fix(bin): bind same-run descendant commits

[dnth]

Intent

Repair the validation run binding helper to accept proven commits created by the same No-Mistakes run after its submitted head, without accepting unrelated descendant changes. Primary targets: bin/fm-receipt-check.sh, existing bin/fm-nm-run-lib.sh provenance helpers as needed, and existing behavioral receipt tests and authoritative documentation. Evidence from fm-omp-orchestrate-opt-in: plan generation fa2c2d0b11566622271264853b9653a1 planned head d5ff941aaee8f03d020afd3f02585a0a380929d9; run 01M25YRZ7NP7HVZ33K1XC94AYN passed CI at c096921 after its document step added a commit. The bind-run path currently accepts equality or faithful restamp only, while completion permits proven pipeline-owned descendants but requires an already-bound run. Confirm this bounded defect against current source, reproduce it in isolated temporary state using real Git commit chains, and reuse the existing provenance owner rather than adding a second divergent verifier. Handle active-run ownership and terminal passed-run evidence deliberately, including restamped submitted chains followed by pipeline commits where supported. Ancestry alone is insufficient: validate task/branch/run/generation identity and authoritative run-owned head evidence. Preserve fail-safe behavior on absent, malformed, stale, mismatched, or ambiguous provenance. Do not mutate the primary home, either existing worker, their metadata, the passing orchestration run, or PR #131. Its repository and run may be inspected read-only for precise evidence. No bypasses, hand-edited validation records, fake terminal outcomes, unrelated polling fixes, model changes, deployments, restarts, or merges. Ship this repair as its own no-mistakes PR with yolo off. Bind validation run promptly at its initial supported boundary; do not use unlanded helper code to bless another task in the main home. Run relevant behavioral tests and actual helper smoke reproduction; preserve fail-before/pass-after evidence and rejected foreign-commit controls. Run repository lint and documentation checks after implementation. No Herdr lifecycle work is required or authorized. Any optional nested helpers must skip validation while edits overlap; the accountable worker runs final validation.

Firstmate-Validation-Generation: fa2c2d0b11566622271264853b9653a1

What Changed

• Added shared head-accounting provenance to recognize strict descendants of validated heads and faithful restamps, including restamp-plus-pipeline-commit chains.
• Hardened validation binding and completion with branch identity, active pipeline ownership, terminal passed-run evidence, and axi sync --check fallback cross-checks.
• Expanded receipt-check behavioral coverage and updated evidence-receipt documentation for accepted and rejected descendant scenarios.

Risk Assessment

✅ Low: The changed binding logic consistently enforces branch identity, shared head accounting, and active pipeline ownership or terminal passed evidence, with no source-verifiable defect found in the reviewed paths.

Testing

Ran the focused fm-receipt-check suite with real Git commit-chain fixtures covering active and terminal pipeline-owned descendants, restamp-plus-pipeline commits, axi sync fallback, wrong-branch and unowned descendant rejection, then ran the companion receipt ledger suite. Both passed; a complete CLI transcript is recorded in the evidence artifact.

Evidence: Descendant binding behavioral test transcript

ok - fm-receipt-check help renders an executable generation-bound bind command
ok - fm-receipt-check reports required, evidenced, and missing ids deterministically
ok - fm-receipt-check distinguishes complete evidence from invalid JSONL
ok - structured success and negative outcomes control criterion evidence
ok - pinned brief and metadata delivery modes must match exactly
ok - pinned metadata owner rejects hard-linked validation records
ok - invalid ship briefs fail and scout/report behavior stays unchanged
ok - early snapshot failures release cleanup without a FIFO reader
ok - snapshot readiness publication failures terminate without waiting
ok - fm-receipt-check pins task evidence and rejects hard-linked ledgers
ok - receipt append and check consume one criterion grammar
ok - exact bound runs complete from the shared current CI-log readiness predicate
ok - finding-to-criterion invalidations remain inspectable in task metadata
ok - run binding resolves abbreviated heads and rejects non-planned commits
ok - binding and completion work against the real agent-supplied intent-log shape while wrong runs fail closed
ok - completion accepts only active pipeline-owned descendant heads
ok - terminal passed runs seal their own pipeline advance and refuse foreign drift
ok - pipeline rebase restamps bind and seal their validated content
ok - restamped chains enforce provenance and ownership
ok - active pipeline-owned descendant binds without replan
ok - terminal pipeline-owned descendant binds and completes
ok - restamp chain followed by pipeline doc commit binds and completes
ok - active descendant binds using axi sync fallback when axi status omits branch_sync
ok - unowned active descendant binding is rejected
ok - descendant bind rejects the wrong branch
ok - low-risk mechanical changes can skip a full No-Mistakes run
ok - low risk requires safe changelog prose and file-bound mechanical evidence
ok - implementation completion refreshes per head and remains idempotent
ok - plan publication holds the pinned ledger boundary against concurrent receipts
ok - diff summary errors fail closed before risk classification
ok - successful terminal runs bind while failed runs remain rejected
ok - No-Mistakes status and CI-log observations are bounded
ok - authoritative documentation remains high
ok - terminal delivery paths record one completion timestamp at their boundary
ok - completion signals release the validation lock for retry
ok - replanning invalidates prior run and completion bindings
ok - dirty worktrees cannot be planned or completed
ok - git status errors fail implementation, planning, and completion cleanliness gates
ok - shared cleanliness inspects ignored submodules
ok - direct and local plans never invoke No-Mistakes
ok - local completion requires fast-forward readiness
ok - local readiness and landing share one fail-closed default resolver
ok - security and uncertain changes retain full No-Mistakes validation
ok - direct-PR and local-only retain evidence gates without invoking No-Mistakes
exit=0

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-receipt-check.test.sh
• bash tests/fm-receipt.test.sh
• Verified git status --short is clean after testing.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.