docs: make no-mistakes a captain-only choice; default remote projects to direct-PR

[matthewstrud]

What

Firstmate no longer selects the no-mistakes validation pipeline by itself. For now, a task ships no-mistakes only when the captain explicitly requests it for that task, or asked to register it as the project's posture. Otherwise a project with a remote ships direct-PR, and one without a remote ships local-only.

The pipeline, its skill, its scripts, and how it runs are unchanged. The only change is who may choose it. When it is chosen it still owns review, fixes, tests, docs, push, PR and CI, and firstmate still never answers a crew-owned run itself. Merge authority (yolo) is untouched.

Rules changed (before -> after)

AGENTS.md §1

• Before: "Ship shared tracked changes through this repo's no-mistakes pipeline and PR path, with the same merge authority as any other project."
• After: "Ship shared tracked changes through a PR on the delivery path section 7 selects, with the same merge authority as any other project."

AGENTS.md §7 intake

• Before: "On a no-mistakes-prod-only project, classify the task's surface: internal-only tooling ... ships direct-PR, while product-facing, mixed, and uncertain work ships no-mistakes; never infer internal-only from file location or project name. An unregistered project or absent registry resolves to no-mistakes with yolo off, ..."
• After: "For now, firstmate never selects no-mistakes itself, for any project or kind of change: a task ships no-mistakes only when the captain explicitly requests it for that task or asked to register it as the project's posture, and otherwise ships direct-PR, or local-only for a project with no remote. An unregistered project or absent registry resolves to that same default with yolo off, ..."

AGENTS.md §7 delivery path

• Before: "If fast-path risk needs more rigor, escalate whether to use no-mistakes instead of inventing a manual gate."
• After: "If fast-path risk needs more rigor, ask the captain whether to request no-mistakes instead of inventing a manual gate."

project-management skill, Delivery posture / Add / Create / Initialize

• Before: no-mistakes-prod-only was the default for new remote-backed projects, old entries were never migrated, and a bare entry meant no-mistakes. A new project's proposed posture defaulted to no-mistakes-prod-only. Initialization ran for every no-mistakes and no-mistakes-prod-only project.
• After: direct-PR is the default for now. Never register no-mistakes or no-mistakes-prod-only unless the captain asks. The conditional posture is retired: existing entries were converted to direct-PR, and a leftover or unbracketed entry now reads as direct-PR. A new project's proposed posture defaults to direct-PR. Initialization runs only when the captain asked, either through a no-mistakes registration made at the captain's request or a direct request to initialize. The procedure itself is kept.

CONTRIBUTING.md Development: firstmate changes ship through a PR on the §7 path, direct-PR unless the captain requests the pipeline, and still need explicit merge approval.

docs/architecture.md: the registry note now says no-mistakes appears only at the captain's request, and the retired value reads as direct-PR.

Scripts (so no default path picks or sets up the pipeline)

• bin/fm-project-mode.sh: an unregistered project, a missing registry, an unknown or typo'd mode, and a bare legacy entry now all fall back to direct-PR off instead of no-mistakes off. The retired no-mistakes-prod-only still parses, maps to direct-PR, and --raw still shows it. Only an explicit [no-mistakes] entry yields no-mistakes. Secondmate home seeding and remote provisioning therefore initialize the pipeline only for an explicit, captain-registered no-mistakes project.
• bin/fm-spawn.sh, bin/fm-brief.sh, bin/fm-promote.sh: they still refuse --mode no-mistakes-prod-only, and the error now says it is a retired value and to ship direct-PR unless the captain requested no-mistakes. The spawn's warning about shipping with less rigor now compares against the direct-PR default.
• bin/fm-fleet-sync.sh: when the posture lookup fails, it falls back to direct-PR (only local-only matters there).

Search proof

grep -rnI -e prod-only -e "classify.*surface" -e product-facing -e "resolves to .no-mistakes" -e "defaulting.*no-mistakes" --exclude-dir=.git --exclude-dir=tests . now finds only retirement wording (the skill's retirement note, the parser still accepting the value, the refusal messages) and an unrelated fm_agent_process_classify comment. No instruction left tells firstmate to pick no-mistakes by itself.

