feat(fleet): rewrite lead's reporting voice and make operator/assistant names configurable

[LeTuR]

Intent

Rewrite FLEET.md's "How you report" section — the standing instruction block the Mission Control lead session runs under — with three changes the operator asked for in their own words:

(1) "Showing the table is no more required, we do have fleet queue custom pane for that." The section used to MANDATE a status table with a worked example; interface/fleet_queue.lua now draws the queue live in a thurbox column, so a table in a reply repeats it. The table and its example are deleted deliberately. The default reply is now one or two lines, naming a task only when something CHANGED or surprised. The ./scripts/fleet-status.sh bullet was deliberately KEPT — one call for fuel/queue/sessions/PRs/checkout is still the right way to answer "where are we", and that is not the same thing as pasting a table unprompted.

(2) "For a bit more fun, lets improve voice, with doom inspired theme. You must call me SLAYER, you are mission-control (alias vega). The SLAYER do not have much time to waste with long text. Be concise." The existing do/do-not tables were deliberately kept as tables and only their CONTENTS rewritten. Two rules are stated explicitly because they are what decays first: register-not-costume (no quoted lines, no roleplay narration, no in-fiction preamble, no emoji or ASCII art — it lives in verb choice and terseness), and "the register is free; a bit is not" — the operator's own "Keep our fun part efficient in token". Every accuracy rule already in the section survives unchanged in force: uncertainty is a state word not a hedge, no estimates, report the artifact not the intention, never restate the brief, say what you did not do, one fact in one place.

(3) "(We should allow user to customize there name if they wants too)." SLAYER and VEGA are therefore NOT hard-coded. New tracked orchestration/voice.example.conf carries OPERATOR_NAME=SLAYER and ASSISTANT_NAME=VEGA; a gitignored voice.conf beside it overrides. Neutral defaults were explicitly ruled out — the operator asked for SLAYER and VEGA, so those ship as the tracked defaults.

The mechanism follows the precedent this repo already set for the session glyphs (orchestration/session-glyphs.example.conf, rendered into the manifest by scripts/install-extension.sh) rather than having the agent read a conf file itself: the lead FREEZES its instructions at launch, so a file it must read every session to learn its operator's name is a read it will forget. So FLEET.md carries @OPERATOR_NAME@ / @ASSISTANT_NAME@ placeholders and install-extension.sh renders them into a NEW gitignored FLEET.rendered.md, which extension.toml.in now ships as its [[files]] payload with the three context-file symlinks retargeted at it. Rendering to a second file rather than in place is deliberate and is the whole reason for the tracked/generated split: an operator who renames themselves must not leave scripts/sync-checkout.sh a dirty tree it refuses to fast-forward.

The placeholders are @-delimited rather than __-delimited like the manifest's REPO_PATH/LEAD_GLYPH because markdown reads x as bold emphasis and rumdl (MD050) rejects it — this was found by the linter, not guessed.

install-extension.sh gained --render-only

, which renders both files into a directory and stops, needing neither thurbox-cli nor jq. That exists so the gate can exercise the substitution end to end without installing anything or overwriting the operator's own rendered payload; FLEET_VOICE_CONF is the seam it renders through.

scripts/check.sh gained a check, run as part of the default gate: it asserts the placeholders are in FLEET.md and the default names are NOT (one place spells a setting), then actually runs --render-only against a throwaway conf in a temp dir and asserts the names landed and no placeholder survived.

Supporting doc updates: .gitignore entries for FLEET.rendered.md (GENERATED) and orchestration/voice.conf (WORKING STATE) with the why-lines that file's header requires; sync-checkout.sh's WIRING_PATHS gains voice.example.conf so a sync that changes the defaults reports reinstall-extension; CONTRIBUTING.md's tracked/ignored table and extension-manifest section; the fleet-onboarding and update-fleet skills. extension.toml.in's version bumped 1.2.0 -> 1.3.0.

AGENTS.md was deliberately NOT touched — it is the repo's operating guide, not the lead's voice, and another worker is editing prose in it concurrently. Applying this change needs a re-install plus a lead restart; neither was run here, by instruction.

./scripts/check.sh passes locally.

What Changed

• Rewrote FLEET.md's "How you report" section: dropped the mandatory status table and worked example (the fleet_queue.lua pane now draws the queue live) in favor of a one-to-two-line default reply that only names a task when something changed or surprised, while keeping the ./scripts/fleet-status.sh bullet; rewrote the do/do-not tables' contents with a doom-inspired register (terse, no roleplay/emoji/ASCII art, "the register is free; a bit is not") while preserving every existing accuracy rule.
• Made the operator/assistant names configurable instead of hard-coded: FLEET.md now uses @OPERATOR_NAME@/@ASSISTANT_NAME@ placeholders, added tracked orchestration/voice.example.conf (defaults SLAYER/VEGA) with a gitignored voice.conf override, and install-extension.sh renders both files into a new gitignored FLEET.rendered.md that extension.toml.in now ships as its [[files]] payload (context-file symlinks retargeted at it); added install-extension.sh --render-only <dir> to exercise the substitution without thurbox-cli/jq.
• Added a scripts/check.sh gate check asserting the placeholders are present in FLEET.md, the default names are absent from it, and that --render-only correctly substitutes names with no leftover placeholders; updated .gitignore, sync-checkout.sh's WIRING_PATHS, CONTRIBUTING.md, and the fleet-onboarding/update-fleet skills accordingly; bumped extension.toml.in version 1.2.0 -> 1.3.0.

