feat(bin): recurring automated review sweep across the fleet

[meisbokai]

Intent

Build a recurring, automated review sweep for firstmate (cron, every 8h) that
reviews every open fleet PR with review-rectify-pi --push (review-only), excluding
drafts and already-approved PRs, keeping failing-CI PRs (with a ## CI Failure
investigation), bounded to 3 concurrent, with a clean-APPROVE -> Jira In-Review
tie-in. Includes bin/fm-review-sweep.sh, the headless fm-spawn.sh launch fix
(stable worktree detection + post-launch verify + --approve), AGENTS.md/README.md
docs, and behavior tests. This re-run pushes via the meisbokai/firstmate fork
(contributor has no push access to kunchenguid/firstmate; CONTRIBUTING.md fork
workflow). Branch HEAD already passed review/test/lint in the prior run; only the
push failed on permissions, now resolved by the fork.

What Changed

• Adds bin/fm-review-sweep.sh, a cron-driven sweep that enumerates every open fleet PR, drops drafts and already-approved PRs (reviewDecision=APPROVED), keeps failing-CI PRs (adding a CI-failure investigation to the review), and dispatches review-rectify-pi in review-only --push mode bounded to FM_SWEEP_CONCURRENCY (3); on a clean APPROVE it moves the PR's linked MILE-\d+ Jira ticket to "In Review".
• Reworks headless launch in bin/fm-spawn.sh: adds --approve to the pi launch template, replaces the naive cwd check with treehouse-path + interactive-shell + two-poll stability detection (defeats the $HOME path transient and the treehouse get foreground race), and adds a post-launch verify that resends once if the harness binary isn't seen within 40s.
• Adds behavior tests for the sweep helpers in tests/fm-review-sweep.test.sh and documents the sweep, its state files, and the headless-launch reliability in AGENTS.md and README.md.

Risk Assessment

✅ Low: This is a focused fix-up commit that correctly resolves all 5 prior findings with minimal, targeted changes consistent with existing firstmate conventions, and introduces no new material risks.

Testing

Exercised the review sweep's real cron code path (enumerate→filter→CI-classify→plan→brief→Jira→flock) against a stubbed-gh fleet via the real main() with redirected paths, and verified the headless fm-spawn.sh detection/verify logic against scripted tmux sequences that replay the documented race conditions. All 25 sweep e2e checks, all 9 spawn-logic checks, and the project's 12 behavior tests pass; the dry-run plan, sweep.log, and both briefs are captured as artifacts showing the intended review-only + failing-CI-kept + clean-APPROVE→Jira behavior. One coverage gap (not a defect): a fully live headless spawn (real treehouse pool + real pi/claude binary) was not run because warming the pool and launching real harnesses would write worktrees/processes outside the worktree boundary and risk interfering with the no-mistakes gate's own treehouse machinery; the spawn fix's per-step logic is instead proven via verbatim-copied predicates driven by scripted pane outputs.

Evidence: Sweep --dry-run plan (what cron prints: candidates with CI flags; draft #2 & approved #3 filtered)

==== DRY RUN PLAN ==== concurrency=3 task_timeout=1800s repo #num cifail title veridianlab/racgoon #1 pass https://github.com/veridianlab/racgoon/pull/1
veridianlab/racgoon #4 fail https://github.com/veridianlab/racgoon/pull/4
veridianlab/infra #10 pass https://github.com/veridianlab/infra/pull/10
==== END DRY RUN (dispatched nothing) ====

sweep: enumerating fleet PRs...
  repo veridianlab/racgoon (projects/racgoon)
  repo veridianlab/infra (projects/racgoon-infra)

==== DRY RUN PLAN ====
concurrency=3  task_timeout=1800s
repo	#num	cifail	title
veridianlab/racgoon	#1	pass	https://github.com/veridianlab/racgoon/pull/1
veridianlab/racgoon	#4	fail	https://github.com/veridianlab/racgoon/pull/4
veridianlab/infra	#10	pass	https://github.com/veridianlab/infra/pull/10
==== END DRY RUN (dispatched nothing) ====

Evidence: state/sweep.log cron run log (filter reasons, plan count, Jira moves + no-key composition)

==== sweep start 2026-06-22T12:49:43Z (dry-run=1, concurrency=3) ==== filter veridianlab/racgoon#2 draft filter veridianlab/racgoon#3 approved plan 3 candidate PR(s) across 2 repo(s) (after draft+approved filters) ==== sweep end (dry-run, 3 candidates) ==== jira veridianlab/racgoon#1 APPROVE -> moved MILE-1001 to In Review jira veridianlab/racgoon#99 APPROVE but no MILE- key in title/body; skipping transition

==== sweep start 2026-06-22T12:49:43Z (dry-run=1, concurrency=3) ====

  filter  veridianlab/racgoon#2 draft
  filter  veridianlab/racgoon#3 approved

  plan    3 candidate PR(s) across 2 repo(s) (after draft+approved filters)
==== sweep end (dry-run, 3 candidates) ====
  jira    veridianlab/racgoon#1 APPROVE -> moved MILE-1001 to In Review
  jira    veridianlab/racgoon#99 APPROVE but no MILE- key in title/body; skipping transition

==== sweep start 2026-06-22T12:49:46Z (dry-run=1, concurrency=3) ====

  plan    1 candidate PR(s) across 1 repo(s) (after draft+approved filters)
==== sweep end (dry-run, 1 candidates) ====

Evidence: Red-PR review brief: dedicated ## CI failure root-cause investigation section (gh pr checks / gh run view --log-failed)

You are a crewmate dispatched by the automated review sweep. Work autonomously; do not wait for a human.

