes(review): Reject duplicate Grok fields and accept spaced tmux sessions * no-mistakes(review): Enforce exact tmux cleanup selectors * no-mistakes(test): Fix historical tmux fixture and validate Grok Stop * no-mistakes: apply CI fixes * fix: restore stock macOS Bash 3.2 brief scaffolding (kunchenguid#1093) * fix(brief): make DOD scaffolding parse-safe on stock macOS Bash 3.2 fm-brief.sh built each Definition-of-done block and the not-enabled Herdr declaration with `VAR=$(cat <<EOF ... EOF)`. On Bash 3.2 (macOS /bin/bash) the lexer scans for the command substitution's closing `)` textually and tracks quote state through the heredoc body, so a single apostrophe, unbalanced quote, or unbalanced paren in that prose breaks parsing of the whole script. Every ship-brief scaffold (no-mistakes, direct-PR, local-only) failed with `unexpected EOF while looking for matching )`. Bash 4+ parses it fine, so the breakage stayed invisible everywhere except stock macOS. Replace all four command-substitution heredocs with `IFS= read -r -d '' VAR <<EOF || true`. That removes the `$(...)` wrapper and the entire defect class regardless of future prose, and preserves the variable expansion the direct-PR and local-only bodies need. `read` keeps the heredoc's trailing newline that `$(...)` used to strip, so trim one newline to keep every generated brief byte-identical to prior output. Guard the structure, not one historical phrase: a new test rejects any heredoc nested in a command substitution anywhere in fm-brief.sh, where the old assertion pinned a single apostrophe phrase and so missed the reintroduction. Extend the stock-macOS Bash CI job from parsing one script to the whole maintained shell surface (bin/*.sh, bin/backends/*.sh, tests/*.sh), matching bin/fm-lint.sh's canonical file set so parse scope and lint scope cannot drift apart. * no-mistakes(review): Captain: harden Bash structure and inventory guards * no-mistakes(document): Align stock macOS Bash contributor checks * no-mistakes(lint): Suppress deliberate SC2016 literal fixture warnings * test: stabilize tmux teardown conformance baseline (kunchenguid#1209) * fix(test): pin teardown tmux baseline to historical kill selectors merge-base HEAD main collapses to HEAD after the exact-selector change lands on the default branch, so the old teardown fixture was accidentally exercising current exact targets. Resolve a content-historical permissive tmux adapter from first-parent history and force that post-squash topology inside the conformance case so main and feature branches keep the same old-vs-new contract. * no-mistakes(lint): Suppress intentional literal-pattern ShellCheck warnings * docs: slim quota-array-dispatch to the pace selection core (kunchenguid#1197) Cut the runtime skill to the compact pace-aware selection procedure plus minimum owner pointers. Keep every distinct decision rule and move expanded acceptance scenarios to deterministic fixture ownership assertions. Size: 170/1374/10187 -> 63/544/4068 (about 63%/60%/60% reduction). * feat(bin): inherit backend config into secondmate homes (kunchenguid#1219) * Inherit config/backend into secondmate homes with deliberate-override preservation Add backend to the shared inheritable config allowlist so launch, locked bootstrap, and config-push converge a primary pin into secondmate homes as each home local future-spawn default. Track last-inherited bytes in a private state provenance marker so deliberate per-home overrides survive present and absent primary convergence, keep --backend and FM_BACKEND stronger, and extend the existing inheritance tests plus docs and skill claims. * no-mistakes(review): Preserve equal unprovenanced backend overrides * no-mistakes(review): Preserve symlink overrides and verify spawn precedence * no-mistakes(review): Snapshot backend inheritance for consistent provenance * no-mistakes(review): Simplify backend inheritance to primary-authoritative convergence * no-mistakes(document): Document inherited backend override preservation * fix: restore primary-authoritative backend inheritance after document regression The document step reintroduced provenance and deliberate per-home override semantics after review had simplified config/backend to plain primary-authoritative allowlist membership. Restore the primary-always-wins path: present overwrites, absent removes, no provenance marker, and docs/tests match that contract. * no-mistakes(review): Add divergent backend precedence regression fixtures * no-mistakes(document): Document backend inheritance contract * fix(pi): remove Calm's upper version ceiling (kunchenguid#1226) * fix(pi): remove Calm's exclusive Pi upper-version ceiling tests/fm-calm-pi-extension.test.sh gated on a closed PI_COMPAT_VERSIONS allowlist ("0.81.1 0.82.0") that refused any other installed Pi, and docs described that range as "supported" rather than verified evidence. The Calm CHANGELOG shows no API introduced at either version, so there is no evidence for a real minimum; the presentation adapters already probe the exact method they patch rather than checking a version. Replace the allowlist with dated version evidence that never rejects a newer Pi, and make each presentation adapter degrade independently with a diagnostic if a future Pi removes its API, instead of the whole Calm extension failing to load. Rewrite the feasibility doc's "Pi 0.81.1 through 0.82.0" phrasing to state it as verified evidence, not a ceiling. * no-mistakes(review): Probe missing Calm adapter exports safely * no-mistakes(document): Document Calm's unbounded Pi compatibility * fix(bin): allow session-local todo tools in the subagent guard (kunchenguid#1204) * fix(guard): allow session-local todo tools in the primary The delegation-shape guard denied TaskCreate and TaskUpdate because their normalized names contain the `task` stem. Those tools write only the harness's session-local todo list, which has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that outlives the session. That is not the unaccounted work the guard exists to stop, so the stem match was a false positive, and the deny text told the primary to run bin/fm-brief.sh and bin/fm-spawn.sh to create a todo entry. Add a separately-reasoned PLAN_ONLY_TOOLS exact-name exclusion rather than widening OBSERVE_ONLY_TOOLS, whose documented contract is tools that only observe or stop existing work. Both lists stay exact-name so neither can widen by substring. Tests cover the two allowed names and six near-miss names that a substring or shortened-stem widening would release; both mutations were watched red. * no-mistakes(review): drop session-local todo tools from recommended deny list * no-mistakes: apply CI fixes * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid (kunchenguid#1206) * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid fm_harness_ancestry_pid() previously returned the first ancestor process whose command matched a verified harness name. Claude Code's Stop hook fires as a bg-spare worker several levels below the session's actual lock-owning claude process (hook shell -> claude bg-spare -> claude bg-pty-host -> claude -> claude(lock)), so the first match was the bg-spare worker, not the lock owner. fm_session_lock_owned_by_self() then never matched state/.lock, and the Claude Stop auto-arm silently treated its own primary session as an unrelated live owner and never armed the watcher. The walk now keeps going past a claude-named match, looking for a still more ancestral claude-named match, and stops the instant a non-match follows an already-found match (bounding it to a contiguous run rather than the literal ancestry top, so an unrelated claude-named process further up the real process tree is never mistaken for part of this session's own nested chain). Every other harness keeps the original first-match-wins behavior, since e.g. Pi's shared signed-wrapper ancestry actually holds the session at the inner engine pid, not an outer wrapper pid. Hop limit raised from 8 to 16 to cover the deeper bg-spare chain. * no-mistakes(review): Add nested-claude-ancestry regression test; fix nudge doc depth claim * no-mistakes: apply CI fixes * fix: conferma l'avvio del watcher su Windows/MSYS (kunchenguid#1212) * fix: confirm watcher startup on MSYS * no-mistakes(review): gate MSYS arm ready timeout, cache uname, harden locale test * no-mistakes(review): validate OpenCode ready timeout, make uname cache internal * fix(spawn): forward CLAUDE_CONFIG_DIR to claude crewmates (kunchenguid#1195) * fix(spawn): forward firstmate's CLAUDE_CONFIG_DIR to claude crewmates Crewmate panes are created by a long-lived tmux/herdr daemon that does not inherit firstmate's current environment. When firstmate runs under a non-default CLAUDE_CONFIG_DIR (for example a work-vs-personal subscription split), a bare `claude` in the crewmate pane fell back to the default ~/.claude store and launched unauthenticated, blocking the crewmate before it could do any work. fm-spawn now prefixes the claude launch with firstmate's own resolved CLAUDE_CONFIG_DIR when set, so the crewmate uses the same credential/config store firstmate is authenticated with. An unset value is the single-store default and adds no prefix; non-claude harnesses are unaffected. Adds three tests in fm-spawn-dispatch-profile.test.sh (forwarded-when-set, omitted-when-unset, non-claude-ignored) and pins CLAUDE_CONFIG_DIR in the test helper so launch assertions no longer depend on the developer's environment. * no-mistakes: apply CI fixes * fix: preserve dispatch identity across authentication checks (kunchenguid#1233) * fix: preserve dispatch harness identity * no-mistakes(review): Fix Grok counterfactual tuple validation * no-mistakes(document): Scope dispatch authentication to selected tuple * fix: restore dispatch instruction budget * no-mistakes(review): Scope dispatch authentication after candidate selection * fix(bin): normalize relative durable paths (kunchenguid#1256) * fix(bin): handle dash-leading harness process names (#2) * fix: handle dash-leading harness process names * no-mistakes(review): Make dash-leading harness regression hermetic * fix: preserve secondmate reply routes across relative homes Resolve relative home, data, and state inputs before durable charter generation, and fail when caller-relative directories cannot be resolved. Use absolute paths at the related spawn, AFK daemon, and X-mode cross-process handoffs so later processes cannot reinterpret them from another working directory. * no-mistakes(review): Preserve absolute overrides and normalize relative durable paths * no-mistakes(review): Normalize relative home before deriving durable paths * no-mistakes(document): Document relative durable-path normalization * no-mistakes(review): Captain: Ignore inherited CDPATH during relative path normalization * no-mistakes(lint): Fix empty CDPATH assignments for ShellCheck * refactor(skills): make Bearings chat-only by default (kunchenguid#1136) * Add internal status skill * no-mistakes(document): register /status skill in documentation-audiences inventory * no-mistakes(lint): replace grep|wc -l with grep -c in status skill test * test: silence literal status skill patterns * Refactor bearings default to chat-only --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> * Clarify follow-up routing during validation (kunchenguid#1277) * fix: honor concrete approval for project operations (kunchenguid#1272) * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * no-mistakes(review): Align project removal preflight with approved exception * no-mistakes(document): Align project removal documentation with approved exception * fix: restore removal test byte-for-byte and preserve the default sentence tests/fm-instruction-owners.test.sh had been changed to assert different text; restore it byte-for-byte to origin/main. project-management SKILL.md's Remove section now keeps the exact default "Never issue a raw removal command from Firstmate." sentence that test still asserts, immediately followed by the already-approved captain-operation-or-scope exception, so the default and the exception both stay explicit and consistent. * no-mistakes(document): Align project-write boundary documentation * fix(skills): route new project intake through secondmate scopes (kunchenguid#1275) * Route project intake through secondmate scopes * no-mistakes(test): Guard all main-home project registry mutations * no-mistakes(document): Consolidate secondmate routing documentation * no-mistakes: apply CI fixes * Restore new-project routing scope * no-mistakes(document): Clarify secondmate routing for new-project intake * no-mistakes: apply CI fixes * fix: scope validation corrections by accepted behavior (kunchenguid#1281) * fix: scope validation corrections by accepted behavior * no-mistakes(review): Classify stale delivery evidence as an autonomous correction * test: replace source assertions with behavioral coverage (kunchenguid#1282) * test: remove source-content assertions * no-mistakes(review): Replace source assertions with runtime behavior coverage * no-mistakes(review): Isolate Kimi task temp runtime coverage * no-mistakes(document): Refresh test cleanup documentation * no-mistakes: apply CI fixes * fix(composer): read an NBSP-padded empty composer as empty, not pending Away-mode escalations sat undelivered for ~9.5 hours in each of three stretches. Root cause, with the reproduction now pinned as a regression test: TRIGGER. Real Claude Code 2.1.220 pads its EMPTY composer row with U+00A0 NBSP, so the captured row is exactly `❯` + \xc2\xa0. bash's [[:space:]] does not match U+00A0, so no trim in bin/fm-composer-lib.sh or in any adapter could remove it; the leading-glyph strip left a lone NBSP behind, and the shared classifier concluded "real, unsubmitted content remains" -> `pending` on a genuinely idle pane. It is a stable property of the idle pane, not a race, so it recurred on every poll indefinitely. The NBSP originates in claude's own output (it sits inside claude's own colour run; non-claude panes never carry it), so the defect is reader-independent: both herdr's ANSI reader and tmux `capture-pane -e` surface it faithfully. MASK. Only the consumers that require an AFFIRMATIVE `empty` could see it, and both fail safe rather than loudly: away-mode escalation injection defers on anything that is not `empty`, and verified submit reports a swallowed Enter. Every other composer consumer treats `pending` as ordinary. So the wedge produced deferral, not an error, and no test covered the shape - the \xc2\xa0 byte pair appeared NOWHERE under tests/, which is precisely why all three 9.5-hour delivery failures passed CI. SYMPTOM. Buffered captain-relevant escalations (decision gates, blockers, completions) delivered only by the away-mode return catch-up ~9.5h later, and false "delivery unconfirmed" errors on steers into an idle pane. FIX (sufficiency). bin/fm-composer-lib.sh's fm_composer_classify_content now normalizes the non-ASCII blanks a TUI can use as padding before its trims: U+00A0, U+2007 and U+202F map to an ASCII space, U+200B and U+FEFF are dropped. That function is the ONE fleet-wide owner of the empty|pending|unknown verdict, so this covers both ANSI readers and all four adapters (tmux, herdr, Orca, cmux) at once and cannot drift back into per-adapter copies. SAFETY PROPERTY. Every character normalized here RENDERS AS BLANK, and nothing else is touched, so the change can only ever make an OTHERWISE-BLANK row read as blank. It is impossible for real typed text to become `empty`: a row holding any visible glyph keeps that glyph byte for byte, NBSP-joined text stays `pending`, and a bare NBSP-padded dead-shell prompt stays non-empty (it becomes the documented `unknown` instead of `pending`). Tests assert both directions. Also hardens the away-mode wedge alarm's herdr channel, which failed in the same incident. `herdr notification show` exits 0 even when it showed nothing: with `[ui.toast] delivery` off (herdr's default) it answers {"shown":false,"reason":"disabled"}. wedge_alarm_via_herdr read exit 0 as success, so a configured-but-disabled channel produced a healthy log line and reached nobody. It now parses the payload, treats an explicit "shown":false as a channel failure and logs the reported reason; a build that reports no outcome keeps its exit-status verdict. Tests: the reproduction becomes the regression test. tests/fm-composer-lib.test.sh and tests/fm-backend-herdr.test.sh gain fixtures carrying the LITERAL \xc2\xa0 byte pair captured from real Claude Code 2.1.220, each paired with a real-text counterpart so the safety property is asserted, and tests/fm-daemon.test.sh covers the unshown, shown, and payload-less herdr channel outcomes. All 171 existing composer and herdr tests stay green (175 with the new ones), and the daemon suite goes 99 -> 101. * no-mistakes(document): document herdr wedge-alarm delivery verification in channel reference --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: Daniel Kuykendall IV <danielkuykendall23@gmail.com> Co-authored-by: Trillium Smith <Spiteless@gmail.com> Co-authored-by: Unknownzed <45267749+Unknownzed@users.noreply.github.com> Co-authored-by: lhalbert <lucashalbert@users.noreply.github.com> Co-authored-by: AG <ag@agw3.org> Co-authored-by: deeto15 <92119640+deeto15@users.noreply.github.com>
…check (#12) * feat(bin): add verified pi-signed runtime adapter (kunchenguid#1145) * feat: add verified pi-signed adapter * no-mistakes(review): Correct pi-signed maintainer verification date * no-mistakes(review): Correct remaining pi-signed verification dates * no-mistakes(review): Preserve authoritative pi-signed runtime identity * no-mistakes(document): Document pi-signed shared adapter semantics * no-mistakes: apply CI fixes * fix(pi): rearm watcher across session transitions (kunchenguid#1166) * fix(pi): rearm watcher across same-process session transitions Pi emits session_shutdown for ordinary /new, /resume, and /fork replacement as well as terminal quit. The primary watcher extension latched a module-level stopping flag on every shutdown, so a replacement session in the same process could not arm monitoring until Pi restarted. Own arm authority per session generation so only the active live generation may start, stop, or rearm the child. Replacement sessions can arm again without restarting Pi, stale prior-generation callbacks cannot mutate the active cycle, and real quit still blocks late rearm. * no-mistakes(review): Preserve Pi generation isolation and exit cleanup * no-mistakes(document): Correct Pi watcher transition documentation * feat: route crew dispatch using quota-window pace (kunchenguid#1172) * Consume quota-axi pace signals in dispatch profile array selection. Add quota-array-dispatch as the single owner of the pace-aware candidate choice, keep AGENTS.md to the intake boundary and load trigger, and cover the acceptance cases with sanitized schemaVersion 3 fixtures. * no-mistakes(review): Stop and report genuine quota dispatch ties * no-mistakes(document): Document quota pace freshness and uncertainty * fix: adapt Grok Stop continuation and harden endpoint cleanup (kunchenguid#1171) * fix(grok): adapt Stop continuation to runtime capability * no-mistakes(review): Reject ambiguous Grok Stop payloads * no-mistakes(review): Reject duplicate Grok fields and accept spaced tmux sessions * no-mistakes(review): Enforce exact tmux cleanup selectors * no-mistakes(test): Fix historical tmux fixture and validate Grok Stop * no-mistakes: apply CI fixes * fix: restore stock macOS Bash 3.2 brief scaffolding (kunchenguid#1093) * fix(brief): make DOD scaffolding parse-safe on stock macOS Bash 3.2 fm-brief.sh built each Definition-of-done block and the not-enabled Herdr declaration with `VAR=$(cat <<EOF ... EOF)`. On Bash 3.2 (macOS /bin/bash) the lexer scans for the command substitution's closing `)` textually and tracks quote state through the heredoc body, so a single apostrophe, unbalanced quote, or unbalanced paren in that prose breaks parsing of the whole script. Every ship-brief scaffold (no-mistakes, direct-PR, local-only) failed with `unexpected EOF while looking for matching )`. Bash 4+ parses it fine, so the breakage stayed invisible everywhere except stock macOS. Replace all four command-substitution heredocs with `IFS= read -r -d '' VAR <<EOF || true`. That removes the `$(...)` wrapper and the entire defect class regardless of future prose, and preserves the variable expansion the direct-PR and local-only bodies need. `read` keeps the heredoc's trailing newline that `$(...)` used to strip, so trim one newline to keep every generated brief byte-identical to prior output. Guard the structure, not one historical phrase: a new test rejects any heredoc nested in a command substitution anywhere in fm-brief.sh, where the old assertion pinned a single apostrophe phrase and so missed the reintroduction. Extend the stock-macOS Bash CI job from parsing one script to the whole maintained shell surface (bin/*.sh, bin/backends/*.sh, tests/*.sh), matching bin/fm-lint.sh's canonical file set so parse scope and lint scope cannot drift apart. * no-mistakes(review): Captain: harden Bash structure and inventory guards * no-mistakes(document): Align stock macOS Bash contributor checks * no-mistakes(lint): Suppress deliberate SC2016 literal fixture warnings * test: stabilize tmux teardown conformance baseline (kunchenguid#1209) * fix(test): pin teardown tmux baseline to historical kill selectors merge-base HEAD main collapses to HEAD after the exact-selector change lands on the default branch, so the old teardown fixture was accidentally exercising current exact targets. Resolve a content-historical permissive tmux adapter from first-parent history and force that post-squash topology inside the conformance case so main and feature branches keep the same old-vs-new contract. * no-mistakes(lint): Suppress intentional literal-pattern ShellCheck warnings * docs: slim quota-array-dispatch to the pace selection core (kunchenguid#1197) Cut the runtime skill to the compact pace-aware selection procedure plus minimum owner pointers. Keep every distinct decision rule and move expanded acceptance scenarios to deterministic fixture ownership assertions. Size: 170/1374/10187 -> 63/544/4068 (about 63%/60%/60% reduction). * feat(bin): inherit backend config into secondmate homes (kunchenguid#1219) * Inherit config/backend into secondmate homes with deliberate-override preservation Add backend to the shared inheritable config allowlist so launch, locked bootstrap, and config-push converge a primary pin into secondmate homes as each home local future-spawn default. Track last-inherited bytes in a private state provenance marker so deliberate per-home overrides survive present and absent primary convergence, keep --backend and FM_BACKEND stronger, and extend the existing inheritance tests plus docs and skill claims. * no-mistakes(review): Preserve equal unprovenanced backend overrides * no-mistakes(review): Preserve symlink overrides and verify spawn precedence * no-mistakes(review): Snapshot backend inheritance for consistent provenance * no-mistakes(review): Simplify backend inheritance to primary-authoritative convergence * no-mistakes(document): Document inherited backend override preservation * fix: restore primary-authoritative backend inheritance after document regression The document step reintroduced provenance and deliberate per-home override semantics after review had simplified config/backend to plain primary-authoritative allowlist membership. Restore the primary-always-wins path: present overwrites, absent removes, no provenance marker, and docs/tests match that contract. * no-mistakes(review): Add divergent backend precedence regression fixtures * no-mistakes(document): Document backend inheritance contract * fix(pi): remove Calm's upper version ceiling (kunchenguid#1226) * fix(pi): remove Calm's exclusive Pi upper-version ceiling tests/fm-calm-pi-extension.test.sh gated on a closed PI_COMPAT_VERSIONS allowlist ("0.81.1 0.82.0") that refused any other installed Pi, and docs described that range as "supported" rather than verified evidence. The Calm CHANGELOG shows no API introduced at either version, so there is no evidence for a real minimum; the presentation adapters already probe the exact method they patch rather than checking a version. Replace the allowlist with dated version evidence that never rejects a newer Pi, and make each presentation adapter degrade independently with a diagnostic if a future Pi removes its API, instead