@awebai/oats 0.35.5 → 0.36.1

package/bin/oats.mjs

@@ -36,7 +36,7 @@ import {
   writeFileAtomic, LOCK_FILE, readLock, readLockIfPresent, writeLock, resolvePackages, memoizedRemote,
   classifyPackageValue, parsePackageRequest } from "../lib/packages.mjs";
 import { loadLocal, validateWorkspace, validateLocal, discoverPackageSouls, workspaceWarnings, memberRowByKey } from "../lib/workspace.mjs";
-import { recordedTeams, reportRows, soulKeyOf, soulTeams, teamModel } from "../lib/teams.mjs";
+import { migrationProblems, recordedTeams, reportRows, soulKeyOf, soulTeams, teamModel } from "../lib/teams.mjs";
 import { launchLayers } from "../lib/launch-preference.mjs";
 import { parseConfigData } from "../lib/config-data.mjs";
 import * as remoteModule from "../lib/remote.mjs";
@@ -221,6 +221,19 @@ async function doctorComposition(ctx, soulName, ws, bail) {
   } finally { for (const c of cleanups) { try { c(); } catch { /* best effort: temporary copies only */ } } }
 }
 
+/** team-model-3-migration in doctor (0.36.x), OFFLINE like the rest of doctor: oats-local.yaml, and for its
+ *  local teams the workspace file this machine's parsed cache holds (cachedWorkspace: no git process, no
+ *  network). Without that file, whether local teams need `localTeams: true` is said to be unchecked
+ *  (information), never guessed. The standalone view has no workspace rules. → { problems, information } */
+function doctorTeamMigration(local) {
+  const standalone = typeof local.standalone === "string" && local.standalone !== "";
+  const file = standalone ? null : cachedWorkspace(local.workspace)?.file ?? null;
+  const model = teamModel(file, local);
+  const unchecked = !standalone && file === null && model.migration.teamKeys.length > 0;
+  return { problems: migrationProblems(model),
+    information: unchecked ? ["team-model-3-migration: whether oats-local.yaml teams/defaultTeam need localTeams: true couldn't be checked: this deployment hasn't observed its workspace yet; run oats sync"] : [] };
+}
+
 /** Workspace-model v2 doctor data, OFFLINE: the deployment declaration found
  * walking up from ctx (oats-local.yaml) and the lock v3 beside it. Doctor never
  * goes to the network for this view (only `--soul`, which resolves the soul like a
@@ -230,7 +243,7 @@ function doctorLockData(ctx) {
   let lockDir = ctx;
   try {
     const found = loadLocal(ctx);
-    out.local = { path: found.path, workspace: found.local.workspace };
+    out.local = { path: found.path, workspace: found.local.workspace, value: found.local };
     lockDir = dirname(found.path);
   } catch (e) {
     // An unreadable oats-local.yaml, or a 0.25 oats-config.yaml inside the deployment
@@ -584,12 +597,13 @@ function legacyLayoutProblems(root) {
 async function doctorWorkspaceJson(ctx, soulName, ws) {
   const composition = await doctorComposition(ctx, soulName, ws, (code, msg, details) => jsonFail(code, msg, details));
   const agentsRoot = join(dirname(ws.local.path), "agents");
-  const problems = [...legacyLayoutProblems(agentsRoot), readableInstanceHomes(agentsRoot)].filter(Boolean);
+  const migration = doctorTeamMigration(ws.local.value);
+  const problems = [...legacyLayoutProblems(agentsRoot), readableInstanceHomes(agentsRoot), ...migration.problems].filter(Boolean);
   return {
     schemaVersion: 1, workspaceApi: 2, context: ctx,
     workspace: { file: ws.local.path, ref: ws.local.workspace },
     workspaceError: ws.localError, lockFile: ws.lockFile, packages: ws.packages, lockError: ws.lockError,
-    information: operationalKnowledgeNote(composition, soulName) ? [operationalKnowledgeNote(composition, soulName)] : [],
+    information: [...(operationalKnowledgeNote(composition, soulName) ? [operationalKnowledgeNote(composition, soulName)] : []), ...migration.information],
     composedInstructions: composition?.text, instructionBlocks: composition?.blocks,
     ...(problems.length ? { problems } : {}),
   };
@@ -624,7 +638,10 @@ async function doctor(dir) {
   const composition = await doctorComposition(ctx, soulName, ws, (code, msg) => die(`${msg} [${code}]`));
   printDoctorWorkspace(ws);
   const agentsRoot = join(dirname(ws.local.path), "agents");
+  const migration = doctorTeamMigration(ws.local.value);
   for (const p of [...legacyLayoutProblems(agentsRoot), readableInstanceHomes(agentsRoot)].filter(Boolean)) console.log(`\n! ${p.code}: ${p.message}`);
+  for (const p of migration.problems) console.log(`\n! ${p.code}: ${p.message} — ${p.fix}`);
+  for (const line of migration.information) console.log(`\nINFO: ${line}`);
   if (soulName) {
     const information = operationalKnowledgeNote(composition, soulName);
     if (information) console.log(`\nINFO: ${information}`);
@@ -1850,7 +1867,7 @@ async function statusDrift(data) {
     catch { /* not a workspace soul (classic, or an unreadable stamp) */ }
   }
   const anything = data.some((a) => (a.instances || []).some((i) => hasModules(i) || hasSoul(i)));
-  if (!anything) return { drift: new Map(), soul: new Map(), souls, unreachable: null };
+  if (!anything) return { drift: new Map(), soul: new Map(), souls, unreachable: null, local: ctx.local, discovery: null };
   const deploymentDir = dirname(ctx.path);
   let lock = null;
   try { lock = readLockIfPresent(deploymentDir); } catch { lock = null; }
@@ -1860,7 +1877,7 @@ async function statusDrift(data) {
   try { const { discoverOrStandalone } = await import("../lib/instance-resolution.mjs"); discovery = await discoverOrStandalone(ctx.local, { lock, remoteOptions: remoteOptionsFromEnv() }); }
   catch (e) {
     const reason = e?.details?.reason ? `${e.code}: ${e.details.reason}` : (e?.code || e?.message || "unknown");
-    return { drift: new Map(), soul: new Map(), souls, unreachable: { code: e?.code ?? null, reason, message: e?.message ?? String(e) } };
+    return { drift: new Map(), soul: new Map(), souls, unreachable: { code: e?.code ?? null, reason, message: e?.message ?? String(e) }, local: ctx.local, discovery: null };
   }
   const { driftOf, soulDriftOf } = await import("../lib/materialize.mjs");
   const drift = new Map();
@@ -1879,7 +1896,67 @@ async function statusDrift(data) {
     const member = memberRowByKey(discovery.members, stamp.repoKey);
     if (member && typeof member.commit === "string" && (member.confirmed || (discovery.standalone === true && member.key === discovery.key))) stamp.current = member.commit;
   }
-  return { drift, soul, souls, unreachable: null };
+  return { drift, soul, souls, unreachable: null, local: ctx.local, discovery };
+}
+/** The deployment's workspace identity in `oats status --json` (feature workspace-identity), read
+ *  OFFLINE. `key` is the workspace HOST's canonical repo key (parseRepoRef(...).key) and `ref` the
+ *  reference as oats-local.yaml writes it. The host is the one this run observed, else the one this
+ *  machine's parsed cache knows: `ref` itself when the cache holds its workspace file, or the host its
+ *  cached oats-membership.yaml names when `ref` is a member ("workspace"). A member whose host is not
+ *  known keys as itself ("member"); a ref nothing is known of is taken as the host, as the schema
+ *  defines `workspace:` ("workspace"). The team model resolves as teamModel resolves it (the default
+ *  label is local; a committed team wins a collision) over the shared teams of, in order, the workspace
+ *  file this run observed (`teamsFrom: "observed"`), the cached file ("cache": no git process), or none
+ *  ("local"). `standalone` is the CONFIGURED standalone view only (oats-local.yaml `standalone:`): it
+ *  reads no workspace file, so its local teams are the whole team model. A run that fell back to the
+ *  standalone view (the host unreadable) is not: its team model is the workspace's, and its
+ *  discovery is the member's, never the host's key. */
+function workspaceIdentity(local, discovery) {
+  const ref = local.workspace;
+  const standalone = typeof local.standalone === "string" && local.standalone !== "";
+  const observed = discovery && discovery.standalone !== true && discovery.workspace ? discovery : null;
+  const cached = observed ? null : cachedWorkspace(ref);
+  const keyOf = (r) => { try { return remoteModule.parseRepoRef(r).key; } catch { return null; } };
+  let key, keyFrom;
+  if (observed) [key, keyFrom] = [observed.key, "workspace"];
+  else if (cached && cached.host === null) [key, keyFrom] = [keyOf(ref), "member"];
+  else [key, keyFrom] = [keyOf(cached?.host ?? ref), "workspace"];
+  if (key === null) keyFrom = null; // a reference parseRepoRef refuses: unusable, never matched
+  let shared = null, teamsFrom = "local";
+  if (!standalone) {
+    if (observed) [shared, teamsFrom] = [observed.workspace, "observed"];
+    else if (cached?.file) [shared, teamsFrom] = [cached.file, "cache"];
+  }
+  const model = teamModel(shared, local);
+  const labels = [...model.labels.keys()].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  return {
+    key, ref, keyFrom, standalone,
+    defaultTeam: model.defaultTeam === null ? null : { label: model.defaultTeam, team: model.labels.get(model.defaultTeam)?.team ?? null },
+    teams: Object.fromEntries(labels.map((l) => [l, model.labels.get(l).team])),
+    teamsFrom,
+  };
+}
+/** What this machine's parsed cache knows of the workspace `ref` names (the values observeWorkspace and
+ *  confirmMembership stored, each at its repo's last observed commit): { host, file } — `host` the ref
+ *  of the workspace host, `file` its workspace file or null — when `ref` is the host (its workspace file
+ *  is cached) or a member whose cached oats-membership.yaml names it (discoverOrStandalone follows the
+ *  same backlink). A member's backlink is cached whether its own workspace slot was observed (missing)
+ *  or never was (the host's discovery confirmed it). { host: null, file: null } for a ref cached as
+ *  having no workspace file and no backlink; null when nothing is known. */
+function cachedWorkspace(ref) {
+  const options = remoteOptionsFromEnv();
+  const cached = (r, item) => {
+    const commit = remoteModule.lastObservedCommit(r, options);
+    const value = commit ? remoteModule.peekAtCommit(r, commit, item, options) : undefined;
+    return value && typeof value === "object" ? value : null;
+  };
+  const fileOf = (read) => (read && !read.missing && !read.problems && read.value && typeof read.value === "object" ? read.value : null);
+  const read = cached(ref, "workspace");
+  if (read && !read.missing) return { host: ref, file: fileOf(read) };
+  const membership = cached(ref, "membership");
+  const host = membership?.kind === "ok" && typeof membership.value?.workspace === "string" ? membership.value.workspace : null;
+  if (host !== null) return { host, file: fileOf(cached(host, "workspace")) };
+  return read ? { host: null, file: null } : null;
 }
 /** One `modules:` line per module. */
 function driftLine(row) {
@@ -1948,7 +2025,7 @@ async function status() {
       }
     }
     const observation = maxAgeGiven === null ? {} : { observation: observationBlock() };
-    console.log(JSON.stringify({ root, agents: data, ...observation, ...(ws ? { workspace: ws.unreachable ? { reachable: false, ...ws.unreachable } : { reachable: true } } : {}), ...(problems.length ? { problems } : {}), ...envelopeWarnings() }, null, 2)); return;
+    console.log(JSON.stringify({ root, agents: data, ...observation, ...(ws ? { workspace: { ...(ws.unreachable ? { reachable: false, ...ws.unreachable } : { reachable: true }), ...workspaceIdentity(ws.local, ws.discovery) } } : {}), ...(problems.length ? { problems } : {}), ...envelopeWarnings() }, null, 2)); return;
   }
   console.log(`oats status — agents root ${shortPath(root)}\n`);
   if (ws?.unreachable) console.log(`  workspace: unreachable (${ws.unreachable.reason}) — drift unknown\n`);
@@ -3059,7 +3136,7 @@ function versionCmd() {
     // Phase B: `instance-modules` and `spawn-provider-payload` are advertised only once spawn
     // runs on resolve/materialize (contract §6); a feature the binary does not implement is
     // never listed.
-    console.log(JSON.stringify({ schemaVersion: 1, name: "@awebai/oats", version: OATS_VERSION, desktopApi: 1, harnesses: ["pi", "claude", "codex"], sessionBackends: ["tmux"], launchOptions: ["yolo"], remote: ["spawn", "retire", "status", "session", "session-start", "session-restart", "launch-config", "roster", "harvest", "schedule", "session-upload", "operations", "readiness", "instance-events", "instance-git", "lifecycle-plans"], features: ["retire-home", "session-start", "session-restart", "launch-config", "schedule", "session-upload", "operations", "instance-git", "instance-git-remote", "souls-declarations", "lifecycle-plans", "retire-retention", "readiness", "spawn-preview", "instance-events", "instance-events-2", "schedule-history", "schedule-read-2", "spawn-preview-2", "spawn-idempotency", "spawn-idempotency-2", "spawn-apply-2", "workspace-v2", "instance-modules", "spawn-provider-payload", "served-identity", "packages-no-approval", "spawn-name", "settings-origins", "team-model-2", "settings-declared", "capabilities-private", "layers-from", "harness", "package-souls", "triggers", "automations", "desktop-facts", "launch-preference", "preview-composed-from", "observe-max-age", "spawn-preview-max-age", "launch-config-default", "capability-show", "capture-file"], automationsApi: A.AUTOMATIONS_API, workspaceApi: 2, instanceGitApi: 1, spawnApplyApi: 1, soulsApi: 2, lifecycleApi: 1, readinessApi: 2, spawnPreviewApi: 2, eventsApi: 2, scheduleHistoryApi: 3, scheduleApi: SCHEDULE_API, operationsApi: 2, capabilityShowApi: 1 }));
+    console.log(JSON.stringify({ schemaVersion: 1, name: "@awebai/oats", version: OATS_VERSION, desktopApi: 1, harnesses: ["pi", "claude", "codex"], sessionBackends: ["tmux"], launchOptions: ["yolo"], remote: ["spawn", "retire", "status", "session", "session-start", "session-restart", "launch-config", "roster", "harvest", "schedule", "session-upload", "operations", "readiness", "instance-events", "instance-git", "lifecycle-plans"], features: ["retire-home", "session-start", "session-restart", "launch-config", "schedule", "session-upload", "operations", "instance-git", "instance-git-remote", "souls-declarations", "lifecycle-plans", "retire-retention", "readiness", "spawn-preview", "instance-events", "instance-events-2", "schedule-history", "schedule-read-2", "spawn-preview-2", "spawn-idempotency", "spawn-idempotency-2", "spawn-apply-2", "workspace-v2", "instance-modules", "spawn-provider-payload", "served-identity", "packages-no-approval", "spawn-name", "settings-origins", "team-model-2", "settings-declared", "capabilities-private", "layers-from", "harness", "package-souls", "triggers", "automations", "desktop-facts", "launch-preference", "preview-composed-from", "observe-max-age", "spawn-preview-max-age", "launch-config-default", "capability-show", "capture-file", "workspace-identity"], automationsApi: A.AUTOMATIONS_API, workspaceApi: 2, instanceGitApi: 1, spawnApplyApi: 1, soulsApi: 2, lifecycleApi: 1, readinessApi: 2, spawnPreviewApi: 2, eventsApi: 2, scheduleHistoryApi: 3, scheduleApi: SCHEDULE_API, operationsApi: 2, capabilityShowApi: 1 }));
     return;
   }
   console.log(`@awebai/oats ${OATS_VERSION} (desktop API v1)`);

package/docs/configuration.md

@@ -81,6 +81,12 @@ refused (`E_WORKSPACE_SCHEMA`).
 How teams are resolved, and what a messaging provider does with them, is in
 [workspaces.md](workspaces.md#teams).
 
+OATS 0.37.0 (team model 3) removes `souls.teams` and `souls.default` (they move
+to `souls:` in `oats-workspace.yaml`) and allows `teams` and `defaultTeam` here
+only when the workspace file says `localTeams: true`. 0.36.x still applies all
+four keys and warns about them (`team-model-3-migration`): see
+[Preparing for team model 3](workspaces.md#preparing-for-team-model-3-036x).
+
 ## Launch configurations
 
 An entry has `harness` (`pi` \| `claude` \| `codex`, required), `executable`

package/docs/desktop-cli-api.md

@@ -38,7 +38,7 @@ canonical (`github.com/<org>/<repo>`, or `local/<abs-path>`). Examples use
              "instance-events-2","schedule-history","schedule-read-2","spawn-preview-2","spawn-idempotency","spawn-idempotency-2","spawn-apply-2",
              "workspace-v2","instance-modules","spawn-provider-payload","served-identity","packages-no-approval","spawn-name","settings-origins",
              "team-model-2","settings-declared","capabilities-private","layers-from","harness","package-souls","triggers","automations","desktop-facts","launch-preference",
-             "preview-composed-from","observe-max-age","spawn-preview-max-age","capability-show","capture-file"],
+             "preview-composed-from","observe-max-age","spawn-preview-max-age","capability-show","capture-file","workspace-identity"],
  "automationsApi":1,"workspaceApi":2,"instanceGitApi":1,"spawnApplyApi":1,"soulsApi":2,"lifecycleApi":1,
  "readinessApi":2,"spawnPreviewApi":2,"eventsApi":2,"scheduleHistoryApi":3,"scheduleApi":2,"operationsApi":2,
  "capabilityShowApi":1}
@@ -100,6 +100,7 @@ canonical (`github.com/<org>/<repo>`, or `local/<abs-path>`). Examples use
 | `spawn-preview-max-age` | `--max-age <s>` on `spawn --preview` and its `observation` block ([Observation reuse](#observation-reuse-feature-observe-max-age-oats-0311), [The preview](#the-preview)) | |
 | `capability-show` | `oats capabilities show <name>` and its `--file` form, OATS 0.34.0 ([`oats capabilities show`](#oats-capabilities-show)) | `capabilityShowApi: 1` |
 | `capture-file` | `oats capture --file <path> --format cc\|pi\|codex --home <instance home> [--json]`: one session file captured as `--home` capture would, with a receipt bound to its bytes, OATS 0.35.0 (the capture USAGE and packages/record/README.md) | |
+| `workspace-identity` | the deployment's workspace identity on `oats status --json` `workspace` (`key`, `ref`, `keyFrom`, `standalone`, `defaultTeam`, `teams`, `teamsFrom`) and each `oats server roster --json` group's relayed `workspace`, OATS 0.36.0 ([Workspace identity](#workspace-identity-feature-workspace-identity-oats-0360)) | |
 
 Payload-only integers, never in the probe: `onboardApi: 2`, `syncApi: 1`,
 `workspaceStatusApi: 1`, `capabilitiesApi: 1`, the `oats souls` document's
@@ -344,7 +345,7 @@ An instance subject, abridged:
 | Key | Meaning |
 |---|---|
 | `subject` | `{kind: "instance", instance, home, soul}` or `{kind: "soul", soul, repoKey, commit}` |
-| `workspace` | `{key, name, deployment, commit, standalone}`; for a home, `name` is the recorded name (`null` if the spawn predates it) |
+| `workspace` | `{key, name, deployment, commit, standalone}`; for a home, `name` is the recorded name (`null` if the spawn predates it). `standalone` is the view the subject resolves in (a fallback for an unreadable host included), unlike `oats status`'s configured-only [`standalone`](#workspace-identity-feature-workspace-identity-oats-0360) |
 | `souls` | exactly the subject's soul |
 | `layers` | `{knowledge, messaging, tasks}`, each `{id, from}` |
 | `capabilities`, `capabilitiesOff` | the resolved modules (by id) and the ones the soul turned off |
@@ -724,7 +725,7 @@ Read-only (it writes no lock):
              "souls":["rm"],"capabilities":["nw-house-style"],"publishes":null,"url":"https://github.com/nw/agents/tree/66566512…",
              "membershipFile":{"path":"oats-membership.yaml","url":"https://github.com/nw/agents/blob/66566512…/oats-membership.yaml"}}],
  "packages":[{"id":"oats.okf","version":"3.0.0","source":"catalog:oats.okf","commit":"ab897841…","integrity":"sha256-bada35…",
-              "capabilities":["oats.okf"],"souls":[],"latest":{"version":"4.1.0","ref":"v4.1.0"}}],
+              "capabilities":["oats.okf"],"souls":[],"latest":{"version":"4.1.1","ref":"v4.1.1"}}],
  "declaredPackages":["oats.framework","oats.okf"],"unsynced":["oats.framework"],"stale":[],
  "external":[{"source":"git:github.com/oss/experts@3c606e09…","soul":"security-reviewer"}],
  "problems":[],"warnings":[],
@@ -783,8 +784,8 @@ packages' capabilities and souls, sorted by name, then origin. Both carry
     "defaultTeam":{"label":"mine","team":"mine:ana.aweb.ai","from":"deployment"},
     "private":false,"path":"souls/writer","work":"directory","description":"Drafts campaigns.","harness":"pi","model":null,"harnessFrom":"kernel-default",
     "file":{"path":"souls/writer/soul.yaml","url":null},"spawnable":true,"problem":null},
-   {"name":"knowledge-maintainer","qualifiedName":"oats.okf/knowledge-maintainer","origin":"package oats.okf v4.1.0","kind":"package","package":"oats.okf",
-    "version":"4.1.0","repoKey":"github.com/awebai/oats-okf","commit":"e331a996…","teams":null,"defaultTeam":null,"private":false,
+   {"name":"knowledge-maintainer","qualifiedName":"oats.okf/knowledge-maintainer","origin":"package oats.okf v4.1.1","kind":"package","package":"oats.okf",
+    "version":"4.1.1","repoKey":"github.com/awebai/oats-okf","commit":"e1d604f7…","teams":null,"defaultTeam":null,"private":false,
     "path":"oats-package/souls/knowledge-maintainer","work":"directory","description":"Reviews harvested knowledge.","harness":"pi","model":null,
     "harnessFrom":"kernel-default","file":{"path":"oats-package/souls/knowledge-maintainer/soul.yaml","url":null},
     "spawnable":false,"problem":{"code":"E_TEAM_UNKNOWN","message":"team \"reviewers\" is not declared (oats-local.yaml#/souls/teams/…)"}}],
@@ -873,8 +874,8 @@ nothing reads a working clone.
 **The show:**
 
 ```json
-{"capabilityShowApi":1,"name":"oats.okf","kind":"package","repoKey":"github.com/awebai/oats-okf","package":"oats.okf","version":"4.1.0",
- "commit":"e331a996…","path":"oats-package/capabilities/oats-okf",
+{"capabilityShowApi":1,"name":"oats.okf","kind":"package","repoKey":"github.com/awebai/oats-okf","package":"oats.okf","version":"4.1.1",
+ "commit":"e1d604f7…","path":"oats-package/capabilities/oats-okf",
  "inject":{"path":"injects/okf.md","bytes":2422,"text":"## Knowledge: OKF\n\nYou have two kinds of knowledge. …","binary":false,"truncated":false},
  "skills":[{"name":"okf-consultation","path":"skills/okf-consultation","description":"Consulting your soul's knowledge with the `oats okf` CLI: …",
             "files":[{"path":"skills/okf-consultation/SKILL.md","bytes":6947},{"path":"skills/okf-consultation/references/consult.md","bytes":4465}],
@@ -900,7 +901,7 @@ nothing reads a working clone.
 **The `--file` answer:**
 
 ```json
-{"capabilityShowApi":1,"name":"oats.okf","kind":"package","commit":"e331a996…",
+{"capabilityShowApi":1,"name":"oats.okf","kind":"package","commit":"e1d604f7…",
  "file":{"path":"skills/okf-instance-knowledge/SKILL.md","bytes":4787,"text":"---\nname: okf-instance-knowledge\n…","binary":false,"truncated":false}}
 ```
 
@@ -1228,9 +1229,38 @@ for a failure and `false` for a warning, plus the problem's own keys.
 | `default-team-changed` | warning | `recorded`, `current` | `--home` with live teams: the default changed since the spawn |
 | `E_TEAM_UNKNOWN` | failure | `label`, `at` | a reference to an undeclared label |
 | `E_TEAM_NOT_ELIGIBLE` | failure | `soul`, `label`, `at` | `souls.default` outside the soul's teams |
+| `team-model-3-migration` | warning | `condition`, `keys` | 0.36.x: what OATS 0.37.0 (team model 3) refuses, one item per condition (below) |
 
-The last two are also spawn, preview and inspect refusals, with the same
-details.
+The `E_TEAM_UNKNOWN` and `E_TEAM_NOT_ELIGIBLE` codes are also spawn, preview and
+inspect refusals, with the same details.
+
+`team-model-3-migration` is a deployment fact, so every soul's readiness
+carries it, and `oats teams` lists it once. Its `condition`:
+
+- `local-soul-teams`: `oats-local.yaml` has `souls.teams` and/or
+  `souls.default` (`keys`: `["souls.teams", "souls.default"]` as found). They
+  move to `souls:` in `oats-workspace.yaml`.
+- `local-teams-closed`: `oats-local.yaml` declares `teams` and/or
+  `defaultTeam` (`keys`: `["teams", "defaultTeam"]` as found) and the
+  workspace file does not say `localTeams: true`. The `fix` names both
+  remedies: add `localTeams: true` to the workspace file, or commit the teams
+  and `defaultTeam` there and remove them locally. Never raised in the
+  standalone view, which has no workspace rules.
+
+```json
+{"code":"team-model-3-migration","severity":"warning","condition":"local-teams-closed","keys":["teams","defaultTeam"],
+ "message":"oats-local.yaml declares teams, defaultTeam, but oats-workspace.yaml does not say localTeams: true: OATS 0.37.0 refuses local teams and a local defaultTeam unless the workspace allows them",
+ "fix":"either (a) add `localTeams: true` to oats-workspace.yaml, or (b) commit the teams and defaultTeam in oats-workspace.yaml, then remove them from oats-local.yaml"}
+```
+
+As a readiness item it is `{subject: "teams", status: "fail", required: false,
+producer: "team model", code, reason: <message>, remedy: <fix>, condition,
+keys}`. `oats doctor --json` lists the same problems under `problems[]`. Doctor
+stays offline: for `local-teams-closed` it reads only the workspace file this
+machine's parsed cache holds; when there is none, it adds no problem and says
+so in `information[]`: `"team-model-3-migration: whether oats-local.yaml
+teams/defaultTeam need localTeams: true couldn't be checked: this deployment
+hasn't observed its workspace yet; run oats sync"`.
 
 <a id="soul-launch-preferences-feature-launch-preference-oats-0300"></a>
 ## Launch preferences
@@ -1679,7 +1709,8 @@ Not an envelope: `{root, agents, observation?, workspace?, problems?, warnings?}
                           "modules":[{"name":"oats.okf","from":{"kind":"package","package":"oats.okf","version":"2.1.3","commit":"ab897841…","integrity":"sha256-bada35…","repoKey":"github.com/awebai/oats-okf"},
                                       "commit":"ab897841…","current":{"commit":"ab897841…","version":"2.1.3"},"status":"current"}],
                           "soul":{"repoKey":"github.com/nw/agents","commit":"66566512…","current":"66566512…","status":"current"}}]}],
- "workspace":{"reachable":true}}
+ "workspace":{"reachable":true,"key":"github.com/nw/agents","ref":"git:github.com/nw/agents","keyFrom":"workspace","standalone":false,"defaultTeam":{"label":"eng","team":"eng:nw.aweb.ai"},
+              "teams":{"eng":"eng:nw.aweb.ai","mine":"mine:ana.aweb.ai","ops":null},"teamsFrom":"observed"}}
 ```
 
 - **Agent rows**: the soul's recorded definition plus `dir` and `instances`,
@@ -1712,11 +1743,68 @@ Not an envelope: `{root, agents, observation?, workspace?, problems?, warnings?}
   reason?}`; a package soul adds `package`, `version`, `currentVersion`
   (`missing` reasons: `package-absent`, `soul-absent`).
 - **`workspace`**: `{reachable: true}`, or `{reachable: false, code, reason,
-  message}` (modules then stay the recorded map). Absent without
-  `oats-local.yaml`.
+  message}` (modules then stay the recorded map), plus the deployment's
+  [workspace identity](#workspace-identity-feature-workspace-identity-oats-0360)
+  either way. Absent without `oats-local.yaml`.
 - `problems`: the legacy-home rows ([dispatch errors](#dispatch-errors)).
   `warnings`: envelope warnings. `--team` is `E_BAD_ARGS` (an envelope).
 
+<a id="workspace-identity-feature-workspace-identity-oats-0360"></a>
+**Workspace identity** (feature `workspace-identity`, OATS 0.36.0). The
+`workspace` object says which workspace and teams this deployment is, read
+offline with no network, so it is there whether `reachable` is `true` or
+`false`:
+
+| Key | Meaning |
+|---|---|
+| `key` | the canonical repo key of the workspace HOST (`parseRepoRef(…).key`: every spelling of one repository gives one key, e.g. `git:github.com/nw/agents`, `https://github.com/nw/agents.git` and `git@github.com:nw/agents.git` all give `github.com/nw/agents`). When `oats-local.yaml` names a member in place of its host, it is the host's key once the member's backlink is known. `null` when `parseRepoRef` refuses the reference |
+| `ref` | the reference exactly as `oats-local.yaml` writes it (`workspace:`), for display only |
+| `keyFrom` | `"workspace"`: `key` is the host's, because this run observed it, or the cache holds the ref's workspace file, or a member's cached backlink names the host. With nothing observed or cached, the ref is taken as the host, as the schema defines `workspace:`. `"member"`: the ref names a member whose host is not known yet, so `key` is the member's own. `null` with a `null` key |
+| `standalone` | `true` only when `oats-local.yaml` sets `standalone:` (the configured standalone view, whose local teams are its whole team model). A run that fell back to the standalone view because the host is unreadable is `false`: its teams are the workspace's, read through the sources below. Unlike `workspace.standalone` on [inspect](#oats-inspect), which is the view a home runs in |
+| `defaultTeam` | `{label, team}`: the label is `oats-local.yaml`'s `defaultTeam`, `team` its provider id from `teams` (`null` when that map gives none). `null` when `oats-local.yaml` names no default team |
+| `teams` | `{<label>: <provider team id> \| null}`: every team label the deployment maps, local and shared, by label; a label in both is the committed (shared) one, as [`oats teams`](#oats-teams) resolves it |
+| `teamsFrom` | where the shared teams came from: `"observed"`, the workspace file this run read; `"cache"`, this machine's cached copy at the host commit it last observed (no git process, no network; when `key` names a member, the host its cached `oats-membership.yaml` names); `"local"`, none: `teams` holds the local teams only |
+
+A configured standalone deployment reads no workspace file, so it is always
+`teamsFrom: "local"`, with its local teams only (as spawn resolves them there).
+`oats status` only reads the workspace when an instance records modules or a
+workspace soul, so an empty deployment answers from the cache, or from local
+teams on a host that has not observed its workspace (`oats sync` and
+`oats teams` observe it). The cache is the running kernel's own: after an
+OATS upgrade it is empty until the host next observes its workspace.
+
+**Matching workspaces across machines.** Two deployments are the same
+workspace when their `key`s are equal; `ref` is never compared. The identity
+is resolved the same offline way for every deployment, standalone included,
+whatever its team view:
+
+- `keyFrom: "member"` is unresolved: never match it, and show it as
+  unresolved (the host is learned when the deployment observes its
+  workspace, e.g. `oats sync`).
+- `keyFrom: "workspace"` with nothing observed (`teamsFrom: "local"` on a
+  deployment that is not standalone) means the ref was taken as the host, as
+  the schema defines. If it is really a member, the worst case is a split
+  (one workspace shown as two until `oats sync` there), never a wrong merge.
+- A `null` key is an unusable reference and never matches. Show `ref` with
+  "this deployment's workspace reference isn't valid; fix oats-local.yaml".
+- Known limit: `parseRepoRef` lowercases the host but keeps the path's case,
+  so references that differ in owner or repository case give different keys.
+
+**Matching teams across machines.** This is the rule for comparing two
+deployments' teams (as the Desktop does to attach a remote machine to a
+workspace):
+
+- `teamsFrom` `"observed"` or `"cache"`: a `null` team is **unmapped**, and
+  unmapped matches only unmapped.
+- `standalone: true` with `teamsFrom: "local"`: the local config IS the
+  complete team model, so a `null` team is **unmapped** (matches only
+  unmapped). Reason to show: "teams are local only on this host
+  (standalone)", with no sync advice.
+- `standalone: false` with `teamsFrom: "local"`: a `null` default team is
+  **unknown** and never matches. Reason to show: "this host hasn't observed
+  its workspace yet; run oats sync there". A non-null default team (a locally
+  mapped team) matches normally.
+
 **Desktop facts** (feature `desktop-facts`): `startedAt` is the last start or
 restart, else `createdAt` for a launched home, else `null`. `modelFrom` is
 `"soul"`, `"spawn"` or `"start"` (an explicit `--model`), `"launch-config"`,
@@ -1738,6 +1826,8 @@ route target:
 {"id":"build:3f2a…","server":"build","label":"Build box","registrationPresent":true,
  "target":{"sshHost":"build-host","workspace":"/srv/team","oatsPath":"oats"},
  "probe":{"ok":true},"agentsRoot":"/srv/team/agents",
+ "workspace":{"reachable":true,"key":"github.com/acme/team","ref":"git:github.com/acme/team","keyFrom":"workspace","standalone":false,"defaultTeam":{"label":"default","team":"acme:team"},
+              "teams":{"default":"acme:team"},"teamsFrom":"observed"},
  "souls":[{"name":"dev","harness":"claude","work":"worktree","agentsRoot":"/srv/team/agents"}],
  "instances":[{"server":"build","instance":"dev-a","agent":"dev","home":"/srv/team/agents/dev/instances/dev-a",
                "agentsRoot":"/srv/team/agents","harness":"claude","backend":"tmux","tmux":{"session":"oats-agents","window":"dev-a"},
@@ -1749,6 +1839,15 @@ route target:
  "retireFailures":[]}
 ```
 
+- **`workspace`** (feature `workspace-identity`, OATS 0.36.0): the host's
+  own `status --json` [`workspace` object](#workspace-identity-feature-workspace-identity-oats-0360),
+  relayed verbatim, or `null` when the host reports none (a deployment
+  without `oats-local.yaml`, or a failed or skipped probe). A host before
+  0.36.0 answers the reachability-only object (`{reachable, code?, reason?,
+  message?}`) with no identity fields, so the identity is there only when
+  the object has a `key` field (which a 0.36.0 host always sends, `null` for
+  an unusable reference). It is never derived on this side. It is on the group, not the
+  rows, so an empty remote deployment still reports it.
 - **Instance rows** relay the host's own `status --json` row: `identity`,
   `identityAddress`, `teams`, `startedAt`, `createdAt`, `model`,
   `runtimeState`, `parentInstance`, `siblingInstance`, `relation`,

package/docs/desktop.md

@@ -104,6 +104,53 @@ opened, or your home directory when there is none (never ~/Downloads);
 
 Launch flags for scripted use: `--dir <workspace>` and `OATS_DESKTOP_PORT`.
 
+## One workspace, several machines
+
+The switcher lists each workspace once, however many deployments it has: the
+deployments you opened on this Mac and those your registered servers report,
+matched by the workspace each one reports (its repository key and default
+team, by the kernel's rules). It needs a CLI with the `workspace-identity`
+feature (OATS 0.36.0); without it each deployment has its own entry.
+
+- **Deployments.** The **Deployments** page (formerly the Active overview)
+  shows the workspace's overview trees. **All** stacks one section per
+  deployment, each headed by its machine and folder ("This Mac ·
+  ~/Agents/oats", "altair · ~/Agents/tsm"). Then each deployment has a tab of
+  its own, named by its machine ("altair"; "This Mac · oats-v2" when this Mac
+  holds two). A workspace with one deployment shows just that deployment's
+  tab. The tab you chose is remembered per workspace. With two or more
+  deployments, the sidebar's instance list is grouped under one heading per
+  machine; with one, it has no headings.
+- **Not shown live.** A deployment that can't be shown live says why in a few
+  words on its heading ("ssh needs a prompt", "Timed out", "OATS too old to
+  report its workspace"), and **How to fix** under it gives the full sentence
+  and the steps. Causes: ssh needs a prompt or a host key, the read timed out,
+  the host's OATS is too old to report its workspace, its workspace reference
+  needs `oats sync` or fixing in `oats-local.yaml`, or this computer's OATS
+  can't read other machines. A server that can't be reached stays under the
+  workspace it last reported, marked "remembered".
+- **The switcher.** Each workspace names its machines on one line ("This Mac ·
+  altair"), with a mark when one of them isn't live.
+- **Not matched to a workspace.** A deployment that can't be matched is
+  listed on its own under that heading in the switcher, with its machine and
+  a short reason; choosing it opens its tab on the Deployments page. When this
+  computer's OATS is too old to report workspaces, nothing can be matched:
+  each deployment is listed on its own, as before, and its heading says to
+  update OATS.
+- **Actions.** Everything you do to an instance goes to that instance's own
+  deployment. Workspace-wide pages (Setup, Capabilities, Sync, Automations,
+  Schedules, Teams configuration) act on the workspace's first deployment on
+  this Mac, else its first, and say "On <deployment>" when there are two or
+  more.
+- **Spawn.** With two or more deployments, the Spawn dialog asks first which
+  one to spawn in (and says "Runs on" in its summary), starting on the one you last used in that workspace when it
+  offers the soul, else the first that does (this Mac first). With one, it
+  asks nothing.
+
+Saved selections and tabs move to the workspace that holds their
+deployment. Details are in
+[the deployment model](../packages/desktop/docs/desktop-deployment-model.md#workspace-views-and-deployments).
+
 ## Scheduling agents and wake messages
 
 Open **Schedules** in the selected workspace to launch a new agent on a cron,

package/docs/integrations.md

@@ -40,7 +40,7 @@ arrives from.
 ```yaml
 # oats-workspace.yaml: one default per slot, for every soul
 packages:
-  oats.okf: v4.1.0
+  oats.okf: v4.1.1
   oats.aweb: v1.17.7
   oats.linear: v1.0.1
   oats.jira: v1.0.1

package/docs/knowledge.md

@@ -26,7 +26,7 @@ The workspace pins the package and fills the slot for every soul by default:
 ```yaml
 # oats-workspace.yaml (excerpt)
 packages:
-  oats.okf: v4.1.0
+  oats.okf: v4.1.1
 defaults:
   knowledge: { oats.okf: { from: package } }
 stores:

package/docs/oats-workspace.schema.json

@@ -27,6 +27,20 @@
       "additionalProperties": { "$ref": "#/$defs/team" },
       "description": "SHARED teams: <label>: { description?, team? }. `team` is the messaging provider's team id, the same for everyone; without it the team is declared but not yet created (readiness team-unmapped). Local teams, the default and which teams each soul belongs to live in the deployment's oats-local.yaml (`oats teams`, `oats soul teams`). A label never gates, restricts or partitions anything."
     },
+    "defaultTeam": {
+      "$ref": "#/$defs/label",
+      "description": "Team model 3 (0.37.0): the workspace's fallback default team, a label of teams: in this file. 0.36.x accepts and validates it without applying it."
+    },
+    "localTeams": {
+      "type": "boolean",
+      "description": "Team model 3 (0.37.0): whether deployments may declare their own teams and defaultTeam in oats-local.yaml. Absent: false. 0.36.x accepts it without applying it."
+    },
+    "souls": {
+      "type": "object",
+      "propertyNames": { "type": "string", "pattern": "^(?:\\*|[a-z0-9][a-z0-9._-]*/(?:\\*|[a-z0-9]+(?:-[a-z0-9]+)*))$" },
+      "additionalProperties": { "$ref": "#/$defs/soulTeams" },
+      "description": "Team model 3 (0.37.0): per soul pattern (\"*\", <member|package>/* or <member|package>/<soul>; the most specific key wins outright), the soul's default team and the other teams it may join. Every label is a label of teams: in this file. 0.36.x accepts and validates it without applying it."
+    },
     "defaults": { "$ref": "#/$defs/defaults" },
     "stores": {
       "type": "object",
@@ -111,6 +125,20 @@
         "team": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/+-]{0,255}$", "description": "The messaging provider's team id (for oats.aweb, <team>:<namespace>). Absent: declared, not yet created. The kernel's safety rule: never '-'-led, no whitespace or control characters, at most 256 characters; the provider validates its own shape." }
       }
     },
+    "soulTeams": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "default": { "$ref": "#/$defs/label", "description": "The soul's default team: a label of teams: in this file." },
+        "teams": {
+          "anyOf": [
+            { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/label" } },
+            { "const": "any" }
+          ],
+          "description": "The other teams the soul may join: labels of teams: in this file, or \"any\" for every one. [] (or no teams) is default only."
+        }
+      }
+    },
     "defaults": {
       "type": "object",
       "additionalProperties": false,

package/docs/official-catalog.md

@@ -9,8 +9,8 @@ or workspace membership alone does not make a package official.
 
 | package | release | capabilities | package souls |
 |---|---|---|---|
-| `oats.framework` | `oats-framework/v1.4.1` (this repository) | `oats.core`, `oats.setup`, `oats.knowledge-theory` | `knowledge-theory-expert` |
-| `oats.okf` | `v4.1.0` | `oats.okf` (knowledge), `oats.okf-harvest`, `oats.okf-maintenance` | `knowledge-harvester`, `knowledge-maintainer` |
+| `oats.framework` | `oats-framework/v1.4.2` (this repository) | `oats.core`, `oats.setup`, `oats.knowledge-theory` | `knowledge-theory-expert` |
+| `oats.okf` | `v4.1.1` | `oats.okf` (knowledge), `oats.okf-harvest`, `oats.okf-maintenance` | `knowledge-harvester`, `knowledge-maintainer` |
 | `oats.aweb` | `v1.17.7` | `oats.aweb` (messaging) | |
 | `oats.engineering` | `v1.5.0` | `oats.engineering-expert`, `oats.developer`, `oats.code-review` | `code-reviewer` |
 | `oats.authoring` | `v1.0.3` | `oats.authoring` | |
@@ -27,7 +27,7 @@ no lock and adds nothing to an existing workspace.
 ## Find and use packages
 
 - A workspace pins an official package by **bare version** in its
-  `packages:` map (`oats.okf: v4.1.0`); `oats sync` resolves it through the
+  `packages:` map (`oats.okf: v4.1.1`); `oats sync` resolves it through the
   catalog to an exact commit, fetches it, verifies its integrity and locks it.
   A package outside the catalog is written `git:<repo>@<ref>`. Pinning does
   not join a team or adopt the publisher's workspace. See

package/docs/packages.md

@@ -44,14 +44,14 @@ whole organisation:
 
 ```yaml
 packages:
-  oats.okf: v4.1.0                                    # bare version → the official catalog
+  oats.okf: v4.1.1                                    # bare version → the official catalog
   acme.tools: git:github.com/acme/tools@v0.4.0        # direct ref: git:<repo>@<tag or full OID>
 ```
 
-- **Bare version** (`v4.1.0`, `4.1.0`, `1.0.0-rc.1`): the id is looked up in
+- **Bare version** (`v4.1.1`, `4.1.1`, `1.0.0-rc.1`): the id is looked up in
   the official catalog — `package-catalog.json` in the `oats` repo, or the file
   named by `OATS_PACKAGE_CATALOG` — which supplies the repo url, the tag
-  convention (`v4.1.0` or `oats-framework/v1.4.1`) and the payload path. An id
+  convention (`v4.1.1` or `oats-framework/v1.4.2`) and the payload path. An id
   the catalog does not know is `E_PACKAGE_MISSING` ("use `git:<repo>@<ref>` for
   a package outside the catalog"). The catalog is the reviewed official list
   ([official-catalog.md](official-catalog.md)) and the only way a
@@ -74,8 +74,8 @@ members:
   - git:github.com/acme/agents
   - git:github.com/acme/platform
 packages:
-  oats.framework: v1.4.1
-  oats.okf: v4.1.0
+  oats.framework: v1.4.2
+  oats.okf: v4.1.1
   oats.aweb: v1.17.7
 teams:
   platform: { team: "platform:acme.aweb.ai", description: Platform engineering }
@@ -105,7 +105,7 @@ decision recorded in the lock.
 $ oats sync
 workspace  acme  (github.com/acme/agents @ 3f2a9c1e)
 members    agents ✓↔ (@ 3f2a9c1e)   platform ✓↔ (@ 77c0a1b2)   billing ✗ (no-backlink)
-packages   acme.tools 0.4.0 ✓ (@ 47f4b816)   oats.okf 4.1.0 ✓ (@ e331a996)
+packages   acme.tools 0.4.0 ✓ (@ 47f4b816)   oats.okf 4.1.1 ✓ (@ e1d604f7)
 changed    acme.tools  — → 0.4.0 (@ 47f4b816)
 souls      9 discovered (6 members, 1 external, 2 package, 0 disabled here) · 0 private capabilities
 teams      platform (shared) · this deployment's: oats teams
@@ -160,8 +160,8 @@ same workspace commit hold identical locks.
       "source": "catalog:oats.okf",
       "url": "https://github.com/awebai/oats-okf.git",
       "path": "oats-package",
-      "version": "4.1.0",
-      "commit": "e331a9969d10aabddaa5824991f1846c7dedb388",
+      "version": "4.1.1",
+      "commit": "e1d604f70c5e4cdc39602095f139383e61f69323",
       "integrity": "sha256-…",
       "capabilities": ["oats.okf", "oats.okf-harvest", "oats.okf-maintenance"]
     },
@@ -331,12 +331,12 @@ A soul that names one of the package's capabilities with
 {
   "policy": "docs/official-catalog.md",
   "packages": {
-    "oats.okf":       { "url": "https://github.com/awebai/oats-okf.git", "ref": "v4.1.0", "path": "oats-package" },
-    "oats.framework": { "url": "https://github.com/awebai/oats.git", "ref": "oats-framework/v1.4.1", "path": "oats-package" }
+    "oats.okf":       { "url": "https://github.com/awebai/oats-okf.git", "ref": "v4.1.1", "path": "oats-package" },
+    "oats.framework": { "url": "https://github.com/awebai/oats.git", "ref": "oats-framework/v1.4.2", "path": "oats-package" }
   }
 }
 ```
 
-`ref` carries the tag convention: a workspace's `oats.framework: v1.4.1`
-resolves to tag `oats-framework/v1.4.1`. Resolving through the catalog never
+`ref` carries the tag convention: a workspace's `oats.framework: v1.4.2`
+resolves to tag `oats-framework/v1.4.2`. Resolving through the catalog never
 advances a lock by itself: `oats sync` does, and says so.

package/docs/release-notes/v0.36.0.md

@@ -0,0 +1,118 @@
+# OATS 0.36.0
+
+## Added
+
+- **A deployment reports its workspace identity** (feature
+  `workspace-identity`, awebai/oats#482). `oats status --json`'s `workspace`
+  object now also carries `key` (the workspace host's canonical repository
+  key, so every spelling of one repository matches, and the host's key when
+  `oats-local.yaml` names a member whose backlink is known), `ref` (the
+  reference exactly as `oats-local.yaml` writes it, for display), `keyFrom`
+  (`"workspace"`, or `"member"` while a member's host is not known),
+  `standalone`, `defaultTeam` (`{label, team}`),
+  `teams` (`{<label>: <provider team id> | null}`) and `teamsFrom`. They are
+  read offline, so they are there whether the workspace is reachable or not.
+  Shared teams come from the workspace file the run read
+  (`teamsFrom: "observed"`), else this machine's cached copy at the host
+  commit it last observed (`"cache"`, no git process), else nowhere
+  (`"local"`: local teams only). `oats server roster --json` relays each
+  host's `workspace` object verbatim on its group (from a host before
+  0.36.0, the reachability-only object), or `null` from a host that reports
+  none. The rule for matching teams across machines (when a
+  `null` team is unmapped and when it is unknown) is in
+  docs/desktop-cli-api.md, under Workspace identity. A deployment without
+  `oats-local.yaml` still has no `workspace` object, and the human-readable
+  `oats status` is unchanged. After upgrading, run `oats sync` on each remote
+  host (and on any deployment with no instances): the parsed cache belongs to
+  the running kernel, so until the deployment observes its workspace again,
+  a status that does not read the workspace itself reports
+  `teamsFrom: "local"` and its shared default team shows as unknown.
+- **The Desktop shows a workspace's deployments on every machine**
+  (awebai/oats#482). The switcher lists each workspace once: its deployments
+  on this Mac and on registered servers are matched by the workspace each
+  reports (its key and default team, by the kernel's rules in
+  docs/desktop-cli-api.md), and named by machine. The Active overview becomes
+  **Deployments**: **All** shows the overview trees split by deployment ("This
+  Mac · ~/Agents/oats", "altair · ~/Agents/tsm"), then each deployment has its
+  own tab. Every action is still addressed to the row's own deployment. A
+  deployment that isn't shown live says why in a few words, with **How to fix**
+  under it (ssh needs a prompt or a host key, timed out, the host's OATS is too
+  old, its workspace reference needs `oats sync` or fixing), and one that can't
+  be matched is listed in the switcher under "Not matched to a workspace". The
+  Desktop remembers the last workspace each remote reported, so an
+  unreachable server stays under its workspace, marked "remembered". With two
+  or more deployments the sidebar groups instances by machine, and the Spawn
+  dialog asks first which deployment to spawn in; the Teams board shows only
+  the workspace's own deployments, grouped by deployment.
+  Saved selections and tabs move to the workspace that holds their
+  deployment. It needs the CLI's `workspace-identity` feature; without it
+  each deployment keeps its own entry, as before.
+
+## Changed
+
+- **The Desktop's tabs fit the window, and the selected tab stays in view.**
+  Tabs share the tab strip like VS Code's "shrink" mode: each takes at most its
+  natural width (still capped at 280px) and they shrink evenly as more open,
+  down to 168px; below that the strip scrolls. A shrunk tab keeps the end of
+  its name ("oats-…palette"), so tabs whose names share a prefix still read
+  differently. The branch gives way before the name, and the full
+  name stays in the tooltip and the accessible name. Whenever a tab becomes
+  active, a tab closes, or a strip resizes (the window, the sidebar or panel,
+  a split), the active tab is scrolled fully into view, in split groups too.
+  After the tabs, only Split right and Split down remain. Closing a split
+  (⌥⌘W / Ctrl+Shift+Alt+W) and showing or hiding the instance panel
+  (⌥⌘B / Ctrl+Alt+B) are on their chords and in the command palette, and the
+  panel keeps its own collapse control
+  ([desktop-keyboard.md](../../packages/desktop/docs/desktop-keyboard.md#the-command-palette-k)).
+- **The Desktop's command palette lists instances like the sidebar and cycles
+  with ⌘K.** With an empty query it shows every instance in the sidebar's
+  groups, order and indentation, then the commands. A query keeps that tree,
+  showing each match under its dimmed ancestors. While the palette is open,
+  ⌘K moves down and ⇧⌘K up, wrapping. Enter opens the row and Esc closes, so
+  a second ⌘K no longer closes the palette. On Linux/Windows the chord,
+  Ctrl+Shift+P, already holds Shift, so ArrowUp moves up there.
+- **The Desktop's default monospace font is Inconsolata, bundled with the
+  app.** The terminal and the UI's code, paths and shortcut hints use it on
+  every machine, ahead of the system monospace fonts. The terminal's default
+  size is now 15px, and the terminal's text sits closer to the pane's edges
+  (12px each side instead of 32px), centred in the pane. Box drawing (Claude
+  Code's input box, tmux borders) is drawn as a native terminal draws it, with
+  thin lines whatever the font. A terminal font or size you already
+  chose is kept, and resetting the terminal's typography (⌘0 / Ctrl+0, the
+  command palette, or Settings → Terminal) goes back to 15px. Settings (the sidebar's settings
+  button, now titled just "Settings") has a Terminal section with a font size
+  stepper (9–28px, or type a size) that changes every open terminal at once
+  and follows ⌘= / ⌘- / ⌘0. Inconsolata is under the SIL Open Font License 1.1
+  ([fonts/README.md](../../packages/desktop/renderer/fonts/README.md)).
+
+- **The Desktop follows a spawn to its new instance.** After **Spawn** the
+  dialog closes at once and the pending row is revealed in the roster, without
+  taking focus. When the instance is running, the Desktop opens its terminal
+  tab and selects its row: arriving there is the confirmation, so a successful
+  spawn no longer posts a toast. It never pulls the operator away from
+  something they did since the press: typing (a lone modifier does not count),
+  pasting, moving focus, opening another tab or view, or an open dialog or
+  overlay. Then they stay where they are, and the row says **New** until it or
+  its tab is first opened. Either way, assistive technology hears "*name*
+  spawned". Partial, refused, failed and unknown outcomes keep their
+  notifications
+  ([desktop-spawn-preview.md](../../packages/desktop/docs/desktop-spawn-preview.md)).
+
+- **The Desktop's spawn dialog opens on Name and jumps between its sections.**
+  Name is focused whenever the dialog opens for a chosen soul, Quick Open
+  included, with the caret after a restored name. **⌘1–⌘7** (Ctrl+1–7
+  elsewhere) jump to Name, Harness, Model, Relationship, Teams and the Opening
+  instruction; ⌘7 opens or closes Developer settings. Quiet hints show the
+  keys; the shortcuts editor lists them under *Spawn dialog*, where they can
+  be rebound, and the shell's own ⌘1–9 do not fire behind the dialog
+  ([desktop-keyboard.md](../../packages/desktop/docs/desktop-keyboard.md)).
+  In "Works in", a directory instance now reads "own folder · free to work
+  across repos".
+
+- **The Active overview no longer has a Spawn button.** Spawn from the
+  canvas with **S**, from the sidebar's **Spawn instance** (⌘N), from Quick
+  Open or from a soul card.
+
+- **The Desktop accepts OATS CLIs `>=0.25.8 <0.37.0`**, so it runs against
+  this release's kernel. Install the CLI and the Desktop 0.36.0 together: the
+  Desktop 0.35.x refuses a 0.36 CLI.

package/docs/release-notes/v0.36.1.md

@@ -0,0 +1,103 @@
+# OATS 0.36.1
+
+## Changed
+
+- **oats.okf 4.1.1** (catalog and workspace pin, and the bundled mirrors):
+  three fixes to harvest completion and `harvest --once`.
+  - `oats okf complete` on an amended PR that is still open
+    (awebai/oats-okf#36). After the knowledge-maintainer pushed an amendment
+    on top of the delivered commit, `complete --run <id>` failed with `E_PR:
+    publication branch has unexpected commit; never force push`. The run is
+    now reported `delivered` when the known PR is open at the branch's tip
+    and Git shows that tip descends from the delivered commit; the answer
+    names the amended head. A tip that does not contain the delivered commit
+    is still refused with `E_PR`, and nothing is ever force-pushed. Ancestry
+    is read from the commit objects alone, so a checkout's grafts or
+    commit-graph file cannot fake it.
+  - `harvest --once`: one-shots of a seat no longer race
+    (awebai/oats-okf#39). The overlap checks and the install run under one
+    seat lock, so of two overlapping one-shots started together one installs
+    and the other gets `E_ONCE_OVERLAP`.
+  - `harvest --once`: a note edited between runs no longer strands a
+    draining one-shot (awebai/oats-okf#40). A rerun with the same manifest
+    continues from custody without reading the listed notes. Another
+    manifest listing a note a one-shot already holds is refused with
+    `E_ONCE_OVERLAP`, naming that one-shot, instead of a `sha256 mismatch`.
+- **Preparing for team model 3** (awebai/oats#485). OATS 0.37.0 commits the
+  teams an organisation's souls may join, and their default team, in the
+  workspace file, closed by default (awebai/oats#484), so the organisation's
+  intended team set is visible and reviewable in its git and a deployment's
+  `oats-local.yaml` no longer adds a team by accident. 0.36.1 lets every workspace and
+  deployment migrate before 0.37.0 refuses the old shape:
+  - `oats-workspace.yaml` accepts `defaultTeam`, `localTeams` and `souls:`,
+    and validates them: every label they name must be a shared team in
+    `teams:` of the same file (`E_WORKSPACE_SCHEMA` otherwise, when the file
+    is read). 0.36.1 does **not** apply them: a soul's teams and default are
+    still resolved from `oats-local.yaml`. Earlier releases refuse these keys,
+    so add them only once everyone who reads the workspace runs 0.36.1 or
+    later.
+  - A new readiness warning, `team-model-3-migration` (never blocking), names
+    what 0.37.0 will refuse. `oats teams`, `oats readiness` (and so the
+    Desktop's readiness view) and `oats doctor` show it. Its `condition` is
+    `local-soul-teams` when `oats-local.yaml` has `souls.teams` or
+    `souls.default`, and `local-teams-closed` when `oats-local.yaml` declares
+    `teams` or `defaultTeam` and the workspace file does not say
+    `localTeams: true` (never in the standalone view). `oats doctor` stays
+    offline: it checks `local-teams-closed` against the workspace file this
+    machine last observed, and says so when there is none yet (`oats sync`
+    fixes that). The shapes are in docs/desktop-cli-api.md, under Team
+    readiness items.
+- **oats.framework 1.4.2** (oats.setup 2.2.1; catalog and workspace pin
+  `oats-framework/v1.4.2`) ships the oats.setup skill changes made since
+  1.4.1, which deployments had not received:
+  - `oats-onboarding`: declare how this machine starts a harness once, as
+    that harness's default launch configuration (0.32.0, awebai/oats#368);
+    `oats spawn --preview` names the launch configuration that applies.
+  - `oats-workspace-config`: a soul's launch preference versus a host launch
+    configuration, `E_LAUNCH_CONFIG_INVALID` and `E_CLAUDE_CONFIG_REMOVED`
+    (awebai/oats#368), and the team model 3 workspace keys `defaultTeam`,
+    `localTeams` and `souls:` (awebai/oats#495).
+  - `oats-teams`: preparing for team model 3, and what each
+    `team-model-3-migration` condition asks for (awebai/oats#495).
+  - `oats-package-pins`: the example pins `oats.okf: v4.1.1`
+    (awebai/oats#494).
+
+## What 0.37.0 will change
+
+- **`souls:` in `oats-workspace.yaml` decides which teams a soul may join**
+  besides its default: the most specific key wins (`<member|package>/<soul>`,
+  then `<member|package>/*`, then `"*"`); `teams` is a list of shared labels
+  or `any`. A soul no key matches joins its default only. This applies to
+  package souls too: a workspace opens a package explicitly.
+- **A soul's default team**, in order: its `souls:` `default`; else the
+  deployment's `defaultTeam`, only when the workspace says
+  `localTeams: true`; else the workspace's `defaultTeam`.
+- **`oats-local.yaml` `souls.teams` and `souls.default` are refused**
+  (`E_WORKSPACE_SCHEMA`, reason `removed-key`), and so are `oats soul teams
+  --add/--remove/--default/--clear-default`.
+- **Local `teams` and `defaultTeam` are refused unless the workspace says
+  `localTeams: true`**, and so are `oats teams add/remove/default`. The
+  standalone view still allows them.
+
+## Upgrade
+
+Nothing is required for 0.36.1 itself. To be ready for 0.37.0
+(`oats teams` lists each deployment's `team-model-3-migration` warnings):
+
+1. **Now**, once everyone who reads the workspace runs 0.36.1 or later,
+   commit in `oats-workspace.yaml` the choices each deployment makes locally:
+   - a `souls:` entry for what `souls.teams` says (`"*": { teams: [...] }`
+     for every soul, `<member|package>/<soul>: { teams: [...] }` for one;
+     local keys are bare soul names, workspace keys are qualified by the
+     member or package, as in `souls.disabled`), with a `default:` for what
+     `souls.default` says;
+   - for local teams and a local `defaultTeam`, choose one: (a) keep them
+     personal, and add `localTeams: true`, which clears `local-teams-closed`
+     at once; or (b) commit the teams in `teams:` and the default as
+     `defaultTeam:`.
+2. **When the deployment moves to 0.37.0**, remove from its `oats-local.yaml`
+   `souls.teams`, `souls.default` and, under (b), the local `teams` and
+   `defaultTeam`. Not before: 0.36.1 does not apply the workspace keys, so
+   those local keys are still what decides a soul's teams and default until
+   then, and their warnings stay until they go. 0.37.0 refuses them, naming
+   the replacement.

package/docs/servers.md

@@ -156,7 +156,9 @@ oats okf harvest --server build --instance dev-fix-123   # the harvest, run in t
 
 The **roster** is what the Desktop shows: one group per server id and route
 target (host and workspace), with the registration (present or not), the
-probe result, the remote souls, the instances joined with saved routes
+probe result, the host's workspace identity (`workspace`: its own `status
+--json` `workspace` object relayed verbatim, reachability only from a host
+before 0.36.0, `null` when it reports none or the probe failed), the remote souls, the instances joined with saved routes
 (`savedRoute`, `running` or `null` when unknown, `retirePending`,
 `rollbackIncomplete`, `missingRemotely`, `addressable`), and `retireFailures`
 (deferred self-retirements that failed there). Each instance row also relays

package/docs/souls-and-instances.md

@@ -152,8 +152,8 @@ composed skills and instructions, a spawn records:
       "commit": "3f2a9c1e…", "digest": "sha256-…", "materializedAt": "2026-09-24T10:12:44.118Z"
     },
     "oats.okf": {
-      "from": { "kind": "package", "package": "oats.okf", "version": "4.1.0", "commit": "e331a996…", "integrity": "sha256-…", "repoKey": "github.com/awebai/oats-okf" },
-      "commit": "e331a996…", "digest": "sha256-…", "materializedAt": "2026-09-24T10:12:44.201Z"
+      "from": { "kind": "package", "package": "oats.okf", "version": "4.1.1", "commit": "e1d604f7…", "integrity": "sha256-…", "repoKey": "github.com/awebai/oats-okf" },
+      "commit": "e1d604f7…", "digest": "sha256-…", "materializedAt": "2026-09-24T10:12:44.201Z"
     }
   },
   "providers": {

package/docs/workspaces.md

@@ -54,8 +54,8 @@ members:                                   # repo refs, NO @revision (E_WORKSPAC
   - git:github.com/acme/tools              # a member that ALSO publishes a package (see below)
 
 packages:                                  # the ONLY versioned things
-  oats.framework: v1.4.1                   # bare version → resolves through the official catalog
-  oats.okf: v4.1.0
+  oats.framework: v1.4.2                   # bare version → resolves through the official catalog
+  oats.okf: v4.1.1
   acme.tools: git:github.com/acme/tools@v0.4.0   # outside the catalog → git:<repo>@<tag|OID>; still a package
 
 teams:                                     # SHARED teams: the same provider team for everyone
@@ -359,6 +359,39 @@ there is no default; `team-unmapped`, blocking when it is the default;
 its environment — see [capabilities.md](capabilities.md#teams-in-the-provider-environment).
 Exact shapes: [desktop-cli-api.md](desktop-cli-api.md#team-model-v2-feature-team-model-2-oats-0300-replaces-feature-teams).
 
+### Preparing for team model 3 (0.36.x)
+
+OATS 0.37.0 commits a soul's teams in the workspace (team model 3,
+awebai/oats#484): the teams an organisation's instances may join become its
+own decision, visible and reviewable in its git, so a deployment's
+`oats-local.yaml` no longer adds one by accident. 0.36.x prepares for it, so
+every workspace and deployment can migrate first:
+
+- **`oats-workspace.yaml` accepts the new keys** and validates them, but
+  **does not apply them**: a soul's teams and default are still resolved as
+  above, from `oats-local.yaml`.
+
+  ```yaml
+  defaultTeam: engineering          # the workspace's fallback default team
+  localTeams: true                  # deployments may declare their own teams (absent: false)
+  souls:                            # per pattern: "*", <member|package>/*, <member|package>/<soul>
+    "*": { teams: [] }              # default only ({} says the same)
+    security-souls/*: { default: security, teams: [engineering] }
+    oats.engineering/*: { teams: any }   # every shared team
+  ```
+
+  `<member|package>` is the name `souls.disabled` uses. Every label (`defaultTeam`,
+  a `souls:` `default`, each of its `teams`) must be a shared team in `teams:` of
+  the same file; anything else is `E_WORKSPACE_SCHEMA` when the file is read. A
+  key naming a member or package the workspace does not have is not an error.
+- **The readiness warning `team-model-3-migration`** (never blocking) names
+  what 0.37.0 will refuse: `souls.teams` / `souls.default` in `oats-local.yaml`
+  (they move to `souls:`), and local `teams` / `defaultTeam` while the workspace
+  does not say `localTeams: true` (fix: add `localTeams: true`, or commit the
+  teams and `defaultTeam` in the workspace file). `oats teams`, readiness (and
+  so the Desktop) and `oats doctor` show it. The migration steps are in the
+  [0.36.1 release notes](release-notes/v0.36.1.md).
+
 ## Provider payloads have three homes
 
 | What it is | Where | Example |

package/lib/servers.mjs

@@ -739,7 +739,7 @@ export function rosterGroups({ server, io = {} } = {}) {
   const groups = new Map();
   const add = (serverId, target, registrationPresent, label) => {
     const key = `${serverId}:${targetKey(target)}`;
-    if (!groups.has(key)) groups.set(key, { id: key, server: serverId, label: label || serverId, registrationPresent, target, probe: null, agentsRoot: undefined, souls: [], instances: [], retireFailures: [], _snapshots: [] });
+    if (!groups.has(key)) groups.set(key, { id: key, server: serverId, label: label || serverId, registrationPresent, target, probe: null, agentsRoot: undefined, workspace: null, souls: [], instances: [], retireFailures: [], _snapshots: [] });
     const g = groups.get(key);
     if (registrationPresent) g.registrationPresent = true;
     return g;
@@ -769,6 +769,9 @@ export function rosterGroups({ server, io = {} } = {}) {
     if (status?.ok) {
       g.probe = { ok: true };
       g.agentsRoot = status.result.root;
+      // The host's own workspace identity (feature workspace-identity), relayed as it answered it: never
+      // derived here, null when the host reports none.
+      g.workspace = status.result.workspace ?? null;
       for (const a of status.result.agents || []) {
         g.souls.push({ name: a.name, harness: a.harness ?? a.runtime, work: a.work, backend: a.backend, description: a.description, agentsRoot: status.result.root });
         // A failed deferred self-retirement needs an operator: it rides with

package/lib/teams.mjs

@@ -17,6 +17,10 @@
  * Rows (docs/desktop-cli-api.md, Team model v2): TeamRow { label, team, default, from: shared|local },
  * the default first, then by label. Reports carry unmapped rows (team null); OATS_TEAMS and
  * instance.json carry mapped rows only. DefaultTeam { label, team, from: deployment|soul } | null.
+ *
+ * Team model 3 (0.37.0, awebai/oats#484) moves these choices into the committed workspace file. 0.36.x
+ * validates its keys (lib/workspace.mjs) without applying them, and warns about what 0.37.0 will refuse
+ * (migrationProblems: team-model-3-migration).
  */
 import { oatsError } from "./errors.mjs";
 
@@ -53,11 +57,19 @@ export function teamModel(workspace, local, { workspaceKey = null } = {}) {
     localTeams.set(label, { label, team: str(def?.team), description: str(def?.description), from: "local", at: `${LOCAL_FILE}#/teams/${pointerKey(label)}` });
   }
   const souls = isObject(local?.souls) ? local.souls : {};
+  const has = (v, k) => isObject(v) && Object.hasOwn(v, k);
   return {
     shared, local: localTeams,
     labels: new Map([...localTeams, ...shared]), // the committed definition wins a collision
     defaultTeam: str(local?.defaultTeam),
     souls: { teams: isObject(souls.teams) ? souls.teams : {}, default: isObject(souls.default) ? souls.default : {} },
+    // Team model 3 (0.37.0) moves these keys; 0.36.x only warns (migrationProblems). `localTeams` is
+    // the workspace's answer, null without a workspace file (the standalone view has no workspace rules).
+    migration: {
+      soulKeys: ["teams", "default"].filter((k) => has(local?.souls, k)).map((k) => `souls.${k}`),
+      teamKeys: ["teams", "defaultTeam"].filter((k) => has(local, k)),
+      localTeams: isObject(workspace) ? workspace.localTeams === true : null,
+    },
   };
 }
 
@@ -130,6 +142,27 @@ const unconfiguredProblem = () => ({ code: "E_TEAM_UNCONFIGURED", severity: "fai
 const refusalProblem = (e) => ({ code: e.code, ...e.details, severity: "failure", message: e.message,
   fix: e.code === "E_TEAM_UNKNOWN" ? "declare the team (`oats teams add`), or remove the reference" : "add the label to the soul's teams (`oats soul teams … --add`), or clear its default (`--clear-default`)" });
 
+/** The fields of a team-model-3-migration problem other than code/severity/message/fix, as every
+ *  surface (oats teams, readiness, doctor) carries them. */
+export const MIGRATION_CODE = "team-model-3-migration";
+/**
+ * The team-model-3-migration warnings (0.36.x; 0.37.0 refuses what they name): `local-soul-teams` when
+ * oats-local.yaml has souls.teams / souls.default, `local-teams-closed` when it declares teams /
+ * defaultTeam and the workspace file does not say `localTeams: true` (never without a workspace file).
+ */
+export function migrationProblems(model) {
+  const m = model.migration, problems = [];
+  if (m.soulKeys.length) problems.push({ code: MIGRATION_CODE, severity: "warning", condition: "local-soul-teams", keys: [...m.soulKeys],
+    message: `oats-local.yaml ${m.soulKeys.join(", ")}: OATS 0.37.0 refuses ${m.soulKeys.length > 1 ? "these keys" : "this key"}; which teams a soul may join, and its default, move to souls: in oats-workspace.yaml`,
+    fix: `commit the same choices as souls: entries in oats-workspace.yaml ("*" or <member|package>/<soul>: { default, teams }), then remove ${m.soulKeys.join(" and ")} from oats-local.yaml` });
+  if (m.teamKeys.length && m.localTeams === false) problems.push(localTeamsClosedProblem(m.teamKeys));
+  return problems;
+}
+/** `local-teams-closed` for the oats-local.yaml `keys` found (doctor builds it from its offline read). */
+export const localTeamsClosedProblem = (keys) => ({ code: MIGRATION_CODE, severity: "warning", condition: "local-teams-closed", keys: [...keys],
+  message: `oats-local.yaml declares ${keys.join(", ")}, but oats-workspace.yaml does not say localTeams: true: OATS 0.37.0 refuses local teams and a local defaultTeam unless the workspace allows them`,
+  fix: "either (a) add `localTeams: true` to oats-workspace.yaml, or (b) commit the teams and defaultTeam in oats-workspace.yaml, then remove them from oats-local.yaml" });
+
 /**
  * Readiness problems. Without `key`: the deployment's (`oats teams`): collisions, unmapped shared
  * teams (a failure when it is `defaultTeam`), every unknown reference, every ineligible
@@ -141,11 +174,11 @@ export function teamProblems(model, { key = null, messaging = false } = {}) {
   if (key !== null) {
     let t;
     try { t = soulTeams(model, key); }
-    catch (e) { if (e.code === "E_TEAM_UNKNOWN" || e.code === "E_TEAM_NOT_ELIGIBLE") return [refusalProblem(e)]; throw e; }
+    catch (e) { if (e.code === "E_TEAM_UNKNOWN" || e.code === "E_TEAM_NOT_ELIGIBLE") return [refusalProblem(e), ...migrationProblems(model)]; throw e; }
     for (const r of t.teams) if (model.shared.has(r.label) && model.local.has(r.label)) problems.push(collisionProblem(r.label, model.shared.get(r.label), model.local.get(r.label)));
     for (const r of t.teams) if (r.team === null) problems.push(unmappedProblem(model.labels.get(r.label), r.default));
     if (messaging && t.defaultTeam === null) problems.push(unconfiguredProblem());
-    return problems;
+    return [...problems, ...migrationProblems(model)];
   }
   const labels = [...model.labels.keys()].sort(byCodepoint);
   for (const label of labels) if (model.shared.has(label) && model.local.has(label)) problems.push(collisionProblem(label, model.shared.get(label), model.local.get(label)));
@@ -159,7 +192,7 @@ export function teamProblems(model, { key = null, messaging = false } = {}) {
     try { soulTeams(model, k); } catch (e) { if (e.code === "E_TEAM_NOT_ELIGIBLE" && e.details.soul === k) problems.push(refusalProblem(e)); else if (e.code !== "E_TEAM_UNKNOWN") throw e; }
   }
   if (messaging && model.defaultTeam === null) problems.push(unconfiguredProblem());
-  return problems;
+  return [...problems, ...migrationProblems(model)];
 }
 
 /**

package/lib/workspace.mjs

@@ -243,8 +243,22 @@ export function validateWorkspace(value, { remote = defaultRemote } = {}) {
     const d = value.defaults;
     for (const slot of ["knowledge", "messaging", "tasks", "capabilities"]) fromProblems(remote, d[slot], `/defaults/${slot}`, problems, { here: false });
   }
+  sharedLabelProblems(value, problems);
   return withRemovedKeys(problems, value, REMOVED_KEYS.workspace);
 }
+/** Team model 3: every label `defaultTeam` and `souls:` name is a shared team of this same file, so an
+ *  unknown label is refused when the file is read, never at a spawn on someone else's machine. */
+function sharedLabelProblems(value, problems) {
+  const shared = new Set(isObject(value.teams) ? Object.keys(value.teams) : []);
+  const known = (label, path) => { if (typeof label === "string" && !shared.has(label)) problems.push({ path, message: `${show(label)} is not a shared team: declare it in teams: of this file` }); };
+  known(value.defaultTeam, "/defaultTeam");
+  if (isObject(value.souls)) for (const [key, entry] of Object.entries(value.souls)) {
+    if (!isObject(entry)) continue;
+    const at = `/souls/${pointerKey(key)}`;
+    known(entry.default, `${at}/default`);
+    if (Array.isArray(entry.teams)) entry.teams.forEach((label, i) => known(label, `${at}/teams/${i}`));
+  }
+}
 export function validateMembership(value) { return withRemovedKeys(validateAgainst(schemaFor("membership"), value), value, REMOVED_KEYS.membership); }
 
 /** Keys 0.30 removed (team model v2): each is a schema problem naming its replacement, in place of

package/package-catalog.json

@@ -3,7 +3,7 @@
   "packages": {
     "oats.okf": {
       "url": "https://github.com/awebai/oats-okf.git",
-      "ref": "v4.1.0",
+      "ref": "v4.1.1",
       "path": "oats-package"
     },
     "oats.aweb": {
@@ -33,7 +33,7 @@
     },
     "oats.framework": {
       "url": "https://github.com/awebai/oats.git",
-      "ref": "oats-framework/v1.4.1",
+      "ref": "oats-framework/v1.4.2",
       "path": "oats-package"
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.35.5",
+  "version": "0.36.1",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",

package/skills/oats-getting-started/SKILL.md

@@ -60,8 +60,8 @@ members:
   - git:github.com/acme/agents          # the host is a member too
   - git:github.com/acme/platform
 packages:
-  oats.framework: v1.4.1                # bare versions resolve through the official catalog
-  oats.okf: v4.1.0
+  oats.framework: v1.4.2                # bare versions resolve through the official catalog
+  oats.okf: v4.1.1
 defaults:
   capabilities: { oats.core: { from: package } }
   knowledge: { oats.okf: { from: package } }