@crvouga/dev-fleet 0.8.0 → 0.9.0

package/schema/check-ids.json

@@ -1,606 +1,2403 @@
 {
-  "$comment": "Every check ID dev-fleet reports, and what a passing check means. A * stands for a name (an agent, a tool, a phase). features/rules/contracts.feature fails when the code reports an ID this registry lacks, or this registry names one the code no longer reports.",
+  "$comment": "Generated by `bun src/check-registry.ts > schema/check-ids.json` from the checks the code reports; features/rules/contracts.feature fails when this file differs. Every check ID dev-fleet reports: what a passing check means; severity, required (a failure blocks readiness unless the run marks the check out of scope) or advisory (reported as a warning or as not required, never blocking); and repair, the fleet-repair recipe that repairs it or the reason only a person can (manual); requirement, a requirement docs/worker-requirements.md lists. A * stands for a name taken from the fleet configuration, a machine or a tool at run time.",
   "version": 1,
   "checks": [
     {
       "id": "accounts:native-login",
-      "meaning": "This machine holds no provider login of its own outside the proxy."
+      "meaning": "This machine holds no provider login of its own outside the proxy.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "accounts:roster-current",
-      "meaning": "This machine offers exactly the accounts of the proxy's current account roster."
+      "meaning": "This machine offers exactly the accounts of the proxy's current account roster.",
+      "severity": "required",
+      "repair": {
+        "manual": "The roster reaches every node with devfleet fleet-sync --only accounts, run from the manager."
+      }
     },
     {
       "id": "accounts:verification",
-      "meaning": "The provider accounts this machine offers were verified; fails when verification could not run."
+      "meaning": "The provider accounts this machine offers were verified; fails when verification could not run.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
-      "id": "agent:*",
-      "meaning": "A coding agent CLI is installed at its pinned version on this machine."
+      "id": "agent:*:*:*",
+      "meaning": "A coding agent launches with its fleet profile on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
-      "id": "agent:*:*:*",
-      "meaning": "A coding agent launches with its fleet profile on this machine."
+      "id": "agent:*:account-*:session",
+      "meaning": "An agent instance of one proxy account is signed in and usable on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
       "id": "agent:*:removed-*:session",
-      "meaning": "This machine offers no agent instance for an account the proxy no longer holds."
+      "meaning": "This machine offers no agent instance for an account the proxy no longer holds.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:antigravity",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:antigravity:session",
+      "meaning": "The shared account of a coding agent is signed in and usable.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:antigravity:version",
+      "meaning": "A coding agent runs the version the fleet pins.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:claude",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:claude:session",
+      "meaning": "The shared account of a coding agent is signed in and usable.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:claude:version",
+      "meaning": "A coding agent runs the version the fleet pins.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:codex",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:codex:session",
+      "meaning": "The shared account of a coding agent is signed in and usable.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:codex:version",
+      "meaning": "A coding agent runs the version the fleet pins.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
-      "id": "agent:*:session",
-      "meaning": "The shared account of a coding agent is signed in and usable."
+      "id": "agent:copilot",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
-      "id": "agent:*:version",
-      "meaning": "A coding agent runs the version the fleet pins."
+      "id": "agent:cursor",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:gemini",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:grok",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:grok:session",
+      "meaning": "The shared account of a coding agent is signed in and usable.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:grok:version",
+      "meaning": "A coding agent runs the version the fleet pins.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:muse:session",
+      "meaning": "The shared account of a coding agent is signed in and usable.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:muse:version",
+      "meaning": "A coding agent runs the version the fleet pins.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:opencode",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
       "id": "agent:profiles",
-      "meaning": "The fleet's agent profiles are written on this machine."
+      "meaning": "The fleet's agent profiles are written on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
       "id": "agent:service-environment",
-      "meaning": "The environment agent services start with is complete."
+      "meaning": "The environment agent services start with is complete.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "agent:t3",
+      "meaning": "A coding agent CLI is installed at its pinned version on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
     },
     {
       "id": "agent:verification",
-      "meaning": "Every coding agent was verified; fails when verification could not run."
+      "meaning": "Every coding agent was verified; fails when verification could not run.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the machine with fleet-sync; an agent that needs a sign-in is a person’s."
+      }
+    },
+    {
+      "id": "auth:antigravity",
+      "meaning": "Not applicable: antigravity has no sign-in of its own on this machine; its summary names the check that proves its access instead.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
-      "id": "auth:*",
-      "meaning": "A required login or capability works in this process context."
+      "id": "auth:aws",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:aws"
+      }
+    },
+    {
+      "id": "auth:claude",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:claude"
+      }
+    },
+    {
+      "id": "auth:cloudflare",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:cloudflare"
+      }
+    },
+    {
+      "id": "auth:codex",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:codex"
+      }
     },
     {
       "id": "auth:copilot",
-      "meaning": "Copilot CLI uses the node's GitHub sign-in with a token it accepts."
+      "meaning": "Copilot CLI uses the node's GitHub sign-in with a token it accepts.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:copilot"
+      }
+    },
+    {
+      "id": "auth:gemini",
+      "meaning": "Not applicable: gemini has no sign-in of its own on this machine; its summary names the check that proves its access instead.",
+      "severity": "advisory",
+      "repair": {
+        "recipe": "login:gemini"
+      }
     },
     {
       "id": "auth:github",
-      "meaning": "gh answers auth status in this context."
+      "meaning": "gh answers auth status in this context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:github"
+      }
+    },
+    {
+      "id": "auth:grok",
+      "meaning": "Not applicable: grok has no sign-in of its own on this machine; its summary names the check that proves its access instead.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "auth:npm",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:npm"
+      }
+    },
+    {
+      "id": "auth:opencode",
+      "meaning": "Not applicable: opencode has no sign-in of its own on this machine; its summary names the check that proves its access instead.",
+      "severity": "advisory",
+      "repair": {
+        "recipe": "login:opencode"
+      }
+    },
+    {
+      "id": "auth:railway",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:railway"
+      }
+    },
+    {
+      "id": "auth:services",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "auth:t3",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "auth:toolchain",
-      "meaning": "The pinned toolchain, dependencies and Docker could be checked."
+      "meaning": "The pinned toolchain, dependencies and Docker could be checked.",
+      "severity": "required",
+      "repair": {
+        "recipe": "workspace"
+      }
     },
     {
       "id": "auth:vault",
-      "meaning": "This machine has its own Vault session."