of the whole Calm extension failing to load. Rewrite the feasibility doc's "Pi 0.81.1 through 0.82.0" phrasing to state it as verified evidence, not a ceiling. * no-mistakes(review): Probe missing Calm adapter exports safely * no-mistakes(document): Document Calm's unbounded Pi compatibility * fix(bin): allow session-local todo tools in the subagent guard (kunchenguid#1204) * fix(guard): allow session-local todo tools in the primary The delegation-shape guard denied TaskCreate and TaskUpdate because their normalized names contain the `task` stem. Those tools write only the harness's session-local todo list, which has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that outlives the session. That is not the unaccounted work the guard exists to stop, so the stem match was a false positive, and the deny text told the primary to run bin/fm-brief.sh and bin/fm-spawn.sh to create a todo entry. Add a separately-reasoned PLAN_ONLY_TOOLS exact-name exclusion rather than widening OBSERVE_ONLY_TOOLS, whose documented contract is tools that only observe or stop existing work. Both lists stay exact-name so neither can widen by substring. Tests cover the two allowed names and six near-miss names that a substring or shortened-stem widening would release; both mutations were watched red. * no-mistakes(review): drop session-local todo tools from recommended deny list * no-mistakes: apply CI fixes * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid (kunchenguid#1206) * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid fm_harness_ancestry_pid() previously returned the first ancestor process whose command matched a verified harness name. Claude Code's Stop hook fires as a bg-spare worker several levels below the session's actual lock-owning claude process (hook shell -> claude bg-spare -> claude bg-pty-host -> claude -> claude(lock)), so the first match was the bg-spare worker, not the lock owner. fm_session_lock_owned_by_self() then never matched state/.lock, and the Claude Stop auto-arm silently treated its own primary session as an unrelated live owner and never armed the watcher. The walk now keeps going past a claude-named match, looking for a still more ancestral claude-named match, and stops the instant a non-match follows an already-found match (bounding it to a contiguous run rather than the literal ancestry top, so an unrelated claude-named process further up the real process tree is never mistaken for part of this session's own nested chain). Every other harness keeps the original first-match-wins behavior, since e.g. Pi's shared signed-wrapper ancestry actually holds the session at the inner engine pid, not an outer wrapper pid. Hop limit raised from 8 to 16 to cover the deeper bg-spare chain. * no-mistakes(review): Add nested-claude-ancestry regression test; fix nudge doc depth claim * no-mistakes: apply CI fixes * fix: conferma l'avvio del watcher su Windows/MSYS (kunchenguid#1212) * fix: confirm watcher startup on MSYS * no-mistakes(review): gate MSYS arm ready timeout, cache uname, harden locale test * no-mistakes(review): validate OpenCode ready timeout, make uname cache internal * fix(spawn): forward CLAUDE_CONFIG_DIR to claude crewmates (kunchenguid#1195) * fix(spawn): forward firstmate's CLAUDE_CONFIG_DIR to claude crewmates Crewmate panes are created by a long-lived tmux/herdr daemon that does not inherit firstmate's current environment. When firstmate runs under a non-default CLAUDE_CONFIG_DIR (for example a work-vs-personal subscription split), a bare `claude` in the crewmate pane fell back to the default ~/.claude store and launched unauthenticated, blocking the crewmate before it could do any work. fm-spawn now prefixes the claude launch with firstmate's own resolved CLAUDE_CONFIG_DIR when set, so the crewmate uses the same credential/config store firstmate is authenticated with. An unset value is the single-store default and adds no prefix; non-claude harnesses are unaffected. Adds three tests in fm-spawn-dispatch-profile.test.sh (forwarded-when-set, omitted-when-unset, non-claude-ignored) and pins CLAUDE_CONFIG_DIR in the test helper so launch assertions no longer depend on the developer's environment. * no-mistakes: apply CI fixes * fix: preserve dispatch identity across authentication checks (kunchenguid#1233) * fix: preserve dispatch harness identity * no-mistakes(review): Fix Grok counterfactual tuple validation * no-mistakes(document): Scope dispatch authentication to selected tuple * fix: restore dispatch instruction budget * no-mistakes(review): Scope dispatch authentication after candidate selection * fix(bin): allowlist the opencode turn-end plugin in teardown's dirty check bin/fm-teardown.sh's dirty check allowlists the turn-end scaffolding fm-spawn writes into a task worktree, but that hand-maintained list had drifted: .opencode/plugins/fm-turn-end.js was missing. When the info/exclude write does not take, an opencode worktree left an untracked .opencode/ surviving the filter, so teardown refused an otherwise clean tree as uncommitted changes. git collapses a fully-untracked directory to a bare "?? .opencode/" line, which can neither match an exact path nor prove the directory holds nothing else, so the status call now expands untracked files. Expanding only ever adds lines, so it cannot hide real dirty work. The .claude/ term stays an un-anchored directory prefix on purpose, so behavior for untracked work under .claude/ is unchanged: it is still allowlisted, and narrowing it to the exact settings.local.json path is deliberately out of scope for this fix. Add regression coverage pinning every worktree-resident artifact at once, since this is a defense-in-depth layer nothing exercised, plus a negative case proving the allowlist stays per-path rather than per-directory. The test pins core.excludesFile so a machine-global ignore of .claude/ cannot silently make the case vacuous. --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: Daniel Kuykendall IV <danielkuykendall23@gmail.com> Co-authored-by: Trillium Smith <Spiteless@gmail.com> Co-authored-by: Unknownzed <45267749+Unknownzed@users.noreply.github.com> Co-authored-by: lhalbert <lucashalbert@users.noreply.github.com>
* Add worker conflict and verification rules * no-mistakes(review): Scope rebase carve-out, document sections, test variant split * no-mistakes(document): note delegated-rebase exception in AGENTS.md validation rule
* fix(bin): refuse spawns that would reclaim a still-owned pool slot `treehouse status` reports a pool slot as available when it has no lease, no live process, and a clean working tree. It does not consider whether HEAD carries commits unreachable from the default branch, so a slot holding a finished-but-unlanded branch is allocatable and the next `treehouse get` detaches it. Restarts make this reachable: they leave slot ownership recorded as either nothing or a stale value, and both read as free. The check has to run before allocation. `treehouse get` resets the slot while acquiring it, before it returns a path, and fm-spawn only learns the worktree by polling the pane's current path afterwards, so a check placed there inspects a slot whose evidence has already been erased. Add bin/fm-worktree-guard.sh, called from bin/fm-spawn.sh before any endpoint exists. It reads treehouse's own available verdict from `status --json` rather than reimplementing eligibility, then applies an offline emptiness test per slot using --no-optional-locks so another lane's index is never written. On evidence it refuses and names the slot, the evidence, the apparent owning task, and what would release it. Ownership resolves through fm_pid_identity, never a bare pid: fm-spawn now records worktree_owner_pid and worktree_owner_identity into the existing state/<id>.meta. Only an identity match reads alive, only a recorded identity that no longer matches reads dead, and an absent record reads unresolved rather than as a released slot, so a post-reboot reused pid cannot read as a live owner. The guard never resets, cleans, forces, discards, or releases anything. bin/fm-teardown.sh remains the sole releaser of a slot holding work and the owner of the complete landed-work test. Uncommitted content is separately protected by treehouse itself, which reports such a slot dirty and refuses to reclaim one even when every slot in an exhausted pool is dirty, so the exposure closed here is specifically a clean working tree plus commits not on the default branch. Suites that spawn a crewmate stubbed treehouse as a silent exit 0, which the guard correctly refuses because the real binary prints [] for an empty pool and never nothing. Add fm_fake_treehouse to tests/lib.sh so that one faithful stub is shared rather than re-rolled per suite. Empirical basis: docs/verification/worktree-allocation.md. * test: model treehouse status in the remaining spawn fakes fm-secondmate-harness builds its fakebin without any treehouse stub and runs with a BASE_PATH that excludes the real binary. That was invisible while fm-spawn only typed `treehouse get` into the pane; the guard runs `treehouse status` from fm-spawn's own environment before allocating. The Herdr presentation comparison normalizes per-run container ids; the worktree owner pid and identity vary per run for the same reason, so they belong in that normalization. * no-mistakes(review): Align worktree guard with allocation safety contract * no-mistakes(review): Validate treehouse JSON schema before allocation * no-mistakes(document): Document safe Treehouse allocation * fix(bin): inspect Treehouse pools on builds without status --json CI pins Treehouse v2.0.1 via bin/fm-install-treehouse.sh, and that build has no `status --json` flag at all: passing it exits 1 with "unknown flag". The guard required that flag, so every Treehouse-backed spawn refused on the pinned build and four real-herdr-gated suites failed. The same defect exists on v2.0.1 - it also reports a clean slot holding an unlanded branch as available - so the guard must still inspect the pool there rather than refuse every spawn. Probe capability from `status --help` advertising --json, not from the error text or a version string, and fall back to the human-readable table. That table needs two compensations: a path under $HOME is abbreviated with a leading tilde, and a slot may be followed by indented process continuation lines. Every non-blank, non-indented line must parse or the guard refuses, so a dropped row cannot leave a slot uninspected. jq is now required only on the --json path. * test: model the treehouse status capability probe in spawn fakes The guard probes `status --help` for --json before choosing a format, so a stub that answers every `status` invocation with [] makes the probe see no --json, fall back to the human-readable table, and then fail to parse [] as a table row. Model all three shapes the guard uses: help advertising --json, --json returning [] for an empty pool, and plain status printing nothing, which is what an empty pool looks like in that format. * docs: record that local Treehouse verification does not prove CI green bin/fm-lint.sh pins shellcheck and refuses to run under any other version, so local and CI cannot diverge on lint. Treehouse has no equivalent: CI installs the version pinned in bin/fm-install-treehouse.sh while a developer machine runs whatever is on PATH, and nothing reconciles them. This is a fleet-wide property of how suites are verified, not a detail of any one change, and it has already cost one red CI run.
* feat: add Windows WSL launcher bridge * no-mistakes(review): pin bat CRLF via gitattributes, canonicalize test temp root * no-mistakes(review): cover gitattributes CRLF pin in bridge suite * no-mistakes(document): Clarify Windows launcher dependency and argument guidance
Reconciles kunchenguid/firstmate:main (33a4287) into sbracewell64/firstmate:main (ecbbe30) without rewriting the fork's 26-commit landed queue. Merge-base was f7d0d0a; the fork was 12 behind and 26 ahead. Automatic merge-upstream had begun returning 409, which is the mandatory-resync ruling's early-warning signal, so this is the manual reconciliation that escalation calls for. Seven paths conflicted (git merge-tree --write-tree exit status 1). Each was resolved by architectural ownership, not by a blanket ours/theirs choice: AGENTS.md - four hunks, all additive from opposite sides. Took upstream's expanded Claude auto-arm state inventory (33a4287 adds the failure-notified, failure-alarmed and budget-lock records) while keeping the fork's .pr-dirty-* watcher-internals entry. Took upstream's exact-task backend-authority clause and kept the fork's config/models.json zero-budget sentence after it. Kept upstream's "outside the supersession sequence above" carve-out and re-seated the fork's pipeline-handback rebase exception as the second exception. Merged both check: wake sources into one list - process-to-event results and the conflicted PR. bin/fm-teardown.sh - two hunks. Both sides added a library source, so both are sourced. In the second hunk the fork's admission_release_reminder is kept, but the fork's local registry_home_for_line parser is dropped: upstream 1e24757 moved that contract into bin/fm-secondmate-registry-lib.sh, the merged file already calls secondmate_registry_parse_line, and keeping the local copy would leave a second owner of a parser upstream fixed for punctuated entries. bin/fm-watch.sh - header wake-reason documentation. The fork documents the conflicting-PR wake and upstream documents the captured process-event wake; they are distinct reasons the watcher can emit, so both blocks are retained. docs/configuration.md - upstream 000c1db rewrote the --backend precedence sentence to bind overrides to exact-task authority; the fork added an adjacent Treehouse pool-guard paragraph. Upstream owns the backend selection contract and the fork's AGENTS.md already points here for it, so upstream's sentence is taken and the pool-guard paragraph is preserved above it. docs/documentation-audiences.json - both sides inserted one agent-runtime skill into the same sorted position. Both entries are kept in order; both SKILL.md files exist in the merged tree. tests/fm-backend.test.sh - OLD_BIN_UNCHANGED_SIBLINGS is a dependency list, so the union is correct: upstream's fm-secondmate-registry-lib.sh joins the fork's fm-launch-lib.sh and fm-admission-lib.sh. tests/fm-gotmp.test.sh - two identical fixture hunks; both sides symlink a real sibling the merged teardown sources, so both symlinks are kept. Upstream fixes imported rather than reimplemented: f5ab708 (portable serial CI sharding), 88b2a94 (session lock and attached watcher supervision) and 33a4287 (Claude supervision auto-arm recovery). No local duplicate of any of them was written.
…onflicts resolved) (#32) * docs: define captain instruction precedence (kunchenguid#1362) * docs: add captain-authorized inherent red-check merge exception Keep the default red-PR ban and own one always-loaded exception in the merge-authority section: captain-explicit PR or bounded batch plus exact check, only when the failure is inherent to the selected delivery path. Yolo cannot activate it; final head and the full current check suite must be verified; other substantive failures remain non-waivable. * docs: replace narrow red-check exception with captain precedence Supersede the inherent failing-check merge exception with one always-loaded Firstmate-local rule: a current explicit concrete captain instruction overrides a conflicting Firstmate-written standing rule only within exact scope, never above platform/system/developer instructions. Keep the ordinary red-PR default and yolo boundary; point section 7 at the section 1 owner. * docs: define validation supersession sequence (kunchenguid#1407) * fix: give validation-time captain overrides a supersession sequence The Validate section let a captain instruction that completely invalidates the work being validated keep the same task and worker, but never said how: the adjacent rule flatly bans hand-editing, committing, aborting, or restarting during an active run with no carve-out, so a worker facing full invalidation had no sanctioned path forward. Add the missing sequence: cancel through no-mistakes axi's abort command, confirm the run has stopped through axi status, recover branch ownership through axi sync's guarded recovery, only then replace the obsolete work, and validate once against the final head. The existing ban on hand-editing an active run now cross-references this sequence instead of contradicting it. * no-mistakes(review): Make validation custody recovery conditional * no-mistakes(document): Clarify validation supersession abort exception * fix: keep obsolete pipeline commits out of the superseded deliverable The review-applied fix made custody recovery conditional on branch_sync.next_action.code, but left an open gap: recovering custody settles who owns the branch, not what content ships. As written, a worker could recover an obsolete run's branch and build the replacement on top of its now-irrelevant commits instead of from the correct pre-invalidation base, carrying obsolete content into the final deliverable. Make that explicit: custody recovery settles ownership, not content, so the worker replaces obsolete work from the correct base and keeps the obsolete run's commits out of what gets validated and shipped. * no-mistakes(test): Restore minimal pre-invalidation replacement instruction * fix: dedupe redundant "replace the obsolete work" restatement Line 309 already says the worker replaces the obsolete work from the correct pre-invalidation base, excluding the obsolete commits. The closing sentence restated "replace the obsolete work" again before gating the final validation run, layering the same fact twice instead of stating it once. Trim the closing sentence to just the ownership gate and the single-run-against-final-head requirement it uniquely adds. * fix: bind backend overrides to exact-task authority (kunchenguid#1413) * fix: bind explicit --backend to exact-task authority A Herdr-backed second mate carried a prior one-task --backend tmux exception forward by analogy, so its child landed in tmux and never appeared under the second mate in Herdr. Runtime detection was correct; the authority surface was not. docs/configuration.md now owns that an explicit --backend is authorized only for that exact task. AGENTS.md and fm-spawn help point there. * no-mistakes(document): Consolidate backend selection authorization documentation * fix(herdr): prevent focus flashes during projected workspace cleanup (kunchenguid#1229) * fix: remove projected workspaces through Herdr's focus-preserving pane-death path Herdr 0.7.5's explicit close of a workspace-emptying last pane moves the attached client's focus to a neighbor workspace, flashing the captain's whole window and routing in-flight keystrokes to the wrong pane until Firstmate's exact-tab restore masks it 56-197 ms later. Teardown and cleanup now plan a workspace-emptying close as a focus-safe removal: verify the close empties the workspace, reposition the doomed workspace behind the focused one through the verified workspace.move transport when it sits before a non-last focused workspace, prove the pane holds one lone idle shell, and end that shell so Herdr removes the emptied workspace through its focus-preserving pane-death path. Any ambiguity or failure falls back to the plain close behind the existing restore backstop, and fm_backend_herdr_kill applies the same plan for non-projected removals. Two conditions proven on real hardware are encoded in the adapter: BSD ps reports a login shell's comm as "-zsh", and an idle shell transiently hosts a prompt helper right after a workspace.move relayout, absorbed by a bounded strict-sample settle window in the idle-shell proof, now the single owner shared with session-start cleanup. An isolated-lab regression reproduces the raw steal on 0.7.5 and proves the plan removes a doomed workspace with zero wrong-focus samples and no corrective focus; unit fixtures cover the position, edge, ambiguity, move and kill failure, escalation, and transient-helper cases. Upstream fixes (kunchenguid#1877 explicit close, kunchenguid#1912 pane death) are merged but unreleased; once released the plan degrades to a harmless reorder-then-remove. * no-mistakes(review): Confirm pane death from structured not-found responses * no-mistakes(review): Serialize Herdr kills and sample focus continuously * no-mistakes(review): Synchronize Herdr focus evidence output * no-mistakes(review): Refuse unlocked Herdr pane closes * no-mistakes(document): Correct Herdr focus-safety documentation * no-mistakes: apply CI fixes * fix: never erase a Herdr task's records while its pane survives a refused close A transient presentation-lock contention could produce a completed teardown while the exact Herdr pane stayed alive as an unowned restored shell: the kill refused the unlocked close (correctly), returned success, the warning was suppressed, and cleanup erased the task's status, turn-end, and metadata records after the isolated copy had already been returned. Teardown now acquires the named-session presentation lock before anything destructive: a contended lock refuses up front while the isolated copy, the task branch, every durable record, and the endpoint are all intact for a plain rerun, and the projected and flat close paths both run under that one held lock instead of acquiring their own. Durable records are erased only once the exact pane is confirmed gone through its structured presence; a refused, skipped, or failed close retains every record with a visible, retryable error, and after a skipped close (unresolvable lock path) only a structured pane_not_found counts as gone - unknown never does. The teardown regression drives a live contending lock holder end to end: the refusal touches nothing (no worktree return, no branch drop, no close attempt), and the retry after release returns the copy, closes the pane under the lock, and removes the records. The unconfirmed projected close now refuses with records retained, and the structured-presence gate has a strict/default unit matrix. * no-mistakes(review): Require structured pane-not-found before Herdr record removal * no-mistakes(document): Correct Herdr record-retention verification date * fix: refuse ambiguity, revalidate SIGKILL ownership, and roll back failed removals Three accepted-contract corrections from the post-CI personal review of the Herdr keep-spaces focus-flash mitigation. Ambiguous endpoint identity no longer counts as a confirmed-gone pane: a missing or malformed target refuses record removal in the structured presence gate, and teardown treats missing confirmation machinery as a refusal instead of skipping the gate, so only an exact structured pane_not_found ever erases durable task records. The pane-death SIGKILL escalation re-reads the exact pane's process information and refuses to signal unless the same shell pid still passes the strict bare-idle ownership proof, so a pid that exited and was reused by an unrelated process is never signaled; the refused escalation falls back to the plain close with the unrelated process untouched. A reposition whose removal is not confirmed no longer outlives the attempt: the emptying-close plan records the verified pre-move order and original index whenever it invokes the mover, and both close owners restore the exact original workspace order through a second verified move, under the same held session lock, before reporting the close as failed. Each defect was reproduced first: the unit matrix documented malformed identity as gone, the PID-reuse regression showed SIGKILL reaching a disowned pid, and the rollback regression showed a single unrestored move. Teardown-level regressions cover unparseable presence retention alongside the strict identity matrix. * no-mistakes(review): Require confirmed Herdr removal and resolvable teardown locks * no-mistakes(review): Enforce structured Herdr closes and teardown preflight * no-mistakes(review): Preflight explicit Herdr close confirmation helper * no-mistakes(document): Document Herdr rollback failure semantics * no-mistakes(review): Captain, harden recursive Herdr teardown safety * no-mistakes(document): Document recursive Herdr teardown evidence * fix: retain nested secondmate home when a recursive child cleanup fails Captain-decided Option A correction for nm-askuser-flash-r6, found during complete-diff rereview of the merged head. cleanup_firstmate_home_children's recursive