feat: merge upstream firstmate at b805823a onto the #13 catch-up - #16
Merged
Merged
Conversation
…3696) * fix(bin): close reserved pending-reply keys via fm-send --resolve-key fm-send wrote answered: notes that the reserved-key fold ignores, so operator closes exited 0 while OPEN DECISIONS kept the decision open. Speak the owning library's close vocabulary on that path, and refuse when a reserved close cannot take effect. * no-mistakes(review): Safely quote manual decision-close recovery commands * no-mistakes(review): Reject unclosable overlong decision keys before sending * no-mistakes(review): Remove contract suffix from open decisions hint * no-mistakes(document): Document resolve-key line-cap refusal
* fix(bin): stop false missed-reply escalations for same-basename self-home answers A healthy secondmate that wrote corr= to its own state/<id>.status never matched the parent channel, so recovery confirmed and the record escalated as pending-reply-missed. Make the report helper resolve the parent channel itself, skip parent-replies.status as wrong-home, put a readable sighting path on the missed line, and restatement-copy only that same-basename self-home file onto the parent channel. * no-mistakes(review): Resolve late replies before recovery escalation * no-mistakes(review): Tighten reply routing and regression coverage * no-mistakes(review): Preserve reply paths and require explicit home * no-mistakes(review): Encode wrong-home paths before persistence * no-mistakes(document): Document corrected secondmate reply routing * no-mistakes(lint): Fix pending-reply ShellCheck warnings
* feat(harness): verify gemini as a crewmate runtime adapter Adds Gemini CLI as a fourth dispatch target alongside claude, codex, and grok, scoped to crewmate and scout work only. Every axis was proven against gemini-cli 0.58.0 rather than inferred; docs/verification/runtime-backends.md carries the dated evidence and names what stayed unverified. Busy state is semantic, not rendered: BeforeAgent opens a turn and AfterAgent and SessionEnd close it. AfterAgent also fires on a manual interrupt, so a cancelled turn closes its own record. Three findings shaped the wiring rather than a config line: - --skip-trust and GEMINI_CLI_TRUST_WORKSPACE=true are presented by the CLI as equivalents and are not. A controlled A/B showed --skip-trust leaves project configuration unloaded, so workspace skills never load. - The worktree's .gemini/settings.json is the PROJECT's committed settings file, unlike claude's settings.local.json. Firstmate's hooks therefore go to a firstmate-owned state/<id>.gemini-settings.json reached through GEMINI_CLI_SYSTEM_SETTINGS_PATH, which also works untrusted and merges with a project's own hooks instead of replacing them. - The shipped CLI is a node bundle whose live process reports comm as MainThread, so ancestry cannot see it. GEMINI_CLI=1 is load-bearing and is tested before an inherited CLAUDECODE, and pane liveness identifies gemini from the script argument through the new bin/fm-gemini-lib.sh. Gemini is refused for secondmates: it has no primary supervision protocol. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GYdQkKfSEQrFUxtcTXZ66L * test: clear gemini's marker in launch and detection expectations Every non-gemini launch now clears GEMINI_CLI the way it already clears cursor's markers, so the two tests that pin the exact launch prefix are updated to match. The harness-detection tests that scrub foreign markers before probing ancestry scrub GEMINI_CLI too, so running the suite from inside a gemini session cannot produce a false verdict. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GYdQkKfSEQrFUxtcTXZ66L * docs: classify the gemini harness reference The documentation inventory is the single classification owner for maintained prose surfaces, and every surface must appear in it exactly once. The new harness reference is agent-runtime, matching its siblings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GYdQkKfSEQrFUxtcTXZ66L * no-mistakes(review): Narrow Gemini ancestry detection * no-mistakes(review): Restrict Gemini hooks to canonical launches * no-mistakes(document): Document Gemini adapter support boundaries * no-mistakes(ci): Fixed Gemini process identity when interpreter or script paths contain whitespace. Tmux liveness now uses NUL-delimited /proc argv on Linux, with the existing flattened ps fallback elsewhere. Added a real-process regression test. Verified with the Gemini harness test suite, full fm-lint, ShellCheck, and git diff --check. The CI and Require no-mistakes runs were action_required/attestation outcomes rather than code failures --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…uid#3704) * conclude parked runs the pipeline advanced past the task copy A no-mistakes fix round commits in the daemon's own gate-repo clone, so a run parked at a gate can carry a head whose object the task copy never received. Teardown's strict object-local identity rule then declined to conclude the run, and cleanup left it parked forever holding a fleet slot (observed 2026-09-03; the same masking condition PR 3681 fixed on the read path, now closing the teardown half its scope boundary deferred). task_status_is_own_parked_run now falls back - only when the reported head resolves to no local object - to the one shared runs-ledger attribution rule fm_nm_runs_status_for_worktree (bin/fm-nm-run-lib.sh), whose anchored continuation proof binds the branch's newest active row to this worktree's exact submitted head. Foreign branches, stale history, terminal rows, ancestor-only anchors, diverged newer rows, and ambiguous multi-row shapes all still refuse, and runs that are actively running, fixing, or in CI remain untouched: only the parked-at-a-gate determination ever reaches the abort. No sqlite access, no fetches into another task copy, no custody changes, no duplicated matching logic. * tighten the parked-run ledger fallback and pin both judge corrections The teardown ledger fallback now authorizes concluding this task's parked run only when the shared runs-ledger rule's proved answer is the explicitly active word (running): a terminal newest row - even anchored at exactly the worktree's head - is finished history and never an abort authorization. The read path may classify the same owner's answer; teardown's abort must never fire for a run that already ended. Two bounded pre-validation corrections from the implementation review: - a fetched-object counterfactual pins the strict-rule path: a pipeline fix head fetched into the task copy aborts through object-local identity alone, with an empty ledger and a proof the runs query never fired; - a negative fixture pins the tightened boundary: an unresolvable reported head with a terminal newest same-branch row anchored at the worktree head engages the ledger fallback and still refuses, so the refusal is the terminal-word boundary and not an earlier guard. * no-mistakes(review): Bind teardown ledger fallback to validated run heads * no-mistakes(review): Restore validated advanced-head ledger continuation * no-mistakes(review): Reject invalid ledger dates and terminal statuses * no-mistakes(document): Document teardown ledger scan limit
* Keep parked and aged undated captain holds off live Captain's Call. Bearings was treating undated parked-style holds as live calls; mark those phrasings deferred and project holds older than a configurable 14-day since date as Charted Next gates instead. * no-mistakes(review): Bound parked marker matching to lexical tokens * no-mistakes(review): Age undated holds from durable hold-set dates * no-mistakes(review): Reset re-held timestamps and scan full bodies * no-mistakes(review): Preserve timestamp precision and prioritize parked suppression * no-mistakes(document): Document undated captain-hold aging * no-mistakes(ci): Fixed stock Bash CI test-count expectations (16 snapshot, 45 Bearings). Prevented fresh holds on old tasks from aging via stale `since` dates by aging only stamped holds. Added behavioral regressions and verified both suites plus Bash 3.2 parsing * no-mistakes(ci): account for rebased snapshot regression * no-mistakes(review): Restore legacy hold aging and mandate wrapper * no-mistakes(review): Restrict hold stamps to canonical leading lines * no-mistakes(review): Exclude historical answers and deduplicate revealed holds * no-mistakes(document): Correct captain-hold projection documentation * no-mistakes(ci): Rebased onto 8988af2 and resolved Bearings conflicts. Fixed the hold timestamp race by persisting and verifying the timestamp before publishing the captain hold; failures now leave the task unheld. Added behavioral coverage for ordering and failure handling. Preserved the required parked-phrase projection behavior. Relevant snapshot, Bearings, lifecycle, syntax, and ShellCheck validations pass * no-mistakes(review): Bound current prose before historical resolutions * no-mistakes(review): Preserve hold age across interrupted answers * no-mistakes(review): Preserve leading hold stamps until answer closure * no-mistakes(review): Normalize answer bodies on matching retries * no-mistakes(review): Document concurrent re-hold age-basis limitation * no-mistakes(document): Refresh captain hold lifecycle documentation * no-mistakes(ci): Fixed both CI failures. Updated the macOS Bash snapshot expectation from 45 to 46 Bearings tests. Narrowed parked-style deferral matching to explicit hold-reason prefixes while preserving legacy explicit markers and preventing contextual prose from hiding active decisions. Added behavioral regression coverage. Verified with stock Bash 3.2: 17 fleet snapshot tests and 46 Bearings tests pass; full lint and workflow validation also pass * no-mistakes(ci): Fixed Greptile’s P1 finding by restricting parked-style deferral phrases to complete hold-reason markers. Contextual reasons beginning with “not urgent,” “queued opportunity,” or “captain-gated” now remain visible decisions. Added behavioral coverage through the real fleet and Bearings snapshot paths and updated documentation. Verified both snapshot suites under Bash 3.2 (17 fleet tests and 46 Bearings tests), syntax checks, and git diff checks. The no-mistakes attestation failure is external/stale and requires the outer pipeline to refresh it for the new head * no-mistakes(ci): Fixed parked-style undated captain holds disappearing from the default Bearings board. They now project to Charted Next with omitted[] disclosure, while --all-decisions reveals them and removes the safety gate. Added behavioral coverage for the reported “not urgent” case and aligned documentation. Verified fm-bearings-snapshot, fleet snapshot view, and captain-hold lifecycle tests; shellcheck, bash syntax, and git diff checks pass * no-mistakes(test): Stabilize concurrency budget and provision timeout tests * no-mistakes(document): Correct captain hold documentation details * no-mistakes(ci): Fixed hold-reason parsing so commas in contextual reasons are preserved and do not incorrectly defer live Captain's Call decisions. Added end-to-end fleet/Bearings regression coverage. Reworked the flaky Herdr timeout test to assert observable late-launch behavior rather than process-ID liveness. Verified both snapshot suites, Herdr test 5 consecutive times, shell syntax, shellcheck, and git diff checks * Restore the Herdr lab timeout test to its main version. The stabilization rounds reworked tests/fm-herdr-lab.test.sh while chasing a load-induced flake, replacing the fake server's wall-clock delay with a SIGSTOP'd process and asserting that the blocked process is gone after a timed-out provision. A stopped process does not die from SIGTERM, so that assertion fails on Linux and the portable parallel shard stayed red. That test is unrelated to the undated captain-hold projection this branch delivers and was identical to main before these rounds, so restore main's version exactly. It still proves that a timed-out provision cancels its late launch before teardown. * no-mistakes(review): Preserve metadata-like prose in captain hold reasons * no-mistakes(review): Resurface due dated captain holds * no-mistakes(review): Distinguish parked holds from explicit deferrals * no-mistakes(review): Invalidate legacy secondmate summary caches * no-mistakes(review): Keep blocked deferred holds in Charted Next * no-mistakes(review): Count blocked deferred holds in omission disclosure * no-mistakes(document): Correct captain-hold projection documentation * no-mistakes(ci): Fixed both CI failures. Updated the macOS Bearings test count to 51. Preserved the v1 summary schema for compatibility while rejecting hold-bearing summaries missing the new aging fields, preventing stale caches from restoring noisy calls. Verified fleet snapshot, Bearings snapshot (51 tests), home-summary refresh, secondmate reconciliation, Bash 3.2 parsing, and diff checks * no-mistakes(ci): Fixed Greptile’s valid finding: `--all-decisions` now reveals deferred/aged captain holds even when blocked, for both main and secondmate homes, and removes their duplicate Charted Next gates. Added behavioral regression coverage and updated documentation. The prose-classifier finding was not applied because exact complete-phrase matching is explicitly required by the author intent; contextual wording remains live. Verified with Bearings and fleet snapshot tests, `bin/fm-lint.sh`, Bash syntax checking, and `git diff --check` * no-mistakes(ci): Fixed the actionable-state bug in Bearings: an arrived parked-style hold is live only when it is not explicitly non-actionable, so blocked due holds remain gated by default and are revealed by --all-decisions. Added behavioral regression coverage for that case. Preserved complete-reason parked-style classification as required by the author intent. Verified with tests/fm-bearings-snapshot.test.sh, bin/fm-lint.sh, and git diff --check * Show why a revealed captain hold is deferred. Under --all-decisions a deferred hold is revealed and its Charted Next gate is removed, but the revealed row carried only the bare hold reason. A date-deferred or blocked hold therefore read exactly like a genuine live decision, because the until date, the age, and the blocking work only ever appeared on the gate row that the reveal replaces. Annotate a row that is revealed because it is deferred with the same vocabulary the gate uses - until <date>, held <n>d, and the blocking work - so the expanded view reads as deferred-but-shown. A genuinely live call is left unannotated, and the default board is unchanged. * Classify captain holds from structured fields alone. Bucket membership was decided by several independent expressions, and two of them matched hold reason or body prose. That produced a recurring class of defects: holds that fell through every bucket and vanished from the board, and live decisions silently suppressed because their wording happened to contain a marker word - a reason of "non-deferred release choice" matched DEFERRED and disappeared. Replace all of it with one total classifier over structured fields only: hold_kind, state, hold_until, unresolved_blocker_ids, and the machine-written hold-set timestamp. Every captain hold gets exactly one hold_bucket - blocked, dated, aged, or live - so no hold can fall through and none can match two. captain_actionable is exactly the live bucket, and the --all-decisions reveal is a property of the bucket rather than a second filter. No hold reason or body prose is matched anywhere in the projection, so wording can no longer hide, reveal, or reclassify a decision. A hold that is superseded or no longer required is closed through the hold lifecycle instead of lingering as an open hold flagged by a keyword. * no-mistakes(review): Preserve working captain holds across bucket surfaces * no-mistakes(review): Reject pre-classifier secondmate summary caches * no-mistakes(review): Preserve complete live hold summaries * no-mistakes(review): Clarify working hold decision bucket semantics * no-mistakes(review): Reveal bounded remote holds and preserve blocker notes * no-mistakes(review): Make blocker overflow explicit in hold summaries * no-mistakes(document): Correct captain-hold projection documentation * no-mistakes(ci): Updated the stock macOS Bash CI snapshot expectation from 17 to 18 tests. Verified the suite under Bash 3.2.57: all 18 tests pass. `git diff --check` also passes * no-mistakes(ci): Updated the stock macOS Bash CI expectation from 51 to 53 Bearings tests. Verified all 53 pass under Bash 3.2.57; git diff --check passes
