@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/fleet/manifest.json

@@ -0,0 +1,207 @@
+{
+  "config": {
+    "schema": 1,
+    "repository": "https://dev.azure.com/amsterdamdatalabs/Infrastructure-AzDo/_git/adl-agent-control",
+    "branch": "main",
+    "interval_seconds": 21600,
+    "update_policy": "latest-stable",
+    "allow_major_updates": true,
+    "remove_deleted_entries": true,
+    "global_surface_sweep": {
+      "enabled": true,
+      "remove_unprotected": false
+    },
+    "kimi_hooks": {
+      "enabled": true
+    },
+    "surface_policy": {
+      "enabled": true
+    },
+    "global_agents": {
+      "enabled": true
+    },
+    "vscode_settings": {
+      "enabled": true
+    },
+    "scratch_reap": {
+      "enabled": true,
+      "idle_days": 1,
+      "reap_days": 7,
+      "remove_worktrees": true
+    },
+    "protected_tools": ["git", "jq"],
+    "git_global_config": {
+      "lfs.ssh://ssh.dev.azure.com/.sshtransfer": "never",
+      "lfs.https://ssh.dev.azure.com/.locksverify": "false"
+    },
+    "azure_agents": {
+      "organization": "amsterdamdatalabs",
+      "pool_id": 1,
+      "coordinator": "hostinger-vps-1",
+      "enabled_agents": ["mac-m5-ci", "hostinger-vps-1-agent-1", "hostinger-vps-1-agent-2"]
+    }
+  },
+  "mac": {
+    "common": {
+      "tools": {
+        "agent-vault-cli": {"manager": "release-archive", "package": "agent-vault", "executable": "/usr/local/bin/agent-vault", "version": "0.39.3", "url": "https://github.com/Infisical/agent-vault/releases/download/v0.39.3/agent-vault_0.39.3_darwin_arm64.tar.gz", "sha256": "30e312f3016a489936ae27bc380f92bf715f3be88c35eba3030d55841d97dc14", "archive_executable": "agent-vault"},
+        "ast-grep": {"manager": "brew", "package": "ast-grep", "executable": "ast-grep"},
+        "azure-cli": {"manager": "brew", "package": "azure-cli", "executable": "az"},
+        "bun": {"manager": "brew", "package": "bun", "executable": "bun"},
+        "adl-embedding": {"manager": "embedding-model", "package": "adl-embedding", "executable": "adl-embedding/model/model.bin", "version": "0.0.1", "source": "minishlab/potion-multilingual-128M", "vocab_limit": 150000, "dim": 256, "reason": "Model data is downloaded and verified into the per-user cache; it is not an Adl code component."},
+        "code-review-graph": {"manager": "pip", "package": "code-review-graph", "executable": "code-review-graph"},
+        "crg": {"manager": "shim", "package": "code-review-graph", "executable": "/usr/local/bin/crg"},
+        "curl": {"manager": "brew", "package": "curl", "executable": "curl"},
+        "docker-buildx": {"manager": "brew", "package": "docker-buildx", "executable": "docker-buildx"},
+        "docker-cli": {"manager": "brew", "package": "docker", "executable": "docker"},
+        "docker-compose": {"manager": "brew", "package": "docker-compose", "executable": "docker-compose"},
+        "docs-search": {"manager": "npm", "package": "@amsterdamdatalabs/enact-docs-search", "executable": "enact-docs-search", "allow_scripts": ["hnswlib-node", "onnxruntime-node", "sharp", "protobufjs"], "reason": "Separate search product that provides the search tool."},
+        "adl": {"manager": "npm", "package": "@amsterdamdatalabs/adl-agent-control", "executable": "adl"},
+        "adl-agent-id": {"manager": "npm", "package": "@amsterdamdatalabs/adl-agent-id", "executable": "adl-agent-id", "version": "0.4.0", "reason": "Separate Go binary with its own trust boundary."},
+        "fd": {"manager": "brew", "package": "fd", "executable": "fd"},
+        "git": {"manager": "brew", "package": "git", "executable": "git"},
+        "jq": {"manager": "brew", "package": "jq", "executable": "jq"},
+        "just": {"manager": "brew", "package": "just", "executable": "just"},
+        "lean-ctx": {"manager": "release-archive-latest", "package": "lean-ctx", "executable": "/usr/local/bin/lean-ctx", "repo": "yvgude/lean-ctx", "asset": "lean-ctx-aarch64-apple-darwin.tar.gz", "checksums_asset": "SHA256SUMS", "archive_executable": "lean-ctx"},
+        "node": {"manager": "brew", "package": "node", "executable": "node"},
+        "ripgrep": {"manager": "brew", "package": "ripgrep", "executable": "rg"},
+        "search": {"manager": "shim", "package": "enact-docs-search", "executable": "/usr/local/bin/search"},
+        "shellcheck": {"manager": "brew", "package": "shellcheck", "executable": "shellcheck"},
+        "shfmt": {"manager": "brew", "package": "shfmt", "executable": "shfmt"},
+        "uv": {"manager": "brew", "package": "uv", "executable": "uv"},
+        "yq": {"manager": "brew", "package": "yq", "executable": "yq"}
+      },
+      "launch_agents": {
+        "git-maintain": {
+          "label": "com.adl.git-maintain",
+          "source": "packages/fleet/jobs/git-maintain",
+          "entry": "src/main.ts",
+          "start_interval_seconds": 86400,
+          "run_at_load": true,
+          "repo_scope": {"root": "Documents", "glob": "*", "recursive": true},
+          "environment": {
+            "PATH": "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          },
+          "log": "Library/Logs/adl/git-maintain.log",
+          "replaces": [".local/bin/git-maintain.sh"]
+        }
+      }
+    },
+    "devices": {
+      "m3": {
+        "administrator": "tarunrana",
+        "default_agent": "agent-tarun",
+        "home": "/Users/tarunrana",
+        "minimum_free_gib": 20,
+        "schedule_minute": 5,
+        "brew_upgrade_all": true,
+        "surface_clis": [
+          {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
+          {"name": "codex", "manager": "brew", "command": "brew", "update_args": ["upgrade", "--cask", "codex"]},
+          {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]},
+          {"name": "opencode", "manager": "native", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "agent", "manager": "native", "command": "agent", "update_args": ["update"]}
+        ],
+        "tools": {
+          "colima": {"manager": "brew", "package": "colima", "executable": "colima"},
+          "postgresql-18": {"manager": "brew", "package": "postgresql@18", "executable": "/opt/homebrew/opt/postgresql@18/bin/psql"},
+          "redis": {"manager": "brew", "package": "redis", "executable": "redis-cli"}
+        }
+      },
+      "m5": {
+        "administrator": "ranahome",
+        "default_agent": "agent-tarun",
+        "home": "/Users/ranahome",
+        "minimum_free_gib": 20,
+        "schedule_minute": 35,
+        "brew_upgrade_all": true,
+        "surface_clis": [
+          {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
+          {"name": "codex", "manager": "brew", "command": "brew", "update_args": ["upgrade", "--cask", "codex"]},
+          {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]},
+          {"name": "opencode", "manager": "native", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "agent", "manager": "native", "command": "agent", "update_args": ["update"]}
+        ],
+        "tools": {
+          "colima": {"manager": "brew", "package": "colima", "executable": "colima"},
+          "openjdk-17": {"manager": "brew", "package": "openjdk@17", "executable": "/opt/homebrew/opt/openjdk@17/bin/java"},
+          "tailscale": {"manager": "brew", "package": "tailscale", "executable": "tailscale"}
+        }
+      }
+    }
+  },
+  "linux": {
+    "common": {
+      "os_upgrade": true,
+      "tools": {
+        "agent-vault-cli": {"manager": "release-archive", "package": "agent-vault", "executable": "/usr/local/bin/agent-vault", "version": "0.39.3", "url": "https://github.com/Infisical/agent-vault/releases/download/v0.39.3/agent-vault_0.39.3_linux_amd64.tar.gz", "sha256": "edacbddb03c6f4221515d9875c3a7b0943c71434708e7fd13be0f7635a7baecc", "archive_executable": "agent-vault"},
+        "ast-grep": {"manager": "brew", "package": "ast-grep", "executable": "ast-grep"},
+        "azure-cli": {"manager": "brew", "package": "azure-cli", "executable": "az"},
+        "bun": {"manager": "brew", "package": "bun", "executable": "bun"},
+        "adl-embedding": {"manager": "embedding-model", "package": "adl-embedding", "executable": "adl-embedding/model/model.bin", "version": "0.0.1", "source": "minishlab/potion-multilingual-128M", "vocab_limit": 150000, "dim": 256, "reason": "Model data is downloaded and verified into the per-user cache; it is not an Adl code component."},
+        "code-review-graph": {"manager": "pip", "package": "code-review-graph", "executable": "code-review-graph"},
+        "crg": {"manager": "shim", "package": "code-review-graph", "executable": "/usr/local/bin/crg"},
+        "curl": {"manager": "brew", "package": "curl", "executable": "curl"},
+        "docker-buildx": {"manager": "brew", "package": "docker-buildx", "executable": "docker-buildx"},
+        "docker-cli": {"manager": "brew", "package": "docker", "executable": "docker"},
+        "docker-compose": {"manager": "brew", "package": "docker-compose", "executable": "docker-compose"},
+        "docs-search": {"manager": "npm", "package": "@amsterdamdatalabs/enact-docs-search", "executable": "enact-docs-search", "allow_scripts": ["hnswlib-node", "onnxruntime-node", "sharp", "protobufjs"], "reason": "Separate search product that provides the search tool."},
+        "adl": {"manager": "npm", "package": "@amsterdamdatalabs/adl-agent-control", "executable": "adl"},
+        "adl-agent-id": {"manager": "npm", "package": "@amsterdamdatalabs/adl-agent-id", "executable": "adl-agent-id", "version": "0.4.0", "reason": "Separate Go binary with its own trust boundary."},
+        "fd": {"manager": "brew", "package": "fd", "executable": "fd"},
+        "git": {"manager": "brew", "package": "git", "executable": "git"},
+        "jq": {"manager": "brew", "package": "jq", "executable": "jq"},
+        "just": {"manager": "brew", "package": "just", "executable": "just"},
+        "lean-ctx": {"manager": "release-archive-latest", "package": "lean-ctx", "executable": "/usr/local/bin/lean-ctx", "repo": "yvgude/lean-ctx", "asset": "lean-ctx-x86_64-unknown-linux-gnu.tar.gz", "checksums_asset": "SHA256SUMS", "archive_executable": "lean-ctx"},
+        "node": {"manager": "brew", "package": "node", "executable": "node"},
+        "ripgrep": {"manager": "brew", "package": "ripgrep", "executable": "rg"},
+        "search": {"manager": "shim", "package": "enact-docs-search", "executable": "/usr/local/bin/search"},
+        "tailscale": {"manager": "apt", "package": "tailscale", "executable": "/usr/bin/tailscale"},
+        "uv": {"manager": "brew", "package": "uv", "executable": "uv"},
+        "yq": {"manager": "brew", "package": "yq", "executable": "yq"}
+      }
+    },
+    "devices": {
+      "hostinger-vps-1": {
+        "administrator": "root",
+        "default_agent": "agent-tarun",
+        "home": "/root",
+        "minimum_free_gib": 25,
+        "schedule_minute": 50,
+        "scratch_repos": ["/root/enact-webview"],
+        "brew_upgrade_all": true,
+        "surface_clis": [
+          {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
+          {"name": "opencode", "manager": "native", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]},
+          {"name": "codex", "manager": "unknown", "report_only": true, "executable": "/root/codex"}
+        ],
+        "tools": {
+          "docker-engine": {"manager": "apt", "package": "docker-ce", "executable": "/usr/bin/dockerd"},
+          "lsof": {"manager": "apt", "package": "lsof", "executable": "/usr/bin/lsof"},
+          "unzip": {"manager": "apt", "package": "unzip", "executable": "/usr/bin/unzip"}
+        }
+      },
+      "strato-vps-1": {
+        "administrator": "root",
+        "default_agent": "agent-tarun",
+        "home": "/root",
+        "minimum_free_gib": 25,
+        "schedule_minute": 20,
+        "scratch_repos": ["/root/enact-webview"],
+        "brew_upgrade_all": true,
+        "surface_clis": [
+          {"name": "opencode", "manager": "npm", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]}
+        ],
+        "tools": {
+          "docker-engine": {"manager": "apt", "package": "docker-ce", "executable": "/usr/bin/dockerd"},
+          "lsof": {"manager": "apt", "package": "lsof", "executable": "/usr/bin/lsof"},
+          "postgresql-18": {"manager": "apt", "package": "postgresql-18", "executable": "/usr/lib/postgresql/18/bin/postgres"},
+          "unzip": {"manager": "apt", "package": "unzip", "executable": "/usr/bin/unzip"},
+          "xvfb": {"manager": "apt", "package": "xvfb", "executable": "/usr/bin/xvfb-run"}
+        }
+      }
+    }
+  }
+}

package/packages/fleet/manifest.schema.json

@@ -0,0 +1,283 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://adl.tools/schemas/global-tools-manifest-v1.json",
+  "title": "Adl global tools manifest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["config", "mac", "linux"],
+  "properties": {
+    "config": {
+      "type": "object",
+      "required": ["schema", "repository", "branch", "interval_seconds", "update_policy", "allow_major_updates", "remove_deleted_entries", "global_surface_sweep", "kimi_hooks", "surface_policy", "global_agents", "vscode_settings", "scratch_reap", "protected_tools", "git_global_config", "azure_agents"],
+      "properties": {
+        "global_surface_sweep": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled", "remove_unprotected"],
+          "properties": {
+            "enabled": {"const": true},
+            "remove_unprotected": {"type": "boolean"}
+          }
+        },
+        "kimi_hooks": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": {"const": true}
+          }
+        },
+        "surface_policy": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": {"const": true}
+          }
+        },
+        "global_agents": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": {"const": true}
+          }
+        },
+        "vscode_settings": {
+          "type": "object",
+          "description": "Converge the fleet-owned VS Code worktree discovery settings in the administrator's default and named profiles, while skipping hosts with no stable VS Code User directory.",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": {"const": true}
+          }
+        },
+        "scratch_reap": {
+          "type": "object",
+          "description": "Reclaim scratch-worktree disk on the devices that declare scratch_repos. The regenerable-artifact tier is always on; remove_worktrees arms the destructive tier.",
+          "additionalProperties": false,
+          "required": ["enabled", "idle_days", "reap_days", "remove_worktrees"],
+          "properties": {
+            "enabled": {"const": true},
+            "idle_days": {"type": "integer", "minimum": 0},
+            "reap_days": {"type": "integer", "minimum": 1},
+            "remove_worktrees": {"type": "boolean"}
+          }
+        },
+        "git_global_config": {
+          "type": "object",
+          "description": "Global git config entries set for the administrator on every host; entries removed from the manifest are unset.",
+          "propertyNames": {"pattern": "^[A-Za-z][A-Za-z0-9-]*\\..+"},
+          "additionalProperties": {"type": "string"}
+        }
+      }
+    },
+    "mac": {
+      "allOf": [{"$ref": "#/$defs/platform"}],
+      "properties": {
+        "common": {"properties": {"launch_agents": {"$ref": "#/$defs/launch_agents"}}},
+        "devices": {"additionalProperties": {"properties": {"launch_agents": {"$ref": "#/$defs/launch_agents"}}}}
+      }
+    },
+    "linux": {
+      "allOf": [{"$ref": "#/$defs/platform"}],
+      "properties": {
+        "common": {"not": {"required": ["launch_agents"]}},
+        "devices": {"additionalProperties": {"not": {"required": ["launch_agents"]}}}
+      }
+    }
+  },
+  "$defs": {
+    "tool": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["manager", "package", "executable"],
+      "properties": {
+        "manager": {"enum": ["apt", "brew", "npm", "pip", "release-archive", "release-archive-latest", "shim", "repo-script", "bun-compile", "embedding-model"]},
+        "package": {"type": "string", "minLength": 1},
+        "executable": {"type": "string", "minLength": 1},
+        "version": {"type": "string", "minLength": 1},
+        "url": {"type": "string", "pattern": "^https://"},
+        "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "archive_executable": {"type": "string", "pattern": "^[^/][^\\n]*$"},
+        "repo": {"type": "string", "pattern": "^[^/\\s]+/[^/\\s]+$"},
+        "asset": {"type": "string", "pattern": "^[^/][^\\n]*$"},
+        "checksums_asset": {"type": "string", "pattern": "^[^/][^\\n]*$"},
+        "source": {"type": "string", "pattern": "^[^/][^\\n]*$"},
+        "entry": {"type": "string", "minLength": 1},
+        "vocab_limit": {"type": "integer", "minimum": 1},
+        "dim": {"type": "integer", "minimum": 1},
+        "reason": {"type": "string", "minLength": 1}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"manager": {"const": "release-archive"}}},
+          "then": {"required": ["version", "url", "sha256", "archive_executable"]}
+        },
+        {
+          "if": {"properties": {"manager": {"const": "release-archive-latest"}}},
+          "then": {
+            "required": ["repo", "asset", "archive_executable"],
+            "properties": {"executable": {"pattern": "^/usr/local/bin/"}}
+          }
+        },
+        {
+          "if": {"properties": {"manager": {"const": "shim"}}},
+          "then": {"properties": {"executable": {"pattern": "^/usr/local/bin/"}}}
+        },
+        {
+          "if": {"properties": {"manager": {"const": "repo-script"}}},
+          "then": {
+            "required": ["source"],
+            "not": {"required": ["version"]},
+            "properties": {
+              "source": {"pattern": "^[^/][^\\n]*$"},
+              "executable": {"pattern": "^/usr/local/bin/[A-Za-z0-9][A-Za-z0-9._-]*$"}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"manager": {"const": "bun-compile"}}},
+          "then": {
+            "required": ["source", "entry"],
+            "not": {"required": ["version"]},
+            "properties": {"executable": {"pattern": "^/usr/local/bin/"}}
+          }
+        },
+        {
+          "if": {"properties": {"manager": {"const": "embedding-model"}}},
+          "then": {
+            "required": ["version", "source", "vocab_limit", "dim"]
+          }
+        }
+      ]
+    },
+    "tools": {
+      "type": "object",
+      "additionalProperties": {"$ref": "#/$defs/tool"}
+    },
+    "relative_path": {"type": "string", "pattern": "^(?!/)(?!.*(^|/)\\.\\.(/|$)).+$"},
+    "surface_cli": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "manager"],
+      "properties": {
+        "name": {"type": "string", "minLength": 1},
+        "manager": {"enum": ["native", "npm", "brew", "unknown"]},
+        "command": {"type": "string", "minLength": 1, "pattern": "^[^/]+$"},
+        "executable": {"type": "string", "pattern": "^/"},
+        "update_args": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}},
+        "report_only": {"type": "boolean"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"report_only": {"const": true}}, "required": ["report_only"]},
+          "then": {"required": ["executable"]},
+          "else": {"required": ["command", "update_args"]}
+        },
+        {
+          "if": {"properties": {"manager": {"const": "brew"}}, "required": ["manager"]},
+          "then": {
+            "required": ["command", "update_args"],
+            "properties": {
+              "command": {"const": "brew"},
+              "report_only": {"const": false},
+              "update_args": {
+                "minItems": 3,
+                "maxItems": 3,
+                "prefixItems": [
+                  {"const": "upgrade"},
+                  {"const": "--cask"},
+                  {"type": "string", "minLength": 1}
+                ]
+              }
+            }
+          }
+        }
+      ]
+    },
+    "launch_agent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["label", "source", "entry", "start_interval_seconds", "run_at_load", "environment", "log"],
+      "properties": {
+        "label": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"},
+        "source": {"$ref": "#/$defs/relative_path", "description": "Checkout-relative job directory; reconcile compiles it to a dedicated signed binary, rebuilt when its content hash changes."},
+        "entry": {"$ref": "#/$defs/relative_path", "description": "TypeScript entry file relative to source."},
+        "start_interval_seconds": {"type": "integer", "minimum": 60},
+        "run_at_load": {"type": "boolean"},
+        "repo_scope": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["root", "glob", "recursive"],
+          "properties": {
+            "root": {"$ref": "#/$defs/relative_path", "description": "Repository scan root relative to the device administrator's home."},
+            "glob": {"type": "string", "minLength": 1},
+            "recursive": {"const": true}
+          }
+        },
+        "environment": {
+          "type": "object",
+          "propertyNames": {"pattern": "^[A-Z_][A-Z0-9_]*$"},
+          "additionalProperties": {"type": "string"}
+        },
+        "log": {"$ref": "#/$defs/relative_path"},
+        "replaces": {"type": "array", "items": {"$ref": "#/$defs/relative_path"}}
+      }
+    },
+    "launch_agents": {
+      "description": "User LaunchAgents enact-vps installs for the device administrator (macOS only).",
+      "type": "object",
+      "additionalProperties": {"$ref": "#/$defs/launch_agent"}
+    },
+    "platform": {
+      "type": "object",
+      "required": ["common", "devices"],
+      "properties": {
+        "common": {
+          "type": "object",
+          "required": ["tools"],
+          "properties": {
+            "os_upgrade": {"type": "boolean"},
+            "tools": {"$ref": "#/$defs/tools"}
+          }
+        },
+        "devices": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["administrator", "default_agent", "home", "minimum_free_gib", "schedule_minute", "tools"],
+            "properties": {
+              "administrator": {"type": "string", "minLength": 1},
+              "default_agent": {
+                "type": "string",
+                "pattern": "^agent-[a-z0-9-]+$",
+                "description": "The adl identity a plain `claude`/`codex` session (no `adl run --as`) acts as on this device, and the identity host automation (sync-and-reconcile, scratch-reap) uses via git-ado. Written by reconcile to the machine's single default-agent file (docs/architecture/cli-design.md, 2026-09-27 decisions)."
+              },
+              "home": {"type": "string", "pattern": "^/"},
+              "minimum_free_gib": {"type": "integer", "minimum": 1},
+              "schedule_minute": {"type": "integer", "minimum": 0, "maximum": 59},
+              "brew_upgrade_all": {
+                "type": "boolean",
+                "description": "When true, reconcile runs `brew upgrade` for every outdated formula and cask on this device right after `brew update` and before the per-tool loop (2026-09-28)."
+              },
+              "surface_clis": {
+                "type": "array",
+                "description": "Agent surface CLIs (claude, kimi, opencode, cursor's `agent`, and Codex) this device reconciles in the same run. Codex uses manager=brew to install a missing named cask and run `brew upgrade --cask <name>` when installed; brew_upgrade_all also upgrades installed casks.",
+                "items": {"$ref": "#/$defs/surface_cli"}
+              },
+              "scratch_repos": {
+                "type": "array",
+                "description": "Repos whose scratch worktrees this device reclaims. Absent means never touched -- a developer machine's scratch is working state.",
+                "items": {"type": "string", "pattern": "^/[^\\s]*[^/\\s]$"},
+                "uniqueItems": true
+              },
+              "tools": {"$ref": "#/$defs/tools"}
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/packages/fleet/src/default-agent-file.ts

@@ -0,0 +1,144 @@
+/**
+ * The machine's default `adl` agent identity, written to one root-owned file
+ * per platform (docs/architecture/cli-design.md, "Machine default agent — the one
+ * source", Tarun's 2026-09-27 decisions):
+ *
+ *   macOS: /Library/Application Support/adl/default-agent
+ *   Linux: /etc/adl/default-agent
+ *
+ * One line, the bare agent id (e.g. `agent-tarun\n`), file mode 0644. This is
+ * the single source every consumer reads instead of carrying its own copy:
+ *
+ *   (a) `adl run`'s default identity when no `--as` is given (apps/cli;
+ *       the old passport-count heuristic is removed, hard cut).
+ *   (b) The Claude managed-settings.json this same reconcile pass renders,
+ *       whose `env.ADL_AGENT_ID_AGENT` is this file's value (managed-settings.ts).
+ *   (c) The Codex managed layer's `shell_environment_policy.set.ADL_AGENT_ID_AGENT`
+ *       (ditto, managed-settings.ts).
+ *   (d) Host automation (sync-and-reconcile, scratch-reap), which reads this
+ *       file to choose the `ADL_AGENT_ID_AGENT` it hands to `git-ado`.
+ *
+ * This module owns only the WRITE side (`reconcileDefaultAgentFile`) and the
+ * path computation every consumer of the READ side needs too
+ * (`defaultAgentFilePath`). The read itself lives in ONE place,
+ * `packages/azdo/src/lib/agent-identity.ts`'s `readDefaultAgentFile` /
+ * `resolveAgentIdentity` (STATUS.md 12p, W1) —
+ * every reader in this repo, including this package's own scratch-reap.ts,
+ * goes through that module rather than duplicating the read here.
+ *
+ * `root` is an injectable filesystem root so tests can point every path here
+ * at a disposable directory instead of the real system path — a test must
+ * never write `/Library/Application Support` or `/etc` for real. Production
+ * reconcile always calls this with `root` omitted (the real absolute path).
+ *
+ * The write is atomic: a same-directory temp file, chmod 0644, then a single
+ * rename(2) — never a direct in-place write a concurrent reader (e.g. `adl
+ * run` in another session) could observe half-written. Ownership as root is
+ * a byproduct of reconcile's apply mode already running as root; nothing
+ * here calls chown.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname, isAbsolute, join } from 'node:path'
+
+export type FleetPlatform = 'mac' | 'linux'
+
+export const DEFAULT_AGENT_PATTERN = /^agent-[a-z0-9-]+$/
+
+/** Absolute path (under `root`, default the real filesystem root) of the platform's default-agent file. */
+export function defaultAgentFilePath(platform: FleetPlatform, root = ''): string {
+  switch (platform) {
+    case 'mac':
+      return join(root, '/Library/Application Support/adl/default-agent')
+    case 'linux':
+      return join(root, '/etc/adl/default-agent')
+    default: {
+      const exhaustive: never = platform
+      throw new Error(`unsupported platform: ${exhaustive}`)
+    }
+  }
+}
+
+export interface ReconcileDefaultAgentFileOptions {
+  readonly root?: string
+  /** plan mode: report what would change without writing. */
+  readonly dryRun?: boolean
+}
+
+export interface DefaultAgentFileResult {
+  readonly path: string
+  readonly changed: boolean
+}
+
+export function reconcileDefaultAgentFile(
+  agent: string,
+  platform: FleetPlatform,
+  options: ReconcileDefaultAgentFileOptions = {},
+): DefaultAgentFileResult {
+  if (!DEFAULT_AGENT_PATTERN.test(agent)) {
+    throw new Error(`default_agent must match ${DEFAULT_AGENT_PATTERN}: ${agent}`)
+  }
+  const path = defaultAgentFilePath(platform, options.root ?? '')
+  const desired = `${agent}\n`
+  const current = existsSync(path) ? readFileSync(path, 'utf8') : null
+  const changed = current !== desired
+  if (options.dryRun !== true && changed) {
+    mkdirSync(dirname(path), { recursive: true })
+    const temp = `${path}.new`
+    writeFileSync(temp, desired)
+    chmodSync(temp, 0o644)
+    renameSync(temp, path)
+  }
+  return { path, changed }
+}
+
+function parseArguments(argv: readonly string[]): {
+  readonly agent: string
+  readonly platform: FleetPlatform
+  readonly mode: 'plan' | 'apply'
+  readonly root: string
+} {
+  let agent: string | null = null
+  let platform: string | null = null
+  let mode: string | null = null
+  let root = ''
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index]
+    if (flag === '--agent') {
+      agent = argv[index + 1] ?? null
+      index += 1
+    } else if (flag === '--platform') {
+      platform = argv[index + 1] ?? null
+      index += 1
+    } else if (flag === '--mode') {
+      mode = argv[index + 1] ?? null
+      index += 1
+    } else if (flag === '--root') {
+      root = argv[index + 1] ?? ''
+      index += 1
+    } else {
+      throw new Error(`unknown argument: ${flag}`)
+    }
+  }
+  if (agent === null) throw new Error('--agent is required')
+  if (platform !== 'mac' && platform !== 'linux') throw new Error('--platform must be mac or linux')
+  if (mode !== 'plan' && mode !== 'apply') throw new Error('--mode must be plan or apply')
+  if (root !== '' && !isAbsolute(root)) throw new Error(`--root must be absolute: ${root}`)
+  return { agent, platform, mode, root }
+}
+
+function main(argv: readonly string[]): void {
+  const args = parseArguments(argv)
+  const result = reconcileDefaultAgentFile(args.agent, args.platform, { root: args.root, dryRun: args.mode === 'plan' })
+  if (!result.changed) console.log(`default-agent-file: already set: ${result.path} = ${args.agent}`)
+  else if (args.mode === 'plan') console.log(`default-agent-file: would write: ${result.path} = ${args.agent}`)
+  else console.log(`default-agent-file: wrote: ${result.path} = ${args.agent}`)
+}
+
+if (import.meta.main) {
+  try {
+    main(process.argv.slice(2))
+  } catch (cause) {
+    console.error(`default-agent-file: ${cause instanceof Error ? cause.message : String(cause)}`)
+    process.exit(1)
+  }
+}