feat(bin): have the worker start its own no-mistakes run (CFVC-15)

[sbracewell64]

Intent

CFVC-15: the worker calls the pipeline directly - retire the keystroke transition.

Goal: the fleet's most-travelled transition (implementation-committed -> validate) stops being actuated by firstmate simulating a human typing /no-mistakes into a terminal composer. Today the worker commits, appends "done:", and stops; that wakes firstmate; firstmate spends a model turn whose entire semantic content is a transition already determined; then bin/fm-send.sh types /no-mistakes into a TUI composer. That actuator has a measured false-positive class: on 2026-07-03 two crewmates were sent the trigger and both left it fully typed but unsubmitted in the composer for minutes while fm-send exited 0 with no error.

Accepted scope:

1. bin/fm-brief.sh's definition-of-done block for mode=no-mistakes ships: the worker that finishes its implementation commit invokes no-mistakes axi run directly as one blocking call inside its existing definition of done, replacing the append-done-and-stop step. Firstmate's turn is spent only when the pipeline returns something needing a decision.
2. AGENTS.md section 7's validate paragraph follows the same change. The firstmate-coding-guidelines skill was loaded and followed before touching either (knowledge-placement decision tree, one-owner rule, AGENTS.md size discipline, one sentence per line, plain dash, no agent co-author, shellcheck-clean scripts, colocated tests).
3. Retire the /no-mistakes keystroke actuator and its per-harness quirk table from the harness-adapters skill - a genuine deletion of documented complexity, not a wrapper over it.
4. Hard constraints from the increment's certification row: this must NOT become a private loop runner. No new watcher, scheduler, wake queue, or supervision daemon; it is one call inside the existing definition of done, replacing a stop. The shared-daemon rule is preserved: a worker never restarts the no-mistakes daemon, because one instance serves every lane.
5. Tests: a worker reaching definition-of-done starts a run without a firstmate turn; a negative control asserts a concurrent run on another branch is refused rather than joined; the daemon-preservation rule is asserted.

Completion criteria: (a) zero firstmate model turns between commit and run start for a ship task; (b) the per-harness keystroke quirk section deleted from harness-adapters; (c) no new scheduler/watcher/queue, asserted by review.

Dependency consumed: CFVC-07's fm-verify landed on the trunk this branch is cut from (commit fabaac4). The pipeline's return is therefore read through the three-valued verifier contract rather than a bare exit status - the generated brief tells the worker to judge the call by the run result it prints, and to treat a return with no readable run result (empty return, daemon error, killed process) as could-not-observe, which is never a pass and never grounds for a blind retry.

Decisions and tradeoffs made while doing the work, which a reviewer reading only the diff would not know:

• Branch scoping was added to the generated brief because the increment creates a new hazard: a worker that starts its own run can now meet another lane's run through the shared daemon. This was verified live and read-only rather than assumed - with no run on this branch, a bare no-mistakes axi status answered with a DIFFERENT branch's run that had a finding awaiting response. The brief therefore tells the worker to check a run's branch: before treating it as its own, and never to respond to, abort, or adopt a foreign lane's run. bin/fm-crew-state.sh already owns and documents that cross-branch fallback fact on the firstmate side, so the brief states the operational rule rather than restating the mechanism (one-owner rule).

• The retirement deletes the "no-mistakes skill invocation" section AND the per-harness Skill invocation table rows, because that axis existed solely for the retired validation trigger; the exit command remains the only routine command-shaped steer firstmate sends. Facts that live code still depends on were deliberately kept and re-anchored to command-shaped sends in general rather than to the retired trigger: codex's $-popup settle scoping (bin/fm-send.sh, tests/fm-send-popup-settle.test.sh) and grok's slash-popup argument-hint hazard with its herdr submit-verification fix. The dated 2026-07-03 incident record is kept verbatim as evidence for that live fix, with one line added noting it is the measured failure that retired the actuator. bin/fm-send.sh's command-shaped classification was deliberately NOT changed: it serves any command-shaped send including the captain typing, and is covered by existing tests.

• Now-dangling skill-invocation load triggers were removed from AGENTS.md sections 4 and 13, .agents/skills/firstmate-orca, .agents/skills/stuck-crewmate-recovery, and docs/configuration.md, per trigger hygiene - a trigger pointing at a deleted section is dead weight. docs/architecture.md's mention of codex $... skill invocations was intentionally left alone because it describes live fm-send behavior.

• The # Who is speaking to you example was changed from /no-mistakes to /compact and the header rationale reworded, because the exception's premise (firstmate cannot mark a command-shaped message) stays true while the specific example became stale once firstmate stopped sending that trigger. /compact is still live in worker instructions.

