sync: merge upstream through d43e610b (round 2) - #270
Merged
Merged
Conversation
…nchenguid#3505) * fix(bearings): keep active children underway beside a captain hold Project each readable home's active children into Underway independently of the home-level captain-decision classification so a hold no longer hides live work. * no-mistakes(review): Preserve Underway repos and disclose child truncation * no-mistakes(review): Fall back to task project for Underway repos * no-mistakes(ci): Updated the stock macOS Bash CI assertion from 44 to 45 Bearings tests, matching the newly added behavioral regression. Verified all 45 tests pass under /bin/bash, Bash syntax checks pass, and git diff validation is clean
…enguid#3513) * fix(pi): settle watcher delivery on Pi accepting the follow-up A follow-up queued while main is streaming joins the running run without ever raising before_agent_start, so waiting on that event before clearing the successor pipeline (kunchenguid#3498) stalled every later actionable close: no successor started, no wake was delivered or offered to the branch, and the turn-end guard woke main to re-arm by hand after every close. The pipeline now settles once Pi accepts the follow-up. Consumption is observed at before_agent_start for an idle main and at the user message_start for a streaming main, and decides only what a replacement session (/new, /resume, /fork, reload) replays. An exhausted restoration delivers its typed failure without launching an arm past the retry bound, which the stall had hidden. The replacement-coordinator map is typed so the strict no-emit typecheck passes again. Tests: the doubles no longer raise before_agent_start for a streaming send, a portable regression drives two actionable closes while main streams and proves the successor chain plus consumption-scoped replay, and a credential-free real-SDK probe pins Pi's event contract for both the streaming and the idle follow-up. Claude-Session: https://claude.ai/code/session_01QJjTsUvKkWAwLGNoncaZ3a * fix(pi): retry a verified successor that fails during wake delivery A verified successor can exit while the wake it was started for is still being delivered, most plausibly during a branch turn that holds the settlement for minutes. Its failure close arrived while the pipeline's single-flight guard was set, so the close handler skipped the retry, and the pipeline's end no longer launched an arm, which left the live generation with no watcher and no retry timer. The close handler now records that failure when the child had reported readiness and was not retired by the restoration itself, and the pipeline runs the ordinary bounded, lock-checked retry for it once the delivery settles. A restoration started for a later pending supersedes it, and an exhausted restoration still hands repair to main without a further arm. The regression holds a branch settlement open while the verified successor exits with a failure and proves one retry watcher starts after the settlement releases, none while it is held. Claude-Session: https://claude.ai/code/session_01QJjTsUvKkWAwLGNoncaZ3a
* fix(bin): bound repeat stale wakes for a parked but live worker A worker parked on a declared wait - `paused:` for an external or pipeline wait, or a verified `captain-held` transfer - kept waking firstmate far inside FM_PAUSE_RESURFACE_SECS. Observed as five consecutive alarms on one captain-held worker and dozens across a day on a pipeline wait, and reported upstream as four wakes in 75 minutes against a 3600s window. pause_state_class deliberately answers `none` for a still-live agent even under a declared wait, so a worker genuinely waiting on a decision is never silenced. That classification is correct and is left alone; it routes every parked but live worker through surface_nonterminal_stale on first sight of each distinct stale hash, and an idle parked pane still churns its hash on a clock or a token counter without changing what is being waited on. Two places let that churn re-alarm: - surface_nonterminal_stale queued the wake BEFORE consulting whether a wait was declared, then wrote `.paused-resurfaced-<key>` - the very throttle that should have suppressed it. The throttle was never read on this path and was advanced by the wake it should have prevented. - The hash-change path cleared that throttle through clear_pause_tracking whenever the classification came back `none`, so each tick also bought the same declared wait a fresh window. Fixing only the first site changes nothing. Read the throttle before anything is queued and advance it only on a wake that really fires, and on the hash-change path reset only the per-hash bookkeeping while the declaration still stands, via a clear_stale_hash_tracking split so neither half of clear_pause_tracking is duplicated. The throttle is keyed to the declaration, not to the pane. First sight still wakes, so an inconclusive state is still inspected, and the window's end still re-surfaces once, so a forgotten wait cannot rot invisibly - noise traded for a bounded cadence, never for silence. The wake identity stays the plain `stale: <win>` the away-mode handoff depends on. Tests cover both observed forms and were confirmed to fail against three deliberate breaks: each site reverted on its own, and a re-surface that never fires again. * fix(document): Clarify declared-wait wake cadence documentation * fix(ci): Captain, fixed the stale-throttle inheritance: cadence markers now bind to the current wait declaration, so replacement paused and captain-held waits each emit their first plain `stale:` wake. Added behavioral coverage for both forms. Bite proof failed as expected when identity matching was removed, then passed after restoration. Full watcher triage suite, `bin/fm-lint.sh`, syntax checks, and diff checks pass. Changes remain uncommitted for the outer executor * fix(ci): Captain, fixed the confirmed Greptile finding. `resurface_absorbed` now applies a throttle only when its stored declaration scope matches the current wait, so replacement `paused:` and `captain-held` waits surface immediately without changing classification. Added executable coverage for both absorbed forms. Bite proof failed before the fix at the intended assertion; afterward the full watcher triage suite, `bin/fm-lint.sh`, shell syntax checks, and `git diff --check` passed
…er (kunchenguid#3567) * fix(turnend): accept the away-mode daemon as the supervision owner While state/.afk exists the away-mode daemon owns supervision and runs bin/fm-watch.sh one-shot: the watcher exits on every wake and the daemon starts its replacement. The turn-end guard tested for a live watcher process holding the watch lock at that instant, so a turn boundary that landed in the hand-off blocked with "TURN WOULD END BLIND" while supervision was completely healthy, costing a full handling turn each time. Reproduced with the real daemon wrapping the real watcher and the real guard sampling the same home: 6 of 40 samples blocked, every one of them with the daemon alive and the beacon 2-3 seconds old, and a new watcher pid on each cycle. After the fix the same reproduction blocks 0 of 40, and killing the daemon and its watcher (away mode still on, beacon still fresh) blocks again. The guard now accepts a live, identity-matched daemon holding this home as proof of supervision while away mode is active. The identity match is the same discipline the watcher lock uses, so a recycled pid or a lock left by a killed daemon proves nothing. The fresh-beacon half of the predicate is unchanged: a daemon that stops restarting its watcher still blocks once the beacon passes grace, a home with no supervisor blocks exactly as before, and with away mode off the strict watcher predicate is untouched. The predicate reads only durable state, so it behaves identically for every primary harness and runtime backend. * no-mistakes(document): clarify away-mode daemon supervision proof and test coverage * no-mistakes(document): generalize stale turn-end predicate summary in architecture.md
…unchenguid#3582) * fix(backlog): omit markdown file for beads probes * no-mistakes(document): Narrow backlog addressing doc to mutations for backend-aware probes * no-mistakes(ci): Fixed the Greptile P2 review comment (the only failing check) on tests/fm-backlog-atomicity.test.sh. The comment correctly noted that an exported TASKS_AXI_BACKEND environment variable would inherit into the spawned scripts and, because fm_tasks_axi_backend gives it top precedence, override each test case's .tasks.toml backend fixture — making the backend-specific argv assertions fail for environmental reasons. Fix: unset TASKS_AXI_BACKEND in the test harness right after sourcing tests/lib.sh, with a comment explaining why, so every case deterministically exercises its declared backend (4 lines added; no production code touched). Verified: reproduced the leak before the fix (TASKS_AXI_BACKEND=beads made the markdown dispatch case fail with 'beads show failed', exactly the reported failure mode); after the fix the full suite passes (0 failures, exit 0) both with and without TASKS_AXI_BACKEND=beads exported. The added lines are shellcheck-clean (the only shellcheck note, SC1091 on the lib.sh source line, pre-exists this change)
…chenguid#3589) The supervision branch's verdict rule escalated every outcome that answered a captain request, so "the work started" and "still working" notes reached the captain with nothing to look at. The rule now keeps a finished result of requested work captain-facing, even when healthy, and treats start or still-working updates that bring no new artifact, finding, or decision as routine. The captain list for review-ready PRs, ask-user findings, exhausted blockers, credentials, and destructive or security-sensitive cases is unchanged, as are the unsolicited-routine, silent-fleet-review, and doubt-chooses-captain rules. The fm_branch_report tool description and the two docs that restated the old unconditional rule now point at the prompt's "Verdict: routine or captain" section as the one owner instead of carrying a second copy.
