fix: preserve dispatch identity across authentication checks

[kunchenguid]

Intent

Prevent Firstmate dispatch identity conflation while preserving the minimal captain-approved contract: keep the explicit harness/model/provider tuple intact, keep Pi with xai/grok-* distinct from the standalone Grok Build CLI harness without requiring Grok CLI login, scope authentication evidence to the selected candidate, and require blocked credential reports to name the harness, model, authentication surface, and concrete failure evidence. Restore the established 550-word quota-array-dispatch ceiling by pruning existing prose without losing quota pace, strongest-reasoning, malformed-configuration, full-candidate-accounting, tie, or authentication guarantees, and retain deterministic Pi/xAI versus explicit Grok regression coverage without adding instruction or schema expansion.

What Changed

• Preserve explicit harness, model, and provider identity so Pi using xAI Grok models remains distinct from the standalone Grok Build CLI.
• Check authentication only after candidate selection and require blocked credential reports to include the selected harness, model, authentication surface, and concrete failure evidence.
• Restore the 550-word dispatch instruction ceiling and add deterministic regression coverage for Pi/xAI selection when an explicit Grok candidate lacks CLI authentication.

Risk Assessment

✅ Low: The fix cleanly restores post-selection authentication, preserves the dispatch tuple and quota rules, adds ordered Pi/xAI versus Grok regression coverage, and remains within the 550-word ceiling.

Testing

Inspected the change, ran the focused quota-selection and spawn-profile suites, and captured an operator-visible counterfactual transcript. Pi using xAI authenticated through Pi xAI OAuth despite unavailable Grok CLI login; explicit Grok produced a complete blocked credential report. Pace, strongest-reasoning, malformed-configuration, full-accounting, tie, tuple-forwarding, and compactness guarantees also passed. No screenshot was applicable because this is an instruction and CLI dispatch change with no rendered UI.

Evidence: Pi/xAI versus standalone Grok dispatch evidence

ready: harness=pi model=xai/grok-4.5 provider=xai authentication surface checked=Pi xAI OAuth blocked: harness=grok model=grok-4.5 provider=grok authentication surface checked=Grok Build CLI failure evidence=Grok Build CLI login missing

ok - quota-array-dispatch has one conditional owner and a concise always-loaded boundary
ok - quota-array-dispatch owns the compact pace procedure (65 lines, 505 words, 3801 bytes)
ok - cross-references point at the single procedure owner
ok - sanitized schemaVersion 3 fixture preserves producer pace shape without private details
ok - case higher-raw-ahead-vs-lower-raw-sustainable -> B (prefer sustainable pace over higher raw headroom with conservation pressure)
ok - case mixed-effective-with-ahead-bound -> B (mixed with aheadWindowIds is conservation pressure)
ok - case both-ahead-least-negative-reserve -> B (among pressured candidates prefer least-negative worst reserve)
ok - case ahead-bounding-window-overrides-neutral-effective-summary -> B (an ahead applicable bounding window creates conservation pressure even when the effective summary is neutral)
ok - case known-sustainable-vs-unknown -> A (prefer known sustainable evidence over unknown pace)
ok - case select-pi-xai-before-authentication -> pi-xai (an unauthenticated standalone Grok candidate cannot block selected authenticated Pi/xAI)
ok - case all-tight-strongest-reasoning -> A (preserve strongest-reasoning class when every candidate is tight)
ok - case genuine-tie-captain-choice -> genuine tie requires captain choice (report genuine ties instead of selecting by array order or harness identity)
ok - case genuine-tie-reversed-array-order -> genuine tie requires captain choice (reversing a genuine tie must still require captain choice)
ok - case schema-v2-absent-pace -> A (absent pace degrades to raw headroom without fabricating pace health)
ready: harness=pi model=xai/grok-4.5 provider=xai authentication surface checked=Pi xAI OAuth
blocked: harness=grok model=grok-4.5 provider=grok authentication surface checked=Grok Build CLI failure evidence=Grok Build CLI login missing
ok - dispatch identity stays concrete across the Pi/xAI versus Grok counterfactual
ok - AGENTS.md does not duplicate the pace procedure body

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 .agents/skills/quota-array-dispatch/SKILL.md:48 - Intent requires authentication evidence to be scoped to the selected candidate, but rule 1 now treats unresolved auth as a pre-selection blocker. With an authenticated Pi/xAI candidate and an unauthenticated explicit Grok candidate, this rule stops on Grok before Pi can be selected, despite line 63's later constraint. Restore authentication checking exclusively after selection and make the regression exercise that ordered sequence; the current fixture evaluates both candidates independently and cannot catch this failure.

🔧 Fix: Scope dispatch authentication after candidate selection
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• Inspected the commit-range diff and dispatch ownership paths for 41ffd450..27cb472.
• tests/fm-quota-array-dispatch.test.sh
• tests/fm-spawn-dispatch-profile.test.sh
• wc -w .agents/skills/quota-array-dispatch/SKILL.md
• Verified git status --short remained clean after testing.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.