chore(bin): merge upstream/main into fork - #10
Merged
Conversation
…d mate (kunchenguid#2457) The lightweight Relay follow-up link lives in the answering home's own state/<task-id>.meta, so it can only bind work that home owns. When a Relay-linked request is routed to a second mate, the task record lives in the second mate's home, fm-x-link.sh failed with a bare "no such task ...meta", and nothing else picked the promise up: only the soft acknowledgement was ever posted. The typed promised-final path already supports --work-home secondmate:<id>; the playbook simply never chose it. - fmx-respond now states the routing rule crisply: a task in this home takes the lightweight link, and second-mate-routed work takes a promised-final commitment bound to that home, registered up front with the brief command carried into the routed worker's instructions. - fm-x-link.sh refuses a task with no local record by naming the registered second mate whose home actually holds it and printing the promised-final registration command, with the exact --work-home when the match is unambiguous. A home with no registered second mates keeps the plain error. - fm-backlog-handoff.sh reports, after a successful move, any moved key that still owes a public reply bound to main/<key>, since that binding no longer names the home owning the work. The move itself is never blocked. Docs and the secondmate handoff prose follow the same rule. Tests cover the refusal, its scoping, the unchanged local-link path, and both handoff outcomes at the script boundary.
…verdicts (kunchenguid#2456) * fix(skills): hint that remote secondmate liveness verdicts false-negative fm-crew-state and fm-send routinely misreport a live remote secondmate as dead; confirm against the pane before relaunching, and relaunch only through fm-spawn.sh, never raw herdr pane surgery. * no-mistakes: apply CI fixes
Pi 0.83.0 added a status line to every tool-expansion change, and Pi updates the previous status line in place when two status messages arrive back to back. Calm's post-export redraw cycled tool expansion on the macrotask right after Pi printed "Session exported to: <path>", so both expansion status lines coalesced over that confirmation and the captain was left with no record of where their export landed. Calm now repaints only the tool rows it presents, by invalidating each row through the render context Pi hands its render slots, and requests the surrounding redraw through setStatus. Neither appends to the transcript. The repaint is still needed because Pi can re-render a row asynchronously - the built-in edit row invalidates itself once its diff is ready - and that re-render can land inside the window where /export forces stock rendering. The real-terminal /export case now asserts the confirmation is still on screen after the redraw has settled, and that the redraw restored every Calm-hidden row, instead of only racing the moment the confirmation first appeared.
…nguid#2488) * feat(stow): persist the open records a session is holding /stow curated memory and captured session knowledge, but never touched record state, while AGENTS.md called it an "unfinished-work sweep" and the receipt declared the session "safe to reset" - wording that implied a record-correctness guarantee stow does not make. A shipped PR with no backlog item, a queued umbrella whose phases had merged, and four decision holds left open after their answers shipped all survived repeated stows. Add a bounded pass that files record state from the same volatile input the rest of stow already uses: the open threads in context, minutes before the reset destroys them. It creates a record for an unfiled thread and corrects one the session knows is wrong, through the owning path, and states its boundary as part of the contract - it never enumerates the backlog, lists holds, or queries a forge, because it cannot be a reconciliation and must not be read as one. Correct the wording in AGENTS.md and the completion receipt so reset-safe means what it actually guarantees: nothing this session knew was lost. * no-mistakes(review): correct stow decision-hold inspection to read hold via tasks-axi * no-mistakes(document): note /stow open-record persistence in README command catalog * refactor(stow): state open-record persistence as principle, not procedure The first version enumerated triggers, named commands, and prescribed an ordered procedure. That is too rigid for an agent skill: it invites literal execution of a checklist instead of judgment, and every enumerated example is a way for the guidance to go stale. Reduce it to the intent - before a reset, the important open work you are holding in context must end up durably recorded rather than dying with the session, filing what is unfiled and correcting what is stale - and let the agent judge importance, the record, and the owning write path. Keep the scope bound, since it is a decided contract and not a mechanic: this covers the open work the session is holding, never a reconciliation of durable records against repository or forge reality. The wording corrections in AGENTS.md and the completion receipt are unchanged.
