feat: strengthen crew dispatch and recovery

[Ospeto]

Intent

Integrate upstream kunchenguid/firstmate main at exact audited commit 833a9a2 into fork Ospeto/firstmate from exact base head 5b49c0b, preserving every fork feature and shipping the integration through a pull request.

What Changed

• Add role-aware, quota-balanced crew profiles with bounded Antigravity quota preflight and automatic Luna fallback.
• Support safe crewmate and scout recovery by resuming the recorded isolated worktree, profile, and branch after endpoint loss.
• Standardize generated worker briefs with todo tracking, specialist and research guidance, bounded Oracle review, and stricter delivery-mode validation.

Risk Assessment

✅ Low: The timeout now encloses both checker execution and output draining, the tmux resume path remains safely repaired, and both the exact fork base and audited upstream commit are preserved ancestors of the target.

Testing

Git-history checks proved the exact two-parent audited integration; five focused automated suites and manual CLI/brief checks demonstrated preserved fork behavior end to end, all passed, reviewer-visible transcripts were captured, and the worktree remained clean. Push, PR, and remote CI validation remain owned by later outer-pipeline phases.

Evidence: Exact merge ancestry and conflict-surface transcript

Firstmate audited integration evidence

target: 8b5fbb03b3f23c36a41e3d848a759539035fbc63
subject: no-mistakes(review): Bound preflight drain within checker timeout

merge commit and exact parents:
merge: 7aecd0e09f97652c6e3490ad276c1a8c7d7d2983
parent 1 (fork base): 5b49c0bdecec53ced61ee8b7e8aad3fe787fb95a 833a9a25bcf2ae522d6f93dbbd9911a6d8e7c409
subject: Merge commit '833a9a25bcf2ae522d6f93dbbd9911a6d8e7c409' into fm/firstmate-upstream-sync

ancestry checks:
PASS audited upstream 833a9a25 is an ancestor of target
PASS fork base 5b49c0bd is an ancestor of target

first-parent integration stack:
7aecd0e Merge commit '833a9a25bcf2ae522d6f93dbbd9911a6d8e7c409' into fm/firstmate-upstream-sync
96fe14b style(tests): restore blank line in fm-spawn-dispatch-profile.test.sh
7e5b880 feat(dispatch): preserve Antigravity quota preflight and dispatch profile test assertions across upstream sync
ff0b62c chore(git): ignore .pi runtime directory
27acfd9 no-mistakes(review): Fix resume cleanup and bound preflight output
8b5fbb0 no-mistakes(review): Bound preflight drain within checker timeout

conflict surface reconstructed by Git:
7aecd0e Merge commit '833a9a25bcf2ae522d6f93dbbd9911a6d8e7c409' into fm/firstmate-upstream-sync
 bin/fm-spawn.sh                         | 40 ---------------------------------
 tests/fm-spawn-dispatch-profile.test.sh | 11 ---------
 2 files changed, 51 deletions(-)

Evidence: Carried fork CLI behavior transcript

Firstmate carried-fork CLI behavior

$ fm-project-mode.sh standard
direct-PR off

$ fm-project-mode.sh production
no-mistakes on

$ fm-project-mode.sh --raw production
no-mistakes-prod-only on

$ fm-project-mode.sh malformed
warn: malformed mode (unknown mode) for malformed; defaulting to no-mistakes off
no-mistakes off

$ fm-brief.sh audited-sync firstmate --mode no-mistakes
scaffolded: /var/folders/w6/329_yp2s4jsg59b_nbv1p1040000gn/T/no-mistakes-evidence/01KZJ3ED84J3K4EGXMGW2QY738/cli-fixture/data/audited-sync/brief.md (ship, mode=no-mistakes; replace {TASK})

Generated brief delivery and todo headings:
57:# Todo tracking
59:Create those items with your workspace `todo` tool.
62:# Definition of done