# Task
Run a **fresh code review** of PR **veridianlab/racgoon#4** and post it as the PR's review
comment. This is **REVIEW-ONLY**: review and post — do NOT edit any code, do NOT
push any fix, do NOT change the branch beyond checking out the PR to review it.

# Engine
Use the **review-rectify-pi** skill in **`--push`** mode. Invoke it so it runs
its full pipeline (existing-comment rectification + fresh code review + merged
findings table + recommendation) and posts/replaces the single
"Review Findings - Rectification Status" comment on the PR.

# Setup
You are in a treehouse worktree of `veridianlab/racgoon` (clone at `/tmp/tmp.nkr9mgwbHh/projects/racgoon`) on a detached
HEAD of the default branch. To review THIS PR, check out its head commit IN THIS
WORKTREE (never touch the pooled clone — review here, in your disposable worktree):
1. `gh pr checkout 4 --repo veridianlab/racgoon`  — run this from your worktree; it fetches
   the PR head and checks it out locally. If it refuses (shared worktree / branch
   exists), fall back to a detached checkout of the head:
   `git fetch origin pull/4/head && git checkout --detach FETCH_HEAD`.
2. Confirm you are on the PR head: `git rev-parse HEAD` should equal the PR's
   head SHA (`gh pr view 4 --repo veridianlab/racgoon --json headRefOid -q .headRefOid`).

## CI failure (this PR's CI is RED — investigate before reviewing)
This PR's GitHub checks are FAILING. As part of this review you MUST investigate
the ROOT CAUSE of the CI failure and include a `## CI Failure` section in the
posted review comment. Steps:
- `gh pr checks 4 --repo veridianlab/racgoon` to list the checks; identify the FAILING job(s).
- Open the failing job's log: `gh run view <run-id> --repo veridianlab/racgoon --log-failed`
  (or the job URL from `gh pr checks`). Read the actual error.
- Name the failing job and quote the error in the `## CI Failure` section, with a
  one-line root-cause assessment (compile error, test failure, lint, env, flake?).
The review-rectify-pi recommendation may still be APPROVE if the code is sound
and CI fails for an unrelated/env reason — but the failure MUST be documented.

# How to run the review
- Invoke review-rectify-pi with **`--push`** so it posts the comment to GitHub.
- The skill already deletes its prior "Review Findings - Rectification Status"
  comment and posts the fresh one (Phase 9) — do NOT manually delete comments.
- Scope the review to the PR's diff. The skill computes diff scope itself; make
  sure you are on the PR head (step above) so `git diff main...HEAD` is correct.
- Pre-push validation (Phase 8.5) runs the project's lint/typecheck/test. If that
  fails because of the RED CI, that is expected for failing-CI PRs — still post
  the review with the `## CI Failure` section; do not block on Phase 8.5.

# Rules
1. REVIEW-ONLY. Never edit project code, never commit, never push, never open or
   merge a PR. The only GitHub write you do is the review comment (via the skill).
2. Stay inside this worktree; the only files you may write outside it are the
   status file below.
3. Use gh / gh-axi for GitHub operations.
4. Report status by appending one line:
   `echo "{state}: {one short line}" >> /tmp/tmp.nkr9mgwbHh/state/sweep-test-fail.status`
   States: working, needs-decision, blocked, done, failed.
5. If you hit the same obstacle twice, append `blocked: {why}` and stop.
6. If a decision belongs to a human, append `needs-decision: {summary}` and stop.

# Definition of done
The review comment is posted to veridianlab/racgoon#4. When posted, append
`done: posted review to veridianlab/racgoon#4` to the status file and STOP (exit pi with
`/quit`). Do not attempt to fix anything the review found.

Evidence: Green-PR review brief: REVIEW-ONLY contract (review-rectify-pi --push; never edit/commit/push/merge)

You are a crewmate dispatched by the automated review sweep. Work autonomously; do not wait for a human.

# Task
Run a **fresh code review** of PR **veridianlab/racgoon#1** and post it as the PR's review
comment. This is **REVIEW-ONLY**: review and post — do NOT edit any code, do NOT
push any fix, do NOT change the branch beyond checking out the PR to review it.

# Engine
Use the **review-rectify-pi** skill in **`--push`** mode. Invoke it so it runs
its full pipeline (existing-comment rectification + fresh code review + merged
findings table + recommendation) and posts/replaces the single
"Review Findings - Rectification Status" comment on the PR.

# Setup
You are in a treehouse worktree of `veridianlab/racgoon` (clone at `/tmp/tmp.nkr9mgwbHh/projects/racgoon`) on a detached
HEAD of the default branch. To review THIS PR, check out its head commit IN THIS
WORKTREE (never touch the pooled clone — review here, in your disposable worktree):
1. `gh pr checkout 1 --repo veridianlab/racgoon`  — run this from your worktree; it fetches
   the PR head and checks it out locally. If it refuses (shared worktree / branch
   exists), fall back to a detached checkout of the head:
   `git fetch origin pull/1/head && git checkout --detach FETCH_HEAD`.
2. Confirm you are on the PR head: `git rev-parse HEAD` should equal the PR's
   head SHA (`gh pr view 1 --repo veridianlab/racgoon --json headRefOid -q .headRefOid`).


