@ours.network/fleet 0.10.1 → 0.10.2

package/dist/docs.d.ts

@@ -4,7 +4,7 @@
  * Keep this concise enough to place directly in an agent context. Unlike
  * Commander's per-command help, this describes how the pieces compose.
  */
-export declare const AI_DOCS = "# ours-fleet reference\n\nours-fleet runs persistent or temporary, identity-bound AI roles. A role selects\na harness independently from its session backend:\n\n- harness: `claude-code` or `codex`\n- session: `tmux` (default) or `acp`\n- lifetime: permanent (supervised, restartable) or `spawn --temp`\n\n## Discover and validate\n\n```sh\nours-fleet docs                         # this complete reference (`man` is an alias)\nours-fleet help <command>               # exact flags for one command\nours-fleet config [-c FILE]             # validate and print the merged plan; no changes\nours-fleet doctor [-c FILE] [--harness codex|claude-code]\n```\n\nDefault configuration is `~/fleet.yaml` plus sorted `~/fleet.d/*.yaml` role\ndrop-ins. An explicit `-c FILE` replaces `~/fleet.yaml`; fleet.d still adds\nroles. Validate with `config` and `doctor` before starting or restarting.\n\n## Lifecycle and console commands\n\n```sh\nours-fleet init\nours-fleet up|down [Name...]\nours-fleet restart [Name...]            # preserve/resume harness context\nours-fleet force-restart [Name...]      # fresh context; briefing is reloaded\nours-fleet ls\nours-fleet status|peek|attach|logs Name\nours-fleet logs -f Name\nours-fleet send Name \"prompt\"\nours-fleet send Name --key Enter        # tmux only\nours-fleet rm Name\n```\n\n`peek`, `attach`, and text `send` work with tmux and ACP. ACP attachment\nalso accepts `/permit <permission-id> <option-id>`, `/interrupt`, and\n`/detach`. Raw `--key` input is tmux-only.\n\n## Spawn\n\n```sh\nours-fleet spawn [--temp] Name \\\n  --harness codex|claude-code --session tmux|acp \\\n  --mission \"one line\" --cwd /absolute/path --identity Identity \\\n  --coordinator Coordinator --model MODEL \\\n  --approval ask|allow|deny \\\n  --filesystem read-only|workspace|unrestricted \\\n  --unattended deny|wait \\\n  --bio-file /path/bio.md --persona-file /path/persona.md\n```\n\nPermanent spawn writes `~/fleet.d/Name.yaml` and starts a supervised role.\n`--temp` writes ephemeral state, starts a detached supervisor, and removes the\nrole after exit/reboot. Both lifetimes support `--session acp`.\n\nCodex-specific spawn flags: `--sandbox`, `--permission-mode`, `--launcher`,\n`--profile`, `--search`, repeatable `--codex-config key=value`, repeatable\n`--add-dir`, and legacy `--monitor` (consent for the native Codex monitor,\nnot the `monitor.mode` wake-owner selector). Run `ours-fleet help spawn` for\nexact values.\n\n## fleet.yaml\n\n```yaml\nvars:\n  work_root: /home/me/work\nstart_stagger_ms: 0\ndefaults:\n  harness: codex\n  session: acp\n  model: gpt-model-id\n  permissions:\n    approval: ask\n    filesystem: workspace\n    unattended: deny\n  monitor:\n    mode: fleet                          # fleet (default) | native\nroles:\n  Coordinator:\n    harness: codex\n    session: acp\n    identity: Coordinator\n    cwd: ${work_root}/project\n    mission: Coordinate work and delegate implementation.\n    model: gpt-model-id\n    permissions:\n      approval: ask\n      filesystem: workspace\n      unattended: deny\n    session_options:                    # advanced overrides; normally omit\n      # acp:\n      #   command: [/custom/codex-acp, --flag]\n      tmux:\n        boot_grace_ms: 10000\n    monitor:\n      mode: fleet                        # fleet supervisor | native harness monitor\n      interrupt: false                    # true cancels active work before every configured wake\n      wake_sources: [message_received, file_received, local_contact_request, pending_message]\n      batch_ms: 2000\n      inject: notification\n      turn_fail_threshold: 3\n    harness_options:\n      launcher: auto\n      sandbox: workspace-write\n      approval: on-request\n      search: false\n      profile: fleet\n      add_dirs: [/data/shared]\n      config:\n        model_reasoning_effort: high\n    bio: Public role card and when peers should engage it.\n    persona: Local operating contract, boundaries, and escalation policy.\n    briefing_file: /absolute/custom-briefing.md\n    coordinator: AnotherCoordinator\n    env:\n      KEY: value\n    oversee:\n      - { role: Worker, interval: 5m }\n```\n\nRole values override defaults. `${name}` substitutes entries from `vars`.