feat: add opt-in never-send brief regions for Jev dispatch

[MrGTV-love]

Intent

do all of hte proposed fork fixes (2026-09-29, answering the Jev value report data/fm-jev-value-scout/report.md section 5, 'Fork follow-up shortlist'). Goal stated with it: "The user is looking to maximize performance while minimizing cost. Jev seems like a massive lever." Jev is typesafe.ai's System One model; firstmate calls it only from bin/fm-dispatch-resolve.sh (typed dispatch resolution). Work lands on the fork MrGTV-love/firstmate only; never push to, open, or comment on anything in kunchenguid/firstmate.

This task covers shortlist item 4:
4. Define an opt-in never-send rule for project/customer-sensitive brief sections before Jev egress; do not use Vernant/customer text until authorized.

Context: config/dispatch-never-send today only blocks literal values. The Jev value report found TypeSafe's public terms do not prove Vernant's standard_confidential/v1 processor bar (delete inputs/outputs within 30 days, no training), so no real Vernant customer data may reach Jev.

What Changed

• Add the # dispatch-never-send marked-sections opt-in to strip explicitly marked private regions before task-section extraction or whole-brief fallback, leaving local briefs unchanged.
• Withhold requests when markers lack the opt-in or privacy directives and markers are invalid; retain literal checks across all remaining request strings.
• Document the privacy contract and authorization restriction for real Vernant/customer text, and add synthetic request-body coverage for protected regions and fail-closed behavior.

Risk Assessment

✅ Low: The change is bounded to explicit resolver privacy preprocessing, preserves existing literal protection and local brief consumers, and implements the recorded fail-closed decisions without a substantiated material defect or unnecessary feature.

Testing

Live synthetic resolver checks demonstrated sanitized outgoing payloads and fail-closed refusal before transport or quota activity. Targeted resolver and brief tests passed after correcting a temporary-path setup issue. Captured payloads, CLI transcripts, inherited-policy behavior, and emitted help are preserved as evidence; no full suite, external model call, or other pipeline phase was run.

• Live validation: ✅ go - 12 of 12 scenarios driven live against the product

Scenario	Result	Live	Evidence
Enable marked sections and send only public task text across multiple protected regions	✅ pass	live	Live resolver payloads: canonical-multiple-regions
Remove protected task headings before whole-brief fallback	✅ pass	live	Live resolver payloads: whole-brief-sanitized-fallback
Withhold marked text inside Markdown code fences	✅ pass	live	Live resolver payloads: markers-inside-code-fence
Use supported surrounding and inter-token whitespace	✅ pass	live	Live resolver payloads: whitespace-policy-and-markers
Submit intended markers without enabling section protection	✅ pass	live	Live resolver transcript: no-list-markers, literal-only-markers, no-list-unspaced-markers
Try malformed, nested, unmatched, inline, and differently spelled reserved markers	✅ pass	live	Live resolver transcript: malformed-marker-*
Try malformed privacy directives and the removed whole-project directive	✅ pass	live	Live resolver transcript: invalid-directive-*
Keep literal withholding effective across all remaining request strings	✅ pass	live	Live resolver transcript: literal-after-section-stripping, literal-case-and-whitespace, literal-unicode-whitespace, literal-project-name, literal-rule-criterion, literal-fixed-question
Send unmarked briefs normally without requiring a project name	✅ pass	live	Live resolver payloads: unmarked-without-list, enabled-unmarked-without-project, unrelated-literal-preserves-request
Refuse an invalid never-send policy path	✅ pass	live	Live resolver transcript: policy-directory-refused, policy-broken-symlink-refused
Propagate section protection into a child home and resolve there	✅ pass	live	Actual child-home inherited-policy execution
Read brief-author guidance through the actual CLI help	✅ pass	live	Emitted brief-author help