…eyed-answer path (kunchenguid#2490) * fix(decisions): close captain holds at answer time Firstmate had two "a decision is open" ledgers with asymmetric closing mechanics. The live status-log ledger closes atomically at answer time, because bin/fm-send.sh --resolve-key makes answering a decision be the act that closes it. The durable backlog hold ledger had no such coupling: answering and recording were two separate acts, and only the first was forced by the workflow. That asymmetry lost four real captain decisions. Their answers were captured durably to disk, keyed character for character by the hold decision keys, acknowledged, and even implemented and shipped, yet the holds stayed open for two days and the captain was asked to re-answer decisions already on his own disk. Give the hold ledger the same answer-time-closure property: - bin/fm-decision-hold.sh gains an `answer` subcommand, the hold ledger's counterpart to --resolve-key. It shares one unrouted close implementation with `decline`, so it carries every existing guard - the captain decision file, the active-hold requirement, retry identity, and the refusal to release still-routed work - and differs only in the resolution mode it records. `decline` keeps its stronger meaning that the answer routes no follow-up work at all. - bin/fm-procevent-lavish.sh wires the channel that actually carried the lost answers. `arm --decisions-origin` binds a deck to the origin whose holds it carries, `answers` reads the structured choices out of a captured poll result, `close-decisions` maps each key to its hold and closes it through the command above, and `autohandle` lets the runner apply that at capture time. Safety is preserved rather than traded away. Only rows tagged `choice` are read, so freeform captain prose cannot forge a decision key. Closure is confined to the one bound origin. The decision text is a pure function of the captured result, so a replayed capture is idempotent. A hold that is absent, already closed, or still blocking routed work is skipped and left for `resolve`, never forced. A deck armed without the binding touches no hold at all. And autohandle deliberately never reports full handling, because recording an answer is transcription while acting on it is firstmate's judgement - so the check wake still reaches the handler. fm-send --resolve-key is untouched. * no-mistakes(document): document state/lavish-decisions binding dir in AGENTS.md state inventory * refactor(decisions): make keyed-answer closure one general capability The previous pass gave holds answer-time closure but built it as bespoke Lavish wiring: the review adapter carried the source-to-origin binding, mapped keys to hold identities, wrote decision records, decided what to skip, and closed holds itself. That treated a review deck as a special decision source. It is not - it is an ephemeral discussion format that happens to carry answers. Collapse it into ONE general capability with one owner. bin/fm-decision-hold.sh now owns the whole of "a keyed answer closes its matching hold": - `answers <origin> --source <provenance>` is the channel-agnostic intake. It reads key/answer/label lines on stdin, maps each key to its hold, and closes it through the same `answer` path, so every guard applies identically whatever channel the answer came from. --source is provenance recorded in the decision, never a behavior switch; there is no per-channel branch and no knowledge of chat, decks, or transports. - `bind`/`unbind`/`binding` own the source-to-origin binding for any channel whose answers arrive detached from their origin. Every channel is now an ordinary caller that only turns what it received into keyed lines: - bin/fm-send.sh (chat) feeds the intake for a key that names an active hold. This also fixes a real gap: once `complete` transfers a decision to its hold it closes the live status copy, so --resolve-key alone could never answer a transferred decision. - bin/fm-procevent.sh feeds it generically. A bound source's captured result goes to `<adapter> answers <result-file>` and whatever that prints is piped into the intake. The runner names no adapter, parses no result, and carries no decision rule, so any future adapter with an `answers` command works with no change here. - bin/fm-procevent-lavish.sh keeps only `answers`, which reports the structured choices a review captured and stops. It maps nothing to a hold and closes nothing; it lost ~160 lines of decision logic. Feeding is independent of handling, so it never acknowledges a result and never suppresses a wake - recording an answer is transcription, acting on it stays firstmate's judgement. The regression that proves closure now drives a FIXTURE adapter that is not the review adapter, so what is proven is that any bound channel reaches the intake rather than that one channel is wired specially. A new regression drives the real fm-send over a stubbed transport for the chat side. Every prior guarantee still holds, and fm-send's status-log behavior is unchanged. * no-mistakes(review): test(decisions): drop source-content grep from hold-closure regression
…mlink (kunchenguid#2512) A Write aimed at CLAUDE.md followed the symlink and destroyed AGENTS.md. The installer now creates and migrates to a recoverable two-line pointer file.