+      "meaning": "This machine has its own Vault session.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:vault"
+      }
     },
     {
       "id": "auth:vault-isolation",
-      "meaning": "A worker reads its Vault token from a document of its own, not from the fleet's shared one."
+      "meaning": "A worker reads its Vault token from a document of its own, not from the fleet's shared one.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "auth:vercel",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "recipe": "login:vercel"
+      }
+    },
+    {
+      "id": "auth:vscode",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "auth:worker",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "auth:worker-token",
-      "meaning": "A worker has a Vault token of its own that only it and the manager can read, or a retired worker's token is revoked."
+      "meaning": "A worker has a Vault token of its own that only it and the manager can read, or a retired worker's token is revoked.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
-      "id": "beszel:*",
-      "meaning": "A monitoring (Beszel) check of this machine."
+      "id": "auth:workstation",
+      "meaning": "A required login or capability works in this process context.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "beszel:access",
-      "meaning": "The monitoring dashboard answers privately."
+      "meaning": "The monitoring dashboard answers privately.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
+    },
+    {
+      "id": "beszel:api",
+      "meaning": "The monitoring hub's API answers this account for this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:backup",
-      "meaning": "The monitoring hub's data is backed up."
+      "meaning": "The monitoring hub's data is backed up.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
+    },
+    {
+      "id": "beszel:connection",
+      "meaning": "The monitoring hub reports this machine connected.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:disk",
-      "meaning": "The monitoring hub's disk use could be verified."
+      "meaning": "The monitoring hub's disk use could be verified.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:enrollment",
-      "meaning": "This machine is enrolled in the monitoring hub."
+      "meaning": "This machine is enrolled in the monitoring hub.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
+    },
+    {
+      "id": "beszel:freshness",
+      "meaning": "The monitoring hub received a sample from this machine within 180 seconds.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:hub",
-      "meaning": "The monitoring hub runs on the manager."
+      "meaning": "The monitoring hub runs on the manager.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:hub-connection",
-      "meaning": "The monitoring agent reaches the hub."
+      "meaning": "The monitoring agent reaches the hub.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:installation",
-      "meaning": "The monitoring agent is installed at its pinned version."
+      "meaning": "The monitoring agent is installed at its pinned version.",
+      "severity": "required",
+      "repair": {
+        "recipe": "monitoring"
+      }
+    },
+    {
+      "id": "beszel:leftover",
+      "meaning": "The monitoring hub watches no system that matches no declared worker.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:lock",
-      "meaning": "Monitoring changes could take the machine's operation lock."
+      "meaning": "Monitoring changes could take the machine's operation lock.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:operation",
-      "meaning": "The monitoring operation completed."
+      "meaning": "The monitoring operation completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:protocol",
-      "meaning": "The machine's monitoring evidence is a valid fleet document."
+      "meaning": "The machine's monitoring evidence is a valid fleet document.",
+      "severity": "required",
+      "repair": {
+        "recipe": "monitoring"
+      }
     },
     {
       "id": "beszel:public-endpoint",
-      "meaning": "The public monitoring dashboard answers."
+      "meaning": "The public monitoring dashboard answers.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:public-viewer",
-      "meaning": "The public read-only viewer account works."
+      "meaning": "The public read-only viewer account works.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
+    },
+    {
+      "id": "beszel:registration",
+      "meaning": "The monitoring hub holds exactly one system record for this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "beszel:service",
-      "meaning": "The monitoring agent service runs."
+      "meaning": "The monitoring agent service runs.",
+      "severity": "required",
+      "repair": {
+        "recipe": "monitoring"
+      }
+    },
+    {
+      "id": "beszel:system",
+      "meaning": "The monitoring hub's system for a replaced worker watches the new machine, or a retired worker's system is gone.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
-      "id": "bootstrap:*",
-      "meaning": "A phase of the remote bootstrap (lock, resources, source-transfer, prerequisites, source-verification, toolchain, configuration and others) completed."
+      "id": "beszel:version",
+      "meaning": "The monitoring hub runs the pinned Beszel release.",
+      "severity": "required",
+      "repair": {
+        "manual": "The monitoring hub and its accounts are converged by fleet-sync on the manager; follow the remedy, then run fleet-sync."
+      }
     },
     {
       "id": "bootstrap:attached",
-      "meaning": "The manager followed this machine's running operation of the same revision and reports its result."
+      "meaning": "The manager followed this machine's running operation of the same revision and reports its result.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:bootstrap",
+      "meaning": "The worker is a supported Ubuntu release and architecture, not a container or WSL2, reached as a non-root account, and its fleet state directory is safe.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:cleanup",
+      "meaning": "Revision checkouts beyond the current, the applied and the two most recent were removed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:configuration",
+      "meaning": "The node converged at the revision: its configuration, services and evidence.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:configuration-install",
+      "meaning": "The fleet configuration was written on the worker under its operation lock.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "bootstrap:exit",
-      "meaning": "The remote bootstrap exited without failure."
+      "meaning": "The remote bootstrap exited without failure.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:first-boot",
+      "meaning": "The machine's own first boot (cloud-init) has finished, or it has none.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:lock",
+      "meaning": "The bootstrap holds the worker's fleet operation lock.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:prerequisites",
+      "meaning": "The packages the bootstrap needs are installed; an interrupted package run was finished first.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "bootstrap:privilege",
-      "meaning": "The development account may use sudo without a password."
+      "meaning": "The development account may use sudo without a password.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      },
+      "requirement": true
     },
     {
       "id": "bootstrap:protocol",
-      "meaning": "The remote bootstrap answered with a valid fleet document."
+      "meaning": "The remote bootstrap answered with a valid fleet document.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:resources",
+      "meaning": "The home file system has the space and inodes the bootstrap needs.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:source-transfer",
+      "meaning": "The source bundle arrived with the digest the manager sent.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:source-verification",
+      "meaning": "The fleet-owned checkout holds exactly the revision, with no change fleet-sync did not make.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:tailnet-key",
+      "meaning": "The single-use tailnet key was handed to the worker in a root-only file.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "bootstrap:toolchain",
+      "meaning": "The pinned toolchain converged.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "configuration:apply",
-      "meaning": "The node's configuration (agent profiles, launcher) was applied."
+      "meaning": "The node's configuration (agent profiles, launcher) was applied.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "configuration:operation",
-      "meaning": "The remote configuration operation completed."
+      "meaning": "The remote configuration operation completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "definition:inventory",
-      "meaning": "Ansible reads the inventory the fleet definition describes."
