FirstMate: agent crews, durable evidence and delivery authority
FirstMate operations: merge authority, away-mode limits and public Relay boundaries
Separate workflow policy from a security sandbox, preserve explicit merge permission and understand documented race limits before unattended operation.
What you will learn
- Worktrees and policy are not a security sandbox
- Read the merge path’s limitations as part of the contract
- Recover without widening the original mandate
Before you start
- Git worktrees and pull-request basics
- Understanding of terminal agents and credential scope
Define a delivery contract and inspect state and authority evidence without claiming untested runtime guarantees.
Key takeaways
- A worktree is not a credential or execution sandbox.
- Merge submission and final landing have different timing risks.
- Public Relay expands the data-disclosure surface.
Worktrees and policy are not a security sandbox
Separate worktrees protect checkout organization, but workers on a machine can still share credentials, network access and resources. FirstMate’s documented role boundaries and shell guards are useful controls; they do not turn an untrusted repository instruction into safe code. Inspect instructions and use least-privilege credentials appropriate to the trial.
Treat public Relay as a separate publication capability. The README describes opt-in public mentions and completion follow-ups. A request arriving through a public channel must not cause secrets, private code or internal task context to appear in a reply. We did not enable Relay or send any public message while reviewing the project.
Read the merge path’s limitations as part of the contract
The architecture describes live checks, head binding and an away-record lock around authority reading and synchronous forge submission. It also explicitly limits the guarantee: a queue-rule or PR-base change after preflight can alter timing, and a surviving forge child can outlive the lock-owning shell. These are not fully atomic distributed transactions.
Our inspected authority helper records a request’s classification for later polling; it does not close every timing window documented above. A durable receipt supports attribution and recovery, but it is not proof that a grant remained valid until final landing. For sensitive repositories, keep attended review and restrictive forge policies in your operating design.
Recover without widening the original mandate
When state is missing, stale or contradictory, retain the evidence and inspect the specific task. Do not treat an away record, a stuck terminal or a restart request as blanket permission for irreversible action. A queue delay may require observation; it does not inherently authorize bypassing checks, deleting worktrees or resubmitting a merge.
Use synthetic projects to rehearse refused actions, remote unavailability and ambiguous landing states before unattended work. Record what is unknown and who must decide next. This review performed no adversarial security audit, live merge, credential isolation test or recovery drill, so these are operational recommendations grounded in the documented boundaries.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Restrict credentials and inspect repository instructions.
- 2
Keep public messaging opt-in and scope its content.
- 3
Review documented merge timing limits before unattended use.
- 4
Rehearse ambiguous states without destructive recovery.
Copy-ready example
{
"operatingPolicyExample": true,
"relayEnabled": false,
"attendedMergeReview": true,
"unknownLanding": "inspect before retry",
"automaticDiscard": false,
"securityAuditExecuted": false
}Frequently asked questions
Is merge submission fully atomic with away authorization?
No. The architecture explicitly documents queue and surviving-child timing limits.
Does a restart request authorize discarding work?
No. Recovery must remain within the original task and specific approved actions.
Sources
- FirstMate / README.mdSource checked 2026-09-14
- FirstMate / docs/architecture.mdSource checked 2026-09-14
- FirstMate / bin/fm-merge-authority-lib.shSource checked 2026-09-14