\nOther role fields include `max_tokens`, `autocompact_pct`, and `isolation`.\nUse README.md for the complete isolation policy and resource-cap schema.\n\n## Permissions\n\nPrefer the harness-neutral `permissions` block:\n\n- `approval: ask|allow|deny`: whether actions may request or receive approval\n- `filesystem: read-only|workspace|unrestricted`: filesystem intent\n- `unattended: deny|wait`: what ACP does when no console can answer a request\n\nThe backend translates this common intent. Harness-native settings in\n`harness_options` take precedence where supplied. Do not choose\n`allow`/`unrestricted`, Codex `never`/`danger-full-access`, or Claude\n`bypassPermissions` without explicit authorization.\n\n### Creation-time isolation\n\n`ours-fleet spawn --isolation-file <path>` supplies a role's sandbox policy at\ncreation, so the FIRST launch is already confined \u2014 a role that only gains\n`isolation:` on a later `up` ran unsandboxed until then.\n\nThe file holds exactly the `isolation:` mapping documented above and nothing\nelse \u2014 the same schema, validated by the same code, so a policy written here\ncannot mean something different from the identical block in fleet.yaml:\n\n```yaml\nnetwork: deny\nfs:\n  read: [/opt/reference]\nresources:\n  mem: 2G\n```\n\nInvalid files are rejected before anything is created: no config, no state\ndirectory, no identity reservation. Works for both permanent and `--temp` roles.\n\n### Never-prompt failure\n\nThe failure this section exists to prevent leaves no error message anywhere.\n\nAn unattended role has no console. When the harness needs a permission decision\nthere is nobody to ask, so the request is refused INSIDE the harness \u2014 no\nprompt, no error, no log line. The agent simply does less than its briefing told\nit to, reports success, and nothing distinguishes that from having done the\nwork. Two settings produce it:\n\n1. a permission mode that suppresses the prompt without granting the action\n   (Claude `dontAsk`, which is why neutral `allow` maps to\n   `bypassPermissions` instead); and\n2. `unattended: deny`, which refuses every request that reaches it.\n\n**Automatic decisions are now recorded.** Every permission request decided\nwithout a human emits a completed event into\n`~/.ours-fleet/agents/<Name>/.session-events.jsonl` carrying the decision,\nwhether policy or a person made it, the policy that produced it\n(`permissions.unattended=deny` vs `permissions.approval=deny`/`=allow`),\nthe reason, and the option selected. `ours-fleet peek` and `attach` render\nthem. Automatic denial asks for a one-shot rejection, never a standing one, so a\nsingle unattended refusal cannot disable a tool for the rest of the session.\n\nA role that can auto-deny logs one line at startup saying so.\n\nTo detect an under-permissioned role BEFORE it runs, use the capability floor\nbelow: `ours-fleet doctor` fails such a role rather than letting it discover\nthe problem silently at work.\n\n### The unattended capability floor\n\nAn unattended role has no console, so a permission request cannot be answered \u2014\nit is refused, silently, inside the harness. The agent then does less than it\nwas told to and reports no error. To make that visible before launch,\n`ours-fleet config` and `ours-fleet doctor` resolve each role's neutral\npermissions through its harness and check the result against a fixed floor:\n\n- `read-state` \u2014 read its briefing, ROUTINES.md, and WORKLOG.md\n- `write-state` \u2014 append its WORKLOG and its own state files\n- `messaging` \u2014 bind its identity, send and receive ours mail\n- `monitor` \u2014 arm and observe its mail monitor\n- `workspace-edit` \u2014 edit and test files in its working directory\n- `status-commands` \u2014 run the inspection commands its briefing prescribes\n\n`doctor` reports this per role as `unattended floor: <Role>`. A role with\n`unattended: deny` that cannot meet the floor FAILS doctor, because it will\ndeny those requests with nobody to see it; with `unattended: wait` it warns,\nbecause a human can still attach and answer.\n\nSecurity meaning: `approval: allow` maps to Claude's `bypassPermissions`,\nwhich genuinely permits the actions the role was authorized to take \u2014\n`dontAsk` only suppresses the prompt while still refusing the action. Nothing\nother than an explicit `allow` is elevated: `ask` stays on Claude's default\nmode and `deny` maps to `plan`. `allow` is therefore a real grant and\nrequires explicit authorization; per-role `isolation:` remains the outer\nboundary that a permission mode cannot cross.