* fix(lint): catch malformed GitHub workflows before merge A self-broken ci.yml cannot report its own breakage, so parse every workflow in the local lint path that no-mistakes already runs. * fix(lint): pin actionlint instead of Ruby for workflow lint A self-broken ci.yml still has to fail in the local lint path, and the named tool for that gate is actionlint, not a new Ruby runtime. * no-mistakes(document): Clarify pinned workflow lint documentation
…d#2546) * fix: install pinned shellcheck and actionlint on macOS and linux arm64 The installers were hardcoded to linux amd64 and sha256sum, so a Mac dev could not satisfy the refuse-on-mismatch lint gate. Select the official per-platform archive and checksum, and fall back to shasum -a 256. * no-mistakes(document): Document cross-platform pinned lint installers
…uid#2548) .no-mistakes.yaml has set test.evidence.store_in_repo: true since kunchenguid#2355, but CONTRIBUTING.md, docs/configuration.md, and docs/architecture.md still described the old policy of keeping evidence out of the repo in a temp directory. The current no-mistakes behavior for store_in_repo: true is to publish each run's test evidence to the orphan no-mistakes/evidence branch and link it from the PR body. That branch shares no history with code branches, so evidence never enters a pushed feature branch or the default branch, and CI's tracked personal fleet paths rule stays accurate. Docs only. No change to .no-mistakes.yaml or any workflow.
* docs: correct test evidence storage comment in .no-mistakes.yaml * no-mistakes: apply CI fixes
…nchenguid#2563) Make that a first-class option in always-loaded instructions so firstmate does not default to mediating and tearing the scout down between iteration rounds.
…chenguid#2570) * fix(bin): report remote secondmate delivery and state truthfully A steer to a remote secondmate crosses fm-on.sh to a host-local fm-send leg whose unconfirmed submit read-back (verdict=pending, typically a busy mate whose harness queues the steer) was flattened into exit 1, so the parent printed "error: text not submitted" / "error: text not sent" and discarded the pending-reply expectation for a steer that had actually landed. fm-send now carries the verdict across the ssh boundary as a documented delivered-unconfirmed exit 3: the parent reports the steer as delivered with confirmation pending, exits 0, keeps the expectation armed (awaiting_report), and closes --resolve-key decisions, while transport loss (ssh 255) and real remote failures keep failing loudly with the remote leg's stderr attached. A local unconfirmed submit now also exits 3 with an honest non-error message and still never closes a decision key. fm-crew-state.sh and fm-peek.sh no longer read a remote mate's endpoint through local probes (which misreported a healthy mate as "worktree gone" / "can't find session: remote"): both now use the true remote source over fm-on.sh, and an unreachable or unreadable remote reads as unknown-remote, never as gone or dead. * no-mistakes(document): Document remote delivery and state truth * no-mistakes: apply CI fixes
* Adopt quota-axi 0.1.29 spendPriority-primary array dispatch. quota-axi 0.1.29 publishes schema 5 with selection.spendPriority as the primary comparative signal and demotes derivation fields out of default --json. Rank comparable-fit candidates on that scalar, keep runway versus the completion horizon as a hard gate, and raise the compatibility floor so a pre-consolidation build cannot reach dispatch intake. * no-mistakes(review): Correct schema fixtures and remove prescriptive selection prompts * no-mistakes(document): Correct quota verification evidence chronology * Collapse quota-array-dispatch onto TOON-first spendPriority ranking. Decide from quota-axi's default TOON; keep --json as a rare defensive fallback. Rank by spendPriority after eligibility, reasoning-class, and runway-feasibility gates, and drop the hand-computed Pareto, pace, reserve, and window-id layers. * no-mistakes(review): Permit ambiguous JSON fallback and correct reset fixtures * no-mistakes(review): Correct runway semantics and escalate unresolved uncertainty * no-mistakes(document): Document TOON-first quota dispatch evidence
* docs: add GROK_BOT.md Grok Bot system prompt * docs: amend GROK_BOT.md with charter report-back and delegation marker * docs: classify GROK_BOT.md as public-product * docs: make GROK_BOT.md the plain Grok Bot system prompt
Refine language for clarity and consistency in instructions.
