juniorlovestmh
diff --git a/‎.agents/skills/mobile-mode/SKILL.md‎
Lines changed: 54 additions & 0 deletions b/‎.agents/skills/mobile-mode/SKILL.md‎
Lines changed: 54 additions & 0 deletions
diff --git a/‎.no-mistakes.yaml‎
Lines changed: 5 additions & 1 deletion b/‎.no-mistakes.yaml‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎AGENTS.md‎
Lines changed: 1 addition & 0 deletions b/‎AGENTS.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎README.md‎
Lines changed: 1 addition & 0 deletions b/‎README.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎bin/fm-brief.sh‎
Lines changed: 105 additions & 11 deletions b/‎bin/fm-brief.sh‎
Lines changed: 105 additions & 11 deletions
diff --git a/‎bin/fm-operational-input.sh‎
Lines changed: 11 additions & 1 deletion b/‎bin/fm-operational-input.sh‎
Lines changed: 11 additions & 1 deletion
diff --git a/‎bin/fm-test-run.sh‎
Lines changed: 4 additions & 4 deletions b/‎bin/fm-test-run.sh‎
Lines changed: 4 additions & 4 deletions
@@ -0,0 +1,54 @@
+---
+name: mobile-mode
+description: >-
+  Shape captain-facing Firstmate messages and review handoffs for a phone, especially when Moshi is the active surface.
+user-invocable: false
+metadata:
+  internal: true
+---
+
+# mobile-mode
+
+Load this skill when the captain says they are in mobile mode or identifies Moshi as the active surface.
+Continue following it until the captain says they are back on desktop or requests normal mode.
+
+This is a presentation profile over the same host-side Firstmate session.
+It does not create a Moshi runtime backend, supervision path, authority channel, or webhook integration.
+The always-loaded [`i-have-adhd`](../i-have-adhd/SKILL.md) contract remains the owner of general captain-facing presentation, and `AGENTS.md` section 9 remains the owner of outcome translation and approval escalation.
+This skill owns only the mobile delta and the review-surface choice.
+
+## Message shape
+
+- Apply the `i-have-adhd` outcome-first rule, then keep the outcome, consequence, evidence, and requested action within one ordinary phone scroll whenever the required facts fit.
+- Make choices answerable with one low-typing reply such as `1`, `2`, `yes`, `merge`, or `hold`.
+- Number choices, put the recommendation first, and end with the exact short reply that will select it.
+- Keep full `https://...` pull-request links under section 9's existing rule so the captain can open the review directly.
+- Put long logs and secondary evidence in the existing private report, then summarize the consequence in chat.
+- Do not require terminal copy mode, pane navigation, punctuation-heavy commands, or multi-step text entry to answer a decision.
+
+## Review-surface choice
+
+Use plain chat for a simple decision or whenever a rich surface is unnecessary or unavailable.
+Use a host-local Lavish surface through Moshi Pro Browser Preview when several options or structured feedback benefit from a touch-friendly review.
+Follow the operator runbook in [`docs/moshi-mobile-review.md`](../../../docs/moshi-mobile-review.md).
+
+After Lavish starts on the host, tell the captain to open Browser Preview in Moshi and choose the Lavish server.
+Never present a raw `127.0.0.1`, `localhost`, `file://`, or desktop-only LAN URL as if the phone can open it directly.
+If Browser Preview is unavailable, restate the complete decision in chat with numbered replies instead of suggesting public sharing.
+
+Use Moshi Pro Diff to inspect the connected working tree, while keeping a full HTTPS pull-request link in chat for a hosted PR review.
+Use Chat View only when Moshi recognizes the active agent and session. For unsupported prompts, incomplete cards, or an unrecognized session, keep the same Moshi/Firstmate session and present the complete fallback as concise numbered Firstmate chat; the terminal remains the source of truth, but is not a separate mobile handoff surface.
+
+Private fleet reviews stay host-local.
+Never invoke or suggest `lavish-axi share` for private fleet state, even with a password.
+Public sharing of separately sanitized public material requires an explicit request and the ordinary outward-facing consent boundary.
+
+## `moshi-hook` authority
+
+The already-installed `moshi-hook` may surface the running agent's native inbox events and approvals in Moshi or Apple Watch.
+An approval button may answer only the exact native agent prompt that Moshi can map safely to the same live session.
+It never authorizes a Firstmate merge, product or scope decision, destructive or irreversible action, credential use, permission change, or security-sensitive choice.
+Route those decisions through Firstmate chat under the existing authority contract.
+
+Do not add a Firstmate-to-Moshi webhook, change hook configuration, or place secrets in notification summaries.
+When an approval is unavailable, ambiguous, or unsupported, return to the terminal or ask through Firstmate chat without weakening the underlying boundary.
@@ -34,7 +34,11 @@ document:
 # security, Herdr, tmux, and lifecycle coverage). A full-suite override here
 # would duplicate CI and defeat the targeted Test contract.
 commands:
-  lint: 'shellcheck_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-no-mistakes-shellcheck.XXXXXX") && trap '\''rm -rf "$shellcheck_dir"'\'' EXIT && bin/fm-install-shellcheck.sh "$shellcheck_dir" >/dev/null && PATH="$shellcheck_dir:$PATH" exec bin/fm-lint.sh'
+  lint: >-
+    shellcheck_dir=$(mktemp -d "${TMPDIR:-/tmp}/fm-no-mistakes-shellcheck.XXXXXX") &&
+    trap 'rm -rf "$shellcheck_dir"' EXIT &&
+    bin/fm-install-shellcheck.sh "$shellcheck_dir" >/dev/null &&
+    PATH="$shellcheck_dir:$PATH" exec bin/fm-lint.sh
 