# How to run the review
- Invoke review-rectify-pi with **`--push`** so it posts the comment to GitHub.
- The skill already deletes its prior "Review Findings - Rectification Status"
  comment and posts the fresh one (Phase 9) — do NOT manually delete comments.
- Scope the review to the PR's diff. The skill computes diff scope itself; make
  sure you are on the PR head (step above) so `git diff main...HEAD` is correct.
- Pre-push validation (Phase 8.5) runs the project's lint/typecheck/test. If that
  fails because of the RED CI, that is expected for failing-CI PRs — still post
  the review with the `## CI Failure` section; do not block on Phase 8.5.

# Rules
1. REVIEW-ONLY. Never edit project code, never commit, never push, never open or
   merge a PR. The only GitHub write you do is the review comment (via the skill).
2. Stay inside this worktree; the only files you may write outside it are the
   status file below.
3. Use gh / gh-axi for GitHub operations.
4. Report status by appending one line:
   `echo "{state}: {one short line}" >> /tmp/tmp.nkr9mgwbHh/state/sweep-test-pass.status`
   States: working, needs-decision, blocked, done, failed.
5. If you hit the same obstacle twice, append `blocked: {why}` and stop.
6. If a decision belongs to a human, append `needs-decision: {summary}` and stop.

# Definition of done
The review comment is posted to veridianlab/racgoon#1. When posted, append
`done: posted review to veridianlab/racgoon#1` to the status file and STOP (exit pi with
`/quit`). Do not attempt to fix anything the review found.

Evidence: --one REPO run: sweep restricted to a single repo

sweep: enumerating fleet PRs... repo veridianlab/infra (projects/racgoon-infra) ==== DRY RUN PLAN ==== repo #num cifail title veridianlab/infra #10 pass https://github.com/veridianlab/infra/pull/10
==== END DRY RUN (dispatched nothing) ====

sweep: enumerating fleet PRs...
  repo veridianlab/infra (projects/racgoon-infra)

==== DRY RUN PLAN ====
concurrency=3  task_timeout=1800s
repo	#num	cifail	title
veridianlab/infra	#10	pass	https://github.com/veridianlab/infra/pull/10
==== END DRY RUN (dispatched nothing) ====

Evidence: Sweep e2e results (25/25 checks pass)

PASS :: candidate #1 (pass CI) kept in plan PASS :: candidate #4 (fail CI) kept in plan PASS :: candidate infra#10 (pending CI -> pass) kept PASS :: draft #2 filtered out PASS :: already-approved #3 filtered out PASS :: FAILING-CI #4 is KEPT, not skipped PASS :: second run refused with the lock message PASS :: green brief states REVIEW-ONLY PASS :: green brief uses review-rectify-pi PASS :: green brief runs --push PASS :: green brief has never-push rule PASS :: no red-only CI-investigation section on a green PR PASS :: red brief has dedicated ## CI Failure section PASS :: red brief mandates investigate root-cause PASS :: red brief instructs reading the failing job log PASS :: red brief instructs listing the checks PASS :: exactly one Jira transition (APPROVE fired, CONDITIONAL suppressed) PASS :: transition targets MILE-1001 -> In Review PASS :: no transition when PR has no MILE key PASS :: no-key case logged (composes with standing rule) PASS :: APPROVE parses to APPROVE PASS :: CONDITIONAL APPROVE parses to CONDITIONAL (not APPROVE) PASS :: BLOCK parses to BLOCK PASS :: --one ran only the named repo PASS :: --one excluded the other repo -- totals: 25 passed, 0 failed -- ALL E2E CHECKS PASSED

PASS :: candidate #1 (pass CI) kept in plan
PASS :: candidate #4 (fail CI) kept in plan
PASS :: candidate infra#10 (pending CI -> pass) kept
PASS :: draft #2 filtered out
PASS :: already-approved #3 filtered out
PASS :: FAILING-CI #4 is KEPT, not skipped
PASS :: second run refused with the lock message
PASS :: green brief states REVIEW-ONLY
PASS :: green brief uses review-rectify-pi
PASS :: green brief runs --push
PASS :: green brief has never-push rule
PASS :: no red-only CI-investigation section on a green PR
PASS :: red brief has dedicated ## CI Failure section
PASS :: red brief mandates investigate root-cause
PASS :: red brief instructs reading the failing job log
PASS :: red brief instructs listing the checks
PASS :: exactly one Jira transition (APPROVE fired, CONDITIONAL suppressed)
PASS :: transition targets MILE-1001 -> In Review
PASS :: no transition when PR has no MILE key
PASS :: no-key case logged (composes with standing rule)
PASS :: APPROVE parses to APPROVE
PASS :: CONDITIONAL APPROVE parses to CONDITIONAL (not APPROVE)
PASS :: BLOCK parses to BLOCK
PASS :: --one ran only the named repo
PASS :: --one excluded the other repo

Evidence: Headless spawn-logic results (9/9: detection + verify + --approve)

PASS :: transient HOME is skipped, worktree captured after it settles PASS :: captured path is the real treehouse worktree (not HOME) PASS :: waits past the treehouse-foreground race, then captures the subshell PASS :: no launch keystrokes sent during the foreground race PASS :: empty WT when only HOME is ever reported (would trigger the error+exit) PASS :: harness detected once pane_current_command flips to the harness binary PASS :: first 40 polls at a shell do NOT falsely verify (resend-once path engages) PASS :: pi launch template passes --approve (clears project-trust gate for headless dispatch) PASS :: brief still passed as the single positional argument