…#2595) * fix(bin): guarantee inactive-reconcile scan progress under second quantization The inactive-outcome scan computed its aggregate deadline in whole seconds, so a 1-second budget's effective value lands anywhere in (0,1]; a scan starting just before a wall-clock second boundary rounded its whole budget away mid-scan and exited having visited no child, while the durable cursor had already advanced past the never-examined child. This is the CI flake behind tests/fm-inactive-reconcile.test.sh's 'next bounded scan did not resume with the following child' (watcher-wake-lock family, portable serial 2, seen on the PR kunchenguid#2590 run). Every scan now visits at least its first due child with the per-child state-read bound floored at one second, so no invocation can be a zero-work no-op. The outer process-group kill moves to budget+1s: the scan's own deadline enforces the budget, and the kill is a backstop for a scan wedged in an unbounded wait instead of a racer that routinely preempts the clean bounded exit. The wake-lock-wait test bound tracks the backstop (3s -> 4s); the previously flaky assertion is unchanged. * no-mistakes(document): Document inactive-reconcile deadline backstop
Refactor the guidelines for Firstmate's role and delegation process, emphasizing the importance of crewmates and asynchronous work.
Clarified guidelines for handing off work to crewmates and managing secrets.
…tions deterministic (kunchenguid#2617) Three assertions in tests/fm-procevent.test.sh depended on a detached runner having finished work that the command starting it does not wait for. reconcile's replacement runner is started through detach_runner, which only forks: reconcile returns and counts the start before that runner has claimed its source or exec'd its child. Any assertion taken straight after reconcile therefore samples a race. - The publish-before-apply recovery section left its always-ready /bin/echo source registered across the recovery reconcile, so that reconcile launched a competing detached poll (observed: started=1) that then raced every later assertion for the source claim, the next capture sequence, and this home's applied record, and outlived the section holding a live claim. It is now retired before that reconcile - re-announcement is proven from the durable inbox alone and needs no registration - and started=0 is asserted so a competing poll cannot be reintroduced unnoticed. This is the same retire-before-reconcile discipline the self-announcing section already carries; that section acquired it after the identical race made its "not-autohandled: self-src" assertion read "already owned: self-src". - The crashed-leader replacement section snapshotted the replacement's claim file and execution log behind a fixed 0.5s settle window. On a loaded machine that window expires first, which is the CI flake behind "a replacement runner started without recording its own claim" and "reconcile did not start exactly one replacement source". Both effects are now waited for with the suite's bounded wait helpers; the exact one-replacement count is still asserted afterwards, unchanged. - The duplicate-start section slept 0.5s for reconcile's runner to record ownership before asserting that a second start loses to it. It now waits for that claim. Also tighten one assertion that could not fail as written: "autohandled: self-src" is a substring of "not-autohandled: self-src", so the applied path was accepted even when the runner reported the capture left for the handler. Evidence: on the unmodified suite, 128 full runs at 6-8x concurrency produced 6 failing runs, all in the crashed-leader section. On the fixed suite, 216 full runs under the same load produced none. Reverting the self-announcing section's retire-before-reconcile line reproduces "already owned: self-src" on the first iteration, confirming the shared mechanism.