Evidence: Live resolver payloads and privacy assertions

Source: Live resolver payloads and privacy assertions

{
  "transport": {
    "product": "bin/fm-dispatch-resolve.sh",
    "bash": "/bin/bash",
    "curl": "/usr/bin/curl",
    "endpoint": "https://api.typesafe.ai/v1/systemone",
    "isolation": "real curl --connect-to to private 127.0.0.1 TLS receiver; temporary CA verifies api.typesafe.ai; --noproxy *",
    "response": "intentional local HTTP 429; no TypeSafe or model call; no real credentials/customer data",
    "quota": "sentinel only, never invoked"
  },
  "scenarios": [
    {
      "name": "canonical-multiple-regions",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "canonical-multiple-regions/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "dispatch-resolve:\n  status: error\n  reason: http 429 after 3 ms\n  timings: api_ms=3 quota_ms=null local_ms=201 total_ms=204\n  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null\n",
      "stderr": "dispatch-resolve: error (http 429 after 3 ms)\n",
      "requests": [
        {
          "path": "/v1/systemone",
          "body": {
            "model": "jev-latest",
            "state": {
              "task": {
                "project": "synthetic-pager",
                "brief": "## Captain's intent\nRepair the public pager.\nPreserve the public pagination behavior.\n\n## Firstmate spec\nUse the existing public pager.\n"
              }
            },
            "questions": {
              "rule": {
                "type": "choice",
                "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
                "criteria": {
                  "rule_1": "A synthetic public pagination repair.",
                  "default": "No listed rule applies to this task."
                }
              }
            }
          },
          "host": "api.typesafe.ai"
        }
      ],
      "curl_invocations": 1,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "# dispatch-never-send marked-sections\nSYNTHETIC-SECRET-4417\n",
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n<!-- dispatch-never-send:start -->\n### SYNTHETIC-PRIVATE-HEADING\nSYNTHETIC-SECRET-4417\n# Private heading must not truncate public intent\n<!-- dispatch-never-send:end -->\nPreserve the public pagination behavior.\n## Firstmate spec\n<!-- dispatch-never-send:start -->\nSYNTHETIC-SECRET-SECOND\n<!-- dispatch-never-send:end -->\nUse the existing public pager.\n# Setup\nSynthetic boilerplate is not task text.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "whole-brief-sanitized-fallback",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "whole-brief-sanitized-fallback/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "dispatch-resolve:\n  status: error\n  reason: http 429 after 2 ms\n  timings: api_ms=2 quota_ms=null local_ms=124 total_ms=126\n  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null\n",
      "stderr": "dispatch-resolve: error (http 429 after 2 ms)\n",
      "requests": [
        {
          "path": "/v1/systemone",
          "body": {
            "model": "jev-latest",
            "state": {
              "task": {
                "project": "synthetic-pager",
                "brief": "Public task before.\nPublic task after.\n"
              }
            },
            "questions": {
              "rule": {
                "type": "choice",
                "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
                "criteria": {
                  "rule_1": "A synthetic public pagination repair.",
                  "default": "No listed rule applies to this task."
                }
              }
            }
          },
          "host": "api.typesafe.ai"
        }
      ],
      "curl_invocations": 1,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "# dispatch-never-send marked-sections\n",
      "fixture_brief": "Public task before.\n   <!-- dispatch-never-send:start -->\n# Task\n## Captain's intent\nSYNTHETIC-SECRET-HIDDEN-TASK\n   <!-- dispatch-never-send:end -->\nPublic task after.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "markers-inside-code-fence",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "markers-inside-code-fence/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "dispatch-resolve:\n  status: error\n  reason: http 429 after 2 ms\n  timings: api_ms=2 quota_ms=null local_ms=135 total_ms=137\n  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null\n",
      "stderr": "dispatch-resolve: error (http 429 after 2 ms)\n",
      "requests": [
        {
          "path": "/v1/systemone",
          "body": {
            "model": "jev-latest",
            "state": {
              "task": {
                "project": "synthetic-pager",
                "brief": "Public fenced example:\n`` `\npublic code\n`` `\n"
              }
            },
            "questions": {
              "rule": {
                "type": "choice",
                "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
                "criteria": {
                  "rule_1": "A synthetic public pagination repair.",
                  "default": "No listed rule applies to this task."
                }
              }
            }
          },
          "host": "api.typesafe.ai"
        }
      ],
      "curl_invocations": 1,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "# dispatch-never-send marked-sections\n",
      "fixture_brief": "Public fenced example:\n`` `\n<!-- dispatch-never-send:start -->\nSYNTHETIC-SECRET-FENCED\n<!-- dispatch-never-send:end -->\npublic code\n`` `\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "unmarked-without-list",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "unmarked-without-list/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "dispatch-resolve:\n  status: error\n  reason: http 429 after 2 ms\n  timings: api_ms=2 quota_ms=null local_ms=145 total_ms=147\n  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null\n",
      "stderr": "dispatch-resolve: error (http 429 after 2 ms)\n",
      "requests": [
        {
          "path": "/v1/systemone",
          "body": {
            "model": "jev-latest",
            "state": {
              "task": {
                "project": "synthetic-pager",
                "brief": "## Captain's intent\nRepair the public pager.\n\n## Firstmate spec\nUse the existing public pager.\n"
              }
            },
            "questions": {
              "rule": {
                "type": "choice",
                "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
                "criteria": {
                  "rule_1": "A synthetic public pagination repair.",
                  "default": "No listed rule applies to this task."
                }
      