secondmate branch called itself for a nested child's home without checking the result, then unconditionally removed that home right after. remove_firstmate_home ends in an unconditional recursive delete with no check for leftover records, so a nested secondmate whose own Herdr grandchild failed its confirmed-gone check would have its entire home - retained grandchild records included - erased by the very next line. Guard the recursive call the same way every other fallible call in this function already is: || return 1, skipping remove_firstmate_home and leaving the nested home and its records for a safe rerun. Empirically, fm-teardown.sh's set -eu already halted the script on the prior unguarded call before reaching removal (verified by hand with the guard reverted, under both this session's bash and stock macOS bash 3.2) - the reachable behavior was already correct. The explicit guard is still applied exactly as decided: it matches every sibling call site in the function, and it stops the correctness of this path depending on errexit's well-known fragility under refactors (a wrapping if/&&, or a future subshell) rather than on an explicit check. Adds a teardown-level regression building on the existing direct-child Herdr fixtures: a top-level secondmate contains a nested secondmate, whose own Herdr child's close goes unconfirmed. Proves through the public fm-teardown.sh interface that the nested home, the nested secondmate's own record, and the grandchild's metadata and status all survive, and that the top-level secondmate's record survives too. * no-mistakes(document): Document nested Herdr teardown retention * fix: prioritize completion runway in quota-aware dispatch (kunchenguid#1431) * fix(dispatch): prioritize quota completion runway * no-mistakes(document): Document completion-aware quota runway selection * fix(bin): preserve full task contract in no-mistakes intent (kunchenguid#1447) * Preserve task contract in no-mistakes intent * no-mistakes(review): Preserve complete current task contract in no-mistakes intent * fix(bin): parse punctuated secondmate registry entries safely (kunchenguid#1452) * fix: centralize secondmate registry parsing * no-mistakes(review): Centralize secondmate registry binding validation * no-mistakes(review): Harden registry EOF and symlink validation * no-mistakes(review): Reject unreadable registries before parsing * no-mistakes(document): Document punctuation-safe secondmate registry validation * no-mistakes: apply CI fixes * feat(bin): add durable process-event supervision (kunchenguid#1483) * feat(procevent): supervise long-polling sources into durable events Firstmate had no way to wait on a blocking external process without holding a conversational turn. Add a domain-neutral process-to-event runner plus a thin adapter around the currently published `lavish-axi poll` interface: canonical physical source identity, one machine-wide owner per source, direct argv execution, and durable 0600 result capture before any event referencing it is published on the existing wake queue. No second notifier, no polling control plane, and no retry machinery. A captured result with no durable handled acknowledgement stays eligible for bounded re-announcement across any number of drains and restarts. Draining a wake before acting on it and then starting a replacement session resurfaces the same exact source and sequence, and never puts result payload text in an event line. `fm-procevent.sh handled <source-id> <sequence>` is the only thing that stops re-announcement: generation-keyed, private, path-safe, durable, and atomically idempotent, so a paired external effect gated on its first-time versus repeat report is never authorized twice. An acknowledgement is refused unless matching captured result and adapter records already exist, so a premature or mistyped call cannot suppress a future result. The source side is unchanged and still lossy: the published poll clears feedback destructively before returning it, so a result lost in that window is unrecoverable. This is never at-least-once, no-loss, or lossless, and the handled acknowledgement is not a generic exactly-once effect either - a crash between an external effect and its acknowledgement can still repeat that effect on replay. Integrate registered sources with watcher supervision, the guards, and recoverable secondmate teardown across nested homes, and cover source identity, lifecycle races, supervision, restart handling, and cleanup safety with regressions. * no-mistakes(review): Prevent Lavish prompt text from spoofing missing sessions * no-mistakes(review): Serialize publication and secure handled acknowledgements * no-mistakes(document): Document hardened process-event acknowledgement guarantees * fix(procevent): never reclaim a source whose owned group still runs A runner is its own process group leader and starts the blocking source in that group, but the claim records only the leader PID and its identity. If the leader died while the source child kept running, the missing PID was classified stale: reconciliation released the claim and started a second runner while the old blocking source was still consuming the same canonical source. For the Lavish adapter that means two destructive long polls racing on one review session, so it is not harmless process litter. It also contradicted the documented promise that ownership is never released until the whole group is gone. Ownership state now distinguishes a generation that is really gone from one whose leader crashed with its group still alive. Reconcile stops that surviving group and releases its exact generation before starting any replacement, and keeps the claim for a later cycle when it cannot prove the group stopped or another home owns it. Acquisition and `start` treat the same state as held rather than reclaimable. Signalling that group is safe precisely because only an absent leader reaches this state. A reused PID leaves the leader alive, so the identity comparison still classifies it stale or uncertain and no group signal follows, which keeps the existing PID-reuse refusal intact. Add a public-interface regression for the exact crash cut - SIGKILL only the leader, prove the child group survives, reconcile, and prove the old group is gone with no second source running - plus its counterexample that a generation with no leader and no surviving group is still reclaimed. Update the runner help, operating documentation, skill, and verification record where they described reclaim in terms of the leader alone. * no-mistakes(review): Enforce runner group ownership and detect poller overlap * no-mistakes(review): Isolate runner groups from unrelated caller processes * no-mistakes(document): Document isolated process-event runner launch * no-mistakes(lint): Suppress Perl literal ShellCheck false positive * fix(bin): retire terminal process events and surface queued wakes (kunchenguid#1500) * fix(bin): deliver process-event results and retire ended sources Two defects reproduced during a real Lavish adapter session. One human `Send & End` produced four captured results: the real feedback, then recurring empty ended sessions. The generic runner had no way to learn a source was finished, so every reconcile restarted a poll that returned immediately. The runner now asks the source's own adapter - `fm-procevent-<adapter>.sh terminal <result-file>` - and on exit 0 alone re-proves ownership, drops the registration, and releases its own claim under one source boundary. Terminal knowledge stays adapter-owned: for Lavish that is an ended session, a missing session, and the final feedback delivery the published poll marks with `session_ended`. An adapter with no terminal command keeps its source armed exactly as before. Capture before publication, captured-result durability, queued wake durability, bounded re-announcement, handled deduplication, one-owner ownership, and explicit idempotent retirement are all unchanged. A captured result queued its `check` wake durably, but a healthy watcher with a fresh beacon never delivered it; the result surfaced only after a manual drain. Publication happens outside the watcher (in the runner) or unconditionally (in reconcile), so the watcher had no newly actionable signal to report and never reached its rewake path. It now reports a queued-but-unsurfaced process-event record through the same actionable exit every other wake uses, deduplicated by the same `.seen-*` marker discipline the signal scan uses, so the record is always durable before it is suppressed. The durable queue remains the authority and no second notifier, poller, timer, queue, or adapter-specific wake path is added. Regressions cover both, driven end to end: an armed Lavish source against a stand-in for the published poll polls once, captures once, publishes one distinct event, and retires itself; two fixture adapters prove the terminal decision follows the adapter alone; and a real capture plus a real watcher prove one proactive wake before any drain, with no duplicate wake while the record stays queued or after it is acknowledged. * no-mistakes(review): Harden process-event retirement and proactive delivery * no-mistakes(review): Route process-event delivery through shared wake owner * no-mistakes(document): Clarify process-event delivery and retirement documentation * no-mistakes(lint): Fix ShellCheck control-flow warnings * no-mistakes(lint): Fix wake output status lint warning * perf: shard portable serial tests across CI runners (kunchenguid#1544) * perf(ci): shard the portable serial behavior lane across runners The Behavior portable serial job ran all 69 scripts of the serial remainder on one runner. The measured serial sum on run 30725985757 was 1143762 ms (19m04s) against a 20-minute timeout, so the job intermittently reached the cap and was cancelled with every step passing. Setup is only about 7s, so the cost is entirely test wall time. Split the lane into four separate-runner shards. Each shard is still strictly serial, and separate runners mean no two of these stateful scripts ever share a machine, so the split needs no concurrency isolation proof. Assignment is longest-processing-time bin packing over measured per-script duration hints, balancing every shard to 285941 ms (~4m46s) of expected work, and the timeout tightens from 20 to 15 minutes. bin/fm-test-run.sh owns the shard count and refuses a lane whose "ofN" disagrees with it, while ci.yml derives the same count from strategy.job-total rather than a literal, so changing it in either file alone fails the lane loudly instead of leaving part of the required suite unrun. --check-coverage additionally proves the shards are non-empty, disjoint, and exactly equal to the serial lane. No test is weakened, skipped, or removed. Also replace the wall-clock sleeps in the --jobs scheduler test fixture with an explicit signal handshake between the fixtures. The old 0.5s-versus-0.05s race failed on a loaded machine; the handshake passes under sustained CPU saturation. * no-mistakes(review): Correct portable serial shard balance evidence * no-mistakes(document): Document portable serial shard evidence accurately * fix(bin): correct session lock and attached watcher supervision (kunchenguid#1545) * fix(bin): identify harness sessions by path and report delivered wakes Two supervision faults, both reported by a contributor and both open on the default branch. Fault 1: the Stop auto-arm never claims the home. fm_harness_ancestry_pid() matched only the basename of `ps -o comm=`, and Claude Code's native installer names the per-session executable by its version (.../share/claude/versions/ 2.1.220), so that basename identifies nothing. Three real failure shapes follow: a version-named session is missed entirely and the hook exits 0 with the epoch never written (unconditional on Linux, where procps reports the kernel exec name and ignores argv[0]); a claude-named daemon that directly parents sessions wins the outermost-contiguous-claude rule ahead of the session itself; and a session that is both version-named and daemon-parented has its live lock reclaimed as stale and rewritten to the shared daemon pid, corrupting the home's ownership record. Harness identity now also reads whole components of the executable path and of argv[0], which is what both platforms still carry. Matching whole components only keeps that widening safe: bin/fm-claude-stop-autoarm.sh and ~/.claude/hooks scripts have no "claude" component. Ownership is then decided against the session's whole contiguous harness ancestry rather than one chosen pid, which is the honest form of the question the library already documents ("does the current process descend from that same harness?"). That subsumes the outermost-pid rule for Claude's nested bg-spare worker chain instead of reverting it, and lets a daemon-parented session recognize its own lock. Lock acquisition still writes the outermost pid of the run, the only pid that lives as long as the session. Fault 2: an attached arm reports a delivered cycle as FAILED. The watcher prints its one reason line to its own stdout, so only the arm that forked it can read that line; an arm that attached observes nothing but a released lock and called a completely successful cycle "cycle ended without an actionable reason". No supervision event was lost - the durable queue held it - but every harness protocol reads that line as "supervision is down" and directs a manual re-arm. The arm now resolves an unobservable close against the durable wake queue, which records every wake before the watcher prints it and whose sequence counter never rewinds, not even across a drain. A cycle the queue proves delivered a wake reports that wake and exits 0; a cycle whose records a handling turn already drained reports the delivery without inventing a reason line; only a cycle that delivered nothing is still the typed nonzero failure. Fixing it in the arm covers codex, opencode, pi, grok and kimi, not just the Claude Stop path. Regressions: tests/fm-session-lock-ancestry.test.sh pins both platforms' ps semantics behind a deterministic process table and runs the real Stop auto-arm in version-named, daemon-parented, and combined real process trees, each orphaned so the walk cannot escape the fixture. tests/fm-watch-arm.test.sh drives a real watcher and a real attached arm through a real wake. Every fault case fails on the previous code. * no-mistakes(review): Bind watcher delivery records to process identity * no-mistakes(review): Return validated watcher identity atomically * no-mistakes(review): Track watcher successors by PID and identity * no-mistakes(document): Consolidate watcher arm-cycle documentation ownership * fix(bin): harden Claude supervision auto-arm recovery (kunchenguid#1495) * fix(supervision): harden Claude auto-arm failure handling * no-mistakes(review): Guarantee automatic retry after Claude auto-arm failures * no-mistakes(review): Gate attended fail-open on verified supervision failure * no-mistakes(document): Document Claude auto-arm retry and guard scope * no-mistakes: apply CI fixes * fix(supervision): make Claude fail-open progression monotonic * no-mistakes(review): Preserve auto-arm failure episodes until verified watcher recovery * no-mistakes(review): Linearize auto-arm failure progression across existing locks * no-mistakes(review): Linearize positive recovery across shared failure episode lock * no-mistakes(review): Scope Claude recovery contention to Claude guard mode * no-mistakes(document): Align supervision auto-arm documentation * no-mistakes(review): Preserve actionable wakes despite healthy successors * no-mistakes(document): Refresh supervision auto-arm documentation --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
…licts chore: record upstream ancestry (zero content change; repairs PR #32 squash)
…34) * fix(bin): keep a released task's PR landable through the sanctioned path The captain's parked-completion ruling releases a ship worker once its pull request is done, green, and mergeable - that is, before it lands. Cleanup then removes state/<id>.meta, and both bin/fm-pr-merge.sh and bin/fm-pr-check.sh refused with "task metadata is unavailable" without it. Following the ruling therefore stranded the pull request from the only sanctioned merge command, and AGENTS.md section 7 forbids reaching around that guard with a lower-level one. Landing identity now comes from the forge rather than from the caller: - bin/fm-teardown.sh leaves a minimal private state/<id>.landing record (pr, the forge's pr_head, project) when it releases a ship task whose request has not landed. The forge decides: the record is written unless the forge positively reports the request merged, because an unreachable forge is not evidence that anything landed. A failed write warns and never blocks cleanup, and the pending landing is reported so the released request is not forgotten. - bin/fm-pr-lib.sh resolves "the task's PR identity record" in one place, as the meta while a task is live and the landing record once it is released. The merge poll's validity and retirement checks go through that resolver, so a released task's merge watch can be rearmed and still retires normally. - bin/fm-pr-check.sh and bin/fm-pr-merge.sh accept a released task through that record, and rebuild one from a forge read of the request itself for a task released before landing records existed. Nothing is asserted by the caller. - A merge through a landing record re-reads the request at its forge and refuses unless it is still open, so no stale local value decides anything. It arms no poll, because a released task has nothing left to watch and the merge is synchronous, and the spent record is removed once the request lands. The metadata refusal is preserved exactly where it still means something: a task with no meta, no landing record, and no request the forge can resolve is refused before gh-axi is called, as before. * no-mistakes(review): enforce landing identity before reconstruction * no-mistakes(document): Document released-task landing identity
…s detection (#20) * feat(bin): add verified pi-signed runtime adapter (kunchenguid#1145) * feat: add verified pi-signed adapter * no-mistakes(review): Correct pi-signed maintainer verification date * no-mistakes(review): Correct remaining pi-signed verification dates * no-mistakes(review): Preserve authoritative pi-signed runtime identity * no-mistakes(document): Document pi-signed shared adapter semantics * no-mistakes: apply CI fixes * fix(pi): rearm watcher across session transitions (kunchenguid#1166) * fix(pi): rearm watcher across same-process session transitions Pi emits session_shutdown for ordinary /new, /resume, and /fork replacement as well as terminal quit. The primary watcher extension latched a module-level stopping flag on every shutdown, so a replacement session in the same process could not arm monitoring until Pi restarted. Own arm authority per session generation so only the active live generation may start, stop, or rearm the child. Replacement sessions can arm again without restarting Pi, stale prior-generation callbacks cannot mutate the active cycle, and real quit still blocks late rearm. * no-mistakes(review): Preserve Pi generation isolation and exit cleanup * no-mistakes(document): Correct Pi watcher transition documentation * feat: route crew dispatch using quota-window pace (kunchenguid#1172) * Consume quota-axi pace signals in dispatch profile array selection. Add quota-array-dispatch as the single owner of the pace-aware candidate choice, keep AGENTS.md to the intake boundary and load trigger, and cover the acceptance cases with sanitized schemaVersion 3 fixtures. * no-mistakes(review): Stop and report genuine quota dispatch ties * no-mistakes(document): Document quota pace freshness and uncertainty * fix: adapt Grok Stop continuation and harden endpoint cleanup (kunchenguid#1171) * fix(grok): adapt Stop continuation to runtime capability * no-mistakes(review): Reject ambiguous Grok Stop payloads * no-mistakes(review): Reject duplicate Grok fields and accept spaced tmux sessions * no-mistakes(review): Enforce exact tmux cleanup selectors * no-mistakes(test): Fix historical tmux fixture and validate Grok Stop * no-mistakes: apply CI fixes * fix: restore stock macOS Bash 3.2 brief scaffolding (kunchenguid#1093) * fix(brief): make DOD scaffolding parse-safe on stock macOS Bash 3.2 fm-brief.sh built each Definition-of-done block and the not-enabled Herdr declaration with `VAR=$(cat <<EOF ... EOF)`. On Bash 3.2 (macOS /bin/bash) the lexer scans for the command substitution's closing `)` textually and tracks quote state through the heredoc body, so a single apostrophe, unbalanced quote, or unbalanced paren in that prose breaks parsing of the whole script. Every ship-brief scaffold (no-mistakes, direct-PR, local-only) failed with `unexpected EOF while looking for matching )`. Bash 4+ parses it fine, so the breakage stayed invisible everywhere except stock macOS. Replace all four command-substitution heredocs with `IFS= read -r -d '' VAR <<EOF || true`. That removes the `$(...)` wrapper and the entire defect class regardless of future prose, and preserves the variable expansion the direct-PR and local-only bodies need. `read` keeps the heredoc's trailing newline that `$(...)