) * fix(bin): keep pending-reply expectations honest on both send legs Two related asymmetries let the parent-owned secondmate reply guard drop or nag requests it should not have. Local delivered-unconfirmed dropped the expectation. A marked request whose submit read-back stayed unconfirmed (verdict=pending) is the same not-a-failure outcome the remote leg reports as delivered, but fm-send discarded the parent's pending-reply record for it, so a request that very likely landed stopped being tracked entirely. The record now stays armed on its unconfirmed-delivery marker: a correlated report still resolves it, and an unanswered one still surfaces through the library's own reconciliation. Exit 3 and the local rule that an unconfirmed answer never closes a decision key are unchanged. Remote replies were nagged for a repost they did not need. A remote mate's report reaches the parent's status log only through the asynchronous mirror in fm-procevent-remote-reply.sh, yet the guard read an absent correlated line as proof the mate never reported - even while the answer was still in flight, which is the common case because the mirror's poll window is comparable to the recovery grace. The mirror now publishes one caught-up watermark from a quiet window, and the guard admits a missing report as evidence only once that watermark passes the turn that should have produced it. A genuinely missed report still gets exactly one repost, and a channel that is behind, unarmed, or broken leaves the request durably open and un-nagged rather than nagging blind; the mirror escalates its own continuity failures as before. Tests: a local unconfirmed secondmate send keeps its expectation armed and resolvable; a mirrored correlated remote reply resolves with no repost; a stale or absent watermark withholds the repost while a fresh one still releases it; a quiet remote window publishes the watermark and retirement clears it. * no-mistakes(review): Distinguish preempted polls from quiet windows * no-mistakes(document): Clarify remote reply channel freshness * no-mistakes(lint): Annotate shared remote preemption exit constant
…d#2619) * fix(watch): honor a declared pause on a busy pane's completed-turn bound A worker that declares an external wait (`paused:`) and then blocks in one long foreground call - a review-hosting scout parked in a single blocking `lavish-axi poll`, a bounded watch loop, a rate-limit sleep - keeps its pane BUSY, so the stale path that already honors declared pauses never ran for it. The busy-pane completed-turn bound instead routed it straight into wedge_timer_check, which re-escalated "possible wedge, escalation N" (and, past the threshold, demand-deep-inspection) every FM_STALE_ESCALATE_SECS for as long as the review stayed open. busy_turn_bound_check now owns which absorber takes a crossed bound: a crew whose own last status line declares an external wait or a verified captain-held transfer takes the bounded FM_PAUSE_RESURFACE_SECS recheck, and everything else keeps the unchanged wedge timer. The discriminator is the declaration together with liveness (the caller has already confirmed the pane is busy), never a blanket silencing - a crew that declared nothing, or whose pane is not live, escalates exactly as before, and a declared pause still re-surfaces once per long cadence so a forgotten wait cannot rot invisibly. Away mode is untouched: the daemon owns pause triage there and already reads the same vocabulary. The two call sites also no longer clear pause bookkeeping in the same poll the pause cadence recorded it, which would have erased the re-surface throttle and turned the long cadence back into a per-poll re-surface. Tests: a three-phase regression fixture pins the absorbed pause, its long-cadence recheck, and the restored wedge escalation once the declaration is lifted on the same busy over-age pane. Also de-flakes tests/fm-watch-triage.test.sh, which failed spuriously on a loaded machine: fixed liveness budgets were reaping watchers mid-startup, so assertions on post-poll state passed vacuously or failed spuriously. Waits that describe a poll's outcome now wait for a completed poll cycle via the liveness beacon, the heartbeat test waits for the heartbeat it asserts on, and every wait_for_exit budget is the uniform 10s already used elsewhere in the file. * no-mistakes(review): Fail poll-cycle waits on timeout * no-mistakes(review): Prevent poll timeout test hangs * no-mistakes(document): Clarify paused busy-pane supervision
Added guidelines for decision communication to the captain.
Clarify communication protocols with crewmates regarding task delegation and reporting.