* fix(bin): never close a captain call during cleanup
A scout that held its own work item for the captain, which is what
captain-hold-lifecycle prefers ("hold the work item the question gates"),
was closed by bin/fm-teardown.sh's automatic backlog transition. The
completion gate passed, cleanup ran, and the captain's question moved to
Done with no recorded answer: the one thing the policy says must never
happen. `tasks-axi done` closes a held row silently, and nothing in
teardown asked whether the row was the captain's own call.
bin/fm-captain-hold.sh gains the read-only `open` predicate: exit 0 when
the task is still an open captain call, 1 when it is not, 2 when that
cannot be established. It reads the row through the transition library's
backend-aware probe, so it addresses the same backlog teardown does; the
script's other commands now address the configured data directory the
same way instead of FM_HOME, which also fixes captain holds in a home
with a relocated data directory.
Teardown asks `open` before any destructive step and refuses on 2. On 0
only the close changes: after cleanup and still under the task's own
lock, the row gets one "Deliverable of the finished work" line at the end
of its body and returns to Queued through `tasks-axi reopen`, keeping its
hold, so it lands in Captain's Call instead of reading as work under way.
--force does not lift this: it authorizes discarding unlanded work, never
the captain's question. The deliverable goes into the body because
`tasks-axi update --report` rewrites the title of a row that is not Done.
The crash window reuses the pending-close record teardown already stages:
a `mode=retain` line makes the existing replay record the deliverable and
reopen instead of closing, with the same validator, stale-generation
check, cleanup-incomplete marking, and non-blocking bootstrap lock as an
ordinary close. A retained row the captain answered first simply retires
the record. No parallel record type, recovery command, or second bootstrap
loop is introduced.
Regressions run the real executables: the captain-held scout survives
cleanup queued, held, with its deliverable and on the board, only
`answer` closes it, --force keeps it open, and an ordinary scout still
closes with its report; an interrupted cleanup leaves the row untouched
and the next session start retains it; a relocated backlog keeps the
retention in its one configured file; and a ship row whose hold cannot be
read refuses cleanup before anything destructive.
Claude-Session: https://claude.ai/code/session_01FqdTiHCwTqrAQrz8K2y4Np
* no-mistakes(review): Serialize captain holds and fix backend-aware listing
* no-mistakes(document): Update captain-call retention documentation
* no-mistakes(document): Fix relocated captain-hold backlog diagnostics
…uid#3592) * fix(bin): deliver every secondmate outcome on the parent channel from the recording scripts A secondmate's captain-facing outcomes could miss: the mate model addressed the captain in its own unread chat instead of appending to the parent channel, and a PR-ready report, a finding, a decision, a blocker, and a failure all depended on that one remembered append. Make delivery structural, so the parent channel never depends on the model: - bin/fm-parent-channel-lib.sh is the one owner of channel resolution and exact-line append-once; the merge outcome path and the inactive-outcome scan now publish through it instead of two private copies. - bin/fm-inactive-reconcile.sh gains a ledger-first path that runs on every watcher poll in a secondmate home: a direct child's whole terminal done or failed line is delivered at once with its note, recorded PR, mode, merge posture, and scout report pointer, keyed and receipted so it is delivered once, and the inactive path yields to it. `report <task-id>` runs the same delivery for a caller holding the child's meta lock. - bin/fm-pr-check.sh publishes the PR-ready line with the canonical URL at registration. - bin/fm-captain-hold.sh publishes a hold and its answer, keyed by task id and resolution-record count, with no new persisted state. - bin/fm-teardown.sh delivers the child's final line before removing its record and refuses, retaining every record, while the channel cannot be written. - The charter opens with the parent-channel rule and confines the mate's own appends to judgement; AGENTS.md carries the carve-out at the persona address rule and the escalation list. docs/secondmate-parent-channel.md records the design and its coverage, and docs/verification/secondmate-parent-channel.md records the live run with real tmux panes and both real watchers delivering every line with no model. Supersedes kunchenguid#3569. * no-mistakes(review): Fix parent outcome retries and reconciliation locking * no-mistakes(review): Prevent busy children from starving ledger delivery * no-mistakes(review): Correct ledger metadata and hold occurrence handling * no-mistakes(review): Disambiguate ledger outcomes and normalize hold reasons * no-mistakes(review): Close ledger races and preserve teardown records * no-mistakes(document): Correct parent-channel receipt and scanner documentation * no-mistakes(lint): Quote done arguments for ShellCheck compliance * no-mistakes(ci): Fixed both CI failures. Updated GOTMP teardown fixtures for the new final-outcome reporter and isolated them from host tmux state. Updated the PR security assertion to distinguish the accepted PR-ready line from duplicate merge outcomes. Verified with both failing test suites, bash syntax checks, and git diff checks * no-mistakes(ci): Fixed Greptile’s duplicate-delivery race in bin/fm-inactive-reconcile.sh. Ledger events now claim matching already-delivered inactive receipts using the prior status fingerprint, preventing duplicate parent reports while preserving later same-state completions. Added behavioral regression coverage. Verified inactive-reconcile tests, project lint, documentation audience checks, syntax, and diff checks. Teardown tests passed relevant cases before the documented pre-existing herdr-preflight-missing-adapter failure
* fix(bin): sync remote second-mate homes to the parent primary commit Session start and remote launch pointed a remote second-mate home at whatever Firstmate copy its own host kept, so a home that had already advanced past that copy refused as a non-fast-forward and every other home stopped at the host's older commit while the primary ran ahead. The parent now resolves ITS primary default-branch commit with the existing helper and hands that commit to the host on both paths. Because a remote home is a standalone clone, the host imports that one commit before advancing - already present, else from that host's Firstmate copy without moving it, else from the home's own origin - and then runs the SAME ff_target guards a local home gets, so dirty, diverged, feature-branch, and unresolvable targets skip untouched and the ancestry rules keep one owner. An unimportable target now names /updatefirstmate instead of failing opaquely, and a host still running an older Firstmate copy is reported the same way rather than echoing a bare refusal. The host-local launch leg no longer re-runs its own secondmate sync, so the spawn it drives cannot re-target that host's copy after the parent has already converged the home. /updatefirstmate is unchanged: it still refreshes the remote code root from that host's origin and then syncs the home to that refreshed copy, which is what the sync call with no target commit means. * no-mistakes(document): Document primary-targeted remote secondmate synchronization
) * fix(bin): split brief task into captain intent and firstmate spec Keep no-mistakes --intent as the captain's ask plus later captain words, not the build spec or worker tradeoffs. * fix(bin): stop task-subsection copies at the next heading Promotion was swallowing the scout Setup contract into Firstmate spec, and pre-subsection briefs lost their # Task body. * no-mistakes(review): Validate brief content and preserve nested specifications * no-mistakes(review): Scope placeholder validation to scaffold-only subsection bodies * no-mistakes(review): Ignore fenced subsection headings during brief validation * no-mistakes(review): Preserve captain intent across scout promotion * no-mistakes(review): Enforce safe intent boundaries for legacy promotions * no-mistakes(review): Allow marked legacy intent and reject empty promotions * no-mistakes(review): Scope task parsing and overlay legacy intent contracts * no-mistakes(review): Overlay current intent contract for all no-mistakes spawns * no-mistakes(review): Preserve later captain clarifications in intent overlays * no-mistakes(document): Document brief intent enforcement and ownership * no-mistakes(ci): Updated spawn-related test fixtures to use valid Captain intent and Firstmate spec subsections, corrected launch-path expectations to launch-brief.md, and resolved ShellCheck quoting findings. Verified with fm-lint.sh and 15 affected behavior tests, including real Herdr tests; all passed * no-mistakes(ci): Updated stale spawn/promotion fixtures in the Muse, Orca, secondmate-harness, and public-followup suites to provide valid Captain's intent and Firstmate spec subsections. Verified full Orca and secondmate-harness suites, targeted public-followup promotion behavior, Bash syntax, diff checks, and fm-lint