\n\nSee also: `spawn --approval/--filesystem/--unattended` set this intent at\ncreation, and `ours-fleet config` prints each role's neutral settings, their\nnative translation, and any warning \u2014 the same text `doctor` reports.\n\nClaude `harness_options`: `permission_mode` (default, acceptEdits, plan,\ndontAsk, bypassPermissions), `plugins`, `mem_palace`, and\n`mem_palace_midsession_autosave`.\n\nCodex `harness_options`: `launcher` (auto, ours-codex, codex), `sandbox`\n(read-only, workspace-write, danger-full-access), `approval` or\n`permission_mode` (untrusted, on-request, never), `profile`, `search`,\n`config`, `add_dirs`, and `monitor`.\n\n## ACP adapters\n\nThe maintained `@agentclientprotocol/codex-acp` and\n`@agentclientprotocol/claude-agent-acp` runtimes are bundled automatically as\noptional ours-fleet dependencies. The supervisor resolves their executable\nentrypoints internally, so default ACP roles do not depend on global PATH.\nThe maintained Claude adapter requires Node 22; tmux and Codex ACP continue to\nwork on the ours-fleet core minimum of Node 20.\n\nOverride an adapter only when necessary with `session_options.acp.command`\n(string or argv list). If optional dependencies were deliberately omitted,\nours-fleet falls back to a compatible globally installed `codex-acp` or\n`claude-agent-acp`. `ours-fleet doctor -c FILE` verifies the resolved adapter.\n\n## Reliable mail wake\n\n`monitor.mode` selects exactly one wake owner:\n\n- `fleet` (default): the ours-fleet supervisor consumes body-free daemon\n  events and advances its durable cursor only after delivery is accepted. ACP\n  uses live steering when supported and falls back to structured\n  `session/prompt`; tmux uses verified console injection.\n- `native`: ours-fleet starts no supervisor monitor; the generated briefing\n  instructs Claude Code or Codex to arm its harness-native wake mechanism.\n\nSet `monitor.interrupt: true` in fleet mode to cancel active work before every\nconfigured wake. The policy is content-blind because the supervisor cannot\ninspect encrypted message bodies. Message bodies are released only when the\nrole calls the ours `get_messages` tool.\n\nLegacy `monitor.enabled: true|false` remains accepted as an alias for\n`mode: fleet|native`; use `mode` in new configuration. Codex's separate\n`harness_options.monitor: true` is native-monitor consent, not monitor-owner\nselection.\nInspect `ours-fleet status Name`, `peek Name`, role logs, and\n`~/.ours-fleet/agents/Name/.monitor-status` when diagnosing delivery.\n";
+export declare const AI_DOCS = "# ours-fleet reference\n\nours-fleet runs persistent or temporary, identity-bound AI roles. A role selects\na harness independently from its session backend:\n\n- harness: `claude-code` or `codex`\n- session: `tmux` (default) or `acp`\n- lifetime: permanent (supervised, restartable) or `spawn --temp`\n\n## Discover and validate\n\n```sh\nours-fleet docs                         # this complete reference (`man` is an alias)\nours-fleet help <command>               # exact flags for one command\nours-fleet config [-c FILE]             # validate and print the merged plan; no changes\nours-fleet doctor [-c FILE] [--harness codex|claude-code]\n```\n\nDefault configuration is `~/fleet.yaml` plus sorted `~/fleet.d/*.yaml` role\ndrop-ins. An explicit `-c FILE` replaces `~/fleet.yaml`; fleet.d still adds\nroles. Validate with `config` and `doctor` before starting or restarting.\n\n## Lifecycle and console commands\n\n```sh\nours-fleet init\nours-fleet up|down [Name...]\nours-fleet restart [Name...]            # preserve/resume harness context\nours-fleet force-restart [Name...]      # fresh context; briefing is reloaded\nours-fleet ls\nours-fleet status|peek|attach|logs Name\nours-fleet logs -f Name\nours-fleet send Name \"prompt\"\nours-fleet send Name --key Enter        # tmux only\nours-fleet rm Name\n```\n\n`peek`, `attach`, and text `send` work with tmux and ACP. ACP attachment\nalso accepts `/permit <permission-id> <option-id>`, `/interrupt`, and\n`/detach`. Raw `--key` input is tmux-only.