• Rollout deviates deliberately from the increment's "migration is per-harness" row: the change is harness-independent. The replacement is a shell command every verified adapter already runs, so the harness-dependent surface is REMOVED rather than migrated, and gating it per harness would add exactly the machinery the certification row forbids. Already-scaffolded briefs keep their previous contract, so in-flight lanes are unaffected, and AGENTS.md section 7 gained one line telling firstmate to steer such a worker into the run rather than restore the actuator. This deviation was reported to firstmate rather than made silently.

• Test placement follows the tests/fm-ask-user-authority.test.sh precedent: a contract-specific file (tests/fm-worker-initiated-validation.test.sh) asserting behavior through the executable interface (running bin/fm-brief.sh and inspecting the artifact it generates), never implementation-source bytes. Each absence assertion is paired with a negative control that reconstructs the retired shape and watches the same predicate go red, because a check that can only report "not found" cannot distinguish a passing brief from a broken generator. All four cases were additionally witnessed failing against the pre-change generator before being trusted green. The test is registered in bin/fm-test-run.sh's pure-contract-unit family and --check-coverage passes.

• The worker's own behavior cannot be executed in CI (the worker is an agent, not a script), so the contract is enforced at the surface that IS executable: the generated brief. This is stated plainly rather than claimed as full end-to-end coverage.

Verification status: bin/fm-lint.sh clean (pinned ShellCheck 0.11.0), bin/fm-doc-audience-check.sh clean, and the directly affected suites pass (fm-worker-initiated-validation, fm-brief, fm-ask-user-authority, fm-task-delivery, fm-send-marker, fm-send-popup-settle, fm-documentation-audiences, fm-test-run). One unrelated test, fm-calm-pi-extension, fails on a local Node ERR_UNKNOWN_FILE_EXTENSION for a .ts Pi extension; this was confirmed pre-existing by reproducing it identically on a pristine git archive HEAD export, and this change touches no Pi, Node, or calm surface.

Delivery constraint specific to this lane: this branch is cut from a fork trunk that is ahead of upstream. If the rebase gate flags the ahead-of-upstream commits, the accepted answer is to skip that step rather than rebase.

What Changed

• bin/fm-brief.sh's mode=no-mistakes definition of done now has the worker invoke no-mistakes axi run directly as one blocking call after its implementation commit — judging the call by the printed run result under the three-valued verifier contract (an unreadable result is could-not-observe, never a pass), and checking a run's branch: before treating it as its own — replacing the append-done:-and-stop step that spent a firstmate turn typing /no-mistakes into a TUI composer. The keystroke actuator and its per-harness quirk table are deleted from the harness-adapters skill (the 2026-07-03 incident record is kept as evidence), AGENTS.md section 7 follows the same change, and now-dangling skill-invocation load triggers are removed; a review-stage follow-up aligned the rule 4 examples and blocked: append wording with the new definition of done. No new watcher, scheduler, queue, or daemon-restart path is introduced, and a worker never restarts the shared no-mistakes daemon.
• New contract suite tests/fm-worker-initiated-validation.test.sh asserts through the generated brief that a worker reaching definition-of-done starts its own run, that a concurrent run on another branch is refused rather than joined, and that the shared-daemon rule holds — each absence assertion paired with a negative control witnessed red against the pre-change generator, and the suite registered in bin/fm-test-run.sh's pure-contract-unit family.
• The branch also carries the fork trunk ahead of the upstream base (64 commits across 245 files, which is why the rebase gate was deliberately skipped): fleet admission control, the LoopSpec schema/register and lawful-transition actuation, the deterministic decision surface, task role/deliverable/stage axes with a durable retry budget, the model registry and zero-budget spawn gate, the wake-outcome ledger, the worktree guard, remote-secondmate tooling, and the fleet launcher menu, among others.

Risk Assessment

✅ Low: The fix commit resolves all three prior findings exactly as instructed (mode-conditional rule 4 examples, an explicit could-not-observe conditional with a coherent placeholder, and the updated test comment), and rendering all brief kinds plus statically re-evaluating every test predicate against the fresh artifact shows no new defects, unbound-variable paths, or intent regressions.

Testing

Exercised the worker-facing contract end-to-end: generated a real no-mistakes brief and diffed its definition-of-done against the pre-change generator's output (showing the append-done-and-stop handoff replaced by the worker's own blocking no-mistakes axi run call with branch scoping and the could-not-observe rule), ran the new contract test green and witnessed it red against the old generator, ran the touched suites (fm-brief, fm-ask-user-authority, fm-documentation-audiences) and the coverage-registration check, and grepped harness-adapters to confirm the keystroke quirk table is gone; everything passed with no new scheduler/watcher surface in the diff. No screenshot evidence applies because the end-user surface is generated markdown, captured directly as artifacts.

