@ours.network/fleet 0.10.0 → 0.10.2

package/dist/resolved-plan.d.ts

@@ -0,0 +1,5 @@
+import type { FleetConfig, ResolvedRole } from './config.js';
+export declare const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+/** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
+export declare function resolvedPlan(cfg: FleetConfig): Record<string, unknown>;
+export declare function resolvedRolePlan(role: ResolvedRole): Record<string, unknown>;

package/dist/resolved-plan.js

@@ -0,0 +1,66 @@
+import { analyzeRolePermissions } from './permissions.js';
+export const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+const sortedObject = (value) => Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+const redactSensitive = (value, key = '') => {
+    if (/(?:secret|token|password|authorization|api[_-]?key)/i.test(key))
+        return '<redacted>';
+    if (Array.isArray(value))
+        return value.map(item => redactSensitive(item));
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([childKey, child]) => [childKey, redactSensitive(child, childKey)]));
+    return value;
+};
+/** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
+export function resolvedPlan(cfg) {
+    return {
+        schemaVersion: RESOLVED_PLAN_SCHEMA_VERSION,
+        sourceFiles: [...cfg.files],
+        startStaggerMs: cfg.startStaggerMs,
+        diagnostics: cfg.diagnostics.map(diagnostic => ({ ...diagnostic })),
+        roles: cfg.roles.map(resolvedRolePlan),
+    };
+}
+export function resolvedRolePlan(role) {
+    const analysis = analyzeRolePermissions(role);
+    return {
+        name: role.name,
+        sourceFile: role.sourceFile,
+        identity: role.identity,
+        harness: role.harness,
+        session: role.session,
+        sessionOptions: role.session_options ?? null,
+        model: role.model ?? null,
+        modelChain: role.model_chain ?? null,
+        cwd: role.cwd ?? null,
+        coordinator: role.coordinator ?? null,
+        maxTokens: role.max_tokens ?? null,
+        autocompactPct: role.autocompact_pct ?? null,
+        permissions: {
+            common: role.permissions,
+            effectiveNative: analysis.native ?? null,
+            supported: analysis.supported,
+            exact: analysis.exact ?? false,
+            capabilities: analysis.capabilities ?? [],
+            floor: analysis.floor ?? null,
+            severity: analysis.floorSeverity ?? null,
+            warnings: [
+                ...analysis.warnings,
+                ...(analysis.conflicts ?? []).map(conflict => conflict.warning),
+                ...(analysis.floorWarning ? [analysis.floorWarning] : []),
+            ],
+        },
+        monitor: role.monitor,
+        isolation: role.isolation ?? null,
+        worklog: role.worklog ?? null,
+        authProxy: role.auth_proxy ?? null,
+        oversee: role.oversee ?? [],
+        harnessOptions: redactSensitive(role.harness_options ?? null),
+        env: {
+            redacted: true,
+            keys: Object.keys(role.env ?? {}).sort(),
+            values: sortedObject(Object.fromEntries(Object.keys(role.env ?? {}).map(key => [key, '<redacted>']))),
+        },
+    };
+}

package/dist/runner.d.ts

@@ -19,6 +19,13 @@ export interface RunnerDeps {
     /** Lets a test (or a shutdown path) end the supervised restart loop. */
     shouldStop?(): boolean;
 }
+/**
+ * Record who owns wake delivery for this run. Returning true means a fleet
+ * monitor is taking ownership back from a native harness and must start at the
+ * current stream tip rather than replay notifications the native owner was
+ * responsible for.
+ */
+export declare function recordMonitorOwner(dir: string, owner: 'fleet' | 'native'): boolean;
 /**
  * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
  * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes
@@ -82,6 +89,7 @@ export interface AttemptResult {
     /** Whether this attempt threw away resume state to start fresh. */
     rotated: boolean;
     mode: 'fresh' | 'resume';
+    modelRecovery?: 'advance' | 'hold';
 }
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export declare function runOnce(name: string, opts?: {

