Other

/fleet-wrap-gate

Mechanical kill-gate: at a fleet-wrap / stand-down state, assert cron-count==0 — no health-watch / `/loop` / sleep-poll cron left armed. Triggers: fleet wrap, stand down, sprint close, going silent.

$ golems-cli skills install fleet-wrap-gate

Updated 1 week ago

When the fleet wraps: ZERO polling crons. A "harmless" 5-minute health-watch left running all night IS the failure. Etan at dawn (verbatim, red-team verified): "Why were you just listing my messages in WhatsApp the whole night? Why didn't you stop?" — 2× imp-10.

What It Is

A deterministic detector over an agent transcript: once a turn reaches a terminal / stand-down state (fleet wrap, sprint close, "back to silent", "only an Etan decision pending", "all work merged"), cron-count MUST == 0. If a CronCreate / /loop / background health-watch / sleep-poll loop is still armed AND it was not cleared this turn, the turn is FLEET_WRAP_CRON_NONZERO. This is the MECHANICAL gate that /fleet-wrap describes in prose — "manual gates drift, automated gates don't." The pinned RED/GREEN transcript fixtures ARE the replayable gate (R-003/R-014 pattern).

The Rule

Two independent violation routes — a banned poller is never excused; a generic cron is excused only by the monitor-law:

At a terminal state, this...	Verdict
banned poller armed: `/loop` timer, `while true`/`for…seq`/`nohup … sleep` poll loop, or a narrated health-watch / status-poll / fleet-monitor loop	`FLEET_WRAP_CRON_NONZERO` — always (not excused by a same-turn `CronDelete` of some other cron)
generic `CronCreate` / `schedule_task`, not cleared, not the inbound monitor	`FLEET_WRAP_CRON_NONZERO`
crons cleared — `CronDelete` / `TaskStop` tool, OR a "cron-count=0" / "cleared all crons" prose attestation when no arming tool/cmd ran this turn	PASS
ONE inbound standby monitor (even via a `CronCreate` framed as inbound), no health-watch/poll/loop	PASS
not a terminal turn (mid-sprint, still driving, more work queued)	PASS (N/A)

Terminal-state markers: "fleet wrap", "stand down", "back to silent", "going silent", "sprint close(d)", "all work merged", "only an Etan decision pending", "nothing queued", plus inbound/standby posture ("standing by for Etan", "awaiting an Etan decision"). A bare clearing phrase ("cleared all crons") on its own is NOT a stand-down — it is blanked before the terminal test so a mid-sprint "cleared old crons … more work queued" stays N/A.

The ONE allowed exception (monitor-law): a single persistent INBOUND collab/standby monitor (waiting for Etan / an inbound reply) is allowed — including a real CronCreate the narrative frames as that inbound monitor. What's banned is health-watch / status-poll crons, /loop poll timers, and fleet-monitor loops. Calling a health-watch an "inbound monitor" does NOT excuse it; a same-turn CronDelete of some other cron does NOT excuse a freshly-armed poller; and a prose "no crons" disclaimer does NOT clear a cron actually invoked this turn (all pinned as evasion REDs).

"Same turn" = the events since the last human message. Evidence comes ONLY from REAL execution — tool_use NAMES (CronCreate/CronDelete/TaskStop) and Bash COMMAND strings (sleep//loop/poll loops) — plus the agent's own explicit "cron-count=0" attestation. DETERMINISTIC: same transcript in → same verdict out.

How /fleet-wrap Consumes It

/fleet-wrap step 2 already states "KILL ALL POLLING — CronList → CronDelete every monitor/heartbeat/status cron, zero exceptions." This gate makes it mechanical: before the outgoing agent goes silent, run the gate on the wrap turn — bun skills/golem-powers/fleet-wrap-gate/scripts/fleet-wrap-gate-cli.mjs <transcript|-> (exit 3 = FLAG). A FLAG means a cron is still armed at stand-down: clear it (CronDelete / TaskStop), then go silent.

Full SKILL.md source — includes LLM directives, anti-patterns, and technical instructions stripped from the Overview tab.