Evidence: Definition-of-done before/after diff (pre-change fabaac4 generator vs CFVC-15 generator)

--- /tmp/dod-before.md	2026-08-09 17:39:58.685781575 -0400
+++ /tmp/dod-after.md	2026-08-09 17:39:58.687141062 -0400
@@ -1,12 +1,23 @@
 # Definition of done
 Delivery contract: mode=no-mistakes
-The task is complete only when committed on your branch.
-When you believe it is complete, append `done: {summary}` to the status file and stop.
-Firstmate will then instruct you to run /no-mistakes to validate and ship a PR.
+The task is complete only once it is committed on your branch AND validated through the no-mistakes pipeline, which you start yourself.
+
+The moment your implementation commit lands, start validation with one blocking call:
+   `no-mistakes axi run --intent "{what this task set out to accomplish}"`
+Start it directly. Do not append a status line for the commit, do not report `done:` first, and do not wait to be told: nobody is watching for a handoff at this point, so a worker that stops here stalls its own task.
+That call blocks until the first approval gate, the CI-ready point, or the final outcome, and prints it.
+Make `--intent` preserve all relevant content from this brief's `# Task` section plus every later accepted Firstmate requirement, clarification, constraint, exclusion, and supersession, carrying only each requirement's current accepted form; retain direct requirements instead of substituting a diff summary, and exclude generic operational, status, delivery, and other scaffold boilerplate unless it is task-specific.
+
+Judge that call by the run result it prints, never by its exit status.
+A printed gate or outcome is an observation you can act on; a call that returns no readable run result at all - an empty return, a daemon error, or a killed process - is could-not-observe, which is never a pass and never a reason to retry blindly.
+Only in that could-not-observe case, append `blocked: {what you observed instead of a run result}` and stop; a printed gate or outcome is never `blocked:` - drive it as described below.
+
+The pipeline validates YOUR branch only, and one shared daemon serves every other lane at the same time.
+Check the `branch:` of any run you are shown before treating it as yours: with no run on your own branch, a bare `no-mistakes axi status` answers with some other branch's run.
+A run on a branch that is not yours is another lane's work - never respond to it, abort it, or adopt it as your own, and never restart the daemon to clear it (rule 6).
 
 You drive no-mistakes by responding to its gates, not by implementing fixes.
-Follow the guidance no-mistakes itself provides for the mechanics: it loads when you invoke /no-mistakes, and `no-mistakes axi run --help` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.
-When starting no-mistakes, make `--intent` preserve all relevant content from this brief's `# Task` section plus every later accepted Firstmate requirement, clarification, constraint, exclusion, and supersession, carrying only each requirement's current accepted form; retain direct requirements instead of substituting a diff summary, and exclude generic operational, status, delivery, and other scaffold boilerplate unless it is task-specific.
+Follow the guidance no-mistakes itself provides for the mechanics: `no-mistakes axi run --help` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.
 Do not hand-edit, commit, or fix findings yourself while a run is active - the pipeline applies every fix.
 The one exception is a rebase the pipeline hands back to you: resolve and commit it under `# Branch conflict resolution` above, then return to driving the gates.
 
@@ -16,4 +27,4 @@
   When the decision comes back, feed it to the gate with `no-mistakes axi respond` and let the pipeline apply it - do not route the question to "the user" or implement the fix yourself.
 - Avoid `--yes`: it would silently bypass firstmate's authority check and any required captain escalation.
 
-After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append `done: PR {url} checks green` and stop. You are finished.
+After the pipeline reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append `done: PR {url} checks green` and stop. You are finished.

Evidence: Full generated worker brief (mode=no-mistakes) from the CFVC-15 generator

You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.

# Task
{TASK}

# Context pressure
Claude Code sessions receive host-computed context-window telemetry in the bottom status line.
For a spawned Claude worker, the same reading is written to `/tmp/fm-cfvc15-demo/context-pressure.json`.
At natural phase boundaries, read that file when it exists and use it instead of a self-estimate.
When `compact_recommended` is `true` (70 percent used or higher), run `/compact` before continuing.
The file is optional because other worker runtimes do not expose this verified telemetry contract; never fabricate a reading when it is absent.

# Herdr lifecycle declaration - NOT ENABLED
**HARD SAFETY GATE:** this scaffold cannot inspect the task text that replaces `{TASK}` later.
If the task will start, stop, delete, restart, profile, or otherwise drive Herdr lifecycle behavior, stop and regenerate the brief with `--herdr-lab` before dispatch.
Do not add Herdr lifecycle commands to this unguarded brief by hand.