\n\n## Spawn\n\n```sh\nours-fleet spawn [--temp] Name \\\n  --harness codex|claude-code --session tmux|acp \\\n  --mission \"one line\" --cwd /absolute/path --identity Identity \\\n  --coordinator Coordinator --model MODEL \\\n  --approval ask|allow|deny \\\n  --filesystem read-only|workspace|unrestricted \\\n  --unattended deny|wait \\\n  --bio-file /path/bio.md --persona-file /path/persona.md\n```\n\nPermanent spawn writes `~/fleet.d/Name.yaml` and starts a supervised role.\n`--temp` writes ephemeral state, starts a detached supervisor, and removes the\nrole after exit/reboot. Both lifetimes support `--session acp`.\n\nCodex-specific spawn flags: `--sandbox`, `--permission-mode`, `--launcher`,\n`--profile`, `--search`, repeatable `--codex-config key=value`, repeatable\n`--add-dir`, and legacy `--monitor` (consent for the native Codex monitor,\nnot the `monitor.mode` wake-owner selector). Run `ours-fleet help spawn` for\nexact values.\n\n## fleet.yaml\n\n```yaml\nvars:\n  work_root: /home/me/work\nstart_stagger_ms: 0\ndefaults:\n  harness: codex\n  session: acp\n  model: gpt-model-id\n  permissions:\n    approval: ask\n    filesystem: workspace\n    unattended: deny\n  monitor:\n    mode: fleet                          # fleet (default) | native\nroles:\n  Coordinator:\n    harness: codex\n    session: acp\n    identity: Coordinator\n    cwd: ${work_root}/project\n    mission: Coordinate work and delegate implementation.\n    model: gpt-model-id\n    permissions:\n      approval: ask\n      filesystem: workspace\n      unattended: deny\n    session_options:                    # advanced overrides; normally omit\n      # acp:\n      #   command: [/custom/codex-acp, --flag]\n      tmux:\n        boot_grace_ms: 10000\n    monitor:\n      mode: fleet                        # fleet supervisor | native harness monitor\n      interrupt: false                    # true cancels active work before every configured wake\n      wake_sources: [message_received, file_received, local_contact_request, pending_message]\n      batch_ms: 2000\n      inject: notification\n      turn_fail_threshold: 3\n    harness_options:\n      launcher: auto\n      sandbox: workspace-write\n      approval: on-request\n      search: false\n      profile: fleet\n      add_dirs: [/data/shared]\n      config:\n        model_reasoning_effort: high\n    bio: Public role card and when peers should engage it.\n    persona: Local operating contract, boundaries, and escalation policy.\n    briefing_file: /absolute/custom-briefing.md\n    coordinator: AnotherCoordinator\n    env:\n      KEY: value\n    oversee:\n      - { role: Worker, interval: 5m }\n```\n\nRole values override defaults. `${name}` substitutes entries from `vars`.\nOther role fields include `max_tokens`, `autocompact_pct`, and `isolation`.\nUse README.md for the complete isolation policy and resource-cap schema.\n\n## Permissions\n\nPrefer the harness-neutral `permissions` block:\n\n- `approval: ask|allow|deny`: whether actions may request or receive approval\n- `filesystem: read-only|workspace|unrestricted`: filesystem intent\n- `unattended: deny|wait`: what ACP does when no console can answer a request\n\nThe backend translates this common intent. Harness-native settings in\n`harness_options` take precedence where supplied. Do not choose\n`allow`/`unrestricted`, Codex `never`/`danger-full-access`, or Claude\n`bypassPermissions` without explicit authorization.\n\n### Creation-time isolation\n\n`ours-fleet spawn --isolation-file <path>` supplies a role's sandbox policy at\ncreation, so the FIRST launch is already confined \u2014 a role that only gains\n`isolation:` on a later `up` ran unsandboxed until then.\n\nThe file holds exactly the `isolation:` mapping documented above and nothing\nelse \u2014 the same schema, validated by the same code, so a policy written here\ncannot mean something different from the identical block in fleet.yaml:\n\n```yaml\nnetwork: deny\nfs:\n  read: [/opt/reference]\nresources:\n  mem: 2G\n```\n\nInvalid files are rejected before anything is created: no config, no state\ndirectory, no identity reservation. Works for both permanent and `--temp` roles.\n\n### Never-prompt failure\n\nThe failure this section exists to prevent leaves no error message anywhere.