... [25293 bytes truncated] ...

ed": true,
      "policy": "synthetic-private-project\n",
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n## Firstmate spec\nUse the existing public pager.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "literal-rule-criterion",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "literal-rule-criterion/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919MDG8TG6XBJAT3EP8DN9/.privacy-validation-g4enrvjj/literal-rule-criterion/config/dispatch-never-send line 1; nothing sent)\n",
      "requests": [],
      "curl_invocations": 0,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "public pagination repair\n",
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n## Firstmate spec\nUse the existing public pager.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "literal-fixed-question",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "literal-fixed-question/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (brief text matches ~/.no-mistakes/worktrees/32d18ed9638d/01M4919MDG8TG6XBJAT3EP8DN9/.privacy-validation-g4enrvjj/literal-fixed-question/config/dispatch-never-send line 1; nothing sent)\n",
      "requests": [],
      "curl_invocations": 0,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "Which ONE dispatch rule\n",
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n## Firstmate spec\nUse the existing public pager.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "unrelated-literal-preserves-request",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "unrelated-literal-preserves-request/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "dispatch-resolve:\n  status: error\n  reason: http 429 after 18 ms\n  timings: api_ms=18 quota_ms=null local_ms=260 total_ms=278\n  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null\n",
      "stderr": "dispatch-resolve: error (http 429 after 18 ms)\n",
      "requests": [
        {
          "path": "/v1/systemone",
          "body": {
            "model": "jev-latest",
            "state": {
              "task": {
                "project": "synthetic-pager",
                "brief": "## Captain's intent\nRepair the public pager.\n\n## Firstmate spec\nUse the existing public pager.\n"
              }
            },
            "questions": {
              "rule": {
                "type": "choice",
                "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
                "criteria": {
                  "rule_1": "A synthetic public pagination repair.",
                  "default": "No listed rule applies to this task."
                }
              }
            }
          },
          "host": "api.typesafe.ai"
        }
      ],
      "curl_invocations": 1,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "# Ordinary comment\nUnrelated synthetic literal\n",
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n## Firstmate spec\nUse the existing public pager.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "policy-directory-refused",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "policy-directory-refused/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (~/.no-mistakes/worktrees/32d18ed9638d/01M4919MDG8TG6XBJAT3EP8DN9/.privacy-validation-g4enrvjj/policy-directory-refused/config/dispatch-never-send is not a readable regular file; nothing sent)\n",
      "requests": [],
      "curl_invocations": 0,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": null,
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n## Firstmate spec\nUse the existing public pager.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "policy-broken-symlink-refused",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "policy-broken-symlink-refused/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "",
      "stderr": "dispatch-resolve: off (~/.no-mistakes/worktrees/32d18ed9638d/01M4919MDG8TG6XBJAT3EP8DN9/.privacy-validation-g4enrvjj/policy-broken-symlink-refused/config/dispatch-never-send is not a readable regular file; nothing sent)\n",
      "requests": [],
      "curl_invocations": 0,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": null,