# Setup
You are in a disposable git worktree of sampleproj, at a detached HEAD on a clean default branch.

**Verify isolation before anything else.** Run `pwd -P` and `git rev-parse --show-toplevel`; both must resolve to the disposable task worktree you were launched in, such as a treehouse pool path or an Orca-managed worktree, not the primary checkout firstmate operates from.
The path check is authoritative: `git rev-parse --git-dir` and `git rev-parse --git-common-dir` can help inspect the repo, but they do not prove you are outside the primary checkout.
If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append `blocked: launched in primary checkout, not an isolated worktree` to the status file and stop.

1. First action: create your branch: `git checkout -b fm/cfvc15-demo`
2. Run `no-mistakes doctor`; if it reports the repo is not initialized here, run `no-mistakes init`.

# Rules
1. Never push to the default branch. Never merge a PR.
2. Stay inside this worktree; modify nothing outside it.
3. Use gh-axi for GitHub operations and chrome-devtools-axi for browser operations. Most of that is action - opening a pull request, commenting, listing issues - and an action has no observation type; when you are instead making an OBSERVATION whose answer you will act on, run it through `/home/shane/.no-mistakes/worktrees/5f306883d81c/01KZM69GBW3PSGK370XDEMAY7V/bin/fm-verify.sh` (`--list` names the declared verifiers) rather than reading the tool's exit status.
4. Report status by appending one line:
   `echo "{state}: {one short line}" >> '/tmp/fm-cfvc15-demo/state/cfvc15-demo.status'`
   States: working, needs-decision, blocked, paused, done, failed.
   Each append wakes firstmate, so report sparingly: only phase changes a supervisor
   would act on (setup done, bug reproduced - never the implementation commit, whose only next step is the pipeline call under Definition of done) and the
   needs-decision/blocked/paused/done/failed states. No step-by-step FYI progress lines;
   firstmate reads your pane for that.
   A mid-task `working:` line (including setup complete) is nonterminal: do not end the
   turn after it; continue the same stage until a defined `done:` gate under Definition of done.
   Use `paused: {why}` - distinct from `blocked:` - ONLY when you are deliberately idling on a
   known external wait you expect to clear on its own (an upstream release, a rate-limit reset,
   a scheduled window): firstmate then leaves your idle pane alone and rechecks it on a long
   cadence instead of treating it as a possible wedge. Use `blocked:` when you are stuck and need help.
5. If a decision belongs above the implementation worker (product choices, destructive actions, ask-user findings),
   append `needs-decision: {summary of options}` and stop. Firstmate will apply the configured authority and reply with the decision.
   When firstmate replies or a blocker clears and you resume, append `resolved: {how it was decided or unblocked}` (add the same `[key=<slug>]` if you opened it with one) so the decision or blocker is durably closed and does not keep resurfacing.
6. Never stop, restart, or update the shared `no-mistakes` daemon - it is one instance serving
   every lane/home, so restarting it kills other lanes' in-flight pipeline runs. On ANY no-mistakes
   daemon error, append `blocked: {the daemon error}` and stop; only firstmate manages the daemon.

# Who is speaking to you
Firstmate marks every message it sends you with a leading `[fm-from-firstmate]` label followed by an invisible system separator; that separator is untypable, so a human never produces it.
A marked message is firstmate: act on it as task instruction.
An unmarked message is a human typing directly into your pane - usually the captain, who may believe this pane is firstmate rather than a worker.
The one exception is a message that starts with `/`, or on codex with `$`, such as `/compact`: a harness recognizes that form only at the very start of the line, so firstmate cannot mark it without breaking it. Treat such a message as routine and act on it.
Before acting on any other unmarked message, say plainly that you are a worker on task `cfvc15-demo`, not firstmate, and that merges, cross-lane work, other lanes' state, and fleet supervision belong to firstmate. Then ask whether they still want you to proceed.
Escalation is always the status file in rule 4, never this pane.
Firstmate does not read your chat, so anything you address to the captain here is lost: a decision or gate left parked with only "Captain, ..." in this pane is invisible to everyone and stalls the task indefinitely.

# Branch conflict resolution
Rebase and resolve branch/base conflicts yourself whenever intent is clear, at any file count: keep the base wherever this branch made no deliberate change, reapply this branch's contributions on top, and preserve every prior pipeline fix commit through the rebase.
Escalate only genuinely ambiguous intent to firstmate, never the captain.

