Goals: safely amend an active primary metric after explicit user confirmation

[tongchen92]

Source and scope

Misrouted NotFair MCP feedback: notfair-mcp#730 (feedback #296).

Current main evidence:

• notfair/src/server/mcp-server/tools.ts exposes propose_goal_metric only for intake and amend_goal only for target/deadline/spend/cadence.
• notfair/src/server/goals/handlers.ts rejects propose_goal_metric outside intake, while handleAmendGoal owns active/paused edits.
• No existing source-repo issue or open PR covers this behavior.

A user explicitly authorized updating an active reliability goal's primary metric during a telemetry outage so zero-call periods fail closed. Today the live metric cannot be server-verified/replaced without starting a new intake goal.

Requested bounded behavior

Add a narrowly scoped live primary-metric amendment path for an active or paused, owned goal. Prefer a dedicated amend_goal_metric lifecycle tool rather than overloading intake-only propose_goal_metric.

The path must:

1. require an explicit user-confirmation assertion and a human-readable reason; document that it is only for a user-requested metric-definition change;
2. re-run the proposed source query server-side before any goal update, using the same connected-source/local-source validation and single-number contract as intake;
3. leave the existing target, mode, deadline, cadence, and spend envelope unchanged;
4. make a durable, inspectable audit record with the reason and before/after metric identity; and
5. fail without changing the goal when ownership/status/source/query validation fails.

Non-goals

• No OAuth, credential, billing, account-selection, or external customer-data change.
• No automatic metric changes by a tick/agent and no live provider mutation.
• No silent replacement or deletion of historical snapshots. Treat optional history re-backfill as separate follow-up work unless the existing backfill contract can safely support it without broadening this change.
• Do not change propose_goal_metric intake semantics.

Acceptance tests

• An active owned goal accepts a user-confirmed, server-verifiable metric amendment and preserves target/mode/deadline/cadence/spend.
• A paused owned goal behaves equivalently.
• Intake/terminal/foreign goals are rejected.
• An unverifiable query, missing source connection, or absent confirmation/reason leaves all goal fields unchanged and records no successful amendment audit entry.
• The lifecycle MCP tools/list schema exposes the new tool and its confirmation/reason fields.
• Regression tests cover handler, tool schema/registration, and durable audit output without real credentials.

Verification

Run focused goal handler/metric/MCP-tool tests plus TypeScript typecheck. Keep the change isolated to the NotFair source repository; no Codex Cloud lane has been verified for this repo.