Evidence: Spawn, dispatch, preflight, fallback, and resume E2E transcript

ok - no --model/--effort records defaults and types the claude launch instructions
ok - relative home overrides ignore CDPATH and become absolute before spawn launch construction
ok - FM_HOME defaults resolve relative paths and preserve absolute spellings
ok - absolute override spellings are preserved in spawn launch paths
ok - unresolvable relative spawn overrides fail with named diagnostics
ok - active crew-dispatch profile requires an explicit harness for ship spawns
ok - active crew-dispatch profile requires an explicit harness for scout spawns
ok - active crew-dispatch profile allows an explicit resolved harness
ok - active crew-dispatch profile allows the legacy positional harness form
ok - active crew-dispatch profile allows the raw launch-command escape hatch
ok - claude receives --model and --effort profile flags
ok - codex receives --model and model_reasoning_effort profile flags
ok - codex omits unsupported max effort instead of passing a bad config value
ok - grok receives --model and --reasoning-effort profile flags
ok - grok omits unsupported max reasoning effort
ok - grok omits unsupported xhigh reasoning effort
ok - opencode receives --model and omits the unsupported effort axis
ok - pi receives --model and --thinking max profile flags
ok - pi-signed shares Pi launch semantics while preserving its configured and recorded identity
ok - pi-signed refuses safely and actionably when the selected executable is unavailable
ok - pi-signed is a distinct persistent secondmate runtime with shared Pi supervision semantics
ok - batch dispatch forwards shared --harness, --model, and --effort to every pair
ok - claude forwards firstmate's CLAUDE_CONFIG_DIR so the crewmate uses the same credential store
ok - claude omits the config-dir prefix when firstmate runs with the single-store default
ok - non-claude harnesses do not receive the claude CLAUDE_CONFIG_DIR prefix
ok - active crew-dispatch profile does not block secondmate launches
ok - exit 0 keeps the requested Antigravity model and effort
ok - native timeout path removes Perl as a required Antigravity dependency
ok - compatible gtimeout is selected when timeout lacks kill-after
ok - preflight refuses before metadata when no timer can clean descendants
ok - configured Antigravity profiles use the shared scout boundary
ok - exit 1 falls back to Luna high before endpoint and metadata publication
ok - exit 1 applies the Luna fallback to raw launch commands
ok - checker error exit code refuses without leaking checker stdout
ok - missing or non-executable checker refuses before endpoint creation
ok - preflight timeout refuses before endpoint creation
ok - Luna and other non-Antigravity models bypass the checker
ok - secondmate config models use the same preflight and accurate fallback metadata
ok - forked checker output descendants stay inside the preflight timeout
ok - invalid timeout and output limit settings refuse before endpoint creation
ok - default checker path under PI_CODING_AGENT_DIR is resolved and executed
ok - secondary checker path under PI_CODING_AGENT_DIR is resolved and executed when primary path is missing
ok - raw launch commands with embedded model flag trigger preflight and Luna fallback
ok - checker writing >8KB output with exit 0 does not receive SIGPIPE or fail
ok - state path containing spaces is handled safely
ok - --resume preserves commits and uncommitted changes while recording the actual profile
ok - single-quoted raw launch model and effort flags are parsed and cleanly replaced on fallback
ok - checker killed by signal refuses spawn and reports unrecognized result
# all fm-spawn-dispatch-profile tests passed

Evidence: Generated no-mistakes task brief

You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.

# Task
{TASK}

# Herdr lifecycle declaration - NOT ENABLED
**HARD SAFETY GATE:** this scaffold cannot inspect the task text that replaces `{TASK}` later.
If the task will start, stop, delete, restart, profile, or otherwise drive Herdr lifecycle behavior, stop and regenerate the brief with `--herdr-lab` before dispatch.
Do not add Herdr lifecycle commands to this unguarded brief by hand.

# Setup
You are in a disposable git worktree of firstmate, at a detached HEAD on a clean default branch.

**Verify isolation before anything else.** Run `pwd -P` and `git rev-parse --show-toplevel`; both must resolve to the disposable task worktree you were launched in, such as a treehouse pool path or an Orca-managed worktree, not the primary checkout firstmate operates from.
The path check is authoritative: `git rev-parse --git-dir` and `git rev-parse --git-common-dir` can help inspect the repo, but they do not prove you are outside the primary checkout.
If the top-level path is the primary checkout or not the worktree you were launched in, STOP - do not branch or commit here - append `blocked: launched in primary checkout, not an isolated worktree` to the status file and stop.

1. First action: create your branch: `git checkout -b fm/audited-sync`
2. Run `no-mistakes doctor`; if it reports the repo is not initialized here, run `no-mistakes init`.