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n## Firstmate spec\nUse the existing public pager.\n",
      "errors": [],
      "result": "pass"
    },
    {
      "name": "inherited-section-policy",
      "argv": [
        "/bin/bash",
        "bin/fm-dispatch-resolve.sh",
        "inherited-section-policy/brief.md",
        "--project",
        "synthetic-pager"
      ],
      "exit": 0,
      "stdout": "dispatch-resolve:\n  status: error\n  reason: http 429 after 2 ms\n  timings: api_ms=2 quota_ms=null local_ms=158 total_ms=160\n  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null\n",
      "stderr": "dispatch-resolve: error (http 429 after 2 ms)\n",
      "requests": [
        {
          "path": "/v1/systemone",
          "body": {
            "model": "jev-latest",
            "state": {
              "task": {
                "project": "synthetic-pager",
                "brief": "## Captain's intent\nRepair the public pager.\nPreserve the public pagination behavior.\n\n## Firstmate spec\nUse the existing public pager.\n"
              }
            },
            "questions": {
              "rule": {
                "type": "choice",
                "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
                "criteria": {
                  "rule_1": "A synthetic public pagination repair.",
                  "default": "No listed rule applies to this task."
                }
              }
            }
          },
          "host": "api.typesafe.ai"
        }
      ],
      "curl_invocations": 1,
      "quota_invocations": 0,
      "local_brief_unchanged": true,
      "policy": "# dispatch-never-send marked-sections\nSYNTHETIC-SECRET-4417\n",
      "fixture_brief": "# Task\n## Captain's intent\nRepair the public pager.\n<!-- dispatch-never-send:start -->\n### SYNTHETIC-PRIVATE-HEADING\nSYNTHETIC-SECRET-4417\n# Private heading must not truncate public intent\n<!-- dispatch-never-send:end -->\nPreserve the public pagination behavior.\n## Firstmate spec\n<!-- dispatch-never-send:start -->\nSYNTHETIC-SECRET-SECOND\n<!-- dispatch-never-send:end -->\nUse the existing public pager.\n# Setup\nSynthetic boilerplate is not task text.\n",
      "errors": [],
      "result": "pass"
    }
  ],
  "inheritance_command": [
    "/bin/bash",
    "-c",
    ". \"$1\" && propagate_inheritable_config \"$2\" \"$3\"",
    "_",
    "bin/fm-config-inherit-lib.sh",
    "isolated-parent/config",
    "isolated-child/config"
  ]
}

• Evidence: Live resolver CLI and HTTPS payload transcript

Evidence: Actual child-home inherited-policy execution

Source: Actual child-home inherited-policy execution

$ /bin/bash -c '. "$1" && propagate_inheritable_config "$2" "$3"' _ bin/fm-config-inherit-lib.sh <isolated-parent>/config <isolated-child>/config

$ FM_HOME=<isolated-child> /bin/bash bin/fm-dispatch-resolve.sh <isolated-child>/brief.md --project synthetic-pager
dispatch-resolve:
  status: error
  reason: http 429 after 4 ms
  timings: api_ms=4 quota_ms=null local_ms=259 total_ms=263
  usage: input_tokens=null output_tokens=null jev_cost_usd=null jev_input_usd_per_million=0.042 returned_model=null
dispatch-resolve: error (http 429 after 4 ms)

Actual captured HTTPS request from child home:
{
  "path": "/v1/systemone",
  "body": {
    "model": "jev-latest",
    "state": {
      "task": {
        "project": "synthetic-pager",
        "brief": "## Captain's intent\nRepair the public pager.\nPreserve the public pagination behavior.\n\n## Firstmate spec\nUse the existing public pager.\n"
      }
    },
    "questions": {
      "rule": {
        "type": "choice",
        "instructions": "Which ONE dispatch rule best fits `task` (read `task.brief` and `task.project`)? Each option is the rule's own matching condition; pick `default` when no rule's condition is met, including when a rule's own exemption text excludes this task.",
        "criteria": {
          "rule_1": "A synthetic public pagination repair.",
          "default": "No listed rule applies to this task."
        }
      }
    }
  },
  "host": "api.typesafe.ai"
}
Local child brief unchanged.

