fix: scope open-work ledger to home-owned obligations by MrGTV-love · Pull Request #56 · MrGTV-love/firstmate

MrGTV-love · 2026-10-08T14:07:22Z

Intent

I would like all bugs to be fixed so tomorrow can be focused entirely to Vernant and not problems preventning Vernant from getting built.

Context: the open-work ledger from PR #45 (state/open-loops.json, check: open-loop-ledger) woke every Vernant lane on 2026-10-08 to route dozens of rows it does not own, which cost lane time on the night meant to clear blockers to Vernant. Evidence is in the backlog item note for fm-open-loops-lane-scope.

What Changed

Restrict PR obligations and check fetching to exact URLs recorded in the home's tasks or backlog, or matching task head repositories and branches; secondmate homes no longer discover repositories from shared clones or their own checkout.
Keep unselected ready backlog items visible as informational, never-overdue rows; only items with task metadata or status logs remain dispatch obligations.
Honor recorded worker stops without reporting false missing-worker or coverage failures, while preserving active-state precedence, generation-invalidated snapshot diagnostics, and unlanded-commit reporting. Update ledger documentation and regression coverage for these behaviors.

Risk Assessment

✅ Low: The changes are bounded, preserve case-sensitive branch and exact-URL ownership, retain generation-invalidated coverage failures, and introduce no substantiated material defects or unnecessary components.

Testing

Both focused test files passed, and seven live scenarios passed through the real ledger, snapshot, watcher, wake-drain, and Bearings interfaces using disposable workspace-local homes and read-only public GitHub data. Evidence includes published ledgers, forge request traces, watcher output, Bearings output, and generation-race transitions; setup issues were corrected before final observations, and all fixtures were removed.

Live validation: ✅ go - 7 of 7 scenarios driven live against the product

Scenario	Result	Live	Evidence
A lane scans its task repository without adopting unrelated fork PRs or shared-project obligations	✅ pass	live	foreign-fork-exclusion.json, invalid-lane-marker-main-discovery.json, and unowned-pr-watcher-proof.json
A home routes exact task- and backlog-owned PRs, including failing checks	✅ pass	live	recorded-url-ownership.json, owned-task-red-check.json, main-home-owned-prs.json, and exact-recorded-url-boundary.json
Branch ownership ignores repository casing but preserves branch casing and source-repository identity	✅ pass	live	case-insensitive-head-repository.json, case-sensitive-branch-exclusion.json, and foreign-fork-exclusion.json
Old queued backlog stays informational until dispatch begins, then appears in watcher and Bearings obligations	✅ pass	live	queue-dispatch-ledger.json, metadata-dispatch-selection.json, watcher-dispatch-proof.json, and bearings-dispatch-proof.json
Done and paused workers do not require recovery, but resumed and silently lost workers do	✅ pass	live	stopped-workers-snapshot.json, stopped-workers-ledger.json, only-stopped-ledger.json, and custom-pause-ledger.json
A stopped ship still reports an unpublished local commit	✅ pass	live	stopped-unlanded-ledger.json
A task generation change keeps coverage incomplete despite a live stop declaration	✅ pass	live	generation-race-transitions.json and generation-done-ledger.json, generation-paused-ledger.json, generation-unrelated-resolution-ledger.json

Evidence: Live validation evidence index and isolation details

Source: Live validation evidence index and isolation details

{
  "isolation": "All disposable homes, Git repositories, metadata, status streams and request tracing lived under the worktree. GitHub calls were read-only public API requests through the installed gh-axi; the tracer delegates with exec and does not alter responses. No harness, Herdr, default tmux server, production fleet home, or pipeline lifecycle was driven.",
  "backlog": {
    "ledger": "queue-dispatch-ledger.json",
    "metadata_selection": "metadata-dispatch-selection.json",
    "watcher": "watcher-dispatch-proof.json",
    "bearings": "bearings-dispatch-proof.json"
  },
  "ownership": {
    "foreign_fork": "foreign-fork-exclusion.json",
    "backlog_url": "recorded-url-ownership.json",
    "repository_casing": "case-insensitive-head-repository.json",
    "branch_casing": "case-sensitive-branch-exclusion.json",
    "exact_url": "exact-recorded-url-boundary.json",
    "task_red_check": "owned-task-red-check.json",
    "main_home": "main-home-owned-prs.json",
    "lane_marker": "invalid-lane-marker-main-discovery.json",
    "watcher": "unowned-pr-watcher-proof.json"
  },
  "worker_stops": {
    "mixed": "stopped-workers-ledger.json",
    "stopped_only": "only-stopped-ledger.json",
    "configured_pause": "custom-pause-ledger.json",
    "unpublished_work": "stopped-unlanded-ledger.json"
  },
  "generation_race": "generation-race-transitions.json",
  "setup_adjustments": "The initial absent tmux socket used an overlong absolute Unix-socket pathname; switching to a worktree-relative private absent socket corrected endpoint observation. A ship fixture initially omitted its worktree metadata field; supplying the public field exposed its unpublished commit. Initial done/paused status events correctly produced unrelated completion/signal wakes; a fresh paused fixture and real fm-wake-drain acknowledgment isolated the subsequent no-ledger-wake observation."
}