+      "meaning": "Ansible reads the inventory the fleet definition describes.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "definition:playbooks",
-      "meaning": "Every playbook passes ansible-playbook --syntax-check."
+      "meaning": "Every playbook passes ansible-playbook --syntax-check.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "definition:schema",
-      "meaning": "fleet.json follows every rule of the fleet definition."
+      "meaning": "fleet.json follows every rule of the fleet definition.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
+    },
+    {
+      "id": "dependencies",
+      "meaning": "The checkout's dependencies are installed as its lockfile and inputs declare.",
+      "severity": "required",
+      "repair": {
+        "recipe": "workspace"
+      }
     },
     {
       "id": "enrollment:connection",
-      "meaning": "The manager has an enrolled connection to this worker."
+      "meaning": "The manager has an enrolled connection to this worker.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
+    },
+    {
+      "id": "enrollment:record",
+      "meaning": "A worker whose record disappeared was retired.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "fleet:enrollment:*",
-      "meaning": "A declared worker has a verified SSH and checkout registration."
+      "meaning": "A declared worker has a verified SSH and checkout registration.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "fleet:probe",
-      "meaning": "The remote probe could be prepared and completed."
+      "meaning": "The remote probe could be prepared and completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "fleet:registration",
-      "meaning": "The machine is registered in the roster."
+      "meaning": "The machine is registered in the roster.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "fleet:roster",
-      "meaning": "A fleet roster is configured."
+      "meaning": "A fleet roster is configured.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "git:clean",
-      "meaning": "The checkout has no uncommitted changes."
+      "meaning": "The checkout has no uncommitted changes.",
+      "severity": "required",
+      "repair": {
+        "manual": "Uncommitted or unpushed work belongs to a person; dev-fleet never resets a checkout."
+      }
     },
     {
       "id": "git:configuration",
-      "meaning": "The declared Git identity and the GitHub credential helper are written in the node's global Git configuration."
+      "meaning": "The declared Git identity and the GitHub credential helper are written in the node's global Git configuration.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync writes the Git identity and credential helper with ansible/github/git.yml; run it from the manager."
+      }
     },
     {
       "id": "github:expiry",
-      "meaning": "The GitHub token does not expire within the warning window."
+      "meaning": "The GitHub token does not expire within the warning window.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one."
+      }
     },
     {
       "id": "github:git-credential",
-      "meaning": "git asks gh for its GitHub credential."
+      "meaning": "git asks gh for its GitHub credential.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync writes the GitHub credential helper with ansible/github/git.yml when the git block is declared; run it from the manager."
+      }
     },
     {
       "id": "github:org-access",
-      "meaning": "Single sign-on has authorised the GitHub token for each declared organisation."
+      "meaning": "Single sign-on has authorised the GitHub token for each declared organisation.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one."
+      }
     },
     {
       "id": "github:permissions",
-      "meaning": "The GitHub token has every declared scope and can push to every declared repository."
+      "meaning": "The GitHub token has every declared scope and can push to every declared repository.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one."
+      }
     },
     {
       "id": "github:principal",
-      "meaning": "The node is signed in to GitHub as its declared login."
+      "meaning": "The node is signed in to GitHub as its declared login.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one."
+      }
     },
     {
       "id": "github:rate-limit",
-      "meaning": "The GitHub rate limit left is above the warning floor."
+      "meaning": "The GitHub rate limit left is above the warning floor.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "github:sync",
-      "meaning": "fleet-sync signed this node in to GitHub from the stored credential."
+      "meaning": "fleet-sync signed this node in to GitHub from the stored credential.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one."
+      }
     },
     {
       "id": "github:token-current",
-      "meaning": "The node uses the GitHub token the store holds now."
+      "meaning": "The node uses the GitHub token the store holds now.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync signs every node in to GitHub from the stored github-token (a worker retries every ten minutes); a token that is missing, expired or short of a scope or organisation needs a person to issue a new one."
+      }
     },
     {
       "id": "github:workflow",
-      "meaning": "fleet-github-verify completed clone, branch, commit, push, pull request, checks and comment on the sandbox repository."
+      "meaning": "fleet-github-verify completed clone, branch, commit, push, pull request, checks and comment on the sandbox repository.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
-      "id": "login:*",
-      "meaning": "A native per-machine login is in place."
+      "id": "manager:boot-recovery",
+      "meaning": "The manager comes back by itself after a power cut or reboot.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
     },
     {
-      "id": "manager:boot-recovery",
-      "meaning": "The manager comes back by itself after a power cut or reboot."
+      "id": "manager:clock",
+      "meaning": "The manager keeps its clock on network time.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:container-watchdog",
+      "meaning": "No container on the manager was capped or restarted by the container watchdog within the last hour.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:disk",
+      "meaning": "The manager's data volume has the free space the macOS policy asks for.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
     },
     {
       "id": "manager:docker",
-      "meaning": "The manager runs the pinned Docker Desktop."
+      "meaning": "The manager runs the pinned Docker Desktop.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Docker Desktop is installed and updated by a person; no playbook installs it."
+      }
     },
     {
       "id": "manager:identity",
-      "meaning": "This machine is the declared fleet manager."
+      "meaning": "This machine is the declared fleet manager.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
+    },
+    {
+      "id": "manager:job-logs",
+      "meaning": "newsyslog keeps the logs of the manager's scheduled jobs under the size the macOS policy names.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:playbook",
+      "meaning": "The manager playbook passed its check-mode run and was applied, or is unchanged since and its postconditions hold.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
     },
     {
       "id": "manager:power",
-      "meaning": "The manager never sleeps on AC power."
+      "meaning": "The manager never sleeps on AC power.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
     },
     {
       "id": "manager:preflight",
-      "meaning": "fleet-sync could start on the manager; its summary names the reason when not."
+      "meaning": "fleet-sync could start on the manager; its summary names the reason when not.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:release",
+      "meaning": "The manager runs at least the macOS release the macOS policy requires.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
     },
     {
       "id": "manager:schedule",
-      "meaning": "The manager's schedule converged the fleet within two of its intervals."