` used to strip, so trim one newline to keep every generated brief byte-identical to prior output. Guard the structure, not one historical phrase: a new test rejects any heredoc nested in a command substitution anywhere in fm-brief.sh, where the old assertion pinned a single apostrophe phrase and so missed the reintroduction. Extend the stock-macOS Bash CI job from parsing one script to the whole maintained shell surface (bin/*.sh, bin/backends/*.sh, tests/*.sh), matching bin/fm-lint.sh's canonical file set so parse scope and lint scope cannot drift apart. * no-mistakes(review): Captain: harden Bash structure and inventory guards * no-mistakes(document): Align stock macOS Bash contributor checks * no-mistakes(lint): Suppress deliberate SC2016 literal fixture warnings * test: stabilize tmux teardown conformance baseline (kunchenguid#1209) * fix(test): pin teardown tmux baseline to historical kill selectors merge-base HEAD main collapses to HEAD after the exact-selector change lands on the default branch, so the old teardown fixture was accidentally exercising current exact targets. Resolve a content-historical permissive tmux adapter from first-parent history and force that post-squash topology inside the conformance case so main and feature branches keep the same old-vs-new contract. * no-mistakes(lint): Suppress intentional literal-pattern ShellCheck warnings * docs: slim quota-array-dispatch to the pace selection core (kunchenguid#1197) Cut the runtime skill to the compact pace-aware selection procedure plus minimum owner pointers. Keep every distinct decision rule and move expanded acceptance scenarios to deterministic fixture ownership assertions. Size: 170/1374/10187 -> 63/544/4068 (about 63%/60%/60% reduction). * feat(bin): inherit backend config into secondmate homes (kunchenguid#1219) * Inherit config/backend into secondmate homes with deliberate-override preservation Add backend to the shared inheritable config allowlist so launch, locked bootstrap, and config-push converge a primary pin into secondmate homes as each home local future-spawn default. Track last-inherited bytes in a private state provenance marker so deliberate per-home overrides survive present and absent primary convergence, keep --backend and FM_BACKEND stronger, and extend the existing inheritance tests plus docs and skill claims. * no-mistakes(review): Preserve equal unprovenanced backend overrides * no-mistakes(review): Preserve symlink overrides and verify spawn precedence * no-mistakes(review): Snapshot backend inheritance for consistent provenance * no-mistakes(review): Simplify backend inheritance to primary-authoritative convergence * no-mistakes(document): Document inherited backend override preservation * fix: restore primary-authoritative backend inheritance after document regression The document step reintroduced provenance and deliberate per-home override semantics after review had simplified config/backend to plain primary-authoritative allowlist membership. Restore the primary-always-wins path: present overwrites, absent removes, no provenance marker, and docs/tests match that contract. * no-mistakes(review): Add divergent backend precedence regression fixtures * no-mistakes(document): Document backend inheritance contract * fix(pi): remove Calm's upper version ceiling (kunchenguid#1226) * fix(pi): remove Calm's exclusive Pi upper-version ceiling tests/fm-calm-pi-extension.test.sh gated on a closed PI_COMPAT_VERSIONS allowlist ("0.81.1 0.82.0") that refused any other installed Pi, and docs described that range as "supported" rather than verified evidence. The Calm CHANGELOG shows no API introduced at either version, so there is no evidence for a real minimum; the presentation adapters already probe the exact method they patch rather than checking a version. Replace the allowlist with dated version evidence that never rejects a newer Pi, and make each presentation adapter degrade independently with a diagnostic if a future Pi removes its API, instead of the whole Calm extension failing to load. Rewrite the feasibility doc's "Pi 0.81.1 through 0.82.0" phrasing to state it as verified evidence, not a ceiling. * no-mistakes(review): Probe missing Calm adapter exports safely * no-mistakes(document): Document Calm's unbounded Pi compatibility * fix(bin): allow session-local todo tools in the subagent guard (kunchenguid#1204) * fix(guard): allow session-local todo tools in the primary The delegation-shape guard denied TaskCreate and TaskUpdate because their normalized names contain the `task` stem. Those tools write only the harness's session-local todo list, which has no executor: it spawns no agent, allocates no worktree, registers no schedule, and starts nothing that outlives the session. That is not the unaccounted work the guard exists to stop, so the stem match was a false positive, and the deny text told the primary to run bin/fm-brief.sh and bin/fm-spawn.sh to create a todo entry. Add a separately-reasoned PLAN_ONLY_TOOLS exact-name exclusion rather than widening OBSERVE_ONLY_TOOLS, whose documented contract is tools that only observe or stop existing work. Both lists stay exact-name so neither can widen by substring. Tests cover the two allowed names and six near-miss names that a substring or shortened-stem widening would release; both mutations were watched red. * no-mistakes(review): drop session-local todo tools from recommended deny list * no-mistakes: apply CI fixes * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid (kunchenguid#1206) * fix(session-lock): resolve Claude bg-spare ancestry to the outermost claude pid fm_harness_ancestry_pid() previously returned the first ancestor process whose command matched a verified harness name. Claude Code's Stop hook fires as a bg-spare worker several levels below the session's actual lock-owning claude process (hook shell -> claude bg-spare -> claude bg-pty-host -> claude -> claude(lock)), so the first match was the bg-spare worker, not the lock owner. fm_session_lock_owned_by_self() then never matched state/.lock, and the Claude Stop auto-arm silently treated its own primary session as an unrelated live owner and never armed the watcher. The walk now keeps going past a claude-named match, looking for a still more ancestral claude-named match, and stops the instant a non-match follows an already-found match (bounding it to a contiguous run rather than the literal ancestry top, so an unrelated claude-named process further up the real process tree is never mistaken for part of this session's own nested chain). Every other harness keeps the original first-match-wins behavior, since e.g. Pi's shared signed-wrapper ancestry actually holds the session at the inner engine pid, not an outer wrapper pid. Hop limit raised from 8 to 16 to cover the deeper bg-spare chain. * no-mistakes(review): Add nested-claude-ancestry regression test; fix nudge doc depth claim * no-mistakes: apply CI fixes * fix: conferma l'avvio del watcher su Windows/MSYS (kunchenguid#1212) * fix: confirm watcher startup on MSYS * no-mistakes(review): gate MSYS arm ready timeout, cache uname, harden locale test * no-mistakes(review): validate OpenCode ready timeout, make uname cache internal * fix(spawn): forward CLAUDE_CONFIG_DIR to claude crewmates (kunchenguid#1195) * fix(spawn): forward firstmate's CLAUDE_CONFIG_DIR to claude crewmates Crewmate panes are created by a long-lived tmux/herdr daemon that does not inherit firstmate's current environment. When firstmate runs under a non-default CLAUDE_CONFIG_DIR (for example a work-vs-personal subscription split), a bare `claude` in the crewmate pane fell back to the default ~/.claude store and launched unauthenticated, blocking the crewmate before it could do any work. fm-spawn now prefixes the claude launch with firstmate's own resolved CLAUDE_CONFIG_DIR when set, so the crewmate uses the same credential/config store firstmate is authenticated with. An unset value is the single-store default and adds no prefix; non-claude harnesses are unaffected. Adds three tests in fm-spawn-dispatch-profile.test.sh (forwarded-when-set, omitted-when-unset, non-claude-ignored) and pins CLAUDE_CONFIG_DIR in the test helper so launch assertions no longer depend on the developer's environment. * no-mistakes: apply CI fixes * fix: preserve dispatch identity across authentication checks (kunchenguid#1233) * fix: preserve dispatch harness identity * no-mistakes(review): Fix Grok counterfactual tuple validation * no-mistakes(document): Scope dispatch authentication to selected tuple * fix: restore dispatch instruction budget * no-mistakes(review): Scope dispatch authentication after candidate selection * fix(bin): normalize relative durable paths (kunchenguid#1256) * fix(bin): handle dash-leading harness process names (#2) * fix: handle dash-leading harness process names * no-mistakes(review): Make dash-leading harness regression hermetic * fix: preserve secondmate reply routes across relative homes Resolve relative home, data, and state inputs before durable charter generation, and fail when caller-relative directories cannot be resolved. Use absolute paths at the related spawn, AFK daemon, and X-mode cross-process handoffs so later processes cannot reinterpret them from another working directory. * no-mistakes(review): Preserve absolute overrides and normalize relative durable paths * no-mistakes(review): Normalize relative home before deriving durable paths * no-mistakes(document): Document relative durable-path normalization * no-mistakes(review): Captain: Ignore inherited CDPATH during relative path normalization * no-mistakes(lint): Fix empty CDPATH assignments for ShellCheck * refactor(skills): make Bearings chat-only by default (kunchenguid#1136) * Add internal status skill * no-mistakes(document): register /status skill in documentation-audiences inventory * no-mistakes(lint): replace grep|wc -l with grep -c in status skill test * test: silence literal status skill patterns * Refactor bearings default to chat-only --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> * Clarify follow-up routing during validation (kunchenguid#1277) * fix: honor concrete approval for project operations (kunchenguid#1272) * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * docs: add captain-approved project operation exception to hard rule 1 Firstmate stays read-only over projects by default, but when the captain clearly approves a concrete project operation and scope in the moment, firstmate may perform exactly that approved operation with its own tools. The approval is never inferred, broadened, or standing, and it does not relax the existing force, discard, unlanded-work, or merge-authority boundaries. * no-mistakes(review): Clarify captain-approved project operation boundaries * no-mistakes(document): Clarify captain-approved project operation scope * docs: cover directories and preserve the operation-or-scope alternative Widen the captain-approved project operation exception in AGENTS.md to files or directories, and restore the explicit operation-or-scope alternative that a prior pipeline auto-fix had collapsed into "and". Rework project-management SKILL.md's Remove section, which previously told firstmate to refuse project removal until a guarded helper existed; that helper was never built, so the text directly contradicted the new instruction-only exception. It now points at the exception plus the existing removal preflight it still requires unchanged. Update the one instruction-owners test assertion that hard-coded the sentence removed above, so the suite tracks current, not obsolete, text. * no-mistakes(review): Align project removal preflight with approved exception * no-mistakes(document): Align project removal documentation with approved exception * fix: restore removal test byte-for-byte and preserve the default sentence tests/fm-instruction-owners.test.sh had been changed to assert different text; restore it byte-for-byte to origin/main. project-management SKILL.md's Remove section now keeps the exact default "Never issue a raw removal command from Firstmate." sentence that test still asserts, immediately followed by the already-approved captain-operation-or-scope exception, so the default and the exception both stay explicit and consistent. * no-mistakes(document): Align project-write boundary documentation * fix(skills): route new project intake through secondmate scopes (kunchenguid#1275) * Route project intake through secondmate scopes * no-mistakes(test): Guard all main-home project registry mutations * no-mistakes(document): Consolidate secondmate routing documentation * no-mistakes: apply CI fixes * Restore new-project routing scope * no-mistakes(document): Clarify secondmate routing for new-project intake * no-mistakes: apply CI fixes * fix: scope validation corrections by accepted behavior (kunchenguid#1281) * fix: scope validation corrections by accepted behavior * no-mistakes(review): Classify stale delivery evidence as an autonomous correction * test: replace source assertions with behavioral coverage (kunchenguid#1282) * test: remove source-content assertions * no-mistakes(review): Replace source assertions with runtime behavior coverage * no-mistakes(review): Isolate Kimi task temp runtime coverage * no-mistakes(document): Refresh test cleanup documentation * no-mistakes: apply CI fixes * fix(watch): escalate busy workers with no completed turn (kunchenguid#1286) * fix(watch): bound how long a busy pane may run with no completed turn A busy pane (backend busy state or the harness's rendered footer) was unconditional, unbounded proof of liveness in every escalation path, so a hung foreground tool call behind a busy signature could run for hours undetected (2026-07 hibit-agent-focus-nonsteal-r1 incident: a catastrophic- backtracking regex hung one bash call for 25h behind an unchanging "Working..." footer). FM_BUSY_TURN_MAX_SECS (default 3600s) now bounds how long a busy pane may run with no completed turn (state/<id>.turn-ended, or its spawn record before any turn has completed). Past the bound, busy_turn_over_age routes the pane through the existing wedge_timer_check, reusing the identical stale reason, escalation counter, and demand-deep-inspection marker for human inspection only - never an automatic interrupt, signal, or restart of the worker or its tool process. A completed turn resets the age. Reproduced end-to-end against the real installed Pi TUI: a foreground `sleep 999999` bash call with no timeout renders the actual busy footer, and two captures ~15s apart show the elapsed counter changing the pane hash while the same turn stays unfinished. Running the pre-fix watcher against the real captures showed it never starts a wedge timer no matter how long the pane stays busy; the fixed watcher starts and escalates the timer through the same mechanism, while the real hung process remained untouched and alive throughout. * no-mistakes(review): fix: parse enriched AFK stale reasons * no-mistakes(review): fix: preserve enriched wedges during AFK supervision * no-mistakes(review): fix: route all enriched AFK wedges * no-mistakes(document): Clarify busy-turn age supervision documentation * fix(gitignore): ignore config/ as a directory, not by exact filename (kunchenguid#1261) A name-by-name list of config/ entries silently stops ignoring any new or home-local file placed there, which makes the working tree read as dirty and blocks guarded sync paths that refuse to touch a dirty home. AGENTS.md already documents config/ as captain-private and gitignored as a category; this makes .gitignore match that contract. * fix(tests): replace source-content .gitignore assertion with behavioral coverage (kunchenguid#1304) The second assertion in fm-gitignore-config.test.sh (added by kunchenguid#1261) greps .gitignore for a specific spelling of the config/ ignore pattern. It fails on a semantically equivalent pattern like config/** and does not prove Git actually ignores anything, per the completed source-content-test audit. Replace it with a real git check-ignore control test on a generated unrelated path, and strengthen the existing directory-coverage test with generated unpredictable direct and nested config/ paths. * feat: bound and consolidate startup memory during stow (kunchenguid#1303) * Add bounded startup memory curation * no-mistakes(review): Record reproducible stow verification evidence * no-mistakes(review): Validate inherited secondmate stow evidence * no-mistakes(document): Document editable startup-memory budget propagation * fix(herdr): place workers in the launching workspace (kunchenguid#1328) * fix(herdr): place workers in the launching agent's exact workspace Herdr enforces no workspace-label uniqueness, and spawn resolved its container by taking the FIRST workspace whose label matched the home label. With two workspaces both labeled "firstmate", a worker launched from the second one was created in the first, so it appeared in a different space than the Firstmate the captain was watching. Reproduced end to end on Herdr 0.7.5 protocol 17 by running the real bin/fm-spawn.sh inside a launcher pane in the second "firstmate" workspace: the worker landed in w1 while its launcher was in w2, with an unrelated third workspace focused throughout, which also rules out any dependence on the focused workspace. Placement now binds to the launching process's own Herdr identity. Herdr injects HERDR_PANE_ID, HERDR_SESSION, and HERDR_SOCKET_PATH into every process it manages a pane for, and fm_backend_herdr_launcher_identity resolves that pane's current owning tab and workspace live from Herdr, cross-checking the pane against its tab and confirming the workspace exists exactly once in the session. The injected HERDR_TAB_ID and HERDR_WORKSPACE_ID are creation-time snapshots and are deliberately not read as current identity. Labels are no longer placement authority. A claimed parent identity that is unreadable, contradictory, stale, or from another named session or Herdr server stops the spawn before any worker endpoint exists, rather than degrading to a label search. A launcher with no Herdr ancestry has no workspace to inherit and keeps the per-home labeled container, which must now resolve to exactly one workspace; two same-labeled candidates refuse instead of adopting either. A --secondmate launch keeps standing up that home's own workspace by design. With presentation spaces enabled, the projected child is created and bound under that same exact parent and anchors its ordering on it, so a duplicated home label no longer makes the layout ambiguous. Projection, focus restoration, restart binding, and quarantine rules are unchanged, and children are never collapsed into the parent. tmux, Zellij, cmux, Orca, and the away-mode daemon terminal were each inspected and are not affected: none resolves a container by searching mutable labels. tests/fm-backend-herdr-launcher-workspace-e2e.test.sh drives the real spawn and teardown against an isolated Herdr lab, with its headline case running fm-spawn.sh inside a real Herdr pane so the identity comes from Herdr's own injection. The refusal matrix and the ordering anchor are covered deterministically in tests/fm-backend-herdr.test.sh. Eight existing real-Herdr suites inherited the developer terminal's own Herdr pane into their isolated lab sessions, which the new cross-session check correctly refuses. tests/herdr-test-safety.sh now owns herdr_forget_inherited_pane and those suites call it, so what they assert no longer depends on where they were launched from. Two unrelated fixes found along the way. tests/fm-secondmate-harness.test.sh had the same class of environment leak through CLAUDECODE, which outranks PI_CODING_AGENT in bin/fm-harness.sh and made its pi-signed ancestry case resolve "claude" whenever the suite ran inside Claude Code. And fm-spawn.sh's usage() printed a fixed line range that had already been truncating its own help mid-sentence. * no-mistakes(review): Enforce exact Herdr launcher and projection identity * no-mistakes(document): Document exact Herdr launcher workspace placement * fix(calm): refine Calm working boat animation (kunchenguid#1339) * feat(calm): replace Pi's working row with an animated ship while Calm is on While Calm is active and one logical agent run is under way, Calm now hides Pi's built-in working row and renders a small two-row SSHHIP-derived boat in its place. When Calm is off, Pi's stock working row is left untouched. The presentation uses only public Pi extension API: setWorkingVisible(false) plus a temporary setWidget() component whose render(width) owns the responsive geometry and whose timer requests a TUI render. Visibility follows agent_start through agent_settled, so the boat does not flicker between tool calls, automatic continuations, retries, or compaction inside the same run, and settle, abort, and failure all reach the same cleanup. fm-calm.ts stays the sole owner of the presentation choice and the only caller of setWorkingVisible(); the new lib owns the sprite geometry and widget. * no-mistakes(review): Guarded Calm-off lifecycle visibility writes; focused tests pass * no-mistakes(test): Fixed Calm E2E wait to include tmux scrollback * no-mistakes(document): Document Calm working boat behavior * no-mistakes: apply CI fixes * feat(calm): slow the Calm boat, animate blue water, and make the sail directional The boat now moves one column every 880ms while a bounded fixed-cell water phase advances every 220ms, so the water ripples several times between boat steps and the presentation reads as calm. One scheduler drives both clocks and disposing the widget stops them together; ticks rather than wall-clock timestamps drive every state change, so tests seek animation time exactly. Colors are standard ANSI foreground codes instead of theme lookups: blue for every water cell and yellow for the complete boat, each run closed with a default-foreground reset so nothing bleeds into padding or later frames. ANSI bytes never enter geometry, so visible width stays exact. The mainsail is directional and trails aft of the mast: <| travelling right and |> travelling left. Direction reverses the moment the boat lands on an endpoint, so the endpoint frame already shows the new heading and no frame at or after a bounce shows the previous sail. * test(calm): wait for the Ctrl+O expansion redraw this block asserts * docs(calm): record the revised working-presentation verification evidence * no-mistakes(document): Fix Calm feasibility document EOF whitespace * fix(dispatch): preflight candidate auth before quota escalation (kunchenguid#1349) * fix(dispatch): scope candidate authentication to its own surface A locally expired timestamp in one credential store was reported to the captain as a sign-out, including for dispatch candidates that never read that store. A `harness=pi, model=xai/grok-*` candidate authenticates through Pi's own xAI credential, but the only Grok quota reading available was gated on the standalone Grok CLI's separate token, whose expiry clock drifts independently. The always-loaded intake rule then turned that unreadable quota into a mandatory captain escalation. Add `bin/fm-auth-preflight.sh` as the deterministic owner of the parts that must not depend on agent memory: it resolves a tuple's authentication surface from quota-axi's own emitted auth sources rather than from a harness or model name, so another harness's CLI can never gate a candidate that does not use it. A vendor CLI is launched only when the tuple's own harness owns the credential store under test and a non-destructive discovery command is registered for it, which today is `grok models` alone. That probe runs at most once with stdin closed and a hard timeout, reads its verdict from the first stdout line because the command exits 0 either way, treats unrecognized output as indeterminate, and never invokes login, logout, or the interactive TUI. Quota is read at most twice, and unknown headroom never makes a candidate ineligible on its own. Update the dispatch procedure to match: usable authentication with unmeasurable headroom stays eligible at lower preference with the unknown disclosed, and stop-and-report is reserved for unresolved authentication, an unresolved relationship, or malformed configuration. Record that Grok's `credits.remaining` is a prepaid balance rather than window headroom. Gate quota-axi at 0.1.16 in bootstrap, the first build reporting per-credential auth sources. A stale install previously passed the presence check silently, which is why a fix published two days earlier was still not in effect. Replace the orphaned quota-array-dispatch fixtures, which encoded a `provider: "xai"` shape the tool never emits and had no consumer, with fixtures shaped like real 0.1.16 output that the new suite drives the script against. The suite asserts the verdict and, separately, which vendor CLIs were launched, so a Pi/xAI candidate reaching the Grok CLI fails. Map `tests/fixtures/<dir>` to its consuming suite so a fixture change selects the right tests instead of refusing. * refactor(bootstrap): give the quota-axi floor one owner The floor was stated twice - once in bootstrap's gate and once inline in the auth preflight - so bumping it needed two edits that could drift. Move it to bin/fm-quota-axi-lib.sh alongside its rationale, matching the existing tasks-axi library, and derive the comparison from the constant so the number appears exactly once. Bootstrap turns a failing check into the operator diagnostic; the preflight refuses to emit an unscoped verdict. Map the new library to both consuming suites so a bump re-runs them, and record that any usable source means the surface authenticates. * no-mistakes(review): Captain: bound quota checks and removed Python dependency * no-mistakes(review): Captain: enforce conservative headroom and exact preflight retry * no-mistakes(review): Captain: preserve OpenCode eligibility without auth-surface guessing * no-mistakes(review): Captain: reject malformed OpenCode model relationships * no-mistakes(review): Captain: exempt verified unmodeled tuples from intake escalation * no-mistakes(document): Updated dispatch authentication documentation * no-mistakes: apply CI fixes * feat(x-mode): reconcile promised public replies deterministically (kunchenguid#1350) * feat(x-mode): reconcile promised public replies deterministically A promised final reply in an X or Discord thread was only kept while the primary remembered it. Compaction or restart erased that memory, so a typed public-followup obligation could sit at pending-work after its PR merged and the original thread never got its reply. Make the promise durable state instead: - bin/fm-public-followup-emit.sh reports a typed terminal work result (source home, work id, generation, outcome, safe deliverables, bounded public-safe text) into the owning home's private inbox. The event id is derived from that identity tuple, so duplicate reports and restart replay converge with no coordination, and nothing ever parses a free-form done: sentence. - bin/fm-public-followup.sh registers a commitment, reconciles events through tasks-axi public-followup, and runs the idempotent delivery sequence (begin-delivery with the payload hash, post, record the posted receipt or a typed error) against the stored platform and opaque thread binding. A delivery interrupted between post and receipt refuses rather than risk a second public reply. - Session start surfaces unresolved commitments from disk, the existing relay poll surfaces a new terminal-result set once, and teardown refuses while this home still owes a public reply for that exact work. tasks-axi public-followup remains the only owner of the obligation state machine, state/x-context/ the only owner of the private request context, and fm-x-reply.sh the