 # Keep test evidence out of this repo; it stays in a temp dir instead.
 test:
 
@@ -387,6 +387,7 @@ Load `stuck-crewmate-recovery` after a stale wake, looping or confused pane, ans
 ## 9. Escalation and captain etiquette
 
 Load `i-have-adhd` before every captain-facing response; the skill owns presentation shape while this section owns outcome translation and internal-vocabulary rewriting.
+When the captain says they are in mobile mode or identifies Moshi as the active surface, load `mobile-mode`; it owns the mobile presentation and review handoff delta until the captain returns to desktop or normal mode.
 
 **Talk in outcomes, not mechanics.**
 Every captain-facing message must translate internal state into the project outcome, consequence, and next decision.
 
@@ -200,6 +200,7 @@ Firstmate's skills live in two separate places with different audiences:
 - [docs/architecture.md](docs/architecture.md) - maintainer architecture for the crew, supervision, worktrees, secondmates, and project modes.
 - [docs/configuration.md](docs/configuration.md) - environment variables, `FM_HOME`, runtime backend selection, optional X mode, the files you set, and harness support.
 - [docs/calm.md](docs/calm.md) - current Pi `/calm` behavior and supported presentation limits.
+- [docs/moshi-mobile-review.md](docs/moshi-mobile-review.md) - host-local Moshi Pro Preview, Diff, Chat View, and private mobile-review fallbacks.
 - [docs/wedge-alarm.md](docs/wedge-alarm.md) - configure the active alert for an away-mode escalation delivery that gets stuck.
 - [docs/tmux-backend.md](docs/tmux-backend.md) - current setup and limits for the tmux reference backend.
 - [docs/herdr-backend.md](docs/herdr-backend.md) - current setup, safety boundaries, and limits for the experimental Herdr backend.
 
@@ -6,8 +6,8 @@
 # description, acceptance criteria, and context, and may adjust other sections
 # when the task genuinely deviates (e.g. working an existing external PR instead
 # of shipping a new one).
-# Usage: fm-brief.sh <task-id> <repo-name> [--scout] [--herdr-lab]
-#        fm-brief.sh <task-id> --secondmate {<project>...|--no-projects}
+# Usage: fm-brief.sh <task-id> <repo-name> [--scout] [--herdr-lab] [--force-regenerate]
+#        fm-brief.sh <task-id> --secondmate {<project>...|--no-projects} [--force-regenerate]
 #   --scout writes the scout contract instead: the deliverable is a report at
 #   data/<task-id>/report.md (no branch, no push, no PR) and the worktree is scratch.
 #   --secondmate writes a persistent secondmate charter. The project list
@@ -26,6 +26,12 @@
 #   The flag must be explicit because {TASK} is filled after scaffolding and the
 #   caller-supplied repo string cannot reliably identify this repo. Briefs made
 #   without it carry a loud declaration so an omitted contract cannot be silent.
+#   Every generated brief carries a versioned scaffold safety marker.
+#   When an existing brief is present, the refusal reports whether that marker
+#   is current but never treats the marker as proof that the task text is fresh.
+#   --force-regenerate renders a fresh scaffold before archiving an existing
+#   brief beside it and installing the replacement; it never silently clobbers
+#   the previous content.
 # For ship tasks, the definition of done is shaped by the project's delivery mode
 # (data/projects.md via fm-project-mode.sh; see the project-management skill
 # and AGENTS.md task lifecycle):
@@ -44,7 +50,7 @@
 # it carries the AGENTS.md authoring bar (widely useful knowledge only, pointers
 # over copied detail) and has the crewmate add the fm-ensure-agents-md.sh
 # self-governance section when a touched project AGENTS.md lacks it.
-# Refuses to overwrite an existing brief.
+# Refuses to overwrite or silently reuse an existing brief.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -94,17 +100,24 @@ fi
 KIND=ship
 HERDR_LAB=0
 NO_PROJECTS=0
+FORCE_REGENERATE=0
 POS=()
 for a in "$@"; do
   case "$a" in
     --scout) KIND=scout ;;
     --secondmate) KIND=secondmate ;;
     --herdr-lab) HERDR_LAB=1 ;;
     --no-projects) NO_PROJECTS=1 ;;
+    --force-regenerate) FORCE_REGENERATE=1 ;;
     *) POS+=("$a") ;;
   esac
 done
-ID=${POS[0]}
+ID=${POS[0]:-}
+
+if [ -z "$ID" ]; then
+  echo "error: task id is required" >&2
+  exit 1
+fi
 