+      "meaning": "The manager's schedule converged the fleet within two of its intervals.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:updates",
+      "meaning": "No macOS update is pending on the manager.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:vault-renewal",
+      "meaning": "The manager is logged in to Vault and its launch agent renews the session.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
+    },
+    {
+      "id": "manager:watch",
+      "meaning": "fleet-watch runs on the manager on a schedule, so the heartbeat reaches the bucket.",
+      "severity": "required",
+      "repair": {
+        "manual": "The manager converges itself in fleet-sync; what needs an administrator is granted once with ansible-playbook -e user=$(id -un) -K ansible/macos/manager-privilege.yml."
+      }
     },
     {
       "id": "notify:configured",
-      "meaning": "Every notification target fleet.json names has its address available as a secret."
+      "meaning": "Every notification target fleet.json names has its address available as a secret.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
+    },
+    {
+      "id": "notify:ntfy",
+      "meaning": "A notification target fleet.json names took the notification.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
+    },
+    {
+      "id": "notify:webhook",
+      "meaning": "A notification target fleet.json names took the notification.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
     },
     {
       "id": "platform:environment",
-      "meaning": "The worker runs on a physical or virtual machine of its own, not in a container or WSL2."
+      "meaning": "The worker runs on a physical or virtual machine of its own, not in a container or WSL2.",
+      "severity": "required",
+      "repair": {
+        "manual": "It is a property of the hardware, the firmware or the operating system release, which no command changes."
+      },
+      "requirement": true
+    },
+    {
+      "id": "platform:machine-class",
+      "meaning": "The probe recorded the class of the worker (physical or virtual machine) before anything is installed; a virtual machine reports firmware power recovery and lid policy as not applicable.",
+      "severity": "required",
+      "repair": {
+        "manual": "It is a property of the hardware, the firmware or the operating system release, which no command changes."
+      }
     },
     {
       "id": "platform:unsupported",
-      "meaning": "The machine runs a supported operating system."
+      "meaning": "The machine runs a supported operating system.",
+      "severity": "required",
+      "repair": {
+        "manual": "It is a property of the hardware, the firmware or the operating system release, which no command changes."
+      }
+    },
+    {
+      "id": "platform:worker-size",
+      "meaning": "The worker has at least the stated minimum memory, root filesystem and CPUs (sizing.minimumWorker in the Ubuntu policy), measured before anything is installed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It is a property of the hardware, the firmware or the operating system release, which no command changes."
+      },
+      "requirement": true
+    },
+    {
+      "id": "provider:antigravity:authentication",
+      "meaning": "A proxy provider authenticates unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:antigravity:inference",
+      "meaning": "A proxy provider answers a bounded inference round trip.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
-      "id": "provider:*:authentication",
-      "meaning": "A proxy provider authenticates unattended."
+      "id": "provider:claude:authentication",
+      "meaning": "A proxy provider authenticates unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
-      "id": "provider:*:inference",
-      "meaning": "A proxy provider answers a bounded inference round trip."
+      "id": "provider:claude:inference",
+      "meaning": "A proxy provider answers a bounded inference round trip.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:codex:authentication",
+      "meaning": "A proxy provider authenticates unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:codex:inference",
+      "meaning": "A proxy provider answers a bounded inference round trip.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:gemini:authentication",
+      "meaning": "A proxy provider authenticates unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:gemini:inference",
+      "meaning": "A proxy provider answers a bounded inference round trip.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:grok:authentication",
+      "meaning": "A proxy provider authenticates unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:grok:inference",
+      "meaning": "A proxy provider answers a bounded inference round trip.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:muse:authentication",
+      "meaning": "A proxy provider authenticates unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "provider:muse:inference",
+      "meaning": "A proxy provider answers a bounded inference round trip.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "provider:verification",
-      "meaning": "Every proxy provider was verified; fails when verification could not run."
+      "meaning": "Every proxy provider was verified; fails when verification could not run.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "proxy:*",
-      "meaning": "A phase of the CLI proxy's reconciliation completed."
+      "meaning": "A phase of the CLI proxy's reconciliation completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "The CLI proxy is installed with devfleet cliproxy install and its accounts are signed in by a person."
+      }
     },
     {
       "id": "proxy:account:*",
-      "meaning": "A provider has at least one usable account signed in on the CLI proxy."
+      "meaning": "A provider has at least one usable account signed in on the CLI proxy.",
+      "severity": "required",
+      "repair": {
+        "manual": "The CLI proxy is installed with devfleet cliproxy install and its accounts are signed in by a person."
+      }
     },
     {
       "id": "proxy:configuration",
-      "meaning": "The CLI proxy's configuration was reconciled."
+      "meaning": "The CLI proxy's configuration was reconciled.",
+      "severity": "required",
+      "repair": {
+        "manual": "The CLI proxy is installed with devfleet cliproxy install and its accounts are signed in by a person."
+      }
     },
     {
       "id": "proxy:reachable-from",
-      "meaning": "This machine reaches the CLI proxy, and how fast."
-    },
-    {
-      "id": "repair:*",
-      "meaning": "An automated repair completed."
+      "meaning": "This machine reaches the CLI proxy, and how fast.",
+      "severity": "required",
+      "repair": {
+        "manual": "The CLI proxy is installed with devfleet cliproxy install and its accounts are signed in by a person."
+      },
+      "requirement": true
     },
     {
       "id": "repair:inputs",
-      "meaning": "The checkout inputs are unchanged since the diagnostics a repair plan used."
+      "meaning": "The checkout inputs are unchanged since the diagnostics a repair plan used.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "repair:operation",
-      "meaning": "A repair could be prepared and completed."
+      "meaning": "A repair could be prepared and completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "repair:providers",
+      "meaning": "An automated repair completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "repair:recheck",
-      "meaning": "Diagnostics completed again after a repair."
+      "meaning": "Diagnostics completed again after a repair.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "repair:workspace",
-      "meaning": "A complete checkout exists for repairs."
+      "meaning": "A complete checkout exists for repairs.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "repair:workstation",
+      "meaning": "An automated repair completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "restore:applied",
+      "meaning": "A replacement manager holds the fleet state from the bucket.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:bucket",
+      "meaning": "The bucket is named in fleet.json, with credentials for it.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:configuration",
+      "meaning": "The project's fleet.json is found and valid.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:container-engine",
+      "meaning": "The container engine answers on the replacement manager.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:git",
+      "meaning": "Git is installed on the replacement manager.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:host-name",
+      "meaning": "The replacement manager has the host name fleet.json gives the manager.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:state",
+      "meaning": "The bucket answers and holds the fleet state.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "restore:tailscale",
+      "meaning": "The replacement manager is signed in to the tailnet.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-restore rebuilds a replacement manager from the bucket; what it needs first (the project’s fleet.json, the bucket’s credentials, Git, Docker Desktop, a tailnet sign-in) is the operator’s: follow the remedy, then run fleet-restore again."