PASS :: transient HOME is skipped, worktree captured after it settles
PASS :: captured path is the real treehouse worktree (not HOME)
PASS :: waits past the treehouse-foreground race, then captures the subshell
PASS :: no launch keystrokes sent during the foreground race
PASS :: empty WT when only HOME is ever reported (would trigger the error+exit)
PASS :: harness detected once pane_current_command flips to the harness binary
PASS :: first 40 polls at a shell do NOT falsely verify (resend-once path engages)
PASS :: pi launch template passes --approve (clears project-trust gate for headless dispatch)
PASS :: brief still passed as the single positional argument

Evidence: End-to-end sweep harness script (reproducible: stubs gh/jira, runs real main())

#!/usr/bin/env bash
# End-to-end exercise of fm-review-sweep.sh decision pipeline (cron sweep logic).
# Stubs `gh`/`jira` with a realistic fleet; SOURCES the sweep (main guard prevents
# execution on source) and calls the REAL main() with redirected globals — same
# code path cron runs, with paths pointed at a temp FM_ROOT. No network/PRs.
set -u

WORK="$1"            # repo worktree (has bin/fm-review-sweep.sh)
SWEEP="$WORK/bin/fm-review-sweep.sh"
EVIDENCE="$2"
mkdir -p "$EVIDENCE"

ROOT=$(mktemp -d)            # stands in for FM_ROOT
mkdir -p "$ROOT/bin" "$ROOT/state" "$ROOT/data"

# ---- realistic fleet registry --------------------------------------------
cat > "$ROOT/projects.md" <<'EOF'
# Fleet registry
- racgoon [no-mistakes] - Backend Go service — github.com/veridianlab/racgoon (added 2026-06-22)
- racgoon-infra [no-mistakes] - Terraform IaC — github.com/veridianlab/infra (added 2026-06-22)
EOF

# ---- robust stub `gh`: dispatch on subcommand + parse --repo --------------
cat > "$ROOT/bin/gh" <<'GHSTUB'
#!/usr/bin/env bash
set -u
repof() { printf '%s' "$*" | grep -oE -- '--repo [^ ]+' | sed 's/--repo //'; }
case "$1 $2" in
  "pr list")
    repo="$(repof "$*")"
    case "$repo" in
      veridianlab/racgoon) cat <<'JSON'
[{"number":1,"isDraft":false,"reviewDecision":null,"title":"feat: auth flow (MILE-1001)","url":"https://github.com/veridianlab/racgoon/pull/1","headRefOid":"aaa111"},{"number":2,"isDraft":true,"reviewDecision":null,"title":"wip: draft","url":"https://github.com/veridianlab/racgoon/pull/2","headRefOid":"bbb222"},{"number":3,"isDraft":false,"reviewDecision":"APPROVED","title":"already approved","url":"https://github.com/veridianlab/racgoon/pull/3","headRefOid":"ccc333"},{"number":4,"isDraft":false,"reviewDecision":null,"title":"feat: payments (MILE-1004) - CI red","url":"https://github.com/veridianlab/racgoon/pull/4","headRefOid":"ddd444"}]
JSON
        ;;
      veridianlab/infra) cat <<'JSON'
[{"number":10,"isDraft":false,"reviewDecision":null,"title":"chore: bump provider","url":"https://github.com/veridianlab/infra/pull/10","headRefOid":"eee555"}]
JSON
        ;;
    esac
    exit 0 ;;
  "pr checks")
    num="$3"; repo="$(repof "$*")"
    case "${repo}#${num}" in
      "veridianlab/racgoon#1") printf '%s' '["SUCCESS","SUCCESS"]'; exit 0 ;;
      "veridianlab/racgoon#4") printf '%s' '["SUCCESS","FAILURE"]'; exit 1 ;;  # gh exits 1 on FAILURE
      "veridianlab/infra#10")  printf '%s' '["STARTED","PENDING"]'; exit 8 ;;  # gh exits 8 while pending
    esac
    printf '%s' '[]'; exit 0 ;;
  "pr view")
    num="$3"
    case "$num" in
      1) printf '%s' 'feat: auth flow (MILE-1001)' ;;
      4) printf '%s' 'feat: payments (MILE-1004) - CI red' ;;
      *) printf '%s' 'no ticket here' ;;
    esac
    exit 0 ;;
  api\ repos*)
    # gh api repos/.../comments : $2 is the full path, so prefix-match.
    printf '### Recommendation: %s\n' "${SWEEP_RECO:-APPROVE}"
    exit 0 ;;
esac
exit 0
GHSTUB
chmod +x "$ROOT/bin/gh"

# ---- stub `jira` (records transitions; never real) -----------------------
JLOG="$ROOT/jira-calls.log"; : > "$JLOG"
cat > "$ROOT/bin/jira" <<EOF
#!/usr/bin/env bash
echo "jira: \$*" >> "$JLOG"
exit 0
EOF
chmod +x "$ROOT/bin/jira"

export PATH="$ROOT/bin:$PATH"

# results accumulator on disk (subshell-safe)
RESULTS="$ROOT/results.txt"; : > "$RESULTS"
chk() { if eval "$1"; then echo "PASS :: $2" >> "$RESULTS"; else echo "FAIL :: $2" >> "$RESULTS"; fi; }