Evidence: Foreign-fork exclusion and absence of check requests

Source: Foreign-fork exclusion and absence of check requests

{
  "ledger": {
    "schema": "fm-open-loops.v1",
    "generated_epoch": 1791467301,
    "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/pr-lane",
    "complete": true,
    "rows": []
  },
  "requests": [
    [
      "api",
      "/repos/jqlang/jq/pulls?state=open&per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ]
  ]
}

Evidence: Case-insensitive head repository ownership

Source: Case-insensitive head repository ownership

{
  "ledger": {
    "schema": "fm-open-loops.v1",
    "generated_epoch": 1791467343,
    "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/pr-lane",
    "complete": true,
    "rows": [
      {
        "id": "8ea6deed268ed7e578d08f82",
        "category": "open_pr",
        "subject": "https://github.com/jqlang/jq/pull/3657",
        "owner": "firstmate",
        "next_action": "route the green PR's review and obtain merge approval",
        "age_seconds": 6124,
        "limit_seconds": 3600,
        "overdue": true,
        "evidence": ""
      },
      {
        "id": "8caf70d63a676915c989b21c",
        "category": "open_pr",
        "subject": "https://github.com/jqlang/jq/pull/3660",
        "owner": "firstmate",
        "next_action": "route the green PR's review and obtain merge approval",
        "age_seconds": 19136,
        "limit_seconds": 3600,
        "overdue": true,
        "evidence": ""
      }
    ]
  },
  "requests": [
    [
      "api",
      "/repos/ITCHYNY/JQ/pulls?state=open&per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/pulls?state=open&per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/4aa57a47238b83684560deaaff0630f52b36fdce/check-runs?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/4aa57a47238b83684560deaaff0630f52b36fdce/statuses?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/7e24fba345cf1e6f464483c308014a38b02c0d42/check-runs?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/7e24fba345cf1e6f464483c308014a38b02c0d42/statuses?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ]
  ]
}

Evidence: Owned task failing checks retain diagnosis obligation

Source: Owned task failing checks retain diagnosis obligation

{
  "ledger": {
    "schema": "fm-open-loops.v1",
    "generated_epoch": 1791467416,
    "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/pr-lane",
    "complete": true,
    "rows": [
      {
        "id": "8caf70d63a676915c989b21c",
        "category": "open_pr",
        "subject": "https://github.com/jqlang/jq/pull/3660",
        "owner": "firstmate",
        "next_action": "route the green PR's review and obtain merge approval",
        "age_seconds": 19209,
        "limit_seconds": 3600,
        "overdue": true,
        "evidence": ""
      },
      {
        "id": "9ed41cc7481c7460f5cb432c",
        "category": "red_check",
        "subject": "https://github.com/jqlang/jq/pull/3552",
        "owner": "worker:fork-branch",
        "next_action": "diagnose: code or test",
        "age_seconds": 153042,
        "limit_seconds": 0,
        "overdue": true,
        "evidence": "macos (amd64); macos (arm64)"
      }
    ]
  },
  "requests": [
    [
      "api",
      "/repos/ITCHYNY/JQ/pulls?state=open&per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/pulls?state=open&per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/4aa57a47238b83684560deaaff0630f52b36fdce/check-runs?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/4aa57a47238b83684560deaaff0630f52b36fdce/statuses?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/b8bdf4522c7bba2706d41348dbe0ea8b2d0cea51/check-runs?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ],
    [
      "api",
      "/repos/jqlang/jq/commits/b8bdf4522c7bba2706d41348dbe0ea8b2d0cea51/statuses?per_page=100",
      "--paginate",
      "--jq",
      "@base64",
      "--full"
    ]
  ]
}

Evidence: Unowned PR lane produces no ledger wake

Source: Unowned PR lane produces no ledger wake

{
  "real_public_forge": true,
  "ledger": {
    "schema": "fm-open-loops.v1",
    "generated_epoch": 1791467525,
    "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/unowned-watch-lane",
    "complete": true,
    "rows": [
      {
        "id": "a1e50b11ca7bc8d3f147db99",
        "category": "ready_not_started",
        "subject": "idle-ready",
        "owner": "firstmate",
        "next_action": "informational: queued and not selected for dispatch",
        "age_seconds": 844782725,
        "limit_seconds": 1800,
        "overdue": false,
        "evidence": "",
        "informational": true
      }
    ]
  },
  "initial_signal_output": "1791467532\t2\tsignal\tforeign-branch.status\tsignal: ~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/unowned-watch-lane/state/foreign-branch.status\nwake annotation: latest wake-EVENT observed at drain, not current state: foreign-branch.status: paused: waiting for independent CI\n",
  "ack_command": "bin/fm-wake-drain.sh --ack-through 2 --recovery-generation 35939.1791467532.FgpuFK",
  "watcher_running_after_seconds": 6,
  "wake_queue": "",
  "stdout": "",
  "stderr": ""
}