only thing that posts. Its new optional --receipt-file is the one addition there, so a caller can record how many messages were sent. A home that never opted into the myfirstmate relay gates out on a single [ -f "$FM_HOME/.env" ] test: no tasks-axi call, no backlog or context scan, no output, and no artifact. Evidence in docs/verification/public-followup.md. * no-mistakes(review): Hardened public-followup reconciliation and ownership guards * no-mistakes(review): Hardened typed terminal cleanup and receipt reconciliation * no-mistakes(review): Automated typed-delivery cleanup and strict backlog validation * no-mistakes(review): Fail-closed parent resolution and registration-safe delivery * no-mistakes(review): Harden relay gating and validate secondmate bindings * no-mistakes(review): Use owner-aware single-gate teardown protection * no-mistakes(document): Correct public-followup documentation drift * no-mistakes(lint): Quote done literals to fix ShellCheck warnings * no-mistakes: apply CI fixes * feat(bin): replace busy heuristics with semantic lifecycle state (kunchenguid#1327) * feat: add semantic busy-state contract owner and event writer One owner (bin/fm-busy-lib.sh) for the captain-approved semantic busy-state redesign: a per-task gen-bound record written only by bin/fm-busy-event.sh, per-harness trusted-source classification with explicit source attribution, busy/idle/unknown/dead semantics where missing, malformed, stale, or untrusted semantic data is unknown - never idle - and endpoint death is the only process-level override. The Grok-only rendered-tail fallback and the standalone-Kimi verification gate live behind the same classifier. * feat: arm busy-state at spawn and convert Pi to the semantic extension path fm-spawn arms the busy-state contract for converted adapters and seeds busy/fm-spawn (the launch brief is a submitted turn). The Pi/pi-signed per-task extension now reports agent_start -> busy and agent_settled -> idle confirmed by ctx.isIdle(), covering auto-retries, compaction retries, tool loops, and queued continuations, while turn_end stays a wake notification touch. Teardown removes the new record, gen sidecar, and lock. Live-verified on Pi 0.82.0: seed -> agent-start busy -> agent-settled idle with the marker still touched. * feat: convert OpenCode to the semantic session.status plugin path The per-task plugin (renamed .opencode/plugins/fm-busy-state.js) now classifies from OpenCode's semantic session.status events - busy and retry are active, idle is inactive - latched to the worker's own session so a subagent child session can never clear the worker's busy state. The session.idle marker touch stays a wake notification. Teardown removes both the new and the legacy plugin filenames. Live-verified on OpenCode 1.17.18 in a real TUI pane: seed -> session-busy -> session-status-idle. * feat: convert Claude to the full lifecycle hooks path The per-task settings.local.json now wires UserPromptSubmit -> busy and Stop, StopFailure, and SessionEnd -> idle, so API-error and shutdown turn ends can never strand a busy record; Stop keeps the turn-ended notification touch. A refused (stale-gen) event exits 0 and stays silent so Claude's own lifecycle is never broken. Live-verified on Claude Code 2.1.220: UserPromptSubmit fires for the argv launch prompt, Stop closes each turn, a mid-stream Escape interrupt fires no closing hook, and the firstmate-controlled idle/fm-interrupt clear resolves it. * feat: gate Codex busy state behind verified semantic sources The approved contract prefers Codex's app-server turn lifecycle with capability negotiation and sanctions its lifecycle hooks as the intermediate. Live probes on codex-cli 0.145.0 show neither is usable for a pane worker: the app-server daemon is unreachable for a TUI thread and refuses to start outside the managed standalone install, and firstmate-written project hooks never fired (interactive with directory trust granted, and exec, both with --dangerously-bypass-hook-trust) while global hooks fired in the same runs. Codex therefore classifies unknown codex-unverified behind an explicit probe rather than falling back to idle or footer text, and fm-spawn installs no unverified Codex wiring. * feat: gate standalone Kimi busy state on live verification Standalone Kimi has no installed binary here, so per the approved contract its semantic path stays guarded and it classifies unknown kimi-unverified rather than idle - and never from its locale-sensitive moon-phase spinner, which the redesign forbids inventing as a state source. The gate records the preferred source order (Wire prompt request lifetime, which brackets a turn and reports cancellation, then the documented hooks including Interrupt because Stop does not fire on interrupts) and the exact evidence required to open it. Arming without wiring would seed a busy record nothing could clear, so both land together behind the same gate. * feat: route busy consumers through the contract and drop the global OR The watcher, crew-state reader, and away-mode daemon now decide busy state through bin/fm-busy-lib.sh: only an exact busy verdict counts as working, and unknown never becomes working or a silent idle, so a crew whose semantic state is missing, malformed, stale, or unverified surfaces instead of being absorbed. Crew-state reports the producing source in its detail. The watcher's global OR regex default is gone; Grok keeps its isolated fallback inside the contract. The daemon's supervisor-pane reader stays rendered-text - that pane is not a recorded task - but is now scoped to firstmate's own detected harness instead of every vendor signature. Secondmate pending-reply observation is deliberately unchanged and documented as a delivery-confirmation signal, not task state. * docs: point busy-state documentation at the single contract owner Adds a maintainer-architecture section naming bin/fm-busy-lib.sh as the owner of what busy means, with per-adapter sources, the unknown-never-idle rule, the endpoint-death override, and the two rendered-text readers that deliberately stay outside the contract. Replaces the stale regex-first prose in architecture, tmux-backend, herdr-backend, and configuration; converts the harness-adapters per-harness rows from UI signatures to the semantic source each harness uses; and records the live verification evidence, including why Codex and standalone Kimi stay unknown. * fix: arm away-launch signal handlers before acquiring the lifecycle lock fm_afk_launch_main acquired its lock and only then installed the EXIT, INT, and TERM traps. A signal arriving in that window terminated the process by default action and left the lock directory behind, which blocks the next away-mode launch until the stale-owner reclaim path clears it. The release helper only removes a lock this process owns, so the handlers are now armed first. The accompanying test also killed the child whether or not the lock had appeared and sampled cleanup the instant wait returned; it now requires the lock, then allows a bounded settle, so it proves the guarantee instead of racing it. * test: align fleet, Kimi, lifecycle, and detection suites with the contract The fleet snapshot and wake-daemon lifecycle fixtures now prove a working crew through its own semantic busy-state record instead of rendered pane text, which is what those consumers read. The Kimi watcher test asserts the approved contract directly: a standalone Kimi task classifies unknown rather than matching its moon-phase spinner, while Grok's isolated fallback still classifies only Grok. The pi-signed detection cases clear ambient harness markers, fixing a pre-existing failure where the running session's own CLAUDECODE outranked the fixture's marker. * fix: stop teardown from deleting a project's own Codex hooks file An intermediate revision wired Codex through a firstmate-written <worktree>/.codex/hooks.json, and teardown removed it alongside the other generated wiring. The Codex wiring was dropped when its probes came back unverified, so that removal now targets a file firstmate never creates - and a project may legitimately track its own .codex/hooks.json, which teardown would then delete from a pooled worktree. * fix: keep busy-record parsing from disturbing its sourcing caller The record parser split fields with set -- under a temporary noglob, which clobbers a sourcing caller's positional parameters and restores glob expansion even when the caller had disabled it. The watcher, the daemon, and the crew-state reader all source this library, so it now reads fields with read -a, which never globs and never touches caller state. * docs: state exactly which Claude hook paths were reproduced live The busy-state record listed all four wired Claude hooks in the source column, which could read as a claim that every one fired during the pass. UserPromptSubmit and Stop did; StopFailure and SessionEnd are wired from hook names confirmed present in the installed binary, but the abnormal turn ends they cover were not reproduced. * test: let reset_fakes own the crew-state busy-text fixture lifecycle The Grok fallback case set FM_FAKE_BUSY_TEXT and cleared it inline, so the variable's lifetime was owned by one test rather than by the shared reset that every other fake already uses. * no-mistakes(review): Fix semantic busy-state lifecycle races * no-mistakes(review): Make busy-state retirement idempotent * no-mistakes(review): Enforce semantic state boundaries for status and injection * no-mistakes(review): Restore harness-scoped away-mode busy guard * no-mistakes(document): Refresh semantic busy-state documentation * no-mistakes: apply CI fixes * fix: preserve Calm boat continuity across working periods (kunchenguid#1356) * fix(calm): resume working boat from frozen column across runs Keep one extension-owned boat animation for the Pi session so settling freezes column and direction, the next working period resumes there without hidden-time jumps, and only a fresh session resets to the left edge. * no-mistakes(review): Freeze Calm boat from last rendered state * no-mistakes(document): Document Calm boat continuity contract * fix: restore evidence-based dispatch eligibility (kunchenguid#1358) * fix(dispatch): judge candidate provider relations instead of rejecting them Firstmate deterministically dropped supported Pi candidates in the openai-codex family. bin/fm-auth-preflight.sh resolved a harness=pi tuple's credential surface by constructing the source id `pi:<model-prefix>`, so `pi + openai-codex/gpt-5.6-terra` looked for a `pi:openai-codex` source. That source does not exist, because Pi's Codex family authenticates through the Codex store quota-axi already lists as `auth-json`/`cli-rpc`. The tuple returned `eligible=no reason=surface-unresolved` while the Pi catalog listed the model and the Codex provider reported fresh, usable credentials with 64 effective percent remaining on its all-model scope. The prefix construction was only ever valid where Pi holds its own credential (`pi:xai`, `pi:kimi-coding`), which is why every previously configured Pi tuple resolved and the defect stayed hidden until a Codex-family Pi model was configured. Retire dispatch eligibility from deterministic shell. The dispatching first mate now establishes model support and provider family from each harness's authoritative catalog, applies quota at the granularity the vendor supplies, and shows that reasoning. Provider-level and all-model evidence bounds every model established in that family; a named-model window bounds only its own model. Missing model-level quota, a missing auth source, unmeasurable headroom, and unmodeled authentication are disclosed uncertainty. Only concrete contradictory evidence blocks a candidate. Replace the preflight with bin/fm-vendor-auth-probe.sh, which keeps the captain's approved bounded probe envelope without any routing knowledge: it takes no harness, model, or provider, reads no quota, renders no verdict, and holds only a fixed-argv safety allowlist. Its behavior suite proves the absent identity surface, the untouched quota, the uniform exit status, the fixed argv with stdin closed, and a real bound even when the configured bound is zero. Also fixed along the way: a zero FM_*_TIMEOUT silently removed the hard bound, the pinned Grok version had drifted to 0.2.117, and --changed selection refused outright on any deleted bin/ script. AGENTS.md section 4 and quota-array-dispatch own the corrected policy, harness-adapters gets the catalog-responsibility correction, and docs/verification/dispatch-auth.md records the 2026-07-30 evidence on Pi 0.82.0, quota-axi 0.1.16, and grok 0.2.117. * no-mistakes(review): Reject all-zero vendor probe timeouts * fix(harness): recognize every verified harness process name consistently Three places classify a process as a harness, and they disagreed. Measured against current main by running each rule over the same basenames: comm fm-harness session-lock tmux-alive kimi-nightly unknown yes alive pi-launcher unknown no alive Pi unknown no alive Two consequences, both real and both fail-safe rather than dangerous: kimi was matched EXACTLY in bin/fm-harness.sh while its four markerless siblings (claude, codex, opencode, grok) are substring globs, and while bin/fm-session-lock-lib.sh and bin/backends/tmux.sh both matched it as a substring. A kimi under a variant basename was therefore recognized by the other two consumers but self-detected as `unknown`. pi-launcher and Pi - the launcher wrapper and the npm shim basename, both already known to bin/backends/tmux.sh's pane classifier - were absent from self-detection and from the session-lock ancestry regex. A firstmate running under either reported `unknown`, and could not prove it owned its home's session lock, so bin/fm-claude-stop-autoarm.sh's ownership check would decline to arm. fm_session_lock_owned_by_self fails closed, so this was a false negative, never a false ownership claim. Align the two outliers: kimi becomes a substring match like its siblings, and the pi family gains the two missing basenames. The pi family stays ANCHORED on purpose - a bare `pi` substring would also match pip, pipenv, and any path component containing "pi" - so each launcher basename gets its own exact arm rather than relaxing the anchor. Deliberately NOT done: the originally-planned shared process-identity table. It would have replaced ~15 lines of clear in-place literals with 80-100 lines of table, dispatcher, three per-consumer generators, and two exceptions to encode exactly the divergences fixed above - failing the design's own stop condition, with its justifying defect (pi missing from the tmux alive list) already fixed on main by kunchenguid#1145. The inconsistencies were the finding worth shipping; the machinery was not. Coverage extends tests/fm-kimi-harness.test.sh rather than adding a runner, and asserts behavior by executing bin/fm-harness.sh and bin/fm-lock.sh against fake ancestry. Each case was verified to FAIL before the fix: reverting kimi to an exact arm, dropping the pi-family arms, and reverting the session-lock regex each reproduce the original miss. pip, pipenv, and piper are asserted to stay unrecognized so the anti-substring guard cannot be relaxed unnoticed. --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: Daniel Kuykendall IV <danielkuykendall23@gmail.com> Co-authored-by: Trillium Smith <Spiteless@gmail.com> Co-authored-by: Unknownzed <45267749+Unknownzed@users.noreply.github.com> Co-authored-by: lhalbert <lucashalbert@users.noreply.github.com> Co-authored-by: AG <ag@agw3.org> Co-authored-by: deeto15 <92119640+deeto15@users.noreply.github.com>
#1) * fix(merge-local): refuse only on genuine working-tree collisions bin/fm-merge-local.sh refused whenever `git status --porcelain` was non-empty. That is stricter than git itself, which already refuses to overwrite modified files and refuses to fast-forward over an untracked file at an incoming path, and it is self-deadlocking: it blocks the very commit that settles the uncommitted entries (ignore rules plus one index removal), because the cure sits behind the symptom. Refuse only where the fast-forward could actually destroy local work: the intersection of paths uncommitted in the project checkout and paths this exact fast-forward rewrites. The incoming set comes from DEFAULT..BRANCH after the fast-forward check settles, so it is the real change set rather than a diverged two-way diff. Kept safe in the ambiguous directions: - A fast-forward that removes a tracked path deletes it from the working tree, so local modifications there still collide. - An untracked file at a path the incoming commit adds still collides. - Both endpoints of a staged rename count as uncommitted, and the rename's second NUL field is consumed so later records are not misread as status codes. - Unresolved conflicts, unrecognized status codes, truncated records, and failed git commands refuse instead of degrading into a silently empty change set. Untracked files, ignored files, and changes at paths the fast-forward never touches no longer block it. A refusal now names every colliding path and what the merge does to it, which the blanket message could not. Both sides are read NUL-delimited: -z is the only status and diff format that emits paths verbatim rather than quoting names with spaces or non-ASCII bytes. --untracked-files=all keeps untracked entries as individual files, since a collapsed parent directory would hide a collision at a nested path. tests/fm-merge-local.test.sh covers both directions, including the observed deadlock as a regression: two untracked operator documents plus one modified tracked pointer the incoming commit removes from the index must refuse naming only the pointer, then land once that single path is settled. * test(merge-local): pin the nested untracked-directory collision git status collapses a wholly untracked directory to a single "reports/" entry, which hides a collision at the nested path the fast-forward actually adds. The guard passes --untracked-files=all for exactly that reason, so cover it: an untracked "reports/Quarterly Review.pdf" inside an untracked "reports/" must still be named as a collision and must survive the refusal. Dropping --untracked-files=all from the guard fails this test and nothing else, so the flag is now pinned by behavior rather than by comment. * no-mistakes(review): name path-shape collisions and refuse in-progress git operations * no-mistakes(review): reach in-progress sentinels on detached HEAD, split git am from rebase * no-mistakes(review): accept intent-to-add, disambiguate diff revs, catch pending sequencer * no-mistakes(document): correct ignored-path rationale in fm-merge-local header * no-mistakes(review): name in-progress states before divergence; catch collapsed untracked dirs --------- Co-authored-by: Firstmate Crew <crew@example.invalid>
#35) * feat(bin): wake-outcome ledger for measured coordinator attention cost Supervision attention cost was estimated, never measured, and the dormant model-promotion system is gated on exactly this instrument plus a terminal per-task outcome line. Adds data/wake-ledger.tsv, a per-home append-only evidence record, and bin/fm-wake-ledger.sh as its single owner of format, closed outcome vocabulary, and append semantics. Three record kinds: one wake record per drained wake, one outcome record per handled wake joined on the wake-queue sequence, and one terminal task record per finished task. The wake half is written deterministically by the drain and the outcome half by the coordinator. That split is deliberate: a single coordinator-written line would make measured attention cost fall whenever the recording step was skipped, so the metric would move without the underlying quantity moving. Splitting it gives a denominator that is stable under no change and turns missing coverage into a reported number instead of a silent undercount. The ledger cannot block, delay, alter, or fail a wake. Its call site sits below the drain's authoritative print-and-delete boundary, with stdout discarded and failure ignored; the ledger takes no lock and writes one capped line per record. Teardown writes the terminal record immediately before deleting the task metadata, the last moment that task's harness, model, and effort are recoverable anywhere. It lives under data/ rather than state/ because teardown clears state/<id>.* and this evidence must outlive the tasks it describes. Watcher-absorbed wakes stay out by design: they never reach the coordinator, so they are not part of the quantity being measured. * no-mistakes(review): join wake outcomes on (seq, queued) across state resets * no-mistakes(document): note wake-ledger recording step in fm-wake-drain header
* fix(bin): measure pool-slot safety against the landing target The allocation guard resolved its comparison ref from refs/remotes/origin/HEAD and counted commits ahead of it. Neither repository in this fleet lands there: origin fetches from an upstream but pushes to a fork, and a second project replays and fast-forwards locally by design, so its remote-tracking ref only drifts further behind. The guard therefore refused every spawn into a slot left at landed state, which is the normal state after any cleanup, and its documented per-slot override became routine - a refusal that fires on every spawn teaches its own bypass. Measured 2026-08-03 in two unrelated pools. Slots sitting exactly on the fork trunk refused as "32 commits not on remotes/origin/main". Slots in the second pool refused with 286/360/361/362 "commits not on remotes/origin/v1.2-recovery" while on every one of them the tree was clean, merge-base --is-ancestor passed, and rev-list --count against the local trunk was 0. One slot in that pool was a genuine true positive, so the guard was never simply broken; it was measuring against the wrong ref. The defect is remote-tracking ref versus local trunk in general, not anything fork-specific. Introduce bin/fm-landed-lib.sh as the single owner of "has this content already landed?": a tree-containment test (3-way merge, compare trees) rather than commit reachability, which a squash merge or a local replay breaks by construction. bin/fm-teardown.sh keeps its own policy - refresh the remote first, and measure against it - and now shares only that instrument. The guard applies its own policy on top: a slot is empty when any ref carrying the default branch's name already contains HEAD's content, because containment in any trunk proves the content outlives the slot. Refusals keep their wording, FM_WORKTREE_RECLAIM_OK keeps its semantics, and nothing that cannot be verified is treated as safe: an unreadable slot, an unresolvable default branch, and an inconclusive comparison all still refuse. A pool holding both a genuinely unlanded slot and locally-landed neighbours still names only the unlanded one. KNOWN REMAINING DEFECT, deliberately not fixed here: a freshly allocated pool slot is still taken as-found, so it can sit on a trunk far older than the one the fleet runs - the failure that dispatched this very task onto a base with no bin/fm-worktree-guard.sh at all. Fixing it by resetting the slot to the primary default-branch commit was implemented and then withdrawn from this change, because that commit is 33 commits ahead of what origin fetches and every contribution branch cut from it would carry fleet-only work upstream, while resetting to upstream main instead would put every slot on a trunk missing 29 tracked files including 10 bin/ scripts the fleet runs. No single ref serves both roles. spawn-cuts-worktrees-at-upstream-not-fleet-trunk owns that work. * test(gotmp): give the fake teardown root the new shared library tests/fm-gotmp.test.sh builds a minimal bin/ tree by symlinking each sibling the real fm-teardown.sh sources, then runs it as a subprocess. Teardown now sources bin/fm-landed-lib.sh unconditionally, so both fake roots need that symlink; without it teardown exits non-zero before reaching any tasktmp cleanup and the suite fails with "teardown exited non-zero with a valid tasktmp". Caught by CI, not locally: bin/fm-teardown.sh matches an explicit entry in fm-test-run.sh's changed-file map that selects only the pr-forge family, so it never reaches the bin/* reference-scan fallback that would have found this suite in session-bootstrap. Adding the symlink also closes that gap for the new library, whose own bin/* mapping does use the reference scan: a change to bin/fm-landed-lib.sh now selects fm-gotmp.test.sh alongside the guard, teardown, and backend suites.