package/dist/runner.js

@@ -15,6 +15,8 @@ import { AcpSession } from './session/acp.js';
 import { RoleControlServer } from './session/control.js';
 import { TmuxSession } from './session/tmux.js';
 import { classifyShellStatus } from './session/types.js';
+import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
+import { rotateWorklog } from './worklog.js';
 const defaultDeps = () => ({
     tmux: new Tmux(),
     exec: realExec,
@@ -32,6 +34,24 @@ const defaultDeps = () => ({
     fetch: (url, init) => globalThis.fetch(url, init),
     createMonitor: opts => createMonitor(opts),
 });
+const MONITOR_OWNER_FILE = '.monitor-owner';
+/**
+ * Record who owns wake delivery for this run. Returning true means a fleet
+ * monitor is taking ownership back from a native harness and must start at the
+ * current stream tip rather than replay notifications the native owner was
+ * responsible for.
+ */
+export function recordMonitorOwner(dir, owner) {
+    let previous = null;
+    try {
+        const path = join(dir, MONITOR_OWNER_FILE);
+        if (existsSync(path))
+            previous = readFileSync(path, 'utf8').trim();
+        writeFileSync(path, `${owner}\n`);
+    }
+    catch { /* ownership diagnostics must never take the role down */ }
+    return owner === 'fleet' && previous === 'native';
+}
 /**
  * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
  * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes
@@ -264,8 +284,20 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         role = findRole(cfg, name);
         staggerMs = cfg.startStaggerMs;
     }
+    const effectiveModel = effectiveModelForRole(dir, role);
+    if (effectiveModel !== role.model) {
+        deps.log(`[${name}] model recovery drift: declared=${role.model ?? '(none)'} effective=${effectiveModel}`);
+        role = { ...role, model: effectiveModel };
+    }
+    if (modelRecoveryHeld(dir))
+        throw new Error(`[${name}] model chain exhausted — held down until config changes or recovery reset`);
     const adapter = getAdapter(role.harness);
     mkdirSync(dir, { recursive: true });
+    const rotation = rotateWorklog(join(dir, 'WORKLOG.md'), role.worklog);
+    if (rotation.deferred)
+        deps.log(`[${name}] worklog rotation deferred: concurrent modification detected`);
+    else if (rotation.rotated)
+        deps.log(`[${name}] worklog rotated: ${rotation.beforeBytes} -> ${rotation.afterBytes} bytes`);
     const sidFile = join(dir, '.session-id');
     if (!existsSync(sidFile))
         writeFileSync(sidFile, randomUUID() + '\n');
@@ -333,19 +365,42 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // (backlog before the tip is the SessionStart hook's job). Native-mode roles
     // leave wake ownership to the harness. Temp snapshots predating `monitor:` are
     // treated as native (monitor may be undefined on an old role.yaml).
+    let sessionHandle;
+    let modelRecovery;
     const resolvedMonitorDeps = monitorDeps(deps, role.env);
-    const monitor = role.monitor?.mode === 'fleet' ? deps.createMonitor({
+    resolvedMonitorDeps.onFailureEvidence = evidence => {
+        if (!role.model_chain)
+            return false;
+        const action = recordModelFailure(dir, role, { ...evidence, model: evidence.model ?? role.model }, role.monitor.turn_fail_threshold ?? 3);
+        if (action.kind === 'advance') {
+            modelRecovery = 'advance';
+            deps.log(`[${name}] MODEL DOWN-SHIFT ${action.from} -> ${action.to}; restarting with resume`);
+            void sessionHandle?.close();
+            return true;
+        }
+        else if (action.kind === 'hold') {
+            modelRecovery = 'hold';
+            deps.log(`[${name}] MODEL CHAIN EXHAUSTED at ${action.model}; held down`);
+            void sessionHandle?.close();
+            return true;
+        }
+        return false;
+    };
+    const monitorOwner = role.monitor?.mode === 'fleet' ? 'fleet' : 'native';
+    const resetMonitorCursor = recordMonitorOwner(dir, monitorOwner);
+    const monitor = monitorOwner === 'fleet' ? deps.createMonitor({
         name, identity: role.identity, agentDir: dir, cfg: role.monitor,
         deps: resolvedMonitorDeps,
     }) : null;
     if (monitor)
-        await monitor.prime();
+        await monitor.prime({ resetCursor: resetMonitorCursor });
     rmSync(exitFile, { force: true });
     let pid;
-    let sessionHandle;
     let acpSession;
     let control;
+    let unsubscribeRecovery;
     let monitorLoop;
+    let acpStartupComplete = false;
     if (sessionBackend === 'acp') {
         const perms = role.permissions ?? resolvePermissions(undefined, undefined);
         // Say once, at startup, that this role will decide permission requests by
@@ -366,6 +421,13 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         });
         pid = acpSession.pid;
         sessionHandle = acpSession;
+        unsubscribeRecovery = acpSession.subscribe(event => {
+            if (event.kind !== 'error' || !event.text)
+                return;
+            const evidence = classifyFailureText(event.text, 'acp', new Date(deps.now()).toISOString());
+            if (evidence)
+                resolvedMonitorDeps.onFailureEvidence?.(evidence);
+        });