…guid#3600) * fix(pi): start a new supervision branch conversation per main session The supervision branch reopened one recorded conversation forever, so every main session start reloaded the current generated prompt and then weeks of accumulated thread, where a superseded rule could still outweigh today's. The branch conversation is now scoped to one main session: the session generation owns the recorded conversation, so a cold start, /new, /resume, /fork, or a reload always builds a new one, while a rebuild inside one session (a model or effort change) still continues that session's own conversation. The dialog mirror re-anchors with it. Its durable cursor records what the previous branch conversation received, so a /resume or reload - which keeps main's own session file - would otherwise leave the new branch blind to dialog main itself still has. The reset is bounded by the current main session, and the cursor keeps advancing incrementally within it. The durable outcome store and its processed marker are untouched, so unacknowledged captain-facing outcomes still re-present on the new main session. * no-mistakes(document): Document fresh Pi supervision conversations * no-mistakes(ci): Fixed the flaky concurrent inbox failure. Lock acquisition now retries when a competing lock disappears between a failed claim and inspection. Added a behavioral regression covering that race. Verified the full inbox test four times, project lint, and git diff checks
* feat(update): restart second mates whose instructions changed /updatefirstmate pulled new bytes onto disk and then asked each advanced second mate to re-read them. A running agent holds AGENTS.md and every loaded skill frozen from launch and no verified harness offers a reload, so that steer could not reach a loaded skill at all and left the mate holding two contradictory copies of its own job description. An eligible mate is now restarted instead, in the same home and endpoint, through the existing transactional relaunch. The restart is gated on the mate first writing down the open work it holds only in conversation - the open-record half of /stow, never its memory sweeps - so an unregistered captain call is flushed before the conversation is spent. Anything that leaves the reload unprovable falls back to the old re-read message and is reported as exactly that, never as a clean reload. Remote mates take the same path: fm-remote-secondmate-control.sh gains a relaunch verb whose host-local leg runs that same control plane, since the mate is an ordinary local secondmate from its host's point of view. The primary resolves the profile and passes it explicitly, because config/secondmate-harness is not inherited and the file on that host belongs to a different home. fm-update.sh now splits its advanced live mates into a restart set and a nudge residual, and both sets require a changed instruction surface, which also closes the over-nudge against the session-start sweep. Restart is stricter still: a bin/-only advance reloads itself on the next call, so it never costs a conversation. Colocated tests cover the gating, the persist-then-restart order, the task-subset persist request, each unsafe fallback, the remote hop, and the remote sync's new instruction-surface report. * no-mistakes(review): Fix restart correlation, concurrent waits, and lifecycle reporting * no-mistakes(review): Parallelize relaunches and classify replacement incarnations * no-mistakes(review): Gate restart actions on live agent state * no-mistakes(review): Handle failed restart workers without hanging * no-mistakes(review): Nudge legacy remotes and preserve persist recovery * no-mistakes(review): Document one-time secondmate restart rollout * no-mistakes(review): Honor arrived replies and refresh remote profiles * no-mistakes(review): Revert remote parent profile reconciliation * no-mistakes(review): Reset remote profile defaults and honor published results * no-mistakes(review): Preserve fallback nudges for unverifiable secondmates * no-mistakes(document): Document second-mate restart update flow * no-mistakes(lint): Fix ShellCheck warnings in restart scripts
…id#3644) * perf(tests): route gate verification through the bounded concurrent runner Local validation was the pipeline's dominant cost: across 67 recorded no-mistakes agent sessions on this repo, 99.3% of command execution was `bash tests/*.test.sh`, run strictly one script at a time, and 2% of those calls were killed by an agent-guessed timeout and paid for twice. Three changes, each measured: - `.no-mistakes.yaml` pins `commands.test` to `bin/fm-test-run.sh --changed --exclude-family real-herdr-gated`. The runner already owns changed-file selection, bounded concurrency, the refusal of unproven scripts, and a generous automatic per-script bound, so the gate's baseline is neither a serial chain nor a guessed timeout. It stays intent-targeted - the Test step still runs its evidence agent on top - and excludes the live-Herdr family the required Herdr lane owns. - `bin/fm-test-run.sh` gives a plain list of script paths the same bounded automatic scheduler and automatic bound that `--changed` gets. Naming several subjects is how a verification round asks for exactly those scripts. The curated selections are untouched: `--lane` still composes CI shards whose serial lane must stay serial, `--family` is what the required Herdr lane runs, and `--all` stays a deliberate complete regression. - `pr-forge` is admitted to the concurrent-safe family registry on two consecutive clean proofs. `docs/fm-test-isolation-proof.md` records those, and records `secondmate` and `session-bootstrap` as refused with the exact script and reason each failed on, so the refusals are actionable rather than silent. Measured on this host, 0 failures on both sides: verification round, 4 scripts 448s chained -> 231s through the runner (-48%) pr-forge family 409.2s at 1 worker -> 237.9s at 4 (1.72x) watcher-wake-lock family 1311.1s at 1 worker -> 539.3s at 4 (2.43x) A fourth lever was implemented and then removed because the measurement refused it: raising the bounded-wait sample interval from 0.1s to 0.5s made `fm-watch-triage.test.sh` slower, 435s and 440s against 390s and 393s unchanged, back to back. Those sleeps are not overhead added to the clock - they are how a test waits for a subject moving on fm-watch.sh's own one-second cadence - so sampling less often only delays detection. It also broke `fm-watcher-lock.test.sh`, which catches a transient rather than waiting for a settled condition. CONTRIBUTING.md records that result so the experiment is not repeated. * no-mistakes(review): Separate concurrent runs by isolation proof family * no-mistakes(review): Limit automatic timeouts to changed-file validation * no-mistakes(document): Clarify validation concurrency documentation
* fix: copy PR URLs from records or abstain, never assemble them Supervision reported a plausible but dead PR link three times because its prompt demanded a full https:// URL at a moment when only a PR number was observable, so the model assembled an owner/repository from memory, and the PR check then accepted that URL and wrote it into the task record, after which the model kept defending its own tool-endorsed guess over the worker's real link. Three changes close that chain without any live forge lookup, so private forges are treated exactly like public ones: - bin/fm-branch-prompt.sh no longer mandates a URL. Its new "PR identity: copy or abstain" section requires a URL to be copied verbatim from a durable record (the done: PR <url> status line, pr= metadata, or the backlog note), forbids assembling owner, repository, host, or number from memory, and has the branch report only the identifier it actually holds when no record names the URL yet, leaving the PR check unarmed until the worker's ready line arrives. AGENTS.md section 7 and 9 carry the same copy-or-abstain rule for main in place of the bare full-URL mandate. - Worker briefs (bin/fm-brief.sh, ship and scout rules) require the full https:// URL wherever a PR is mentioned - status line, terminal, or summary - never a bare "PR 108", so the link is in view as early as the number is. - bin/fm-pr-check.sh refuses, offline and before any side effect, a URL that the task's own done lines contradict, printing both spellings; a log naming no URL still records the argument as before. fm_pr_status_ready_urls in bin/fm-pr-lib.sh owns reading those lines. The refusal also reaches bin/fm-pr-merge.sh, so nothing merges under a contradicted URL. Tests cover the offline refusal with zero side effects, the recorded spelling being accepted, markdown-wrapped and punctuated URLs, working lines not counting, the merge wrapper propagation, a self-hosted merge request with no forge call, the prompt carrying the rule, and the brief carrying the worker rule. * no-mistakes(review): Remove stale PR URL enforcement * no-mistakes(ci): Removed backlog notes as an accepted PR identity source. PR URLs may now be copied only from the task’s `done: PR <url>` status or canonical `pr=` metadata; otherwise supervision reports only the known identifier and leaves PR checking unarmed. Updated related guidance/docs and verified with branch-supervision tests, brief tests, ShellCheck, and `git diff --check`
