fix(bin): safely repair legacy Herdr endpoint bindings

[mcordovaforus]

Intent

Recover the legacy retirement path for the completed dpf-monitor-catalogo-permisos-audit work safely. The captain withdrew further catalog and IAM work and wants the obsolete record retired, but fm-teardown correctly refuses because the legacy Herdr metadata lacks an exact task binding. Do not bypass that refusal, use --force, delete state by hand, kill a pane, change GCP IAM, or alter data-platform project material. Provide the narrowest firstmate-only recovery capability that permits binding repair only after positive identity proof, fails closed on every ambiguous legacy binding, and never infers a target from a label, shared workspace, or stale pane identifier. Preserve every report, branch, commit, and captain-held decision; both captain-held decisions are now durably answered and remote archival of the six commits is separately authorized and being handled by another worker, but do not repair or retire the live legacy record until that worker proves the remote archive. This work is limited to validating and shipping the safe mechanism with tests and documentation through a PR; it does not authorize Herdr lifecycle controls or the actual retirement.

What Changed

• Add a fail-closed command to repair the missing task binding on positively proven legacy Herdr records, without performing lifecycle actions or retirement.
• Guard the repair command in gate contexts and register its focused backend-dispatch test coverage.
• Document the supported recovery path and its identity-proof requirements.

Risk Assessment

✅ Low: Captain, the change is narrowly scoped to metadata binding, requires concrete live and durable identity evidence, and preserves all lifecycle retirement gates.

Testing

Reviewed the target diff, ran the focused repair regression suite, and captured end-to-end CLI evidence of a successful metadata-only binding repair (with report, captain-held status, commit, and worktree preserved) plus the outside-CWD gate refusal; all targeted validation passed.

Evidence: Successful metadata-only repair transcript

Successful repair CLI output:
repaired endpoint task binding for legacy-task; no lifecycle action was performed

Metadata change (only the missing binding):
--- /private/var/folders/8q/s7sl96nn6mg9vp5_6t335qqr0000gp/T/manual-repair-evidence.YOQNBA/meta.before	2026-08-22 17:48:53
+++ /private/var/folders/8q/s7sl96nn6mg9vp5_6t335qqr0000gp/T/manual-repair-evidence.YOQNBA/home/state/legacy-task.meta	2026-08-22 17:48:54
@@ -8,3 +8,4 @@
 herdr_workspace_id=w1
 herdr_tab_id=w1:t2
 herdr_pane_id=w1:p2
+endpoint_task_id=legacy-task

Herdr runtime calls (read-only identity proof):
pane get w1:p2 --session lab
pane get w1:p2 --session lab

Preservation checks:
report=preserved
captain-held-status=preserved
worktree-commit-and-status=preserved

Evidence: Outside-CWD gate-path refusal transcript

error: refusing fleet lifecycle from inside a no-mistakes gate worktree (/Users/M-matiascordova/.no-mistakes/repos/5e4f0607c2e2.git)

exit=3

- Outcome: 🔧 1 issue found → auto-fixed ✅ across 2 runs (10m31s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

🔧 **Test** - 1 issue found → auto-fixed ✅

• 🚨 bin/fm-repair-legacy-endpoint-binding.sh:71 - The no-mistakes Git-path backstop is caller-directory dependent. At line 71, the new command calls fm_refuse_if_gate_agent without an anchor, so after NO_MISTAKES_GATE is removed, running it from the gate worktree exits 3 but cd-ing elsewhere lets it advance past the guard (the probe reaches the later missing-metadata refusal). This violates the required no-bypass/fail-closed boundary. Anchor the check to $FM_ROOT and add a regression case that removes the env marker and invokes the command from outside the gate worktree.
• git diff --stat 1231b6ae7fd4c5ff7e94d2f5ca2159536c4c41cb 0b93ad587b9077683b184915121338e760a97238 and targeted source/test inspection
• bin/fm-test-run.sh tests/fm-repair-legacy-endpoint-binding.test.sh --json /var/folders/8q/s7sl96nn6mg9vp5_6t335qqr0000gp/T/no-mistakes-evidence/01M0NPEKCM6RMNZ4AF066RY7R5/focused-test.json
• Direct gate-context probe with NO_MISTAKES_GATE and FM_GATE_REFUSE_BYPASS unset, executed once from the gate worktree and once after changing to the evidence directory

🔧 Fix: Anchor legacy repair gate backstop
✅ Re-checked - no issues remain.

• tests/fm-repair-legacy-endpoint-binding.test.sh
• Manual isolated legacy-record fixture invoking bin/fm-repair-legacy-endpoint-binding.sh legacy-task with two exact read-only Herdr pane responses
• Outside-CWD gate-path probe with NO_MISTAKES_GATE unset and FM_ROOT_OVERRIDE anchored to this gate worktree

✅ **Document** - passed

✅ No issues found.

⚠️ **Lint** - 1 warning

• ⚠️ linter found issues (exit code 1)

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (3): Last reviewed commit: "no-mistakes: apply CI fixes" | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

VISION: aligns. New capability ships as an option: captain must invoke bin/fm-repair-legacy-endpoint-binding.sh. Authority is never inferred (labels, shared workspace, stale pane id are not proof). Evidence is never authorization: two read-only herdr pane get samples plus durable identity, then metadata-only publish. Scripts stop safely and refuse on every ambiguous binding. Does not perform teardown, kill a pane, or change project material. Gate-refuse is sourced and anchored to the script checkout, not FM_ROOT_OVERRIDE.

Class: opt-in. Corrective recovery command, not default-on lifecycle.

Security: none after review. Fail-closed; atomic metadata rename; no bin/backends/herdr.sh edit; no spawn/teardown; no credentials. Greptile's caller-controlled gate note was addressed by anchoring fm_refuse_if_gate_agent to SCRIPT_ROOT.

Overlap / HOLD named: Herdr conceptually overlaps open hold-pair #2637 (bin/backends/herdr.sh, bin/fm-spawn.sh, bin/fm-teardown.sh) and open #2792 (bin/backends/herdr.sh). This diff does not edit herdr.sh, fm-spawn.sh, or fm-teardown.sh — binding repair vs spawn/teardown, files disjoint. Coordinator decides whether that disjointness is enough to land beside the pair later. Also overlaps bin/fm-gate-refuse-lib.sh comment-only.

CI: HEAD 3687877220f8aa17ffe5372ee0ac55ae1d78fd0e. mergeable MERGEABLE, mergeStateStatus UNSTABLE. ahead 4 / behind 0. Fork CI 32601142602 in_progress (approved earlier this pass, not green). Require no-mistakes / body-compliance 32601142607 FAILURE. No structured no-mistakes-pipeline-attestation:v1 whose head_sha matches THIS HEAD — no-mistakes is blocking. Greptile SUCCESS — not a gate.

Workflows approved: yes (CI 32601142602, NM 32601142607). Land-eligible: NO this pass. Waiting on CI; matching NM attestation still required from the author. Not waiting on the captain. Captain-flag NOW: no.