…er (#37) * feat: add research-approved-work skill and deterministic corpus scanner Answering "which reported work was genuinely approved and remains unimplemented?" meant reading data/**/report.md - 79 files, 5.7 MB, roughly 1.9M estimated tokens - on every asking. This adds the narrow recurring capability instead. bin/fm-research-scan.sh is model-free. It inventories the corpus, fingerprints it against three independent inputs (the reports, the durable decision records, and every implementation HEAD), and reaches a no_delta terminal before opening a single report when none of them changed. Extractions are content-addressed under the report's own SHA-256, so an unchanged report is reused rather than re-read, and the derived index lives under the home's existing volatile-state owner where deleting it is always safe. The evidence provers deliberately under-claim. They report that durable records MENTION an identifier, that repositories MATCH a token at HEAD, and that a pull request title NAMES one - never that something was approved, implemented, or delivered. Running against the real corpus is what forced that: sweeping for LC-R4 hit four commission files that merely asked an investigation to examine it, and "route=" matched unrelated shell locals. A prover that answered "approved" or "implemented" from those would manufacture both. The skill grades the cited excerpts and named paths. The same run found the delivery prober passing a field list the forge tool rejects, then reporting the failed call as "nothing was delivered" - which would re-commission finished work. It now fails loudly instead. The skill is read-only: finding approved work authorises nothing. Tests pin all thirteen behaviours with negative controls that were watched failing first, and each was mutation-checked against a deliberately broken scanner. * docs(skill): align skill wording with the prover verdict names
…38) LoopSpec had zero code in this repository and in every registered project clone, verified at HEAD. This adds the primitive itself, not a runtime: the loop runtime is not operational, so the shipped instance lands in an honest ready_not_active state and no private loop runner is introduced to work around the missing substrate. loopspecs/schema.json is the canonical field contract, covering identity and version, lifecycle status, trigger predicate and source, preconditions, the deterministic selection key and tie behaviour, permitted skills and actions, authority class, goal and success condition, verifier and required evidence, persistent loop state, cadence, retry, backoff and dedup, iteration, time and capacity budgets, no-progress detection, named terminal states, escalation, idempotency, crash recovery, and evidence linkage. loopspecs/triggers.json is the sixteen-trigger register, recording six axes separately so a complete description can never read as an implementation: specified, detector implemented, deterministically selectable, execution path implemented, verified, and enabled. Exactly one trigger is implemented, the merge-conflict poll. No trigger has an implemented execution path, none is verified, and none is enabled. The PR-merged detector is held outside the sixteen because it is not on the canonical enumeration; counting it is what produced the withdrawn two-of-sixteen figure. Every count is computed by the tool and stored nowhere, so no figure in the register can go stale. loopspecs/approved-work-reconciliation.json is one instance for recurring approved-work reconciliation. It references the research-approved-work skill rather than duplicating its workflow, and it cannot become enabled for two independently sufficient reasons the validator enforces rather than asserts: its trigger has no implemented, verified execution path, and its only permitted skill is not installed. bin/fm-loopspec.sh is the single interpreter. It validates, selects and records; it never schedules, spawns, steers, merges or executes a skill. It refuses with a stable token when no spec matches, when candidates remain tied, when a spec is not enabled, when a trigger is unimplemented, when authority is insufficient, when the spec version changed under a running iteration, when required evidence is missing, when the verifier is unavailable or rejecting, when capacity is unknown or inside the stop band, when a budget is spent, when no-progress fires, and when persistent state cannot be read or written truthfully. An unavailable verifier can only reach a failure terminal. Starting an iteration is gated wherever it can begin, so naming a spec directly cannot bypass the checks selection performs. Finishing deliberately is not gated, so disabling a loop never strands work already in flight, and the capacity stop band blocks a new iteration without blocking verification of the current one. tests/fm-loopspec.test.sh proves each guarantee through the public interface, witnessing its negative control fail first.
…ks (#39) * feat(bin): require an explicit per-task delivery contract (kunchenguid#1563) * feat(bin): require an explicit ship delivery mode in fm-brief A ship brief's definition of done was shaped by a silent per-project registry lookup, so an adjusted brief and the task's recorded delivery could disagree and no one had to decide anything per task. fm-brief now requires --mode on ship scaffolds, validates it against the closed set, refuses the conditional no-mistakes-prod-only registry policy as a task mode, and records the choice as a fixed machine-readable "Delivery contract: mode=<mode>" line that fm-spawn can check. --mode is refused on scout and secondmate scaffolds, and --yolo is refused outright because the worker never owns approval decisions. * feat(bin): require an explicit ship delivery contract at spawn and promotion fm-spawn resolved every ship and scout task's mode and yolo from the project registry, so the delivery posture was never a per-task decision and could contradict the brief the worker was about to follow. fm-spawn now requires --mode and --yolo on ship spawns, validates both against their closed sets, and reads the brief's recorded delivery contract line and refuses a mismatch before any endpoint exists; a brief scaffolded before that line existed warns once and launches on the flag. A batch carries one shared contract that each pair still checks against its own brief. Scout and secondmate spawns refuse the flags, and a scout now records no mode or yolo at all, which teardown and the snapshot already tolerate. When the explicit mode carries less rigor than the project's standing posture, a deviation notice is printed and the spawn continues, so the registry stays advisory rather than an enforced default. fm-promote requires the same two flags, because a scout carries no posture to inherit, and writes them into the task record with the kind flip. fm-project-mode keeps its one registry parser for the mechanical consumers that have no task in hand, accepts the conditional no-mistakes-prod-only annotation and maps it to its most rigorous leg for them, and grows --raw so the deviation notice can tell a conditional policy apart from a flat mode. * docs: record the explicit per-task delivery contract AGENTS.md section 7 now owns how each ship task's mode and yolo are resolved at intake, including the surface classification for a no-mistakes-prod-only project and the unregistered-project fallback, and the project-management skill defines that conditional policy as a registration-time posture with its defaults and initialization consequences. The registry blurb, script table, and architecture section follow: the registry records the captain's standing posture, and task delivery is decided per task and passed explicitly. * test: pass ship delivery flags per call site in the Herdr launcher e2e The shared spawn helper also launches a secondmate, which refuses the flags, so the contract belongs at each ship call site rather than inside the helper. * test: pass the ship delivery contract in the secondmate suites Both suites scaffold or spawn an ordinary ship task as the control case for a secondmate assertion, so each needs the explicit contract the ship path now requires. * feat(bin): support remote secondmate homes (kunchenguid#1576) * Add generic remote secondmate transport * Add routed remote secondmate replies * Add remote outbox backlog handoff * Integrate remote secondmate lifecycle * no-mistakes(review): Fix remote snapshot and handoff races * no-mistakes(review): Serialize remote home provisioning transactions * no-mistakes(review): Harden remote lifecycle transaction boundaries * no-mistakes(review): Serialize remote lifecycle mutations and fail closed * no-mistakes(review): Close remote lifecycle and file race windows * no-mistakes(review): Serialize remote reply retirement and inheritance * no-mistakes(review): Harden remote transfer integrity and recovery * no-mistakes(review): Serialize remote respawn with registry retirement * no-mistakes(document): Document remote bootstrap convergence accurately * no-mistakes(document): Clarify skipped remote secondmate mutations * no-mistakes(lint): Resolve remote script ShellCheck warnings * no-mistakes: apply CI fixes * feat: add per-task trace context propagation (kunchenguid#995) * feat(spawn): propagate a native W3C traceparent to spawned agents Add a default-off capability that resolves one W3C traceparent for a task, injects it into the agent's pane shell as the TRACEPARENT environment variable immediately before launch, and records the identical value as traceparent= in state/<id>.meta, so an external observer that explicitly reads that env value or meta field can correlate a worker, a Secondmate, and their nested children into one trace with no collector, storage, UI, or vendor coupling. TRACEPARENT as an environment variable is a firstmate convention carrying a W3C-formatted value: W3C Trace Context standardizes the header, not an env var, and OpenTelemetry SDKs do not read it automatically, so a downstream must consume it deliberately; this feature parents no SDK span by itself. Identity is per task, not per spawn: the carrier is minted with random ids on the first spawn, adopted as a child (fresh span, same trace) for a nested spawn whose parent already holds one, and reused verbatim from the meta on relaunch, so a task keeps one stable logical identity across restarts. A malformed or all-zero inherited value is treated as absent and roots a fresh trace. A new root is sampled (01) - a sampling decision a downstream parent-based sampler honors, not a guarantee that any collector stores a span, and firstmate emits no spans; a child preserves the inherited flag. Trust boundary: a firstmate-minted root is random and reads no prompt, path, task prose, credential, or arbitrary environment key. An inherited TRACEPARENT is opaque caller-controlled data - up to 24 bytes of id passed through after syntax validation - so whoever set it controls those bytes, a bounded fixed-width channel rather than a general content or secret channel. The feature adds no OTEL_* variable, no tracestate, and no arbitrary environment injection; it runs no configurable or arbitrary command, only the fixed local od and tr (resolved from PATH) to read a few bytes of entropy - a small local pipeline with no network or watchdog and no hard latency guarantee. Any entropy or validation failure that returns omits the carrier without aborting the spawn. A default-off spawn leaves the generated meta and launch environment unchanged. Enablement is default-off (config/trace-context, or FM_TRACE_CONTEXT where a non-empty value overrides and unset or empty defers to the file) and is propagated into secondmate homes, taking effect at each agent's next launch: a Secondmate launched or relaunched after enablement carries the primary trace into its nested workers, while an already-running Secondmate roots new traces for its own workers until relaunched. Injection reuses the existing GOTMPDIR channel, so all spawn backends and harnesses and the ship, scout, and secondmate paths are covered. Covered by a pure-library suite and a spawn-path integration test (fake tmux plus a real worktree, hermetic against ambient FM_TRACE_CONTEXT) proving the recorded and injected carriers are identical and sent before launch, that default-off writes and injects neither, that a relaunch reuses the recorded carrier, and that an explicit FM_TRACE_CONTEXT overrides the file both ways; plus a source-owner inheritance test proving trace-context propagates and absence-mirrors through propagate_inheritable_config. Documentation follows the repository documentation-audiences contract: docs/trace-context.md is maintainer-architecture rationale, the configuration schema lives in docs/configuration.md, and the repeatable test evidence is separated into docs/verification/trace-context.md (maintainer-verification), registered in docs/documentation-audiences.json. * fix(spawn): propagate the effective trace-context decision to secondmates FM_TRACE_CONTEXT overrode trace context only in the process that read it. A newly launched secondmate decided enablement from the inherited config/trace-context file alone, so the override did not cross the primary-to-secondmate boundary: FM_TRACE_CONTEXT=off with the file present left the secondmate's nested workers traced (a broken kill switch), and FM_TRACE_CONTEXT=on with the file absent left them untraced despite the inherited carrier. Deliver the primary's effective decision to a newly launched secondmate as a normalized on/off FM_TRACE_CONTEXT in the launch prefix, so a FM_TRACE_CONTEXT override governs the nested primary -> secondmate -> worker chain both ways, not just the copied file. The value is bounded to the literal on/off and does not broaden environment injection; the already-running secondmate boundary is unchanged. Add a genuine two-level spawn regression that drives fm-spawn twice with the exact environment the primary injects into the secondmate and proves both divergent directions end to end. Correct the documentation that implied secondmate coverage on every backend, since orca and cmux reject secondmate spawns, and refresh the verification evidence for the new assertion count. * no-mistakes(review): Clarify Secondmate trace-context launch snapshots * no-mistakes(document): Correct trace-context documentation ownership and relaunch semantics * fix(spawn): resolve the trace-context decision once for carrier and snapshot The effective trace-context decision was read twice per spawn: once inside fm_trace_context_resolve for the recorded carrier, and again for the secondmate FM_TRACE_CONTEXT launch snapshot. A config-file change between the two reads could pair a carrier with the opposite enable state - an injected carrier with an off snapshot, or no carrier with an on snapshot. Freeze the effective on/off decision once, drive the carrier resolution under that frozen FM_TRACE_CONTEXT so it cannot independently re-read the file, and reuse the same frozen decision for the secondmate launch snapshot. Add a spawn-path regression that drives the file-decided path and proves the recorded carrier and the delivered snapshot always agree, and refresh the verification evidence for the new assertion count. * no-mistakes(review): Preserve legacy Secondmate trace boundary * no-mistakes(document): Correct trace-context verification comparison base * no-mistakes(review): Captain, prevent failed trace delivery metadata claims * no-mistakes(review): Captain, align trace-context tests and verification evidence * no-mistakes(document): Correct trace-context verification evidence * no-mistakes(lint): Suppress intentional ShellCheck literal-dollar warnings * no-mistakes(review): Captain: freeze trace context at session start * no-mistakes(test): Captain: stabilize scheduler test and document Kimi trace coverage * no-mistakes(document): Document trace-context safety boundaries * fix(trace): fail off on stale session snapshots Publish each home session decision atomically through a same-directory temporary file and bind it to the current session lock. A replacement failure can no longer leave an earlier on decision active in a later session; missing, stale, malformed, or unpublishable state defaults safely to off. Add regressions for read-only replacement and failed publication, update spawn and session-start fixtures for the lock-bound format, and refresh the architecture and verification records. * no-mistakes(review): Fix trace spawn failure independence and duplicate safety * no-mistakes(document): Refresh trace-context documentation and verification * no-mistakes(review): Clear partial backend input after failed trace submission * no-mistakes(review): Stop unsafe trace delivery before launch append * no-mistakes(document): Document unsafe trace delivery handling * fix(trace): bound each trace to one routed task, never the routing agent A persistent Secondmate holds its launch-time TRACEPARENT in the process environment for its whole life, and routed requests never replace it, so resolving new-task carriers from the ambient environment chained every routed task into one ever-growing trace per Secondmate with distinct parent ids. Resolve now reuses the task's recorded carrier or mints a fresh sampled root, never reading ambient TRACEPARENT, so each routed task is its own trace boundary while relaunch, recovery, and scout-to-ship promotion keep one stable per-task identity. The spawn regression models the reviewed scenario exactly: two unrelated tasks spawned sequentially through one persistent Secondmate environment record and inject distinct trace ids, adopt nothing from the Secondmate's carrier, and a relaunch of the first task reuses its original carrier verbatim. * docs(trace): define the per-task trace boundary The design contract is one task per trace: a persistent Secondmate is routing infrastructure with its own agent identity, never a shared trace root for the unrelated tasks routed through it. Root/recovery semantics replace the removed child-inheritance path, the sampling and safety sections drop inherited-carrier language because ambient TRACEPARENT is never read, and the verification page records the refreshed suite inventories including the two-task Secondmate boundary regression. * test(trace): adopt the explicit per-task delivery contract in spawn fixtures Rebasing onto current main brings the explicit per-task delivery contract: ship spawns now require --mode and --yolo instead of resolving them from the project registry. The trace spawn fixtures pass the same explicit contract canonical spawn tests use, preserving the per-task trace boundary coverage unchanged, and the verification page records the refreshed comparison base. * fix(bin): harden tmux agent liveness across harnesses (kunchenguid#1577) * fix(bin): classify tmux agent liveness independent of process titles `fm_backend_tmux_agent_state` attributed a pane solely from `#{pane_current_command}`, which is a process TITLE a harness can rewrite, not a structural fact. Claude Code 2.1.220 reports its version string there, so a live Claude endpoint classified `ambiguous`: the session-start secondmate liveness sweep could no longer see it, and any consumer that gates on a positive classification refuses outright. Read a second, independent name source: the kernel `comm` of every process in the pane tty's foreground process group. Either source naming a verified harness yields `alive`, because a false `dead` is the one verdict that can start a duplicate agent on a live worktree. Scoping to the foreground process group rather than the pane's descendants keeps a harness-named background process from faking an agent, and covers multi-process launchers (the Pi Launcher path) without a special case. Verified on 2026-08-03 against all seven adapters running for real on tmux 3.6a / macOS 26.5.2 arm64: claude 2.1.220, codex-cli 0.146.0, opencode 1.18.11, pi 0.82.0, pi-signed 0.82.0, grok 0.2.118, kimi 0.31.1 all classify `alive`, each attributed by a source independent of its title. Two tests, because they fail for different reasons: - tests/fm-tmux-agent-liveness.test.sh pins the logic with real processes and no harness, so it runs everywhere CI runs tmux. It drives the two name sources apart on purpose and asserts the divergence, so no case can go quietly vacuous. - tests/fm-harness-liveness-drift-live-e2e.test.sh relaunches every installed harness and fails naming the harness and version when one stops being attributed by a title-independent source. AGENTS.md section 4 carries the resulting standing rule, and firstmate-coding-guidelines owns how to satisfy it. * no-mistakes: apply CI fixes * docs: move the harness-dependent-check policy out of AGENTS.md The standing rule was stated in AGENTS.md section 4 with the mechanics in firstmate-coding-guidelines, which split one contract across two owners and charged every session for a rule that only fires when firstmate's own harness-dependent code is being changed. firstmate-coding-guidelines is now the single owner of both the rule and how to satisfy it: real-harness proof required, that proof authorized to spend tokens, structural signals preferred over vendor-rendered surfaces, and a guard that fails loudly naming the harness and version where a surface signal is unavoidable. No inline stub is left behind, because AGENTS.md already carries the load trigger for that skill in sections 7 and 13, so it is read before any change to firstmate's shared tracked material. Also records the cross-platform lesson the pipeline caught in the portable regression, and corrects that file's header: the divergence assertion lives on the version-string case, which diverges on both supported platforms, rather than on every case. * no-mistakes(review): Harden tmux liveness identity and drift validation * no-mistakes(document): Clarify cross-platform tmux liveness documentation * feat(bin): propagate trace context to remote secondmates (kunchenguid#1609) * feat(bin): trace remote secondmate routes and unify the inherit allowlist Per-task W3C trace context (kunchenguid#995) resolved and injected its carrier only at the local spawn path. A remote secondmate is routed through spawn_remote_secondmate, which returns long before that site and wrote its own metadata block, so a remote secondmate stayed silently untraced even with the capability enabled. The parent home still owns that task's identity, because it holds the metadata an observer reads. It now resolves the carrier against the task's own meta under its own frozen decision - reused verbatim on relaunch, freshly rooted otherwise, never adopting the parent process's ambient TRACEPARENT - and hands it to the configured host through a new fm-spawn --traceparent argument, accepted only for a secondmate launch and only as a strict W3C value. The remote host exports it at the same unconditional pre-launch site and reports back the carrier its endpoint actually holds, which the parent records, so an already-alive endpoint reports the identity its agent really received rather than one the parent merely intended. Disabled remains byte-identical and off. The remote inherit path also carried its own hardcoded copy of the inheritable config set, already drifted from FM_INHERITABLE_CONFIG by trace-context. Both remote ends now derive from that one declaration, so a future item cannot be sent by one side and refused by the other, and session-scoped enablement items are skipped on live convergence exactly as the local path skips them. Also fixes a latent stderr leak: an absent session lock printed a raw redirect failure, which the