feat: add WorkGraph parallelism and one-node validation

[garynewball]

Intent

Implement Slice 2 of Firstmate WorkGraph: persistent parallelism modes off|eco|on|max with auto accepted only as a CLI alias canonicalized to on; request/goal/project/global precedence; deterministic one-node WorkGraph and slice-contract v1 schemas and validation/status; no spawn, teardown, enforcement, AGENTS.md, active-task, or implicit global-config mutation; preserve legacy behavior. Validate strict duplicate-free JSON, recursively reject unknown keys, bind hash and parse to the same bytes, align runtime and schemas exactly, use safe integer semantics, hermetic tests, and documentation ownership. Do not leave global parallelism materialized in this slice.

What Changed

• Add persistent off|eco|on|max parallelism modes with request, goal, project, and global precedence; CLI-only auto canonicalizes to on.
• Add strict validation and status reporting for digest-bound, one-node WorkGraph and slice-contract v1 files without enabling dispatch enforcement.
• Add aligned JSON schemas, operator documentation, ownership metadata, and test-runner coverage for the WorkGraph surface.

Risk Assessment

✅ Low: Captain, the focused fix resolves the prior CLI-alias finding without introducing material source risk, and the overall change remains bounded and non-enforcing.

Testing

Baseline diff/status inspection confirmed the intended standalone CLI/schema scope; the focused hermetic test and isolated end-to-end workflow passed, demonstrating persistence and precedence, CLI-only auto, strict byte-bound one-node validation, disabled enforcement, no implicit global write, and preserved legacy state. The reviewer-visible artifact is a CLI transcript because this change has no rendered UI.

Evidence: End-to-end WorkGraph CLI transcript

Shows mode precedence, CLI-only auto, canonical persistence, verified one-node graph status, duplicate-key rejection, disabled enforcement, and unchanged legacy state.

$ fm-parallelism.sh get
on
global_config_exists_after_default_read=false

$ fm-parallelism.sh set off
off
$ fm-parallelism.sh set eco --project project-1
eco
$ fm-parallelism.sh set max --goal goal-1
max

$ fm-parallelism.sh status --goal goal-1 --project project-1
mode=max
source=goal
request=absent
goal=max
project=eco
global=off
enforcement=disabled

$ fm-parallelism.sh status --request auto --goal goal-1 --project project-1
mode=on
source=request
request=on
goal=uninspected
project=uninspected
global=uninspected
enforcement=disabled

$ fm-parallelism.sh set auto --goal goal-auto
on
persisted_goal_auto_alias=on

$ fm-workgraph.sh status graph.json
valid=true
schema_version=workgraph/v1
goal_id=goal-1
slice_count=1
slice_id=slice-1
contract_path=contracts/slice-1.json
contract_sha256=c9eab5b7e605db89dc7a54f7c92957b12185373f2d6a5907d358b53f3f724d26
contract_verified=true
enforcement=disabled

$ fm-workgraph.sh validate duplicate-graph.json
fm-workgraph: WG-E-CORRUPT: graph is not valid JSON: duplicate object key "goal_id" at character offset 72
exit_code=1

legacy_state_unchanged=true
legacy_state_file_count=2

$ FM_PARALLELISM_OVERRIDE=auto fm-parallelism.sh get
fm-parallelism: invalid mode 'auto'; expected off|eco|on|max
exit_code=1

$ fm-parallelism.sh get  # persisted file contains auto
fm-parallelism: unknown global mode 'auto' in /tmp/no-mistakes-evidence/01KYQ6BNFEME06GRJ7A7N6GX6D/manual/noncli-auto-home/config/parallelism
exit_code=1

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 bin/fm-parallelism.sh:149 - Intent requires “auto accepted only as a CLI alias canonicalized to on,” but this hunk applies the alias-accepting require_mode to FM_PARALLELISM_OVERRIDE, so FM_PARALLELISM_OVERRIDE=auto ... get is accepted and resolved as on. Restrict auto canonicalization to parsed CLI arguments and accept only canonical modes from the environment, unless this broader alias behavior is explicitly approved.

🔧 Fix: Captain: restrict auto alias to CLI inputs
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bin/fm-test-run.sh tests/fm-workgraph.test.sh
• Isolated fm-parallelism.sh get/set/status workflow covering default non-materialization, canonical modes, request > goal > project > global precedence, and auto canonicalization
• Non-CLI auto rejection through FM_PARALLELISM_OVERRIDE=auto and a manually persisted auto value
• bin/fm-workgraph.sh status .../graph.json against a digest-bound one-node contract
• bin/fm-workgraph.sh validate .../duplicate-graph.json to demonstrate strict duplicate-key rejection
• Legacy task-state byte comparison before and after parallelism operations
• bin/fm-test-run.sh --list --changed --base 99533c5d7d3702050e6084429dddff6ea4fe1aa0 selection check
• Target-tree checks confirming no materialized config/parallelism and no changes to AGENTS.md, spawn, or teardown surfaces
• git status --short after testing and cleanup

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.