# helper: source sweep and redirect ALL derived globals to $ROOT
sourced() {
  . "$SWEEP"
  FM_ROOT="$ROOT"
  STATE_DIR="$ROOT/state"; PROJECTS_MD="$ROOT/projects.md"
  SWEEP_LOG="$ROOT/state/sweep.log"; SWEEP_RUN_DIR="$ROOT/state/sweep"
  export FM_ROOT
}

echo "########## 1) DRY-RUN: full enumerate -> filter -> CI-classify -> plan"
( sourced; main --dry-run ) > "$ROOT/dryrun.out" 2>&1
echo "rc=$?"
cat "$ROOT/dryrun.out"

echo
echo "########## 2) sweep.log (the cron run log the captain inspects)"
cat "$ROOT/state/sweep.log"

echo
echo "########## 3) filtering invariants from the plan"
chk 'grep -q "veridianlab/racgoon	#1	pass" "$ROOT/dryrun.out"' "candidate #1 (pass CI) kept in plan"
chk 'grep -q "veridianlab/racgoon	#4	fail" "$ROOT/dryrun.out"' "candidate #4 (fail CI) kept in plan"
chk 'grep -q "veridianlab/infra	#10	pass" "$ROOT/dryrun.out"' "candidate infra#10 (pending CI -> pass) kept"
chk '! grep -q "#2" "$ROOT/dryrun.out"' "draft #2 filtered out"
chk '! grep -q "#3" "$ROOT/dryrun.out"' "already-approved #3 filtered out"
chk 'grep -q "#4" "$ROOT/dryrun.out"' "FAILING-CI #4 is KEPT, not skipped"

echo
echo "########## 4) flock guard: a second concurrent run is refused gracefully"
(
  exec 9>>"$ROOT/state/.sweep.lock"
  flock -n 9 || exit 1
  echo "fixture-holds-lock" > "$ROOT/lock-held"
  sleep 3
) &
FX=$!
sleep 0.6
( sourced; main --dry-run ) > "$ROOT/second.out" 2>&1
rc=$?
echo "second run rc=$rc  (expected 0 — refused, not crashed)"
cat "$ROOT/second.out"
chk 'grep -q "another run holds the lock" "$ROOT/second.out"' "second run refused with the lock message"
wait $FX 2>/dev/null

echo
echo "########## 5) write_brief: REVIEW-ONLY contract (green PR)"
( sourced
  write_brief "sweep-test-pass" "veridianlab/racgoon" 1 "pass" "projects/racgoon" >/dev/null
  echo "brief: $ROOT/data/sweep-test-pass/brief.md"
  grep -qi "REVIEW-ONLY" "$ROOT/data/sweep-test-pass/brief.md" && echo "  yes: states REVIEW-ONLY"
  grep -qi "review-rectify-pi" "$ROOT/data/sweep-test-pass/brief.md" && echo "  yes: uses review-rectify-pi"
  grep -qi -- "--push" "$ROOT/data/sweep-test-pass/brief.md" && echo "  yes: --push mode"
  grep -qi "do NOT push" "$ROOT/data/sweep-test-pass/brief.md" && echo "  yes: never-push rule"
  chk 'grep -qi "REVIEW-ONLY" "$ROOT/data/sweep-test-pass/brief.md"' "green brief states REVIEW-ONLY"
  chk 'grep -qi "review-rectify-pi" "$ROOT/data/sweep-test-pass/brief.md"' "green brief uses review-rectify-pi"
  chk 'grep -qi -- "--push" "$ROOT/data/sweep-test-pass/brief.md"' "green brief runs --push"
  chk 'grep -qi "never push" "$ROOT/data/sweep-test-pass/brief.md"' "green brief has never-push rule"
  chk '! grep -qi "CI failure (this PR" "$ROOT/data/sweep-test-pass/brief.md"' "no red-only CI-investigation section on a green PR"
)

echo
echo "########## 6) write_brief: RED PR adds the ## CI Failure investigation section"
( sourced
  write_brief "sweep-test-fail" "veridianlab/racgoon" 4 "fail" "projects/racgoon" >/dev/null
  echo "brief: $ROOT/data/sweep-test-fail/brief.md"
  grep -qi "CI failure (this PR" "$ROOT/data/sweep-test-fail/brief.md" && echo "  yes: dedicated CI Failure section"
  grep -qi "investigate" "$ROOT/data/sweep-test-fail/brief.md" && echo "  yes: investigate mandate"
  grep -qi "gh run view" "$ROOT/data/sweep-test-fail/brief.md" && echo "  yes: read failing job log"
  chk 'grep -qi "CI failure (this PR" "$ROOT/data/sweep-test-fail/brief.md"' "red brief has dedicated ## CI Failure section"
  chk 'grep -qi "investigate" "$ROOT/data/sweep-test-fail/brief.md"' "red brief mandates investigate root-cause"
  chk 'grep -qi "gh run view" "$ROOT/data/sweep-test-fail/brief.md"' "red brief instructs reading the failing job log"
  chk 'grep -qi "gh pr checks" "$ROOT/data/sweep-test-fail/brief.md"' "red brief instructs listing the checks"
)