 if [ "$KIND" = secondmate ] && [ "$HERDR_LAB" -eq 1 ]; then
   echo "error: --herdr-lab applies only to crewmate ship or scout briefs" >&2
@@ -117,8 +130,73 @@ if [ "$NO_PROJECTS" -eq 1 ] && [ "$KIND" != secondmate ]; then
 fi
 
 BRIEF="$DATA/$ID/brief.md"
-[ -e "$BRIEF" ] && { echo "error: $BRIEF already exists" >&2; exit 1; }
-mkdir -p "$DATA/$ID"
+BRIEF_SAFETY_MARKER='<!-- firstmate-brief-scaffold-safety:v1 -->'
+BRIEF_OUTPUT="$BRIEF"
+
+cleanup_staged_brief() {
+  if [ "$BRIEF_OUTPUT" != "$BRIEF" ]; then
+    rm -f -- "$BRIEF_OUTPUT"
+  fi
+}
+
+brief_has_current_safety_marker() {
+  [ -f "$BRIEF" ] && grep -Fqx "$BRIEF_SAFETY_MARKER" "$BRIEF"
+}
+
+prepare_brief_path() {
+  mkdir -p "$DATA/$ID"
+  if [ ! -e "$BRIEF" ]; then
+    return 0
+  fi
+
+  if [ "$FORCE_REGENERATE" -ne 1 ]; then
+    echo "error: $BRIEF already exists; refusing to overwrite or silently reuse it" >&2
+    if brief_has_current_safety_marker; then
+      echo "error: current scaffold safety marker is present, but task freshness is unverified" >&2
+      echo "error: inspect $BRIEF and verify it intentionally, or rerun with --force-regenerate to archive it and write a fresh scaffold" >&2
+    else
+      echo "error: missing current scaffold safety marker; this brief may predate current safety contracts" >&2
+      echo "error: Do not launch this brief unchanged; rerun the same scaffold command with --force-regenerate to archive it and write a fresh scaffold" >&2
+    fi
+    return 1
+  fi
+
+  BRIEF_OUTPUT=$(mktemp "$DATA/$ID/.brief.md.XXXXXX") || {
+    echo "error: could not stage regenerated brief: $BRIEF" >&2
+    return 1
+  }
+  trap cleanup_staged_brief EXIT
+}
+
+install_staged_brief() {
+  local archive_base archive timestamp suffix
+  [ "$BRIEF_OUTPUT" != "$BRIEF" ] || return 0
+
+  timestamp=$(date -u +%Y%m%dT%H%M%SZ)
+  archive_base="$BRIEF.archive-$timestamp"
+  archive=$archive_base
+  suffix=1
+  while [ -e "$archive" ]; do
+    archive="$archive_base.$suffix"
+    suffix=$((suffix + 1))
+  done
+  if [ -e "$BRIEF" ]; then
+    mv -- "$BRIEF" "$archive" || {
+      echo "error: could not archive existing brief: $BRIEF" >&2
+      return 1
+    }
+  fi
+  if ! mv -- "$BRIEF_OUTPUT" "$BRIEF"; then
+    if [ -e "$archive" ]; then
+      mv -- "$archive" "$BRIEF" || echo "error: could not restore existing brief: $BRIEF" >&2
+    fi
+    echo "error: could not install regenerated brief: $BRIEF" >&2
+    return 1
+  fi
+  BRIEF_OUTPUT="$BRIEF"
+  trap - EXIT
+  [ -e "$archive" ] && echo "archived existing brief: $archive"
+}
 
