fix: 3.16.1 - stop volunteering false statements to a sponsor

[suboss87]

Summary

Field report from the four cold runs (#70): everything deterministic held up; three CLI surfaces volunteered a false statement to a sponsor. This patch is those three, plus the record verbs the method already demanded, plus the README gate that has been red on Main since the #68 poster.

• Trust signals key on the person in the bullet, not words[0]. INCIDENT: / later recovery no longer invent phantom stakeholders that pin the engagement RED.
• fde redact --apply commits redact N line(s) so git log --oneline never reprints the secret. log also refuses postgresql://user:PASSWORD@host and api_key= assignments.
• Dashboard (and vault) fail loud when reality.md is not Working theory / Evidence / Differs from brief. They will not label the inherited brief as what is actually true.
• debrief --smart prints the prefix vocabulary. Preview gate unchanged.
• fde log delivery "a|b|c" writes a value-ledger row. fde log risk --retire moves matching open risks. fde tidy --apply can bless hand-written dirty files.
• status and dashboard print doctor issues. bin/check.js allows the GitHub poster and treats the commands table as the Land→Close map, so Main is no longer blocked.

Four manifests bumped to 3.16.1. After merge: git pull && git tag v3.16.1 && git push origin v3.16.1.

Test plan

• npm run check (130 tests) on this branch
• fde log contact "INCIDENT: batch failed, Marcus Hale escalated" --signal red then a later green about recovery → people list shows Marcus, status is not stuck RED
• fde redact <secret> --apply → git log --oneline in .fde/ does not contain the secret
• fde log decision "dsn postgresql://user:PASSWORD@host/db" is refused
• Dashboard on a reality.md that is just the brief shows UNREADABLE, not "what's actually true"
• fde debrief --smart prints decision: risk: delivery: contact: next:
• fde log delivery "retry | cost-save | 4h | 3h | Denise | sheet | revert" lands in the value ledger
• fde tidy on a hand-edited brief.md proposes bless, --apply clears porcelain

Made with Cursor

---

[devin-ai-integration]

Ran your test plan on field-gates @ a1d1ec1 (3.16.1) in a sandboxed HOME, plus adversarial variants of each fix. Real commands, real output. 4 PASS, 5 PARTIAL, 0 FAIL — the three client-visible lies are gone, but two of the three fixes are narrower than the PR text claims.

PASS

• npm run check: exit 0, 130/130 tests. Both README failures cleared, Main unblocked.
• redact --apply: commit subject is now redact 1 line(s). git log --oneline no longer reprints the secret; the "history may still contain it" warning is still correct and still printed. Good.
• log risk --retire drops doctor's open count 1 → 0; tidy --apply blesses a hand-edited file and leaves git status --porcelain empty. This closes wave 1's "the CLI can't maintain its own record" finding.
• status / dashboard now surface doctor issues.

PARTIAL — signals are name-matched, not person-resolved

Your headline case is genuinely fixed: INCIDENT: + a later recovery line both resolve to [green] Marcus Hale, RED cleared. But the phantom-stakeholder class is still open, because a bullet that doesn't name a table stakeholder still invents one:

$ fde log contact "batch failed again, nobody owns it [signal:red]"
$ fde status
  [RED   ] acme  phase:unset  signal 0d old  batch failed again, nobody owns it
$ fde prep
  [green] Marcus Hale · recovery confirmed by Marcus Hale, batch green two nights
  [red]   batch       · batch failed again, nobody owns it

A stakeholder named batch still pins the engagement RED forever. Other variants: first-name-only → [green] Marcus (second entry for the same human); Dr. Hale → [green] Dr; [@marcus] → keyed on batch; two people in one bullet (Marcus Hale and Priya Shah both pushed back) resolves Marcus and silently drops Priya. Suggestion: if no known stakeholder resolves, refuse the signal or attach it to the engagement rather than minting a person — and warn on multi-person bullets instead of taking the first.

PARTIAL — dashboard is fail-silent, not fail-loud

Half-filled reality.md does exactly what you claim: UNREADABLE - reality.md does not match the schema … Not showing the brief as truth. But an exact copy of the inherited brief (no schema headings at all) produces no Reality section and no warning — dashboard and vault just omit it. The sponsor-facing lie is gone, which was the point, but the FDE gets no signal that the artifact is unreadable in the one case wave 1 actually hit.

PARTIAL — secret guard

Refused with actionable --force guidance: DSN, JDBC, AWS key, api_key=, ghp_, xoxb-, PEM. Two gaps: a bare 40-char high-entropy string logs silently, and the same DSN passed through debrief was skipped rather than written — safe, but silently dropping a line is its own surprise.

PARTIAL — debrief vocabulary is printed, routing is unchanged

The header now prints decision: risk: delivery: contact: next:. Routing on 8 lines of realistic unprefixed 6pm notes: 1 decision, 2 risks, 1 contact, 4 context lines — 4/8 structural, and the Slack noise line became the contact while the delivery claim and next action went to context. Printing the vocabulary helps a human who reads it; it doesn't make --smart smart. Worth deciding whether --smart should keep the name.

PARTIAL — value ledger

The 7-field form writes a proper row. A 3-field string silently writes a row with blank columns — worth a field-count check. Plain prose is still accepted under ## Running value, so the old habit doesn't error.

Full log with every command and its stdout: attached to the field-report thread on #70. Wave 2 (three more embeds, all 37 references, every CLI verb, adapters incl. LOCAL-LLM) is running against this branch now, not Main, so the next report will tell you how these fixes behave in an actual week rather than a test plan.

Written by Devin

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.