echo
echo "########## 7) Jira tie-in: clean APPROVE moves; CONDITIONAL does not"
: > "$JLOG"
( sourced
  maybe_transition_jira "veridianlab/racgoon" 1 "APPROVE"
  maybe_transition_jira "veridianlab/racgoon" 1 "CONDITIONAL"
)
echo "-- jira invocations recorded (expect exactly one 'issue move ... In Review') --"
cat "$JLOG"
chk '[ "$(grep -c "issue move" "$JLOG")" -eq 1 ]' "exactly one Jira transition (APPROVE fired, CONDITIONAL suppressed)"
chk 'grep -q "issue move MILE-1001 In Review" "$JLOG"' "transition targets MILE-1001 -> In Review"
: > "$JLOG"
( sourced
  maybe_transition_jira "veridianlab/racgoon" 99 "APPROVE"  # PR 99 has no MILE key
)
chk '[ "$(grep -c "issue move" "$JLOG")" -eq 0 ]' "no transition when PR has no MILE key"
chk 'grep -q "no MILE- key" "$ROOT/state/sweep.log"' "no-key case logged (composes with standing rule)"

echo
echo "########## 8) parse_recommendation across decision words"
( sourced
  for dec in APPROVE "CONDITIONAL APPROVE" BLOCK "REQUEST CHANGES" CAUTION; do
    r=$(SWEEP_RECO="$dec" parse_recommendation veridianlab/racgoon 1)
    printf 'recommendation %-22s -> parsed=[%s]\n' "[$dec]" "$r"
  done
  chk '[ "$(SWEEP_RECO=APPROVE parse_recommendation veridianlab/racgoon 1)" = "APPROVE" ]' "APPROVE parses to APPROVE"
  chk '[ "$(SWEEP_RECO="CONDITIONAL APPROVE" parse_recommendation veridianlab/racgoon 1)" = "CONDITIONAL" ]' "CONDITIONAL APPROVE parses to CONDITIONAL (not APPROVE)"
  chk '[ "$(SWEEP_RECO=BLOCK parse_recommendation veridianlab/racgoon 1)" = "BLOCK" ]' "BLOCK parses to BLOCK"
)

echo
echo "########## 9) --one REPO restricts the sweep to a single repo"
( sourced; main --one veridianlab/infra --dry-run ) > "$ROOT/one.out" 2>&1
echo "rc=$?"
cat "$ROOT/one.out"
chk 'grep -q "infra	#10" "$ROOT/one.out"' "--one ran only the named repo"
chk '! grep -q "racgoon	#1" "$ROOT/one.out"' "--one excluded the other repo"

echo
echo "########## RESULT SUMMARY"
echo "-- checks --"
cat "$RESULTS"
F=$(grep -c '^FAIL' "$RESULTS" || true)
P=$(grep -c '^PASS' "$RESULTS" || true)
echo "-- totals: $P passed, $F failed --"
[ "$F" -eq 0 ] && echo "########## ALL E2E CHECKS PASSED" || echo "########## SOME E2E CHECKS FAILED"

cp "$RESULTS" "$EVIDENCE/sweep-e2e-results.txt"
cp "$ROOT/dryrun.out" "$EVIDENCE/sweep-dryrun-output.txt"
cp "$ROOT/state/sweep.log" "$EVIDENCE/sweep-cron-log.txt"
cp "$ROOT/data/sweep-test-fail/brief.md" "$EVIDENCE/sweep-brief-failing-ci.md"
cp "$ROOT/data/sweep-test-pass/brief.md" "$EVIDENCE/sweep-brief-green.md"
cp "$ROOT/one.out" "$EVIDENCE/sweep-one-repo-output.txt"
echo "evidence copied to $EVIDENCE"

Evidence: Spawn-logic harness script (verbatim predicates driven by scripted tmux)

#!/usr/bin/env bash
# Verifies the fm-spawn.sh headless-launch detection LOGIC against scripted tmux
# pane sequences that replay the exact race conditions the fix documents.
# The predicate functions (is_treehouse_path, is_interactive_shell) and the
# detection/verify loop bodies are copied VERBATIM from bin/fm-spawn.sh so this
# exercises the real logic; only `tmux` and `sleep` are stubbed (no real tmux /
# treehouse / harness processes are spawned — keeps the test inside the worktree
# boundary and deterministic).
set -u

WORK="$1"; SPAWN="$WORK/bin/fm-spawn.sh"; EVIDENCE="$2"; mkdir -p "$EVIDENCE"
ROOT=$(mktemp -d); mkdir -p "$ROOT/bin"
RESULTS="$ROOT/results.txt"; : > "$RESULTS"
chk() { if eval "$1"; then echo "PASS :: $2" >> "$RESULTS"; else echo "FAIL :: $2" >> "$RESULTS"; fi; }

# ---- VERBATIM predicate copies from bin/fm-spawn.sh (lines 132-141) --------
is_treehouse_path() {
  case "$1" in *.treehouse/*) return 0 ;; *) return 1 ;; esac
}
is_interactive_shell() {
  case "$(basename "$1")" in fish|bash|zsh|sh|dash) return 0 ;; *) return 1 ;; esac
}

# ---- stub tmux: pops scripted (path<TAB>cmd) pairs per display-message call -
# A global SCRIPT array holds "path|cmd" frames; each tmux display-message for
# pane_current_path returns the path of the current frame, for pane_current_command
# the cmd. advance() moves to the next frame. send-keys / new-window are recorded.
TMUXLOG="$ROOT/tmux.log"; : > "$TMUXLOG"
NEXT=0
SCRIPT=()
advance() { NEXT=$((NEXT+1)); }
tmux() {
  local arg rest
  case "$1" in
    new-window|send-keys|has-session|new-session|list-windows)
      echo "tmux $*" >> "$TMUXLOG"; return 0 ;;
    display-message)
      rest="$*"
      if printf '%s' "$rest" | grep -q 'pane_current_path'; then
        printf '%s' "${SCRIPT[$NEXT]:-EOF}" | cut -d'|' -f1
      elif printf '%s' "$rest" | grep -q 'pane_current_command'; then
        printf '%s' "${SCRIPT[$NEXT]:-EOF}" | cut -d'|' -f2
      fi ;;
  esac
}
# fast sleep
sleep() { :; }