* fix(pi): deliver supervision outcomes off Pi's render thread The supervision branch runs inside the captain's own Pi process, and Pi runs extensions, their tools, and their event handlers on the single JavaScript thread that also draws the TUI and reads the keyboard. Every delivered outcome ran roughly five bash script invocations plus several `ps` calls through spawnSync on that thread, so the TUI could not repaint or echo a keystroke for the whole chain - the subsecond freeze the captain saw every time a routine or captain-facing outcome arrived. Convert the delivery path's subprocess calls to an awaited spawn behind a serializing queue. lib/fm-async-exec.ts is the single owner of the awaited-spawn replacement and returns the same capture shape and failure verdicts spawnSync returned. Awaiting yields the thread, so what the single thread used to guarantee for free is now an explicit queue: every delivery, acknowledgement, and turn-boundary reconciliation runs as one unit of it, preserving the durable append before anything visible, one delivery at a time in sequence order, the read cursor advanced before the next reader sees a row, and one ownership activation per generation. Cancellation is preserved by the generation and lock-ownership rechecks the awaits are placed around. Two reads stay synchronous because Pi's own API is synchronous there, not as an optimization: its bash spawn hook is typed as a plain function, and the watcher reads offer.accepted the moment its dispatch event returns, so a session that does not own the fleet lock must still refuse a wake without waiting. Both walk the lock's process ancestry in full every time, never cached, because reparenting and pid reuse can invalidate a remembered chain and that answer decides ownership rather than hinting at it. The store scripts and their durability contracts are unchanged. Measured through the real fm_branch_report tool and real bin/ scripts with a 1 ms interval timer, the largest block of the JS thread falls from 273 to 2.0 ms for a routine outcome, 286 to 2.0 ms for a captain outcome, and 134 to 1.9 ms for main's acknowledgement, against a 1.3-2.2 ms idle floor. In a real Pi 0.82.0 TUI the worst keystroke echo while two outcomes arrive falls from 676.9 ms to 36.8 ms, against a 22.6 ms extension-free floor. Regressions: a delivery must leave the event loop running (zero timer ticks before this change, in 250 ms), interleaved reports stay ordered and exactly once, a session replaced mid-delivery neither loses nor duplicates an outcome, and a failing store script surfaces without losing or doubling one. The real-TUI half is an opt-in live guard that types into an isolated Pi pane while outcomes are delivered and fails if echo leaves the class of the same machine's own floor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013bzoWyr2EcJGBKuoUjVRSp * no-mistakes(review): Revalidate ownership and bound asynchronous subprocess output * no-mistakes(ci): Fixed CI defects: routine outcomes now persist a sequence-keyed delivery receipt before awaiting cursor advancement, preventing duplicate delivery after mark-read failure. Corrected the session-replacement test to exercise an actual asynchronous ps ancestry lookup. Targeted behavioral tests, strict Pi typecheck, ShellCheck, and diff checks pass. The full extension test remains locally blocked by an unrelated stock-render assertion under the installed Pi runtime. The no-mistakes attestation failure is external pipeline state (test was previously skipped), not a source defect * fix(pi): keep the declined routine receipt out and skip the renderer case below its Pi floor Four follow-ups on the same branch, plus one revert. Revert the routine-delivery receipt a CI auto-fix round added. It introduced a new persisted `fm-branch-routine-delivery` entry, written into the captain's transcript for every routine note, to deduplicate a note whose cursor write failed. That is a change to the delivery contract, which this task is not authorized to make: the approved work is the asynchronous conversion with the existing durability contract preserved. The ownership re-read and output bounding from the review round are kept - both are genuine asynchronous correctness, not contract changes - as is that round's use of a real parent pid so the replacement regression traverses an actual ps subprocess. Record the routine gap instead of closing it. A routine note is a plain message with no sequence-keyed record, so a mark-read failure after delivery makes the next reconciliation send it once more; a captain row cannot duplicate that way because its visible entry is found by store sequence. That asymmetry predates moving delivery off the render thread. It is now stated at the call site and in the delivery-contract docs, tracked as fm-pi-routine-delivery-idempotency-followup-r1, and pinned by a regression that proves the routine note is re-delivered exactly once more and never again, the captain entry stays single, and the store keeps both rows. Give the stock-renderer case a Pi version floor. It compares the extension's renderers against Pi's stock rendering, so its verdict only means anything against the contract those renderers target: since 0.84.4 the stock renderer no longer supplies an implicit reset at multiline boundaries and the extension emits that reset itself, so an older installed Pi differs legitimately. It now names the installed version and the floor and skips, while a package whose version cannot be read at all still fails. Make the responsiveness regression's second signal a fraction rather than a millisecond budget. A loaded machine that deschedules the process inflates an absolute stall budget into a false failure, but it inflates the delivery's own wall time too, so requiring the worst stall to be a minority of that wall time holds under load. Synchronous delivery sits near 1.0 there whatever the load, and the tick-count signal still reads zero on it. Replace the test-family mapping for the Pi extension libraries with per-script targeting. Routing them to whole families - or leaving them unmapped, which widens through the reference scan to each referencing suite's entire family - selected dozens of suites with nothing to do with Pi and pulled an unrelated flake into the run. The changed-file selection drops from 112 scripts to 61. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013bzoWyr2EcJGBKuoUjVRSp * no-mistakes(document): Clarify asynchronous execution documentation --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…nguid#3763) * fix(memory): honor explicit project maintenance guidance * no-mistakes(test): Blocked by pre-existing Bash and Muse fixture failures * no-mistakes(test): Remove accidentally tracked test attribution report * no-mistakes(ci): Restricted the marker to the exact first line, preventing fenced examples from suppressing governance, and corrected the documentation. Regression failed before the fix; all 18 helper tests, focused ShellCheck, documentation validation, and diff checks pass. CI and Require no-mistakes report action_required with zero jobs executed; those external checks remain unresolved
…nguid#3783) * fix(spawn): refuse repository primary from linked spawning homes Compare the resolved task git directory with the spawning repository's common git directory before refreshing a fresh copy or relaunching a task. This protects the primary even when the spawning project is a linked home. Keep pooled copies accepted and preserve recorded work on relaunch. Fixes kunchenguid#3741. Verification for the pipeline PR body: - Red on origin/main 1820316 with the new regression and unchanged production code: bin/fm-test-run.sh tests/fm-spawn-pool-base-freshen.test.sh exited 1 with "linked spawning home accepted primary as a disposable copy". - Green after the guard: the complete pool-base-freshen and control-relaunch suites passed through bin/fm-test-run.sh, covering primary and symlink refusal before fetch/reset, spawning-directory refusal, scout acceptance, and committed plus unfinished work preserved during linked-home relaunch. - The worktree-settle suite passed on pristine main and the final branch. An earlier loaded-host run exceeded its five-second assertion (6s); the final retry passed without changing code or the assertion. - Test fixture commits ran with GIT_CONFIG_COUNT=1, GIT_CONFIG_KEY_0=commit.gpgsign, GIT_CONFIG_VALUE_0=false. - bin/fm-lint.sh and /bin/bash -n for all three changed scripts passed. The upstream cwd-selection cause remains outside this change. * no-mistakes(document): Clarify spawn isolation ownership and relaunch preservation
…kunchenguid#3785) * fix: read a failed herdr CLI as unreachable, not a gone backend target The no-run fallback in bin/fm-crew-state.sh collapsed every failed pane capture into 'backend target gone', which downstream consumers treat as positive death evidence - so a herdr CLI that errors or stalls under load briefly scored dozens of live claims dead on a busy box. Only a successful herdr answer proving the pane absent (fm_backend_agent_state's 'missing', backed by pane get answering pane_not_found) may now read as gone; every other verdict reports 'backend unreachable' with the endpoint state, which is never positive death evidence. Adds a behavior test: an always-failing fake herdr reads unknown/unreachable, never gone. * test: pin the herdr suite's ambient home to a marker-free fixture FM_HOME defaults to the suite's own root when unset, and any secondmate- marked checkout (every treehouse crew home carries .fm-secondmate-home) flips the default workspace label to 2ndmate-*, so the ambiguous-label placement test found zero firstmate matches and fell into the create path instead of refusing (expected exit 3, got 1) - deterministically green in CI, deterministically red from a crew home. Export a marker-free ambient FM_HOME fixture; per-test FM_HOME prefixes still override it. * fix: classify herdr endpoint answers instead of every non-missing verdict Review decision (firstmate, 2026-09-05): a failed pane capture is not itself evidence of death, but neither is every non-missing classifier verdict a failed answer. missing (pane get answered pane_not_found) and dead (pane present, agent_not_found husk) keep gone-class text so a stale-claim sweep may still reclaim them; an alive answer falls through to the normal busy/state flow instead of being discarded when only the heavy 200-line scrollback read failed; only when the cheap pane get / agent get calls themselves fail to answer does the line read 'backend unreachable'. Adds the two missing cases: alive with a failed scrollback read stays live, and a husk pane still reads gone. * no-mistakes(review): route tmux through agent-state classifier; drop test stall * no-mistakes(review): narrow inaccurate tmux socket and alive-arm fallback comments * no-mistakes(document): document classifier-backed endpoint verdicts in crew-state contract
) * fix: distinguish subshell wake-lock owners on stock Bash Restore distinct process ownership for issue kunchenguid#3743 using the existing PID helper, consistently across lock publication, reclaim, release, role checks, and bounded handoff. The existing wake-queue regression fails on pristine upstream Bash 3.2 with rc=13. The complete suite now passes on Bash 3.2.57 and Bash 5.3.15, with added coverage for ownership when BASHPID is unset. Canonical lint and stock-Bash syntax checks pass. * no-mistakes(document): Correct lock grace-period documentation * no-mistakes(ci): Captain, fixed all 14 SC2031 false positives with nine ShellCheck source-boundary annotations across three tests. Full CI-mode lint and the complete wake-queue suite on stock Bash 3.2 passed. Runtime behavior is unchanged
…backends (kunchenguid#3782) * fix(bin): close legacy records on the Beads backend honestly Two pre-Beads reads blocked honest closure of leftover records: 1. fm-captain-hold.sh complete/verify resolved attested legacy hold ids only against the live backend and the pre-collapse derived identity, so a home whose holds fm-hold-migration rehomed under fm- ids failed with an empty-name absence message (the resolve failure was swallowed by the command substitution feeding verify_hold_durable). Resolution now falls back, on the Beads backend only, to the legacy id under the configured beads prefix and to the row whose notes carry the exact marker line 'migrated from data/backlog.md id <legacy id>'; every refusal names the id it could not resolve, and the markdown path is unchanged. 2. fm-teardown.sh refused any record without spawn_gen forever. A record that predates the field can now be torn down with an explicit --legacy-record flag once the recovery-grade endpoint classifier confirms the recorded endpoint dead or agent-less; the accepted incarnation is stamped into the record right before its close marker binds to it and named in the teardown line. Refusals leave the record byte-identical, the unlanded-work refusal is not relaxed, and a corrupt (multi-valued) spawn_gen is never accepted. The companion repair this branch carries (follow-up commit) is the backend-gated --file and markdown-file requirement in the mutate path and lifecycle gates: fm_backlog_mutate passed --file and required the markdown backlog file regardless of the resolved backend, and the transition gate plus row probe required that file before any backend work, so a home on a non-markdown backend could neither gate, probe, nor close its rows. Behavior tests: self-contained beads fixtures over a scratch bd graph (self-skipping on markdown-only tasks-axi installs), legacy meta fixtures for every teardown gate, and the relocated markdown backlog coverage stays green. * no-mistakes(review): fix(review): report migrated-hold scan refusals and guard legacy spawn_gen stamp against newline-less records * fix(backlog): address the configured backend for lifecycle writes Completes the fm-backlog-transition-lib repair the first commit's message claims: on this base fm_backlog_mutate passed --file and required the markdown backlog file regardless of the resolved backend, and fm_backlog_transition_applies plus fm_backlog_row_probe required that file before any backend work, so a home on a non-markdown backend could neither gate, probe, nor close its backlog rows. All three now gate the markdown file on the resolved tasks-axi backend: markdown keeps exactly its explicit <data>/backlog.md behavior, non-markdown homes address the backend their own configuration selects with no markdown file requirement. fm_backlog_row_show and fm_backlog_row_list already gated correctly and are unchanged. docs/configuration.md owns the contract line. Also extends the same backend gate to fm-captain-hold.sh's own mutation wrapper - hold/add/update/answer/done append the markdown --file only when the resolved backend is markdown, so a captain call on a Beads home reaches the Beads store end to end - and applies the review round's two direct remedies there: the [beads] graph path resolves against the backlog root when relative (never the process CWD), and a failed bd graph read reports bd's own trimmed stderr reason in the refusal. Coverage: tests/fm-backlog-atomicity.test.sh gains a stub-driven Beads completion case proving the transition gate applies, the row probe reads, and done runs without any markdown file or --file override; the relocated markdown backlog test stays green. * no-mistakes(review): Document root-tasks.toml-only beads settings for migrated-hold resolution * test(gotmp): stub fm_tasks_axi_backend so the fixture matches the backend-aware transition lib The legacy-records change made fm-backlog-transition-lib.sh resolve the configured backend via fm_tasks_axi_backend before the markdown-only skip. The gotmp fixture's fm-tasks-axi-lib stub lacked that function, so the markdown check fell through and teardown hit the incompatible-backend error with unbound FM_TASKS_AXI_MIN under set -u. Stub the backend as markdown and define the floor, restoring the intended no-backlog skip. * fix(teardown): roll the legacy stamp back when the close marker fails A legacy-record teardown stamps its accepted incarnation into the record right before the close marker binds to it; when that marker write then fails, the stamp survived, so a retried teardown sailed past the dead-or-agent-less endpoint gate the stamp now proved unnecessary. The failed marker write now truncates the record back to its exact pre-stamp bytes (verified by size), restoring the byte-identical-refusal invariant; when the rollback itself fails the operator is told to re-run with --legacy-record after reconciling the endpoint. Also completes the recorded review decision's coverage wording: the beads stub test now drives the answer close end to end (update and done through the gated wrapper), asserting no markdown file override reaches either verb. * fix(review): harden the legacy stamp rollback and resolve derived migrated ids The legacy-record stamp rollback now uses perl (already in the teardown curated PATH; truncate is not, and is absent on stock macOS), routes every failure branch inside the stamp block through the same size-verified rollback so the byte-identical-refusal invariant holds on those paths too, and gains behavior coverage: an unrecordable close (an invalid pr= link) fails the teardown, leaves the record byte-identical, keeps the backlog row in flight, and a flag-less retry still refuses. Migrated-hold resolution now probes the derived pre-collapse identity (<origin>-decision-<entry>) alongside the raw entry - fm-hold-migration recorded the DERIVED id in every migrated row's marker note - in both the prefix and the migration-note forms, with the ambiguity refusal naming every identity tried, plus behavior coverage for a bare decision key resolved through its derived identity's marker. Also aligns fm-backlog-transition-lib.sh's header ADDRESSING/SCOPE paragraphs with the backend-gated contract, drops an unreachable FORCE validity guard the parser rewrite left behind, and switches the new stub fixture to the portable sed -i.bak idiom. * no-mistakes(review): Name the configured backend in teardown's backlog reminder * no-mistakes(review): Scan migration markers before the prefix guess * no-mistakes(review): Document marker-first resolution and cover the prefix branch * no-mistakes(document): Record prefix-attestation audit and marker-line forms * no-mistakes(ci): Fixed the Greptile P1 on bin/fm-teardown.sh: a failed rollback of the synthetic legacy stamp let a retry bypass the dead-or-agent-less endpoint gate. Root cause: teardown minted `spawn_gen=legacy-<ts>-<pid>` into the task record before the close marker bound to it. When the close-marker write failed AND the rollback also failed, the record retained that token. On the next invocation `fm_backlog_meta_spawn_gen` succeeded, so `TEARDOWN_LEGACY_PENDING` stayed 0 and the endpoint gate was skipped entirely — even with `--legacy-record`. The script's own error text told the operator to "re-run teardown with --legacy-record", advice the code could not honor. Fix (bin/fm-teardown.sh): - A `legacy-*` spawn_gen is now recognized as a stamp this teardown path minted, never one a spawn published (fm-spawn.sh publishes `s<epoch>.<pid>.<random>`). Such a record still reads as the legacy record it is: it re-enters the endpoint gate, and a flag-less retry refuses naming `--legacy-record`. - Acceptance reuses the retained token instead of minting a second one; the append block is skipped when the record already carries it, so no duplicate spawn_gen is written. - The rollback attempt and its "could not be rolled back" message are guarded to runs that actually appended a stamp, so a run that appended nothing never claims a rollback it did not perform. - Usage header documents the retained-stamp rule. Test (tests/fm-teardown.test.sh): added `test_retained_legacy_stamp_still_faces_the_endpoint_gate`, an end-to-end reproduction — a `perl` stub that fails only the rollback's `truncate` (delegating every other perl call to the real interpreter) leaves the stamp behind, then the retry must still hit the gate, must not stamp a second incarnation, must not close the backlog row, and the flag-less retry must refuse. Verification: the new test fails against the pre-fix script on exactly the reported defect ("the retry skipped the dead-or-agent-less endpoint gate") and passes after. Full tests/fm-teardown.test.sh 80 ok / 0 failures / rc=0; tests/fm-backlog-atomicity.test.sh 80 ok / 0 failures / rc=0; bin/fm-lint.sh (pinned ShellCheck 0.11.0 + actionlint 1.7.12) clean
* fix(lint): drop source following on the local changed-file gate The local lint step was inlining library closures through --external-sources and peaking above 8 GB on a single root. Keep full analysis in CI, on main, and without a merge-base; exclude the four cross-file codes from the local pass so those findings still land in CI. Co-authored-by: Cursor <cursoragent@cursor.com> * no-mistakes(review): Run local ShellCheck per root and document measurements * no-mistakes(review): Correct local source-following telemetry * no-mistakes(document): Clarify context-sensitive lint documentation --------- Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(pi): route needs-decision wakes and mixed batches wholly to main Skip the supervision branch for every needs-decision status append, the same way a check-kind wake already skips it. A coalesced signal/stale trigger batch containing any needs-decision row is delivered wholly to main, not split between the branch and a later main wake - the whole batch, including any co-present routine rows for a different task, travels together. Heartbeat and unread-status scans stay independent. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013LB2CeerSMCZN4oNsVfLeE * test(pi): cover distinct-file mixed batches and heartbeat independence Add a regression using two distinct files (not the same status file twice) in one coalesced trigger so a some-vs-every regression on the file-list cross-reference cannot hide behind a degenerate same-key case, and a heartbeat/needs-decision co-presence test proving a needs-decision row neither vetoes nor rides along with an otherwise eligible heartbeat scan. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013LB2CeerSMCZN4oNsVfLeE * no-mistakes(document): Clarify needs-decision and heartbeat routing * no-mistakes(ci): Fixed captain-held stale reminders so they bypass supervision and wake main, while unrelated unread rows and heartbeats remain independent. Added routing regressions and updated documentation. Pi watcher tests, strict TypeScript checks, lint, and diff checks pass. The no-mistakes attestation failure was pipeline-state related, not a source defect * no-mistakes(ci): Fixed CI lint by narrowly suppressing false-positive SC2031 diagnostics where background PIDs are captured immediately in the same shell. Verified with `CI=true bin/fm-lint.sh` and `git diff --check`. The no-mistakes attestation failure is pipeline-state-related (`test` was skipped), not a source defect * no-mistakes(review): Route stale open decisions directly to main * no-mistakes(review): Honor configured verbs in stale decision routing * no-mistakes(review): Route second-mate escalations and configured decisions to main * no-mistakes(review): Ignore trailing whitespace after captain holds * no-mistakes(review): Cache stale decision classification per status file * no-mistakes(review): Document unread decision precedence for later task wakes * no-mistakes(review): Cache unchanged stale decisions across scope scans * no-mistakes(review): Resolve decision aliases and reject symlinked statuses * no-mistakes(review): Route surfaced captain-held signals directly to main * no-mistakes(document): Document decision-owned main routing * no-mistakes(ci): Fixed captain-held spans to remain actionable while crew working evidence is positive, ensuring the watcher delivers their main-only marker. Updated the executable regression test to cover this case. Verified with the full fm-watch-triage suite, bash syntax checks, and git diff checks. Shellcheck reported only pre-existing test harness warnings (SC1091/SC2034) * no-mistakes(ci): Fixed the CI regression: captain-held transfers now retain their established non-actionable stale classification while the signal-routing side-band still surfaces them main-only. Verified with tests/fm-daemon.test.sh, tests/fm-watch-triage.test.sh, bash syntax checks, and git diff --check --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
…d#3802) * feat(spawn): add an opt-in worker environment allowlist Honor a home-local launch-env-allowlist at the shared worker command boundary and inherit it into secondmate homes. Preserve the existing launch behavior when the file is absent. Keep the operational environment and explicit launch assignments, and account for filtered Muse credentials. Refs kunchenguid#3742 Verification: - Red on origin/main 1820316: the new enabled-allowlist regression observed synthetic-unrelated in the worker; the absent-file control passed. - Green: fm-test-run.sh on fm-spawn-dispatch-profile, fm-muse-harness, and fm-trace-context-spawn; all three passed without skips. - Synthetic emitted-command probes ran through sh, stock Bash, and zsh. - Canonical lint, documentation audience checks, and stock Bash syntax checks passed. * no-mistakes(review): Reject inaccessible launch environment configuration * no-mistakes(review): Preserve inherited allowlists on source inspection errors * no-mistakes(document): Clarify worker environment grants and inheritance documentation * no-mistakes(lint): Fix inheritance test ShellCheck source boundary
…kunchenguid#3575) * feat(bin): add rovo as a verified crewmate/scout worker harness Wire the Atlassian Rovo CLI (202609.1.2) into the TUI-under-tmux/herdr adapter contract: detection with marker-precedence ordering, one-shot positional launch with --startup-receipt readiness polling instead of composer scraping, model/effort flags, a screen-scrape busy fallback scoped like grok's, and crew/scout-only lifecycle control that refuses secondmate launches. Ships with a portable regression suite, a live PTY guard against the real binary, a per-harness reference doc, and a dated verification record covering the silent OAuth refresh, the interrupt-ack divergence from the originating scout report, and the still-open composer-ghost and tmux/herdr pane-liveness gaps. * no-mistakes(review): revert rovo launch to positional brief, drop startup-receipt * no-mistakes(test): rewire rovo adapter to kimi-style launch-then-send shape * no-mistakes(document): add rovo to stale worker-harness enumerations in docs * docs(verification): close the rovo herdr-liveness gap with live isolated-lab evidence Placement, launch-then-send, and busy/idle rendering are now verified live in an isolated non-default Herdr lab session (bin/fm-herdr-lab.sh), driven directly through fm-spawn.sh's/fm-backend.sh's own shared primitives since the cross-session launcher-identity guard refuses this task's own ambient Herdr identity for a full fm-spawn.sh run. fm_backend_agent_state reported dead for a live, responding rovo pane at every point checked, because herdr's own agent-integration registry has no rovo entry (herdr integration status), so herdr agent get returns agent_not_found regardless of whether rovo is actually running. This is recorded as a Herdr-side integration gap rather than a firstmate bug, left unpatched to avoid a false-positive alive verdict for other idle shells. Updates docs/verification/rovo.md's backend-liveness section and its two cross-references (docs/verification/runtime-backends.md, docs/configuration.md) accordingly. * fix(bin): close rovo's failed-spawn leak and busy-scrape false idle Greptile P1s on PR kunchenguid#3575: a failed rovo readiness/submission/delivery gate exited without tearing down the just-created endpoint, leaving the launched --yolo rovo process running as an orphaned agent outside task control. Separately, the busy classifier's rendered-tail fallback returned definitive idle whenever the "Rovo is thinking" marker scrolled out of the last 12 nonblank lines of a long turn, which could make supervision wrongly conclude a still-working worker had gone idle. fm-spawn.sh: rovo_spawn_fail now calls rovo_endpoint_cleanup, which kills the created endpoint (tmux/herdr/zellij/cmux) via the same generic fm_backend_kill dispatch fm-spawn.sh's own orca-abort path already uses; orca's worktree and terminal remain owned by the separate ORCA_ABORT_CLEANUP trap. fm-busy-lib.sh: the rovo classifier arm now reports "unknown rovo-regex" instead of "idle rovo-regex" when the marker is absent, matching how muse and cursor already express "can't tell" for their own fallbacks. The positive busy match is unchanged. Extends tests/fm-rovo-harness.test.sh: the readiness and delivery failure tests now assert the endpoint is torn down (and the success test asserts it is not), and a new test drives the busy marker out of the tail window to confirm the verdict is unknown, never idle. bin/fm-lint.sh is clean on both changed files. * test(rovo): align spawn fixture with the launch-brief validation contract Upstream main now requires a brief's ## Captain's intent and ## Firstmate spec subsections (or a nonempty legacy # Task body) before spawn, and rewrites ship+no-mistakes briefs into launch-brief.md. Update the rovo harness fixture and pointer assertions to match, mirroring the kimi harness fixture. * no-mistakes(review): align rovo.md delivery-gate note with live herdr evidence * fix: prevent stale supervision wake loops (kunchenguid#3672) * fix(bin): stop the supervision branch's stale-ack and ghost-report loops Clean-slate implementation of the four authorized recommendations from the supervision-ghost-retrigger analysis (items 1, 2, 3, and 7), in their minimal form, superseding PR kunchenguid#3604: - fm_branch_report refuses a task the wake being handled never named. The extension fixes the reportable task set from the eligible rows before each prompt (signal and stale rows resolve to their tasks, a heartbeat allows any task with a live record, fleet is always allowed), so a report typed from memory about a task whose records teardown already removed is never stored or delivered. - An acknowledgement that consumes nothing says "nothing was acknowledged through N" and prints the exact --ack-through / --recovery-generation command for the current presented wake, instead of "re-run the drain", which re-fed the same stale acknowledgement in a loop. - bin/fm-guard.sh no longer tells the branch actor to drain queued wakes while it is handling them; it names the granted rows instead. - Teardown removes state/.<task>.branch-outcome-index for ordinary tasks and descendants; the index rebuild and the append-side index write both skip a task with neither a live record nor a status log, so the branch's report of a teardown it just performed is stored without recreating the index. No new locking, no spawn-generation binding, and no retired-task refusal: the branch can still report the outcome of a task it just tore down, and the teardown test now proves that path end to end. * fix(bin): narrow the branch report scope and guard silence to the minimal form Apply the four review decisions on the clean-slate branch: - A signal or stale prompt may report only the tasks its own rows resolve to; fleet is refused there too. A heartbeat review is not scoped by task at all, so the extension no longer tracks live task records and refuses nothing by task id during a fleet review. - The outcome-index rebuild no longer skips retired tasks; the append-side skip alone keeps a torn-down task's index from being recreated. - bin/fm-guard.sh keeps the queued-wakes warning silent for the branch actor instead of printing a replacement note. * no-mistakes(document): Align supervision docs with scoped wake handling * fix(bin): grant rovo the per-task home paths its standard crewmate flow needs rovo confines every file-tool operation to its worktree by default, and its bash tool independently refuses the same external paths regardless of any grant (confirmed live), so a rovo worker could not read its own brief or steering messages or write its status/report - all of which live in the firstmate home outside the worktree - without hand-feeding it. Grant toolPermissions.allowedExternalPaths for exactly the task's brief directory, steering inbox, and status file at launch time via --config-override, merged with agent.efficiencyLevel into one JSON object since that flag is single-value and silently discards a second occurrence. Extends the live PTY guard to prove, against the real binary, that the grant lets rovo read an external brief and append to an external status file, and that the same flow is blocked without the grant. * no-mistakes(document): align rovo reference Effort row with merged single --config-override * no-mistakes(document): document rovo file-access grant in harness reference --------- Co-authored-by: PUNEET PATWARI <ppatwari@atlassian.com> Co-authored-by: Kun Chen <3233006+kunchenguid@users.noreply.github.com>
…guid#3813) * fix(bin): read a crew's pipeline-death claim against the live run A crew's no-mistakes drive call blocks until the next gate or outcome, routinely far longer than its harness lets one command live, so the call gets killed or times out while the daemon runs the fix round on in the background. Crews read that as daemon death and block on it, and firstmate had nothing that contradicted them. Rule 7 of every generated brief now says a drive-call error or a harness command timeout is not a daemon error, requires `no-mistakes daemon status` plus `no-mistakes axi status` before a pipeline `blocked:`, and reserves that report for a refused socket or a run record failed with a daemon error. The no-mistakes definition of done adds the harness command limit and the background-and-poll shape that fits inside it. fm-crew-state gains one classification case: a `blocked:` line blaming the daemon, a timeout, or unreachability, while the run is running or fixing AND the pipeline reports fresh activity, now reads as superseded because the run is alive. Recency comes from the client's own `quiet` marker on active_steps.last_activity rather than a threshold invented here, and positive evidence is required, so a run record that outlives a genuinely dead daemon keeps the plain reading. stuck-crewmate-recovery gains the inverse-of-a-dead-endpoint playbook: firstmate reads both statuses itself, steers a reattach, never restarts the shared daemon on a crew's claim, and escalates only a refused socket. Nothing here depends on an unshipped no-mistakes capability. * no-mistakes(review): Prioritize daemon socket failure and narrow unreachable matching * no-mistakes(review): Honor socket refusal across coarse status and crew guidance * no-mistakes(test): Replace flaky settle timing assertion with pane-read count * no-mistakes(document): Document daemon timeout recovery contract * no-mistakes(ci): Fixed daemon socket failures being suppressed by terminal attributed runs. Positive refused/missing socket evidence now remains blocked regardless of run status. Added a behavioral regression test for terminal failed runs. Verified with fm-crew-state tests, project ShellCheck lint, and git diff checks
…unchenguid#3797) * fix(brief): scope Firstmate workers to their launch contract * no-mistakes(document): Clarify supervisor scope and worker contract ownership * no-mistakes(ci): Removed the heading-based bypass so every ship/scout launch receives the current worker-role contract. Added a regression that failed before the fix and passes afterward. Dispatch, brief, and delivery suites, focused ShellCheck, and git diff --check all passed * no-mistakes(review): make launch overlay sole owner of worker role contract * no-mistakes(review): narrow heading test dimension and fix publish error wording * no-mistakes(review): gate role supersession, fix render guard, drop AGENTS twin * no-mistakes(document): align architecture AGENTS.md scope and spawn launch-brief header
…d#3823) * fix(bin): stop ringing steering doorbells into dead panes The steering-inbox doorbell was a plain sentence plus Enter typed into a worker's pane, and the watcher re-rang it on the assumption that a ring is free. In a pane whose agent has exited that line is a shell command, and the re-ring ladder kept typing it into a shell that can never acknowledge it. - Prefix the doorbell with the shell no-op `: ` so a bare shell executes nothing while a live worker still reads the same self-describing line. `#` is not used because interactive zsh does not treat it as a comment by default and the claude harness binds it to memory mode. - fm_task_inbox_ring skips the pane (return 3) when the backend positively classifies the agent as dead; missing, ambiguous, unreadable, and unverified endpoints still ring so a blind classifier never starves a live worker. - The watcher caps the ladder for a dead pane: one stale wake for recovery, no ring, no ladder walk, and the durable record stays for stuck-crewmate-recovery. fm-send and the remote steer leg report the skip. Tests cover the no-op in real shells, the dead/live/unclassifiable ring verdicts, and the single-surfacing watcher path. * no-mistakes(review): Quote doorbell paths against shell injection * no-mistakes(review): Reject terminal-control paths before ringing * no-mistakes(review): Document accepted partial doorbell delivery race * no-mistakes(review): Skip unavailable endpoints before busy-state handling * no-mistakes(test): Respect shell startup PATH in environment allowlist test * no-mistakes(test): Fix doorbell test fixtures for endpoint liveness * no-mistakes(test): Prioritize confirmed restarts and clean shell test syntax * no-mistakes(document): Document dead and missing doorbell recovery * no-mistakes(ci): Fixed the persistence-reply timeout race by rechecking for a correlated reply immediately before falling back to a nudge. Added a deterministic regression covering replies arriving between the preliminary resolution pass and timeout handling. Verified with the targeted restart suite, project lint, coverage guard, bash syntax checks, and diff checks
…tree poll (kunchenguid#3834) * fix(spawn): keep the worktree poll from adopting the repository primary After `treehouse get` is sent, the worktree-discovery poll reads the pane's foreground-process cwd. While treehouse is still fetching and checking a slot out, the foreground process is treehouse itself and it reports the repository's PRIMARY checkout as its cwd for several seconds. The poll accepted any path that merely differed from the spawning project, so from a linked spawning home - whose project is itself a worktree of that repository - it adopted the primary, and the isolation guard then refused a launch whose slot treehouse went on to create normally. Screen every candidate with the isolation guard's own conditions, extracted as spawn_worktree_isolated, so a read the guard would reject stays a transient the poll keeps waiting through. The two-consecutive-reads rule and the guard as final backstop are unchanged; a pane that never reaches an isolated worktree still fails at the existing 60s deadline, now naming the last path it reported. The already-settled timing assertion counted whole-spawn wall time against a 5s budget and failed on unmodified HEAD on slower machines; it now counts pane reads, which is what "one confirming read, not an extra cycle" actually means. * fix(spawn): say which path the worktree wait rejected, and why Screening every discovery-poll candidate means a host that never reaches an isolated worktree spends the whole 60s window before refusing. That wait is deliberate - separating a transient from a terminal misconfiguration needs machinery this path does not want - so the refusal explains itself instead: the isolation check records why a candidate failed, and the deadline names the last path seen together with that reason. Message and diagnostics only; the poll's control flow is unchanged. Two suites asserted the guard's wording on paths the poll now rejects rather than adopts, so their refusal arrives from the deadline instead: realign fm-tangle-guard's non-git and subdirectory-of-primary cases (each now also asserting the stated reason, and the second the metadata absence it was missing) and the herdr projection e2e's forced non-worktree cwd. * no-mistakes(review): stub poll sleep in tangle-guard spawn isolation test * no-mistakes(document): document spawn poll isolation screen in fm-spawn header * test(spawn): make the non-git isolation case non-git anywhere The refusal-reason assertion for a path outside any repository assumed TMPDIR is not inside a git repository. Where it is, git walks up from the temporary directory, finds that repository, and the spawn reports the subdirectory cause instead - so the case passed or failed on a property of the host rather than on the behaviour under test. Build the path under a directory the test then names in GIT_CEILING_DIRECTORIES, which git documents as not chdir-ing up into a listed directory while looking for a repository. Git never excludes the directory being searched, so the ceiling is the parent of the path handed to the spawn. The assertions pin which cause fired rather than the sentence that explains it, leaving the operator wording free to improve. * no-mistakes(document): point spawn poll comment at the isolation screen's comparison * no-mistakes(ci): Fixed the "Behavior portable serial 2" failure in tests/fm-tangle-guard.test.sh ("non-worktree spawn did not say why the path was rejected (missing: 'not inside a git worktree')"). Root cause, in this PR's code: bin/fm-spawn.sh's spawn_worktree_isolated resolved the git toplevel with `wt_top_real=$(cd "$SPAWN_WT_TOP" ...)`. For a path in no repository, `git rev-parse --show-toplevel` yields empty, and `cd ""` is a SUCCESSFUL no-op on bash before 5.3 (CI's ubuntu-latest ships bash 5.2). The empty toplevel therefore resolved to fm-spawn's own cwd — the CI checkout — so the poll reported "it is a subdirectory of worktree root '/home/runner/work/firstmate/firstmate'" instead of the correct "it is not inside a git worktree". Dev machines with bash 5.3 fail `cd ""`, which is why the suite passed locally and only failed on CI; it is a genuine shell-portability defect in the reason vocabulary this change added, not a test-environment artifact. Fix (smallest root-cause change, 1 line + comment, bin/fm-spawn.sh:2168-2173): guard the empty value so it never reaches `cd` — if [ -n "$SPAWN_WT_TOP" ] && ! wt_top_real=$(cd "$SPAWN_WT_TOP" 2>/dev/null && pwd -P); then No change to the poll's timing or deadline behavior (respecting the recorded refusal-latency and spawn-wt-reason-vocabulary decisions), no new tests, no other files touched. Verification: - Reproduced the exact CI failure locally by putting bash 3.2 (same `cd ""` semantics as CI's 5.2) first on PATH: fails before the fix with the identical message shape, passes after. - tests/fm-tangle-guard.test.sh passes under both bash 3.2 and bash 5.3. - tests/fm-spawn-worktree-settle.test.sh and tests/fm-spawn-pool-base-freshen.test.sh pass; shellcheck -x bin/fm-spawn.sh clean. - bin/fm-test-run.sh --changed: 46 suites completed, every FM_TEST_END exit=0, 1076 passing assertions, 0 "not ok" (including fm-tangle-guard, fm-control-relaunch, fm-lint). The run ended on my own 900s wall-clock cap (rc=124), not on any test failure
Co-authored-by: Talon Stark <talonstark@gmail.com>
…d as not failed (kunchenguid#3846) * fix(bin): read an orphaned green ci monitor as held-for-merge, not failed A no-mistakes run held for a captain merge decision keeps its ci step polling until merged or closed; when the shared daemon restarts under that poll, the run is recorded failed although every substantive step completed and GitHub reports the PR green. A monitor whose only remaining job is to observe a human decision must not convert the absence of that decision into a failure verdict. fm-crew-state.sh now reclassifies a terminal failed run as done (held-for-merge), surfacing the run's PR URL, when the steps table shows every step completed except exactly ci failed and the ci log's last recognized marker reads checks green. A genuinely red check, an unreadable ci log, or a second failed step keeps the failure. * no-mistakes(review): Read daemon-down coarse failed ledger as unknown, not failed * no-mistakes(document): docs: align AGENTS.md failed-verdict guidance with crew-state reclassification
…livery (kunchenguid#3852) * fix(bin): read preserved spawn state back before the interrupted exit claims it The deferred-signal exit path asserted the paired task record and In-flight backlog state were preserved without reading either back, exactly when a reader is least able to check (fm-yi4j evidence, 2026-09-05). The commit's exit status alone has been observed to agree with a row that did not actually move. The exit path now re-reads the record and the row under the same per-task lock as the commit, repairs a row the commit believed it moved, and phrases the error as exactly what was verified or attempted - verified preserved, repaired and verified, or an explicit preservation-could-not-be-verified with the reason and hand-closeout instruction. Two behavior tests drive a lying tasks-axi start through a real interrupted spawn and assert the printed claim and the real backlog state agree. * no-mistakes(test): Fix calm suite for Pi 0.85 and pin test umask * no-mistakes(document): Document interrupted-spawn preservation claim in backlog gate owner * no-mistakes(ci): Fixed the Greptile P1 in bin/fm-spawn.sh's deferred-signal exit path: during preservation verification, the no-op HUP/INT/TERM re-trap combined with an unresponsive `tasks-axi show`/`start` (bash cannot run traps while a foreground child runs) held the per-task meta lock - and every lifecycle operation waiting on it - indefinitely. Root-cause fix: bound every tasks-axi invocation made under the lock. bin/fm-backlog-transition-lib.sh gains fm_tasks_axi, an exec-based wrapper (GNU timeout, gtimeout fallback) used by fm_backlog_row_show and fm_backlog_mutate that preserves the exact process placement of the plain tasks-axi call; bin/fm-spawn.sh sets FM_TASKS_AXI_TIMEOUT (default 30s) at the commit point so both the commit and the read-back verification are bounded. A timed-out call fails through the existing error plumbing and probe/mutate name the timeout as the reason, so the interrupted exit path prints honest 'preservation could not be verified ... (reason)' wording - never intent phrased as outcome, matching the author's intent. Added a behavior test in tests/fm-backlog-atomicity.test.sh that drives a real interrupted spawn through a lying tasks-axi whose repair start never answers; it asserts the spawn exits promptly (self-bounded by an outer timeout), the attempted wording names the timeout, and the printed claim agrees with the real record/backlog state. Confirmed the test fails on the unfixed tree and passes with the fix. Verified: fm-backlog-atomicity (83 ok), fm-transition-lib, fm-backlog-handoff, fm-captain-hold, fm-teardown, fm-fleet-snapshot-view, fm-secondmate-reconcile, fm-spawn-batch, fm-spawn-dispatch-profile, fm-task-delivery, fm-control-relaunch all pass; bin/fm-lint.sh clean. The fm-bootstrap 'unsplit run lost its local diagnostic' failure reproduces on the pristine base commit and is unrelated to this change * no-mistakes(ci): Fixed the Greptile P1 in bin/fm-backlog-transition-lib.sh: fm_tasks_axi bounded tasks-axi only through GNU timeout/gtimeout and fell through to an unbounded exec on hosts with neither (stock macOS), so an unresponsive call could hold the per-task meta lock forever during interrupted-spawn verification. Root-cause fix: the bound now has no unbounded path. GNU timeout is preferred, gtimeout next, then a small perl watchdog (fork + waitpid WNOHANG polling at 50ms, TERM on expiry, one bound of grace, then KILL, exit 124 so the callers' existing timeout plumbing reports it; exit statuses and output pass through unchanged). Polling was chosen over alarm+die to avoid perl's platform-dependent syscall-restart semantics. When a bound is requested but no bounding mechanism exists, the call fails closed (exit 127 with a diagnostic) rather than running unbounded, so the interrupted exit path prints honest attempted wording, never intent as outcome. The unbounded exec remains only for the no-bound plain-call case. Added three behavior tests in tests/fm-backlog-atomicity.test.sh driving fm_tasks_axi through a PATH with no timeout binary: a hanging stub must exit 124 within the bound (verified to fail on the pre-fix code), a failing stub's status/output must pass through, and a tool-less PATH must fail closed with the diagnostic. Verified: fm-backlog-atomicity 86/86 ok, fm-transition-lib, fm-backlog-handoff, fm-teardown, fm-spawn-batch, fm-task-delivery, fm-fleet-snapshot-view, fm-secondmate-reconcile, fm-control-relaunch, fm-spawn-dispatch-profile all pass; bin/fm-lint.sh clean * no-mistakes(ci): Fixed the Greptile P1 on bin/fm-backlog-transition-lib.sh: fm_tasks_axi's GNU timeout and gtimeout paths sent TERM at the bound but had no kill-after, so a tasks-axi that ignores SIGTERM kept the bounded call - and the per-task meta lock - held indefinitely during interrupted-spawn verification. Root-cause fix: both GNU execs now carry -k "$bound" (TERM at the bound, KILL after one further bound of grace), giving every bounded path the same forced-termination contract the perl watchdog already had. Because GNU timeout exits 137 (128+SIGKILL) when the kill-after fires - versus 124 for a TERM expiry - the probe/mutate timeout detection now goes through a new fm_tasks_axi_timeout_expired helper that treats 124 and 137 alike, so the interrupted exit path still names the timeout as the reason; the helper keeps the bound check in one place. Added a behavior test in tests/fm-backlog-atomicity.test.sh that drives fm_tasks_axi through a real GNU timeout with a tasks-axi stub that traps and ignores TERM (the ignored disposition survives exec into sleep) and asserts a bound-expiry status plus completion within bound+grace; on the pre-fix code the suite hangs until killed, confirming the reproduction. Verified: fm-backlog-atomicity 87/87 ok, fm-transition-lib, fm-backlog-handoff, fm-spawn-batch, fm-task-delivery, fm-teardown, fm-secondmate-reconcile, fm-control-relaunch, fm-spawn-dispatch-profile, fm-captain-hold-lifecycle all pass; bin/fm-lint.sh clean
…3821) * docs: correct stale tmux/herdr backend maturity claims Herdr now has 21 test files, its own required CI job (tests-herdr) that installs a pinned build and hard-fails on "skip: herdr not found", while tmux has 3 test files and is only required as a dependency of the portable-serial e2e lane. zellij, orca, and cmux still have no CI lane at all. AGENTS.md and docs/herdr-backend.md still called Herdr merely "experimental" alongside those three, misleading every session and reader about actual coverage. Update AGENTS.md's config/backend entry, the opening lines of docs/herdr-backend.md and docs/tmux-backend.md, the runtime-backend section of docs/configuration.md, and the matching claims in docs/architecture.md, CONTRIBUTING.md, and README.md so they agree and distinguish tmux (default), herdr (own required CI lane, largest suite, Windows still spike-only), and zellij/orca/cmux (still experimental, no CI lane). No behavior, selection order, or dispatch logic changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GDYsWPEfwTuPNjQ2nGBCcj * no-mistakes(review): docs: fix stale herdr label and CI-lane wording * no-mistakes(document): docs: align tmux adapter label in scripts.md * no-mistakes(review): docs: drop duplicated herdr CI claim from tmux page * no-mistakes(review): docs: drop windows claim, align contributing backend wording * no-mistakes(review): docs: trim duplicated CI claim from herdr opening line * no-mistakes(review): docs: drop unguarded largest-test-suite superlative * no-mistakes(review): docs: restore tmux verified label and README experimental scope --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* fix: delete deterministic no-mistakes test baseline, restore intent-targeted Test PR kunchenguid#3644 pinned commands.test to a fm-test-run.sh --changed walk of the repository's 75-162 tests/*.test.sh scripts. no-mistakes runs commands.test verbatim and unconditionally after every fix round, so that walk multiplied by round count: measured at 32.7 minutes per validation versus 3.6 minutes intent-targeted. Delete the pin and restore the 3.6-minute posture. Add tests/fm-nm-test-contract.test.sh as a regression guard, parsing .no-mistakes.yaml as YAML (ruby's bundled Psych, matching the parser tests/fm-test-run.test.sh already uses for ci.yml) rather than grepping its text, restoring in legal form what PR kunchenguid#823 added and PR kunchenguid#1282 removed. Record the rule in docs/configuration.md's "Gate defaults" section (the authoritative owner CONTRIBUTING.md already points at) and strengthen CONTRIBUTING.md's existing local-Test guidance to state it plainly: never configure commands.test to a deterministic test command, complete or partial. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CSt9JvrQMVc4u3jPyUFCFC * no-mistakes(review): Centralize no-mistakes test policy and narrow guard --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* fix(bin): verify pool-slot ownership before returning a worktree slot Workers were killed when cleanup returned a Treehouse pool slot that a different, live task had already taken. Teardown now proves the slot is genuinely this task's before releasing it: it refuses when another task record claims the same live worktree path, or when the endpoint's working directory contradicts the recorded slot, and that refusal holds under --force. Slot allocation, metadata publication, ownership verification, and slot return are serialized across linked firstmate homes, and forced secondmate cleanup verifies descendant slot ownership before returning any child worktree. Regression coverage drives the scripts with two task records naming one slot path and asserts the live worker survives and its slot is not reset. * no-mistakes(review): Protect slots across cloned Firstmate homes * no-mistakes(test): Gate teardown locking on genuine Treehouse slots * no-mistakes(test): Clarify pooled descendant slot gating * no-mistakes(test): Synchronize watcher re-arm test on process exit * no-mistakes(test): Wait for watcher cleanup before timeout escalation * no-mistakes(document): Document pool-slot ownership safeguards * no-mistakes(ci): Fixed all reported CI issues: normalized bare local Git origins to the same Treehouse project-lock identity as absolute clone origins; resolved ShellCheck SC1091 with explicit conditional sourcing; and taught concurrent Herdr teardown coverage to retry expected Treehouse lock contention. Added behavioral regression coverage for bare/absolute origin lock identity. Verified endpoint-safety tests, watcher tests, full CI lint, and the previously failing Herdr teardown assertion * fix(bin): resolve relative origins from repository root * no-mistakes(ci): Fixed teardown so an exact recorded endpoint may change cwd without falsely vetoing cleanup. Removed cwd-based ownership refusal while preserving cross-home record exclusivity and project locking. Updated behavioral coverage for both foreign slot ownership refusal and moved-cwd teardown success. Endpoint-safety, backend, watcher, checkpoint, and targeted lint checks pass. Real Herdr presentation E2E progressed successfully but exceeded the 600s local timeout
…ndmate, and primary (kunchenguid#3867) * feat: add verified omp (Oh My Pi) harness adapter for crew, secondmate, and primary Add omp as a verified harness: anchored process-name detection with a Firstmate-owned FM_OMP_HARNESS launch marker that needs real omp ancestry, the fm-spawn launch template with foreign-marker clearing, the tracked .omp/fm-worker-overlay.yml posture overlay, --auto-approve, --cwd, and pre-launch model validation scoped to providers 'omp models --json' lists. Workers get a state-resident busy-state extension keyed on agent_end without willContinue (omp has no agent_settled). The primary gets two tracked .omp/extensions: a turn-end guard that answers omp's blocking session_stop hook by compelling one continuation per turn, with the pre-tool seatbelts and Run-tier session-start delivery, and a watcher extension ported from the Pi one with fm_watch_arm_omp. Control tables, composer busy footers, omp's status row as a bare-composer boundary, the extension supervision model with an omp-keyed ownership proof, the session-start diagnostic, and the supervision protocol snippet follow. Verified live on omp 18.1.11 with openai-codex/gpt-6-astra: a Herdr scout through spawn, busy state, steer, interrupt, exit, and teardown, and the isolated rpc primary lab through extension auto-discovery, digest delivery, lock identity, watcher arm, successor and wake delivery, and the compelled guard continuation. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AMyYaHU42Ltotn6fauPAh * test: prove the omp guard continuation through a guard spy Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AMyYaHU42Ltotn6fauPAh * fix(spawn): clear the gemini marker at the omp launch boundary Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AMyYaHU42Ltotn6fauPAh * test(omp): force the guard stage by freezing the watcher and clear lint findings Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AMyYaHU42Ltotn6fauPAh * test(omp): reap the live lab by path and record omp's rpc shutdown as a note Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AMyYaHU42Ltotn6fauPAh * test(omp): spawn a real secondmate for the discovery rule and classify the omp surfaces Replace the template-extraction check with a genuine --secondmate launch pinned to the fake tmux backend, assert the worker extension's handler set through the executable rather than its bytes, classify the two new omp surfaces in the documentation inventory, and record the Herdr worker evidence in the runtime-backends verification doc. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012AMyYaHU42Ltotn6fauPAh * no-mistakes(review): omp: unverify remote routes, narrow busy regex, drop overlay approval pin * no-mistakes(review): omp: validate config-pinned model, correct remote and marker docs * no-mistakes(review): omp: pin config-model validation with a test, trim overlay * no-mistakes(review): omp: sync guard evidence, drop dead param, map quota family * no-mistakes(review): omp quota: refuse unmapped prefixes, match bare model scopes * no-mistakes(document): docs: cover omp in cd-guard, quota, continuity, tmux * no-mistakes(document): docs: add omp subagent-guard row, fix live test header * no-mistakes(ci): Fixed both failing behavior shards and the Greptile P1 in bin/fm-composer-lib.sh. Root cause of "Behavior portable serial 1" and "Behavior portable parallel 2": the omp busy regex (FM_DELIVERY_OMP_BUSY_REGEX_DEFAULT) and omp status-row furniture regex (FM_COMPOSER_OMP_STATUS_RE_DEFAULT) used the bracket range [⠁-⣿]; BSD grep on macOS accepts it but GNU grep on Linux CI aborts with "Invalid collation character", failing every omp busy/furniture read (3 assertions across fm-omp-harness, fm-tmux-submit-busy, fm-composer-lib). Replaced the range with one shared explicit alternation FM_OMP_SPINNER_FRAMES_RE of omp 18.1.11's unicode-preset spinner frames (status set ⣾⣽⣻⢿⡿⣟⣯⣷ + activity set ⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏, read from the installed binary), the same pattern the Kimi busy regex already uses in CI. For Greptile's finding (the harness-agnostic furniture rule's first alternative matched any 1–4-byte token + ' · ', so wrapped typed input like 'fix · tests' with the cursor on it regressed from pending to unknown; reproduced locally vs base), pinned that alternative to omp's identity cell (π||pi, the icon.omp of each preset in the 18.1.11 binary). Tests: fm-composer-lib.test.sh asserts 'fix · tests' is not furniture, a status-set spinner row is furniture, and the wrapped composer screen reads pending under both locales (CAPS_TMUX cursor 3); fm-omp-harness.test.sh asserts a status-set frame reads busy. New negative cases fail against the pre-fix lib and pass after. Verified: fm-omp-harness, fm-tmux-submit-busy pass via bin/fm-test-run.sh; fm-composer-lib passes all cases except one pre-existing, unrelated local failure (Herdr half-block test uses printf '▀', unsupported by macOS bash 3.2; fails identically on a pristine HEAD export, passes on CI bash 5); shellcheck and bin/fm-lint.sh clean. Caveat: GNU grep is unavailable locally, so the Linux compile was not run directly; the fix uses only constructs already proven on CI's GNU grep (multibyte literal alternations, incl. under LC_ALL=C). Files changed: bin/fm-composer-lib.sh, tests/fm-composer-lib.test.sh, tests/fm-omp-harness.test.sh. No docs needed changes (they describe the rule generically) * no-mistakes(ci): Greptile Review: fixed. The omp status-row furniture regex FM_COMPOSER_OMP_STATUS_RE_DEFAULT in bin/fm-composer-lib.sh still accepted a literal `pi ·` opening, so wrapped composer input beginning with `pi ·` was truncated and misclassified. Read the installed omp 18.1.11 binary: the ascii preset's `icon.omp` is `pi` but its `sep.dot` separator is ` - ` (unicode/nerd use ` · `), so a real ascii status row never contains `pi ·` and that alternative could only ever match typed text. Removal-first fix: dropped `pi` from the identity alternation (now `(π|)`) and updated the comment to record why the ascii preset is excluded. Tests (tests/fm-composer-lib.test.sh): added a negative furniture case for 'pi · e · phi as the three constants' and a wrapped-screen assertion (CAPS_TMUX, cursor 3) that a continuation row opening `pi ·` reads pending in both locales; the new case fails against the unfixed lib and passes after. Verified: composer test with the half-block case skipped passes all 33 cases including the omp matrix; bin/fm-test-run.sh tests/fm-omp-harness.test.sh passes; shellcheck -x clean on both files; bin/fm-lint.sh clean. The full composer test via the runner fails locally only on the pre-existing half-block case (bash 3.2 printf cannot emit ▀; passes on CI bash 5), identical to before this change. Docs unchanged (they describe the rule generically and never mention the ascii identity cell). PR must be raised via no-mistakes: not caused by code. attestation.head_sha is cdddc60 while the PR head is cd51cf4 because the pipeline's ci-phase push moved the head; the outer executor's re-push will re-bind the attestation. No file change for that check. Files changed: bin/fm-composer-lib.sh, tests/fm-composer-lib.test.sh --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…#3843) * Fix Pi shell invocation on native Windows * no-mistakes(document): Document Pi Windows Bash transport * no-mistakes(ci): Captain, staged a narrow fix: register the Pi Windows regression for both extension paths, make Windows mode emulation non-failing, and enforce LF shell checkouts. Mapping and coverage checks pass; CI/Require no-mistakes were approval-gated externally * no-mistakes(review): Cover async Windows branch-outcome Bash invocation * no-mistakes(review): Preserve Cygwin checks and refresh Windows timing * no-mistakes(test): Invoke OpenCode operational-input owner through Bash on Windows * validation-fixture * no-mistakes(document): Document Windows Bash helper invocation * no-mistakes(ci): Fixed PR-caused changed-selection failure by removing the malformed tracked evidence artifact and allowing deleted, unconsumed source paths to retire cleanly while preserving fail-closed behavior for live unmapped paths. Added regression coverage. Verified native-Windows Pi shell-seam test passes and --changed selects the Windows regression --------- Co-authored-by: test <test@example.invalid>
…unchenguid#3870) * fix(bin): recognise squash-merged rebased work as landed at teardown A pipeline rebase can leave the local worktree on pre-rebase commits while GitHub squash-merges the rebased head. The landed-work test then compared those stale commits against a squashed main and refused cleanup of work that had already landed. When the forge reports the recorded PR merged and its merge commit is on the default branch, treat a local branch that only repeats paths from the pipeline push as stale rather than unlanded. If the forge is unreachable, the same coverage check runs against a PR head whose content is already on default. Extra local paths still refuse. * fix(bin): drop unprovable squash-rebase landed-work coverage Path-set coverage treated a diverged local branch as landed whenever it touched the same files as the squash merge. That accepts the reviewer's failing sequence: same path, different content, work discarded. git cherry and merge-tree containment were already too strict on the real rebase-fold case. No remaining check is both safe and permissive enough to recognise a stale pre-rebase copy without also accepting unlanded edits, so that case still refuses. Keep the proofs that hold: a merged PR head that contains local work, or a clean content-in-default tree match. Tests now refuse same-path different content and extra unlanded commits, and still allow a local branch that followed the pipeline rebase. * no-mistakes(review): drop recorded-pr-head fallback and reverted-design leftovers * no-mistakes(review): silence squash-merge stdout corrupting test PR head * no-mistakes(review): make unlanded follow-up commit sole cause of refusal * no-mistakes(document): correct stale squash-rebase fixture comments in teardown tests * no-mistakes(ci): Split the three reported checks: - CI (run 34061098467) and Require no-mistakes (run 34061098460) both concluded `action_required` — approval-gated workflow runs that never executed a step. Not caused by this PR's code; no change can clear them. - Greptile Review was a genuine defect in the new tests: the three new refusal cases (tests/fm-teardown.test.sh) asserted only exit status 1 and a REFUSED line, so a teardown regression that destroyed the worktree, branch, and task record before reporting refusal would still pass. Fix (tests only): added one `assert_refusal_retained_task_state` helper and called it from `test_squash_merged_same_file_different_content_refuses`, `test_squash_merged_rebased_local_with_unlanded_commit_refuses`, and `test_squash_merged_stale_local_refuses_when_forge_unreachable`, each capturing the worktree HEAD before `run_teardown`. It pins that the refusal left the isolated copy on disk, the task branch still checked out at the same unlanded commit, and state/task-x1.meta intact. Verification: the four squash tests pass; a sensitivity probe ran the ALLOW fixture (teardown completes) and pointed the same helper at the outcome — it fires, because a completed teardown detaches/deletes the branch and removes the task record, proving the assertions discriminate. Full tests/fm-teardown.test.sh: 83 passing. bin/fm-lint.sh clean with pinned ShellCheck 0.11.0 + actionlint 1.7.12 (plus an explicit --external-sources pass on the changed file). bin/fm-test-run.sh --check-coverage ok. Caveat: test_herdr_flat_teardown_preflight_refuses_before_changes (mode missing-adapter) fails on this machine. Verified it fails identically on base commit f91a950 via `git archive`, so it is a pre-existing local environment difference untouched by this diff; skipped to run the rest of the suite, not modified --------- Co-authored-by: Morten Gad <mogad@itm8.com>
…nguid#3860) * fix(bin): keep supervision armed for registered custom checks A custom check bound by bin/fm-check-register.sh only ever runs inside the watcher's check sweep, but fm_supervision_status counted in-flight tasks, the relay poll shim, and process-event sources as supervision need, and not registered checks. Tearing down the last task therefore stopped every home-level check silently until the next spawn. Count a state/<id>.check.sh that carries its state/<id>.check-trust binding as supervision need. The relay shim keeps its own trust path and task PR polls carry no such binding and are torn down with their task, so neither arms a home by accident. Presence of the binding is the whole test: the sweep validates the bytes at execution time and wakes firstmate when it rejects one, which is the outcome an idle home needs. Closes kunchenguid#3856 * no-mistakes(review): name registered checks in turn-end block banner and doc invariant * no-mistakes(review): narrow PR poll predicate test to what it proves * no-mistakes(document): point Grok re-arm step at supervision-need owner
…nguid#3883) * fix(bin): resolve the shared Treehouse project lock inside remote secondmate homes Every spawn and teardown inside a remote-seeded secondmate home refused, because the project lock's anchor could not be resolved there. fm_firstmate_root_home walks a home's parent bindings upward to find the anchor the lock lives in, and treated a remote parent binding as an error. A remote-seeded home's parent is on another machine, so that walk can never succeed from there - and neither can the home's own local descendants, whose chain terminates at the same record. Both fail closed on every Treehouse-backed spawn and every pool-slot teardown. A remote parent now terminates the walk at the home holding it, which is the correct anchor: a lock taken on this filesystem is neither held nor observable across that boundary, and that home is already the top of the local tree teardown's collect_local_firstmate_states enumerates, since that walk skips remote registry entries for the same reason. Mutual exclusion is unchanged - every home reachable through local parent links still derives one identical lock file per project, and an unreadable binding, an unsupported route, an unreachable local parent, a cycle, and an over-deep chain all still refuse. Origin-less local-only projects keep resolving through their worktree top. Regression coverage pins the anchor for the main-home layout, a local secondmate, a remote-seeded home, and its local child; drives teardown end-to-end in a remote-seeded home; keeps the cross-home slot-ownership refusal across that boundary; and proves two homes still serialize on the one shared lock file. * no-mistakes(document): Clarify machine-local Treehouse lock ownership
…enguid#5635) * fix(bin): let gate agents drive lifecycle against marked lab homes Part 2 of the kunchenguid#5615 split. A no-mistakes gate agent runs inside a checkout carrying the fleet-captain identity, so fm-gate-refuse-lib refuses fleet mutation on the gate signal. That refusal was absolute, which kept gate validation from ever exercising the real lifecycle. Stamp a disposable lab FM_HOME with a .fm-lab-home marker file that only bin/fm-lab-home.sh writes, and only onto a fresh empty dir, so no call path can mark a populated real home. fm_refuse_if_gate_agent then permits lifecycle only when FM_HOME carries the marker and is driven through its stock layout - any FM_*_OVERRIDE relocation stays refused so part of the "lab" cannot be split back onto the real fleet. The threat model is a confused agent touching the real fleet, not deliberate forgery, so the marker is a plain token file rather than a bound record. FM_GATE_REFUSE_BYPASS is unchanged: it still serves the test harness, which cannot mark hundreds of temp homes. Teardown's slot-ownership scan compared state-dir paths textually while fm_firstmate_root_home canonicalizes, so a lab home under a symlinked TMPDIR scanned its own record twice and self-collided; compare file identity (-ef) instead. * no-mistakes(review): Refuse unlistable lab homes and hardlinked slot records * no-mistakes(review): Mint lab markers only on verified-empty fresh dirs * no-mistakes(document): Clarify lab-home gate documentation and comment contracts * no-mistakes(document): Clarify lab-home gate documentation and remove stale claims * no-mistakes(document): Clarify gate lab-home documentation and boundary wording
…ad of refusing every re-arm (kunchenguid#5594) * fix(bin): replace a watcher whose beacon stalls past a hard bound instead of refusing every re-arm A fleet watcher that is alive but whose liveness beacon has gone stale could never be replaced: every re-arm was refused because the lock holder was a live pid, and the holder was never evicted because it was not dead. Add FM_WATCHER_STALL_BOUND (default 3x the stale grace): below it the refusal is unchanged; at or past it the arm re-verifies the holder against the lock's recorded identity, sends TERM, waits boundedly, and takes the lock the normal way, ledgering a stalled-holder-replaced row. A holder that survives TERM keeps the old refusal. Fixes kunchenguid#4400 * no-mistakes(test): poll for replacement message to fix watcher-lock test flake * no-mistakes(document): document FM_WATCHER_STALL_BOUND in config inventory
…n can keep them (kunchenguid#5563) * fix(pi): hide queued Firstmate notifications under Calm only when the session can keep them Calm now keeps authenticated Firstmate operational inputs out of Pi's queued-message listing, but only after proving the live session exposes every member needed to keep them across Escape. A session missing any of them keeps stock rows and Escape and shows one generic warning. Escape and the dequeue key return only captain-authored messages to the editor and re-queue hidden notifications in order; after an abort that kept any in Pi's agent queue, the adapter starts the delivery turn itself because Pi 0.87.1 does not continue an aborted run. Compaction-held notifications stay with Pi's compaction flush and never start or announce a turn. Fixes kunchenguid#1588 * docs(calm): record Pi 0.87.1 queued-row retention verification * no-mistakes(review): Deliver kept Calm notifications after tree-navigation aborts too * no-mistakes(review): Defer Calm notification turn until tree navigation finishes * no-mistakes(lint): Silence SC2016 for literal JavaScript in queue-retention e2e test
…uid#5548) * fix(bin): refuse teardown when a required source disappears A missing sibling was sourced after cleanup had started, so Bash 3.2 exited 0 from the EXIT trap and Bash 5 continued and reported success. * no-mistakes(review): Remove unused FM_TEST_ONLY hook from teardown tests * no-mistakes(review): Check task backend sources before any teardown cleanup * test(gotmp): give teardown fixtures every tmux adapter sibling Teardown now refuses when a sibling the recorded backend's adapter sources is missing, so the fake bin must carry fm-session-lock-lib.sh, fm-agent-process-lib.sh and fm-gemini-lib.sh.
Restructure the supervision host doc's prose into shorter sections, lists, and tables without changing documented behavior. Every original heading, anchor, identifier, number, quoted string, and link target is preserved.
* docs: make herdr-backend easier to read Restructure the Herdr backend doc's prose into shorter sections, lists, numbered procedures, and tables without changing documented behavior. Every original heading, anchor, fenced code block, link target, and documented fact is kept. * no-mistakes(document): Restore composer-proof reason and complete Herdr topic table
Restructure the prose into sections, lists, and tables without changing documented behavior. Every original heading and anchor, inline-code span, link target, number, and quoted string is kept, and each sentence sits on its own line. Adds a topic navigation table and short subsections under the existing headings.
* docs: make watcher-continuity easier to read Restructure the prose into sections, lists, and tables without changing documented behavior. Every original heading, anchor, identifier, link target, and number is kept. * no-mistakes(review): Fix actor and supervision-host scope in watcher-continuity doc * no-mistakes(review): Make readiness TERM and retry conditional on unready successor
* docs: make sessionstart-nudge easier to read Restructure the prose into sections, lists, and tables without changing documented behavior. Every original heading, inline-code span, link target, number, and fact is preserved, and a harness-to-tier table now sits near the top. * no-mistakes(review): Drop helm glossary line and dedupe exit-code lead-in
* docs: make captain-hold-lifecycle easier to read Restructure the captain-hold lifecycle prose into sections, lists, and tables without changing documented behavior. Every original heading, anchor, identifier, number, quoted string, and link target is kept. * no-mistakes(review): Fix verification record subjects and grouping headings * no-mistakes(review): Clarify task-body read-back cases belong to the suite
* docs: make remote-secondmates easier to read Restructure the remote second mates prose into sections, lists, numbered procedures, and tables without changing documented behavior. Every original heading, anchor, fenced code block, identifier, link target, and qualifier is preserved. * no-mistakes(review): Merge remote-home table cell into one sentence * no-mistakes(review): Tighten readiness lead-in, restore causal link, fix dangling reference
…nguid#5554) * fix(bin): bound the away digest and log why a delivery failed The away daemon joined every buffered escalation into one unbounded digest. A start-up catch-all span can exceed what one transport argument carries (tmux rejects the send-keys command; Linux refuses to exec any argument above 131,071 bytes, which is how herdr receives it), so the initial send failed on every housekeeping pass and was logged as an unconfirmed Enter with text possibly in the composer. escalate_flush now builds the injected digest under a fixed byte budget: each event is cut at a UTF-8 boundary with an omitted-bytes marker, the joined events stop with a "+K more event(s)" tail, and a bounded digest names a state/.subsuper-digests/ file that keeps every buffered event verbatim. The buffer itself is untouched, so the return catch-up stays complete. The tmux submit core and the herdr literal send now replay the transport's stderr on failure, and inject_msg logs the failing stage (initial send versus Enter confirmation) with the byte count and that stderr. The wedge alarm line and marker carry the last failure reason. Fixes kunchenguid#4382 * no-mistakes(review): Drop digest pruning; label send-failed as send-or-Enter stage * no-mistakes(review): Keep digest full text once submit ran; reuse on retry * no-mistakes(lint): Count digest files with find instead of ls --------- Co-authored-by: firstmate-oss <firstmate@kunchenguid.local>
…henguid#5638) * feat(tests): add FM_TEST_SEAM launch seam and gate lab-primary recipe Part 1 of the kunchenguid#5615 split: the pieces that let the no-mistakes pipeline live-validate firstmate changes, without the gate-refusal rescoping. - bin/fm-afk-launch.sh: FM_TEST_HARNESS pins the detected harness only alongside the FM_TEST_SEAM=1 marker test suites set, so a leaked variable in a real primary's environment stays inert and unknown tokens fall through to real detection. - tests/lib.sh: export FM_TEST_SEAM=1 for every suite. - .no-mistakes.yaml: per-harness recipe for running a real fixture primary from a gate run - a plain mktemp lab FM_HOME on a private tmux socket, with FM_GATE_REFUSE_BYPASS=1 scoped to it and NO_MISTAKES_GATE scrubbed. - tests/fm-wake-queue.test.sh: stop the owned watcher fixture with KILL and clear its lifecycle state so the next leg starts clean; TERM could leave bash waiting in a child on some runners. - tests/fm-remote-secondmate-lifecycle-e2e.test.sh: wait for the liveness lock holder's post-acquire marker instead of the lock dir, which is published before the claim finishes. * no-mistakes(review): Scrub lab home overrides and require FM_TEST_SEAM separately * no-mistakes(document): Clarify test seam and disposable lab bypass documentation * no-mistakes(document): Clarify lab isolation and test-seam documentation * no-mistakes(ci): Fixed the CI failure: test cleanup killed the remote worker child but left its supervisor able to restart it during fixture removal. Cleanup now stops the worker tree. The lifecycle test passed locally; ShellCheck and diff checks passed
… home is gone (kunchenguid#5552) * fix(bin): refuse watchers from disposable checkouts and exit when the home is gone Fixes kunchenguid#321 Fixes kunchenguid#4760 A watcher armed from a disposable no-mistakes validation checkout under .no-mistakes/worktrees/ outlived the validation step and kept writing the real home's state, and a running watcher never noticed when its home, state directory, or code root disappeared. The arm now refuses from such a checkout with the typed failure line, the watcher checks once per poll that its home, state directory (or its own lock holder record), and bin directory still exist and exits with a logged reason scoped to itself, and the shared test helpers reap every watcher a suite armed for a temporary home through the home-scoped stop. * no-mistakes(lint): fix SC1007 by assigning empty string in watch-arm test * no-mistakes(ci): Found and fixed a genuine, reproducible hang introduced by this branch's test-watcher reaper, which is what killed both CI checks (serial-2 cancelled at the 30-min cap; Lint 2 exit 143 = the suite's own TERM-trap code). Root cause: test_drain_asserts_watcher_liveness (tests/fm-wake-queue.test.sh) fabricates a .watch.lock whose pid is the test runner's own $$ with the runner's real identity, to make the drain believe a live watcher exists. The new make_case tracking registers that state dir for reaping, so at fm_test_cleanup the new fm_test_reap_watchers drives fm-watch-arm.sh --stop; its identity check matches (the fixture recorded the runner's identity) and it kill -TERMs the test runner. tests/lib.sh:231 is `trap 'fm_test_cleanup; exit 143' TERM`, so the TERM re-enters cleanup -> reap -> kills $$ again -> infinite loop until the runner cap. I reproduced this locally: the suite ran all tests then looped forever in cleanup spawning fm-watch-arm.sh --stop against a lock naming its own PID. Fix (tests/lib.sh, +5 lines): in fm_test_reap_watchers, skip any tracked lock whose pid equals our own $$ before driving --stop. This is the single shared reap boundary; seven $$-self-lock fixtures across four test files are all covered by the one guard, and real armed watchers (pid != $$) are still reaped. Invariant: the test reaper must only signal real armed watcher processes, never the test runner itself. Verified locally: tests/fm-wake-queue.test.sh -> EXIT 0 (63 ok, no hang); tests/fm-watch-arm.test.sh -> EXIT 0 (21 ok, including test_reaper_stops_a_tracked_watcher, confirming the guard does not over-skip). Lint 2's exit 143 was the same shard/cap signature; a fresh CI run on this new commit will re-evaluate it --------- Co-authored-by: firstmate-oss <firstmate@kunchenguid.local>
…m as silence (kunchenguid#5588) * fix(bin): surface an unrecognized status prefix instead of dropping it A parked or holding declaration, and a verb whose correlation token did not parse, never became an event, so the supervisor still saw the earlier line. * no-mistakes(review): Require verb-shaped unrecognized status prefixes, add continuation tests * no-mistakes(document): Document unrecognized status prefix escalation in afk skill * no-mistakes(ci): I reproduced the "Behavior portable serial 6" failure locally and fixed it by changing the test data in one test. No product code changed. **What failed:** `tests/fm-session-start.test.sh`, in `test_orphan_status_logs_are_printed`, with "matched status log was printed 2 times". **Why:** the test writes status lines with made-up prefixes, `matched: surfaced once` and `orphan: step N`. The test only uses them as placeholder text. It checks that the session-start digest prints each task's status tail exactly once. This PR (kunchenguid#4763) deliberately makes an unrecognized one-word lowercase prefix a status event. So those lines now surface as captain-relevant events, and the wake queue's STATUS OUTCOME BACKSTOP section prints them a second time. The code under review is behaving as the issue asks. Only the test's placeholder data had become meaningful. **Rule the test depends on:** its status lines must not be captain-relevant, so the digest is the only place they are printed. Both lines in this test broke that rule. The orphan line would have failed the same count check right after the matched line did. **Fix:** in that test only, I switched both lines to the recognized, non-captain verb `working:`: `working: surfaced once` and `working: orphan step 1..6`. I updated the matching assertions and counts to use the new text. What the test checks is unchanged: orphan logs are labelled, the tail is bounded, the log path is printed, and each tail appears once. **Verification:** before the fix, the test failed locally the same way as in CI. After it, `bash tests/fm-session-start.test.sh` reports "all assertions passed * no-mistakes(review): Detect unrecognized prefixes on unstamped lines; share verb list --------- Co-authored-by: Kun's firstmate <kunchenguid+firstmate@users.noreply.github.com>
…henguid#5658) Fixes kunchenguid#5295 Session start now reports a remote inheritance failure using the push's own error line instead of the first unchanged item that happened to print before it, and the shared captain preferences header check now names the first required phrase it did not find, on both the local and remote inheritance paths.
…yloads (kunchenguid#5657) * fix(bin): stand down the Claude Stop auto-arm on pi-code-delivered payloads pi-code loads the tracked Claude settings but has no asyncRewake, so it awaits every Stop hook; without a stand-down the auto-arm runs synchronously inside Pi's turn end and holds it open for the declared multi-hour timeout. Stand down when the payload's transcript_path contains a /.pi/ path component, the same discriminator the closed-but- unmerged fix in kunchenguid#3352 used, with an explicit string-type check on the jq filter. Fixes kunchenguid#3343 * no-mistakes(document): document pi-code stand-down in harness integrations reference
…kunchenguid#5659) * fix(bin): match whole multi-word project names in the registry lookup bin/fm-project-mode.sh matched a registered project name against only the first whitespace-delimited token of a registry row, so a name containing a space never matched, silently defaulting the project to no-mistakes off instead of its declared posture. The lookup now matches the whole registered name against the raw line text, so a name is compared literally (never as a regex) and a name that is a leading prefix of another registered name still resolves to its own row. * no-mistakes(document): docs already accurate for multiword registry name match * chore: drop accidental empty err file Co-authored-by: Kun Chen <kunchenguid@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Kun Chen <kunchenguid@users.noreply.github.com>
…d#5546) * fix(bin): classify the stdin program of `bash -s` with operands in the arm policy With -s, sh/bash/zsh read the program from stdin even when operands follow; the operands are only positional parameters. The arm policy treated the first operand as a script path, so heredoc and here-string payloads were never classified and a hidden bin/fm-watch.sh execution was allowed. A protected path in the operand position still fails closed as before. Fixes kunchenguid#1489 * no-mistakes(document): Clarify stdin shell operand documentation * no-mistakes(ci): Captain, fixed `shellInvocation` so `bash -- -s` treats `-s` as a script name, and updated R21 to test the exact command. The targeted policy suite, lint, documentation check, and diff check pass. Both hosted workflows show `action_required` before any jobs ran; that external approval state remains unresolved * fix(bin): keep main's handling of words after a leading `--` Revert the pipeline CI-step change that made the first word after a leading `--` always a script. It turned forms that main denies today into allow (for example `bash -- -c 'bin/fm-watch.sh'`), which is outside kunchenguid#1489 and loosens a fail-closed policy. `--` after `-s` still ends option parsing.
…o fork Third upstream catch-up, built on the validated second catch-up (fork PR #13, head 753bb79). Joins 174 upstream commits (869ae90..b805823) as one true merge; the recorded merge-base is the real semantic base 869ae90. Hand-resolved conflicts (19 files): - .github/workflows/no-mistakes-required.yml: adopt upstream's v1.80.1 pin and exempt-authors on both judging steps; keep the fork's rebind-wait fallback, because v1.80.1 reads the live body but does not wait for a post-push body rewrite to land. - AGENTS.md: upstream's draft-aware ready signal and named-head gate beside the fork's attestation recovery (reworded: checks now judge the live body); check-wake line carries both sides' poll results. - bin/fm-brief.sh: fork steer-ack reply adopts upstream's [at=<epoch>] stamp; upstream's corrections-only project-memory header. - bin/fm-send.sh: fork --ack guard and armed-ack discard on upstream's shfmt layout. - bin/fm-spawn.sh: fork freshen-from-primary signature on upstream layout. - bin/fm-watch.sh: upstream stalled-holder eviction measured on the fork's awake-time beacon age. - bin/fm-bootstrap.sh: upstream code-root note; fork's seven mutating sweeps. - bin/fm-test-run.sh: upstream's refreshed weight hints wholesale plus the fork-only dispatch-pickup row; both sides' family rows. - docs/configuration.md: fork's store_in_repo: false posture; stall bound documented in awake time. - docs/fm-test-portable-shards.md, docs/scripts.md, docs/verification/supervision.md, docs/watcher-continuity.md: upstream structure with every fork fact re-homed. - tests/lib.sh, tests/fm-claude-stop-autoarm.test.sh, tests/fm-watcher-lock.test.sh, tests/fm-pr-check-security.test.sh: both sides kept. - tests/fm-backlog-atomicity.test.sh, tests/fm-secondmate-liveness.test.sh: upstream's portable fm_run_timed backstop and pinned server-running probe supersede the fork's Darwin-only workarounds. Also: tests/fm-no-mistakes-required.test.sh follows the workflow pin to v1.80.1; tests/fm-steer-ack.test.sh covers the stamped ack reply.
…ssing bin/fm-decision-wait.sh ran a bare tasks-axi from FM_HOME, so a home whose data directory lives elsewhere scanned a different (usually absent) backlog and its once-daily digest never surfaced that home's captain holds. Route the scan's backlog reads through bin/fm-tasks-axi.sh, the addressing owner every other firstmate backlog command now uses, and pin the relocated-data case with a regression test.
…rd packing The fork adopted upstream's v1.80.1 require-no-mistakes pin, which judges the PR's live body at run time instead of the body the triggering event carried. Update CONTRIBUTING.md and the rebind-wait helper header to that verdict; the wait-and-re-judge fallback and every recovery step are unchanged. Record that the seven fork-only serial suites fill every portable serial shard to the 11m38s floor in this fork.
Upstream 756f64e (kunchenguid#5548) made fm_backend_source prove each adapter's sibling libraries readable by looping over an unquoted space-separated string. zsh does not word-split unquoted expansions, so from an interactive zsh session (the macOS default shell) the whole list read as one missing path and every known backend refused to load; tests/fm-backend.test.sh's zsh case fails on any host with zsh, which Ubuntu CI runners lack. Pass the sibling names as separate arguments instead, keeping the adapter-then-siblings check order and the refusal for a missing or unreadable file.
tests/fm-contributions.test.sh runs a real watcher over a recorded pr= with a fake forge that serves only the contribution observer, so the fork's recorded-PR reconcile sweep queued its offline diagnostic and won the single wake; hold that sweep inside its hourly throttle, as tests/fm-pr-check-security.test.sh already does. tests/fm-gate-refuse.test.sh's lab-home helpers meant to run with no FM_*_OVERRIDE but listed only upstream's, so tests/lib.sh's FM_SYSTEM_WAKE_EPOCH_OVERRIDE=0 leaked in and upstream's lab permit (kunchenguid#5635) read it as a relocated layout; unset every inherited FM_*_OVERRIDE instead.
Upstream b42d4fa (kunchenguid#5566) stands up a live claim holder with setsid(1), which stock macOS does not ship, so the case failed before reaching its contract on Darwin hosts. Use the Perl setsid idiom the same suite already uses, which likewise execs in place so $! stays the sleeper's pid.