…uid#3661) * fix(bin): disable Claude's feedback-draft flow for fleet-launched agents Scope --settings '{"feedbackDrafts":"off"}' to every Firstmate-launched Claude crewmate and secondmate, so /bug and /feedback never queue or submit a bug report on the captain's behalf. feedbackDrafts is the documented settings key (Claude Code changelog 2.1.247); the per-launch CLI flag never touches the captain's global settings.json. Claude-Session: https://claude.ai/code/session_01XYAXXzr4oZx9NjZb1veeE3 * no-mistakes(review): Prevent managed settings from re-enabling Claude feedback drafts * no-mistakes(document): Fix Claude feedback documentation formatting * fix(bin): layer both feedback-draft controls for defense in depth The prior --settings-only fix can be overridden by a managed Claude settings policy (feedbackDrafts precedence). Keep CLAUDE_CODE_SEND_FEEDBACK=0 alongside --settings '{"feedbackDrafts":"off"}': either control alone disables the SendFeedback tool, so a managed override of one still leaves the other in force. Claude-Session: https://claude.ai/code/session_01XYAXXzr4oZx9NjZb1veeE3 * no-mistakes(document): Document Claude feedback-draft suppression ownership
…guid#3662) * perf(tests): admit three more families to concurrent validation The three families that `docs/fm-test-isolation-proof.md` recorded as refused were not refused for concurrency. Each blocker was a test that decided a property by wall clock, or a script filed where it cannot run. Fixing those three things admits all three families and recovers 28.6 minutes of local validation with no assertion removed or weakened. - `tests/fm-backlog-handoff.test.sh` injected its pre-move crash by killing the handoff, sleeping a fixed second, then delegating the move to the real binary. Nothing ever killed the fake, so on a host slow enough for the case's next assertions to take longer than a second, the orphan woke and completed the very move the case requires left undone, and recovery then failed with `Task "pre-move-crash" not found in this backlog`. Watching the two backlogs during the injected crash showed exactly that, the item moving one second after the crash. All four crash injections in the file now go through a new `fm_fake_crash_injector` shim that signals the target and returns only once it is observably gone, and the pre-move fake never delegates the move at all. - `tests/fm-session-start.test.sh` proved the startup digest does not block on a slow current-state read by timing the whole digest against a fixed eight-second sleep, which a loaded host exceeds without the property being violated. It now holds that read open until the case releases it and asserts, the moment the digest returns, that the read has not finished. A digest that waited would wait indefinitely rather than for an interval a slow host can out-run, so the assertion is stronger than the bound it replaces. Its scan budget moves to the maximum, because the old value left two seconds of margin over the fixed sleep and measured the host rather than the deadline that `tests/fm-inactive-reconcile.test.sh` owns. - `fm-backend-herdr-focus-flash-e2e` was filed in the family map's catch-all, which put it in the portable serial lane, where Linux CI gate-skips it: that real-Herdr regression was running nowhere. It moves to `real-herdr-gated` and the required Herdr lane. `fm-claude-stop-autoarm-live-e2e` gate-skips on its opt-in variable and moves to `live-harness-optin`. The 28 remaining ungrouped scripts become an enumerated `standalone` family instead of admitting `unclassified` itself. `unclassified` is the family map's `*)` arm, so admitting it would silently grant concurrency to every test added afterwards, which is exactly the population with no proof. A new test still lands in `unclassified` and stays serial, and `tests/fm-test-run.test.sh` covers that split behaviorally. Each family passes two consecutive four-worker proofs with zero failures. On the production runner, `secondmate` goes 1233.1s to 453.4s, `session-bootstrap` 756.4s to 286.4s, and `standalone` 724.6s to 261.1s: 2.71x overall and 1713.2s recovered. The whole suite runs 177 scripts in 52.6 minutes of wall clock against 121 minutes of summed script time. * no-mistakes(document): Refresh concurrent validation and shard documentation * no-mistakes(ci): Fixed the real-Herdr focus-flash E2E race exposed by reclassification. Part C now starts its persistent child atomically via `pane run` and verifies stable child identity through Herdr’s public `process-info` interface, avoiding the racy send-text/send-keys sequence and platform-specific `ps` matching. Verified with bash syntax checking, ShellCheck, git diff checks, and the complete E2E test on Herdr 0.8.2
* feat(brief): structure no-mistakes ask-user escalation as event + snapshot file Crewmates escalating a no-mistakes ask-user gate now report one status event naming every finding id plus a snapshot file holding the gate's axi finding records verbatim (id, severity, file, line, description, authority), using the same shape even for a single finding. The status line never paraphrases. The format is defined once in fm-dod-lib.sh and rendered into both the scout and ship rule 6 in fm-brief.sh, so a promoted scout - whose rule 6 fm-promote.sh preserves unchanged - gets the identical contract as a freshly-spawned no-mistakes ship worker. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpiWaDerbYavTLPPtEjQei * no-mistakes(review): Preserve ask-user escalation output contract * no-mistakes(review): Align escalation format test expectation * no-mistakes(review): Scope ask-user escalation instructions correctly * no-mistakes(review): Remove ask-user from generic decision rules --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* fix(bin): require a self-sufficient no-mistakes intent A no-mistakes worker's --intent is only as useful as the string it passes. PR kunchenguid#3604 shipped with an intent that was only "do 1, 2, 3, 7 from the report": the real contract lived in a private scout report and never reached --intent, so nobody holding that string plus the codebase could have derived the specification. This is pure instruction at the contract's one owner; no spawn-side or promotion-side check is added. - bin/fm-dod-lib.sh: the generated no-mistakes Definition of done now states that the --intent string must be self-sufficient (the string plus the codebase reconstructs roughly the same specification) and tells the worker to write the substance of any report, decision, or PR the captain's intent refers to into --intent rather than the pointer, while Firstmate build instructions and the worker's own decisions still stay out. The spawn-time overlay points back at that rule so its "supersedes" wording cannot cancel it, and the header's owner statement carries the rule. - AGENTS.md section 11 and bin/fm-brief.sh's header ask Firstmate to include the substance of referenced material when filling ## Captain's intent, and section 11 points at the owner of the rule. - tests/fm-brief.test.sh and tests/fm-task-delivery.test.sh assert the rendered brief and launch contract carry the rule. Claude-Session: https://claude.ai/code/session_01YMhEe42q7BAAoN6RxNuzim * no-mistakes(document): Replace incident-specific intent test commentary
* Speed local fleet snapshot composition * no-mistakes(review): Stabilize task inventory during concurrent snapshot composition * no-mistakes(document): Document local snapshot observation concurrency * no-mistakes(ci): Fixed CI failures by making empty task manifests compatible with stock macOS Bash 3.2, snapshotting task metadata before concurrent observations to prevent generation drift, strengthening the behavioral race regression, and updating the stock-Bash Bearings test count to 45. Verified fleet snapshot tests (15), Bearings tests (45), workflow lint tests, project lint, Bash 3.2 parsing, and diff checks * no-mistakes(ci): Fixed the Linux CI failure caused by passing large backlog/task JSON through jq command-line arguments, which exceeded the per-argument size limit. Both inventory projections now stream large JSON inputs through stdin. Verified with fm-bearings-snapshot.test.sh (45 tests), fm-fleet-snapshot-view.test.sh (15 tests), Bash syntax, and git diff checks * no-mistakes(ci): Fixed concurrent task teardown during metadata capture: vanished metadata is now omitted while genuine copy failures remain fatal. Added a deterministic public Bearings regression test and updated CI’s expected test count. Verified with the full Bearings suite, workflow-lint suite, Bash syntax checks, and git diff checks * no-mistakes(ci): Fixed PR-caused CI and review issues: streamed large fleet JSON through jq stdin to avoid Linux argument limits, kept crew-state reads bound to captured metadata generations, and strengthened the behavioral race test. Bearings (46 tests), fleet snapshot (15 tests), crew-state, backend, lint, Bash syntax, and diff checks pass locally. Serial shard 5’s unrelated task-inbox segmentation fault appears infrastructural/flaky * no-mistakes(ci): Fixed endpoint-state generation crossing by validating captured spawn_gen before and after local endpoint probes, falling back to exact metadata identity for legacy tasks. Stale probe results now become unknown instead of false unhealthy state. Added a behavioral relaunch-race regression test. Verified the full Bearings snapshot suite, shellcheck, bash syntax, and git diff checks * fix(snapshot): keep live observations generation-coherent * no-mistakes(review): Keep secondmate observations generation-bound without copying reports * no-mistakes(document): Document generation-coherent snapshot observations * test(bearings): measure local read overlap instead of wall-clock budget The large-local-snapshot regression asserted that a whole snapshot composed in under five seconds. That bound measures how loaded the host is, not whether the per-task reads actually overlap, so it failed intermittently on a contended machine: one run in six on a box at load 16-20, landing exactly on the five second boundary. Time a serialized run and a concurrent run of the same workload instead and require the concurrent one to save at least two seconds. Both runs pay the same composition overhead, so the difference isolates the overlap this change delivers. Five one-second reads serialize into five seconds and overlap into about one, and re-serializing the reads collapses the saving to roughly zero, so the assertion still fails loudly if the concurrency regresses. Also bump the pinned Bearings test count to 48, since rebasing onto the current default branch picked up its captain-hold test. * no-mistakes(review): Restore JSON-derived decision flags * no-mistakes(review): Unify status-derived snapshot observations * no-mistakes(ci): Updated the stock macOS Bash CI check’s Bearings test count from 48 to 49. Verified the full Bearings suite passes and emits exactly 49 TAP successes; git diff checks pass