Evidence: Unselected backlog stays quiet while selected work wakes

Source: Unselected backlog stays quiet while selected work wakes

{
  "quiet_watcher_running_after_seconds": 6,
  "quiet_queue": "",
  "quiet_stdout": "",
  "quiet_stderr": "",
  "selected_exit": 0,
  "selected_stdout": "check: open-loop-ledger (1 overdue assigned obligations; read state/open-loops.json)\n",
  "selected_stderr": "",
  "selected_queue": "1791467198\t1\tcheck\topen-loop-ledger\tcheck: open-loop-ledger (1 overdue assigned obligations; read state/open-loops.json)\n"
}

Evidence: Bearings exposes selected overdue work only

Source: Bearings exposes selected overdue work only

{
  "schema": "fm-bearings.v1",
  "home": ".live-ledger-c1vtiqpg/queue-lane",
  "generated": "2026-10-08T13:46:39Z",
  "prs": "not_requested (run: /bearings include PRs)",
  "contributions": {
    "scope": "owned contributions per home",
    "known": 0,
    "checked": 0,
    "counts": {
      "captain": 0,
      "fleet": 0,
      "maintainer": 0,
      "nobody": 0
    },
    "complete": true,
    "proven_clear": true,
    "unmeasured_homes": 0,
    "unreadable_records": 0,
    "unmeasured": 0,
    "stale_verdicts": 0,
    "missing_verdicts": 0,
    "captain_omitted": 0,
    "captain": []
  },
  "in_flight": [],
  "secondmates": [],
  "secondmate_reconcile": [],
  "decisions_open": [],
  "landed": [],
  "gates": [
    {
      "id": "idle-ready",
      "title": "Not selected",
      "blocked_by": "-",
      "reason": "-",
      "owner": "(main)",
      "filed": "2000-01-01"
    },
    {
      "id": "started-ready",
      "title": "Dispatch started",
      "blocked_by": "-",
      "reason": "-",
      "owner": "(main)",
      "filed": "2000-01-01"
    },
    {
      "id": "held-ready",
      "title": "Await decision",
      "blocked_by": "-",
      "reason": "decision",
      "owner": "(main)",
      "filed": "2000-01-01"
    },
    {
      "id": "blocked-ready",
      "title": "Dependency",
      "blocked_by": "idle-ready",
      "reason": "-",
      "owner": "(main)",
      "filed": "2000-01-01"
    },
    {
      "id": "dated-ready",
      "title": "Future",
      "blocked_by": "-",
      "reason": "-",
      "owner": "(main)",
      "filed": "2000-01-01"
    }
  ],
  "reports": [],
  "recorded_prs": [],
  "omitted": [
    {
      "surface": "backlog item bodies",
      "reveal": "--fields bodies"
    },
    {
      "surface": "task paths",
      "reveal": "--fields paths"
    },
    {
      "surface": "watch/steer actions",
      "reveal": "--fields actions"
    },
    {
      "surface": "healthy endpoint detail",
      "reveal": "--fields endpoints"
    },
    {
      "surface": "full scout-report inventory",
      "reveal": "--all-reports"
    },
    {
      "surface": "live PR discovery + checks",
      "reveal": "--include-prs"
    }
  ],
  "open_loops": {
    "generated_epoch": 1791467180,
    "complete": true,
    "rows": [
      {
        "id": "be63a0c32ec18cbb5a1159c1",
        "category": "ready_not_started",
        "subject": "started-ready",
        "owner": "firstmate",
        "next_action": "dispatch the dependency-cleared work",
        "age_seconds": 844782380,
        "evidence": ""
      }
    ]
  }
}

Evidence: Stopped workers versus resumed and silently lost workers

Source: Stopped workers versus resumed and silently lost workers

{
  "schema": "fm-open-loops.v1",
  "generated_epoch": 1791467250,
  "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/stopped-lane",
  "complete": false,
  "rows": [
    {
      "id": "3208e695d4f14bb7bcd960cf",
      "category": "coverage",
      "subject": "ledger degraded",
      "owner": "firstmate",
      "next_action": "restore the unreadable sources and rerun the reconciler",
      "age_seconds": null,
      "limit_seconds": 0,
      "overdue": true,
      "evidence": "worker current state blocked-again: worktree gone (torn down?); worker current state resumed: worktree gone (torn down?); worker current state silent-loss: worktree gone (torn down?)"
    },
    {
      "id": "9b925f2bfc03e2d6facb0d0b",
      "category": "missing_worker",
      "subject": "blocked-again",
      "owner": "firstmate",
      "next_action": "recover the assigned worker without discarding work",
      "age_seconds": 14,
      "limit_seconds": 600,
      "overdue": false,
      "evidence": ""
    },
    {
      "id": "035a8957f55c7856b531ae02",
      "category": "missing_worker",
      "subject": "resumed",
      "owner": "firstmate",
      "next_action": "recover the assigned worker without discarding work",
      "age_seconds": 14,
      "limit_seconds": 600,
      "overdue": false,
      "evidence": ""
    },
    {
      "id": "7a8b4e047207fcdda68f96c0",
      "category": "missing_worker",
      "subject": "silent-loss",
      "owner": "firstmate",
      "next_action": "recover the assigned worker without discarding work",
      "age_seconds": 14,
      "limit_seconds": 600,
      "overdue": false,
      "evidence": ""
    },
    {
      "id": "b2076736b281bf53623be98c",
      "category": "unanswered_question",
      "subject": "blocked-again:default",
      "owner": "firstmate",
      "next_action": "answer or close this question, or record why it no longer applies",
      "age_seconds": null,
      "limit_seconds": 1800,
      "overdue": true,
      "evidence": "blocked: new blocker"
    }
  ]
}