…ture Upstream's parked-gate opt-in case proves an unconfigured home never reaches the wedge timer's evidence path by counting every current-state read during three escalations. The fork's completion alarm reads each live task's current state on its own cadence, so its first sweep landed in that count. Hold the sweep inside its pacing in the shared wedge fixture, keeping the armed and unarmed fixtures identical apart from the flag.
The watcher digest phases gave the watcher a fixed 2.5s liveness window before reaping it and asserting what its sweep wrote. Under fork-heavy load the watcher's startup outruns that window: the marker is touched before the scan, so the record assertion failed with 'hold:dec-a' missing. Wait while the watcher stays alive for the sweep's last write (the wait record appearing, or the cleared wait dropping), then keep the original liveness window so the negative digest and marker checks keep their strength. Under 24 fork-looping hogs the old test failed 7 of 12 runs and the new one passed 12 of 12.
f60b1ab held the fork's completion-alarm sweep out of the shared wedge fixture by touching state/.last-completion-scan once, which only holds for the 45s default FM_COMPLETION_SCAN_INTERVAL. The parked-gate cases run three wedge_threshold_round calls, and once they outlast that interval the sweep's current-state read lands in the probe count and 'an unarmed home spent N current-state read(s)' fails. With the interval shortened to 2s the old test fails exactly that way. wedge_threshold_round now also passes FM_COMPLETION_SCAN_INTERVAL=999999 beside FM_CHECK_INTERVAL and FM_HEARTBEAT, so no case length makes the sweep due. The fixture keeps its fresh marker touch, because a missing marker reads as due at any interval.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Third upstream catch-up for this fork (adonis-garcia-git/firstmate), superseding the stale fork PR #13 (#13). Supersedes #13. Firstmate closes #13; this PR does not.
Built on #13 rather than redoing its weaving: the branch was reset to #13's validated head 753bb79 (a true merge of upstream kunchenguid/firstmate main at 869ae90 with 15 hand-woven files and its post-merge test and doc commits), then current upstream main at b805823 was merged on top as ONE true merge commit (45cdded, parents 753bb79 and b805823) - 174 upstream commits since 869ae90, never rebased, squashed, or forced. The recorded merge-base is the real semantic base 869ae90. All 26 fork-side commits of #13's lineage stay reachable unchanged (the 21 fork-local commits #13 preserved, #13's merge 15bae7e, and its four post-merge commits cba62c3, dcbb4f6, 8c587e5, 753bb79).
Fork contracts and standing accepted decisions that must survive (from #13's Intent): remote-less freshen-from-primary spawn, wake awake-time clamp, backlog automatic-transition gate, required-workflow attestation fallback, pr-reconcile, dispatch-pickup, head-bound attestation recovery, completion alarm, steer-ack, decision digest; upstream-inherited prose is exempt from the one-sentence-per-line rule and must not be rewrapped or re-flagged; upstream commits are preserved verbatim including their trailers, with the no-co-author rule governing fork-authored commits only; plain dashes in fork-authored prose. Where upstream now ships its own version of a fork-only feature, prefer upstream's and drop the fork duplicate only if it fully covers the fork contract, saying so explicitly.
Per-file conflict accounting for the new merge (19 hand-resolved files; every other both-changed file auto-merged, and a side-added-line audit over all 45 both-changed files confirmed every dropped line is an intentional rewording, reformat, or supersession):
done [at=<epoch>]ready signal and fm-dod-lib named-head gate beside the fork's attestation-recovery paragraph, whose first two lines are reworded because checks now judge the live body; the check-wake line carries both sides (recorded PRs found merged or closed externally, contribution signals, dispatched work, decision-digest) plus upstream's secondmate auto-relaunch and inbox-reply sub-lines. Upstream's contributions observer wakes only on maintainer comments/reviews and label transitions, not merged/closed state, so it does not cover pr-reconcile and both stay.resolved [key=ack-{token}] [at=<epoch>]: starting ...; the detector matches the key anywhere on the line); upstream's corrections-only project-memory header.Also in the merge commit: tests/fm-no-mistakes-required.test.sh follows the workflow pin to v1.80.1, and tests/fm-steer-ack.test.sh covers the stamped ack reply.
Post-merge commits, all to be preserved: (a) 4801d7a fix(bin): bin/fm-decision-wait.sh reads backlog holds through upstream's new bin/fm-tasks-axi.sh addressing owner instead of a bare tasks-axi from FM_HOME, so a home whose data directory lives elsewhere still surfaces its captain holds in the daily digest (reproduced first: relocated-data scan reported 0 waiting with a hold present; regression test added) - this closes the follow-up #13's review noted. (b) 99102a1 docs: CONTRIBUTING.md and the rebind-wait helper header describe the v1.80.1 live-body verdict; docs/fm-test-portable-shards.md records that the seven fork-only serial suites fill every serial shard to the 11m38s floor. (c) 2546fb2 fix(bin): upstream 756f64e (kunchenguid#5548) made fm_backend_source loop over an unquoted space-separated sibling list, which zsh does not word-split, so sourcing bin/fm-backend.sh from zsh (the macOS default shell) refused every known backend; tests/fm-backend.test.sh's zsh case fails on any host with zsh (Ubuntu CI has none). Sibling names are now passed as separate arguments, keeping the adapter-then-siblings check order and the refusal for a missing or unreadable file. (d) dfba4ac test: tests/fm-contributions.test.sh holds the fork's recorded-PR reconcile sweep inside its hourly throttle (its fake forge serves only the contribution observer, so the sweep's offline diagnostic won the single wake), as tests/fm-pr-check-security.test.sh already does; tests/fm-gate-refuse.test.sh's lab-home helpers unset every inherited FM_*_OVERRIDE, because tests/lib.sh's FM_SYSTEM_WAKE_EPOCH_OVERRIDE=0 leaked in and upstream's lab permit (kunchenguid#5635) read it as a relocated layout. (e) 70db909 test: tests/fm-procevent.test.sh starts its draining claim holder with the suite's own Perl setsid idiom because stock macOS ships no setsid(1) (upstream b42d4fa, kunchenguid#5566). (f) f60b1ab test: tests/fm-watch-triage.test.sh's shared wedge fixture holds the fork's completion-alarm sweep inside its pacing, because upstream's unarmed parked-gate case counts every current-state read and the completion alarm's routine sweep landed in that count; docs/configuration.md scopes its "no current-state read" claim to the wedge timer, so it stays true. (g) ef5a070 test: tests/fm-decision-wait.test.sh's watcher digest phases waited a fixed 2.5s liveness window before reaping the watcher and asserting its sweep's writes; under fork-heavy load the watcher's startup outran it (the marker is touched before the scan, so 'the anchoring sweep must still record the wait' failed with 'hold:dec-a' missing). The first and last phases now wait, while the watcher stays alive, for the sweep's own last write (the wait record appearing, or the cleared wait dropping), then keep the original liveness window so the negative digest and marker checks keep their strength; under 24 fork-looping CPU hogs the old test failed 7 of 12 runs and the new one passed 12 of 12. (h) d81a972 test: review of ef5a070 found that (f)'s one-time state/.last-completion-scan touch only holds the completion-alarm sweep for the 45s default FM_COMPLETION_SCAN_INTERVAL, so parked-gate cases whose three wedge_threshold_round calls outlast it let the sweep's current-state read land in the probe count ('an unarmed home spent N current-state read(s)'). wedge_threshold_round now also passes FM_COMPLETION_SCAN_INTERVAL=999999 beside FM_CHECK_INTERVAL and FM_HEARTBEAT, and the fixture keeps its fresh marker touch because a missing marker reads as due at any interval; with the interval shortened to 2s the old case fails exactly that way and the new one passes.
Testing already done locally on this Darwin host (macOS, stock Bash 3.2 and Bash 5, zsh 5.9; CI-equivalent tools supplied from a scratch prefix: tmux 3.7c, tasks-axi 0.2.6, the public Pi package 0.87.1 with tsc, pinned ShellCheck 0.11.0 and actionlint 1.7.12): lint partitions 1of2 and 2of2 green; bin/fm-test-run.sh --check-coverage ok (238 suites, 9 serial shards); bin/fm-doc-audience-check.sh ok (110 surfaces, 625 local links); 21 targeted fork-contract suites green (spawn freshen-from-primary, steer-ack, watcher-lock, no-mistakes-required at v1.80.1, attestation-rebind-wait, pr-reconcile, pr-check-security, dispatch-pickup, completion-alarm, decision-wait, secondmate-liveness, claude-stop-autoarm, turnend-guard, brief, send-inbox/strict/resolve-key, bootstrap, test-toolpath, lint, lint-workflows); portable-parallel-1 11/11 and portable-parallel-2 13/13 green with zero gate skips; portable-serial 198 suites with 5 failures, each fixed by (c)-(f) and re-run green standalone (fm-backend, fm-gate-refuse under Bash 5 and 3.2, fm-contributions 38 cases, fm-procevent 131 cases, fm-watch-triage 136 cases). fm-watch-triage was then run to completion under tasks-axi 0.2.6 at f60b1ab: exit 0, 136 ok, 0 not ok (the earlier held-delivery fixture failure was this host's older tasks-axi 0.2.5, below FM_TASKS_AXI_MIN). fm-decision-wait is green unloaded and under load after (g). After (h), the full fm-watch-triage suite ran to completion at d81a972 under tasks-axi 0.2.6: exit 0, 136 ok, 0 not ok. Disclosed skips: 33 serial gate-skipped live/e2e suites needing real harness binaries, logins, or backends not installed here (afk-pi-herdr-return, agy/devin/muse/rovo signals, cmux and zellij smoke, calm-claude-mod, claude-stop-autoarm, cmux-claude-composer, codex continuity and hook-layer, composer codex-idle and matrix, cursor/omp/opencode/pi primaries, grok continuity and stop, harness-adapter instructions, herdr submit-confirm, launch-prompt signals, pi-branch live, pi-codex-native, pi-windows-shell-invocation, pr-state live, quota-array-dispatch live, send-inbox doorbell live, send-secondmate-marker herdr, sessionstart hook and instruction-refresh, supervision-host live), and the 16-suite real-herdr-gated lane, which needs the pinned real Herdr and has its own required CI lane. The secret-scanner flags on staged merge content are all synthetic upstream test fixtures already public upstream (e.g. tok-dotenv, test-only, fixture SHAs).
Constraints: nothing under projects/, data/, state/, config/, .env, or .no-mistakes/ is tracked or touched; bin/fm-test-run.sh --check-coverage, bin/fm-doc-audience-check.sh, pinned ShellCheck 0.11.0 and actionlint 1.7.12 stay green. Local no-mistakes Test stays intent-targeted, not a full tests/*.test.sh walk: the full portable lane composition already ran locally on this Darwin host with disclosed skips (see the Testing section).
What Changed
mainat b805823 (174 commits). This brings in the agy, devin, gemini, omp, and rovo harness adapters, the supervision host (bin/fm-supervision-host.sh), the Claude calm mod, and the mail plane (bin/fm-mail*.sh). It also brings in secondmate restart, parent channel, and liveness libs, the fleet ledger, contributions, PR state, and PR reviewer observers, dispatch resolution, worker accounts, andbin/fm-tasks-axi.sh. Wider Herdr/tmux backend, watcher, procevent, teardown, and spawn changes come with it, along with the matching docs, skills, and tests.no-mistakes-required.ymlmoves to upstream's v1.80.1 pin but keeps the fork's rebind-wait fallback. The steer-ack reply now uses upstream's[at=<epoch>]stamp. The watcher's stalled-holder eviction (FM_WATCHER_STALL_BOUND) is measured on the fork's awake-time beacon. The fork's pr-reconcile, decision-digest, and dispatch-pickup rows sit alongside upstream's new entries inAGENTS.md,bin/fm-bootstrap.sh,bin/fm-test-run.sh, and the docs. The fork's Darwin-only test workarounds are dropped because upstream's portablefm_run_timedbackstops cover them.bin/fm-decision-wait.shnow reads captain holds throughbin/fm-tasks-axi.sh, so a home whose data directory lives elsewhere still shows its holds in the digest.bin/fm-backend.shpasses sibling backend names as separate arguments, so sourcing it from zsh works again.fm-contributions,fm-gate-refuse,fm-procevent(nosetsid(1)on macOS),fm-watch-triage(keeps the completion-alarm sweep out of the wedge rounds), andfm-decision-wait(waits for the sweep's own write).🤖 Generated with Claude Code
Risk Assessment
Testing
I ran the targeted suites for the post-merge fixes under tasks-axi 0.2.6 at d81a972: watch-triage, backend under zsh, decision-wait, procevent, gate-refuse, contributions, steer-ack, and no-mistakes-required pinned at v1.80.1. All exited 0. The full fm-watch-triage suite finished with 136 passing cases and none failing, including the parked-gate case that (h) targets. A before/after zsh run of fm_backend_source shows fix (c) working.
Evidence: fm-watch-triage full run (tasks-axi 0.2.6, d81a972): EXIT=0, 136 ok
Evidence: zsh fm_backend_source before/after fix (c)
== 2546fb2~1: tmux: REFUSED / bogus: refused == HEAD: tmux: accepted / bogus: refusedEvidence: fm-decision-wait log
Evidence: fm-backend log
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
✅ No issues found.
✅ **Test** - passed
✅ No issues found.
bash tests/fm-watch-triage.test.shwith tasks-axi 0.2.6 at d81a972 (EXIT=0, 136 ok, 0 not ok)bash tests/fm-backend.test.sh(includes the zsh case)bash tests/fm-decision-wait.test.shbash tests/fm-procevent.test.shbash tests/fm-gate-refuse.test.shbash tests/fm-contributions.test.shbash tests/fm-steer-ack.test.shbash tests/fm-no-mistakes-required.test.shManual: sourced bin/fm-backend.sh underzsh -cfrom 2546fb2~1 and from HEAD, then calledfm_backend_source tmuxandfm_backend_source bogus✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.