fix: tighten worker status protocol

[withally]

Intent

The captain, 2026-09-08, after seeing that 114 of 231 firstmate turns today were monitoring notifications: "Turn off the per-status doorbells for progress lines: workers should append only phase changes. Several briefs today still produced chatty status." and "are we done with these -? if not get it going". Existing backlog item (2026-08-24): tighten generated brief status wording: working = phase change only, no pre-pipeline done, no resolved echo. Evidence from today: workers appended working: lines for sub-steps ("local validation passed at 1440 and 390", "committed fix round 2 successfully and started re-review", "assembling doors 2 and 3 locally"), a done: line before the no-mistakes pipeline had run (fm-codex-max-effort-f1 "done: committed ... lint and both focused test files pass"), and resolved echoes of firstmate's own steers.

What Changed

• Added shared status-protocol wording for generated briefs and promotion handoffs, including wake-cost reminders, mode-specific phase-only working: rules, and bans on sub-step progress and resolved steer echoes.
• Tightened no-mistakes completion wording so local commits, validation, and pipeline start are nonterminal; done follows green pipeline results, while scout completion requires a completed report.
• Updated protocol ownership documentation and added regression coverage for ship, scout, secondmate, and promoted-worker contracts.

Risk Assessment

✅ Low: Captain, the changed generated contracts consistently enforce phase-only working updates, prohibit pre-pipeline done signals, and carry the no-resolved-echo rule through promotion.

Testing

Focused automated tests, end-to-end brief generation, and promoted-scout handoffs all exercised the requested status protocol. Evidence confirms phase-only working rules, mode-specific phases, no resolved echoes, and no pre-pipeline done event.

Evidence: Generated brief and promoted-scout CLI transcript

Source: Generated brief and promoted-scout CLI transcript

END-TO-END GENERATED BRIEF STATUS PROTOCOL
home=~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home

[fresh no-mistakes: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/fresh-no-mistakes/brief.md]
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: work started, implementation committed and validation started, or PR opened.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
Definition of done:
# Definition of done
Delivery contract: mode=no-mistakes
The task is complete only when committed on your branch.
After committing the implementation, append `working: implementation committed and validation started` only if that phase change has not already been reported, then run /no-mistakes to validate and ship a PR.
A local commit, local validation pass, or pipeline start is never a `done:` event.

You drive no-mistakes by responding to its gates, not by implementing fixes.
Follow the guidance no-mistakes itself provides for the mechanics: it loads when you invoke /no-mistakes, and `no-mistakes axi run --help` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.

[fresh direct-PR: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/fresh-direct-PR/brief.md]
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: work started, implementation committed and validation started, or PR opened.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
Definition of done:
# Definition of done
Delivery contract: mode=direct-PR
This task ships **direct-PR**: you raise the PR yourself, without the no-mistakes pipeline.
The task is complete only when committed on your branch.
When it is implemented and committed, push your branch and open a PR with `gh-axi`, then append `done: PR {url}` to the status file and stop.
Do NOT run /no-mistakes. The configured merge authority decides whether to merge the PR; firstmate relays the outcome.

[fresh local-only: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/fresh-local-only/brief.md]
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: work started or implementation committed and validation started.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
Definition of done:
# Definition of done
Delivery contract: mode=local-only
This task ships **local-only**: no remote, no PR, no pipeline.
The task is complete only when committed on your branch `fm/fresh-local-only`. Do NOT push, do NOT open a PR, do NOT merge.
Keep your branch a clean fast-forward onto the current default branch - if `main` has advanced, rebase onto it so the eventual merge stays a fast-forward.
When it is implemented and committed, append `done: ready in branch fm/fresh-local-only` to the status file and stop.
The configured merge authority approves the ready branch, then firstmate merges it into local `main` through the guarded fast-forward path.

[fresh scout: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/fresh-scout/brief.md]
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: starting the investigation, entering a distinct research phase, or beginning report writing.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
Definition of done:
# Definition of done
Write your findings to `~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/fresh-scout/report.md`.
The report must stand alone: what you did, what you found, the evidence (commands run, output, file:line references), and what you recommend.
If your deliverable is a visual artifact the captain will review and iterate on, you may host the Lavish review loop yourself (poll, revise, re-serve, staying alive) instead of handing it back to firstmate.
Before reporting done, read and follow `~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.agents/skills/captain-hold-lifecycle/SKILL.md` and pass its shared completion gate for the report and any visual review.
Only after the report exists and is complete, append `done: {one-line conclusion}` to the status file and stop.
If your findings reveal work that should ship (e.g. you reproduced a bug and the fix is clear), say so in the report; firstmate may promote this task in place, and you would then receive mode-specific ship instructions as a follow-up message.

PROMOTED SCOUT HANDOFFS

[promote no-mistakes]
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: never, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the guarded operation WILL still run.
●  repair missing watcher supervision according to the session-start block for this harness; do not use shell &.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
promoted promoted-no-mistakes to ship mode=no-mistakes yolo=off (teardown protection restored)
wrote ship instructions for mode=no-mistakes: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/promoted-no-mistakes/ship-instructions.md
next: FM_HOME=~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home bin/fm-send.sh fm-promoted-no-mistakes "$(cat ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/promoted-no-mistakes/ship-instructions.md)"
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: work started, implementation committed and validation started, or PR opened.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
   Never append a `resolved:` echo of a firstmate steer; moving its message into `handled/` is the acknowledgement.
Definition of done delivered to promoted worker:
# Definition of done
Delivery contract: mode=no-mistakes
The task is complete only when committed on your branch.
After committing the implementation, append `working: implementation committed and validation started` only if that phase change has not already been reported, then run /no-mistakes to validate and ship a PR.
A local commit, local validation pass, or pipeline start is never a `done:` event.

