feat: extend opt-in away supervision to non-Pi primaries - #5503
Merged
Merged
Conversation
… while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host.
…ch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five.
A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it.
A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running.
…acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff.
…mp session replacement
…OINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
mituso89
pushed a commit
to mituso89/firstmate
that referenced
this pull request
Sep 26, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
mehulbhagwani
pushed a commit
to mehulbhagwani/firstmate
that referenced
this pull request
Sep 26, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
mehulbhagwani
pushed a commit
to mehulbhagwani/firstmate
that referenced
this pull request
Sep 26, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
mehulbhagwani
pushed a commit
to mehulbhagwani/firstmate
that referenced
this pull request
Sep 27, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
mehulbhagwani
pushed a commit
to mehulbhagwani/firstmate
that referenced
this pull request
Sep 27, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
mehulbhagwani
pushed a commit
to mehulbhagwani/firstmate
that referenced
this pull request
Sep 27, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
RooseveltAdvisors
pushed a commit
to RooseveltAdvisors/firstmate
that referenced
this pull request
Sep 29, 2026
…#5503) * feat(bin): run the supervision host beside the other non-Pi primaries while away Cursor's stop-hook park, the OpenCode plugin, the omp watch extension, Grok's model-owned background arm, and Codex's foreground checkpoint now run bin/fm-supervision-host.sh in the watcher arm's place when the home opted in with config/supervision-host, so the host's Claude engine takes away-posture wakes beside those primaries exactly as it does beside Claude. Without the file nothing changes. - The host streams its first cycle's status line, accepts --restart and the owner's predecessor arm for its first cycle, and prints each exit in one write, so owners that wait for arm readiness and restart their own successor (OpenCode, omp) keep their handling handoff. - Codex's checkpoint passes its bound to the host as the park boundary, raises it to FM_CODEX_WATCH_CHECKPOINT_AWAY (3600 s) while the away record exists, and lets an engine turn that starts before the bound finish after it (FM_SUPERVISION_HOST_PARK_LIMIT). - /afk launches no away daemon on an opted-in home of those harnesses and says so at entry when the file selects no engine for that primary. - Session start renders the host protocol for each arm owner, and Grok's arm command becomes the host. * fix(bin): keep the watcher-down banner away from the supervision branch actor A supervision host's engine turn runs guarded commands after its successor watcher cycle may already have closed on a newer wake, so the guard showed it the watcher-down banner with the primary's repair line. Under a Codex primary pin that line is the checkpoint, and a live Codex lab run showed the away session running it mid-turn (the nested host stood down on its ownership check). The branch actor never owns watcher continuity, so the banner, its reminder, and the episode state now leave that actor out, as the queued-wake warning already does. The lint telemetry fixture counts bin/fm-afk-launch.sh's source directives, which the host engine note raised from four to five. * fix(bin): queue away-session outcomes recorded after the return for main A Cursor park superseded by the captain's return stops its host as the engine turn ends, so the host's own handoff of that turn's outcomes was never printed and the outcomes never reached main. The report surface now queues every outcome it records after the away record is gone as a durable check wake; the return owner archives the record before it reads the store, so each outcome is in the return brief, queued, or both. A host stopped mid-turn also removes its turn's result and error files. The stream test now acknowledges its first close and accepts a restarted cycle that closes on its resurface before the arm confirms it. * fix(bin): clear a hard-killed host's turn at the next activation A Cursor park superseded mid-turn can kill its host outright, which runs no cleanup, so the turn's result, error, and descendant files stayed behind and any tool process the engine started was left running. The next host's activation now reaps the descendants that turn recorded and removes its files. The host suite also registers its homes in a file, because make_home runs in a command substitution, so its cleanup now stops every host a case leaves running. * fix(bin): leave rows that arrive after main's drain unclaimed at its acknowledgement Main's acknowledgement re-claimed every unreserved queued row, including one that arrived after the drain above the acknowledged cutoff. That row stayed main's without ever being shown to it, so while away the supervision host refused every later wake that included it and handed each back to main until main drained again. The acknowledgement now claims only unreserved rows at or below its cutoff. * docs: name the killed turn's engine and files in the host's failure direction * docs: record live supervision host runs on the non-Pi primaries * no-mistakes(review): Replay host-only supervision boundaries across omp session replacement * no-mistakes(review): Deliver omp supervision-host wakes only at the host's close * no-mistakes(document): Correct supervision host documentation for non-Pi primaries * no-mistakes(ci): Fixed the CI failure by naming FM_CODEX_WATCH_CHECKPOINT_AWAY in the rendered Codex host instructions. The focused instruction and checkpoint suites pass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
yes
(to: merge #5488 and start 3b on Opus)
Standing words for this AFK revamp: "2 should be done by opus crewmates" and "start on opus now - i will reset my quota if it gets close to running out. this is a major architectural revamp so i want it to do very careful live validation including regression in isolated live environments with some real complex sessions before calling it done. it's ok to use my real llm tokens here"
The end state the captain expects, in his words: "non-afk mode gains pi-like supervision session which offloads main session work. in afk mode it activates a different posture where everything goes to supervision session". The approved plan (data/fm-afk-slices23-plan-s1/report.md) gets there in rungs: 3a (merged as 5488) built the supervision host with the Claude engine handling away wakes behind a default-off config/supervision-host flag; this task is rung 3b: the other five non-Pi harness arm owners (Cursor, OpenCode, omp, Grok, Codex) run the host under that same flag while away, including the Codex checkpoint bound while away. Attended posture and /quiet (3c), the default-on flip (3d), and daemon retirement (3e) come later.