         control = new RoleControlServer(dir, acpSession, deps.log);
         await control.start();
         resolvedMonitorDeps.delivery = {
@@ -373,7 +435,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             // refusal or a cancellation reached the agent and was not acted on, so
             // the monitor must keep its cursor and try again.
             submit: async (text, options) => {
-                const result = await acpSession.submitPrompt(text, { ...options, steer: true });
+                // Cancelling the runner-owned startup prompt makes startup look failed
+                // and closes the session before the wake turn can run. During startup,
+                // steer into the live turn instead; after it completes, honor the
+                // configured interrupt policy normally.
+                const interrupt = options?.interrupt === true && acpStartupComplete;
+                const result = await acpSession.submitPrompt(text, { ...options, interrupt, steer: true });
                 const steered = result.accepted
                     && (result.detail === 'injected' || result.detail === 'startedNewTurn');
                 return {
@@ -390,17 +457,35 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         // startup prompt and then refuses it has not started; logging the role as
         // up would hide a role that never read its briefing.
         const starting = acpSession.submitPrompt(firstPrompt);
-        // Start monitoring as soon as the initial prompt has been submitted. ACP
-        // steering can deliver a wake into that turn without a boot-time deaf gap.
+        // Monitoring starts immediately. The delivery adapter above downgrades
+        // interruption to steering until this startup turn reaches a terminal
+        // success, so there is neither a deaf gap nor a boot-cancellation loop.
         monitorLoop = monitor?.run(pid);
         const started = await starting;
         if (!started.succeeded) {
             monitor?.stop();
             await control.close();
             await acpSession.close();
+            unsubscribeRecovery?.();
+            if (modelRecovery) {
+                if (monitorLoop)
+                    await monitorLoop;
+                return {
+                    elapsedSecs: 0,
+                    exit: {
+                        version: 1,
+                        class: 'program-exit',
+                        detail: `ACP startup triggered model recovery (${modelRecovery})`,
+                    },
+                    rotated: false,
+                    mode,
+                    modelRecovery,
+                };
+            }
             throw new Error(`[${name}] ACP startup prompt ${started.outcome}` +
                 `${started.detail ? `: ${started.detail}` : ''}`);
         }
+        acpStartupComplete = true;
     }
     else {
         await deps.tmux.kill(name);
@@ -427,6 +512,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         monitor.stop();
         await monitorLoop;
     }
+    unsubscribeRecovery?.();
     if (control)
         await control.close();
     if (acpSession)
@@ -470,7 +556,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     }
     else
         deps.log(`[${name}] ${exitRecord.detail} (${elapsed.toFixed(0)}s) -> next start RESUMES context`);
-    return { elapsedSecs: elapsed, exit: exitRecord, rotated, mode };
+    return { elapsedSecs: elapsed, exit: exitRecord, rotated, mode, modelRecovery };
 }
 /**
  * The persistent supervisor for one permanent role: run child sessions in a
@@ -490,6 +576,18 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
     const stamp = () => new Date(deps.now()).toISOString();
     while (!shouldStop()) {
         let ledger = readRestartLedger(dir);
+        try {
+            const configPath = resolveConfigPath(dir, opts.configPath);
+            const role = findRole(loadConfig(configPath), name);
+            reconcileModelRecovery(dir, role, stamp());
+            if (modelRecoveryHeld(dir)) {
+                await deps.sleep(HELD_DOWN_POLL_MS);
+                continue;
+            }
+        }
+        catch {
+            // Normal attempt path reports config errors through the restart circuit.
+        }
         if (ledger.circuit === 'open') {
             // Held down. Stay alive — exiting would hand the role straight back to
             // the service manager — and watch for an operator reset.
@@ -513,6 +611,18 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
         // Re-read: the attempt itself may have taken minutes, and an operator may
         // have reset the ledger meanwhile.
         ledger = readRestartLedger(dir);
+        if (result.modelRecovery === 'advance') {
+            writeRestartLedger(dir, {
+                ...emptyLedger(),
+                lastReason: 'approved model-chain transition',
+                updatedAt: stamp(),
+            });
+            continue;
+        }
+        if (result.modelRecovery === 'hold') {
+            await deps.sleep(HELD_DOWN_POLL_MS);
+            continue;
+        }
         const fastFailSecs = fastFailSecsFor(name, opts.configPath);
         const immediate = result.elapsedSecs < fastFailSecs;
         if (!immediate) {