Evidence: Configured pause survives unrelated resolution

Source: Configured pause survives unrelated resolution

{
  "schema": "fm-open-loops.v1",
  "generated_epoch": 1791467274,
  "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/stopped-lane",
  "complete": false,
  "rows": [
    {
      "id": "3208e695d4f14bb7bcd960cf",
      "category": "coverage",
      "subject": "ledger degraded",
      "owner": "firstmate",
      "next_action": "restore the unreadable sources and rerun the reconciler",
      "age_seconds": null,
      "limit_seconds": 0,
      "overdue": true,
      "evidence": "worker current state custom-resumed: worktree gone (torn down?)"
    },
    {
      "id": "594ba655ca3d34496652e985",
      "category": "missing_worker",
      "subject": "custom-resumed",
      "owner": "firstmate",
      "next_action": "recover the assigned worker without discarding work",
      "age_seconds": 0,
      "limit_seconds": 600,
      "overdue": false,
      "evidence": ""
    }
  ]
}

Evidence: Stopped ship retains unpublished commit obligation

Source: Stopped ship retains unpublished commit obligation

{
  "schema": "fm-open-loops.v1",
  "generated_epoch": 1791467299,
  "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/stopped-ship",
  "complete": true,
  "rows": [
    {
      "id": "22d17635ed0fb1f3e7126ba2",
      "category": "unlanded_commit",
      "subject": "unlanded",
      "owner": "firstmate",
      "next_action": "land this work through its PR, or obtain the captain's drop",
      "age_seconds": 24,
      "limit_seconds": 86400,
      "overdue": false,
      "evidence": "1 commit(s) not on refs/remotes/origin/main; newest: unpublished work"
    }
  ]
}

Evidence: Actual generation races retain coverage and coherent rescans recover

Source: Actual generation races retain coverage and coherent rescans recover

[
  {
    "status": "done",
    "generation_changes": 17,
    "invalidated_coverage": "worker liveness relaunching: worker liveness is inconclusive: unknown; worker current state relaunching: task generation changed during snapshot",
    "stable_ledger": {
      "schema": "fm-open-loops.v1",
      "generated_epoch": 1791467384,
      "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/generation-lane",
      "complete": true,
      "rows": []
    }
  },
  {
    "status": "paused",
    "generation_changes": 22,
    "invalidated_coverage": "worker liveness relaunching: worker liveness is inconclusive: unknown; worker current state relaunching: task generation changed during snapshot",
    "stable_ledger": {
      "schema": "fm-open-loops.v1",
      "generated_epoch": 1791467385,
      "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/generation-lane",
      "complete": true,
      "rows": []
    }
  },
  {
    "status": "unrelated-resolution",
    "generation_changes": 31,
    "invalidated_coverage": "worker liveness relaunching: worker liveness is inconclusive: unknown; worker current state relaunching: task generation changed during snapshot",
    "stable_ledger": {
      "schema": "fm-open-loops.v1",
      "generated_epoch": 1791467386,
      "home": "~/.no-mistakes/worktrees/32d18ed9638d/01M4DSD4R6N2HB2ZR3P1ED6V1G/.live-ledger-c1vtiqpg/generation-lane",
      "complete": true,
      "rows": []
    }
  }
]

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 4 issues found → auto-fixed (3) ✅