# Rules
1. Never push to the default branch. Never merge a PR.
2. Stay inside this worktree; modify nothing outside it.
3. Use gh-axi for GitHub operations and chrome-devtools-axi for browser operations.
4. Report status by appending one line:
   `echo "{state}: {one short line}" >> '/var/folders/w6/329_yp2s4jsg59b_nbv1p1040000gn/T/no-mistakes-evidence/01KZJ3ED84J3K4EGXMGW2QY738/cli-fixture/state/audited-sync.status'`
   States: working, needs-decision, blocked, paused, done, failed.
   Each append wakes firstmate, so report sparingly: only phase changes a supervisor
   would act on (setup done, bug reproduced, fix implemented, validation passed) and the
   needs-decision/blocked/paused/done/failed states. No step-by-step FYI progress lines;
   firstmate reads your pane for that.
   A mid-task `working:` line (including setup complete) is nonterminal: do not end the
   turn after it; continue the same stage until a defined `done:` gate under Definition of done.
   Use `paused: {why}` - distinct from `blocked:` - ONLY when you are deliberately idling on a
   known external wait you expect to clear on its own (an upstream release, a rate-limit reset,
   a scheduled window): firstmate then leaves your idle pane alone and rechecks it on a long
   cadence instead of treating it as a possible wedge. Use `blocked:` when you are stuck and need help.
5. If you hit the same obstacle twice, append `blocked: {why}` and stop; firstmate will help.
6. If a decision belongs above the implementation worker (product choices, destructive actions, ask-user findings),
   append `needs-decision: {summary of options}` and stop. Firstmate will apply the configured authority and reply with the decision.
   A decision or blocker you opened stays open until a `resolved` line carrying its exact key lands; a later `done:` or `working:` line never closes it, even when the answer is what started that work.
   Firstmate's reply normally writes that closing line at answer time; when a blocker or wait clears WITHOUT a firstmate reply, append `resolved: {how it cleared}` yourself (same `[key=<slug>]` if you opened it with one) as you resume.
7. Never stop, restart, or update the shared `no-mistakes` daemon - it is one instance serving
   every lane/home, so restarting it kills other lanes' in-flight pipeline runs. On ANY no-mistakes
   daemon error, append `blocked: {the daemon error}` and stop; only firstmate manages the daemon.
8. Standard implementation uses one `antigravity/gemini-3.6-flash` crewmate at high effort unless Firstmate explicitly overrides dispatch. You own narrow supporting calls to installed specialists: use `@fixer` for targeted implementation, `@explorer` for repository mapping and search, `@plan` for architecture or implementation planning, `@designer` for frontend, UI, and visual work, and `@oracle` for independent correctness and risk review when authorized. Inspect and incorporate returned findings yourself, then return implementation, evidence, and any required PR to Firstmate while preserving this brief's isolation, approval, and delivery rules.
9. For web research, use Firecrawl MCP first: call `firecrawl_search`, call `firecrawl_search_feedback` after using its results, and use `firecrawl_scrape` for known pages. If Firecrawl is unavailable, use another tool only as a fallback and disclose that fallback in your findings.
10. Before pre-commit review, record the base and HEAD SHAs, then have the reviewer inspect the exact committed range with `git diff <base>...<HEAD>` and use `git show <base>..<HEAD>` for commit details; if the review tool cannot access those commits or shows an empty range, report the mismatch instead of reviewing it. Follow the authoritative role contract in `harness-adapters`: Fixer is implementation-only, Oracle is read-only correctness and architecture review, Lelouch is read-only post-PR release-risk review, ordinary deep Oracle review uses xhigh, and max requires explicit architecture or security escalation. Use one initial Oracle review and at most one re-review after fixes; if actionable findings remain after re-review, escalate or fail instead of looping.

# Project memory
If `AGENTS.md` or `CLAUDE.md` already exists, or if this task produced durable project-intrinsic knowledge, run `/Users/macbookair/.no-mistakes/worktrees/16740b5a3bf7/01KZJ3ED84J3K4EGXMGW2QY738/bin/fm-ensure-agents-md.sh .` in the worktree.
Record only project knowledge useful to almost every future session.
For anything the codebase already shows, prefer a pointer to the authoritative file, command, or doc over copying the detail.
If you touch a project `AGENTS.md` that lacks `## Maintaining this file`, add that short self-governance section from `/Users/macbookair/.no-mistakes/worktrees/16740b5a3bf7/01KZJ3ED84J3K4EGXMGW2QY738/bin/fm-ensure-agents-md.sh` in the same pass.
Keep it proportionate: skip `AGENTS.md` edits for trivial tasks that produced no durable project knowledge.

# Todo tracking
Derive a useful checklist from the filled `# Task`.
Create those items with your workspace `todo` tool.
Keep exactly one item in progress at a time, and complete items immediately when done.

# Definition of done
Delivery contract: mode=no-mistakes
The task is complete only when committed on your branch.
When you believe it is complete, append `done: {summary}` to the status file and stop.
Firstmate will then instruct you to run /no-mistakes to validate and ship a PR.