Evidence: Emitted brief-author help

Source: Emitted brief-author help

$ /bin/bash bin/fm-brief.sh --help
Scaffold a crewmate brief or persistent secondmate charter at
data/<task-id>/brief.md under the active firstmate home.
For ordinary tasks, the standard Setup/Rules/Definition-of-done contract is
filled in. Ship and scout `# Task` sections have two subsections Firstmate
fills before dispatch: `{TASK}` under `## Captain's intent` (the captain's
own ask plus the context needed to read it, including the substance of any
report, decision, or PR the ask refers to, without added speaker labels or
direct address) and `{FIRSTMATE_SPEC}`
under `## Firstmate spec` (build instructions, which are never the captain's
intent). bin/fm-dod-lib.sh owns the no-mistakes `--intent` contract those
subsections feed; bin/fm-spawn.sh refuses leftover placeholders and a
`## Captain's intent` line opening with a Captain label or address. Secondmate
charters still use a single `{TASK}` charter fill. Firstmate may adjust other
sections when the task genuinely deviates (e.g. working an existing external
PR instead of shipping a new one).
Jev privacy markers: to keep project- or customer-sensitive brief text out of
bin/fm-dispatch-resolve.sh requests, wrap it in these exact standalone lines:
  <!-- dispatch-never-send:start -->
  <!-- dispatch-never-send:end -->
They need the exact opt-in line `# dispatch-never-send marked-sections` in
config/dispatch-never-send. Missing opt-in or malformed markers with the
reserved `dispatch-never-send` prefix stop the request; arbitrary spelling
mistakes are not detected. The local brief and the worker's instructions
keep the marked text; docs/configuration.md "Never-send list" owns the full
contract.
Usage: fm-brief.sh <task-id> <repo-name> --mode <no-mistakes|direct-PR|local-only> [--branch-prefix <prefix>] [--forge <none|gerrit> [--shape squash]] [--herdr-lab]
       fm-brief.sh <task-id> <repo-name> --scout [--herdr-lab]
       fm-brief.sh <task-id> --secondmate {<project>...|--no-projects}
  --scout writes the scout contract instead: the deliverable is a report at
  data/<task-id>/report.md (no branch, no push, no PR) and the worktree is scratch.
  It offers the Lavish review loop only when `fm-bootstrap.sh lavish-compatible`
  confirms the supported lavish-axi floor; otherwise it asks for a text report.
  --secondmate writes a persistent secondmate charter. The project list
  is cloned into the secondmate home, while the natural-language scope
  tells the main firstmate when to route work there; routine churn stays in its own home;
  captain-relevant escalations and marked from-firstmate replies append to this
  home's status file.
  --no-projects writes a project-less charter for a domain whose subject is the
  firstmate repo itself (its home is a firstmate worktree, its crews take pooled
  worktrees of the same repo). It is mutually exclusive with a project list, and
  omitting both still fails loudly so an accidental omission is never silent.
  Set FM_SECONDMATE_CHARTER='<charter>' to fill the charter text.
  Set FM_SECONDMATE_SCOPE='<scope>' to write a routing scope distinct from the charter text.
  --herdr-lab is mandatory when the task will issue Herdr lifecycle commands.
  It adds the hard isolation contract backed by bin/fm-herdr-lab.sh.
  The flag must be explicit because {TASK} and {FIRSTMATE_SPEC} are filled
  after scaffolding and the caller-supplied repo string cannot reliably
  identify this repo. Briefs made without it carry a loud declaration so an
  omitted contract cannot be silent.
For ship tasks, --mode is REQUIRED and shapes the definition of done. Firstmate
resolves it per task at intake (AGENTS.md section 7); data/projects.md holds the
captain's standing posture as context, and this script never reads it:
  no-mistakes  implement -> /no-mistakes pipeline -> PR -> configured merge authority
  direct-PR    implement -> push + open PR via gh-axi (no pipeline) -> configured merge authority
  local-only   implement on branch, stop and report "ready in branch" (no push/PR);
               the configured merge authority approves, firstmate merges to local main
no-mistakes-prod-only is a registry policy, not a task mode; resolve it to one of
the three concrete modes at intake before calling this script.
--branch-prefix <prefix> optionally overrides the ship branch's "fm/" prefix, so
the resolved branch is "<prefix><task-id>" instead of the default "fm/<task-id>".
Pass an empty prefix ("--branch-prefix ''") for a bare "<task-id>" branch, or a
conventional prefix such as "fix/" - useful for a third-party project that does
not use this tooling and should not see an "fm/"-branded branch or PR. Defaults
to "fm/" when omitted, so every existing installation's branch names are