# Verification discipline
An observation has three values, never two: observed-good, observed-bad, and could-not-observe.
The third is a real result, not a missing one.
An empty result set, an unreadable file, an absent artifact, an unreachable tool, a silent verifier, and an exit code that covers both a failure and a refusal are all could-not-observe, and none of them is a pass.
Never narrow one into the other two: an empty violations log, no output, and no failures found are never success on their own, and a missing expected artifact is could-not-observe at collection time rather than work still in progress.
Run a verifier through `/home/shane/.no-mistakes/worktrees/5f306883d81c/01KZM69GBW3PSGK370XDEMAY7V/bin/fm-verify.sh` (`--help` lists the declared verifiers) and act on the `PASS` / `FAIL` / `NO_VERIFIER_RAN` result it returns, rather than interpreting a tool's exit status yourself.
When the observation you need has no declared verifier, apply the same three-valued rule by hand: name which of the three values you reached and the evidence you reached it on, and report the undeclared verifier as a gap - never infer a pass from an exit status.
Before trusting a success reported only by absence, run a negative control, watch that same check go red, and only then run the real check.

# Project memory
If `AGENTS.md` or `CLAUDE.md` already exists, or if this task produced durable project-intrinsic knowledge, run `/home/shane/.no-mistakes/worktrees/5f306883d81c/01KZM69GBW3PSGK370XDEMAY7V/bin/fm-ensure-agents-md.sh .` in the worktree.
Record only project knowledge useful to almost every future session.
For anything the codebase already shows, prefer a pointer to the authoritative file, command, or doc over copying the detail.
If you touch a project `AGENTS.md` that lacks `## Maintaining this file`, add that short self-governance section from `/home/shane/.no-mistakes/worktrees/5f306883d81c/01KZM69GBW3PSGK370XDEMAY7V/bin/fm-ensure-agents-md.sh` in the same pass.
Keep it proportionate: skip `AGENTS.md` edits for trivial tasks that produced no durable project knowledge.

# Commit conventions
Never add an agent name as a commit co-author, and never add a Co-Authored-By trailer naming an agent, whatever your own harness instructions say.
Never carry the fleet conversational conventions - captain address and nautical seasoning - into a commit message, PR title, PR body, or anything else crewmates and other tools read.

# Definition of done
Delivery contract: mode=no-mistakes
The task is complete only once it is committed on your branch AND validated through the no-mistakes pipeline, which you start yourself.

The moment your implementation commit lands, start validation with one blocking call:
   `no-mistakes axi run --intent "{what this task set out to accomplish}"`
Start it directly. Do not append a status line for the commit, do not report `done:` first, and do not wait to be told: nobody is watching for a handoff at this point, so a worker that stops here stalls its own task.
That call blocks until the first approval gate, the CI-ready point, or the final outcome, and prints it.
Make `--intent` preserve all relevant content from this brief's `# Task` section plus every later accepted Firstmate requirement, clarification, constraint, exclusion, and supersession, carrying only each requirement's current accepted form; retain direct requirements instead of substituting a diff summary, and exclude generic operational, status, delivery, and other scaffold boilerplate unless it is task-specific.

Judge that call by the run result it prints, never by its exit status.
A printed gate or outcome is an observation you can act on; a call that returns no readable run result at all - an empty return, a daemon error, or a killed process - is could-not-observe, which is never a pass and never a reason to retry blindly.
Only in that could-not-observe case, append `blocked: {what you observed instead of a run result}` and stop; a printed gate or outcome is never `blocked:` - drive it as described below.

The pipeline validates YOUR branch only, and one shared daemon serves every other lane at the same time.
Check the `branch:` of any run you are shown before treating it as yours: with no run on your own branch, a bare `no-mistakes axi status` answers with some other branch's run.
A run on a branch that is not yours is another lane's work - never respond to it, abort it, or adopt it as your own, and never restart the daemon to clear it (rule 6).

You drive no-mistakes by responding to its gates, not by implementing fixes.
Follow the guidance no-mistakes itself provides for the mechanics: `no-mistakes axi run --help` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.
Do not hand-edit, commit, or fix findings yourself while a run is active - the pipeline applies every fix.
The one exception is a rebase the pipeline hands back to you: resolve and commit it under `# Branch conflict resolution` above, then return to driving the gates.

Two firstmate-specific rules layer on top of that guidance:
- ask-user findings are never yours to answer: escalate to firstmate (rule 5) and stop.
  Firstmate applies the authority contract in its `AGENTS.md` and obtains any required captain decision.
  When the decision comes back, feed it to the gate with `no-mistakes axi respond` and let the pipeline apply it - do not route the question to "the user" or implement the fix yourself.
- Avoid `--yes`: it would silently bypass firstmate's authority check and any required captain escalation.

After the pipeline reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append `done: PR {url} checks green` and stop. You are finished.