You drive no-mistakes by responding to its gates, not by implementing fixes.
Follow the guidance no-mistakes itself provides for the mechanics: it loads when you invoke /no-mistakes, and `no-mistakes axi run --help` plus the `help` lines in each `axi` response are authoritative and version-matched to the installed binary.

[promote direct-PR]
WARNING: watcher still down (same stale episode; last beat: never, grace 300s) - full banner already printed this episode.
promoted promoted-direct-PR to ship mode=direct-PR yolo=off (teardown protection restored)
wrote ship instructions for mode=direct-PR: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/promoted-direct-PR/ship-instructions.md
next: FM_HOME=~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home bin/fm-send.sh fm-promoted-direct-PR "$(cat ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/promoted-direct-PR/ship-instructions.md)"
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: work started, implementation committed and validation started, or PR opened.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
   Never append a `resolved:` echo of a firstmate steer; moving its message into `handled/` is the acknowledgement.
Definition of done delivered to promoted worker:
# Definition of done
Delivery contract: mode=direct-PR
This task ships **direct-PR**: you raise the PR yourself, without the no-mistakes pipeline.
The task is complete only when committed on your branch.
When it is implemented and committed, push your branch and open a PR with `gh-axi`, then append `done: PR {url}` to the status file and stop.
Do NOT run /no-mistakes. The configured merge authority decides whether to merge the PR; firstmate relays the outcome.

[promote local-only]
WARNING: watcher still down (same stale episode; last beat: never, grace 300s) - full banner already printed this episode.
promoted promoted-local-only to ship mode=local-only yolo=off (teardown protection restored)
wrote ship instructions for mode=local-only: ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/promoted-local-only/ship-instructions.md
next: FM_HOME=~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home bin/fm-send.sh fm-promoted-local-only "$(cat ~/.no-mistakes/worktrees/37852af5566c/01M20GSHBZTV19YET6Q396NQ0S/.status-protocol-e2e.0lnNk1/home/data/promoted-local-only/ship-instructions.md)"
   Each status-file append wakes the supervisor and costs a full supervision turn.
   Append `working:` only for a genuine phase change the supervisor would act on: work started or implementation committed and validation started.
   Never append `working:` for a sub-step, a verification pass, or the start of re-review.
   Never append a `resolved:` echo of a firstmate steer; moving its message into `handled/` is the acknowledgement.
Definition of done delivered to promoted worker:
# Definition of done
Delivery contract: mode=local-only
This task ships **local-only**: no remote, no PR, no pipeline.
The task is complete only when committed on your branch `fm/promoted-local-only`. Do NOT push, do NOT open a PR, do NOT merge.
Keep your branch a clean fast-forward onto the current default branch - if `main` has advanced, rebase onto it so the eventual merge stays a fast-forward.
When it is implemented and committed, append `done: ready in branch fm/promoted-local-only` to the status file and stop.
The configured merge authority approves the ready branch, then firstmate merges it into local `main` through the guarded fast-forward path.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed (3) ✅

• ⚠️ bin/fm-brief.sh:465 - The generated scout brief says working: is valid for PR opened and implementation committed and validation started at bin/fm-brief.sh, while the same scout contract is report-only and forbids pushing or opening a PR at lines 454-455. An unpromoted scout can therefore emit a false or forbidden phase. Render scout-specific phases, or explicitly condition ship-only phases on promotion.

🔧 Fix: Captain: scout working phases narrowed to research/report only
2 issues (1 error, 1 warning) still open:

• 🚨 bin/fm-brief.sh:465 - The narrowed scout contract at this line is still carried into promoted ship tasks: bin/fm-promote.sh:216 says the original status protocol remains unchanged. A scout promoted to --mode no-mistakes therefore still sees working: limited to investigation/research/report phases and has no permitted working: implementation committed and validation started phase. Render the mode-specific ship status protocol in the promotion handoff instead of carrying the scout protocol.
• ⚠️ bin/fm-brief.sh:549 - This shared ship wording allows working: ... PR opened for every mode, while --mode local-only explicitly forbids opening a PR in bin/fm-dod-lib.sh:195. The generated local-only contract is internally contradictory; make the allowed working phases conditional on the selected delivery mode.

🔧 Fix: Captain: mode-specific status handoffs fixed; delivery-contract tests pass
1 error still open:

• 🚨 bin/fm-promote.sh:221 - The authoritative intent requires “no resolved echo,” specifically preventing “resolved echoes of firstmate’s own steers.” The promotion handoff only says the inbox rules carry over unchanged and injects wake/working rules; it does not deliver the new prohibition. Promotion sends only ship-instructions.md, so a legacy scout brief can be promoted while still permitting a resolved: echo. Include this rule in the promotion payload.

🔧 Fix: Captain: promotion payload fix verified by delivery-contract tests
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bin/fm-test-run.sh --changed --exclude-family real-herdr-gated
• tests/fm-brief.test.sh
• tests/fm-task-delivery.test.sh
• Executor baseline: bin/fm-test-run.sh --changed --exclude-family real-herdr-gated
• Manual bin/fm-brief.sh generation for all ship modes and scout mode
• Manual bin/fm-promote.sh promotion for all three ship modes
• Final git status and transient-artifact cleanup check

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Suppress intentional SC2016 literal-backtick warnings
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.