+      }
+    },
+    {
+      "id": "revision",
+      "meaning": "The computer's checkout is at the manager's commit.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its branch, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
     },
     {
       "id": "rollout:evidence",
-      "meaning": "A worker's rollout produced verification evidence."
+      "meaning": "A worker's rollout produced verification evidence.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "rollout:next",
-      "meaning": "Names the command that converges a worker after it was replaced."
+      "meaning": "Names the command that converges a worker after it was replaced.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
+    },
+    {
+      "id": "rollout:node",
+      "meaning": "The fleet-sync of one worker that fleet-node-resume runs ended ready.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "rollout:operation",
-      "meaning": "The remote rollout operation completed."
+      "meaning": "The remote rollout operation completed.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "rollout:prerequisites",
-      "meaning": "A worker met the rollout's prerequisites."
+      "meaning": "A worker met the rollout's prerequisites.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "rollout:promotion",
-      "meaning": "The canary proved the revision, so promotion to this worker went ahead."
+      "meaning": "The canary proved the revision, so promotion to this worker went ahead.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "source:bootstrap",
-      "meaning": "The approved bootstrap source is available on the manager."
+      "meaning": "The approved bootstrap source is available on the manager.",
+      "severity": "required",
+      "repair": {
+        "manual": "It reports how a command or a run went, not the state of a machine: repeat the command once its remedy is followed."
+      }
     },
     {
       "id": "ssh:agent",
-      "meaning": "The SSH agent exposes at least one identity."
+      "meaning": "The SSH agent exposes at least one identity.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:auth",
-      "meaning": "SSH key or agent authentication succeeded."
+      "meaning": "SSH key or agent authentication succeeded.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      },
+      "requirement": true
     },
     {
       "id": "ssh:disconnected",
-      "meaning": "The SSH session was not lost while an operation ran."
+      "meaning": "The SSH session was not lost while an operation ran.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:dns",
-      "meaning": "The SSH host name resolved."
+      "meaning": "The SSH host name resolved.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:fresh-session",
-      "meaning": "A fresh, host-key-verified SSH session succeeded."
+      "meaning": "A fresh, host-key-verified SSH session succeeded.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:host-key",
-      "meaning": "The worker's SSH host key is known and unchanged."
+      "meaning": "The worker's SSH host key is known and unchanged.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      },
+      "requirement": true
     },
     {
       "id": "ssh:missing",
-      "meaning": "The local SSH client could be started."
+      "meaning": "The local SSH client could be started.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:network",
-      "meaning": "The SSH endpoint is reachable."
+      "meaning": "The SSH endpoint is reachable.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:probe",
-      "meaning": "A remote probe over SSH succeeded."
+      "meaning": "A remote probe over SSH succeeded.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:protocol",
-      "meaning": "The remote answer is a supported fleet document."
+      "meaning": "The remote answer is a supported fleet document.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:runtime",
-      "meaning": "The remote workspace and runtime exist for non-login SSH sessions."
+      "meaning": "The remote workspace and runtime exist for non-login SSH sessions.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:session",
-      "meaning": "A noninteractive SSH session and probe succeeded."
+      "meaning": "A noninteractive SSH session and probe succeeded.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:tailscale-check",
-      "meaning": "Tailscale SSH did not require interactive reauthentication."
+      "meaning": "Tailscale SSH did not require interactive reauthentication.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
       "id": "ssh:timeout",
-      "meaning": "SSH and the remote probe finished within their deadline."
+      "meaning": "SSH and the remote probe finished within their deadline.",
+      "severity": "required",
+      "repair": {
+        "manual": "SSH trust (host keys, keys in the agent, the alias) is set up by a person once per machine; dev-fleet never accepts a host key for you."
+      }
     },
     {
-      "id": "state:*",
-      "meaning": "A document of the fleet state (definition, roster, enrollment) is stored."
+      "id": "state:bucket",
+      "meaning": "A bucket for the fleet state is configured and reachable.",
+      "severity": "required",
+      "repair": {
+        "manual": "The bucket and its credentials are the operator’s: name them in fleet.json and pass the credentials."
+      }
     },
     {
-      "id": "state:bucket",
-      "meaning": "A bucket for the fleet state is configured and reachable."
+      "id": "state:definition",
+      "meaning": "A document of the fleet state (definition, roster, enrollment) is stored.",
+      "severity": "required",
+      "repair": {
+        "manual": "The fleet configuration (fleet.json) or the roster is wrong: only the operator edits them."
+      }
+    },
+    {
+      "id": "state:enrollment",
+      "meaning": "A document of the fleet state (definition, roster, enrollment) is stored.",
+      "severity": "required",
+      "repair": {
+        "recipe": "state"
+      }
     },
     {
       "id": "state:replica",
-      "meaning": "The bucket holds this manager's fleet state."
+      "meaning": "The bucket holds this manager's fleet state.",
+      "severity": "required",
+      "repair": {
+        "recipe": "state"
+      }
     },
     {
       "id": "state:retired",
-      "meaning": "The fleet state records that a retired worker was retired."
+      "meaning": "The fleet state records that a retired worker was retired.",
+      "severity": "required",
+      "repair": {
+        "recipe": "state"
+      }
+    },
+    {
+      "id": "state:roster",
+      "meaning": "A document of the fleet state (definition, roster, enrollment) is stored.",
+      "severity": "required",
+      "repair": {
+        "recipe": "state"
+      }
+    },
+    {
+      "id": "sync:bun.lock",
+      "meaning": "An input of the computer's checkout (a lockfile, a tool pin, a manifest) matches the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its lockfiles and pins, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
+    },
+    {
+      "id": "sync:mise-sidecars",
+      "meaning": "An input of the computer's checkout (a lockfile, a tool pin, a manifest) matches the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its lockfiles and pins, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
+    },
+    {
+      "id": "sync:mise.lock",
+      "meaning": "An input of the computer's checkout (a lockfile, a tool pin, a manifest) matches the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its lockfiles and pins, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
+    },
+    {
+      "id": "sync:mise.toml",
+      "meaning": "An input of the computer's checkout (a lockfile, a tool pin, a manifest) matches the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its lockfiles and pins, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
+    },
+    {
+      "id": "sync:package.json",
+      "meaning": "An input of the computer's checkout (a lockfile, a tool pin, a manifest) matches the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its lockfiles and pins, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
+    },
+    {
+      "id": "sync:workspace-manifests",
+      "meaning": "An input of the computer's checkout (a lockfile, a tool pin, a manifest) matches the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "The checkout of that computer differs from the manager’s: reconcile its lockfiles and pins, or converge it with fleet-sync; dev-fleet never resets a working tree."