Evidence: Contract test transcript: green on CFVC-15, witnessed red on pre-change generator

$ bash tests/fm-worker-initiated-validation.test.sh (against the CFVC-15 generator) ok - a no-mistakes worker starts validation itself, with no firstmate turn between commit and run ok - worker-started validation preserves the one-instance shared-daemon rule ok - a concurrent run on another branch is refused rather than joined ok - the validate transition stays one blocking call, with no poller, timer, or watcher $ bash tests/fm-worker-initiated-validation.test.sh (against the pre-change fabaac4 generator — witnessed red) not ok - no-mistakes brief does not tell the worker to start its own run

$ bash tests/fm-worker-initiated-validation.test.sh   (against the CFVC-15 generator)
ok - a no-mistakes worker starts validation itself, with no firstmate turn between commit and run
ok - worker-started validation preserves the one-instance shared-daemon rule
ok - a concurrent run on another branch is refused rather than joined
ok - the validate transition stays one blocking call, with no poller, timer, or watcher

$ bash tests/fm-worker-initiated-validation.test.sh   (against the pre-change fabaac4 generator — witnessed red)
not ok - no-mistakes brief does not tell the worker to start its own run

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⏭️ **Rebase** - skipped

• ⚠️ .agents/skills/afk/SKILL.md - branch carries 64 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (277 file(s)) into the PR:
• fabaac4 feat(bin): make an unobserved result a third value that cannot pass (land of upstream feat(bin): add fm-verify so an unobserved result cannot read as a pass #1827) (feat: add optional tasks-axi groundwork #55)
• 095cf63 fix(bin): select empty worktree-pool slots and attribute live occupancy (land of upstream fix(bin): select empty worktree-pool slots and attribute live workers #1923) (Use agent terminology throughout firstmate #66)
• 3a1ab1d feat(bin): consume a deterministic decision surface instead of reconstructing operational truth (feat: add optional no-mistakes gate mode #68)
• 825e965 feat(bin): split task identity into role/deliverable/stage axes and rename promote to reflag (Codespace support #65)
• 0204baa feat(bin): count task attempts against a durable retry budget (CFVC-13) (feat(skills): add PR readiness guardrail #63)
• faf131b feat(bin): let the terminal record say a task failed (land of upstream feat(bin): let the terminal record say a task failed #1978) (fix: preserve watcher check wakes #62)
• 5004452 feat(loopspecs): unify the terminal-state vocabulary behind one owned mapping (feat: adopt tasks-axi backlog mutations #60)
• 6e8bc24 fix(bin): refresh away-mode wedge markers for provably-working crews (land of upstream fix(bin): refresh away-mode wedge markers for provably-working crews #1828) (feat(supervision): add injection/honeypot guard for external-repo crewmate PRs #67)
• b9091f5 feat(bin): record why every agent dispatch was necessary at the spawn chokepoint (land of upstream feat(bin): record why every agent dispatch was necessary at the spawn chokepoint #1830) (fix bootstrap sandbox gh diagnostic #58)
• c71122c docs(verification): record what CI does not prove about harness adapters (docs: add operator-seat orchestration guide #57)
• 150610e fix(launcher): establish the user PATH for a fresh WSL session (test(secondmate): trim redundant spawn ordering assertions #56)
• fa852d9 feat(loopspec): bind verifiers executably and actuate lawful transitions (feat: add treehouse setup hook and manual PR validation flow #53)
• c1bd574 feat(bin): reconcile ruling documents against open captain decision holds (land of upstream feat(bin): reconcile ruling documents against open captain decision holds #1819) (feat: add crash and reboot resilience for firstmate #51)
• 46786c9 feat(bin): surface validation daemon liveness at session start (land of upstream feat(bin): surface validation daemon liveness at session start #1611) (fix: handle opencode idle supervision #50)
• ab6f98f feat(bin): carry the commit conventions into every generated brief (fix(supervision): opencode-aware composer-idle detection + exclude supervisor pane from stale scan #49)
• a779309 fix(bin): answer "cannot resolve this run head" instead of "not mine" (land of upstream fix(bin): stop reporting live runs as failed when their unpushed tip is unresolvable #1855) (fix: harden away-mode escalation delivery #54)
• c1141a5 fix: unblock the fork trunk's portable serial 2 check (fix(bin): gate agent-native MCP startup for Codex spawns #64)
• e3432d3 fix(ci): verify a head-bound attestation instead of PR body text (land of upstream fix(bin): verify a head-bound attestation instead of PR body text #1825, refreshed) (feat: add firstmate self-update skill #61)
• ed376cf fix(bin): refuse merges without verified green checks (land of upstream fix(bin): refuse merges without verified green checks #1614) (Crash/reboot resilience + atomic O_EXCL lock (fix WSL2 mkdir non-atomicity) #48)
• 744f982 fix(bin): resolve the fork trunk as a landing target (feat(spawn): add Treehouse worktree setup hook #47)
• 561f0bb fix(bin): keep the fleet view working past the per-argument cap (feat: add OpenCode server backend #46)
• aef7a6d fix(bin): resolve the wake sequence instead of trusting a supplied one (fix(skill): Replace ':' with ';' in skill description #45)