package/dist/spawn.d.ts

@@ -1,5 +1,5 @@
 import type { IsolationConfig } from './isolation/types.js';
-import { type ApprovalMode, type FilesystemMode, type SessionBackendId, type UnattendedMode } from './config.js';
+import { type ApprovalMode, type FilesystemMode, type ResolvedRole, type RoleConfig, type SessionBackendId, type UnattendedMode } from './config.js';
 import { type OpsDeps } from './ops.js';
 import { type CreationDeps, type CreationProvenance } from './creation.js';
 /**
@@ -13,6 +13,7 @@ export interface SpawnOpts {
     harness?: string;
     session?: SessionBackendId;
     mission?: string;
+    missionFile?: string;
     identity?: string;
     cwd?: string;
     coordinator?: string;
@@ -38,6 +39,8 @@ export interface SpawnOpts {
     isolationFile?: string;
     overseeInterval?: string;
     configPath?: string;
+    dryRun?: boolean;
+    json?: boolean;
 }
 /**
  * Read and validate an `--isolation-file`. The file is the existing
@@ -49,8 +52,23 @@ export interface SpawnOpts {
  * must fail before any artifact exists.
  */
 export declare function readIsolationFile(path: string): IsolationConfig;
+/** Read mission text without trimming or newline rewriting. */
+export declare function readMissionFile(path: string): string;
 /** The ours identity a spawn will bind: explicit, else the role name. */
 export declare const effectiveIdentity: (o: SpawnOpts) => string;
+export interface SpawnDryRun {
+    schemaVersion: 1;
+    warning: string;
+    roleDocument: {
+        roles: Record<string, RoleConfig>;
+    };
+    resolvedRole: ResolvedRole;
+}
+/**
+ * Validate and resolve a spawn without reserving names, contacting the daemon,
+ * or writing state. Collision checks are necessarily a point-in-time snapshot.
+ */
+export declare function spawnDryRun(o: SpawnOpts): SpawnDryRun;
 /** Permanent spawn: persist to ~/fleet.d/<Name>.yaml, then bring it up. */
 export declare function spawnPermanent(o: SpawnOpts, deps: OpsDeps, creation?: CreationDeps): Promise<string>;
 /** Launches the detached temp supervisor (`_run-temp <name>`). Injectable for tests. */