* fix(bin): stop the supervision branch's stale-ack and ghost-report loops Clean-slate implementation of the four authorized recommendations from the supervision-ghost-retrigger analysis (items 1, 2, 3, and 7), in their minimal form, superseding PR kunchenguid#3604: - fm_branch_report refuses a task the wake being handled never named. The extension fixes the reportable task set from the eligible rows before each prompt (signal and stale rows resolve to their tasks, a heartbeat allows any task with a live record, fleet is always allowed), so a report typed from memory about a task whose records teardown already removed is never stored or delivered. - An acknowledgement that consumes nothing says "nothing was acknowledged through N" and prints the exact --ack-through / --recovery-generation command for the current presented wake, instead of "re-run the drain", which re-fed the same stale acknowledgement in a loop. - bin/fm-guard.sh no longer tells the branch actor to drain queued wakes while it is handling them; it names the granted rows instead. - Teardown removes state/.<task>.branch-outcome-index for ordinary tasks and descendants; the index rebuild and the append-side index write both skip a task with neither a live record nor a status log, so the branch's report of a teardown it just performed is stored without recreating the index. No new locking, no spawn-generation binding, and no retired-task refusal: the branch can still report the outcome of a task it just tore down, and the teardown test now proves that path end to end. * fix(bin): narrow the branch report scope and guard silence to the minimal form Apply the four review decisions on the clean-slate branch: - A signal or stale prompt may report only the tasks its own rows resolve to; fleet is refused there too. A heartbeat review is not scoped by task at all, so the extension no longer tracks live task records and refuses nothing by task id during a fleet review. - The outcome-index rebuild no longer skips retired tasks; the append-side skip alone keeps a torn-down task's index from being recreated. - bin/fm-guard.sh keeps the queued-wakes warning silent for the branch actor instead of printing a replacement note. * no-mistakes(document): Align supervision docs with scoped wake handling
* Fix fleet snapshot large JSON transport * no-mistakes(review): Captain: file-back fleet snapshot transport safely * no-mistakes(review): Captain: file-back parent summary aggregation * no-mistakes(ci): Rebased the PR's three commits onto f4d7875 and resolved the fleet snapshot conflict while preserving the base's task-observation lifecycle. Fixed Greptile's valid finding by recursively removing the private mktemp transport directory, so future transport files cannot cause cleanup to fail. Verified with tests/fm-home-summary-refresh.test.sh, bin/fm-lint.sh, git diff --check, and ancestry checks. All passed; the fix remains as an uncommitted worktree change for the outer executor
…nguid#3681) * fix(bin): recognize active pipeline fix rounds with unfetched run heads A no-mistakes fix round advances the run head beyond the submitted head, and the pipeline commits in its own checkout, so the task copy never receives the new commit object. fm-crew-state's strict head rule rejected the active row, the coarse runs-list scan skipped it and matched the older failed row at the submitted head, and an active validation read as failed (observed on model-routing-benchmark-hardening: active head ac61c64 vs task copy at fb47636d). fm_nm_runs_status_for_worktree in bin/fm-nm-run-lib.sh now owns runs-ledger attribution: the branch's newest row alone decides, and a newest row whose head cannot resolve locally is recognized only as a provable pipeline-owned continuation - active (running) and anchored by the immediately older row for the same branch having ended at exactly this worktree's HEAD. The reader keeps the axi TOON as full detail for that proven same-branch run. Unanchored, ancestor-anchored, and terminal unresolvable rows stay unattributed, so branch-name coincidence and other tasks' runs never match, and fm_nm_head_matches_worktree keeps its exact prior semantics for teardown (verified by the full teardown suite). Tests: reproduction regression for the unfetched active fix head (reads working via full run-step detail), coarse-path continuation when axi answers another branch, and negative controls for the unanchored active row and the unresolvable terminal row with the historical fallback preserved. Ported onto upstream/main f4d7875, where kunchenguid#3194 independently added the branch_sync custody exemption on the full axi-status path: both mechanisms now coexist, each owning one surface (TOON custody on the full path, the runs ledger on the coarse path). The port deletes the superseded coarse scan-and-skip (nm_runs_status_for_branch) and its now caller-less helpers (fm_nm_head_resolvable, nm_coarse_head_matches_worktree), renames the exemption comment's "the one exemption" phrasing now that a second complementary exemption exists, and points the stale FM_CREW_STATE_RUNS_LIMIT comment at fm_nm_runs_status_for_worktree (judge follow-up #1). The parent coarse-guard test's fixture is the ledger-anchored continuation shape, so its expectation flips to the fixed behavior (working via run-step, never the older failed row); a new mismatched-anchor coarse negative control preserves that guard's original no-anchor protection (pane answers, never the older row). * no-mistakes(document): Clarify pipeline attribution documentation
…uid#3663) * fix(bin): pre-register claude workspace trust for task worktrees A claude crewmate launched into a fresh task worktree met Claude Code's interactive workspace-trust dialog before it ever read its brief, and firstmate could not answer it: the key plane carries only Enter, Escape, and C-c with no arrow navigation, and the dialog's selection starts on "No, exit", so the documented Enter recipe ended the session instead of accepting it. Two workers wedged this way and were unblocked only by hand-seeding the trust store per path. --dangerously-skip-permissions does not cover that gate. `claude --help` records the dialog as skipped only in non-interactive mode, through -p or a non-TTY stdout, and a crewmate pane is interactive, so there is no launch flag to reach for. fm-spawn now pre-registers the worktree through bin/fm-claude-trust.sh in the existing claude branch, before the project settings that the same gate would otherwise block, and refuses the spawn when that write fails rather than launching a worker that would wedge. The scope test is the safety property and is structural rather than a path policy: the path must be a linked git worktree, sharing the spawning project's common dir, whose top level is exactly the resolved argument. Git is the ground truth, so the argument is never trusted on its own word, and a primary checkout, an unrelated repo, a worktree subdirectory, a plain directory, and a home directory are each refused rather than warned about or skipped. A treehouse or orca path prefix was deliberately avoided because treehouse's root is configurable, which would make a prefix both wrong and a new policy surface. One structural test covers both worktree providers. tests/fm-claude-trust.test.sh pins both halves, including a case where HOME is itself a valid linked worktree so the home guard is proven load-bearing rather than passing vacuously, plus the spawn-level proof that a claude spawn trusts its worktree and launches with the brief pointed at the same store. The adapter reference no longer tells a firstmate to press Enter on that dialog, and the shared trust reference now names every harness surface: which harnesses gate, which suppress at launch, which dodge the gate, which now pre-registers, and that a claude secondmate is excluded by design. The spawn fixture runs each spawn against a throwaway HOME so the suite cannot write the developer's real store, isolating through HOME rather than CLAUDE_CONFIG_DIR because the spawn forwards a set CLAUDE_CONFIG_DIR onto the launch command that launch-shape assertions read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HNEN2GLnew27HFyfi4ms4v * fix(bin): create the staged trust store exclusively The staged store was written to a predictable pid-based path with a plain write, which follows a symlink. Where the Claude config directory is writable by another local account, that account could pre-create the path as a symlink and redirect the write into another file the launching user owns. The staged name now carries random bytes and is created with an exclusive "wx" open, so an existing path is refused outright instead of followed. The happy-path test also asserts no staged store survives the rename. The durability comment now states the residual window plainly: the readback proves the entry landed, not that it survives, because a vendor session that rewrites the whole store afterwards can still drop it and no lock closes that window when the writer is Claude itself. The worker then meets the dialog and stalls, which reaches firstmate as the ordinary stale wake rather than as silent success. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HNEN2GLnew27HFyfi4ms4v * no-mistakes(review): neutralise CDPATH in claude trust scope guard * no-mistakes(review): sandbox HOME in spawn tests, drop out-of-scope artifacts * no-mistakes(review): refuse unresolvable git dir, compact store, fix secondmate doc * no-mistakes(review): clear git env overrides, resolve symlinked store target * no-mistakes(review): degrade without node, fix Pi gate claim, record trust proof * no-mistakes(review): refuse without node, pin CLAUDE_CONFIG_DIR in spawn tests * no-mistakes(review): refuse relative config dir and concurrent store modification * no-mistakes(review): correct orca worktree claim, clean staged store on failure * no-mistakes(review): restore pretty-printed store, correct trust dialog docs * no-mistakes(review): arm trust gate before busy state to avoid orphans * no-mistakes(document): record claude trust pre-registration in its owner docs * no-mistakes(document): note orca limit for claude trust pre-registration * no-mistakes(ci): Fixed the Greptile P1 on bin/fm-spawn.sh by moving the Claude trust gate earlier rather than adding cleanup machinery. Diagnosis: Greptile reported that when Claude trust registration fails on tmux/Zellij/cmux/non-projected Herdr, the exit runs after the backend endpoint and /tmp/fm-<id> were created, and the abort trap cleans neither. The endpoint half is pre-existing, deliberate architecture — the two refusals immediately above the gate (the 60s `treehouse get` timeout at fm-spawn.sh:2550 and `validate_spawn_worktree` at :2487) also exit with the endpoint live and direct the operator with "inspect window $T"; spawn_abort_cleanup only reclaims orca endpoints (already covered via ORCA_ABORT_CLEANUP) and herdr projections. The temp-root half was genuinely introduced by this PR: the gate was placed beside the busy-state arm, ~30 lines after `mkdir -p "$TASK_TMP/gotmp"`, and fm-teardown can only find that root through `tasktmp=` in a meta record a refused spawn never publishes. Root-cause fix (smallest correct change, no new subsystem): - bin/fm-spawn.sh — moved the `claude*` trust gate from inside the busy-arm block up to the first point $WT is known, immediately after the `freshen_spawn_worktree_base` block and before TASK_TMP creation, the STATE setup, and the relaunch `clear_relaunch_harness_wiring` retirement. A refusal now leaves no temp root, no retired relaunch wiring, and no busy record; only the endpoint remains, in the same class as the two refusals just above it. - bin/fm-spawn.sh — the refusal message now ends with "inspect window $T", matching the existing convention so control/teardown can identify the endpoint. $T is set for every backend on the non-secondmate path. - bin/fm-spawn.sh:196 — header note corrected from "before any state is armed" to "before any per-task state exists". - tests/fm-claude-trust.test.sh — the existing refused-spawn test's own comment claimed "before any task state exists" but only asserted busy state. Renamed to test_refused_spawn_leaves_no_task_state and added an assertion that /tmp/fm-<id> is absent, with the task id suffixed by the test process pid so the assertion reads only this run's path (a stale /tmp/fm-refusedspawn from the fixed-id version was in fact present on this box). No assertions on implementation source bytes. Verification run locally: - The new assertion fails against the pre-fix bin/fm-spawn.sh ("not ok - a refused spawn stranded a temp root no teardown can find") and passes after — a real before/after regression proof. - tests/fm-claude-trust.test.sh: 20/20 ok. - tests/fm-backend.test.sh, fm-backend-orca, fm-control-relaunch, fm-spawn-dispatch-profile, fm-trace-context-spawn, fm-gotmp: all pass. - tests/fm-backlog-atomicity.test.sh: rc=0, 79 assertions ok. - bin/fm-lint.sh (repo's single lint owner, pinned ShellCheck 0.11.0 + actionlint 1.7.12): clean. - No /tmp/fm-refusedspawn* leftovers after the runs. Scope respected: no trust subsystem, no policy layer, no config surface, no endpoint-cleanup mechanism added; the change is an ordering move plus one error-message clause and the test that pins it. Adapter references and docs made no ordering claim, so none needed updating. Changes are left uncommitted in the worktree for the outer executor --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* feat(update): restart every live second mate after a successful update /updatefirstmate only restarted a second mate when that pass advanced its AGENTS.md or .agents/skills. An already-current home was skipped entirely, a bin/-only advance was steered instead, and a remote host that could not report its instruction diff was downgraded to a re-read. A running agent also freezes its launch-time wiring - turn-end hooks, harness flags, per-harness feature switches - and none of that is derivable from a file diff, so an unchanged tracked surface is not evidence the agent is already on the current behavior. Restart is now unconditional on a successful update of that home. Every live second mate the pass leaves on the target commit is restarted, whether it advanced or was already there. The safety contract is unchanged: open records are persisted before the agent is replaced, nothing is forced, stashed, or discarded, a home the pass had to skip is not restarted at all, and a mate whose runtime cannot prove a restart keeps the honest re-read path and is never reported as reloaded. bin/fm-ff-lib.sh gains a settled-state hook that fires for a home left at the base whether it advanced or was already there, and never for a skipped one; the instruction-gated hook the session-start convergence sweep uses is untouched. Regressions: fm-update pins the already-current mate into the restart set and the unprovable one into the nudge set, and fm-secondmate-restart drives both real commands end to end - an already-current home is named, persisted, and genuinely replaced with its checkout untouched, while the unprovable one keeps its running agent. * no-mistakes(document): Document unconditional secondmate restarts
…3696) * fix(bin): close reserved pending-reply keys via fm-send --resolve-key fm-send wrote answered: notes that the reserved-key fold ignores, so operator closes exited 0 while OPEN DECISIONS kept the decision open. Speak the owning library's close vocabulary on that path, and refuse when a reserved close cannot take effect. * no-mistakes(review): Safely quote manual decision-close recovery commands * no-mistakes(review): Reject unclosable overlong decision keys before sending * no-mistakes(review): Remove contract suffix from open decisions hint * no-mistakes(document): Document resolve-key line-cap refusal
* fix(bin): stop false missed-reply escalations for same-basename self-home answers A healthy secondmate that wrote corr= to its own state/<id>.status never matched the parent channel, so recovery confirmed and the record escalated as pending-reply-missed. Make the report helper resolve the parent channel itself, skip parent-replies.status as wrong-home, put a readable sighting path on the missed line, and restatement-copy only that same-basename self-home file onto the parent channel. * no-mistakes(review): Resolve late replies before recovery escalation * no-mistakes(review): Tighten reply routing and regression coverage * no-mistakes(review): Preserve reply paths and require explicit home * no-mistakes(review): Encode wrong-home paths before persistence * no-mistakes(document): Document corrected secondmate reply routing * no-mistakes(lint): Fix pending-reply ShellCheck warnings
Adopt the first 26 remaining first-parent changes through a full merge. Preserve agy, Pi away supervision, durable fork outcomes, remote process safety, bounded validation, GBrain, and dashboard contracts. Apply the reviewed terminal-anchor attribution requirement and the Firstmate-approved recovery/restart instruction corrections. Isolate Claude trust-writing fixtures and retain their negative guards. Later sync endpoints and ledger-parked branches remain excluded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge the first of four remaining contiguous upstream prefixes, through
kunchenguid/firstmate@d43e610b0a6b1c6eb79bcf37e6c41074d89a4c6d.This imports 26 first-parent changes while preserving the fork's agy adapter, Pi away supervision, durable outcomes, remote process safety, GBrain, dashboard behavior, and test bounds.