+      }
     },
     {
       "id": "t3:api",
-      "meaning": "The local T3 API answers."
+      "meaning": "The local T3 API answers.",
+      "severity": "required",
+      "repair": {
+        "recipe": "t3"
+      }
     },
     {
       "id": "t3:end-to-end",
-      "meaning": "T3 relay and peer access, which need an operator test."
+      "meaning": "T3 relay and peer access, which need an operator test.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
+    },
+    {
+      "id": "t3:link",
+      "meaning": "The manager's T3 link to a replaced or retired worker's old environment is gone, and the manager's T3 is paired with a replacement's new environment.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:manager-endpoint",
-      "meaning": "The manager reaches the worker's private T3 endpoint."
+      "meaning": "The manager reaches the worker's private T3 endpoint.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:manager-origin",
-      "meaning": "The manager's T3 origin is configured."
+      "meaning": "The manager's T3 origin is configured.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:models",
-      "meaning": "T3 offers only the declared models for every account instance the fleet manages."
+      "meaning": "T3 offers only the declared models for every account instance the fleet manages.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:paired-access",
-      "meaning": "The manager's T3 is linked to this worker."
+      "meaning": "The manager's T3 is linked to this worker.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:policy-loaded",
-      "meaning": "The running T3 loaded the managed policy."
+      "meaning": "The running T3 loaded the managed policy.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:policy-staged",
-      "meaning": "The managed T3 policy is installed."
+      "meaning": "The managed T3 policy is installed.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:prerequisites",
-      "meaning": "The T3 baseline prerequisites are present."
+      "meaning": "The T3 baseline prerequisites are present.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:private-route",
-      "meaning": "T3's private HTTPS route is served."
+      "meaning": "T3's private HTTPS route is served.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:profile",
-      "meaning": "The declared T3 settings are in place on this machine."
+      "meaning": "The declared T3 settings are in place on this machine.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:provider-names",
-      "meaning": "T3 lists the fleet's provider names."
+      "meaning": "T3 lists the fleet's provider names.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:providers",
-      "meaning": "T3's provider instances are the declared ones."
+      "meaning": "T3's provider instances are the declared ones.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
+    },
+    {
+      "id": "t3:running-version",
+      "meaning": "The running T3 server is the installed release; a restart the release needs waits for running agent turns.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:service",
-      "meaning": "The pinned T3 app runs."
+      "meaning": "The pinned T3 app runs.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:settings",
-      "meaning": "T3 settings are readable."
+      "meaning": "T3 settings are readable.",
+      "severity": "required",
+      "repair": {
+        "recipe": "t3"
+      }
     },
     {
       "id": "t3:updates",
-      "meaning": "T3's own updater is off, as the fleet's policy declares."
+      "meaning": "T3's own updater is off, as the fleet's policy declares.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "t3:version",
-      "meaning": "This machine runs the T3 version the fleet pins."
+      "meaning": "This machine runs the T3 version the fleet pins.",
+      "severity": "required",
+      "repair": {
+        "manual": "A worker’s first T3 pairing and its private route are approved by a person; a replaced worker is paired by fleet-node-replace or the next fleet-sync, and fleet-sync applies the rest."
+      }
     },
     {
       "id": "tailscale:configuration",
-      "meaning": "Tailscale is configured as declared."
+      "meaning": "Tailscale is configured as declared.",
+      "severity": "required",
+      "repair": {
+        "recipe": "network"
+      },
+      "requirement": true
+    },
+    {
+      "id": "tailscale:device",
+      "meaning": "A replaced or retired worker's old tailnet device was removed.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Removing a device needs the tailnet-admin credential and a declared control plane, both the operator’s; without them a person removes it in the admin console."
+      }
     },
     {
       "id": "tailscale:discovery",
-      "meaning": "Tailscale computers could be discovered."
+      "meaning": "Tailscale computers could be discovered.",
+      "severity": "required",
+      "repair": {
+        "manual": "Signing a machine in to the tailnet and approving it is a person’s; the daemon itself is repaired by the network recipe."
+      }
     },
     {
       "id": "tailscale:enrolled-identity",
-      "meaning": "The Tailscale identity matches the enrollment."
+      "meaning": "The Tailscale identity matches the enrollment.",
+      "severity": "required",
+      "repair": {
+        "manual": "Signing a machine in to the tailnet and approving it is a person’s; the daemon itself is repaired by the network recipe."
+      }
+    },
+    {
+      "id": "tailscale:enrolment-key",
+      "meaning": "A worker that is not on the tailnet yet was handed a single-use, pre-authorised, tagged key minted by the fleet's control plane.",
+      "severity": "required",
+      "repair": {
+        "manual": "The tailnet-admin credential and the tag it may use are the operator’s, kept in the secrets provider and the control plane."
+      }
     },
     {
       "id": "tailscale:identity",
-      "meaning": "A machine's Tailscale identity is unambiguous."
+      "meaning": "A machine's Tailscale identity is unambiguous.",
+      "severity": "required",
+      "repair": {
+        "manual": "Signing a machine in to the tailnet and approving it is a person’s; the daemon itself is repaired by the network recipe."
+      }
+    },
+    {
+      "id": "tailscale:key-expiry",
+      "meaning": "The machine's Tailscale node key does not expire, or not within the warning window.",
+      "severity": "required",
+      "repair": {
+        "manual": "Signing a machine in to the tailnet and approving it is a person’s; the daemon itself is repaired by the network recipe."
+      }
+    },
+    {
+      "id": "tailscale:key-expiry-policy",
+      "meaning": "The control plane disabled node-key expiry for an enrolled worker whose key had one.",
+      "severity": "required",
+      "repair": {
+        "manual": "The tailnet-admin credential and the tag it may use are the operator’s, kept in the secrets provider and the control plane."
+      }
+    },
+    {
+      "id": "tailscale:leftover",
+      "meaning": "Every device on the tailnet that carries the fleet's worker tag is a declared worker (parked ones included) or a device the roster binds; warns, naming the device, for one that is not.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Whether a device tagged as a worker belongs to the fleet is the operator’s choice: declare it, or remove it from the tailnet."