new remote resolve site made visible. Adds tests/fm-remote-secondmate-trace-context.test.sh, driving the real parent -> fm-on -> remote entrypoint -> control -> remote fm-spawn chain over the deterministic SSH boundary and reading the carrier back from the remote pane's own log. * no-mistakes(document): Clarify remote trace and allowlist contracts * feat(bin): preflight remote runtime tool paths (kunchenguid#1623) * feat(bin): widen the remote runtime PATH and add a remote doctor preflight The fixed remote entrypoint hard-coded a four-directory PATH, so a remote account whose tools live under nix or a per-user profile could not run basic Firstmate work without a login shell. The entrypoint now composes its child PATH from the code root's bin, the account's ~/.local/bin, the common package-manager directories that actually exist on the host, and the portable system tail, deduplicated and in a fixed order, still under env -i with the same variable allowlist and no shell command string. fm-remote-doctor.sh reports that exact PATH by inheriting it from its own entrypoint launch rather than recomposing it, so the ordering keeps one owner. It is read-only, reports where each required and optional tool resolved, and exits non-zero naming every required tool that did not. Remote seeding runs it as a preflight before anything is created on the host and restores the registry when it fails. * no-mistakes(review): Harden remote git authorization and missing-tool diagnostics * no-mistakes(document): Document remote PATH doctor and safe shims * no-mistakes(lint): Fix ShellCheck findings in remote path tests * no-mistakes(lint): Suppress exported fixture's false-positive ShellCheck warning * feat: gate remote second mates on Herdr readiness (kunchenguid#1639) * feat(bin): gate remote second mates on herdr readiness A remote second mate now always runs on the Herdr backend, whose server belongs to the host's GUI login session and therefore outlives the SSH connections that supervise it. fm-spawn's remote route forces that backend and the host-local control script refuses any other, so the requirement cannot be dropped from either side. fm-remote-doctor.sh becomes the single owner of what "ready" means. It keeps its PATH and tool reporting from kunchenguid#1623 and adds the Herdr, Aqua LaunchAgent, GUI-session, server-reachability, and entrypoint-symlink checks, tagging each gap fixable: or human: with the exact operator step. --fix closes only the automatable gaps - writing and loading the Aqua-scoped dev.firstmate.herdr launch agent, starting the server where no launch agent applies, and recreating the entrypoint symlink - then re-derives every check from the host, so a human gap is never presented as fixed. It never creates a login session, writes an auto-login password, or touches FileVault. Remote seed, remote spawn, and the startup liveness relaunch all run the same check, repair, re-check sequence through one shared library and fail closed with the doctor's own gap text. Recovery inherits the gate because it respawns through the same route. Tests drive the real doctor against a controlled account fixture with a private HOME, a state-backed launchctl, and a fake herdr, and prove the dangerous actions are never attempted. The remote lifecycle suites gain a stateful Herdr CLI fixture and answer the readiness gate at the SSH boundary, so they never inspect or repair the runner's own account. * no-mistakes(review): Validate launch-agent contract and confirm Herdr startup * no-mistakes(review): Validate loaded launch-agent contract before readiness * no-mistakes(review): Refuse legacy remote backends without altering routes * no-mistakes(review): Clarify conditional remote readiness repair sequence * no-mistakes(review): Repair remote readiness before liveness probing * no-mistakes(review): Preserve unknown seeds and reject legacy liveness * no-mistakes(document): docs: clarify remote Herdr backend ownership * fix: isolate remote secondmates in shared Herdr session (kunchenguid#1659) * Pin remote secondmates to fm-remote * no-mistakes(review): Fail closed on legacy remote Herdr endpoints * no-mistakes(review): Isolate fm-remote launch agent from interactive default * no-mistakes(document): Document shared remote Herdr retirement safety * feat: route remote commands through an Aqua job worker (kunchenguid#1660) * feat: run remote commands through Aqua job worker * no-mistakes(review): Enforce remote job deadlines and safe worker shutdown * no-mistakes(review): Refresh stale workers and harden dependency-free supervision * no-mistakes(review): Harden worker ownership recovery and shutdown quarantine * no-mistakes(review): Fix doctor bootstrap, harness repair, and output draining * no-mistakes(review): Probe doctor tools through authenticated worker bootstrap * no-mistakes(review): Refresh stale workers before doctor tool probes * no-mistakes(review): Recover stopped quarantines and extend job deadlines * no-mistakes(review): Separate queue and execution timeout windows * no-mistakes(review): Supervise Linux worker crashes and bind root identity * no-mistakes(review): Resolve authorized Nix profile bin links * no-mistakes(review): Clarify Nix path resolution documentation * no-mistakes(review): Harden PATH safety and nvm selection * no-mistakes(review): Honor nvm system defaults and refresh doctor digest * no-mistakes(review): Keep workers ready during active jobs * no-mistakes(review): Bound pre-execution validation by job timeout * no-mistakes(document): Clarify remote worker documentation * no-mistakes(lint): Fix remote worker ShellCheck diagnostics * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * fix: clarify remote doctor bootstrap path (kunchenguid#1691) * fix(bin): bound remote SSH dead-peer detection (kunchenguid#1699) * fix(remote): arm SSH dead-peer detection in fm-on.sh A vanished remote host mid-poll (a reboot, a dropped link) left ssh blocked indefinitely on a half-open TCP connection, because fm-on.sh's ssh invocation had no ServerAliveInterval/ServerAliveCountMax. This wedged the remote-reply ferry: fm-procevent.sh's runner blocked inside the ssh child and never reached its own no-result -> claim-release -> reconcile re-arm self-healing path, which otherwise already handles a nonzero exit with empty output correctly. Recovery required a manual retire and re-arm. Arm ServerAliveInterval=15 and ServerAliveCountMax=3 by default (bounded ~45s detection window), both overridable via FM_SSH_ALIVE_INTERVAL and FM_SSH_ALIVE_COUNT_MAX. This is a transport- level fix in fm-on.sh, so it covers every remote command routed through it, not just the reply ferry. The remote sshd answers keepalive probes independently of whatever the remote command is doing, so a legitimately long-but-alive command (a 55s poll, a clone, the doctor) is never falsely killed - only a truly vanished peer trips it, turning that case into a bounded, detectable ssh failure (exit 255) instead of an indefinite hang. Extends tests/fm-on.test.sh with a behavioral regression asserting a bounded, positive ServerAliveInterval/ServerAliveCountMax on the real ssh argv captured through the FM_SSH_BIN process seam, plus coverage that both are env-overridable. * no-mistakes(document): Document SSH dead-peer detection ownership * fix: report stale AXI tools during bootstrap (kunchenguid#1701) * feat(bootstrap): gate stale axi CLIs at the floors firstmate actually uses Add gh-axi 0.1.29 floor so bare --squash PR merges stop failing quietly on older builds. Raise tasks-axi to FM_TASKS_AXI_MIN=0.2.2 (multi-id mv) while keeping feature probes. Keep quota-axi at 0.1.16 after verifying schema 3 and per-model availability already ship there; runway remains optional. * no-mistakes(document): Clarify AXI compatibility documentation ownership * fix: prevent false watcher-down alarms in Claude sessions (kunchenguid#1661) * fix(guard): stop false watcher-down alarm mid-turn under Claude auto-arm bin/fm-guard.sh derived its watcher-health verdict from fm_watcher_healthy, which requires a live watcher process holding the home lock. Under the Claude Stop-hook auto-arm supervision model the watcher is armed at each turn end and exits on its wake, so it runs only between turns. Every guarded command run mid-turn therefore found no live watcher and printed the "WATCHER DOWN - SUPERVISION IS OFF" banner even though supervision was healthy. Because the episode key was derived from the beacon mtime (which the between-turns watcher advances every poll), the full banner re-printed on essentially every command, and the message always blamed a "fresh beacon" that was in fact fresh. Make the pull guard's health check model-aware via a new fm_watcher_supervision_verdict in bin/fm-wake-lib.sh: - Under the auto-arm model a beacon fresh within FM_GUARD_GRACE is healthy even with no live watcher process; only a beacon stale beyond grace (or absent) is a genuine lapse and alarms. - Under every persistent-watcher harness (codex foreground checkpoint, opencode/pi/grok background arm, tmux, unknown) a live identity-matched watcher with a fresh beacon is still required, unchanged. The banner now names the true failing condition, a missing live watcher process versus a genuinely stale beacon, instead of always blaming the beacon, and the once-per-episode dedup keys on that condition rather than the beacon mtime so a genuine lapse announces once and does not re-print each turn. The turn-end guard keeps the strict fm_watcher_healthy check because it fires at the turn boundary, where the auto-arm brings a fresh watcher up and it cooperates with that arm. fm_watcher_healthy itself is unchanged, so the arm layer's start/attach/replace decisions are unaffected. Tests in tests/fm-guard-stale-banner.test.sh cover the auto-arm healthy fresh-beacon-without-a-watcher case, the auto-arm stale-beacon alarm and its stable episode, the true-reason banner wording, and the reason-keyed episode surviving a beacon mtime change; existing persistent-model cases are pinned to that model. * no-mistakes(review): Pin secondmate supervision model to launched harness * no-mistakes(document): Align watcher documentation with model-aware supervision health * test: prevent fixture temporary directory leaks (kunchenguid#1704) * fix(tests): stop fixture-tempdir helper from self-deleting under command substitution fm_test_tmproot is almost always called as `TMP_ROOT=$(fm_test_tmproot prefix)`, which forks a subshell to capture its stdout. The old implementation set its EXIT cleanup trap inside that call, so the trap fired - and deleted the fixture root - the instant the subshell exited, before the real caller's own EXIT trap was ever installed. Every test using the documented call pattern leaked its fixture root on every run; two suites had already independently discovered and worked around this with ad-hoc mktemp calls. Registration now goes through a $$-keyed registry file instead of in-process state, since $$ resolves to the invoking shell's PID even inside the subshell. The real cleanup trap is armed once at source time (always the real caller, never a subshell) for EXIT, INT, and TERM. A best-effort orphan sweep on next source reaps marked fixture roots old enough to be from a killed prior run. Simplifies the two existing ad-hoc workarounds (fm-procevent.test.sh, wake-helpers.sh) back onto the shared helper now that it works correctly. * no-mistakes(review): Preserve live fixtures during orphan reaping * no-mistakes(review): Harden fixture ownership against PID reuse * no-mistakes(review): Secure cleanup registry against path precreation * no-mistakes(review): Make fixture registration transactional * no-mistakes(document): Documentation already matches fixture cleanup behavior * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * feat(herdr): enable presentation spaces by default (kunchenguid#1708) * feat(herdr): default presentation spaces on with an explicit opt-out Herdr's disposable one-task presentation workspace was opt-in through the presence of local config/herdr-presentation-spaces. It is now on by default, and a home opts out by writing "off" into that same file. Values are read with the whole-file whitespace-stripped convention the other scalar config items already use, plus case folding. An absent file, an empty file, and "on" all resolve on; only "off" opts out; an unrecognized value warns and keeps the default rather than failing a spawn over a purely visual setting. The empty file is exactly the historical opt-in form, so every home that had already enabled the projection stays enabled with no migration step, and no previously enabled home can be turned off by the flip. Because absence now means on at both ends, secondmate inheritance needs no item-specific convergence: mirroring an absent primary file converges a secondmate to the same default-on rather than turning its projection off, and only an explicit primary opt-out propagates the opt-out. The gate itself moves into fm_backend_herdr_presentation_enabled in the Herdr adapter so the semantics have one owner that regressions can exercise directly. * no-mistakes(document): Document Herdr default-on presentation safety --------- Co-authored-by: kunchenguid <kun-1@kunchenguid.com> * fix(bin): surface fleet-wide open decisions on every wake drain (kunchenguid#1711) * fix: surface consolidated open decisions on every wake-drain A needs-decision or blocked event buried under later, unrelated status appends was only ever shown via the last-line wake annotation, so a still-open captain decision could go silently missed even though status_open_decisions (fm-classify-lib.sh) already folds the whole status stream correctly and fleet-snapshot/bearings already reuse it. Wire that same fold into bin/fm-wake-drain.sh: a new fleet-wide scan_open_decisions wrapper scans every state/<id>.status, and fm-wake-drain.sh prints a separate, bounded OPEN DECISIONS section on every drain (including the empty-queue fast path), so session-start and every wake-handling turn surface it for free without duplicating the open/resolved fold itself. Heartbeat wakes drain through the same script, so this covers that surface too. Also tighten status_open_decisions' file guard to skip an unreadable status file instead of leaking a bash redirection error, now that a fleet-wide directory scan can reach files a single targeted read would not. * no-mistakes(review): Prevent status symlinks leaking open decisions * fix: drop unbounded perl subprocess from status symlink guard The review step's own symlink-safety auto-fix (O_NOFOLLOW read via a perl subprocess) forked one perl process per status file scanned by the new fleet-wide open-decisions scan, with no cap - inflating fm-wake-drain.sh's total external-read cost from 8 (the existing annotation read_cap) to 18 in the enrichment-caps regression test. The plain [ -L "$f" ] check already rejects any status file that is itself a symlink before any read happens, which is exactly what the new regression test exercises and is the same defense level the sibling scan_captain_relevant_statuses/last_status_line already rely on elsewhere in this file (no O_NOFOLLOW). Drop the subprocess-based nofollow read and keep the cheap builtin guard. * no-mistakes(document): Document actionable fleet-wide open decision drains * fix(bin): abort parked runs and reap leaked processes before teardown (kunchenguid#1710) * fix(bin): abort orphaned no-mistakes runs and reap leaked processes at teardown Teardown could remove a task's worker while its no-mistakes pipeline run was still parked at a gate, leaving an orphaned run holding a fleet slot indefinitely (observed 2026-08-03: runs parked 7h39m and parked at a post-CI approval gate). It could also leave backgrounded/disowned descendant processes rooted under the worktree or tasktmp surviving reparented to init (observed: two `go test` binaries pinning CPU for hours with no live task meta to attribute them to). Add two coupled pre-teardown steps, both scoped to this task's exact branch/head or worktree/tasktmp so they can never touch another task's run or processes: - conclude_task_no_mistakes_run aborts a run parked at a gate via `no-mistakes axi abort`, cd'd into the exact worktree so the daemon resolves the run itself rather than teardown naming a --run id. - reap_task_worktree_processes sweeps for processes whose cwd is under the worktree or tasktmp (via `lsof -a -d cwd`) and TERM/KILLs them. Both run before any worktree return, branch delete, or backend kill, and are idempotent on a retried teardown. The branch+head attribution logic is factored out of bin/fm-crew-state.sh into the new shared bin/fm-nm-run-lib.sh so both scripts use the same ownership contract. * no-mistakes(review): Fail closed on incomplete teardown cleanup * no-mistakes(review): Bind teardown cleanup to verified run and process identities * no-mistakes(review): Require confirmed aborts and convergent identity-safe process reaping * no-mistakes(review): Handle process exits during teardown identity checks * no-mistakes(review): Restore teardown library in hermetic gotmp fixtures * no-mistakes(document): Document teardown run attribution and timeout * no-mistakes(lint): Rename shell variable conflicting with done keyword * no-mistakes: apply CI fixes * test: give fork scaffolding tests the delivery contract upstream now requires Upstream kunchenguid#1563 made --mode mandatory for ship briefs and --mode plus --yolo mandatory for ship spawns, and updated the tests it shipped with. Three fork tests were written after the fork diverged, against the pre-kunchenguid#1563 interfaces, so they called the scaffolds with no delivery contract. Merging the two trunks put those callers in front of the new requirement and they refused before reaching the behavior each test exists to pin. Git could not see this: the requirement and the callers live in different files, so both sides merged clean and the breakage only showed up when the suite ran. Upstream's contract is kept exactly as it is - it is a deliberate safety gate, and AGENTS.md section 7 depends on the brief and the spawn refusing to guess. Each fork test instead states its mode explicitly, so every assertion it was written to make still runs. The standing-worker-rules variants each state their own mode, because those cases assert mode-specific prose and fm-brief no longer reads the registry. Verified: all three fail on the merge commit and pass here, with fm-brief, fm-launch-lib and fm-model-zero-budget green. --------- Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com> Co-authored-by: Gavin <51008413+allstargg@users.noreply.github.com> Co-authored-by: Christopher McKay <101884182+karotkriss@users.noreply.github.com> Co-authored-by: kunchenguid <kun-1@kunchenguid.com>
A task whose reconciled current state is terminal kept producing
possible-wedge stale wakes, because the stale path decided from the status
line's TEXT rather than the reconciled state. Seventeen such wakes were
recorded on 2026-08-04 (joined ledger outcomes, defect
stale-fires-on-finished-task); every one found nothing to do, because an idle
pane is the correct condition for those tasks: a done task with its PR open
and green, a task parked on a captain decision with its work committed, a
task blocked on a credential.
fm-classify-lib.sh's crew_absorb_class already performs the one
fm-crew-state.sh read on that path, so the settled verdict is a fourth token
from that same read rather than a new call:
done nothing is left for the crew to do on its own.
parked, blocked the next move belongs above the crew, but ONLY while a
durable open decision (status_open_decisions) proves it.
Both supervisors consume that one verdict. The watcher absorbs a settled
stale with no wedge timer and records .settled-<key> so unchanged polls of
the same pane hash absorb without re-reading the crew state; any pane change
drops the marker and reclassifies. The away daemon self-handles the wake,
drops rather than records wedge tracking, and re-checks the reconciled state
immediately before escalating an aged marker, which is where a task that
settles after going stale would otherwise still alarm.
Genuine wedges are unaffected:
- failed is deliberately NOT settled, because it also reconciles a CANCELLED
run, the mid-supersession state in which a crew must recover custody and
resume, so an idle pane there is a real stall.
- unknown never settles, so a dead endpoint or torn-down worktree keeps aging.
- a run parked at a gate the crew must answer ITSELF opens no decision, so it
keeps aging and still escalates.
- reading the reconciled state rather than the log text preserves the earlier
precedence fix: a leftover pre-validation done: line under an active run
reconciles as working and keeps its wedge timer.
Nothing rots as a result: an absorb does not mark the status surfaced, so the
terminal status still reaches firstmate through the captain-relevant signal
path and, if that was missed, through the heartbeat catch-all scan, while a
parked or blocked task keeps its open decision surfacing on every wake drain.
Every new test was witnessed failing on unmodified code first.
…pe (#41) A push-capable backend reports an agent-state edge to `blocked` - the harness stopped for a human prompt - as a stale wake that deliberately bypasses the wedge timer. The away daemon's `classify_stale` then deduplicated that wake against the task's LAST STATUS LINE via the `.subsuper-seen-status-<key>` marker. A task correctly parked on a captain decision has an unchanged terminal status line by definition, so its first block escalated and every subsequent block was absorbed permanently. One task sat parked seven hours with its decision already delivered because its worker was blocked on read-only permission prompts that never re-escalated. The dedupe keyed on what the worker last SAID, never on what it was DOING. The producer already deduplicates on agent state - one wake per `->blocked` edge, cleared by the next `->working` edge - so the status-line dedupe was a second, wrong-keyed owner layered on top of a wake that arrives pre-deduplicated. Keying this path on agent state instead would have duplicated the producer's dedupe in a second owner, so the wake is exempted from status-line dedupe entirely. `bin/fm-classify-lib.sh` gains the one owner of the wake's detail grammar: the watcher builds it with `stale_detail_blocked_on_human` and the daemon recognizes it with `stale_detail_is_blocked_on_human`, so neither supervisor spells the text itself and a reworded producer cannot silently stop being exempt. The exemption sits after the declared-pause branch, so a `paused:` external wait stays self-handled, and before the settled-terminal absorb. That second ordering is load-bearing rather than incidental: a crew parked on a captain decision reconciles as settled terminal, so absorbing settled first would swallow this edge exactly as the status-line dedupe did. The two checks observe different things - a standing condition against a reported transition - so a harness stopped on a human prompt still surfaces even when the crew's own work is over. Wedge aging is unaffected, because this path escalates directly and records no wedge marker for the settled drops to age. Ordinary stale dedupe is untouched: it still absorbs a repeated terminal status with no such transition, and a duplicate signal/stale pair still folds to one digest entry. Herdr is the only push-capable backend today; every other runtime backend produces no such detail and is unaffected, and the wake is produced by the session backend rather than the primary harness.