Risk Assessment

✅ Low: The round-1 finding (sed substitution chaining allowing an @ASSISTANT_NAME@-valued OPERATOR_NAME to silently collide) is verifiably fixed — reproduced the attack against the current code and confirmed it is now rejected with a clear error; the full local gate (scripts/check.sh, including the new voice check) passes, FLEET.md contains only placeholders with no literal names, AGENTS.md is untouched as required, and a live --render-only run correctly substitutes SLAYER/VEGA end to end.

Testing

Baseline ./scripts/check.sh had already passed; I additionally reproduced the specific review-1 collision bug manually and confirmed it is now refused, and ran a normal render plus the isolated voice gate check to confirm the FLEET.md rewrite and rendering pipeline work end-to-end as the user intent describes — all passed with no issues found.

Evidence: Rendered 'How you report' section (SLAYER/VEGA)

## How you report

You answer to VEGA; the operator is SLAYER. Mission
Control stays the SESSION's name — thurbox's, and the mailbox address.

**The default reply is one or two lines.** Name a task only when something
about it CHANGED or surprised you. `interface/fleet_queue.lua` draws the board
live in a thurbox column — topics, states, artifacts — so a status table in a
reply repeats what SLAYER is already looking at, which the "one fact
in one place" rule below already forbids.

`./scripts/fleet-status.sh` answers "where are we" in ONE call — fuel, queue,
sessions, PRs, checkout. Run it when asked and assemble the same picture from
five commands only when it has failed you. Asked is the condition: unprompted,
it is the table again.

... (do/do-not tables with doom-register content follow, then unchanged accuracy rules) ...

Evidence: Fix verification: collision scenario now refused

$ FLEET_VOICE_CONF=/tmp/voice-repro/voice.conf ./scripts/install-extension.sh --render-only /tmp/voice-repro/out
error: a name in /tmp/voice-repro/voice.conf contains a quote, a pipe, a backslash, an '&' or an '@': @ASSISTANT_NAME@
exit code: 1

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 info

• ⚠️ scripts/install-extension.sh:195 - The two placeholder substitutions run as two -e scripts in the same sed invocation, so they apply sequentially over the same pattern space rather than independently. If OPERATOR_NAME's value happens to contain the literal text "@ASSISTANT_NAME@" (not blocked by the current denylist, which only rejects |, , &, ' and "), the first substitution injects that string into the line, and the second substitution then rewrites it again with ASSISTANT_NAME's value — silently replacing the operator's name with the assistant's name with no error and no surviving-placeholder detection. Reproduced: with OPERATOR_NAME=@ASSISTANT_NAME@ and ASSISTANT_NAME=VEGA, --render-only produces "You answer to VEGA; the operator is VEGA." instead of failing or preserving the operator's chosen text. Fix by rejecting '@' in the name denylist, or by performing both substitutions in a single non-chaining pass (e.g. one sed/awk expression keyed on both placeholders at once, or two independent passes over the original source rather than over each other's output).

🔧 Fix: Reject '@' in operator/assistant name to prevent placeholder collision
1 info still open:

• ℹ️ orchestration/voice.example.conf:42 - The trailing comment says the renderer refuses a name carrying only 'a quote, a pipe or a backslash', but the fix round widened the denylist in scripts/install-extension.sh to also reject '&' and '@' (closing the placeholder-collision bug from round 1). The comment is now stale and undersells the protection.

✅ **Test** - passed

✅ No issues found.

• ./scripts/check.sh
• Reproduced review-1's exact collision scenario: FLEET_VOICE_CONF=/tmp/voice-repro/voice.conf ./scripts/install-extension.sh --render-only /tmp/voice-repro/out with OPERATOR_NAME=@ASSISTANT_NAME@, ASSISTANT_NAME=VEGA — confirmed it now dies with 'a name ... contains ... an @' instead of silently rendering a swapped name
• Normal render: FLEET_VOICE_CONF=/tmp/voice-repro/voice-good.conf ./scripts/install-extension.sh --render-only /tmp/voice-repro/out2 with OPERATOR_NAME=SLAYER, ASSISTANT_NAME=VEGA — confirmed FLEET.rendered.md has 0 surviving @NAME@ placeholders and the 'How you report' section text matches the intended rewrite (no mandated table, fleet-status.sh bullet kept, do/do-not tables kept with new content)
• ./scripts/check.sh voice run in isolation — passed
• git status --porcelain after testing — confirmed clean working tree, no stray generated files (extension.toml, FLEET.rendered.md, voice.conf) left in the repo

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.