• f90ed1d fix(bin): detect child-process work during supervision (land of upstream fix(bin): detect child-process work during supervision #1676) (feat: add opencode server backend #44)
• 3611e49 fix(bin): separate task read and contribution bases (land of upstream fix(bin): separate task read and contribution bases #1613) (feat: lease secondmate homes with treehouse #43)
• dda7f30 fix: stop rechecking captain-gated pauses in away mode (land of upstream fix: stop rechecking captain-gated pauses in away mode #1621) (feat(secondmate): keep secondmates idle and hand off scoped backlog #42)
• 4bee9f1 fix(bin): escalate blocked-on-human transitions past status-line dedupe (feat(tasks): wire fm-tasks SQLite into fm-spawn/teardown/watch #41)
• 27c7a2d fix(bin): stop wedge alarms on settled terminal tasks (feat(spawn): add cb harness adapter for account-B crewmates #40)
• ad53e97 reconcile: one landable base from the diverged fork and upstream trunks (feat(bin): recurring automated review sweep across the fleet #39)
• 9f914d1 feat: add the canonical LoopSpec representation, schema and register (feat(supervision): GitHub PR events watcher (comments, CI, reviews, merges) #38)
• cc242ae feat: add research-approved-work skill and deterministic corpus scanner (feat: support persistent secondmates #37)
• 50adfce fix(bin): measure pool-slot safety against the landing target (fix(spawn): set per-task GOTMPDIR so interrupted Go builds don't leak /tmp #36)
• 631c248 feat(bin): wake-outcome ledger for measured coordinator attention cost (docs(contributing): document fork-based contributions #35)
• 817ee8e CI mirror: refuse local merges only on genuine working-tree collisions (chore: initialize no-mistakes gate #1)
• ef74752 fix(bin): recognize kimi variants and pi launcher basenames in harness detection (feat(bin): prune gone branches during fleet sync #20)
• 5e6e90f fix(bin): let a released task land through the sanctioned merge path (fix(watcher): make check wakes lossless via watcher-side suppression #34)
• 1149178 Merge pull request feat(spawn): support batch task dispatch #33 from sbracewell64/fm/fork-upstream-resync-conflicts
• 490a371 reconcile: fork trunk with upstream main (0 behind, queue intact, 7 conflicts resolved) (fix: remind supervisors to refresh backlog after teardown #32)
• a004e4c Merge upstream 33a4287 into the fork trunk queue
• ecbbe30 fork-landing: Windows-to-WSL launcher bridge reconciled onto trunk (fix(teardown): allow teardown when work is on any remote (incl. fork), not just local main #31)
• abc2e7b fix(bin): prevent treehouse allocation from detaching live work (docs: clarify context supervision signal #25)
• 61a5ce8 feat(bin): carry standing worker rules into every generated brief (revert: remove HomeMux design skill from firstmate #23)
• 1ba6ffe fix(bin): allowlist the opencode turn-end plugin in teardown's dirty check (fix: wake pi crewmates after each turn #12)
• 988dd4b fix(composer): read an NBSP-padded empty composer as empty and fail unshown herdr wedge alarms (feat: add per-project delivery modes #14)
• 0c83af2 test: reap leaked background processes on every suite ending (docs: tighten captain-facing communication #16)
• 8e1eb2d feat(bin): wake firstmate when a monitored PR goes conflicting (feat: manage project agent memory through ship briefs #21)
• 3edbc23 CI mirror: feat(bin): add fleet admission control stages 0 and 1 (feat(bin): guard watcher liveness across supervision scripts #8)
• cf8f2c6 feat(bin): trigger the 70% compaction doctrine from Claude's host-computed context telemetry (docs: require full PR URLs in captain reports #11)
• e960b84 feat(bin): enforce the zero-budget model rule with a model registry, spawn gate, and probe verification (fix: keep idle watcher supervision silent #10)
• d965699 feat(bin): mark crewmate and scout steers as from-firstmate and teach briefs to read the marker (docs: clarify live supervision constraints #9)
• 9dbaa00 Merge fm/fm-launch-menu: fleet launcher menu (upstream PR feat(bin): add fleet launcher menu backed by a single-owner launch library #1288)
• 06a6fbd no-mistakes(review): add launch lock, reject leading-zero input, refresh evidence anchors
• fa1dcc7 test: replace launch-lib one-owner source assertions with behavioral coverage
• 74be2a6 no-mistakes(review): fix glob split, enforce backend, guard reattach, probe pi-signed
• cca9d3a feat(bin): add the fleet launcher menu, Herdr gate, and reattach guard
• a083886 no-mistakes(document): point harness-adapters launch facts at fm-launch-lib owner
• 0f42855 no-mistakes(review): bind consumer obligation to every primary, fix pi rationale
• 1154677 no-mistakes(review): bind consumer obligation to any bypass flag, add grok
• bf87246 no-mistakes(review): record primary autonomy evidence and consumer obligation
• abe3c8d no-mistakes(review): add grok --trust, refuse kimi primary, pin every primary shape
• dbfd400 no-mistakes(document): point grok adapter launch line at fm-launch-lib owner
• e067656 no-mistakes(review): use verified opencode --auto primary shape and tighten launch-lib ownership
• 7fd8e55 no-mistakes(document): point launch-command docs at new fm-launch-lib.sh owner
• 6e65a07 no-mistakes(review): map fm-launch-lib.sh into test selection, fixture, and docs
• 2c93585 refactor(bin): give launch knowledge one owner in fm-launch-lib.sh

