feat: add opt-in OMP orchestration for task briefs

[dnth]

Intent

Implement captain-approved opt-in OMP orchestration in Firstmate. Add --orchestrate to fm-brief.sh for ordinary ship briefs, record the orchestration: enabled marker as generated front-matter at the top of the brief, and have fm-spawn.sh pass a single task-bearing OMP launch message: the exact lowercase orchestrate keyword only when opted in, plus an instruction to read the original brief at its absolute path before any work. Refuse scouts, secondmates, non-OMP harnesses, and raw launch commands for marked briefs before launch. Preserve ordinary briefs/launches unchanged without the opt-in. Keep Firstmate registered-crewmate supervision, merge authority, receipt contract, and No-Mistakes branch custody; nested task subagents remain crewmate-owned implementation helpers, never independent Firstmate workers. Document the policy in .agents/skills/harness-adapters/SKILL.md and docs/verification/runtime-backends.md; extend tests/fm-brief.test.sh and tests/fm-omp-harness.test.sh. No combining orchestrate/workflowz, no default orchestration, no forced fan-out, no changes to shared installed OMP config or crew-dispatch.json/model selection. Verify with targeted shell tests, lint, docs check, and an isolated live OMP proof with at least two task subagents on independent targets plus combined verification. Firstmate-Validation-Generation: 7ffba69cdf8d349d3af4e925742b2c97

What Changed

• Added opt-in --orchestrate brief generation with an orchestration: enabled front-matter marker, while leaving ordinary briefs unchanged.
• Updated OMP spawning to send a single task-bearing launch message with the exact orchestrate keyword and an absolute brief-read instruction; marked briefs reject scouts, secondmates, non-OMP harnesses, and raw launches before launch.
• Documented the orchestration policy and expanded brief and OMP harness coverage.

Risk Assessment

✅ Low: The opt-in is explicitly front-matter gated, non-OMP/raw/scout/secondmate paths refuse before endpoint creation, and the OMP launch message keeps orchestration opt-in only.

Testing

Exercised the user-facing shell brief and spawn paths, including front-matter opt-in generation, ordinary-brief preservation, non-OMP/raw-launch refusals, task-text marker regression, OMP capability and dispatch behavior, and maintained-documentation checks; all targeted tests passed. Evidence transcript saved at the listed path.

Evidence: Targeted OMP opt-in validation transcript

$ bash tests/fm-brief.test.sh
ok - fm-brief.sh: bash -n succeeds
/tmp/fm-brief.y2cLt6/heredoc-in-substitution.sh:2
ok - fm-brief.sh: no heredoc is nested inside a command substitution (Bash 3.2 parse-safe)
ok - fm-brief.sh: --help renders the complete header
ok - fm-brief.sh: no-mistakes/direct-PR/local-only briefs generate cleanly
ok - fm-brief.sh: ship --mode is required and closed-set validated
ok - fm-brief.sh: the explicit ship mode wins over the registered posture
ok - fm-brief.sh: --yolo, scout/secondmate --mode, and non-ship --orchestrate are refused, never silently dropped
ok - fm-brief.sh: --orchestrate adds the ship marker only when opted in
ok - fm-brief.sh: faster paths use configured authority without stacked review
ok - fm-brief.sh: no-mistakes DOD keeps its apostrophe prose, now parse-safe
ok - fm-brief.sh: ship project-memory wording carries the AGENTS.md authoring bar
ok - fm-brief.sh: --herdr-lab emits the complete hard safety contract
ok - fm-brief.sh: --herdr-lab uses its quoted Firstmate-owned helper path
ok - fm-brief.sh: ship and scout scaffolds make omitted Herdr intent fail-visible
ok - fm-brief.sh: the documented {TASK} fill cannot corrupt the Herdr safety gate
ok - fm-brief.sh: Herdr lab contract covers scouts and rejects secondmate misuse
ok - fm-brief.sh: --no-projects scaffolds a project-less charter and guards misuse
ok - fm-brief.sh: marked requests avoid generic acknowledgements and preserve material reporting
ok - fm-brief.sh: relative directory inputs ignore CDPATH, render stable absolute charter paths, or fail loudly
ok - fm-brief.sh: custom pause verb renders in every scaffold
ok - fm-brief.sh: investigation and visual-review completions load the shared decision policy
ok - fm-brief: scout and secondmate code paths still scaffold well-formed briefs
ok - fm-brief: concurrent ship scaffolds preserve one complete owner
ok - fm-brief: ship evidence publication is atomic and retryable