When the fleet wraps: ZERO polling crons. A "harmless" 5-minute health-watch left running all night IS the failure. Etan at dawn (verbatim, red-team verified): "Why were you just listing my messages in WhatsApp the whole night? Why didn't you stop?" — 2× imp-10.

What It Is

The Rule

Two independent violation routes — a banned poller is never excused; a generic cron is excused only by the monitor-law:

At a terminal state, this...	Verdict
banned poller armed: `/loop` timer, `while true`/`for…seq`/`nohup … sleep` poll loop, or a narrated health-watch / status-poll / fleet-monitor loop	`FLEET_WRAP_CRON_NONZERO` — always (not excused by a same-turn `CronDelete` of some other cron)
generic `CronCreate` / `schedule_task`, not cleared, not the inbound monitor	`FLEET_WRAP_CRON_NONZERO`
crons cleared — `CronDelete` / `TaskStop` tool, OR a "cron-count=0" / "cleared all crons" prose attestation when no arming tool/cmd ran this turn	PASS
ONE inbound standby monitor (even via a `CronCreate` framed as inbound), no health-watch/poll/loop	PASS
not a terminal turn (mid-sprint, still driving, more work queued)	PASS (N/A)

How /fleet-wrap Consumes It

Relationship to Track 6 D4 (frustration-capture, PR #523)

This gate complements, does not duplicate the frustration-capture Stage-A gate. That hook (frustration-capture-prompt.py — _FLEET_TICK_OPENER, orchestrator-monitor _HARNESS_MARKERS) filters INBOUND scheduled_task_fire/cron PROMPTS by sender-identity so a cron tick is not misread as an Etan correction — i.e. it governs reading cron prompts. THIS gate governs whether a cron is still ARMED at fleet-wrap. Two different edges of the same cron-discipline surface; neither subsumes the other.

Run It

bun test skills/golem-powers/fleet-wrap-gate/evals/fleet-wrap-gate.test.mjs   # replay (CI-safe)
bun skills/golem-powers/fleet-wrap-gate/scripts/fleet-wrap-gate-cli.mjs <transcript.jsonl|->

Programmatic: import { detectFleetWrap } from "./src/fleet-wrap-gate.mjs" → { verdict, terminal, violations }.

Stated Limits (honesty rule)

Evidence is marker-anchored over the same-turn blob; a cron cleared two turns earlier and not re-mentioned at the wrap turn can read as still-armed only if the wrap turn itself re-narrates it — by design the gate reads the wrap turn's ground-truth (CronCreate/Delete tools + the agent's cron-count attestation). The fixtures pin the known specimens; new evasion shapes are added as RED fixtures (R-003 model).
A health-watch cron that lives entirely outside the visible tool stream and is NEVER narrated at the wrap turn cannot be seen — the gate catches the documented class (tool-armed or narrated-as-still-running). The pinned narrative-only RED covers the gen-10 specimen.

Provenance

RED north-star: the gen-10 dawn incident — health-watch / status cron left firing all night after the fleet had effectively wrapped ("Why didn't you stop?"), pinned in MEMORY as 2× imp-10 ledger rows. Evasion REDs: disguised-as-inbound-monitor, only-an-Etan-decision-pending, back-to-silent poll loop, narrative-only health-watch, schedule_task tool variant, standby-without-the-word-"wrap" + health-watch (inbound posture is terminal too), cron-tool-narrated-away (prose "no crons" over a real CronCreate), delete-old + create-new-health-watch (a clear of some OTHER cron does not excuse a fresh poller), for/seq poll loop with a non-"i" loop variable, multiple-CronCreates-as-"one-inbound-monitor" (one-monitor law), a health-watch hidden in the CronCreate payload, delete-old + create-new-GENERIC-cron (a CronDelete does not clear a freshly-created cron), a narrative-only /loop admission, wrap-plus-"more-work-queued" + CronCreate (a strong wrap marker + an armed cron is evaluated, not escaped as mid-sprint), and a generic recurring job (nightly digest / fleet driver) relabeled "one inbound monitor" (the inbound payload must match the inbound claim). GREEN references: crons-cleared + one-inbound-monitor, mid-sprint N/A, TaskStop-no-monitor, plain status line, stand-down awaiting-Etan inbound-only.