PROJ_ABS="/home/captain/projects/acme"   # the project we launched from
T="t:fm-x"
HARNESS="pi"; EXPECTED_CMD="pi"

# ---- VERBATIM worktree-detection loop (lines 145-167), with `advance()` to  --
# step the scripted tmux each poll instead of real time ----------------------
detect_worktree() {
WT=""
prev=""
for _ in $(seq 1 90); do
  p=$(tmux display-message -p -t "$T" '#{pane_current_path}' 2>/dev/null || true)
  c=$(tmux display-message -p -t "$T" '#{pane_current_command}' 2>/dev/null || true)
  if [ -n "$p" ] && [ "$p" != "$PROJ_ABS" ] && is_treehouse_path "$p" && is_interactive_shell "$c"; then
    if [ "$p" = "$prev" ]; then
      WT="$p"; break
    fi
    prev="$p"
  else
    prev=""
  fi
  advance
  sleep 1
done
}

echo "########## A) PATH TRANSIENT then SETTLE (the documented ~100ms HOME blip)"
# poll0: HOME transient; poll1: real worktree; poll2: same -> captured
NEXT=0
SCRIPT=("/home/captain|fish" "/home/captain/.treehouse/acme-x1/1/main|fish" "/home/captain/.treehouse/acme-x1/1/main|fish")
detect_worktree
echo "WT=$WT"
chk '[ -n "$WT" ]' "transient HOME is skipped, worktree captured after it settles"
chk 'case "$WT" in *.treehouse/acme-x1/1/main) true;; *) false;; esac' "captured path is the real treehouse worktree (not HOME)"

echo
echo "########## B) FOREGROUND RACE: treehouse still running when we'd capture"
# poll0: treehouse is foreground in PROJ_ABS; poll1: worktree+fish; poll2: same
NEXT=0
SCRIPT=("$PROJ_ABS|treehouse" "/home/captain/.treehouse/acme-x1/2/main|fish" "/home/captain/.treehouse/acme-x1/2/main|fish")
detect_worktree
chk '[ -n "$WT" ]' "waits past the treehouse-foreground race, then captures the subshell"
chk '! grep -q "send-keys" "$TMUXLOG"' "no launch keystrokes sent during the foreground race"

echo
echo "########## C) never reaches a worktree within the window -> error path"
NEXT=0
SCRIPT=("/home/captain|fish" "/home/captain|fish" "/home/captain|fish")
detect_worktree
chk '[ -z "$WT" ]' "empty WT when only HOME is ever reported (would trigger the error+exit)"

echo
echo "########## D) post-launch VERIFY: harness flips to running quickly"
# VERBATIM verify loop (lines 261-289), driven by scripted tmux command frames.
EXPECTED_CMD="pi"
harness_running() {
  case "$(basename "$(tmux display-message -p -t "$T" '#{pane_current_command}' 2>/dev/null || true)")" in
    "$EXPECTED_CMD"|node*) return 0 ;; *) return 1 ;;
  esac
}
verify_harness() {
  : > "$TMUXLOG"
  verified=0
  for _ in $(seq 1 40); do
    if harness_running; then verified=1; break; fi
    advance
  done
  echo "$verified"
}
NEXT=0
SCRIPT=("fish" "pi")   # poll0 still shell, poll1 harness up
v=$(verify_harness)
echo "verified=$v"
chk '[ "$v" = "1" ]' "harness detected once pane_current_command flips to the harness binary"

echo
echo "########## E) post-launch VERIFY: stays at shell -> resend path"
# 40 polls of 'fish' then the resend; we simulate resend succeeding on 2nd pass.
NEXT=0
# first 40 polls fish (never detected), then after resend we'd re-poll; script 41 fish then pi
SCRIPT=()
for i in $(seq 1 41); do SCRIPT+=("fish"); done
SCRIPT+=("pi")
v=$(verify_harness)   # this models the first pass only (40 polls)
echo "first-pass verified=$v (expect 0 -> triggers the 40s resend-once path)"
chk '[ "$v" = "0" ]' "first 40 polls at a shell do NOT falsely verify (resend-once path engages)"

echo
echo "########## F) launch template carries --approve (headless trust gate fix)"
# pull the real template from the file (don't trust the copy)
tpl=$(awk '/launch_template\(\)/{f=1} f&&/pi\) printf/{print; exit}' "$SPAWN")
echo "template: $tpl"
chk 'printf "%s" "$tpl" | grep -q -- "--approve"' "pi launch template passes --approve (clears project-trust gate for headless dispatch)"
# also confirm other adapters unchanged shape (still single positional brief)
chk 'printf "%s" "$tpl" | grep -q "cat __BRIEF__"' "brief still passed as the single positional argument"

echo
echo "########## RESULT SUMMARY"
cat "$RESULTS"
F=$(grep -c '^FAIL' "$RESULTS" || true); P=$(grep -c '^PASS' "$RESULTS" || true)
echo "-- totals: $P passed, $F failed --"
[ "$F" -eq 0 ] && echo "ALL SPAWN-LOGIC CHECKS PASSED" || echo "SOME SPAWN-LOGIC CHECKS FAILED"
cp "$RESULTS" "$EVIDENCE/spawn-logic-results.txt"