🚨 bin/fm_open_loops.py:501 - Branch ownership is matched globally across repositories. For example, a lane has a task in repository A on fm/fix and another task in repository B on fm/other; an unrelated PR in B on fm/fix passes owns_pr(), fetches checks, and produces an actionable open_pr/red_check obligation. Task identifiers and branches are home-local, so another lane can legitimately use the same branch name. This leaves the reported cross-lane wake failure reachable. Qualify branch matching by the task's repository identity at owns_pr(), while retaining exact recorded-URL ownership. Related changed sites: bin/fm_open_loops.py:494 stores unqualified branches; bin/fm_open_loops.py:589 applies the match to every discovered repository; docs/configuration.md:593 documents the overly broad rule.
🚨 bin/fm_open_loops.py:260 - A historical stop event overrides an authoritative non-stopped current state. A worker can append paused while awaiting its validation run, have current_state=working from that active run, and then lose its agent. recorded_stop() still returns true from the historical paused event, suppressing missing_worker and potentially publishing complete:true without a recovery obligation. The existing current-state contract explicitly gives active run/pane evidence precedence over stale status events (bin/fm-crew-state.sh:4-12 and bin/fm-classify-lib.sh:809-811). Make known working/blocked verdicts override historical stop events in this shared predicate. Related changed sites: bin/fm_open_loops.py:270 suppresses the backlog obligation; bin/fm_open_loops.py:299-304 suppresses liveness failures; bin/fm_open_loops.py:307 and :312 suppress current-state degradation and missing-worker rows; docs/configuration.md:599 repeats the unconditional historical-event rule.
⚠️ bin/fm_open_loops.py:259 - Recorded-stop detection introduces a second, incomplete interpretation of status events. With FM_CLASSIFY_PAUSED_VERB=awaiting, the generated worker protocol emits awaiting, but STOP_EVENTS recognizes only literal paused. Likewise, a valid multiline paused declaration followed by continuation prose loses its stop classification because the snapshot projects the last physical nonempty line (bin/fm-fleet-snapshot.sh:372-373), not the logical event. Once the endpoint is gone and current_state becomes unknown, both cases incorrectly emit missing_worker. These are supported existing behaviors, covered by tests/fm-crew-state.test.sh:2808-2811 and :2960-2977. Reuse last_status_line/status_is_paused from the existing status-event owner rather than relying on the raw tail verb. Related changed sites: bin/fm_open_loops.py:38 hardcodes the vocabulary; :260 consumes it; :270 and :299-312 apply the resulting classification; docs/configuration.md:599 states the recorded-stop guarantee.
⚠️ bin/fm_open_loops.py:594 - Simplification: the new main-home 'unowned project PRs' aggregation is not required to stop lanes receiving obligations they do not own; filtering actionable PR rows already satisfies that correction. It also labels PRs owned by secondmate lanes as having 'no fleet owner', although this collector intentionally reads only its own home and excludes secondmate task records. The smallest remedy is removing this introduced informational aggregation rather than adding cross-home ownership machinery. Related changed sites: bin/fm_open_loops.py:92 and :592 maintain the accumulator; :636 emits the group; docs/configuration.md:588 and :595 describe it; tests/fm-open-loops.test.sh:672-677 assert the new output. Removing this deliberate output component needs author approval.

🔧 Fix applied.
6 issues (3 errors, 3 warnings) still open:

🚨 bin/fm_open_loops.py:501 - Branch ownership is matched globally across repositories. For example, a lane has a task in repository A on fm/fix and another task in repository B on fm/other; an unrelated PR in B on fm/fix passes owns_pr(), fetches checks, and produces an actionable open_pr/red_check obligation. Task identifiers and branches are home-local, so another lane can legitimately use the same branch name. This leaves the reported cross-lane wake failure reachable. Qualify branch matching by the task's repository identity at owns_pr(), while retaining exact recorded-URL ownership. Related changed sites: bin/fm_open_loops.py:494 stores unqualified branches; bin/fm_open_loops.py:589 applies the match to every discovered repository; docs/configuration.md:593 documents the overly broad rule.
🚨 bin/fm_open_loops.py:260 - A historical stop event overrides an authoritative non-stopped current state. A worker can append paused while awaiting its validation run, have current_state=working from that active run, and then lose its agent. recorded_stop() still returns true from the historical paused event, suppressing missing_worker and potentially publishing complete:true without a recovery obligation. The existing current-state contract explicitly gives active run/pane evidence precedence over stale status events (bin/fm-crew-state.sh:4-12 and bin/fm-classify-lib.sh:809-811). Make known working/blocked verdicts override historical stop events in this shared predicate. Related changed sites: bin/fm_open_loops.py:270 suppresses the backlog obligation; bin/fm_open_loops.py:299-304 suppresses liveness failures; bin/fm_open_loops.py:307 and :312 suppress current-state degradation and missing-worker rows; docs/configuration.md:599 repeats the unconditional historical-event rule.
⚠️ bin/fm_open_loops.py:259 - Recorded-stop detection introduces a second, incomplete interpretation of status events. With FM_CLASSIFY_PAUSED_VERB=awaiting, the generated worker protocol emits awaiting, but STOP_EVENTS recognizes only literal paused. Likewise, a valid multiline paused declaration followed by continuation prose loses its stop classification because the snapshot projects the last physical nonempty line (bin/fm-fleet-snapshot.sh:372-373), not the logical event. Once the endpoint is gone and current_state becomes unknown, both cases incorrectly emit missing_worker. These are supported existing behaviors, covered by tests/fm-crew-state.test.sh:2808-2811 and :2960-2977. Reuse last_status_line/status_is_paused from the existing status-event owner rather than relying on the raw tail verb. Related changed sites: bin/fm_open_loops.py:38 hardcodes the vocabulary; :260 consumes it; :270 and :299-312 apply the resulting classification; docs/configuration.md:599 states the recorded-stop guarantee.
⚠️ bin/fm_open_loops.py:594 - Simplification: the new main-home 'unowned project PRs' aggregation is not required to stop lanes receiving obligations they do not own; filtering actionable PR rows already satisfies that correction. It also labels PRs owned by secondmate lanes as having 'no fleet owner', although this collector intentionally reads only its own home and excludes secondmate task records. The smallest remedy is removing this introduced informational aggregation rather than adding cross-home ownership machinery. Related changed sites: bin/fm_open_loops.py:92 and :592 maintain the accumulator; :636 emits the group; docs/configuration.md:588 and :595 describe it; tests/fm-open-loops.test.sh:672-677 assert the new output. Removing this deliberate output component needs author approval.
🚨 bin/fm_open_loops.py:501 - Round 1's repository-scoping fix leaves fork PRs falsely owned because slug identifies the base repository, not the repository containing head.ref. Concrete case: this home has origin acme/project and branch fix/build; an unrelated contributor opens a PR into acme/project from contributor/project:fix/build. owns_pr() returns true, fetches its checks, and emits an actionable open_pr/red_check row despite no recorded URL or matching source branch. This remains reachable through the normal open-PR listing, including the supported third-party branch prefixes (bin/fm-brief.sh:60-65). Compare the task-origin identity with head.repo.full_name at the shared owns_pr() boundary, retaining exact recorded-URL ownership. Related changed sites: bin/fm_open_loops.py:532 stores origin-qualified branches; :584 lists base-repository PRs; :591 applies ownership; docs/configuration.md:593 states the repository-and-branch guarantee; tests/fm-open-loops.test.sh:641 omits head repository identity from ownership fixtures. GitHub's response contract distinguishes head.repo from the requested repository: https://docs.github.com/en/rest/pulls/pulls#list-pull-requests.
⚠️ bin/fm_open_loops.py:258 - Round 1's status-parser fix leaves the standing-pause sibling unresolved. A worker records needs-decision [key=choice], then paused while awaiting an independent condition; firstmate answers with fm-send --resolve-key choice, appending resolved [key=choice]. That answer does not retract the pause under the shared event contract (bin/fm-status-event-lib.sh:250-273). If the endpoint subsequently disappears, crew-state reports unknown and recorded_stop() examines only the latest resolved event, returning false and producing a spurious missing_worker obligation. The existing executable scenarios explicitly preserve pauses behind unrelated answers (tests/fm-daemon.test.sh:925-938). Use status_declared_wait_line/status_is_paused for the pause fallback, while retaining latest-event handling for done and known-current-state precedence. Related changed sites: bin/fm_open_loops.py:271 applies the predicate to in-flight backlog rows; :300 obtains it for worker rows; :308 and :313 use it for coverage and recovery obligations; docs/configuration.md:599 documents only latest-event handling; tests/fm-open-loops.test.sh:724-725 covers continuation and resumption but not unrelated resolution.

🔧 Fix applied.
8 issues (3 errors, 5 warnings) still open:

🚨 bin/fm_open_loops.py:501 - Branch ownership is matched globally across repositories. For example, a lane has a task in repository A on fm/fix and another task in repository B on fm/other; an unrelated PR in B on fm/fix passes owns_pr(), fetches checks, and produces an actionable open_pr/red_check obligation. Task identifiers and branches are home-local, so another lane can legitimately use the same branch name. This leaves the reported cross-lane wake failure reachable. Qualify branch matching by the task's repository identity at owns_pr(), while retaining exact recorded-URL ownership. Related changed sites: bin/fm_open_loops.py:494 stores unqualified branches; bin/fm_open_loops.py:589 applies the match to every discovered repository; docs/configuration.md:593 documents the overly broad rule.
🚨 bin/fm_open_loops.py:260 - A historical stop event overrides an authoritative non-stopped current state. A worker can append paused while awaiting its validation run, have current_state=working from that active run, and then lose its agent. recorded_stop() still returns true from the historical paused event, suppressing missing_worker and potentially publishing complete:true without a recovery obligation. The existing current-state contract explicitly gives active run/pane evidence precedence over stale status events (bin/fm-crew-state.sh:4-12 and bin/fm-classify-lib.sh:809-811). Make known working/blocked verdicts override historical stop events in this shared predicate. Related changed sites: bin/fm_open_loops.py:270 suppresses the backlog obligation; bin/fm_open_loops.py:299-304 suppresses liveness failures; bin/fm_open_loops.py:307 and :312 suppress current-state degradation and missing-worker rows; docs/configuration.md:599 repeats the unconditional historical-event rule.
⚠️ bin/fm_open_loops.py:259 - Recorded-stop detection introduces a second, incomplete interpretation of status events. With FM_CLASSIFY_PAUSED_VERB=awaiting, the generated worker protocol emits awaiting, but STOP_EVENTS recognizes only literal paused. Likewise, a valid multiline paused declaration followed by continuation prose loses its stop classification because the snapshot projects the last physical nonempty line (bin/fm-fleet-snapshot.sh:372-373), not the logical event. Once the endpoint is gone and current_state becomes unknown, both cases incorrectly emit missing_worker. These are supported existing behaviors, covered by tests/fm-crew-state.test.sh:2808-2811 and :2960-2977. Reuse last_status_line/status_is_paused from the existing status-event owner rather than relying on the raw tail verb. Related changed sites: bin/fm_open_loops.py:38 hardcodes the vocabulary; :260 consumes it; :270 and :299-312 apply the resulting classification; docs/configuration.md:599 states the recorded-stop guarantee.
⚠️ bin/fm_open_loops.py:594 - Simplification: the new main-home 'unowned project PRs' aggregation is not required to stop lanes receiving obligations they do not own; filtering actionable PR rows already satisfies that correction. It also labels PRs owned by secondmate lanes as having 'no fleet owner', although this collector intentionally reads only its own home and excludes secondmate task records. The smallest remedy is removing this introduced informational aggregation rather than adding cross-home ownership machinery. Related changed sites: bin/fm_open_loops.py:92 and :592 maintain the accumulator; :636 emits the group; docs/configuration.md:588 and :595 describe it; tests/fm-open-loops.test.sh:672-677 assert the new output. Removing this deliberate output component needs author approval.
🚨 bin/fm_open_loops.py:501 - Round 1's repository-scoping fix leaves fork PRs falsely owned because slug identifies the base repository, not the repository containing head.ref. Concrete case: this home has origin acme/project and branch fix/build; an unrelated contributor opens a PR into acme/project from contributor/project:fix/build. owns_pr() returns true, fetches its checks, and emits an actionable open_pr/red_check row despite no recorded URL or matching source branch. This remains reachable through the normal open-PR listing, including the supported third-party branch prefixes (bin/fm-brief.sh:60-65). Compare the task-origin identity with head.repo.full_name at the shared owns_pr() boundary, retaining exact recorded-URL ownership. Related changed sites: bin/fm_open_loops.py:532 stores origin-qualified branches; :584 lists base-repository PRs; :591 applies ownership; docs/configuration.md:593 states the repository-and-branch guarantee; tests/fm-open-loops.test.sh:641 omits head repository identity from ownership fixtures. GitHub's response contract distinguishes head.repo from the requested repository: https://docs.github.com/en/rest/pulls/pulls#list-pull-requests.
⚠️ bin/fm_open_loops.py:258 - Round 1's status-parser fix leaves the standing-pause sibling unresolved. A worker records needs-decision [key=choice], then paused while awaiting an independent condition; firstmate answers with fm-send --resolve-key choice, appending resolved [key=choice]. That answer does not retract the pause under the shared event contract (bin/fm-status-event-lib.sh:250-273). If the endpoint subsequently disappears, crew-state reports unknown and recorded_stop() examines only the latest resolved event, returning false and producing a spurious missing_worker obligation. The existing executable scenarios explicitly preserve pauses behind unrelated answers (tests/fm-daemon.test.sh:925-938). Use status_declared_wait_line/status_is_paused for the pause fallback, while retaining latest-event handling for done and known-current-state precedence. Related changed sites: bin/fm_open_loops.py:271 applies the predicate to in-flight backlog rows; :300 obtains it for worker rows; :308 and :313 use it for coverage and recovery obligations; docs/configuration.md:599 documents only latest-event handling; tests/fm-open-loops.test.sh:724-725 covers continuation and resumption but not unrelated resolution.
⚠️ bin/fm_open_loops.py:503 - Repository identity matching is case-sensitive although GitHub owner/repository names are not. With task origin https://github.com/acme/vernant.git, branch fm/build, and no recorded PR URL, GitHub can return head.repo.full_name=Acme/Vernant and head.ref=fm/build. owns_pr() then rejects this home's PR, silently omitting its open_pr/red_check obligation and check requests. Round 1's repository-scoping fix introduced this false-negative path, and Round 2's head-repository fix retains it. Normalize only the repository identity on both sides of branch ownership matching; preserve case-sensitive branch matching and exact recorded-URL ownership. Related changed sites: bin/fm_open_loops.py:534 stores the origin spelling; bin/fm_open_loops.py:593 filters classification; docs/configuration.md:593 promises repository-and-branch ownership. GitHub documents both names as case-insensitive: https://docs.github.com/en/rest/repos/repos#get-a-repository.
⚠️ bin/fm_open_loops.py:258 - The live status fallback can erase the snapshot's explicit generation-invalidated observation. During a supported relaunch, spawn_gen changes while the fleet snapshot reads a task; the snapshot deliberately returns current_state=unknown with detail='task generation changed during snapshot', endpoint.exists=null, and agent_alive=unknown, discarding mutable observations (bin/fm-fleet-snapshot.sh:692-699). If the retained status log contains a standing pause or the replacement appends paused/done, recorded_stop() rereads that live log and returns true. worker_rows() then suppresses both inconclusive liveness and the generation-change diagnostic, potentially publishing complete:true without a coherent worker observation. Round 1's parser fallback introduced this cross-generation path; Round 2 preserves it. At the shared recorded_stop() boundary, reject stop inference for an explicitly generation-invalidated sample so its coverage failure remains visible. Related changed sites: bin/fm_open_loops.py:271 uses the predicate for backlog recovery; bin/fm_open_loops.py:300-305 suppresses liveness errors; bin/fm_open_loops.py:308 suppresses unknown-state coverage; bin/fm_open_loops.py:313 gates worker recovery.