The approved plan's rung 3b item, by reference: "the other five harnesses under away ... Each arm owner swaps its arm command for the host under the same flag; Codex's checkpoint bound; protocol docs under
docs/supervision-protocols/."What Changed
config/supervision-hostis present, while leaving/quietand unconfigured homes on their existing paths.Risk Assessment
Testing
Live validation before this run
Before validation, the flag-on path was driven live in isolated lab homes on private tmux sockets, with real primaries supervising real workers through attended work, an away window, a pre-answered decision, a named steer, a stopped worker, lease contention, the park boundary, and a return during an engine turn.
Codex, Cursor, Grok, OpenCode (on OpenCode's free
opencode/big-pickle, because this machine's OpenAI login rejectsgpt-5.6-soland has exhaustedgpt-5.5), and Claude primaries all ran through the host while away, and Codex, Cursor, and Grok also ran flag-off regression pairs against the tree before this change with identical results.omp was not live-tested: it is not installed on the measuring machine, so its routing rests on
tests/fm-omp-harness.test.shalone.The dated record, with versions, per-case results, costs, and the before/after live guard table, is docs/verification/supervision.md, "Non-Pi primaries".
The AFK-launch and omp suites the pipeline's test run could not credit under Pi ancestry pass from a non-Pi shell at
1bf367f4(tests/fm-omp-harness.test.sh14 of 14,tests/fm-afk-launch.test.sh77 of 77).Pipeline test run
The focused host, checkpoint, Cursor, instruction, and wake checks passed; a real Claude engine handled and resumed two away wakes, and real Codex completed a foreground checkpoint. AFK-launch and omp fixture suites were confounded by the invoking Pi ancestry. No real opt-in session was driven for the five new primary arm owners; the working tree is clean.
FM_CODEX_LIVE_E2E=1 tests/fm-codex-continuity-live-e2e.test.shcompleted its real Codex checkpointEvidence: Real host-engine turns and recorded branch outcome
Source: Real host-engine turns and recorded branch outcome
Evidence: Focused checks and Pi-ancestry failures
Source: Focused checks and Pi-ancestry failures
Evidence: Repeat with Pi environment variables removed
Source: Repeat with Pi environment variables removed
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
🔧 **Review** - 1 issue found → auto-fixed (2) ✅
.omp/extensions/fm-primary-omp-watch.ts:322- A host cycle boundary can produce only asupervision-host:line (bin/fm-supervision-host.sh:406). The changed host classifier treats it as actionable (.omp/extensions/fm-primary-omp-watch.ts:422), but replacement-handoff validation here still requires a signal/stale/check/heartbeat line. If omp replaces its session before consuming the boundary follow-up, the persisted handoff fails to load and that follow-up is not replayed. Accept the host-only boundary as a valid pending actionable message.🔧 Fix applied.
2 warnings still open:
.omp/extensions/fm-primary-omp-watch.ts:322- A host cycle boundary can produce only asupervision-host:line (bin/fm-supervision-host.sh:406). The changed host classifier treats it as actionable (.omp/extensions/fm-primary-omp-watch.ts:422), but replacement-handoff validation here still requires a signal/stale/check/heartbeat line. If omp replaces its session before consuming the boundary follow-up, the persisted handoff fails to load and that follow-up is not replayed. Accept the host-only boundary as a valid pending actionable message..omp/extensions/fm-primary-omp-watch.ts:990- The round 1 fix made host-only handoffs replayable, but left a sibling delivery path incomplete. If the host's exit output arrives in multiple stream chunks, a completedsignal:line can enqueue and deliver the follow-up before latersupervision-host: outcomelines arrive. The close handler at line 1022 updates only an undelivered record, so main can miss those outcomes even though the host completed normally. In host mode, wait for the child close before delivering its actionable message; continue streaming the readiness line.🔧 Fix applied.
✅ Re-checked - no issues remain.
FM_CODEX_LIVE_E2E=1 tests/fm-codex-continuity-live-e2e.test.shcompleted its real Codex checkpointtests/fm-supervision-host.test.sh,tests/fm-watch-checkpoint.test.sh,tests/fm-cursor-primary.test.sh,tests/fm-supervision-instructions.test.sh, andtests/fm-wake-queue.test.shtests/fm-afk-launch.test.shandtests/fm-omp-harness.test.sh, repeated with Pi environment variables removedFM_SUPERVISION_HOST_LIVE_E2E=1 tests/fm-supervision-host-live-e2e.test.shFM_CODEX_LIVE_E2E=1 tests/fm-codex-continuity-live-e2e.test.shgit status --shortafter testing✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.