One reading to confirm

"Only the captain can request no-mistakes" is written here to cover two cases: a request for a single task, and a no-mistakes project posture the captain explicitly asks to register. The skill already requires the captain's explicit ask for the second. If the intent is per-task requests only, with registered no-mistakes entries ignored at intake, that is a one-sentence change in AGENTS.md §7.

Tests

• tests/fm-task-delivery.test.sh: the parser test now checks that defaults, missing registries, typos, bare entries, and the retired value all read as direct-PR, and that only an explicit [no-mistakes] reads as no-mistakes. The spawn's less-rigor warning cases and the refusal wording are updated to match.
• tests/fm-brief.test.sh: refusal wording.
• tests/fm-secondmate-safety.test.sh, tests/fm-secondmate-lifecycle-e2e.test.sh: fixtures that exercise pipeline initialization now register those projects explicitly as [no-mistakes], and the missing-registry case expects direct-PR off.
• Passed: fm-task-delivery, fm-brief, fm-secondmate-safety, fm-secondmate-lifecycle-e2e, fm-secondmate-sync, fm-fleet-sync, fm-bootstrap, fm-backlog-handoff, fm-backend, fm-claude-trust, fm-update, fm-gotmp, fm-remote-secondmate-trace-context, fm-remote-secondmate-parent-binding, and fm-remote-secondmate-lifecycle-e2e (run from a scratch worktree; see below). bin/fm-lint.sh and bin/fm-doc-audience-check.sh also pass.
• Not caused by this change, and failing the same way on the untouched base commit locally: fm-turnend-guard (a Node module-type warning on this host) and fm-public-followup.
• fm-remote-secondmate-lifecycle-e2e fails when run from this task's worktree location: cleanup refuses because it cannot resolve a secondmate's parent home. It passes on this branch from a scratch worktree, so the failure depends on the local environment.

[Copilot]

🟡 Changes recommended

The unresolved critical repository-policy conflict and moderate legacy-mode lookup issue block approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR makes direct-PR the default for remote projects, preserves local-only for projects without remotes, and uses no-mistakes only when explicitly requested or registered by the captain.

Changes:

• Updates delivery policy, project-management guidance, contributor documentation, and architecture notes.
• Maps missing, unknown, bare, and retired modes to direct-PR.
• Updates scripts, initialization behavior, and regression tests.

Open findings include a critical (2 votes) repository-policy conflict, a moderate (1 vote) legacy-mode lookup issue, and nits (1 vote each) involving stale references and messaging.

File summaries

File	Summary
tests/fm-task-delivery.test.sh	Updates parser and delivery-default coverage.
tests/fm-secondmate-safety.test.sh	Uses explicit pipeline posture fixtures.
tests/fm-secondmate-lifecycle-e2e.test.sh	Updates lifecycle posture fixtures.
tests/fm-brief.test.sh	Updates mode-refusal expectations.
docs/architecture.md	Documents updated registry behavior.
CONTRIBUTING.md	Documents the direct-PR workflow.
bin/fm-spawn.sh	Updates retired-mode handling and posture warnings.
bin/fm-promote.sh	Updates retired-mode refusal messaging.
bin/fm-project-mode.sh	Changes defaults and legacy-mode mapping.
bin/fm-fleet-sync.sh	Uses direct-PR as the fallback posture.
bin/fm-brief.sh	Updates mode validation messaging.
AGENTS.md	Updates delivery-path and intake rules.
.agents/skills/project-management/SKILL.md	Defines new posture and initialization behavior.

Review details

Suppressed comments (1)

AGENTS.md:48

• The policy change leaves .agents/skills/stow/SKILL.md:225 and :308-309 saying that shared tracked material still goes through the no-mistakes/pipeline path. Because /stow is a supported route for these same changes, those instructions remain a conflicting way for firstmate to select no-mistakes and contradict this new delivery-path rule. Please update the stale cross-references as part of this change.

Ship shared tracked changes through a PR on the delivery path section 7 selects, with the same merge authority as any other project.

• Files reviewed: 8/13 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.