unchanged. Like --mode, this script never reads data/projects.md for it: the
registry's optional "branch=<prefix>" annotation (bin/fm-project-mode.sh's
header owns that format and its --branch-prefix query) is the captain's
standing per-project preference, and firstmate resolves it per task at intake
and passes the explicit flag. Refused on --scout and --secondmate: a scout
makes no branch and a charter is not a delivery contract.
--forge names the project's forge, defaults to none, and is orthogonal to --mode
exactly as the registry's `forge=` token is. It is the captain's confirmed
registry binding, read from data/projects.md at intake and passed here; this
script never infers a forge and never looks the binding up, and bin/fm-spawn.sh
refuses a brief whose forge disagrees with the registry. bin/fm-project-mode.sh's
header owns what the binding means, and bin/fm-dod-lib.sh owns what `gerrit`
changes for the worker. A forge on --mode local-only is refused, because that
mode publishes nothing.
--shape names how a forge=gerrit task is published, and only `squash` - one
change - is accepted: `stack` is refused until a stack can be watched by its
membership pinned when its watch is armed, because the merge watch follows one
change.
It defaults to squash on gerrit and is refused without it.
The generated ship brief records the chosen mode as a fixed machine-readable
"Delivery contract: mode=<mode>" line, followed by " forge=gerrit shape=squash"
on that forge. bin/fm-spawn.sh reads that line and refuses to launch a ship task
whose explicit --mode or registered forge disagrees, so an adjusted brief and the
recorded task metadata cannot drift apart.
Ship briefs begin with a worktree-isolation assertion before the branch step.
Both crewmate scaffolds carry one shared rule against administering the
infrastructure every lane shares - the no-mistakes daemon and the worktree pool
their own slot came from - so ship and scout cannot drift apart. A secondmate
charter omits it: that home allocates and returns slots for its own crewmates.
--mode, --forge, and --shape are refused on scout and secondmate scaffolds: a
scout's deliverable is a report rather than a merge, and a charter is not a
delivery contract.
There is no --yolo flag here. The worker never owns merge decisions, so yolo is
a spawn-time and firstmate-side input only (AGENTS.md section 7).
Every scaffold's status protocol distinguishes the configured
declared-external-wait verb (FM_CLASSIFY_PAUSED_VERB, default "paused") from
"blocked:": pause for a known wait expected to clear on its own, including
the worker's own background work, pipeline or long command; blocked when
firstmate must act. The first-sight alert remains; repeats use the long cadence.
Emission-time syntax and legacy unknown-time handling are owned by
bin/fm-classify-lib.sh; each scaffold renders the stamp as a literal <epoch>
placeholder the worker replaces with a numeric Unix time as it appends, so a
scaffold never emits a substitution a file-write tool would copy through.
Every scaffold also carries the steering-inbox receive-and-ack section:
process state/<id>.inbox/*.msg in order and acknowledge each by moving it to
handled/ (record, doorbell, and ladder owned by bin/fm-task-inbox-lib.sh).
Ship tasks include a project-memory section bounding crewmate edits to a
project's AGENTS.md/CLAUDE.md: only corrections of factually wrong
information, including wrong information the task itself introduced - never
additions of missing knowledge. A correction edits only the wrong text and
never runs fm-ensure-agents-md.sh, whose inserted sections and created
pointer file are themselves additions.
Scaffolds carry no role scope: fm-spawn.sh supplies fm_brief_worker_role from
fm-dod-lib.sh to every ship/scout launch brief, so this file never becomes a
second owner of a contract that must stay current across relaunches.
A home may carry standing worker instructions without editing this tracked
script: when config/brief-include.md exists under the active home, ship and
scout scaffolds append its text verbatim as their last section, "# Home brief
additions", which defers to every other section of the brief. It goes last
because the machine-read `# Task` heading resolves to its first match, so
appended text can never shadow it; a later scout promotion appends its ship
contract below it, which that position-free deference already covers. An
absent or blank file changes nothing; a present path that is not a readable
regular file, or text carrying its own "Delivery contract: mode=" line (which
a later scout promotion could not outrank), stops the scaffold before
anything is written. Secondmate charters never take it.
Refuses to overwrite an existing brief.