* fix(herdr): confirm local steers that native agent-state misses Herdr can leave agent_status idle for a landed Claude turn and can keep queued Enter text visible while busy, so fm-send was reporting false swallows. Confirm those cases through the shared queued-Enter verdict and a cleared composer, and keep a genuine idle pending composer as unconfirmed. * no-mistakes(review): Stop Herdr Enter retries on unreadable composers * no-mistakes(review): Reject queued delivery when all Herdr Enter sends fail * no-mistakes(review): Prevent confirmation after failed Herdr Enter * no-mistakes(review): Pace Herdr retries and clarify submit fallback * no-mistakes(review): Align Herdr submit docs with idle fallback * no-mistakes(document): Correct Herdr submit-confirmation documentation
* feat(bin): accept any-origin decision bindings with full-identity keys An aggregation surface (the bearings board) carries captain answers for holds across origins, but a binding was one-origin-per-source and the Lavish adapter capped question keys at 64 chars while real full hold identities measure 69-81. - fm-decision-hold.sh: bind <source-id> --any-origin records the (any) marker; binding prints it verbatim and answers accepts it, so the runner's feed seam carries an any-origin source with no runner change. In any-origin mode each key is a full hold identity <origin>-decision-<key>, split at its first -decision-; a key with no separator (merge/dispatch instructions) is skipped and feeds nothing, keeping non-decision answers out of the hold ledger by construction. Every existing close guard applies unchanged. - fm-procevent-lavish.sh: raise the question-key cap 64 -> 128 so a full hold identity fits; the slug-shape security property is unchanged. - tests: cross-origin closure through the real runner seam, an 81-char identity through the adapter, cap and shape refusals, routed-work skips, nonexistent-identity skips, and idempotent replay. * feat(bearings): add the /bearings lavish interactive fleet board /bearings lavish renders the bearings snapshot onto a shipped, reusable board template and arms it as a Lavish process-event source, so the captain answers Captain's Call items on the board and firstmate is woken by an ordinary check wake - no conversational turn ever blocks on a poll. - .agents/skills/bearings/assets/board-template.html: the shipped template (myfirstmate design system inlined, one fm-bearings-board.v1 JSON slot, fail-closed schema guard that renders an error card instead of an empty fleet). Per-invocation agent work is composing the payload only. - bin/fm-bearings-board.sh: build/refresh owner - fail-closed payload validation, slot injection with a round-trip check and \u003c escaping, stable board path, any-origin bind ALWAYS before arm, arm-if-absent. - bearings SKILL.md: the lavish invocation option, board composition rules, board-wake handling, and the captain-ruled merge-click authorization with its mandatory safeguards (PR resolved from the task's own meta record, wake-time green re-verification, never a red or changed PR, merges only through bin/fm-pr-merge.sh, chat echo with the full PR URL). - process-event-sources SKILL.md: one-line board-wake routing trigger. - tests: payload refusals, injection round-trip, bind-before-arm, idempotent re-arm, and template slot integrity. Fleet pickup: homes receive this after merge plus a firstmate self-update; landing timing is coordinated with the main firstmate. * no-mistakes(review): Harden bearings board validation and wake handling * no-mistakes(review): Require HTTPS for bearings board PR links * no-mistakes(review): Fail closed and bound bearings board answers * no-mistakes(review): Enforce UTF-8 byte limits for board answers * no-mistakes(review): Serve bearings board before arming and reject empty actions * no-mistakes(review): Prove bind-before-arm ordering through live answer consumption * no-mistakes(document): Document bearings board and cross-origin answers