You drive no-mistakes by responding to its gates, not by implementing fixes.
Follow the guidance no-mistakes itself provides for the mechanics: it loads when you invoke /no-mistakes, and `no-mistakes axi run --help` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.
When starting no-mistakes, make `--intent` preserve all relevant content from this brief's `# Task` section plus every later accepted Firstmate requirement, clarification, constraint, exclusion, and supersession, carrying only each requirement's current accepted form; retain direct requirements instead of substituting a diff summary, and exclude generic operational, status, delivery, and other scaffold boilerplate unless it is task-specific.
Do not hand-edit, commit, or fix findings yourself while a run is active - the pipeline applies every fix.

Two firstmate-specific rules layer on top of that guidance:
- ask-user findings are never yours to answer: escalate to firstmate (rule 6) and stop.
  Firstmate applies the authority contract in its `AGENTS.md` and obtains any required captain decision.
  When the decision comes back, feed it to the gate with `no-mistakes axi respond` and let the pipeline apply it - do not route the question to "the user" or implement the fix yourself.
- Avoid `--yes`: it would silently bypass firstmate's authority check and any required captain escalation.

After /no-mistakes reports CI green (the CI-ready return point - do not wait for it to keep monitoring in the background until merge), append `done: PR {url} checks green` and stop. You are finished.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 1 warning

• ⚠️ .agents/skills/harness-adapters/SKILL.md - branch carries 6 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (45 file(s)) into the PR:
• 5b49c0b fix(spawn): remove orphaned closing brace in fm-spawn.sh
• 16e7635 Show workspace todos by default for future workers (fix: reduce crewmate status wake noise #6)
• c45850e feat(dispatch): add role-aware quota dispatch and recovery (ci: enforce contributor guardrails #5)
• e0b73ea feat(dispatch): reapply Antigravity quota preflight before spawn (docs: align tmux and harness guidance #3)
• 71aa761 docs: align Oracle review contract in AGENTS.md and briefs (docs: polish README banner and repo housekeeping #2)
• 2c39bd7 feat: standardize worker-owned crewmate workflow (chore: initialize no-mistakes gate #1)

Push main to origin, or rebase your branch onto origin/main, before gating.

🔧 **Review** - 2 issues found → auto-fixed (2) ✅

• 🚨 bin/fm-spawn.sh:822 - A normal tmux agent exit leaves its window alive with only a shell. This check classifies that endpoint as dead and permits resume, but the later fm_backend_tmux_create_task call refuses because the same fm-<id> window still exists. Thus --resume fails in its primary recovery scenario; the current test omits window= and misses this sequence. After the ownership check, reuse or remove the confirmed-dead endpoint before creating its replacement.
• ⚠️ bin/fm-spawn.sh:1100 - FM_ANTIGRAVITY_PREFLIGHT_OUTPUT_BYTES is validated but never applied: all checker output is written to the temporary file until the timeout. A noisy checker can therefore consume unbounded disk for 30 seconds, contradicting the documented bounded-output invariant. Since the output is never read, discard it or cap storage while continuing to drain the process.

🔧 Fix: Fix resume cleanup and bound preflight output
1 error still open:

• 🚨 bin/fm-spawn.sh:1103 - The new drain sits outside timeout. If the checker exits after spawning a background child that inherits stdout, timeout returns but cat waits for that descendant to close the pipe, so the 30-second preflight can hang indefinitely. The existing forked-checker fixture redirects the child’s stdout and does not exercise this sequence. Put the producer and drain under the same process-group timeout, or simply discard checker output since it is never consumed.

🔧 Fix: Bound preflight drain within checker timeout
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• git show -s --format=... 7aecd0e09f97652c6e3490ad276c1a8c7d7d2983 and git merge-base --is-ancestor for upstream 833a9a25…, fork base 5b49c0bd…, and target 8b5fbb03…
• git show --remerge-diff --stat 7aecd0e09f97652c6e3490ad276c1a8c7d7d2983
• bash tests/fm-spawn-dispatch-profile.test.sh
• bash tests/fm-brief.test.sh
• bash tests/fm-task-delivery.test.sh
• bash tests/fm-bootstrap.test.sh
• bash tests/fm-secondmate-lifecycle-e2e.test.sh
• Manual isolated fm-project-mode.sh checks for direct-PR, conditional +yolo, raw policy, and malformed-policy fallback
• Manual fm-brief.sh audited-sync firstmate --mode no-mistakes generation and inspection
• bash tests/fm-spawn-dispatch-profile.test.sh | tee .../spawn-dispatch-e2e.txt
• Final git status --short and evidence-file verification

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Suppress intentional child-shell expansion lint warning
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.

[Ospeto]

Closing upstream PR: intended target is fork Ospeto/firstmate:main.