+      }
     },
     {
       "id": "tailscale:membership",
-      "meaning": "A registered machine is in the visible tailnet."
+      "meaning": "A registered machine is in the visible tailnet.",
+      "severity": "required",
+      "repair": {
+        "manual": "Signing a machine in to the tailnet and approving it is a person’s; the daemon itself is repaired by the network recipe."
+      }
     },
     {
       "id": "tailscale:online",
-      "meaning": "Tailscale is online on this machine."
+      "meaning": "Tailscale is online on this machine.",
+      "severity": "required",
+      "repair": {
+        "recipe": "network"
+      }
     },
     {
       "id": "tailscale:reachability",
-      "meaning": "The machine is online in the tailnet."
+      "meaning": "The machine is online in the tailnet.",
+      "severity": "required",
+      "repair": {
+        "recipe": "network"
+      }
     },
     {
       "id": "tool:*",
-      "meaning": "A pinned tool, or the global mise configuration (tool:global-mise-config), is as the revision declares."
+      "meaning": "A pinned tool, or the global mise configuration (tool:global-mise-config), is as the revision declares.",
+      "severity": "required",
+      "repair": {
+        "recipe": "workspace"
+      }
+    },
+    {
+      "id": "tool:docker-cli",
+      "meaning": "Not applicable on a worker whose containers feature is off: the Docker CLI is not one of its tools.",
+      "severity": "required",
+      "repair": {
+        "recipe": "docker"
+      }
     },
     {
       "id": "ubuntu:baseline",
-      "meaning": "The Ubuntu baseline policy is applied."
+      "meaning": "The Ubuntu baseline policy is applied.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the Ubuntu baseline."
+      }
     },
     {
       "id": "ubuntu:boot-policy",
-      "meaning": "The no-sleep and session boot policy is active."
+      "meaning": "The no-sleep and session boot policy is active.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the Ubuntu baseline."
+      }
+    },
+    {
+      "id": "ubuntu:lid-policy",
+      "meaning": "Not applicable on a virtual machine, which has no lid; on a physical machine the lid policy is part of ubuntu:boot-policy.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the Ubuntu baseline."
+      }
     },
     {
       "id": "ubuntu:prerequisites",
-      "meaning": "The Ubuntu prerequisites are installed."
+      "meaning": "The Ubuntu prerequisites are installed.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the Ubuntu baseline."
+      }
     },
     {
       "id": "ubuntu:release",
-      "meaning": "The worker runs the supported Ubuntu release."
+      "meaning": "The worker runs the supported Ubuntu release.",
+      "severity": "required",
+      "repair": {
+        "manual": "It is a property of the hardware, the firmware or the operating system release, which no command changes."
+      },
+      "requirement": true
     },
     {
       "id": "ubuntu:resource-safety",
-      "meaning": "The OOM killer, disk guard and resource caps are active."
+      "meaning": "The OOM killer, disk guard and resource caps are active.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the Ubuntu baseline."
+      }
     },
     {
       "id": "vscode:forwarding",
-      "meaning": "VS Code Remote-SSH forwarding, which needs an operator test."
+      "meaning": "VS Code Remote-SSH forwarding, which needs an operator test.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
+    },
+    {
+      "id": "watch:heartbeat",
+      "meaning": "fleet-watch stored its heartbeat and each machine's health in the bucket.",
+      "severity": "required",
+      "repair": {
+        "manual": "The heartbeat is kept in the bucket fleet.json names: name it, or restore access to it, then run fleet-watch again."
+      }
+    },
+    {
+      "id": "worker:account",
+      "meaning": "The declared worker account was created over a root login, with the manager's key and the fleet's sudo rule.",
+      "severity": "required",
+      "repair": {
+        "manual": "fleet-sync creates the declared account over a root login; when it cannot, the account is created by the operator on the machine, or declared in fleet.json."
+      },
+      "requirement": true
     },
     {
-      "id": "worker:*",
-      "meaning": "A worker readiness gate."
+      "id": "worker:agent-sessions",
+      "meaning": "How many agent sessions this worker runs, and how many its memory policy supports at the estimated size of a session; warns when more run.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:auto-park",
+      "meaning": "fleet-watch parked a worker idle longer than declared (only with parking.autoPark).",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Whether a worker runs is the operator’s choice: park it with fleet-node-park or resume it with fleet-node-resume."
+      }
+    },
+    {
+      "id": "worker:browser",
+      "meaning": "A headless browser starts on a worker whose tool profiles include web.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
       "id": "worker:capacity",
-      "meaning": "CPU, memory and disk evidence is available."
+      "meaning": "CPU, memory and disk evidence is available.",
+      "severity": "required",
+      "repair": {
+        "recipe": "disk"
+      }
+    },
+    {
+      "id": "worker:capacity:disk",
+      "meaning": "A worker meets one capacity floor (load, memory, disk, inodes).",
+      "severity": "required",
+      "repair": {
+        "recipe": "disk"
+      }
+    },
+    {
+      "id": "worker:capacity:inodes",
+      "meaning": "A worker meets one capacity floor (load, memory, disk, inodes).",
+      "severity": "required",
+      "repair": {
+        "recipe": "disk"
+      }
+    },
+    {
+      "id": "worker:capacity:load",
+      "meaning": "A worker meets one capacity floor (load, memory, disk, inodes).",
+      "severity": "required",
+      "repair": {
+        "recipe": "disk"
+      }
+    },
+    {
+      "id": "worker:capacity:memory",
+      "meaning": "A worker meets one capacity floor (load, memory, disk, inodes).",
+      "severity": "required",
+      "repair": {
+        "recipe": "disk"
+      }
+    },
+    {
+      "id": "worker:clock",
+      "meaning": "The worker keeps its clock on network time.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
-      "id": "worker:capacity:*",
-      "meaning": "A worker meets one capacity floor (load, memory, disk)."
+      "id": "worker:clock-offset",
+      "meaning": "The worker's clock is within the offset the Ubuntu policy allows of the manager's.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:credential-renewal",
+      "meaning": "Worker credential renewal timer is active.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
       "id": "worker:desired-source",
-      "meaning": "The worker runs the declared revision."