package/dist/spawn.js

@@ -4,11 +4,12 @@ import { join } from 'node:path';
 import { parse, stringify } from 'yaml';
 import { agentDir, fleetDDir } from './paths.js';
 import { validateIsolationConfig } from './isolation/policy.js';
-import { loadConfig, resolveMonitorConfig, resolvePermissions, } from './config.js';
+import { loadConfig, resolveAuthProxy, resolveModelChain, resolveMonitorConfig, resolvePermissions, resolveWorklogPolicy, } from './config.js';
 import { applyRole, up } from './ops.js';
 import { START_STAGGER_FILE } from './runner.js';
 import { buildProvenance, daemonIdentityProvisioner, ensureIdentity, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
 import { VERSION } from './version.js';
+import { getAdapter } from './harness/registry.js';
 /**
  * The provenance record written by the most recent spawn in this process, so
  * the CLI can print the same summary it persisted rather than rebuilding it.
@@ -26,7 +27,9 @@ function roleFromOpts(o, defaultHarness) {
         r.cwd = o.cwd;
     if (o.coordinator)
         r.coordinator = o.coordinator;
-    if (o.mission)
+    if (o.missionFile)
+        r.mission = readMissionFile(o.missionFile);
+    else if (o.mission !== undefined)
         r.mission = o.mission;
     if (o.model?.trim())
         r.model = o.model.trim();
@@ -91,6 +94,8 @@ export function readIsolationFile(path) {
     return cfg;
 }
 function validateSpawnOpts(o) {
+    if (o.mission !== undefined && o.missionFile)
+        throw new Error('--mission and --mission-file are mutually exclusive');
     if (o.session && !['tmux', 'acp'].includes(o.session))
         throw new Error(`invalid --session '${o.session}'; allowed: tmux, acp`);
     if (o.approval && !['ask', 'allow', 'deny'].includes(o.approval))
@@ -100,6 +105,15 @@ function validateSpawnOpts(o) {
     if (o.unattended && !['deny', 'wait'].includes(o.unattended))
         throw new Error(`invalid --unattended '${o.unattended}'; allowed: deny, wait`);
 }
+/** Read mission text without trimming or newline rewriting. */
+export function readMissionFile(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch (e) {
+        throw new Error(`--mission-file ${path}: ${e.message}`);
+    }
+}
 /**
  * Reject names that are already USED. This is a precondition, not a claim: it
  * runs INSIDE the creation transaction, after both names are reserved, so the
@@ -112,9 +126,69 @@ function assertNameFree(o) {
         throw new Error(`role '${o.name}' already exists (${cfg.roles.find(r => r.name === o.name).sourceFile})`);
     if (existsSync(agentDir(o.name)) || existsSync(agentDir(o.name, true)))
         throw new Error(`agent dir for '${o.name}' already exists — pick another name or 'ours-fleet rm ${o.name}'`);
+    const identity = effectiveIdentity(o);
+    const owner = cfg.roles.find(role => role.identity === identity);
+    if (owner)
+        throw new Error(`identity '${identity}' is already used by role '${owner.name}' (${owner.sourceFile}); `
+            + 'identity sharing is unsupported because binding is exclusive');
 }
 /** The ours identity a spawn will bind: explicit, else the role name. */