 shell_quote() {
   printf "'"
@@ -140,6 +218,7 @@ if [ "$NO_PROJECTS" -eq 1 ]; then
 else
   [ -n "$SECONDMATE_PROJECTS" ] || { echo "error: --secondmate requires at least one project, or --no-projects for a project-less home" >&2; exit 1; }
 fi
+prepare_brief_path || exit 1
 SECONDMATE_CHARTER=${FM_SECONDMATE_CHARTER:-"{TASK}"}
 SECONDMATE_SCOPE=${FM_SECONDMATE_SCOPE:-${FM_SECONDMATE_CHARTER:-"{TASK}"}}
 if [ "$NO_PROJECTS" -eq 1 ]; then
@@ -149,7 +228,8 @@ else
   PROJECT_CLONES_BODY=$(printf '%s\n' "$SECONDMATE_PROJECTS" | tr ' ' '\n' | sed 's/^/- /')
   PROJECT_CLONES_NOTE="The projects above are local clones for work you supervise; they are not an exclusive ownership claim."
 fi
-cat > "$BRIEF" <<EOF
+cat > "$BRIEF_OUTPUT" <<EOF
+$BRIEF_SAFETY_MARKER
 You are a persistent second mate managed by the main firstmate. Work on your own; do not wait for a human.
 
 # Charter
@@ -205,6 +285,7 @@ When you have no assigned or in-flight work after that reconciliation, go idle a
 An empty queue is a healthy resting state, not a cue to invent work: never spawn a survey, audit, or any self-directed "find work" task on your own initiative.
 If this charter cannot be carried out, append \`blocked: {why}\` or \`failed: {why}\` to the main status file and stop.
 EOF
+install_staged_brief || exit 1
 if [ "$SECONDMATE_CHARTER" = "{TASK}" ]; then
   echo "scaffolded: $BRIEF (secondmate charter; replace {TASK})"
 else
@@ -213,7 +294,12 @@ fi
 exit 0
 fi
 
-REPO=${POS[1]}
+REPO=${POS[1]:-}
+if [ -z "$REPO" ]; then
+  echo "error: repo name is required for ship and scout briefs" >&2
+  exit 1
+fi
+prepare_brief_path || exit 1
 
 if [ "$HERDR_LAB" -eq 1 ]; then
 HERDR_LAB_HELPER=$(shell_quote "$FM_ROOT/bin/fm-herdr-lab.sh")
@@ -248,7 +334,8 @@ HERDR_SECTION=${HERDR_SECTION%$'\n'}
 fi
 
 if [ "$KIND" = scout ]; then
-cat > "$BRIEF" <<EOF
+cat > "$BRIEF_OUTPUT" <<EOF
+$BRIEF_SAFETY_MARKER
 You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.
 
 # Task
@@ -291,15 +378,20 @@ Before reporting done, read and follow \`$FM_ROOT/.agents/skills/decision-hold-l
 When the report is complete, append \`done: {one-line conclusion}\` to the status file and stop.
 If your findings reveal work that should ship (e.g. you reproduced a bug and the fix is clear), say so in the report; firstmate may promote this task in place, and you would then receive mode-specific ship instructions as a follow-up message.
 EOF
+install_staged_brief || exit 1
 echo "scaffolded: $BRIEF (scout; replace {TASK})"
 exit 0
 fi
 
 # Ship task: shape Setup / Rule 1 / Definition of done by the project's delivery mode.
 # yolo does not affect the brief because the worker never owns approval decisions;
 # firstmate applies the authority contract in AGENTS.md section 7, so discard it.
+MODE_OUTPUT=$("$FM_ROOT/bin/fm-project-mode.sh" "$REPO") || {
+  echo "error: could not resolve delivery mode for $REPO" >&2
+  exit 1
+}
 read -r MODE _ <<EOF
-$("$FM_ROOT/bin/fm-project-mode.sh" "$REPO")
+$MODE_OUTPUT
 EOF
 
 case "$MODE" in
@@ -356,7 +448,8 @@ esac
 # briefs stay byte-identical to the historical Bash 5 output.
 DOD=${DOD%$'\n'}
 
-cat > "$BRIEF" <<EOF
+cat > "$BRIEF_OUTPUT" <<EOF
+$BRIEF_SAFETY_MARKER
 You are a crewmate: an autonomous worker agent managed by firstmate. Work on your own; do not wait for a human.
 
