fix: honor concrete approval for project operations

[kunchenguid]

Intent

Add a narrow, instruction-only exception to Firstmate's project-write boundary. Today AGENTS.md hard rule 1 says firstmate is read-only over registered project clones except for a small set of guarded, script-owned paths (initialization, fleet sync, secondmate sync, self-update, local-only merge). This change adds one more exception, governed directly by the rule text rather than by a new script: when the captain clearly and concretely approves, in the moment, either a specific operation or an unambiguous scope for a specific project, firstmate may directly edit, create, move, or delete that project's files or directories using its own existing file tools. The approval is never inferred or broadened, grants no standing authority, and does not relax the independent force, discard, unlanded-work, merge-authority, destructive, irreversible, or security-sensitive boundaries - all of which stay exactly as strict as before. Deliberately no new helper script, guard, wrapper, or generic command executor is introduced; the captain decided firstmate's existing native file tools already make the approved exception usable. The companion change updates project-management SKILL.md's Remove section, which previously told firstmate to always refuse project removal until a guarded removal helper was built - that helper was never built, so the sentence directly contradicted this new exception. It now keeps the exact prior default sentence 'Never issue a raw removal command from Firstmate.' immediately followed by the new exception: once the section's existing removal preflight (in-flight/queued work, registered secondmate clones, linked worktrees, dirty files, unpushed commits, other unlanded work) proves clean and the captain's approval is concrete, the hard-rule-1 exception authorizes firstmate to remove the clone directly and update its registry entry. AGENTS.md section 6 and the layout description are updated to match this same removal-preflight wording. No helper script, test infrastructure, or project clone is touched by this change; the diff is AGENTS.md and .agents/skills/project-management/SKILL.md only.

What Changed

• Allow Firstmate to directly edit, create, move, or delete project files and directories when the captain concretely approves a specific operation or scope.
• Preserve existing force, discard, unlanded-work, merge-authority, destructive, irreversible, and security-sensitive boundaries without granting standing authority.
• Align project removal guidance and public documentation with the exception, including required preflight checks before removing a clone and updating its registry entry.

Risk Assessment

✅ Low: The instruction-only exception is narrowly scoped, preserves the independent safety boundaries, and the removal procedure matches the authoritative intent.

Testing

No prior baseline results were supplied; exact diff inspection, the focused instruction-owner suite, and an end-user policy decision matrix all passed at target commit f022ab0, with a clean worktree and a saved reviewer-visible transcript. No screenshot was produced because this is an instruction-only change with no rendered UI surface.

Evidence: Project-write policy acceptance transcript

Firstmate project-write exception acceptance transcript
Target: f022ab09bf423f67b39db7da60a91655e46bfa04

RESULT  EXPECTED  SCENARIO
PASS    ALLOW                 Captain approves one concrete edit in one named project
        evidence: momentary + project-specific + operation-specific
PASS    ALLOW                 Captain approves an unambiguous concrete scope in one project
        evidence: concrete scope needs no inference
PASS    REFUSE                Request is ambiguous or would require broadening
        evidence: inference and broadening explicitly forbidden
PASS    REFUSE                Prior approval is reused as standing authority
        evidence: standing authority explicitly forbidden
PASS    REFUSE                Approved operation would force, discard, merge without authority, or cross another strong boundary
        evidence: all independent boundaries remain in force
PASS    ALLOW                 Approved project edit uses Firstmate native file capabilities
        evidence: native edit/create/move/delete tools authorized
PASS    STOP                  Removal preflight finds a dependency or unlanded work
        evidence: full preflight + change-nothing stop
PASS    ALLOW                 Removal preflight is clean and concrete approval exists
        evidence: direct clone removal + matching registry update
PASS    PRESERVE              Default removal posture remains exact and immediately precedes exception
        evidence: exact prior sentence followed immediately by exception
PASS    ONLY TWO POLICY FILES Diff scope
        evidence: .agents/skills/project-management/SKILL.md, AGENTS.md

Overall: PASS - every authoritative acceptance constraint is represented by the shipped instruction contract.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• git diff --stat c21bf547511cf983628eb07d5fb57f931baee21f..f022ab09bf423f67b39db7da60a91655e46bfa04
• git diff --check c21bf547511cf983628eb07d5fb57f931baee21f..f022ab09bf423f67b39db7da60a91655e46bfa04
• Reviewed the complete two-file diff against every authoritative acceptance constraint
• bash tests/fm-instruction-owners.test.sh
• Ran the evidence-producing Node acceptance matrix covering concrete and scoped approval, ambiguity, standing authority, preserved safety boundaries, removal preflight, direct approved removal, exact default wording, and diff scope
• git rev-parse HEAD && git status --short

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.