🔧 Fix applied.
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

Live validation: ✅ go - 7 of 7 scenarios driven live against the product

Scenario	Result	Live	Evidence
A lane scans its task repository without adopting unrelated fork PRs or shared-project obligations	✅ pass	live	foreign-fork-exclusion.json, invalid-lane-marker-main-discovery.json, and unowned-pr-watcher-proof.json
A home routes exact task- and backlog-owned PRs, including failing checks	✅ pass	live	recorded-url-ownership.json, owned-task-red-check.json, main-home-owned-prs.json, and exact-recorded-url-boundary.json
Branch ownership ignores repository casing but preserves branch casing and source-repository identity	✅ pass	live	case-insensitive-head-repository.json, case-sensitive-branch-exclusion.json, and foreign-fork-exclusion.json
Old queued backlog stays informational until dispatch begins, then appears in watcher and Bearings obligations	✅ pass	live	queue-dispatch-ledger.json, metadata-dispatch-selection.json, watcher-dispatch-proof.json, and bearings-dispatch-proof.json
Done and paused workers do not require recovery, but resumed and silently lost workers do	✅ pass	live	stopped-workers-snapshot.json, stopped-workers-ledger.json, only-stopped-ledger.json, and custom-pause-ledger.json
A stopped ship still reports an unpublished local commit	✅ pass	live	stopped-unlanded-ledger.json
A task generation change keeps coverage incomplete despite a live stop declaration	✅ pass	live	generation-race-transitions.json and generation-done-ledger.json, generation-paused-ledger.json, generation-unrelated-resolution-ledger.json

bash tests/fm-open-loops.test.sh — passed the focused ledger contract suite; mock-based cases were supplemental, not counted as live evidence.
bash tests/fm-watch-open-loops.test.sh — passed the focused watcher integration suite.
bin/fm-lab-home.sh create <workspace-local-home> and FM_HOME=<home> bin/fm-open-loops.sh --heartbeat --json — exercised isolated homes and verified atomic publication against command output.
Read-only public GitHub scenarios through the installed gh-axi: foreign-fork exclusion, exact task/backlog URL ownership, repository-case normalization, branch-case sensitivity, owned failing checks, and main-home filtering. A transparent request tracer recorded requests without altering responses.
FM_HOME=<home> bin/fm-watch.sh — observed quiet cycles for non-actionable backlog and unowned PRs, and one durable ledger wake for overdue dispatch-started work.
FM_HOME=<home> bin/fm-wake-drain.sh followed by its emitted acknowledgment command — handled the fixture's initial worker signal before observing subsequent ledger silence.
FM_HOME=<home> bin/fm-bearings-snapshot.sh --json — confirmed informational backlog was omitted from overdue open-loop obligations.
FM_HOME=<home> bin/fm-fleet-snapshot.sh --home-input and the real ledger — exercised missing endpoints, durable stops, configured multiline pauses, unrelated resolutions, resumed workers, and unpublished Git commits.
Changed disposable task metadata generations concurrently with real ledger scans for done, paused, and unrelated-resolution status streams; verified degraded coverage during the race and complete coherent rescans afterward.
Removed all disposable fixtures and confirmed no fixture-addressed processes remained. No source files were changed.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

…e worker stop detection

…nvalidated coverage

…econciliation guidance

MrGTV-love added 5 commits October 8, 2026 07:52

fix: scope open-work ledger rows to what each home owns

c880c0b

no-mistakes(review): Fix repository-scoped ownership and authoritativ…

5434010

…e worker stop detection

no-mistakes(review): Fix fork PR ownership and preserve standing pauses

24dcd01

no-mistakes(review): Normalize PR ownership and preserve generation-i…

610c42c

…nvalidated coverage

no-mistakes(document): Correct lane-scoped ledger documentation and r…

6309598

…econciliation guidance

MrGTV-love merged commit 36675e0 into main Oct 8, 2026
21 checks passed

Navigation Menu

Repository navigation

fix: scope open-work ledger to home-owned obligations - #56

fix: scope open-work ledger to home-owned obligations#56
MrGTV-love merged 5 commits into
mainfrom
fm/fm-open-loops-lane-scope

MrGTV-love commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MrGTV-love commented Oct 8, 2026

Intent

What Changed

Risk Assessment

Testing

Pipeline

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant