@awebai/oats 0.39.0 → 0.39.1

package/docs/desktop-cli-api.md

@@ -468,6 +468,17 @@ confirmed member (`evidence: {repoKey, workspace, commit}`); `fail` when not
 (the remedy names `oats-membership.yaml`); `unknown` when the workspace could
 not be read. External souls and standalone views are `not-applicable`,
 `required: false` (a standalone item carries `evidence.standaloneReason`).
+A package soul is trusted through the workspace's `packages:` pin, never
+through membership ([the non-collapse rule](workspaces.md#member-tier-vs-package-tier-the-non-collapse-rule)):
+its item is `package <package>/<soul>` (producer `workspace lock`,
+`evidence: {repoKey, workspace, commit, version, integrity, from}` with
+`from.kind: "package"`). It passes when the package is declared and locked
+and ships the soul at the locked commit, and the soul's copy is intact: for
+`--soul`, the copy a spawn would link matches the locked digest; for
+`--home`, the home's copy matches the digest it recorded, and a lock still
+at that commit records the same digest. The copy is digested on every read.
+It fails otherwise, with `code: "E_PACKAGE_INTEGRITY"` on a digest mismatch
+and the remedy naming `oats sync` or a fresh spawn.
 
 **`providers`** (producer `provider binding check`): for each module whose
 manifest declares `binding`, the kernel runs its `binding.check` and relays

package/docs/integrations.md

@@ -41,7 +41,7 @@ arrives from.
 # oats-workspace.yaml: one default per slot, for every soul
 packages:
   oats.okf: v4.1.1
-  oats.aweb: v1.21.0
+  oats.aweb: v1.21.1
   oats.linear: v1.0.1
   oats.jira: v1.0.1
 defaults:
@@ -89,7 +89,13 @@ operations in full.
   `knowledge-maintainer` package soul reviews the resulting PRs.
 - **`oats.aweb`** mints a messaging identity for each instance at spawn and
   removes it at retire, contributes the aweb messaging skills, and wires the
-  channel so sessions are woken by mail. `oats aweb roster` lists the team:
+  channel so sessions are woken by mail. Under `delivery: channel`, Claude Code
+  loads the channel plugin with `--dangerously-load-development-channels`,
+  since `aweb-channel` is not on its approved channel list, so every such
+  Claude start waits at Claude Code's
+  development-channels confirmation until someone answers it in the
+  instance's terminal; the start's warnings and readiness say so
+  (`channel-dev-confirmation`). `oats aweb roster` lists the team:
   its membership certificates and workspaces, one entry per alias with its
   sources, status and kind (global identities first), and says when either
   source is incomplete. After `oats server connect`, `oats aweb connect

package/docs/official-catalog.md

@@ -11,7 +11,7 @@ or workspace membership alone does not make a package official.
 |---|---|---|---|
 | `oats.framework` | `oats-framework/v1.5.0` (this repository) | `oats.core`, `oats.setup`, `oats.knowledge-theory` | `knowledge-theory-expert` |
 | `oats.okf` | `v4.1.1` | `oats.okf` (knowledge), `oats.okf-harvest`, `oats.okf-maintenance` | `knowledge-harvester`, `knowledge-maintainer` |
-| `oats.aweb` | `v1.21.0` | `oats.aweb` (messaging) | |
+| `oats.aweb` | `v1.21.1` | `oats.aweb` (messaging) | |
 | `oats.engineering` | `v1.5.0` | `oats.engineering-expert`, `oats.developer`, `oats.code-review` | `code-reviewer` |
 | `oats.authoring` | `v1.0.3` | `oats.authoring` | |
 | `oats.jira` | `v1.0.1` | `oats.jira` (tasks) | |

package/docs/packages.md

@@ -76,7 +76,7 @@ members:
 packages:
   oats.framework: v1.5.0
   oats.okf: v4.1.1
-  oats.aweb: v1.21.0
+  oats.aweb: v1.21.1
 teams:
   platform: { team: "platform:acme.aweb.ai", description: Platform engineering }
 defaults:
@@ -134,7 +134,7 @@ Declaring a package in the workspace's `packages:` is the trust decision
 ## `oats package add | remove`
 
 ```bash
-oats package add oats.aweb v1.21.0                         # a catalog version
+oats package add oats.aweb v1.21.1                         # a catalog version
 oats package add acme.tools git:github.com/acme/tools@v0.4.0
 oats package remove acme.tools
 ```

package/docs/release-notes/v0.39.1.md

@@ -0,0 +1,42 @@
+# OATS 0.39.1
+
+## Changed
+
+- **oats.aweb 1.21.1: a Claude Code start says that it will wait at Claude
+  Code's development-channels confirmation** (awebai/oats-aweb#44). Under
+  `delivery: channel`, Claude Code loads the `aweb-channel` plugin with
+  `--dangerously-load-development-channels`, because the plugin is not on
+  Claude Code's approved channel list. Claude Code then stops at its "Loading
+  development channels" confirmation before the session starts, and waits
+  until someone answers it in the instance's terminal. Unattended starts
+  (Desktop starts and restarts, automations, successors) waited there with
+  nothing saying so. Now:
+  - every spawn or start that adds the flag carries the warning
+    `channel-dev-confirmation` once;
+  - `oats readiness` reports it, without changing the status, for a home
+    whose last start was Claude Code under `channel`.
+
+  Nothing answers the confirmation on the human's behalf. Launch arguments
+  and settings are unchanged. `--channels` registers only plugins on Claude
+  Code's approved list; for a plugin not on it, Claude Code prints a startup
+  warning and the channel does not register. That list is Anthropic's
+  default, or a Team/Enterprise organization's managed
+  `allowedChannelPlugins`, which replaces the default and requires
+  `channelsEnabled: true`.
+
+## Fixed
+
+- **`oats readiness` no longer fails package souls on membership**
+  (awebai/oats#533). A package soul (`oats.okf/knowledge-maintainer`,
+  `oats.engineering/code-reviewer`, …) failed its `member` check with
+  "member <its package's repository>: not a member of the workspace", and the
+  remedy asked to list the package's repository in `members:`. A package
+  soul is trusted through the workspace's `packages:` pin, never through
+  membership (see [the non-collapse rule](../workspaces.md#member-tier-vs-package-tier-the-non-collapse-rule)).
+  Its `member` item is now `package <package>/<soul>`. It passes when the
+  package is declared and locked, ships the soul at the locked commit, and
+  the soul's copy matches its digest: for `--soul`, the copy a spawn would
+  link against the lock; for `--home`, the home's copy against the digest it
+  recorded, and the lock against that same digest while it still pins the
+  same commit. A mismatch fails with `E_PACKAGE_INTEGRITY`. Member and
+  external souls are unchanged. Spawn already applied this rule.

package/lib/instance-inspect.mjs

@@ -15,7 +15,7 @@ import { accessSync, constants as fsConstants, existsSync, readFileSync, realpat
 import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { capabilityManifests, sessionDefaults, homeLaunchLayers, instanceSoulDir, launchConfigsAt, launchFolderTrust, launchReportFor, manifestOperations, parseYamlNested, servedIdentityOf, teamEnv, upgradeHomeMeta, withConfigFile } from "./core.mjs";
-import { agentDirOf, discoverOrStandalone, ensureWorkspaceSoul, findSoulEntry, liveTeams, prepareInstance } from "./instance-resolution.mjs";
+import { agentDirOf, discoverOrStandalone, ensureWorkspaceSoul, findSoulEntry, liveTeams, prepareInstance, soulCopyDigests } from "./instance-resolution.mjs";
 import { declaredSettings } from "./capability-contract.mjs";
 import { kernelCompatibility } from "./resolve.mjs";
 import { discoveredTeamKeys, isRemovedTeamKeys, isTeamRefusal, recordedTeams, reportRows, soulKeyOf, teamKeyOf, soulTeams, teamModel, teamProblems } from "./teams.mjs";
@@ -133,7 +133,8 @@ export async function homeTarget(home, meta, { remoteOptions, discover = true, l
     kind: "instance", home: realHome, meta, deployment, agentsRoot, teams: live.teams, defaultTeam: live.defaultTeam ?? null, teamsSource: live.source, launch, launchCurrent, session: newSessionDefaults(deployment),
     recordedDefaultTeam: recordedTeams(meta).defaultTeam, teamModel: model, teamKey,
     subject: { kind: "instance", instance: meta.instance, home, soul: meta.agent },
-    soul: { name: meta.agent, repoKey: ws.soul?.repoKey ?? null, commit: ws.soul?.commit ?? null, external, path: null, soulDir, definition, problems: [...problems, ...loadProblems] },
+    soul: { name: meta.agent, repoKey: ws.soul?.repoKey ?? null, commit: ws.soul?.commit ?? null, external, path: null, soulDir, definition, problems: [...problems, ...loadProblems],
+      ...(obj(ws.soul?.package) && typeof ws.soul.package.id === "string" ? { package: { id: ws.soul.package.id, soul: ws.soul.name ?? meta.agent, version: ws.soul.package.version ?? null, commit: ws.soul.package.commit ?? ws.soul.commit ?? null, integrity: ws.soul.package.digest ?? null } } : {}) },
     workspace: { key: ws.key ?? null, name: typeof ws.name === "string" ? ws.name : discovery?.workspace?.name ?? null, deployment, commit: ws.commit ?? null, standalone: ws.standalone === true },
     modules: Object.keys(modules).sort().map((name) => ({ name, from: modules[name]?.from ?? null, manifest: manifests[name] ?? null, dir: join(realHome, ".oats", "modules", name) })),
     payloads: obj(meta.providers) ? meta.providers : {},
@@ -189,7 +190,8 @@ export async function soulTarget(contextDir, soul, { remoteOptions } = {}) {
     kind: "soul", home: null, meta: null, deployment, agentsRoot: join(deployment, "agents"), teams, defaultTeam, teamsSource: "live", teamModel: model, teamKey, launch, session: newSessionDefaults(deployment),
     subject: { kind: "soul", soul: soulEntry.name, repoKey: soulEntry.repoKey ?? null, commit: soulEntry.commit ?? null },
     soul: { name: soulEntry.name, repoKey: soulEntry.repoKey ?? null, commit: soulEntry.commit ?? null, external: soulEntry.external === true, path: soulEntry.path ?? null,
-      soulDir, definition: soulEntry.definition ?? null, problems: [], ...(soulCopyError ? { copyError: soulCopyError } : {}) },
+      soulDir, definition: soulEntry.definition ?? null, problems: [], ...(soulCopyError ? { copyError: soulCopyError } : {}),
+      ...(typeof soulEntry.package === "string" ? { package: { id: soulEntry.package, soul: soulEntry.name, version: soulEntry.version ?? null, commit: soulEntry.commit ?? null, integrity: soulEntry.digest ?? null } } : {}) },
     workspace: { key: discovery?.key ?? null, name: discovery?.workspace?.name ?? null, deployment, commit: discovery?.commit ?? null, standalone: discovery?.standalone === true },
     modules: (res?.modules || []).map((m) => ({ name: m.name, from: m.from ?? null, manifest: m.manifest ?? null, dir: null, module: m })).sort((a, b) => a.name.localeCompare(b.name)),
     payloads: obj(res?.payloads) ? res.payloads : {}, payloadOrigins: obj(res?.payloadOrigins) ? res.payloadOrigins : {}, slots: obj(res?.slots) ? res.slots : Object.fromEntries(LAYERS.map((l) => [l, null])), slotsFrom: obj(res?.slotsFrom) ? res.slotsFrom : {},
@@ -404,6 +406,48 @@ export function runProviderCheck(t, mod, dir, { timeoutMs = 30000 } = {}) {
     || (res.status === "ready" && res.problems.length)) return invalid();
   return { outcome: "result", result: { status: res.status, problems: codeMessages(res.problems), warnings: codeMessages(res.warnings ?? []) } };
 }
+/** The `member` item of a package soul. A package soul is trusted through the workspace's
+ *  `packages:` pin (the lock's commit and integrity), never through membership: its
+ *  repository is not a member and need not be (docs/workspaces.md, the non-collapse rule).
+ *  It passes when the discovery lists the soul from the lock (the package declared and
+ *  locked, the soul shipped at the locked commit) and the soul's copy is intact: for a
+ *  soul, the copy a spawn would link matches the locked digest; for a home, its copy
+ *  matches the digest it recorded, and a lock still at that commit records the same one.
+ *  A copy is digested every read: a complete copy is reused, never refetched. */
+function packageSoulItem(t, d) {
+  const p = t.soul.package;
+  const subject = `package ${p.id}/${p.soul}`;
+  const from = { kind: "package", package: p.id, version: p.version, commit: p.commit, integrity: p.integrity };
+  const evidence = { repoKey: t.soul.repoKey, workspace: d?.key ?? null, commit: p.commit, version: p.version, integrity: p.integrity, from };
+  if (!d) return item(subject, "unknown", { producer: "workspace discovery", reason: t.discoveryError ? `the workspace could not be read: ${t.discoveryError.message}` : "no workspace observation", evidence });
+  if (d.standalone === true) return item(subject, "not-applicable", { required: false, producer: "workspace discovery", reason: `standalone view (${d.standaloneReason ?? "explicit"}): the workspace's packages: is not read, so the package pin is recorded, not observed`, evidence });
+  const shipped = (d.packageSouls || []).filter((s) => s.package === p.id);
+  const live = shipped.find((s) => s.name === p.soul);
+  if (!live) {
+    return item(subject, "fail", { producer: "workspace lock", evidence,
+      reason: shipped.length ? `the version of ${p.id} locked in this workspace does not ship the soul ${p.soul}` : `${p.id} is not locked in this workspace's packages:`,
+      remedy: shipped.length ? `pin a release of ${p.id} that ships ${p.soul} in the workspace's packages:, then oats sync` : `declare ${p.id} in the workspace's packages:, then oats sync` });
+  }
+  const integrity = (reason, remedy) => item(subject, "fail", { producer: "workspace lock", code: "E_PACKAGE_INTEGRITY", reason, evidence, remedy });
+  const lockRemedy = "oats sync (a lock that was edited: remove the entry and sync again)";
+  const copy = t.soul.copyError;
+  if (copy?.code === "E_PACKAGE_INTEGRITY") return integrity(copy.message, lockRemedy);
+  const dir = t.soul.soulDir;
+  if (!dir) return item(subject, "unknown", { producer: "workspace lock", reason: "the soul's copy is not available, so its integrity cannot be checked", evidence });
+  const expected = t.home ? "recorded" : "locked";
+  let digests;
+  try { digests = soulCopyDigests(dir); }
+  catch (e) { return integrity(`the soul's copy at ${dir} cannot be digested: ${e.message}`, `move ${dir} aside, then spawn again (a fresh copy is fetched and verified)`); }
+  if (!digests.includes(p.integrity)) {
+    return integrity(`the soul's copy at ${dir} digests ${digests.at(-1)}, not the ${expected} ${p.integrity}${t.home ? "" : " (the lock's)"}`,
+      t.home ? `the copy changed after its spawn, and a spawn reuses it: move ${dir} aside, then spawn a new instance of ${p.id}/${p.soul} (a fresh copy is fetched and verified against the lock)` : `move ${dir} aside, then spawn again (a fresh copy is fetched and verified against the lock); if the lock was edited: ${lockRemedy}`);
+  }
+  if (t.home && live.commit === p.commit && live.digest !== p.integrity) {
+    return integrity(`the lock records ${live.digest} for the same commit ${String(p.commit).slice(0, 12)}; this home recorded ${p.integrity} at its spawn`, lockRemedy);
+  }
+  return item(subject, "pass", { producer: "workspace lock", evidence });
+}
+
 /** The total time the providers check may take in one readiness read. */
 export const PROVIDER_CHECK_BUDGET_MS = 60_000;
 
@@ -430,9 +474,11 @@ export async function readinessDocument(t, { selector = null, remoteOptions, cat
   }
   configured.push(...teamItems(t), ...launchItems(t), ...folderTrustItems(t));
   // member — the soul's member repository is a confirmed member of the workspace
-  // (oats-membership.yaml backlink observed over the remotes).
+  // (oats-membership.yaml backlink observed over the remotes); a package soul's is its
+  // package instead (packageSoulItem).
   const d = t.discovery;
-  if (t.soul.external) member.push(item(`soul ${t.soul.name}`, "not-applicable", { required: false, producer: "workspace discovery", reason: "an external soul is declared by the workspace; it has no member repository", evidence: { repoKey: t.soul.repoKey } }));
+  if (t.soul.package) member.push(packageSoulItem(t, d));
+  else if (t.soul.external) member.push(item(`soul ${t.soul.name}`, "not-applicable", { required: false, producer: "workspace discovery", reason: "an external soul is declared by the workspace; it has no member repository", evidence: { repoKey: t.soul.repoKey } }));
   else if (!d) member.push(item(`member ${t.soul.repoKey ?? "?"}`, "unknown", { producer: "workspace discovery", reason: t.discoveryError ? `the workspace could not be read: ${t.discoveryError.message}` : "no workspace observation", evidence: { repoKey: t.soul.repoKey } }));
   // A standalone view is an allowed mode (decision 10): membership cannot be confirmed
   // there by definition, so it is not a readiness requirement (as for an external soul).

package/lib/instance-resolution.mjs

@@ -16,7 +16,7 @@
  *
  *  Nothing here reads `oats-config.yaml`, an installed-capability directory or a
  *  per-soul `source:` — those do not exist in this model. */
-import { existsSync, readFileSync, readdirSync, lstatSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, lstatSync, readlinkSync, realpathSync } from "node:fs";
 import { join, resolve as resolvePath, dirname, relative, isAbsolute, sep } from "node:path";
 import { oatsError } from "./errors.mjs";
 import { loadLocal, discoverWorkspace, discoverRepo, standaloneRepo, observeWorkspace } from "./workspace.mjs";
@@ -25,7 +25,7 @@ import { BY_TEAM_REMOVED, isRemovedTeamKeys, isTeamRefusal, memberNameOf, record
 import { launchLayers } from "./launch-preference.mjs";
 import { declaredSettings } from "./capability-contract.mjs";
 import { materialize, moduleSkills, MODULES_DIR, SKILLS_DIR } from "./materialize.mjs";
-import { fetchRemoteTree } from "./remote.mjs";
+import { contentDigest, fetchRemoteTree } from "./remote.mjs";
 import { mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync, symlinkSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -232,6 +232,19 @@ async function fetchSoulSource(prepared, dest) {
   if (!existsSync(join(dest, "CLAUDE.md"))) symlinkSync("AGENTS.md", join(dest, "CLAUDE.md"));
 }
 
+/** The digests a soul copy may carry as its source was fetched (fetchSoulSource): the copy itself, and,
+ *  when it holds the CLAUDE.md → AGENTS.md alias, the copy without it, since fetchSoulSource adds that
+ *  alias to a source that has none. A package soul's copy is intact when one of them is its digest. */
+export function soulCopyDigests(dir) {
+  const options = { allowSymlinks: SOUL_ALIAS_SYMLINK };
+  const alias = join(dir, "CLAUDE.md");
+  let aliased = false;
+  try { aliased = lstatSync(alias).isSymbolicLink() && readlinkSync(alias) === "AGENTS.md"; } catch { aliased = false; }
+  const digests = [contentDigest(dir, options)];
+  if (aliased) digests.push(contentDigest(dir, { ...options, omit: (rel) => rel === "CLAUDE.md" }));
+  return digests;
+}
+
 /** A preview's soul source. A preview writes NOTHING in the deployment (K6b), so it
  *  never populates the per-commit cache or moves the `soul` pointer: it reads the
  *  cache entry for the prepared commit when one is already complete, else fetches

package/lib/remote.mjs

@@ -2139,7 +2139,8 @@ function createDigest() {
 }
 
 /** Same digest as fetchRemoteTree, computed over a local directory. Symlinks and
- * non-regular entries are refused (E_REMOTE_TREE_UNSAFE); a missing dir → E_REMOTE_PATH_MISSING. */
+ * non-regular entries are refused (E_REMOTE_TREE_UNSAFE); a missing dir → E_REMOTE_PATH_MISSING.
+ * `omit(relPath, absPath)` → true leaves an entry out (what a copy gained after its fetch). */
 function posixNormalize(p) {
   const out = [];
   for (const seg of p.split("/")) { if (!seg || seg === ".") continue; if (seg === "..") { if (out.length && out.at(-1) !== "..") out.pop(); else out.push(".."); } else out.push(seg); }
@@ -2155,7 +2156,7 @@ function posixNormalize(p) {
  */
 export const OATS_ALIAS_SYMLINK = (relPath) => typeof relPath === "string" && (relPath === "CLAUDE.md" || relPath.endsWith("/CLAUDE.md"));
 
-export function contentDigest(dir, { allowSymlinks = null } = {}) {
+export function contentDigest(dir, { allowSymlinks = null, omit = null } = {}) {
   if (typeof dir !== "string" || !isAbsolute(dir)) throw fail("E_REPO_REF", "contentDigest requires an absolute directory path", { path: dir });
   let st;
   try { st = lstatSync(dir); } catch { throw fail("E_REMOTE_PATH_MISSING", `${dir} does not exist`, { path: dir }); }
@@ -2165,6 +2166,7 @@ export function contentDigest(dir, { allowSymlinks = null } = {}) {
     for (const name of readdirSync(abs)) {
       if (!rel && name === ".git") continue; // a local checkout's metadata is not content
       const p = join(abs, name), r = rel ? `${rel}/${name}` : name, s = lstatSync(p);
+      if (typeof omit === "function" && omit(r, p)) continue;
       if (s.isSymbolicLink()) {
         // Refused by default (contract §1). The same narrow opt-in fetchRemoteTree
         // honours (a relative, non-escaping alias such as CLAUDE.md → AGENTS.md)

package/package-catalog.json

@@ -8,7 +8,7 @@
     },
     "oats.aweb": {
       "url": "https://github.com/awebai/oats-aweb.git",
-      "ref": "v1.21.0",
+      "ref": "v1.21.1",
       "path": "oats-package"
     },
     "oats.jira": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.39.0",
+  "version": "0.39.1",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",