@awebai/oats 0.35.4 → 0.36.0

package/bin/oats.mjs

@@ -1850,7 +1850,7 @@ async function statusDrift(data) {
     catch { /* not a workspace soul (classic, or an unreadable stamp) */ }
   }
   const anything = data.some((a) => (a.instances || []).some((i) => hasModules(i) || hasSoul(i)));
-  if (!anything) return { drift: new Map(), soul: new Map(), souls, unreachable: null };
+  if (!anything) return { drift: new Map(), soul: new Map(), souls, unreachable: null, local: ctx.local, discovery: null };
   const deploymentDir = dirname(ctx.path);
   let lock = null;
   try { lock = readLockIfPresent(deploymentDir); } catch { lock = null; }
@@ -1860,7 +1860,7 @@ async function statusDrift(data) {
   try { const { discoverOrStandalone } = await import("../lib/instance-resolution.mjs"); discovery = await discoverOrStandalone(ctx.local, { lock, remoteOptions: remoteOptionsFromEnv() }); }
   catch (e) {
     const reason = e?.details?.reason ? `${e.code}: ${e.details.reason}` : (e?.code || e?.message || "unknown");
-    return { drift: new Map(), soul: new Map(), souls, unreachable: { code: e?.code ?? null, reason, message: e?.message ?? String(e) } };
+    return { drift: new Map(), soul: new Map(), souls, unreachable: { code: e?.code ?? null, reason, message: e?.message ?? String(e) }, local: ctx.local, discovery: null };
   }
   const { driftOf, soulDriftOf } = await import("../lib/materialize.mjs");
   const drift = new Map();
@@ -1879,7 +1879,67 @@ async function statusDrift(data) {
     const member = memberRowByKey(discovery.members, stamp.repoKey);
     if (member && typeof member.commit === "string" && (member.confirmed || (discovery.standalone === true && member.key === discovery.key))) stamp.current = member.commit;
   }
-  return { drift, soul, souls, unreachable: null };
+  return { drift, soul, souls, unreachable: null, local: ctx.local, discovery };
+}
+/** The deployment's workspace identity in `oats status --json` (feature workspace-identity), read
+ *  OFFLINE. `key` is the workspace HOST's canonical repo key (parseRepoRef(...).key) and `ref` the
+ *  reference as oats-local.yaml writes it. The host is the one this run observed, else the one this
+ *  machine's parsed cache knows: `ref` itself when the cache holds its workspace file, or the host its
+ *  cached oats-membership.yaml names when `ref` is a member ("workspace"). A member whose host is not
+ *  known keys as itself ("member"); a ref nothing is known of is taken as the host, as the schema
+ *  defines `workspace:` ("workspace"). The team model resolves as teamModel resolves it (the default
+ *  label is local; a committed team wins a collision) over the shared teams of, in order, the workspace
+ *  file this run observed (`teamsFrom: "observed"`), the cached file ("cache": no git process), or none
+ *  ("local"). `standalone` is the CONFIGURED standalone view only (oats-local.yaml `standalone:`): it
+ *  reads no workspace file, so its local teams are the whole team model. A run that fell back to the
+ *  standalone view (the host unreadable) is not: its team model is the workspace's, and its
+ *  discovery is the member's, never the host's key. */
+function workspaceIdentity(local, discovery) {
+  const ref = local.workspace;
+  const standalone = typeof local.standalone === "string" && local.standalone !== "";
+  const observed = discovery && discovery.standalone !== true && discovery.workspace ? discovery : null;
+  const cached = observed ? null : cachedWorkspace(ref);
+  const keyOf = (r) => { try { return remoteModule.parseRepoRef(r).key; } catch { return null; } };
+  let key, keyFrom;
+  if (observed) [key, keyFrom] = [observed.key, "workspace"];
+  else if (cached && cached.host === null) [key, keyFrom] = [keyOf(ref), "member"];
+  else [key, keyFrom] = [keyOf(cached?.host ?? ref), "workspace"];
+  if (key === null) keyFrom = null; // a reference parseRepoRef refuses: unusable, never matched
+  let shared = null, teamsFrom = "local";
+  if (!standalone) {
+    if (observed) [shared, teamsFrom] = [observed.workspace, "observed"];
+    else if (cached?.file) [shared, teamsFrom] = [cached.file, "cache"];
+  }
+  const model = teamModel(shared, local);
+  const labels = [...model.labels.keys()].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  return {
+    key, ref, keyFrom, standalone,
+    defaultTeam: model.defaultTeam === null ? null : { label: model.defaultTeam, team: model.labels.get(model.defaultTeam)?.team ?? null },
+    teams: Object.fromEntries(labels.map((l) => [l, model.labels.get(l).team])),
+    teamsFrom,
+  };
+}
+/** What this machine's parsed cache knows of the workspace `ref` names (the values observeWorkspace and
+ *  confirmMembership stored, each at its repo's last observed commit): { host, file } — `host` the ref
+ *  of the workspace host, `file` its workspace file or null — when `ref` is the host (its workspace file
+ *  is cached) or a member whose cached oats-membership.yaml names it (discoverOrStandalone follows the
+ *  same backlink). A member's backlink is cached whether its own workspace slot was observed (missing)
+ *  or never was (the host's discovery confirmed it). { host: null, file: null } for a ref cached as
+ *  having no workspace file and no backlink; null when nothing is known. */
+function cachedWorkspace(ref) {
+  const options = remoteOptionsFromEnv();
+  const cached = (r, item) => {
+    const commit = remoteModule.lastObservedCommit(r, options);
+    const value = commit ? remoteModule.peekAtCommit(r, commit, item, options) : undefined;
+    return value && typeof value === "object" ? value : null;
+  };
+  const fileOf = (read) => (read && !read.missing && !read.problems && read.value && typeof read.value === "object" ? read.value : null);
+  const read = cached(ref, "workspace");
+  if (read && !read.missing) return { host: ref, file: fileOf(read) };
+  const membership = cached(ref, "membership");
+  const host = membership?.kind === "ok" && typeof membership.value?.workspace === "string" ? membership.value.workspace : null;
+  if (host !== null) return { host, file: fileOf(cached(host, "workspace")) };
+  return read ? { host: null, file: null } : null;
 }
 /** One `modules:` line per module. */
 function driftLine(row) {
@@ -1948,7 +2008,7 @@ async function status() {
       }
     }
     const observation = maxAgeGiven === null ? {} : { observation: observationBlock() };
-    console.log(JSON.stringify({ root, agents: data, ...observation, ...(ws ? { workspace: ws.unreachable ? { reachable: false, ...ws.unreachable } : { reachable: true } } : {}), ...(problems.length ? { problems } : {}), ...envelopeWarnings() }, null, 2)); return;
+    console.log(JSON.stringify({ root, agents: data, ...observation, ...(ws ? { workspace: { ...(ws.unreachable ? { reachable: false, ...ws.unreachable } : { reachable: true }), ...workspaceIdentity(ws.local, ws.discovery) } } : {}), ...(problems.length ? { problems } : {}), ...envelopeWarnings() }, null, 2)); return;
   }
   console.log(`oats status — agents root ${shortPath(root)}\n`);
   if (ws?.unreachable) console.log(`  workspace: unreachable (${ws.unreachable.reason}) — drift unknown\n`);
@@ -3059,7 +3119,7 @@ function versionCmd() {
     // Phase B: `instance-modules` and `spawn-provider-payload` are advertised only once spawn
     // runs on resolve/materialize (contract §6); a feature the binary does not implement is
     // never listed.
-    console.log(JSON.stringify({ schemaVersion: 1, name: "@awebai/oats", version: OATS_VERSION, desktopApi: 1, harnesses: ["pi", "claude", "codex"], sessionBackends: ["tmux"], launchOptions: ["yolo"], remote: ["spawn", "retire", "status", "session", "session-start", "session-restart", "launch-config", "roster", "harvest", "schedule", "session-upload", "operations", "readiness", "instance-events", "instance-git", "lifecycle-plans"], features: ["retire-home", "session-start", "session-restart", "launch-config", "schedule", "session-upload", "operations", "instance-git", "instance-git-remote", "souls-declarations", "lifecycle-plans", "retire-retention", "readiness", "spawn-preview", "instance-events", "instance-events-2", "schedule-history", "schedule-read-2", "spawn-preview-2", "spawn-idempotency", "spawn-idempotency-2", "spawn-apply-2", "workspace-v2", "instance-modules", "spawn-provider-payload", "served-identity", "packages-no-approval", "spawn-name", "settings-origins", "team-model-2", "settings-declared", "capabilities-private", "layers-from", "harness", "package-souls", "triggers", "automations", "desktop-facts", "launch-preference", "preview-composed-from", "observe-max-age", "spawn-preview-max-age", "launch-config-default", "capability-show", "capture-file"], automationsApi: A.AUTOMATIONS_API, workspaceApi: 2, instanceGitApi: 1, spawnApplyApi: 1, soulsApi: 2, lifecycleApi: 1, readinessApi: 2, spawnPreviewApi: 2, eventsApi: 2, scheduleHistoryApi: 3, scheduleApi: SCHEDULE_API, operationsApi: 2, capabilityShowApi: 1 }));
+    console.log(JSON.stringify({ schemaVersion: 1, name: "@awebai/oats", version: OATS_VERSION, desktopApi: 1, harnesses: ["pi", "claude", "codex"], sessionBackends: ["tmux"], launchOptions: ["yolo"], remote: ["spawn", "retire", "status", "session", "session-start", "session-restart", "launch-config", "roster", "harvest", "schedule", "session-upload", "operations", "readiness", "instance-events", "instance-git", "lifecycle-plans"], features: ["retire-home", "session-start", "session-restart", "launch-config", "schedule", "session-upload", "operations", "instance-git", "instance-git-remote", "souls-declarations", "lifecycle-plans", "retire-retention", "readiness", "spawn-preview", "instance-events", "instance-events-2", "schedule-history", "schedule-read-2", "spawn-preview-2", "spawn-idempotency", "spawn-idempotency-2", "spawn-apply-2", "workspace-v2", "instance-modules", "spawn-provider-payload", "served-identity", "packages-no-approval", "spawn-name", "settings-origins", "team-model-2", "settings-declared", "capabilities-private", "layers-from", "harness", "package-souls", "triggers", "automations", "desktop-facts", "launch-preference", "preview-composed-from", "observe-max-age", "spawn-preview-max-age", "launch-config-default", "capability-show", "capture-file", "workspace-identity"], automationsApi: A.AUTOMATIONS_API, workspaceApi: 2, instanceGitApi: 1, spawnApplyApi: 1, soulsApi: 2, lifecycleApi: 1, readinessApi: 2, spawnPreviewApi: 2, eventsApi: 2, scheduleHistoryApi: 3, scheduleApi: SCHEDULE_API, operationsApi: 2, capabilityShowApi: 1 }));
     return;
   }
   console.log(`@awebai/oats ${OATS_VERSION} (desktop API v1)`);

package/docs/desktop-cli-api.md

@@ -38,7 +38,7 @@ canonical (`github.com/<org>/<repo>`, or `local/<abs-path>`). Examples use
              "instance-events-2","schedule-history","schedule-read-2","spawn-preview-2","spawn-idempotency","spawn-idempotency-2","spawn-apply-2",
              "workspace-v2","instance-modules","spawn-provider-payload","served-identity","packages-no-approval","spawn-name","settings-origins",
              "team-model-2","settings-declared","capabilities-private","layers-from","harness","package-souls","triggers","automations","desktop-facts","launch-preference",
-             "preview-composed-from","observe-max-age","spawn-preview-max-age","capability-show","capture-file"],
+             "preview-composed-from","observe-max-age","spawn-preview-max-age","capability-show","capture-file","workspace-identity"],
  "automationsApi":1,"workspaceApi":2,"instanceGitApi":1,"spawnApplyApi":1,"soulsApi":2,"lifecycleApi":1,
  "readinessApi":2,"spawnPreviewApi":2,"eventsApi":2,"scheduleHistoryApi":3,"scheduleApi":2,"operationsApi":2,
  "capabilityShowApi":1}
@@ -100,6 +100,7 @@ canonical (`github.com/<org>/<repo>`, or `local/<abs-path>`). Examples use
 | `spawn-preview-max-age` | `--max-age <s>` on `spawn --preview` and its `observation` block ([Observation reuse](#observation-reuse-feature-observe-max-age-oats-0311), [The preview](#the-preview)) | |
 | `capability-show` | `oats capabilities show <name>` and its `--file` form, OATS 0.34.0 ([`oats capabilities show`](#oats-capabilities-show)) | `capabilityShowApi: 1` |
 | `capture-file` | `oats capture --file <path> --format cc\|pi\|codex --home <instance home> [--json]`: one session file captured as `--home` capture would, with a receipt bound to its bytes, OATS 0.35.0 (the capture USAGE and packages/record/README.md) | |
+| `workspace-identity` | the deployment's workspace identity on `oats status --json` `workspace` (`key`, `ref`, `keyFrom`, `standalone`, `defaultTeam`, `teams`, `teamsFrom`) and each `oats server roster --json` group's relayed `workspace`, OATS 0.36.0 ([Workspace identity](#workspace-identity-feature-workspace-identity-oats-0360)) | |
 
 Payload-only integers, never in the probe: `onboardApi: 2`, `syncApi: 1`,
 `workspaceStatusApi: 1`, `capabilitiesApi: 1`, the `oats souls` document's
@@ -344,7 +345,7 @@ An instance subject, abridged:
 | Key | Meaning |
 |---|---|
 | `subject` | `{kind: "instance", instance, home, soul}` or `{kind: "soul", soul, repoKey, commit}` |
-| `workspace` | `{key, name, deployment, commit, standalone}`; for a home, `name` is the recorded name (`null` if the spawn predates it) |
+| `workspace` | `{key, name, deployment, commit, standalone}`; for a home, `name` is the recorded name (`null` if the spawn predates it). `standalone` is the view the subject resolves in (a fallback for an unreadable host included), unlike `oats status`'s configured-only [`standalone`](#workspace-identity-feature-workspace-identity-oats-0360) |
 | `souls` | exactly the subject's soul |
 | `layers` | `{knowledge, messaging, tasks}`, each `{id, from}` |
 | `capabilities`, `capabilitiesOff` | the resolved modules (by id) and the ones the soul turned off |
@@ -1679,7 +1680,8 @@ Not an envelope: `{root, agents, observation?, workspace?, problems?, warnings?}
                           "modules":[{"name":"oats.okf","from":{"kind":"package","package":"oats.okf","version":"2.1.3","commit":"ab897841…","integrity":"sha256-bada35…","repoKey":"github.com/awebai/oats-okf"},
                                       "commit":"ab897841…","current":{"commit":"ab897841…","version":"2.1.3"},"status":"current"}],
                           "soul":{"repoKey":"github.com/nw/agents","commit":"66566512…","current":"66566512…","status":"current"}}]}],
- "workspace":{"reachable":true}}
+ "workspace":{"reachable":true,"key":"github.com/nw/agents","ref":"git:github.com/nw/agents","keyFrom":"workspace","standalone":false,"defaultTeam":{"label":"eng","team":"eng:nw.aweb.ai"},
+              "teams":{"eng":"eng:nw.aweb.ai","mine":"mine:ana.aweb.ai","ops":null},"teamsFrom":"observed"}}
 ```
 
 - **Agent rows**: the soul's recorded definition plus `dir` and `instances`,
@@ -1712,11 +1714,68 @@ Not an envelope: `{root, agents, observation?, workspace?, problems?, warnings?}
   reason?}`; a package soul adds `package`, `version`, `currentVersion`
   (`missing` reasons: `package-absent`, `soul-absent`).
 - **`workspace`**: `{reachable: true}`, or `{reachable: false, code, reason,
-  message}` (modules then stay the recorded map). Absent without
-  `oats-local.yaml`.
+  message}` (modules then stay the recorded map), plus the deployment's
+  [workspace identity](#workspace-identity-feature-workspace-identity-oats-0360)
+  either way. Absent without `oats-local.yaml`.
 - `problems`: the legacy-home rows ([dispatch errors](#dispatch-errors)).
   `warnings`: envelope warnings. `--team` is `E_BAD_ARGS` (an envelope).
 
+<a id="workspace-identity-feature-workspace-identity-oats-0360"></a>
+**Workspace identity** (feature `workspace-identity`, OATS 0.36.0). The
+`workspace` object says which workspace and teams this deployment is, read
+offline with no network, so it is there whether `reachable` is `true` or
+`false`:
+
+| Key | Meaning |
+|---|---|
+| `key` | the canonical repo key of the workspace HOST (`parseRepoRef(…).key`: every spelling of one repository gives one key, e.g. `git:github.com/nw/agents`, `https://github.com/nw/agents.git` and `git@github.com:nw/agents.git` all give `github.com/nw/agents`). When `oats-local.yaml` names a member in place of its host, it is the host's key once the member's backlink is known. `null` when `parseRepoRef` refuses the reference |
+| `ref` | the reference exactly as `oats-local.yaml` writes it (`workspace:`), for display only |
+| `keyFrom` | `"workspace"`: `key` is the host's, because this run observed it, or the cache holds the ref's workspace file, or a member's cached backlink names the host. With nothing observed or cached, the ref is taken as the host, as the schema defines `workspace:`. `"member"`: the ref names a member whose host is not known yet, so `key` is the member's own. `null` with a `null` key |
+| `standalone` | `true` only when `oats-local.yaml` sets `standalone:` (the configured standalone view, whose local teams are its whole team model). A run that fell back to the standalone view because the host is unreadable is `false`: its teams are the workspace's, read through the sources below. Unlike `workspace.standalone` on [inspect](#oats-inspect), which is the view a home runs in |
+| `defaultTeam` | `{label, team}`: the label is `oats-local.yaml`'s `defaultTeam`, `team` its provider id from `teams` (`null` when that map gives none). `null` when `oats-local.yaml` names no default team |
+| `teams` | `{<label>: <provider team id> \| null}`: every team label the deployment maps, local and shared, by label; a label in both is the committed (shared) one, as [`oats teams`](#oats-teams) resolves it |
+| `teamsFrom` | where the shared teams came from: `"observed"`, the workspace file this run read; `"cache"`, this machine's cached copy at the host commit it last observed (no git process, no network; when `key` names a member, the host its cached `oats-membership.yaml` names); `"local"`, none: `teams` holds the local teams only |
+
+A configured standalone deployment reads no workspace file, so it is always
+`teamsFrom: "local"`, with its local teams only (as spawn resolves them there).
+`oats status` only reads the workspace when an instance records modules or a
+workspace soul, so an empty deployment answers from the cache, or from local
+teams on a host that has not observed its workspace (`oats sync` and
+`oats teams` observe it). The cache is the running kernel's own: after an
+OATS upgrade it is empty until the host next observes its workspace.
+
+**Matching workspaces across machines.** Two deployments are the same
+workspace when their `key`s are equal; `ref` is never compared. The identity
+is resolved the same offline way for every deployment, standalone included,
+whatever its team view:
+
+- `keyFrom: "member"` is unresolved: never match it, and show it as
+  unresolved (the host is learned when the deployment observes its
+  workspace, e.g. `oats sync`).
+- `keyFrom: "workspace"` with nothing observed (`teamsFrom: "local"` on a
+  deployment that is not standalone) means the ref was taken as the host, as
+  the schema defines. If it is really a member, the worst case is a split
+  (one workspace shown as two until `oats sync` there), never a wrong merge.
+- A `null` key is an unusable reference and never matches. Show `ref` with
+  "this deployment's workspace reference isn't valid; fix oats-local.yaml".
+- Known limit: `parseRepoRef` lowercases the host but keeps the path's case,
+  so references that differ in owner or repository case give different keys.
+
+**Matching teams across machines.** This is the rule for comparing two
+deployments' teams (as the Desktop does to attach a remote machine to a
+workspace):
+
+- `teamsFrom` `"observed"` or `"cache"`: a `null` team is **unmapped**, and
+  unmapped matches only unmapped.
+- `standalone: true` with `teamsFrom: "local"`: the local config IS the
+  complete team model, so a `null` team is **unmapped** (matches only
+  unmapped). Reason to show: "teams are local only on this host
+  (standalone)", with no sync advice.
+- `standalone: false` with `teamsFrom: "local"`: a `null` default team is
+  **unknown** and never matches. Reason to show: "this host hasn't observed
+  its workspace yet; run oats sync there". A non-null default team (a locally
+  mapped team) matches normally.
+
 **Desktop facts** (feature `desktop-facts`): `startedAt` is the last start or
 restart, else `createdAt` for a launched home, else `null`. `modelFrom` is
 `"soul"`, `"spawn"` or `"start"` (an explicit `--model`), `"launch-config"`,
@@ -1738,6 +1797,8 @@ route target:
 {"id":"build:3f2a…","server":"build","label":"Build box","registrationPresent":true,
  "target":{"sshHost":"build-host","workspace":"/srv/team","oatsPath":"oats"},
  "probe":{"ok":true},"agentsRoot":"/srv/team/agents",
+ "workspace":{"reachable":true,"key":"github.com/acme/team","ref":"git:github.com/acme/team","keyFrom":"workspace","standalone":false,"defaultTeam":{"label":"default","team":"acme:team"},
+              "teams":{"default":"acme:team"},"teamsFrom":"observed"},
  "souls":[{"name":"dev","harness":"claude","work":"worktree","agentsRoot":"/srv/team/agents"}],
  "instances":[{"server":"build","instance":"dev-a","agent":"dev","home":"/srv/team/agents/dev/instances/dev-a",
                "agentsRoot":"/srv/team/agents","harness":"claude","backend":"tmux","tmux":{"session":"oats-agents","window":"dev-a"},
@@ -1749,6 +1810,15 @@ route target:
  "retireFailures":[]}
 ```
 
+- **`workspace`** (feature `workspace-identity`, OATS 0.36.0): the host's
+  own `status --json` [`workspace` object](#workspace-identity-feature-workspace-identity-oats-0360),
+  relayed verbatim, or `null` when the host reports none (a deployment
+  without `oats-local.yaml`, or a failed or skipped probe). A host before
+  0.36.0 answers the reachability-only object (`{reachable, code?, reason?,
+  message?}`) with no identity fields, so the identity is there only when
+  the object has a `key` field (which a 0.36.0 host always sends, `null` for
+  an unusable reference). It is never derived on this side. It is on the group, not the
+  rows, so an empty remote deployment still reports it.
 - **Instance rows** relay the host's own `status --json` row: `identity`,
   `identityAddress`, `teams`, `startedAt`, `createdAt`, `model`,
   `runtimeState`, `parentInstance`, `siblingInstance`, `relation`,

package/docs/desktop.md

@@ -104,6 +104,53 @@ opened, or your home directory when there is none (never ~/Downloads);
 
 Launch flags for scripted use: `--dir <workspace>` and `OATS_DESKTOP_PORT`.
 
+## One workspace, several machines
+
+The switcher lists each workspace once, however many deployments it has: the
+deployments you opened on this Mac and those your registered servers report,
+matched by the workspace each one reports (its repository key and default
+team, by the kernel's rules). It needs a CLI with the `workspace-identity`
+feature (OATS 0.36.0); without it each deployment has its own entry.
+
+- **Deployments.** The **Deployments** page (formerly the Active overview)
+  shows the workspace's overview trees. **All** stacks one section per
+  deployment, each headed by its machine and folder ("This Mac ·
+  ~/Agents/oats", "altair · ~/Agents/tsm"). Then each deployment has a tab of
+  its own, named by its machine ("altair"; "This Mac · oats-v2" when this Mac
+  holds two). A workspace with one deployment shows just that deployment's
+  tab. The tab you chose is remembered per workspace. With two or more
+  deployments, the sidebar's instance list is grouped under one heading per
+  machine; with one, it has no headings.
+- **Not shown live.** A deployment that can't be shown live says why in a few
+  words on its heading ("ssh needs a prompt", "Timed out", "OATS too old to
+  report its workspace"), and **How to fix** under it gives the full sentence
+  and the steps. Causes: ssh needs a prompt or a host key, the read timed out,
+  the host's OATS is too old to report its workspace, its workspace reference
+  needs `oats sync` or fixing in `oats-local.yaml`, or this computer's OATS
+  can't read other machines. A server that can't be reached stays under the
+  workspace it last reported, marked "remembered".
+- **The switcher.** Each workspace names its machines on one line ("This Mac ·
+  altair"), with a mark when one of them isn't live.
+- **Not matched to a workspace.** A deployment that can't be matched is
+  listed on its own under that heading in the switcher, with its machine and
+  a short reason; choosing it opens its tab on the Deployments page. When this
+  computer's OATS is too old to report workspaces, nothing can be matched:
+  each deployment is listed on its own, as before, and its heading says to
+  update OATS.
+- **Actions.** Everything you do to an instance goes to that instance's own
+  deployment. Workspace-wide pages (Setup, Capabilities, Sync, Automations,
+  Schedules, Teams configuration) act on the workspace's first deployment on
+  this Mac, else its first, and say "On <deployment>" when there are two or
+  more.
+- **Spawn.** With two or more deployments, the Spawn dialog asks first which
+  one to spawn in (and says "Runs on" in its summary), starting on the one you last used in that workspace when it
+  offers the soul, else the first that does (this Mac first). With one, it
+  asks nothing.
+
+Saved selections and tabs move to the workspace that holds their
+deployment. Details are in
+[the deployment model](../packages/desktop/docs/desktop-deployment-model.md#workspace-views-and-deployments).
+
 ## Scheduling agents and wake messages
 
 Open **Schedules** in the selected workspace to launch a new agent on a cron,

package/docs/execution-targets.md

@@ -170,6 +170,12 @@ The task's text never travels on a command line, where any local user could
 read it in the process list:
 
 - pi and Claude Code get `@TASK.md`, which each harness reads as the file.
+  pi sends it as the session's first prompt and refuses it if another
+  extension's turn (the @awebai/pi welcome) is running or starts while it is
+  being sent. The pi bridge (`@awebai/oats-pi`) holds it on pi's own path
+  until no turn is active, so it runs exactly once, unaltered; a pi
+  deployment without the bridge can sit idle with no task. The exception is
+  in the bridge's [README](../packages/pi/README.md).
 - Codex gets a fixed pointer to the file and reads it with a tool.
 - A home whose recorded command still hands over `"$(cat TASK.md)"` starts
   with its harness's safe prompt instead, and the command is saved that way.

package/docs/release-notes/v0.35.5.md

@@ -0,0 +1,34 @@
+# OATS 0.35.5
+
+## Fixed
+
+- **Adding a workspace never drops a saved deployment that is missing at
+  that moment** (awebai/oats#472). A saved deployment on a volume that was
+  not mounted yet stayed saved at launch, but adding another workspace then
+  saved only the deployments that validated, and it was gone for good. The
+  same happened when the Desktop was launched on a new deployment. Now the
+  server is still started only with the deployments that are there, while
+  `workspace-open.json` keeps every saved one; the next launch serves it again
+  once it is back. Only an explicit remove drops a saved deployment (the
+  Desktop has no remove action yet).
+
+- **A pi instance launched with a task runs it, once, after the @awebai/pi
+  welcome** (awebai/oats#469). pi's interactive mode sends `@TASK.md` as the
+  session's first prompt with no streamingBehavior (pi 0.85.1
+  `interactive-mode.js:816`), so pi refused it ("Agent is already
+  processing…") when the @awebai/pi welcome turn was running or started
+  while the task was being sent, leaving the instance idle with no task.
+  With the bridge, the opening task now runs exactly once, after any turn
+  another extension starts, exactly as pi's input processing made it: the
+  bridge holds it on pi's own path until no turn is active, and never
+  sends, re-sends or alters a message. One exception remains: an extension
+  loaded behind the bridge that starts a turn (or awaits I/O while one
+  starts) inside its own input or before_agent_start handling of the
+  opening prompt can still make pi refuse the task, as before. The bridge
+  with @awebai/pi has no such handler and is fully covered. Tested against
+  pi 0.85.1; pi before 0.80.4, which has no `agent_settled` event, is
+  covered by a model of its behaviour only. The fix ships in
+  `@awebai/oats-pi` 0.35.5: a pi deployment must update the bridge to get it
+  (`oats update` updates an installed bridge; without one, `pi install
+  npm:@awebai/oats-pi`), then restart its pi sessions. The kernel alone does
+  not fix it. Claude and Codex launches are unchanged.

package/docs/release-notes/v0.36.0.md

@@ -0,0 +1,118 @@
+# OATS 0.36.0
+
+## Added
+
+- **A deployment reports its workspace identity** (feature
+  `workspace-identity`, awebai/oats#482). `oats status --json`'s `workspace`
+  object now also carries `key` (the workspace host's canonical repository
+  key, so every spelling of one repository matches, and the host's key when
+  `oats-local.yaml` names a member whose backlink is known), `ref` (the
+  reference exactly as `oats-local.yaml` writes it, for display), `keyFrom`
+  (`"workspace"`, or `"member"` while a member's host is not known),
+  `standalone`, `defaultTeam` (`{label, team}`),
+  `teams` (`{<label>: <provider team id> | null}`) and `teamsFrom`. They are
+  read offline, so they are there whether the workspace is reachable or not.
+  Shared teams come from the workspace file the run read
+  (`teamsFrom: "observed"`), else this machine's cached copy at the host
+  commit it last observed (`"cache"`, no git process), else nowhere
+  (`"local"`: local teams only). `oats server roster --json` relays each
+  host's `workspace` object verbatim on its group (from a host before
+  0.36.0, the reachability-only object), or `null` from a host that reports
+  none. The rule for matching teams across machines (when a
+  `null` team is unmapped and when it is unknown) is in
+  docs/desktop-cli-api.md, under Workspace identity. A deployment without
+  `oats-local.yaml` still has no `workspace` object, and the human-readable
+  `oats status` is unchanged. After upgrading, run `oats sync` on each remote
+  host (and on any deployment with no instances): the parsed cache belongs to
+  the running kernel, so until the deployment observes its workspace again,
+  a status that does not read the workspace itself reports
+  `teamsFrom: "local"` and its shared default team shows as unknown.
+- **The Desktop shows a workspace's deployments on every machine**
+  (awebai/oats#482). The switcher lists each workspace once: its deployments
+  on this Mac and on registered servers are matched by the workspace each
+  reports (its key and default team, by the kernel's rules in
+  docs/desktop-cli-api.md), and named by machine. The Active overview becomes
+  **Deployments**: **All** shows the overview trees split by deployment ("This
+  Mac · ~/Agents/oats", "altair · ~/Agents/tsm"), then each deployment has its
+  own tab. Every action is still addressed to the row's own deployment. A
+  deployment that isn't shown live says why in a few words, with **How to fix**
+  under it (ssh needs a prompt or a host key, timed out, the host's OATS is too
+  old, its workspace reference needs `oats sync` or fixing), and one that can't
+  be matched is listed in the switcher under "Not matched to a workspace". The
+  Desktop remembers the last workspace each remote reported, so an
+  unreachable server stays under its workspace, marked "remembered". With two
+  or more deployments the sidebar groups instances by machine, and the Spawn
+  dialog asks first which deployment to spawn in; the Teams board shows only
+  the workspace's own deployments, grouped by deployment.
+  Saved selections and tabs move to the workspace that holds their
+  deployment. It needs the CLI's `workspace-identity` feature; without it
+  each deployment keeps its own entry, as before.
+
+## Changed
+
+- **The Desktop's tabs fit the window, and the selected tab stays in view.**
+  Tabs share the tab strip like VS Code's "shrink" mode: each takes at most its
+  natural width (still capped at 280px) and they shrink evenly as more open,
+  down to 168px; below that the strip scrolls. A shrunk tab keeps the end of
+  its name ("oats-…palette"), so tabs whose names share a prefix still read
+  differently. The branch gives way before the name, and the full
+  name stays in the tooltip and the accessible name. Whenever a tab becomes
+  active, a tab closes, or a strip resizes (the window, the sidebar or panel,
+  a split), the active tab is scrolled fully into view, in split groups too.
+  After the tabs, only Split right and Split down remain. Closing a split
+  (⌥⌘W / Ctrl+Shift+Alt+W) and showing or hiding the instance panel
+  (⌥⌘B / Ctrl+Alt+B) are on their chords and in the command palette, and the
+  panel keeps its own collapse control
+  ([desktop-keyboard.md](../../packages/desktop/docs/desktop-keyboard.md#the-command-palette-k)).
+- **The Desktop's command palette lists instances like the sidebar and cycles
+  with ⌘K.** With an empty query it shows every instance in the sidebar's
+  groups, order and indentation, then the commands. A query keeps that tree,
+  showing each match under its dimmed ancestors. While the palette is open,
+  ⌘K moves down and ⇧⌘K up, wrapping. Enter opens the row and Esc closes, so
+  a second ⌘K no longer closes the palette. On Linux/Windows the chord,
+  Ctrl+Shift+P, already holds Shift, so ArrowUp moves up there.
+- **The Desktop's default monospace font is Inconsolata, bundled with the
+  app.** The terminal and the UI's code, paths and shortcut hints use it on
+  every machine, ahead of the system monospace fonts. The terminal's default
+  size is now 15px, and the terminal's text sits closer to the pane's edges
+  (12px each side instead of 32px), centred in the pane. Box drawing (Claude
+  Code's input box, tmux borders) is drawn as a native terminal draws it, with
+  thin lines whatever the font. A terminal font or size you already
+  chose is kept, and resetting the terminal's typography (⌘0 / Ctrl+0, the
+  command palette, or Settings → Terminal) goes back to 15px. Settings (the sidebar's settings
+  button, now titled just "Settings") has a Terminal section with a font size
+  stepper (9–28px, or type a size) that changes every open terminal at once
+  and follows ⌘= / ⌘- / ⌘0. Inconsolata is under the SIL Open Font License 1.1
+  ([fonts/README.md](../../packages/desktop/renderer/fonts/README.md)).
+
+- **The Desktop follows a spawn to its new instance.** After **Spawn** the
+  dialog closes at once and the pending row is revealed in the roster, without
+  taking focus. When the instance is running, the Desktop opens its terminal
+  tab and selects its row: arriving there is the confirmation, so a successful
+  spawn no longer posts a toast. It never pulls the operator away from
+  something they did since the press: typing (a lone modifier does not count),
+  pasting, moving focus, opening another tab or view, or an open dialog or
+  overlay. Then they stay where they are, and the row says **New** until it or
+  its tab is first opened. Either way, assistive technology hears "*name*
+  spawned". Partial, refused, failed and unknown outcomes keep their
+  notifications
+  ([desktop-spawn-preview.md](../../packages/desktop/docs/desktop-spawn-preview.md)).
+
+- **The Desktop's spawn dialog opens on Name and jumps between its sections.**
+  Name is focused whenever the dialog opens for a chosen soul, Quick Open
+  included, with the caret after a restored name. **⌘1–⌘7** (Ctrl+1–7
+  elsewhere) jump to Name, Harness, Model, Relationship, Teams and the Opening
+  instruction; ⌘7 opens or closes Developer settings. Quiet hints show the
+  keys; the shortcuts editor lists them under *Spawn dialog*, where they can
+  be rebound, and the shell's own ⌘1–9 do not fire behind the dialog
+  ([desktop-keyboard.md](../../packages/desktop/docs/desktop-keyboard.md)).
+  In "Works in", a directory instance now reads "own folder · free to work
+  across repos".
+
+- **The Active overview no longer has a Spawn button.** Spawn from the
+  canvas with **S**, from the sidebar's **Spawn instance** (⌘N), from Quick
+  Open or from a soul card.
+
+- **The Desktop accepts OATS CLIs `>=0.25.8 <0.37.0`**, so it runs against
+  this release's kernel. Install the CLI and the Desktop 0.36.0 together: the
+  Desktop 0.35.x refuses a 0.36 CLI.

package/docs/servers.md

@@ -156,7 +156,9 @@ oats okf harvest --server build --instance dev-fix-123   # the harvest, run in t
 
 The **roster** is what the Desktop shows: one group per server id and route
 target (host and workspace), with the registration (present or not), the
-probe result, the remote souls, the instances joined with saved routes
+probe result, the host's workspace identity (`workspace`: its own `status
+--json` `workspace` object relayed verbatim, reachability only from a host
+before 0.36.0, `null` when it reports none or the probe failed), the remote souls, the instances joined with saved routes
 (`savedRoute`, `running` or `null` when unknown, `retirePending`,
 `rollbackIncomplete`, `missingRemotely`, `addressable`), and `retireFailures`
 (deferred self-retirements that failed there). Each instance row also relays

package/lib/servers.mjs

@@ -739,7 +739,7 @@ export function rosterGroups({ server, io = {} } = {}) {
   const groups = new Map();
   const add = (serverId, target, registrationPresent, label) => {
     const key = `${serverId}:${targetKey(target)}`;
-    if (!groups.has(key)) groups.set(key, { id: key, server: serverId, label: label || serverId, registrationPresent, target, probe: null, agentsRoot: undefined, souls: [], instances: [], retireFailures: [], _snapshots: [] });
+    if (!groups.has(key)) groups.set(key, { id: key, server: serverId, label: label || serverId, registrationPresent, target, probe: null, agentsRoot: undefined, workspace: null, souls: [], instances: [], retireFailures: [], _snapshots: [] });
     const g = groups.get(key);
     if (registrationPresent) g.registrationPresent = true;
     return g;
@@ -769,6 +769,9 @@ export function rosterGroups({ server, io = {} } = {}) {
     if (status?.ok) {
       g.probe = { ok: true };
       g.agentsRoot = status.result.root;
+      // The host's own workspace identity (feature workspace-identity), relayed as it answered it: never
+      // derived here, null when the host reports none.
+      g.workspace = status.result.workspace ?? null;
       for (const a of status.result.agents || []) {
         g.souls.push({ name: a.name, harness: a.harness ?? a.runtime, work: a.work, backend: a.backend, description: a.description, agentsRoot: status.result.root });
         // A failed deferred self-retirement needs an operator: it rides with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.35.4",
+  "version": "0.36.0",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",