+      "meaning": "The worker runs the declared revision.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:docker-run",
+      "meaning": "A container starts and exits on a worker whose containers feature is on.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:exposure",
+      "meaning": "Nothing listens on the worker beyond loopback and the tailnet but what the declared exposure policy allows, and the fleet firewall that closes the rest is loaded; not applicable without an address outside the tailnet.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      },
+      "requirement": true
+    },
+    {
+      "id": "worker:features",
+      "meaning": "The worker has the features fleet.json declares, and nothing dev-fleet installed for a feature that is off (containers) remains.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:git-identity",
+      "meaning": "The worker's global Git identity is the one fleet.json declares.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:git-push-auth",
+      "meaning": "The worker can push to the declared repositories with the fleet credentials.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:git-signing",
+      "meaning": "The worker signs commits as fleet.json declares, or leaves signing off.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
       "id": "worker:github-sync",
-      "meaning": "The worker is signed in to GitHub from the stored credential as the declared login."
+      "meaning": "The worker is signed in to GitHub from the stored credential as the declared login.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      },
+      "requirement": true
     },
     {
-      "id": "worker:package:*",
-      "meaning": "The pinned Ubuntu package is installed at or past its pin."
+      "id": "worker:idle",
+      "meaning": "An active worker runs an agent turn, or has run one within fleet.json's parking.idleAfterHours; warns once it has been idle longer.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Whether a worker runs is the operator’s choice: park it with fleet-node-park or resume it with fleet-node-resume."
+      }
     },
     {
       "id": "worker:manifest",
-      "meaning": "A worker is made of what the declared pins and a fresh build of the same revision are made of."
+      "meaning": "A worker is made of what the declared pins and a fresh build of the same revision are made of.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:ansible-core",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:build-essential",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:ca-certificates",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:curl",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:dconf-cli",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:docker-buildx",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:docker-compose-v2",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:docker.io",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:git",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:nftables",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:openssh-server",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:python3",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:sudo",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:systemd-oomd",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:tailscale",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:unzip",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:package:xz-utils",
+      "meaning": "The pinned Ubuntu package is installed at or past its pin.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:park-hook",
+      "meaning": "The stop or start command fleet.json declares under parking ran for the worker.",
+      "severity": "required",
+      "repair": {
+        "manual": "Whether a worker runs is the operator’s choice: park it with fleet-node-park or resume it with fleet-node-resume."
+      }
+    },
+    {
+      "id": "worker:parked",
+      "meaning": "A worker parked on purpose: listed with the time since, not contacted and never the canary (not-applicable). As a command result, the worker was parked or resumed.",
+      "severity": "required",
+      "repair": {
+        "manual": "Whether a worker runs is the operator’s choice: park it with fleet-node-park or resume it with fleet-node-resume."
+      }
+    },
+    {
+      "id": "worker:parked-online",
+      "meaning": "A parked worker is not online on the tailnet.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Whether a worker runs is the operator’s choice: park it with fleet-node-park or resume it with fleet-node-resume."
+      }
     },
     {
       "id": "worker:power-loss-recovery",
-      "meaning": "The worker powers on after AC loss."
+      "meaning": "The worker powers on after AC loss.",
+      "severity": "required",
+      "repair": {
+        "manual": "It is a property of the hardware, the firmware or the operating system release, which no command changes."
+      }
     },
     {
       "id": "worker:proxy-authentication",
-      "meaning": "The worker authenticates to the shared proxy."
+      "meaning": "The worker authenticates to the shared proxy.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
       "id": "worker:proxy-singleton",
-      "meaning": "The worker is a proxy client, not a second gateway."
+      "meaning": "The worker is a proxy client, not a second gateway.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:public-reachability",
+      "meaning": "From the manager, the worker's SSH, T3 and monitoring ports accept no connection on its public address; optional, and not applicable when Tailscale knows no public address for it.",
+      "severity": "advisory",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      },
+      "requirement": true
     },
     {
       "id": "worker:readiness",
-      "meaning": "The worker readiness checks could run."
+      "meaning": "The worker readiness checks could run.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:reboot",
+      "meaning": "The worker was rebooted while it ran no agent turn (after its first converge, or for maintenance), answered again and was converged once more.",
+      "severity": "required",
+      "repair": {
+        "manual": "A reboot ends running agent turns, so it waits for them: rerun fleet-sync --maintenance-reboot once they end, or with --force."
+      },
+      "requirement": true
+    },
+    {
+      "id": "worker:reboot-pending",
+      "meaning": "The worker needs no reboot to finish an update.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
       "id": "worker:service-recovery",
-      "meaning": "Worker services recover after failure."
+      "meaning": "Worker services recover after failure.",
+      "severity": "required",
+      "repair": {
+        "recipe": "recovery"
+      }
+    },
+    {
+      "id": "worker:service:beszel-agent",
+      "meaning": "A service every worker runs is active, enabled for boot and restarts unconditionally.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:service:docker",
+      "meaning": "A service every worker runs is active, enabled for boot and restarts unconditionally.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:service:ssh",
+      "meaning": "A service every worker runs is active, enabled for boot and restarts unconditionally.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:service:tailscaled",
+      "meaning": "A service every worker runs is active, enabled for boot and restarts unconditionally.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:sudo",
+      "meaning": "Designated worker user has noninteractive sudo.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:t3-health",
+      "meaning": "T3 local API answers with its environment identity within 10 seconds.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:t3-recovery",
+      "meaning": "The worker's T3 service is active, enabled for boot and restarts after a failure.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
+    },
+    {
+      "id": "worker:ubuntu",
+      "meaning": "Required Ubuntu release and architecture.",
+      "severity": "required",
+      "repair": {
+        "manual": "Re-converge the worker with fleet-sync: it applies the whole worker policy at the approved revision."
+      }
     },
     {
       "id": "worker:vault-renewal",
-      "meaning": "The worker renews its Vault identity unattended."
+      "meaning": "The worker renews its Vault identity unattended.",
+      "severity": "required",
+      "repair": {
+        "manual": "It needs a person: a sign-in, an approval or a choice only the operator can make."
+      }
     },
     {
       "id": "workstation:configuration",
-      "meaning": "The devfleet launcher is installed and linked."
+      "meaning": "The devfleet launcher is installed and linked.",
+      "severity": "required",
+      "repair": {
+        "recipe": "workstation"
+      }
     },
     {
       "id": "workstation:installation",
-      "meaning": "The devfleet launcher could be installed."
+      "meaning": "The devfleet launcher could be installed.",
+      "severity": "required",
+      "repair": {
+        "recipe": "workstation"
+      }
     }
   ]
 }