 export const effectiveIdentity = (o) => o.identity ?? o.name;
+/**
+ * Validate and resolve a spawn without reserving names, contacting the daemon,
+ * or writing state. Collision checks are necessarily a point-in-time snapshot.
+ */
+export function spawnDryRun(o) {
+    validateSpawnOpts(o);
+    if (o.isolationFile)
+        readIsolationFile(o.isolationFile);
+    if (o.missionFile)
+        readMissionFile(o.missionFile);
+    assertNameFree(o);
+    const cfg = loadConfig(o.configPath);
+    const raw = roleFromOpts(o, cfg.defaults.harness);
+    const harnessOptions = {
+        ...(cfg.defaults.harness_options ?? {}),
+        ...(raw.harness_options ?? {}),
+    };
+    const resolvedRole = {
+        ...raw,
+        name: o.name,
+        sourceFile: o.temp ? '(temp dry-run)' : join(fleetDDir(), `${o.name}.yaml`),
+        harness: raw.harness ?? cfg.defaults.harness ?? 'claude-code',
+        session: raw.session ?? cfg.defaults.session ?? 'tmux',
+        session_options: raw.session_options,
+        permissions: resolvePermissions(cfg.defaults.permissions, raw.permissions),
+        permissionsDeclared: raw.permissions !== undefined || cfg.defaults.permissions !== undefined,
+        identity: effectiveIdentity(o),
+        model: raw.model ?? cfg.defaults.model,
+        model_chain: resolveModelChain(raw.model ?? cfg.defaults.model, raw.model_chain ?? cfg.defaults.model_chain),
+        harness_options: Object.keys(harnessOptions).length ? harnessOptions : undefined,
+        isolation: raw.isolation ?? cfg.defaults.isolation,
+        monitor: resolveMonitorConfig(cfg.defaults.monitor, raw.monitor),
+        worklog: resolveWorklogPolicy(cfg.defaults.worklog, raw.worklog),
+        auth_proxy: resolveAuthProxy(cfg.defaults.auth_proxy, raw.auth_proxy),
+    };
+    resolvedRole.env = {
+        ...(cfg.defaults.env ?? {}),
+        ...(raw.env ?? {}),
+        ...(resolvedRole.auth_proxy
+            ? { ANTHROPIC_BASE_URL: resolvedRole.auth_proxy.base_url }
+            : {}),
+    };
+    const adapter = getAdapter(resolvedRole.harness);
+    if (resolvedRole.auth_proxy && resolvedRole.harness !== 'claude-code')
+        throw new Error('auth_proxy is supported only by claude-code');
+    const optionProblems = adapter.validateOptions(resolvedRole.harness_options);
+    if (optionProblems.length)
+        throw new Error(optionProblems.map(problem => `${problem.path}: ${problem.message}`).join('; '));
+    return {
+        schemaVersion: 1,
+        warning: 'collision checks are a snapshot; a real spawn reserves names atomically',
+        roleDocument: { roles: { [o.name]: raw } },
+        resolvedRole,
+    };
+}
 /**
  * Which settings came from the operator, from fleet defaults, or from a
  * built-in (6.6). Built while the options are still separable — once they are
@@ -147,6 +221,8 @@ export async function spawnPermanent(o, deps, creation = {}) {
     validateSpawnOpts(o);
     if (o.isolationFile)
         readIsolationFile(o.isolationFile); // fail before reserving
+    if (o.missionFile)