Topology and scope
83f4a40bff0ee86960bd7f4774a92068da56880b.88fb3c0ae9ddca1cfd58acf87308f0d1d4b73ccb.git merge --no-ff d43e610b0a6b1c6eb79bcf37e6c41074d89a4c6d; the merge commit has exactly the fork and endpoint parents above.38e6e9f0374d5d8dbfc99e9e328b2f6854d932e8. Pushed successfully to the explicitly verified fork origin.4768e98d469b7216569acf6e7a5cc696ecd15c2e; later endpoints2e65d2e2482247c22db2ba7aeeb055eb7876fef1,b84e0e362face25f3dd8945297a3df1320d7668c, and the ceiling remain excluded.Validation
The unchanged-parent failures are preserved separately.
Both parents expose private-directory fixture refusals under ambient umask 0002 and a Calm stock-renderer oracle mismatch on Pi 0.85.1.
Upstream additionally exposes host-sensitive node/PATH/wrapper fixtures and an unavailable Ruby parser dependency that the fork already handles.
Final validation uses umask 022 with the production private-state guard unchanged; unchanged-parent directory-mode counterexamples establish that distinction.
Calm's production code is unchanged; its test now supplies the stock SDK tool definitions and recognizes the installed stock working indicator.
The initial integrated sweep's two additional failures were outdated fork-only agy brief and Claude launch-template expectations, corrected without weakening production gates; both affected suites passed their reruns.
Strict Pi typechecking passed against installed Pi 0.85.1 with the existing cached TypeScript 7.0.2 compiler.
Credential-free real-SDK guard tests passed on both parents and the candidate; all final Pi TypeScript files are byte-identical to that candidate.
No real model-provider or opt-in live-harness coverage is implied by those checks or by gate skips.
The snapshot suite passes 52 checks against the CI minimum of 49.
Documentation audience, cross-system pointer, whitespace, and full lint checks passed.
All lifecycle tests use repository-owned unique guarded nondefault Herdr labs, under Firstmate's explicit fixture authorization.
An initial isolated-HOME discovery attempt hit the unchanged fleet tripwire and was stopped; read-only A/B established the stopped shadow socket versus the actual running default under baseline HOME.
The final invocation restores real-HOME discovery, clears inherited fleet identity, and isolates Claude-writing fixtures with scratch stores, including a regression observing the actual write destination.
No server update, global stop, default-session lifecycle change, tool installation, or fleet dispatch-default change was performed.
Private trust-fixture incident reconciliation: the captain-approved four-entry cleanup completed with exact-key verification and unchanged unrelated settings/permissions; a possible fifth remains unconfirmed and was neither searched for nor removed.
Review conclusions and ledger changes
Gemini CLI and Antigravity/agy are separate executables with different authentication, trust, and supervision mechanisms.
Gemini arrives in the next prefix, not this merge; agy remains crew-only and Herdr-only with native identity and atomic inbox delivery.
The ceiling's Gemini configured-profile validator omits Gemini despite its runtime registration; the report records an executable reproduction for the later round.
This prefix preserves existing Pi supervision and adds fresh per-main-session branch conversations, accepted-follow-up handling, requested-result classification, and wake-task-scoped reporting.
Later async delivery, extension-provider, Windows, native Codex, and AFK-posture changes remain excluded.
Prompt-cache and interruption-percentage announcements are not treated as measured guarantees.
The ledger records the explicitly approved terminal exact-HEAD anchor for unresolved active no-mistakes heads, retaining strict teardown attribution and the fork's relation/custody/degraded-state guarantees.
It retires the pre-move crash-fixture divergence because upstream's shared injector now supplies that behavior.
Compatible snapshot, wait-cadence, authored-brief, and preserving-refusal adaptations are recorded; the parked list is unchanged.
Firstmate approved narrowing two inconsistent skill statements to their existing owners: preserving-refusal recovery follows teardown, and rollout restart eligibility requires confirmed exact-target convergence and excludes skipped homes.
This is direct-PR because no-mistakes would rebase away the required merge topology.
No no-mistakes run was invoked.
The sole expected red check is PR must be raised via no-mistakes; all 16 other checks passed, including lint, every portable lane, real-Herdr behavior, stock macOS Bash snapshot compatibility, repository invariants, coverage and timing aggregation.
Explicit GitHub API readback:
mergeable=true,merged=false, exact head38e6e9f0374d5d8dbfc99e9e328b2f6854d932e8, baseHelloWorldSungin/firstmate:mainat83f4a40bff0ee86960bd7f4774a92068da56880b.mergeable_state=unstablereflects the deliberately red compliance gate, not a merge conflict.Landing remains reserved for Firstmate through
bin/fm-pr-merge.sh fm-upstream-sync-2026-09-08-round-2 https://github.com/HelloWorldSungin/firstmate/pull/270 -- --mergewith an explicitly composed commit body.Private comparison report:
/home/sungin/firstmate/data/fm-upstream-sync-2026-09-08-round-2/report.md.Its evidence index preserves the measured inventory and all 166 overlap patches, parent/final artifacts, Kun fetched commit/hashes and attributed advisory influence, and the full-ceiling comparison.