…e-aug21 Brings in 27 upstream commits, including the Lavish fleet board for bearings (kunchenguid#2659), reliable herdr steer confirmation (kunchenguid#2647), declared-pause handling in busy-pane wedge checks (kunchenguid#2619), pending-reply preservation and deferred remote reposts (kunchenguid#2618), deterministic process-event tests (kunchenguid#2617), preserved inactive reconciliation scan progress (kunchenguid#2595), spendPriority quota dispatch (kunchenguid#2574), and the cross-origin keyed-answer path for decision holds. Conflicts resolved to keep both sides' intent: - AGENTS.md: kept the fork's slimmed startup context (#1) while folding in upstream's substantive changes - TOON-first spendPriority dispatch, the cross-origin decision-binding marker, and the live-scout Lavish loop hint. - Skill descriptions (bearings, quota-array-dispatch, stow, stuck-crewmate-recovery): kept the fork's condensed one-trigger form and carried upstream's new triggers and corrected remote-secondmate facts. - process-event-sources: kept the fork's slack-captain adapter paragraph (#4) alongside upstream's generic keyed-answer feed. - bin/fm-decision-hold.sh, bin/fm-procevent-lavish.sh, bin/fm-send.sh, docs/, tests/: took upstream, whose any-origin binding, 128-char identity cap, and remote delivery notice are supersets of the fork's versions. The fork's ship-brief isolation check (#9) and the gh-axi/chrome-devtools-axi "all" tooling rule (#7) are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Merge upstream into the firstmate fork. This repo is digbycampbell/firstmate (origin), forked from kunchenguid/firstmate (upstream). Upstream/main was 27 commits ahead of our main (fetched 2026-08-21; includes bearings Lavish fleet board kunchenguid#2659, herdr steer confirmation kunchenguid#2647, declared-pause wedge checks kunchenguid#2619, pending-reply preservation kunchenguid#2618, procevent test determinism kunchenguid#2617, inactive-reconciliation scan progress kunchenguid#2595, spendPriority quota dispatch kunchenguid#2574, and several doc/guideline revisions).
Required procedure, following the shape the fork established in merge commits 1e0557c/6ed3006 and PR #8:
Excluded by instruction: no modifications to .env, data/, state/, config/, projects/ (untracked operational dirs, not part of the merge).
This change is firstmate's own shared tracked material, so firstmate-coding-guidelines applies: one full sentence per line in tracked Markdown, plain dashes not em dashes, one-owner rule for contracts, AGENTS.md size discipline (conditional detail belongs in skills, not inline), no agent name as commit co-author.
Conflict resolutions made, all deliberate:
The fork's ship-brief isolation check (fix(brief): identify firstmate's permanent clone structurally in ship brief isolation check #9) and the gh-axi/chrome-devtools-axi 'all' tooling rule (docs: restore "all" to the axi tooling rule in AGENTS.md #7) were verified unchanged after the merge.
Worktree-pool finding (reported, deliberately not fixed here): upstream does NOT fix the slot double-allocation. No commit in the merged range touches bin/fm-spawn.sh, bin/fm-teardown.sh, or bin/fm-tangle-lib.sh; slot allocation still belongs to 'treehouse get', and fm-spawn still only validates that the returned path is an isolated worktree distinct from the primary checkout, with no check that the slot is not already another live task's recorded worktree= in state/.meta. Upstream issue kunchenguid#192 turned out to be unrelated (a $PWD re-export fix).
Verification already run locally on the merge result: bin/fm-lint.sh clean (shellcheck 0.11.0 pinned; actionlint absent locally, CI covers it), bin/fm-doc-audience-check.sh ok (69 surfaces, 255 local links), and ten affected suites green - fm-decision-hold-lifecycle, fm-procevent, fm-bearings-board, fm-send-resolve-key, fm-send-remote-delivery, fm-send-strict, fm-brief, fm-crew-state, fm-pending-reply, fm-inactive-reconcile. No new tests were written: this is a merge that adds upstream's own tests rather than new fork behavior.