+        readMissionFile(o.missionFile); // fail before reserving
     // Name AND identity reserved together, before anything is written or started
     // (6.4). A loser of the race creates no config, no state, no service.
     return withCreationTransaction({ role: o.name, identity: effectiveIdentity(o) }, async (tx) => {
@@ -218,16 +294,18 @@ export async function spawnTemp(o, binPath, launch = detachedSupervisor, creatio
     validateSpawnOpts(o);
     if (o.isolationFile)
         readIsolationFile(o.isolationFile); // fail before reserving
+    if (o.missionFile)
+        readMissionFile(o.missionFile); // fail before reserving
     // Temporary roles go through the SAME reservation boundary as permanent ones
     // (6.4): a temp agent competes for the same names.
     return withCreationTransaction({ role: o.name, identity: effectiveIdentity(o) }, async (tx) => {
+        assertNameFree(o);
         const guarantee = await ensureIdentity(effectiveIdentity(o), { bio: o.bioFile ? readFileSync(o.bioFile, 'utf8').trim() : undefined,
             persona: o.personaFile ? readFileSync(o.personaFile, 'utf8').trim() : undefined }, creation.identityProvisioner ?? daemonIdentityProvisioner(), creation.log);
         return spawnTempInner(o, binPath, launch, tx, guarantee);
     }, creation);
 }
 async function spawnTempInner(o, binPath, launch, tx, guarantee) {
-    assertNameFree(o);
     const cfg = loadConfig(o.configPath);
     const defaultHarness = cfg.defaults.harness;
     const fromOpts = roleFromOpts(o, defaultHarness);
@@ -242,13 +320,23 @@ async function spawnTempInner(o, binPath, launch, tx, guarantee) {
         session: o.session ?? cfg.defaults.session ?? 'tmux',
         identity: o.identity ?? o.name,
         model: o.model?.trim() || cfg.defaults.model,
+        model_chain: resolveModelChain(o.model?.trim() || cfg.defaults.model, fromOpts.model_chain ?? cfg.defaults.model_chain),
         harness_options: Object.keys(mergedHarnessOptions).length ? mergedHarnessOptions : undefined,
         permissions: resolvePermissions(cfg.defaults.permissions, fromOpts.permissions),
         permissionsDeclared: fromOpts.permissions !== undefined || cfg.defaults.permissions !== undefined,
         // Temp agents inherit the fleet-wide monitor defaults via the snapshot (design §2).
         monitor: resolveMonitorConfig(cfg.defaults.monitor, fromOpts.monitor),
+        worklog: resolveWorklogPolicy(cfg.defaults.worklog, fromOpts.worklog),
+        auth_proxy: resolveAuthProxy(cfg.defaults.auth_proxy, fromOpts.auth_proxy),
         sourceFile: '(temp)',
     };
+    role.env = {
+        ...(cfg.defaults.env ?? {}),
+        ...(fromOpts.env ?? {}),
+        ...(role.auth_proxy ? { ANTHROPIC_BASE_URL: role.auth_proxy.base_url } : {}),
+    };
+    if (role.auth_proxy && role.harness !== 'claude-code')
+        throw new Error('auth_proxy is supported only by claude-code');
     const dir = applyRole(role, { temp: true, identityGuarantee: guarantee.state });
     const provenance = buildProvenance({
         role: o.name, lifetime: 'temporary', fleetVersion: VERSION,