Current-round first-parent applicability
8988af2aec35fix(bearings): keep active children underway during captain holds77ee3c82f86efix(pi): settle watcher delivery on Pi accepting the follow-upd22318ea1e61fix(bin): bound repeat stale wakes for parked workers5fb0ce7628f2fix(bin): accept the away-mode daemon as the turn-end supervision owner353a8f0ff25dfix(backlog): omit --file from row probes for non-markdown backends1c00e86cf3a1fix(bin): classify progress updates on requested work as routineb2e3e9ef69b2fix(bin): preserve captain calls during teardownd3fcdfa548f5fix(bin): deliver secondmate outcomes to the parent channele1d1d692674bfix(bin): sync remote second mates to primary commit28fb5acaf32cfix(bin): separate captain intent from firstmate specs3d2a08b2097dfix: start a fresh supervision branch for every main session1c5c9c18d580feat: restart second mates after instruction updates7dcf07218c76perf: accelerate local validation with bounded concurrency75b2de262ab0fix: copy PR URLs from durable records3034912cd57dfix(bin): disable Claude feedback drafts for fleet launches7adb358fd507feat(tests): run three more validation families concurrentlyed44d1507a91feat: structure no-mistakes ask-user escalations3b82ebdd79cffix(bin): require self-sufficient no-mistakes intent5a7ba57caf2cfix: accelerate local Bearings snapshot compositionf4d7875824ecfix: prevent stale supervision wake loops31cba0db93f0fix(bin): avoid fleet snapshot argument limitsb82d09f0f090fix(bin): attribute active runs with unfetched pipeline heads1b0fbb9b8693fix(bin): pre-register claude workspace trust at spawn timeefbeb4fe700efix: restart every live second mate after updates3c1e86d7687bfix(bin): close pending-reply decisions via resolve-keyd43e610b0a6bfix(bin): prevent false missed-reply escalationsPer-file contract reasoning
AGENTS.md.agents/skills/bearings/SKILL.md.agents/skills/bootstrap-diagnostics/SKILL.md.agents/skills/updatefirstmate/SKILL.md.agents/skills/ask-user-authority/SKILL.md.agents/skills/captain-hold-lifecycle/SKILL.md.agents/skills/secondmate-provisioning/SKILL.md.agents/skills/harness-adapters/references/common/control-and-recovery.md.agents/skills/harness-adapters/references/harness/claude.mdbin/fm-bearings-snapshot.shbin/fm-fleet-snapshot.shbin/fm-bootstrap.shbin/fm-brief.shbin/fm-dod-lib.shbin/fm-crew-state.shbin/fm-nm-run-lib.shbin/fm-guard.shbin/fm-launch-lib.shbin/fm-spawn.shbin/fm-claude-trust.shbin/fm-pr-check.shbin/fm-task-inbox-lib.shbin/fm-teardown.shbin/fm-test-run.shbin/fm-watch.shbin/fm-backlog-transition-lib.shbin/fm-parent-channel-lib.shbin/fm-secondmate-report.shbin/fm-pending-reply-lib.shbin/fm-send.shbin/fm-secondmate-restart-lib.shbin/fm-secondmate-restart.shbin/fm-update.shbin/fm-remote-secondmate-control.shbin/fm-tasks-axi-lib.shbin/fm-turnend-guard.sh.pi/extensions/fm-primary-pi-watch.ts.pi/extensions/fm-branch-supervision.ts.pi/extensions/lib/fm-branch-dispatch.tsbin/fm-branch-outcome.shbin/fm-branch-prompt.sh.github/workflows/ci.yml.no-mistakes.yamldocs/fork-divergence.mddocs/fm-test-portable-shards.mdCONTRIBUTING.mdREADME.mddocs/configuration.mddocs/watcher-continuity.mddocs/captain-hold-lifecycle.mddocs/supervision-protocols/pi.mddocs/verification/runtime-backends.mddocs/verification/supervision.mddocs/architecture.mddocs/scripts.mdAdditional changed contract files
bin/fm-backend.shbin/fm-control.shbin/fm-ff-lib.shbin/fm-inactive-reconcile.shbin/fm-merge-outcome-lib.shbin/fm-promote.shbin/fm-supervise-daemon.shbin/fm-wake-lib.shbin/fm-wake-drain.shdocs/secondmate-parent-channel.mddocs/verification/secondmate-parent-channel.mddocs/agent-control.mddocs/remote-secondmates.mddocs/turnend-guard.mddocs/orca-backend.mddocs/documentation-audiences.jsondocs/fm-test-isolation-proof.mdRemaining contract rows
bin/fm-captain-hold.shdocs/pi-supervision-branch.mdChanged fixture contract reasoning
tests/fixtures.shtests/fm-agy-adapter.test.shtests/fm-design-skills.test.shtests/fm-issue-linkage.test.shtests/fm-dashboard-events.test.shtests/fm-spawn-worktree-settle.test.shtests/fm-cmux-claude-composer-live-e2e.test.shtests/fm-launch-lib.test.shtests/fm-brief.test.shtests/fixtures/fm-brief-no-issue.sha256tests/fm-calm-pi-extension.test.shtests/fm-crew-state.test.shtests/fm-test-run.test.shtests/fm-backlog-handoff.test.shtests/fm-bearings-snapshot.test.shtests/fm-watch-triage.test.shtests/fm-spawn-dispatch-profile.test.shActive-divergence survival evidence
Each row names the executable regression witness; pending entries are not claimed passed.
The opt-in live dashboard/browser and real agy probes remain explicitly gated and are not implied by portable passes.
tests/fm-agy-adapter.test.sh: passedtests/fm-lint.test.sh: passedtests/fm-quota-sidecar.test.sh: passedtests/fm-send-strict.test.sh: passedtests/fm-watcher-lock.test.sh: passedtests/fm-backend-herdr.test.sh: passed;tests/fm-watcher-lock.test.sh: passedtests/fm-daemon.test.sh: passed;tests/fm-watch-triage.test.sh: passedtests/fm-daemon.test.sh: passed;tests/fm-watch-triage.test.sh: passedtests/fm-backend-herdr.test.sh: passedtests/fm-remote-job-orphan-reap.test.sh: passed;tests/fm-remote-job.test.sh: passedtests/fm-remote-job.test.sh: passedtests/fm-on.test.sh: passed;tests/fm-test-run.test.sh: passedtests/fm-test-run.test.sh: passedtests/fm-guard-stale-banner.test.sh: passed;tests/fm-turnend-guard.test.sh: passed;tests/fm-wake-queue.test.sh: passedtests/fm-crew-state.test.sh: passedtests/fm-trigger-validation.test.sh: passedtests/fm-backlog-atomicity.test.sh: passedtests/fm-spawn-dispatch-profile.test.sh: passedtests/fm-bearings-snapshot.test.sh: passed;tests/fm-fleet-snapshot-view.test.sh: passed;tests/fm-home-summary-refresh.test.sh: passedtests/fm-pi-watch-extension.test.sh: passedtests/fm-no-mistakes-required-gate.test.sh: passedtests/fm-no-mistakes-required-gate.test.sh: passedtests/fm-pr-merge.test.sh: passedtests/fm-upstream-status.test.sh: passedtests/fm-agents-hard-rules.test.sh: passedtests/fm-bootstrap.test.sh: passed;tests/fm-brief.test.sh: passed;tests/fm-gbrain-capture.test.sh: passed;tests/fm-gbrain-health.test.sh: passed;tests/fm-gbrain-pin-check.test.sh: passed;tests/fm-gbrain-readonly-e2e.test.sh: gate skipped;tests/fm-recall.test.sh: passed;tests/fm-remote-secondmate-lifecycle-e2e.test.sh: passedtests/fm-bearings-snapshot.test.sh: passed;tests/fm-dashboard-browser.test.sh: gate skipped;tests/fm-dashboard-events.test.sh: passed;tests/fm-dashboard-gbrain-ui.test.sh: passed;tests/fm-dashboard-gbrain.test.sh: passed;tests/fm-dashboard-history.test.sh: passed;tests/fm-dashboard-usage.test.sh: passed;tests/fm-dashboard.test.sh: passed