$ bash tests/fm-omp-harness.test.sh
ok - OMP worker tools preserve the exact launch-boundary harness identity
ok - standalone OMP workers require exact bound executable and PID evidence
ok - standalone primary identity survives a deleted launch-time executable path
ok - explicit Bun shebangs bind their declared interpreter
ok - env-shebang bare bun argv retains exact PID-bound canonical runtime identity
ok - OMP capability probe accepts the required launch and recovery surface
ok - OMP capability probe accepts an installed standalone native executable
ok - OMP capability probe rejects no-shebang text wrappers
ok - OMP capability probe rejects unsupported interpreter-backed process identity
ok - OMP capability probe names each missing launch or recovery requirement
ok - OMP max-time capability is exact and scoped to bounded launch templates
ok - selected OMP refuses instead of falling back to another harness
ok - fm-spawn: orchestration marker refuses non-omp harnesses
ok - fm-spawn: orchestration marker refuses raw launch commands
ok - fm-spawn: task prose marker does not opt into orchestration

$ bash tests/fm-spawn-dispatch-profile.test.sh
ok - no --model/--effort records defaults and types the claude launch instructions
ok - relative home overrides ignore CDPATH and become absolute before spawn launch construction
ok - FM_HOME defaults resolve relative paths and preserve absolute spellings
ok - absolute override spellings are preserved in spawn launch paths
ok - unresolvable relative spawn overrides fail with named diagnostics
ok - active crew-dispatch profile requires an explicit harness for ship spawns
ok - active crew-dispatch profile requires an explicit harness for scout spawns
ok - active crew-dispatch profile allows an explicit resolved harness
ok - active crew-dispatch profile allows the legacy positional harness form
ok - active crew-dispatch profile preserves raw direct non-OMP launch arguments
ok - raw OMP spellings refuse before raw execution
ok - ambiguous raw OMP spellings refuse before raw execution
ok - lookalike non-OMP raw launches preserve the escape hatch
ok - raw direct non-OMP launches bypass ambient pane aliases and functions
ok - raw direct non-OMP launches preserve plain assignments
ok - raw command -p launches its direct non-OMP target
ok - raw command -p launches an absolute direct non-OMP target
ok - raw command -p launches a relative direct non-OMP target
ok - raw command paths symlinked to OMP refuse before raw execution
ok - raw bare targets symlinked to OMP refuse before raw execution
ok - raw bare targets matching canonical OMP identity refuse before raw execution
ok - raw targets matching OMP in their effective PATH refuse before raw execution
ok - raw targets hardlinked to OMP refuse before raw execution
ok - raw dynamic loader wrappers refuse before raw execution
ok - raw BusyBox wrappers refuse before raw execution
ok - raw wrappers hardlinked to known dispatchers refuse before raw execution
ok - raw Git wrappers refuse before raw execution
ok - raw tar wrappers refuse before raw execution
ok - raw sed wrappers refuse before raw execution
ok - raw man wrappers refuse before raw execution
ok - raw terminal multiplexers refuse before raw execution
ok - raw command -p validates wrappers under its child PATH
ok - raw shebang wrappers refuse before raw execution
ok - raw native non-OMP targets preserve raw compatibility
ok - raw absolute wrappers refuse before raw execution
ok - raw command -p bypasses pane command functions
ok - raw command -p preserves a plain PATH assignment
ok - claude receives --model and --effort profile flags
ok - codex receives --model and model_reasoning_effort profile flags
ok - codex omits unsupported max effort instead of passing a bad config value
ok - grok receives --model and --reasoning-effort profile flags
ok - grok omits unsupported max reasoning effort
ok - grok omits unsupported xhigh reasoning effort
ok - opencode receives --model and omits the unsupported effort axis
ok - pi receives --model and --thinking max profile flags
ok - pi-signed shares Pi launch semantics while preserving its configured and recorded identity
ok - pi-signed refuses safely and actionably when the selected executable is unavailable
ok - OMP invokes its canonical entrypoint directly and records its runtime identity
fies every maintained prose surface exactly once
ok - classification, setup routing, and maintained-prose scope fail safely
ok - required documentation owner pointers cannot silently disappear
ok - local links resolve while dates, versions, commands, and incident prose remain semantically reviewed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-brief.test.sh
• bash tests/fm-omp-harness.test.sh
• bash tests/fm-spawn-dispatch-profile.test.sh
• bash tests/fm-documentation-audiences.test.sh

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.