Route Sentry and Datadog findings through one audited draft-PR repair lane #3338

Job

Firstmate can accept a Sentry Seer or Datadog Bits finding for a registered project, deduplicate it into one incident, assign exactly one repair writer, and deliver at most a draft PR with an auditable evidence chain; it can never auto-merge or auto-deploy.

Why this belongs in Firstmate

Sentry and Datadog can investigate and propose repairs, but they do not own cross-agent concurrency, project worktree isolation, proof policy, or captain merge authority. If both vendors independently edit the same incident, observability becomes a second uncontrolled fleet. Firstmate is the orchestration and claim-provenance boundary.

Observable outcome

Given two provider findings that refer to the same repository/SHA/error fingerprint, Firstmate creates one durable task, records both sources, launches no more than one writer, runs the project's existing validation path, and reports a draft PR plus provider/test evidence to the captain.

Exit criterion

bash tests/test-provider-repair-intake.sh

returns 0 and proves:

1. Sentry and Datadog payloads are treated as untrusted findings, not facts;
2. repository, environment, release SHA, issue/monitor ID, and fingerprint are normalized deterministically;
3. matching findings deduplicate to one task and one worktree writer;
4. a finding without repository/SHA/evidence is parked for clarification, not dispatched;
5. the generated brief requires reproduction/falsification before repair;
6. provider evidence, agent changes, test output, commit, and draft PR are recorded as distinct provenance hops;
7. the delivery path refuses merge/deploy regardless of provider recommendation;
8. concurrency/session caps from feat(bin): cap active crew concurrency per home #3323 still apply;
9. dry-run fixtures require no live provider token or project write.

Prerequisites

• Firstmate feat(bin): cap active crew concurrency per home #3323 or equivalent bounded active-crew policy.
• Rehoboam/Holodeck expose immutable releases and provider-readable evidence before live intake is enabled.
• Captain-confirmed policy: draft PR only; no automatic merge or deployment.

Files in scope

• The smallest existing inbox/procevent/task-intake and brief-generation scripts
• A provider-neutral normalized finding schema in the existing private-state conventions
• Deterministic fixture-based tests and one short configuration/runbook section

Reuse first

• Existing procevent, durable inbox, task metadata, project registry, one-writer worktree guard, no-mistakes pipeline, PR polling, and captain merge boundary.
• Prefer a small adapter that maps provider payloads into existing intake over a new daemon or agent framework.

Security and authority

• Provider credentials remain in the operator secret store and are never copied into briefs, state logs, PRs, or project repos.
• Default intake is poll/read or verified webhook-to-private-inbox; payloads cannot execute commands.
• Vendor suggestions are evidence tagged reported, never verified until reproduced.
• Provider write scope may create analysis/remediation proposals, but Firstmate alone decides whether to dispatch a draft-PR task.

Out of scope

• Automatic merge/deploy, direct writes into project primary checkouts, autonomous production rollback, a new incident-management product, or vendor-specific policy forks.