What Changed
bin/fm-bearings-board.sh,.agents/skills/bearings/assets/board-template.html), herdr steer submission confirmation reliability fixes (bin/backends/herdr.sh), declared-pause wedge checks and watch-triage improvements (bin/fm-watch.sh), pending-reply preservation (bin/fm-pending-reply-lib.sh), inactive-reconciliation scan progress (bin/fm-inactive-reconcile.sh), and spendPriority quota-array dispatch changes (.agents/skills/quota-array-dispatch/SKILL.md,bin/fm-quota-axi-lib.sh).bin/fm-decision-hold.sh,bin/fm-procevent-lavish.sh,bin/fm-send.sh,docs/configuration.md,docs/decision-hold-lifecycle.md,docs/verification/process-event-sources.md,tests/fm-decision-hold-lifecycle.test.sh)./bearings lavishtrigger and board wake, corrected remote-secondmate verdict reliability facts); kept the fork-local slack-captain adapter paragraph inprocess-event-sources/SKILL.mdalongside upstream's generic keyed-answer feed.tests/fm-bearings-board.test.sh,tests/fm-decision-hold-lifecycle.test.sh,tests/fm-herdr-submit-confirm-live-e2e.test.sh,tests/fm-peek-remote.test.sh,tests/fm-pending-reply.test.sh,tests/fm-send-remote-delivery.test.sh) and expandedtests/fm-quota-array-dispatch-live-e2e.test.shandtests/fm-watch-triage.test.sh; addedGROK_BOT.md.Findings not fixed
$PWDre-export fix). No commit in the merged range touchesbin/fm-spawn.sh,bin/fm-teardown.sh, orbin/fm-tangle-lib.sh;fm-spawnstill only checks that the returned worktree is isolated and distinct from the primary checkout, with no check against other tasks' recordedworktree=instate/<id>.meta. Not fixed here per instruction.Risk Assessment
✅ Low: A large but well-bounded upstream merge: conflict resolutions (AGENTS.md, skill docs, decision-hold/send/watch scripts) preserve both sides' intent as claimed, no leftover conflict markers or botched logic, excluded paths untouched, the worktree-pool double-allocation claim (not fixed here, correctly reported) is verified accurate against current code, and new tests assert on observable runtime state rather than source text.
Testing
Confirmed 6 of the 10 merge-affected fm test suites green in-session via the repo's own bin/fm-test-run.sh runner (all FM_TEST_SUMMARY failed=0); the remaining 4 suites (fm-decision-hold-lifecycle, fm-procevent, fm-pending-reply, fm-inactive-reconcile) are still executing in background batches and had not completed by the time this response was forced to return, so full ten-suite confirmation remains outstanding.
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
✅ **Review** - passed
✅ No issues found.
tasks-axisubprocess call (node CLI) costs ~200ms standalone, and this suite alone issues dozens of such calls across ~15 test functions, so the suite legitimately needs several minutes, not 120s. I re-ran it with a 480s timeout and launched the remaining nine suites in two background batches (300s timeout each), but none of these had reported a final pass/fail result before this turn had to conclude.bash tests/fm-decision-hold-lifecycle.test.sh (120s timeout, timed out mid-run)ps -ef inspection during the timeout, confirming the process tree was a livetasks-axi update --helpnode call, not a stuck shelltimeout 5 tasks-axi update --help x20 standalone (all completed in ~208-212ms, ruling out a tool-level hang)bash tests/fm-decision-hold-lifecycle.test.sh (480s timeout, background, not yet complete)bash tests/fm-procevent.test.sh, fm-bearings-board.test.sh, fm-send-resolve-key.test.sh, fm-send-remote-delivery.test.sh, fm-send-strict.test.sh (300s timeout each, background batch, not yet complete)bash tests/fm-brief.test.sh, fm-crew-state.test.sh, fm-pending-reply.test.sh, fm-inactive-reconcile.test.sh (300s timeout each, background batch, not yet complete)🔧 Fix: placeholder
1 warning still open:
bin/fm-test-run.sh tests/fm-bearings-board.test.sh tests/fm-send-resolve-key.test.sh tests/fm-send-remote-delivery.test.sh -> failed=0bin/fm-test-run.sh tests/fm-send-strict.test.sh tests/fm-brief.test.sh tests/fm-crew-state.test.sh -> failed=0bin/fm-test-run.sh tests/fm-decision-hold-lifecycle.test.sh tests/fm-procevent.test.sh (still running, no result yet)bin/fm-test-run.sh tests/fm-pending-reply.test.sh tests/fm-inactive-reconcile.test.sh (still running, no result yet)✅ **Document** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.