Evidence: Targeted resolver behavioral tests

Source: Targeted resolver behavioral tests

$ /bin/bash tests/fm-dispatch-resolve.test.sh
ok - absent key is off: one stderr line, exit 0, no network call
ok - TYPESAFE_API_KEY= in .env activates the tool; environment and config overrides work
ok - clear: one rule Choice request, key on the fd header only, spendPriority argmax over every candidate
ok - stock Bash resolver separates API, quota, local and total timing, with input-only Jev cost
ok - stock Bash timing uses the host epoch clock at millisecond precision
skip: bash on PATH has no EPOCHREALTIME
ok - missing curl transfer time is reported as unknown
ok - unavailable usage is unknown and a failed quota snapshot retains API cost
ok - quota-error model evidence accepts only safe Jev version ids
ok - successful resolution model evidence accepts only safe Jev version ids
ok - error diagnostics omit sensitive API bodies without blocking intake
ok - never-send list withholds the request on a match or a bad list, and never prints the value
ok - opt-in marked sections protect outgoing bodies and markers never send without the exact opt-in
ok - rules snapshots and shell quoting preserve the profile protocol
ok - no-rule fallback, Agy, Gemini, and documented configurations resolve
ok - ambiguous: confidence below the fixed floor hands the decision back
ok - per-rule confidence floors fall to the most probable runner-up that clears its own floor
ok - only the brief's task sections and scout tag reach the model, with a whole-brief fallback
ok - escalate: a rule declared approval: captain never yields a profile
ok - rule floor: known shortfall falls through while unavailable evidence escalates
ok - declared provider and profile floor evidence are applied in code
ok - nonnumeric spendPriority evidence is never ranked
ok - partial and missing quota evidence remain eligible but unranked
ok - provider-wide and exact quota rows combine into one limiting candidate
ok - default: no rule matched resolves among the default profiles
ok - tie: equal spendPriority never breaks by array order
ok - no rankable candidate: the tool escalates instead of guessing
ok - native Codex binds to codex-home before default, independently of Pi accounts and row order
ok - Pi native adapters bind to codex-home with existing fallbacks and schema 5 compatibility
ok - schema 6: each candidate binds to its account row; schema 5 is unchanged
ok - task-horizon runway, pooled-account, OpenRouter coverage, and minimum-version guards
ok - quota evidence comes from one quota-axi --json read, and its failure is an error outcome
ok - API, transport, and response failures are error outcomes with exit 0
ok - configuration errors exit 2 before any network call
# all fm-dispatch-resolve tests passed

