fix: strengthen goal fidelity and live-state freshness

[ruby-dlee]

Intent

Strengthen Firstmate's behavior guardrails so extensions remain faithful to the captain's actual goal and live operational surfaces always use fresh state. Require premise-checking before crews proceed, reinforce crew-steering around ownership, evidence, quality, goal fidelity, and directness, establish an always-serve-fresh rule for live surfaces, and require documenting a purpose before adding any bypass. Preserve legitimate crew stop and recovery behavior, keep proof contracts and tests aligned, and make these rules durable in the appropriate shared documentation and skills without weakening the requested behavior.

What Changed

• Add crew-steering guardrails for ownership, evidence, premise checks, robustness, goal fidelity, and direct correction while preserving legitimate safety stops and solve-first escalation.
• Reconcile captain-facing boards, summaries, and X-mode replies with fresh crew state while retaining completion history and protecting unsubmitted Lavish answers during refreshes.
• Strengthen consequential premise and bypass critical-path checks, with proof-contract coverage for the new crew-steering and live-surface rules.

Risk Assessment

✅ Low: Captain, the amended branch now satisfies the stated guardrails, resolves the prior contract conflicts, and protects each load-bearing crew-steering behavior with focused source-contract assertions.

Testing

The supplied full baseline had passed; focused guardrail, authoritative-state, bearings, and worktree-safety suites also passed, while the captured end-to-end CLI run proved fresh state supersedes stale events without losing legitimate stops or completion history; no screenshot was applicable because this changes instruction and CLI behavior rather than a rendered UI.

Evidence: End-to-end freshness and stop/recovery transcript

=== Loaded guardrail contracts ===
Before adding any bypass, record that target outcome and the rationale for the critical-path judgment.
In both modes, preserve the captain's actual goal and use the existing owner for detail instead of copying its contract.
Require the crew to solve and implement the task: it never stops solely because work is hard or failing, it preserves mandated safety `blocked` stops such as unsafe or non-isolated worktree placement, and it exhausts its capability before following the solve-first escalation bar owned by `AGENTS.md` section 9.
A Lavish board is a live surface, so reconcile it against live fleet state before serving or updating it and never render it from a remembered snapshot; `AGENTS.md` section 9 owns the serve-fresh rule.
=== Fresh state wins over a stale blocked event ===
state: working · source: run-step · validating (running) · status-log superseded by active run
=== A genuine decision stop remains parked ===
state: parked · source: run-step · parked at review: 1 finding(s) (ask-user: captain decision)
=== A mandated safety stop remains blocked ===
state: blocked · source: status-log · unsafe or non-isolated worktree placement
=== Live surface before resolution ===
{
  "decisions_open": [
    {
      "id": "mate",
      "key": "surface",
      "verb": "needs-decision",
      "summary": "choose the live-surface behavior"
    }
  ],
  "landed": [
    {
      "id": "delivered",
      "what": "Faithful guardrails",
      "artifact": "https://github.com/example/firstmate/pull/42"
    }
  ]
}
=== Live surface after resolution ===
{
  "decisions_open": [],
  "landed": [
    {
      "id": "delivered",
      "what": "Faithful guardrails",
      "artifact": "https://github.com/example/firstmate/pull/42"
    }
  ]
}
RESULT: fresh actionable state replaced the resolved decision while completion history remained visible.

- Outcome: 🔧 1 issue found → auto-fixed ✅ across 2 runs (2h33m16s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 4 issues found → auto-fixed (2) ✅

• 🚨 .agents/skills/operating-fundamentals/SKILL.md:56 - The intent requires “documenting a purpose before adding any bypass,” but this rule only asks the operator to establish the target outcome mentally; it never requires recording the purpose or rationale before introducing a bypass. Amend the rule and its contract test, or confirm that undocumented bypasses are intentional.
• 🚨 AGENTS.md:682 - This universal rule requires every status or summary to remove completed items and show only pending/in-flight work, contradicting the existing /bearings “Recently Landed” contract and /reports, whose purpose is completed work. Scope removal to resolved actionable/decision items or explicitly exempt completion-oriented surfaces.
• 🚨 .agents/skills/lavish-decision-boards/SKILL.md:15 - The new always-fresh board rule conflicts with the existing instruction never to edit a served board while the captain is answering because reload destroys in-progress input. When fleet state changes mid-answer, agents cannot both refresh immediately and preserve answers; define precedence or a safe refresh strategy.
• 🚨 tests/operating-fundamentals.test.sh:65 - The updated proof contract checks only operating-fundamentals phrases; it does not protect the new crew-steering skill/trigger or the AGENTS/Lavish serve-fresh contract. Because the intent explicitly requires keeping proof contracts and tests aligned, add focused assertions for those new durable rules or confirm that they are intentionally prose-only.

🔧 Fix: Align guardrails with freshness and answer-preservation contracts
1 error still open:

• 🚨 tests/operating-fundamentals.test.sh:91 - The requested proof contract remains incomplete: this test claims to retain all six crew-steering guardrails but checks only their headings. Every behavioral rule beneath them—including premise-checking before action, evidence requirements, and legitimate safety stops—could be deleted while the test stays green. Add focused assertions for each load-bearing rule so the test protects the actual contract, not just its outline.

🔧 Fix: Protect crew-steering behavior in proof contracts
✅ Re-checked - no issues remain.

🔧 **Test** - 1 issue found → auto-fixed ✅

• 🚨 .agents/skills/operating-fundamentals/SKILL.md:57 - The required “document a purpose before adding any bypass” rule is weakened to require written rationale only for consequential irreversible/high-stakes bypasses, while explicitly exempting trivial skips. The proof test at tests/operating-fundamentals.test.sh:69 requires that exemption, so both implementation and test contradict the authoritative “any bypass” criterion.
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"
• Pre-supplied successful baseline: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"
• bash tests/operating-fundamentals.test.sh && bash tests/fm-tangle-guard.test.sh && bash tests/fm-bearings-snapshot.test.sh && bash tests/fm-secondmate-lifecycle-e2e.test.sh
• Two-state bin/fm-bearings-snapshot.sh --json scenario followed by jq assertions that resolution removes the open decision while retaining landed history
• FM_GATE_REFUSE_BYPASS=1 FM_HOME=<temporary-evidence-home> bin/fm-brief.sh faithful-proof firstmate, verifying the isolation stop precedes branch creation
• Manual authoritative-intent check rejecting trivial skips do not require this written record
• git status --short and evidence integrity checks

🔧 Fix: Captain, require purpose documentation for every bypass
✅ Re-checked - no issues remain.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"
• Configured full baseline command supplied as already successful: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"
• bash tests/operating-fundamentals.test.sh
• bash tests/fm-crew-state.test.sh
• bash tests/fm-bearings-snapshot.test.sh
• bash tests/fm-tangle-guard.test.sh
• /var/folders/y_/bfdbj_vx20l9b9tw7crgkzwm0000gn/T/no-mistakes-evidence/01KY6JJEGD9NAK8Y5XYWMGXCQE/manual-e2e-smoke.sh "$PWD"
• git status --short

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Fix proportional bypass lint assertions, captain
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.