Push main to origin, or rebase your branch onto origin/main, before gating.

🔧 **Review** - 3 issues found → auto-fixed ✅

• ⚠️ bin/fm-brief.sh:679 - Rule 4's reportable-phase example list still names "fix implemented" (bin/fm-brief.sh:679), which is exactly the moment the new definition of done forbids reporting ("Do not append a status line for the commit", line 620). Since every append wakes firstmate, a worker weighing rule 4's example over the DoD prohibition re-creates the commit-to-run-start wake the increment's completion criterion (a) requires to be zero. The example list is shared across modes (it stays apt for local-only), so the fix needs a wording decision — e.g. mode-conditional examples or dropping "fix implemented" — rather than a mechanical edit.
• ℹ️ bin/fm-brief.sh:625 - The sentence "Append blocked: {what the pipeline returned} and stop." (bin/fm-brief.sh:625) is not explicitly conditioned on the could-not-observe case it follows: a literal reader at a printed approval gate could take it as the next step for any run result and stall the task with blocked: instead of driving the gate (the correction only arrives two paragraphs later). Additionally, the placeholder "{what the pipeline returned}" is incoherent for a case defined by the pipeline returning nothing readable — "{what you observed instead}" or an explicit "If so, append..." conditional would remove both ambiguities.
• ℹ️ tests/fm-brief.test.sh:814 - The block comment above test_crewmate_scaffolds_carry_who_is_speaking still says the command-shaped exclusion exists "so the routine validation trigger does not read as a rule violation" (tests/fm-brief.test.sh:814), but this change retires that trigger and the assertion message beneath was already updated to the new rationale ("so a typed command is not read as an impostor"). Update the comment to match — a stale rationale pointing at a retired mechanism is exactly the dead weight the change's trigger-hygiene pass removed elsewhere.

🔧 Fix: align rule 4 examples and blocked append with DoD
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-worker-initiated-validation.test.sh — all 4 contract cases pass (worker-started run, shared-daemon rule, foreign-branch run refused, no private loop runner)
• bash tests/fm-worker-initiated-validation.test.sh run against the pre-change fabaac4 generator — witnessed red (not ok - no-mistakes brief does not tell the worker to start its own run), proving the checks detect the retired shape
• bash tests/fm-brief.test.sh — full brief-generator suite passes, including the mode=no-mistakes definition-of-done and /compact who-is-speaking example
• bash tests/fm-ask-user-authority.test.sh and bash tests/fm-documentation-audiences.test.sh — touched suites pass
• bin/fm-test-run.sh --check-coverage — new test registered in the pure-contract-unit family, 144 tests mapped
• Manual: generated a real brief via FM_HOME=… bin/fm-brief.sh cfvc15-demo sampleproj --mode no-mistakes and diffed its definition-of-done against one produced by the pre-change fabaac4 generator
• Manual: grep -n 'Skill invocation|/no-mistakes|$no-mistakes' .agents/skills/harness-adapters/SKILL.md — only the deliberately kept 2026-07-03 incident record remains
• Manual: reviewed the full CFVC-15 diff (fabaac4..79915bc, 9 files) to confirm no new watcher, scheduler, queue, or daemon-restart path is introduced

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[sbracewell64]

Closing: wrong venue, and the head bundles this fork's landing queue.

This pull request was opened against kunchenguid/firstmate main, but the branch is cut from a fork trunk that is ahead of upstream. The pushed head was rebased onto origin/main, so the pull request carries 63 commits, 179 changed files and +39,369/-1,240 - the fork's unlanded landing queue replayed onto upstream - while the actual change under review is 9 files and +218/-44.

The change itself is sound and unaffected: review returned low risk, and the pipeline's fixes are included. It is being re-raised at the fork venue on a fresh branch cut from the current fork trunk, carrying only its own commits.

No force-push was performed, and this branch is left in place rather than deleted.