package/dist/worklog.d.ts

@@ -0,0 +1,25 @@
+import type { WorklogPolicy } from './config.js';
+export interface WorklogInspection {
+    enabled: boolean;
+    bytes: number;
+    overLimit: boolean;
+}
+export interface WorklogRotation {
+    rotated: boolean;
+    deferred?: boolean;
+    beforeBytes: number;
+    afterBytes: number;
+    archivePath?: string;
+}
+export declare function inspectWorklog(path: string, policy?: WorklogPolicy): WorklogInspection;
+export declare function pruneWorklogArchives(path: string, maxArchives: number): void;
+/**
+ * Conservatively rotate a stable snapshot. A changed size/mtime/inode aborts
+ * before replacement; callers retry at the next fleet-owned lifecycle point.
+ */
+export declare function rotateWorklog(path: string, policy?: WorklogPolicy, deps?: {
+    now?: () => Date;
+    beforeCommit?: () => void;
+    /** Deterministic test hook for the rename→link commit window. */
+    afterArchiveRename?: () => void;
+}): WorklogRotation;

package/dist/worklog.js

@@ -0,0 +1,99 @@
+import { existsSync, linkSync, readdirSync, readFileSync, renameSync, rmSync, statSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { replaceFileAtomically } from './atomic-file.js';
+const ARCHIVE_RE = /^WORKLOG\.\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z(?:\.\d+)?\.md$/;
+export function inspectWorklog(path, policy) {
+    const bytes = existsSync(path) ? statSync(path).size : 0;
+    return {
+        enabled: policy !== undefined,
+        bytes,
+        overLimit: policy !== undefined && bytes > policy.max_kb * 1024,
+    };
+}
+const safeTailStart = (buffer, wanted) => {
+    let start = Math.max(0, buffer.length - wanted);
+    while (start < buffer.length && (buffer[start] & 0xc0) === 0x80)
+        start++;
+    const newline = buffer.indexOf(0x0a, start);
+    return newline >= 0 && newline + 1 < buffer.length ? newline + 1 : start;
+};
+const archiveName = (path, now, collision) => {
+    const stamp = now.toISOString().replace(/:/g, '-');
+    return join(dirname(path), `WORKLOG.${stamp}${collision ? `.${collision}` : ''}.md`);
+};
+export function pruneWorklogArchives(path, maxArchives) {
+    const dir = dirname(path);
+    const archives = readdirSync(dir).filter(name => ARCHIVE_RE.test(name)).sort().reverse();
+    for (const old of archives.slice(maxArchives))
+        rmSync(join(dir, old), { force: true });
+}
+/**
+ * Conservatively rotate a stable snapshot. A changed size/mtime/inode aborts
+ * before replacement; callers retry at the next fleet-owned lifecycle point.
+ */
+export function rotateWorklog(path, policy, deps = {}) {
+    const inspection = inspectWorklog(path, policy);
+    if (!policy || !inspection.overLimit)
+        return { rotated: false, beforeBytes: inspection.bytes, afterBytes: inspection.bytes };
+    const before = statSync(path);
+    const content = readFileSync(path);
+    const start = safeTailStart(content, policy.keep_tail_kb * 1024);
+    const tail = content.subarray(start);
+    deps.beforeCommit?.();
+    const current = statSync(path);
+    if (current.ino !== before.ino || current.size !== before.size
+        || current.mtimeMs !== before.mtimeMs) {
+        return {
+            rotated: false, deferred: true,
+            beforeBytes: before.size, afterBytes: current.size,
+        };
+    }
+    let collision = 0;
+    let archivePath = archiveName(path, deps.now?.() ?? new Date(), collision);
+    while (existsSync(archivePath))
+        archivePath = archiveName(path, deps.now?.() ?? new Date(), ++collision);
+    // Prepare the intended tail before moving the live inode. replaceFileAtomically
+    // gives us a fully written/fsynced inode; hard-linking it below publishes that
+    // inode without ever overwriting a path a concurrent appender may create.
+    const preparedTail = join(dirname(path), `.${basename(path)}.${randomUUID()}.rotate`);
+    replaceFileAtomically(preparedTail, tail.toString('utf8'), before.mode & 0o777);
+    try {
+        // Linearization point: the complete original inode becomes the archive.
+        // Writers that opened before this rename keep appending to that inode, so
+        // their acknowledged bytes remain in the archive even after the move.
+        renameSync(path, archivePath);
+        deps.afterArchiveRename?.();
+        try {
+            // Atomic create-without-overwrite. If a writer opened the missing path in
+            // the rename→link window, it created the new live file; EEXIST means leave
+            // that file untouched. The intended tail remains recoverable in the full
+            // archive, and every concurrent suffix remains in the writer-created live.
+            linkSync(preparedTail, path);
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
+        }
+    }
+    finally {
+        rmSync(preparedTail, { force: true });
+    }
+    const liveBytes = existsSync(path) ? statSync(path).size : 0;
+    const status = {
+        schemaVersion: 1,
+        rotatedAt: (deps.now?.() ?? new Date()).toISOString(),
+        beforeBytes: before.size,
+        afterBytes: liveBytes,
+        archive: basename(archivePath),
+        archiveContainsFullSnapshot: true,
+    };
+    replaceFileAtomically(join(dirname(path), '.worklog-rotation.json'), `${JSON.stringify(status, null, 2)}\n`);
+    pruneWorklogArchives(path, policy.max_archives);
+    return {
+        rotated: true,
+        beforeBytes: before.size,
+        afterBytes: liveBytes,
+        archivePath,
+    };
+}