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 5 issues found → auto-fixed ✅

• ⚠️ bin/fm-review-sweep.sh:301 - --one without a following repo argument hangs forever. ONLY_REPO="${2:-}" tolerates the missing arg, but shift 2 fails when only one arg remains (returns non-zero, does not shift) and set -e is deliberately off, so $1 stays --one and the while [ $# -gt 0 ] loop re-matches it indefinitely. Verified: fm-review-sweep.sh --one loops without progress. Fix: guard with shift 2 || { echo 'error: --one requires a repo argument' >&2; exit 2; } (or check $# -ge 2).
• ⚠️ bin/fm-review-sweep.sh:24 - The header doc (line 24) promises an overrun review is 'abandoned (window left for inspection)', but on timeout try_reap (line ~411) calls teardown_task, which sends /quit, kill-window (line 287), and treehouse prune (line 289). The window and worktree are destroyed, so nothing is left for inspection — defeating post-mortem debugging of an unattended cron run. Either the doc or the behavior is wrong; preserving the pane/worktree on timeout (or at least skipping the kill) better matches the stated intent.
• ⚠️ bin/fm-review-sweep.sh:221 - When fm-spawn.sh returns non-zero, the failure cleanup only rm -fs the meta/status and rm -rfs data (rm -f "$FM_ROOT/state/$id.meta" "$status_file"; rm -rf "$FM_ROOT/data/$id"), but fm-spawn may already have created the tmux window fm-$id (it creates the window before the worktree-detection and post-launch-verify waits that can fail). The window is never killed, so it leaks. Over repeated sweep runs these accumulate. Add tmux kill-window -t "fm-$id" 2>/dev/null || true to the failure path.
• ℹ️ bin/fm-review-sweep.sh:289 - teardown_task calls treehouse prune --yes, a GLOBAL prune of all orphaned worktrees, whereas the established bin/fm-teardown.sh returns the specific worktree with treehouse return --force "$WT" (reading worktree= from meta). The sweep never reads its task's worktree path, so it falls back to the imprecise global prune. prune is safe if treehouse only targets truly-orphaned worktrees, but running it from cron while a live firstmate session has active crewmates relies on treehouse correctly distinguishing active vs orphaned worktrees. Returning the specific worktree (like fm-teardown) would be deterministic and consistent.
• ℹ️ bin/fm-review-sweep.sh:356 - The dry-run header printf 'repo\t#cifail\ttitle\turl\n' does not match the data rows printf '%s\t#%s\t%s\t%s\n' "$repo" "$num" "$cifail" "$title". The header shows a nonsensical #cifail column and lists url, while the data prints repo, #<num>, <cifail>, <title> — so the columns are mislabeled and url is promised but never printed. The header should be printf 'repo\t#num\tcifail\ttitle\n'.

🔧 Fix: fix sweep --one loop, timeout inspection, spawn-fail window leak, precise worktree return, dry-run header
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-review-sweep.test.sh (project's own behavior tests: resolve_fleet, ci_status, parse_recommendation clean-vs-CONDITIONAL, jira_key_for — 12/12 pass)
• e2e_sweep.sh: sourced the real main() and ran main --dry-run against a stubbed gh fleet of 5 PRs across 2 repos — verified draft #2 and approved #3 are filtered, candidates #1/#4/#10 kept, failing-CI #4 KEPT, and the dry-run plan + sweep.log show it
• e2e_sweep.sh §4: held the flock from a background fixture then ran main --dry-run again — verified graceful refusal with exit 0 and the lock message
• e2e_sweep.sh §5-6: called write_brief for a green PR and a red PR — verified the review-only contract (review-rectify-pi/--push/never-push) and that only the red PR brief contains the dedicated ## CI failure (this PR's CI is RED) root-cause investigation section (gh pr checks / gh run view --log-failed)
• e2e_sweep.sh §7: called maybe_transition_jira with APPROVE then CONDITIONAL against a stubbed jira CLI — verified exactly one issue move MILE-1001 In Review (CONDITIONAL suppressed), plus the no-MILE-key suppression+log path
• e2e_sweep.sh §8: called parse_recommendation for APPROVE/CONDITIONAL APPROVE/BLOCK/REQUEST CHANGES/CAUTION — verified clean APPROVE→APPROVE and CONDITIONAL APPROVE→CONDITIONAL
• e2e_sweep.sh §9: ran main --one veridianlab/infra --dry-run — verified it ran only the named repo and excluded the other
• e2e_spawn_logic.sh: drove verbatim-copied is_treehouse_path/is_interactive_shell + the worktree-detection loop with a scripted tmux replaying the documented ~100ms $HOME path transient (skipped), the treehouse foreground race (waits, no keystrokes sent), and a never-settling pane (empty WT→error path)
• e2e_spawn_logic.sh §D-E: drove the verbatim post-launch verify loop — harness detected when pane_current_command flips to the harness binary; 40 polls at a shell do NOT falsely verify (engages the resend-once path)
• e2e_spawn_logic.sh §F: extracted the live pi launch_template from bin/fm-spawn.sh — verified it carries --approve and still passes the brief as a single positional arg
• bash -n bin/fm-review-sweep.sh bin/fm-spawn.sh tests/fm-review-sweep.test.sh (syntax)
• Worktree cleanliness verified before/after (git status clean; removed transient state/sweep.log + state/sweep created by an early subprocess run)

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.