…eam kunchenguid#1621) (#42) * fix(bin): stop rechecking captain-gated pauses on the away-mode cadence The pause re-surface cadence treated every declared pause the same, but the question it actually asks is whether the thing being waited on can change without the captain acting. An external wait can, so rechecking it is real work. A captain-gated wait cannot: it clears only when the captain acts, and the captain acting is already the away-mode exit signal, which runs the full return catch-up, so the hourly recheck could never surface anything the exit does not. Measured over one away-mode stretch, 32 of 38 false-positive wakes were exactly that recheck. The backlog already records the distinction per work item as hold_kind (captain|external|load|parked|future), the same field fm-decision-hold.sh verifies a captain hold with, so task_hold_kind/pause_is_captain_gated read that existing vocabulary rather than parsing pause prose or introducing a parallel one. Suppression is a cadence decision only. The marker is kept and the window is still reset, so the wait stays tracked, stays as visible as before in the backlog digest, the fleet view, and the return catch-up, and resumes ordinary rechecking within one window if its recorded kind stops being captain-gated. An indeterminate kind is deliberately not a captain-gated kind: a missing reader, an unreadable or absent item, or an item with no active hold all read as unknown and keep being rechecked. The always-on watcher path, the wedge definition, and the stale-escalation threshold are untouched. Verified in both directions, since a change that suppressed everything would look like a fix. Against unchanged code the captain-gated test failed ("a captain-gated pause was re-surfaced on the cadence") while the external and indeterminate tests passed; against a deliberately over-suppressing build the external test failed ("a declared external wait stopped being re-surfaced on the cadence") and the indeterminate test failed with it. * no-mistakes(document): Correct stale pause-cadence comments
…unchenguid#1613) (#43) * feat(bin): carry a task's read base and contribution base separately A dispatched worker needs two different commits and the spawn path supplied only one, so every brief citing a file or a line number was silently unreliable whenever they differed. Measured across four concurrently live workers: every one sat at upstream 4ee4a0a while the fleet ran 631c248, a 33-commit gap. One task found a script its brief cited entirely absent from its own base; another recorded that upstream line numbers are simply wrong for the running fleet and nearly published them. Neither single reference fixes it. Resetting slots to the fork trunk carries fleet-only commits into every upstream contribution. Resetting them to upstream dispatches tasks onto a trunk missing 29 tracked files, including 10 bin/ scripts the fleet runs. So the spawn path now resolves and keeps both: slot base the commit the worktree is placed at, so reads, greps, line citations and running the code resolve against what the fleet actually runs contribution target the commit the branch is cut from, so the PR carries no commit that target never had bin/fm-task-base-lib.sh owns the contract and derives both from the project checkout. An upstream trunk that exists but cannot be read locally is recorded as unresolved rather than guessed onto the slot base, because that guess is the pollution being prevented. Explicit flags override the derivation, which cannot see a task's target files. fm-spawn.sh places the slot at the slot base instead of leaving it at whatever commit the pool last used, records slot_base=, contribution_target= and base_state= in task metadata, and refuses a brief that names a different pair. A slot holding uncommitted work or sitting on a task branch is left untouched. fm-brief.sh states both plainly with the read-here/write-there rule and cuts the branch from the contribution target by name. A scout takes only a read base. Where the two coincide the brief is byte-identical. Verified with every negative control watched red first: the guard neutered to always pass, the unresolved case degraded onto the slot base, the slot reset removed, the metadata recording removed, and the brief's branch step reverted each fail the test that covers them. Against the live repo the guard reports the real branch clean and refuses the fork trunk with the exact 33 commits. * no-mistakes(review): Captain: enforce mode-aware spawn base contracts * no-mistakes(document): Document separate task base references
…eam kunchenguid#1676) (#44) * fix(bin): see a crewmate's work when it happens in a child process Supervision's absorb rule consulted only semantic sources: the no-mistakes run step, the status log, and the harness busy signal. All three correctly report "not working" the moment an agent backgrounds a long command and ends its turn, so a crew doing real work in a child process reads as a wedge. Measured 2026-08-03: one crew running the portable suite in the background produced seven consecutive false wedge escalations across 42 minutes, each demanding a deep inspection, and at least three other crews hit the same pattern while pipeline stages ran underneath them. Add descendant CPU advancement as a third source of positive evidence, alongside the existing ones rather than in place of them. The agent is resolved from kernel facts, never a vendor process name: its working directory is the task's recorded worktree, and it is the leader of the foreground process group on its pane's terminal. The CPU of everything below it - live descendants plus already-reaped ones through the leader's cutime/cstime - is compared against a sample from the previous poll. Two rules keep it from becoming a blindfold. Each sample is bound to fm_pid_identity of the agent it came from, so a reused pid is never compared across the identity change. And only ADVANCEMENT counts: a descendant that merely exists proves nothing, so a crew whose child is hung, dead, or absent still escalates on the unchanged schedule. The agent's own utime/stime is excluded, so a looping wedged agent cannot vouch for itself. The stale threshold, escalation ladder, and deep-inspection demand are untouched. The new evidence folds into the same work_now gate a busy pane uses, so it inherits the BUSY_TURN_MAX_SECS completed-turn bound: a child that churns forever can delay an escalation, never cancel one. A definite parked, done, failed, or blocked run-step verdict is never overridden. Where /proc is unavailable the probe reports no evidence, which is exactly today's behaviour. Verified in all four directions against real processes, and each guarantee was witnessed failing first under a deliberate breakage: existence instead of advancement, the agent's own CPU counted, identity ignored, the freshness bound removed, a definite verdict overridden, and the completed-turn bound not applied to the new evidence. * no-mistakes(review): Captain, preserve semantic verdicts over child liveness * no-mistakes(review): Captain, prevent double-probing child CPU evidence * no-mistakes(document): Document descendant CPU supervision
#45) * fix(bin): resolve the wake sequence instead of trusting a supplied one `fm-wake-ledger.sh outcome` took the wake sequence as a positional argument and validated only that it was an integer. A coordinator recording outcomes after the fact no longer had the real sequences and supplied descending placeholders; every one was accepted and stored with queued=unknown, which is also what a legitimately wiped state/ produces, so nothing looked wrong and nothing reconciled outcome records against wake records. Measured 2026-08-04: 200 of 249 outcome records were fabricated this way. The coordinator now names what a wake cost, never which number it was: - `outcome <token>` with no sequence resolves the most recent wake record that no outcome record joins, and is the normal path. A second bare call moves on rather than re-recording the same wake, and no unrecorded wake left is a loud refusal rather than a guess. - An explicitly passed sequence that joins no wake record is refused before anything is written, confirmed against the whole file so the refusal states a fact rather than a lookup horizon. `--allow-unjoined` keeps the genuine wiped-state/ case reachable and a guess unreachable. - `reconcile` counts the outcome records that join no wake record, and session-start bootstrap reports it, so the corruption cannot stay silent. An absent ledger counts a real zero; one that exists and cannot be read refuses rather than reporting that same zero. The (seq, queued) durable join identity, the closed outcome vocabulary, and multiple sequences per invocation are unchanged, and no existing record is rewritten or migrated. * fix(bin): stop the wake library creating state when it is only read fm-wake-lib.sh ran `mkdir -p "$STATE"` at source time, so merely sourcing it made the caller a writer. The new `reconcile` bootstrap diagnostic sources it to count unjoined outcome records, which turned a read into a mutation and broke bootstrap's detect-only read-only contract; the guard that asserts that contract went red ("detect-only bootstrap created its state directory"). Fixed at the source rather than by teaching bootstrap to avoid it, because any future read-only caller inherits the same trap. Sourcing now observes a home and never creates one; the write paths materialize the directory on demand: - fm_state_ensure() is the named, idempotent creation point, called by fm_wake_append for the sequence file that always lives in $STATE. - fm_lock_owner_dir creates the directory that will hold a lock it is about to take. This is load-bearing, not defensive: fm_lock_abs_path fails while the parent is missing and fm_lock_acquire_wait retries forever, so without it a lock under a missing state directory hangs instead of failing. Verified by removing the guard and watching the wait spin until killed. Every other caller that writes into $STATE either creates it itself or takes a lock first, so the removed source-time mkdir was duplication, not the contract. The diagnostic itself is unchanged and still distinguishes its three cases: an absent ledger counts a real zero and stays silent, a populated ledger reports the true unjoined count, and a ledger that exists but cannot be read reports that rather than the same zero. Reads leave the ledger byte-identical; it stays append-only and nothing is rewritten, migrated, or truncated.
fm-fleet-snapshot.sh handed the whole backlog and task inventory to jq as --argjson command-line arguments. Linux caps a single argv entry at MAX_ARG_STRLEN (131072 bytes) independent of the much larger ARG_MAX total, so the snapshot died with "Argument list too long" once the backlog crossed that cap - a size the fleet had already reached. Bulk JSON now travels on stdin: json_envelope assembles the value with shell builtins and pipes it into `jq -n`, whose filter reads it back with `input`. stdin was chosen over a temp file or a process substitution because this command is read-only and must stay that way - there is no file to create, secure, or leave behind when an interrupted read abandons it. Every unbounded --argjson in the file is converted, not only the one that was failing. The more serious half was a fail-open. task_json_lines built one row per task in a loop piped into `jq -s`, so a row that could not be serialized was dropped while `jq -s` slurped the survivors and exited 0 - a task vanished from a snapshot that still reported success, and a supervisor reviewing the fleet would see a task that does not exist. scout_report_lines had the same shape and its caller checked no status at all, and fm-fleet-view.sh rendered a snapshot that produced no output as a healthy empty fleet at exit 0. A genuine failure now exits nonzero and names what failed, while an empty fleet remains a complete snapshot at exit 0. Tests generate the oversized backlog and the oversized task row programmatically, assert both render in full, and assert that neither a failed snapshot nor an empty one is ever reported as success. The macOS stock-Bash job asserts an exact fleet-view test count, so its expected value moves from 15 to 20 in the same commit as the five new tests to keep the guard and the suite from drifting. The sibling Bearings assertion stays at 41: that suite is unchanged.
The "has this landed?" check measured against a trunk this fleet does not land on, so proven-landed work read as unlanded and held its worktree slot. With `origin` fetching kunchenguid/firstmate and pushing sbracewell64/ firstmate, both refs the check considered were wrong at once: origin/main tracked upstream, and refs/heads/main had not been fast-forwarded since the fork trunk advanced five times that day. Measured on the held slot: PR 44 squash-merged, recorded head 2582c15, fork trunk f90ed1d git diff --stat 2582c15 f90ed1d -> empty (content landed) git merge-base --is-ancestor 2582c15 f90ed1d -> false (squash) fm_landed_tree_contains vs refs/heads/main -> 1 (not contained) fm_landed_tree_contains vs origin/main -> 2 (inconclusive) fm_landed_tree_contains vs the fork trunk -> 0 (contained) The default fetch refspec cannot reach the fork, because it points at the fetch url. fm_landed_push_url resolves the push url when it differs from the fetch url - the same fetch-versus-push comparison bin/fm-task-base-lib.sh already made at the spawn site, now owned in one place and read by both - and fm_landed_refresh_push_target fetches that trunk into refs/fm-landing/origin/<name> for fm_landed_candidate_refs to offer. The check is not made more permissive. The added ref is a landing target only because this fleet demonstrably pushes there, never inferred from a remote's name. Only a caller that already refreshes remotes fetches it, so the guard stays local. A push url that exists but cannot be read leaves the landing target unread, and teardown refuses rather than falling back to the upstream answer - a case that previously passed on that fallback. A repository whose fetch and push urls agree resolves no landing ref at all and takes an identical path. Every negative control was watched red first: pre-fix, the fork-landed slot is refused at both the teardown and guard sites, and the unreadable-push-url case wrongly passes. The unlanded, upstream-only, and single-remote controls pass before and after, so they are not vacuous. Verified against the live held slot: the resolved push url fetches the real fork trunk, which reports the merged work contained while upstream stays inconclusive, and the same slot plus one unlanded commit still reports not contained. Full changed-scope run: 75 scripts, 6 failing identically on the unmodified fork trunk (tmux readiness, node ESM resolution, harness env), 0 new.
kunchenguid#1614) (#48) Ports upstream PR kunchenguid#1614 onto this fork's trunk. Nothing here is redesigned: the guard, its refusal wording, the --allow-unverified override, the merge_verification=/merge_verified_head= metadata keys, and the crew-state mapping changes are upstream's as written. Provenance: upstream PR kunchenguid#1614 head commit e3e4b47 its base c8edff3 landed onto 3611e49 (sbracewell64/firstmate main) The two trunks diverged at upstream kunchenguid#1495, so the diff did not apply cleanly. Resolutions, all of them fork-versus-upstream divergence rather than changes to what kunchenguid#1614 does: bin/fm-pr-merge.sh - this fork resolves a task's identity through either a live meta or the durable landing record a released task keeps, which upstream has no equivalent of. The record resolution stays, and verification is placed between it and the recording step, so upstream's property still holds exactly: a head the guard refuses leaves no pr= recorded and no merge poll armed. META is bound to whichever record the task actually has, so the verification metadata write addresses it unchanged. tests/fm-pr-merge.test.sh - upstream's file is the base, with this fork's six released-task cases and their fixtures re-added. Their gh mocks now answer the verification read as well as the forge-view read. test_missing_meta_refuses_before_merge exists on both trunks asserting opposite behavior: upstream refuses a task with no record before any forge lookup, while this fork deliberately rebuilds that record from the pull request itself. The fork's version of the case is kept, because that reconstruction is this trunk's behavior. AGENTS.md, docs/architecture.md, docs/scripts.md - upstream's sentences folded into the fork's own text for the landing record, the task base references, and the merge poll's conflict reporting. Verified on this fork: fm-lint.sh clean, fm-doc-audience-check.sh ok, and tests/fm-pr-merge.test.sh (34), tests/fm-crew-state.test.sh (54) and tests/fm-pr-check-security.test.sh (41) all pass. Checked once against the live forge with the merge command mocked: the pre-change path issued a squash merge for a pull request with three failing check runs, and this one refused it, naming the head and the failing count, before arming anything.
firstmate.bat launches `wsl.exe --exec /bin/bash` so the launch never depends on the login shell, but that session's PATH carries only the system directories plus Windows interop. The menu probes each harness with `command -v`, so every harness installed under the account's private bin directories rendered as "not installed" and the Enter default fell through to whatever happened to resolve. bin/fm-wsl-entry.sh now prepends ~/.local/bin and ~/bin when they exist, before handing off to the launcher. Those are exactly the two directories the stock ~/.profile prepends and the ones every supported harness installer targets, so this restores interactive parity as a filesystem fact rather than by evaluating a login profile in a non-interactive launch. Only existing directories are added, only once, and nothing already on the inherited PATH is removed or reordered. firstmate.bat's --exec choice is unchanged. Verified through the real bridge command: `wsl.exe --cd <repo> --exec /bin/bash ./bin/fm-wsl-entry.sh --print-menu` now renders a menu byte-identical to the interactive `bin/fm-launch.sh --print-menu`, for every harness the menu lists.
3 tasks
Author
|
Withdrawn: opened at the wrong venue by delivery automation. This branch is based on the fork trunk, so the upstream view bundles 46 unrelated fork-landed commits; the change is a single commit and will be delivered as a fork PR on sbracewell64/firstmate. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Fix the Windows launcher's fresh-session PATH gap so the harness menu sees user-installed harnesses and defaults to the captain's ruled default (Claude).
Background measured 2026-08-07: firstmate.bat deliberately launches
wsl.exe --exec /bin/bashso the launch never depends on the login shell, but bin/fm-wsl-entry.sh never re-established the user-level PATH. A fresh session therefore carried only the system directories plus Windows interop appends. bin/fm-launch.sh probes each menu entry withcommand -v, so every harness installed under the account's private bin directories (claude, codex, pi all live in $HOME/.local/bin here) rendered as 'not installed - install ' and the Enter default fell away from the captain's ruled Claude default.Accepted requirements for this change:
wsl.exe --cd <repo> --exec /bin/bash ./bin/fm-wsl-entry.sh --print-menunow renders a menu byte-identical to the interactivebin/fm-launch.sh --print-menu- Claude default restored, Codex available, both Pi-routed entries available with their correct sign-in note, and OpenCode still honestly dim because it genuinely is not installed.Known and deliberately out of scope: tests/fm-launch.test.sh has a pre-existing failing case about CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION ghost-text suppression, confirmed failing identically on the base branch with these changes stashed; it is unrelated to the PATH gap and was left alone.
What Changed
bin/fm-wsl-entry.shnow establishes the user-level PATH before handing off to the launcher menu: it prepends$HOME/.local/binand$HOME/binwhen they exist — each at most once, ahead of the system tail in login-shell order, never removing or reordering anything already inherited. This is the smallest deterministic extension (the two directories the stock~/.profileprepends and every supported harness installer targets), chosen over sourcing a login profile in a non-interactive launch; the rationale lives in the script's own header, andfirstmate.bat's--exec /bin/bashchoice is deliberately untouched. A freshwsl.exe --exec /bin/bashsession now resolves user-installed harnesses, so the bridge menu renders byte-identical to the interactivebin/fm-launch.sh --print-menuand the Enter default returns to Claude.tests/fm-wsl-entry.test.shgains two cases, witnessed red against the base script: one proving a fresh session (system-only PATH) resolves harnesses installed in both~/.local/binand~/bin, and one proving the established PATH adds only existing directories, never duplicates one, and never invents an absent~/bin. All 6 cases pass, anddocs/windows-launcher.mdrecords the PATH behavior plus a troubleshooting line for harnesses installed elsewhere.fm-launch-lib.sh, the Windows-to-WSL bridge itself, fleet admission control, the model registry and zero-budget spawn gate, the wake-outcome ledger, LoopSpec, the research corpus scanner, remote-secondmate tooling, and a series of merge, supervision, and teardown fixes.Risk Assessment
✅ Low: A small, additive, well-tested change that prepends only existing well-known user bin directories to PATH in the WSL entry script, exactly matching every required intent constraint (deterministic extension, no profile sourcing, untouched firstmate.bat, red-capable tests, guideline-compliant docs) with no bugs or risks found.
Testing
Ran the targeted tests/fm-wsl-entry.test.sh suite (6/6 pass, including the two new PATH cases), independently witnessed the red case against the base entry script and green against the patched one, and demonstrated the fix through the real wsl.exe bridge: the fresh-session menu is now byte-identical to the interactive menu with the Claude default restored, whereas the base script's fresh session showed Claude "not installed" with the default fallen to ChatGPT Sol; transcripts saved as evidence and no issues found.
Evidence: Windows launcher menu before/after through the real wsl.exe bridge (with byte-identical diff vs interactive)
== BEFORE the fix: base bin/fm-wsl-entry.sh through the real bridge == Firstmate Sessions start without permission prompts. 1 Claude high not installed - install claude 2 ChatGPT Sol gpt-5.6-sol · high via pi ← default 3 Grok grok-4 · high via pi - sign in: pi /login 4 Codex high 5 OpenCode - not installed - install opencode ⏎ ChatGPT Sol 1-5 select q quit == AFTER the fix: patched bin/fm-wsl-entry.sh through the real bridge == Firstmate Sessions start without permission prompts. 1 Claude high ← default 2 ChatGPT Sol gpt-5.6-sol · high via pi 3 Grok grok-4 · high via pi - sign in: pi /login 4 Codex high 5 OpenCode - not installed - install opencode ⏎ Claude 1-5 select q quit == diff (after-fix bridge menu vs interactive menu) == byte-identical: no differencesEvidence: Red/green harness resolution in a fresh session (base vs patched entry script)
== BEFORE the fix (base fm-wsl-entry.sh, fresh --exec session PATH) == claude=[NOT-ON-PATH] codex=[NOT-ON-PATH] == AFTER the fix (patched fm-wsl-entry.sh, identical fresh session) == claude=[.../home/.local/bin/claude] codex=[.../home/bin/codex]Evidence: After-fix bridge menu transcript (fresh wsl.exe session)
Evidence: Before-fix bridge menu transcript (fresh wsl.exe session, base entry script)
Evidence: Interactive baseline menu transcript (bin/fm-launch.sh --print-menu)
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
⏭️ **Rebase** - skipped
.agents/skills/afk/SKILL.md- branch carries 46 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (201 file(s)) into the PR:Push main to origin, or rebase your branch onto origin/main, before gating.
✅ **Review** - passed
✅ No issues found.
✅ **Test** - passed
✅ No issues found.
bash tests/fm-wsl-entry.test.sh— all 6 cases pass, including the two new fresh-session PATH casesRed/green witness: identical fresh-session fixture (env -i, system-only PATH, fake harnesses in a fake $HOME) run against the basebin/fm-wsl-entry.sh(claude/codex NOT-ON-PATH) and the patched one (both resolve)End-to-end after-fix:/mnt/c/Windows/System32/wsl.exe --cd "$PWD" --exec /bin/bash ./bin/fm-wsl-entry.sh --print-menuin a genuinely fresh WSL session — Claude default restored, Codex/pi entries available, OpenCode honestly dimEnd-to-end before-fix: same wsl.exe bridge through the base entry script — Claude rendered "not installed - install claude" and the Enter default fell to ChatGPT Soldiffof after-fix bridge menu vs interactivebin/fm-launch.sh --print-menu— byte-identicalConstraint checks:git show a69c8c6 --statconfirms firstmate.bat untouched; PATH prepend order and dedup verified in the diff and tests✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.