exit: 0

• Evidence: Initial brief test setup failure

Evidence: Temporary-path failure diagnosis

Source: Temporary-path failure diagnosis

$ ['/bin/bash', 'bin/fm-brief.sh', 'brief-branch-safe-g3', 'some-proj', '--mode', 'local-only', '--branch-prefix', '$(touch${IFS}~/.no-mistakes/worktrees/32d18ed9638d/01M4919MDG8TG6XBJAT3EP8DN9/.privacy-validation-g4enrvjj/tmp/branch-prefix-shell-safe-marker)']
exit: 1
error: --branch-prefix and task id must form a valid git branch (got '$(touch${IFS}~/.no-mistakes/worktrees/32d18ed9638d/01M4919MDG8TG6XBJAT3EP8DN9/.privacy-validation-g4enrvjj/tmp/branch-prefix-shell-safe-marker)brief-branch-safe-g3')

Test TMPDIR was inside .no-mistakes and .privacy-validation path components; Git ref-format forbids dot-leading components. Rerun uses ordinary /tmp for incidental toolchain temp files (per allowed boundary).

• Evidence: Passing brief tests with normal temporary directory

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 12 of 12 scenarios driven live against the product

Scenario	Result	Live	Evidence
Enable marked sections and send only public task text across multiple protected regions	✅ pass	live	Live resolver payloads: canonical-multiple-regions
Remove protected task headings before whole-brief fallback	✅ pass	live	Live resolver payloads: whole-brief-sanitized-fallback
Withhold marked text inside Markdown code fences	✅ pass	live	Live resolver payloads: markers-inside-code-fence
Use supported surrounding and inter-token whitespace	✅ pass	live	Live resolver payloads: whitespace-policy-and-markers
Submit intended markers without enabling section protection	✅ pass	live	Live resolver transcript: no-list-markers, literal-only-markers, no-list-unspaced-markers
Try malformed, nested, unmatched, inline, and differently spelled reserved markers	✅ pass	live	Live resolver transcript: malformed-marker-*
Try malformed privacy directives and the removed whole-project directive	✅ pass	live	Live resolver transcript: invalid-directive-*
Keep literal withholding effective across all remaining request strings	✅ pass	live	Live resolver transcript: literal-after-section-stripping, literal-case-and-whitespace, literal-unicode-whitespace, literal-project-name, literal-rule-criterion, literal-fixed-question
Send unmarked briefs normally without requiring a project name	✅ pass	live	Live resolver payloads: unmarked-without-list, enabled-unmarked-without-project, unrelated-literal-preserves-request
Refuse an invalid never-send policy path	✅ pass	live	Live resolver transcript: policy-directory-refused, policy-broken-symlink-refused
Propagate section protection into a child home and resolve there	✅ pass	live	Actual child-home inherited-policy execution
Read brief-author guidance through the actual CLI help	✅ pass	live	Emitted brief-author help

• /bin/bash bin/fm-dispatch-resolve.sh <synthetic-brief> [--project synthetic-pager] with isolated FM_HOME configurations, covering section stripping, extraction and fallback, missing opt-in, malformed markers/directives, literals, and invalid policy paths.
• Executed real curl with --noproxy '*' --connect-to api.typesafe.ai:443:127.0.0.1:<private-port> --cacert <temporary-certificate>; captured actual HTTPS request bodies and verified withheld requests invoked neither curl nor quota-axi.
• /bin/bash -c '. "$1" && propagate_inheritable_config "$2" "$3"' _ bin/fm-config-inherit-lib.sh <isolated-parent>/config <isolated-child>/config, followed by real resolver execution using the propagated child home.
• /bin/bash bin/fm-brief.sh --help and verification of its emitted canonical markers, required opt-in, and local-text retention guidance.
• /bin/bash tests/fm-dispatch-resolve.test.sh — passed.
• /bin/bash tests/fm-brief.test.sh — initially failed because the worktree-local TMPDIR introduced dot-leading components into a synthetic Git branch; diagnosed through the public brief CLI, then passed with TMPDIR=/tmp.
• Stopped the private HTTPS receivers and removed disposable worktree fixtures.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.