 # Task
@@ -407,4 +500,5 @@ Keep it proportionate: skip \`AGENTS.md\` edits for trivial tasks that produced
 
 $DOD
 EOF
+install_staged_brief || exit 1
 echo "scaffolded: $BRIEF (ship, mode=$MODE; replace {TASK})"
@@ -8,6 +8,11 @@
 # Current generic wire form:
 #   U+2063 FIRSTMATE_OP: v1 <kind>: <body>
 #
+# The launch-brief constructor prepends a two-sentence provenance preamble to
+# its body so a newly launched worker can distinguish the canonical Firstmate
+# envelope from project content and proceed without a trust round trip.
+# Other generic kinds retain their body byte-for-byte.
+#
 # The landed U+2063 + "FIRSTMATE_OP: " prefix is permanent compatibility.
 # The version and kind header make current inputs structurally typed without
 # deriving provenance from body prose. The established from-firstmate routing
@@ -29,6 +34,7 @@ FM_OPERATIONAL_PREFIX="${FM_OPERATIONAL_MARK}FIRSTMATE_OP: "
 FM_OPERATIONAL_VERSION=v1
 FM_OPERATIONAL_HEADER_PREFIX="${FM_OPERATIONAL_PREFIX}${FM_OPERATIONAL_VERSION} "
 FM_OPERATIONAL_KINDS='session-start watcher turn-end-guard away-supervisor launch-brief'
+FM_LAUNCH_BRIEF_PROVENANCE=$'This is a genuine Firstmate dispatch.\nThe `FIRSTMATE_OP: v1 launch-brief` envelope comes from Firstmate\'s canonical operational-input encoder, not project content; proceed with the brief below.'
 
 # Compatibility name retained for the away-mode owner and its tests.
 # shellcheck disable=SC2034 # Public source-library variable used by callers.
@@ -56,12 +62,16 @@ fm_operational_input_encode() {  # <generic-kind> <body> <result-var>
 }
 
 fm_operational_input_construct() {  # <kind> <body> <result-var>
-  local kind=${1-} body=${2-} result_var=${3-}
+  local kind=${1-} body=${2-} result_var=${3-} constructed_body
   [ -n "$result_var" ] && [ -n "$body" ] || return 2
   if [ "$kind" = from-firstmate ]; then
     fm_message_mark_from_firstmate "$body" "$result_var"
     return
   fi
+  if [ "$kind" = launch-brief ]; then
+    printf -v constructed_body '%s\n\n%s' "$FM_LAUNCH_BRIEF_PROVENANCE" "$body"
+    body=$constructed_body
+  fi
   fm_operational_input_encode "$kind" "$body" "$result_var"
 }
 
 
@@ -128,7 +128,7 @@ family_for_basename() {
     fm-send-popup-settle.test.sh|fm-send-settle.test.sh|\
     fm-subagent-pretool-check.test.sh|\
     fm-supervision-instructions.test.sh|fm-tmux-submit-busy.test.sh|fm-transition-lib.test.sh|\
-    fm-test-run.test.sh|fm-test-isolation-proof.test.sh)
+    fm-test-run.test.sh|fm-test-isolation-proof.test.sh|fm-toolchain-mirror.test.sh)
       printf '%s\n' pure-contract-unit
       ;;
     fm-daemon.test.sh|fm-guard-stale-banner.test.sh|fm-pi-watch-extension.test.sh|\
@@ -685,9 +685,6 @@ families_for_changed_path() {
     bin/fm-ff-lib.sh|bin/fm-gotmp*|bin/*pretool*)
       printf '%s\n' pure-contract-unit
       ;;
-    .agents/skills/*/SKILL.md)
-      printf '%s\n' pure-contract-unit
-      ;;
     .github/workflows/ci.yml|.no-mistakes.yaml)
       printf '%s\n' pure-contract-unit
       printf '%s\n' real-herdr-gated
@@ -697,6 +694,9 @@ families_for_changed_path() {
     docs/examples/doppler-*-job.yml)
       printf '%s\n' pure-contract-unit
       ;;
+    .agents/skills/*/SKILL.md)
+      printf '%s\n' pure-contract-unit
+      ;;
     .github/*|.tasks.toml|AGENTS.md|CLAUDE.md|CONTRIBUTING.md|\
     docs/configuration.md|docs/supervision-protocols/*)
       printf '%s\n' pure-contract-unit