\n\nAn unattended role has no console. When the harness needs a permission decision\nthere is nobody to ask, so the request is refused INSIDE the harness \u2014 no\nprompt, no error, no log line. The agent simply does less than its briefing told\nit to, reports success, and nothing distinguishes that from having done the\nwork. Two settings produce it:\n\n1. a permission mode that suppresses the prompt without granting the action\n   (Claude `dontAsk`, which is why neutral `allow` maps to\n   `bypassPermissions` instead); and\n2. `unattended: deny`, which refuses every request that reaches it.\n\n**Automatic decisions are now recorded.** Every permission request decided\nwithout a human emits a completed event into\n`~/.ours-fleet/agents/<Name>/.session-events.jsonl` carrying the decision,\nwhether policy or a person made it, the policy that produced it\n(`permissions.unattended=deny` vs `permissions.approval=deny`/`=allow`),\nthe reason, and the option selected. `ours-fleet peek` and `attach` render\nthem. Automatic denial asks for a one-shot rejection, never a standing one, so a\nsingle unattended refusal cannot disable a tool for the rest of the session.\n\nA role that can auto-deny logs one line at startup saying so.\n\nTo detect an under-permissioned role BEFORE it runs, use the capability floor\nbelow: `ours-fleet doctor` fails such a role rather than letting it discover\nthe problem silently at work.\n\n### The unattended capability floor\n\nAn unattended role has no console, so a permission request cannot be answered \u2014\nit is refused, silently, inside the harness. The agent then does less than it\nwas told to and reports no error. To make that visible before launch,\n`ours-fleet config` and `ours-fleet doctor` resolve each role's neutral\npermissions through its harness and check the result against a fixed floor:\n\n- `read-state` \u2014 read its briefing, ROUTINES.md, and WORKLOG.md\n- `write-state` \u2014 append its WORKLOG and its own state files\n- `messaging` \u2014 bind its identity, send and receive ours mail\n- `monitor` \u2014 arm and observe its mail monitor\n- `workspace-edit` \u2014 edit and test files in its working directory\n- `status-commands` \u2014 run the inspection commands its briefing prescribes\n\n`doctor` reports this per role as `unattended floor: <Role>`. A role with\n`unattended: deny` that cannot meet the floor FAILS doctor, because it will\ndeny those requests with nobody to see it; with `unattended: wait` it warns,\nbecause a human can still attach and answer.\n\nSecurity meaning: `approval: allow` maps to Claude's `bypassPermissions`,\nwhich genuinely permits the actions the role was authorized to take \u2014\n`dontAsk` only suppresses the prompt while still refusing the action. Nothing\nother than an explicit `allow` is elevated: `ask` stays on Claude's default\nmode and `deny` maps to `plan`. `allow` is therefore a real grant and\nrequires explicit authorization; per-role `isolation:` remains the outer\nboundary that a permission mode cannot cross.\n\nSee also: `spawn --approval/--filesystem/--unattended` set this intent at\ncreation, and `ours-fleet config` prints each role's neutral settings, their\nnative translation, and any warning \u2014 the same text `doctor` reports.\n\nClaude `harness_options`: `permission_mode` (default, acceptEdits, plan,\ndontAsk, bypassPermissions), `plugins`, `mem_palace`, and\n`mem_palace_midsession_autosave`.\n\nCodex `harness_options`: `launcher` (auto, ours-codex, codex), `sandbox`\n(read-only, workspace-write, danger-full-access), `approval` or\n`permission_mode` (untrusted, on-request, never), `profile`, `search`,\n`config`, `add_dirs`, and `monitor`.\n\n## ACP adapters\n\nThe maintained `@agentclientprotocol/codex-acp` and\n`@agentclientprotocol/claude-agent-acp` runtimes are bundled automatically as\noptional ours-fleet dependencies. The supervisor resolves their executable\nentrypoints internally, so default ACP roles do not depend on global PATH.\nThe maintained Claude adapter requires Node 22; tmux and Codex ACP continue to\nwork on the ours-fleet core minimum of Node 20.\n\nOverride an adapter only when necessary with `session_options.acp.command`\n(string or argv list). If optional dependencies were deliberately omitted,\nours-fleet falls back to a compatible globally installed `codex-acp` or\n`claude-agent-acp`. `ours-fleet doctor -c FILE` verifies the resolved adapter.\n\n## Reliable mail wake\n\n`monitor.mode` selects exactly one wake owner:\n\n- `fleet` (default): the ours-fleet supervisor consumes body-free daemon\n  events and advances its durable cursor only after delivery is accepted. ACP\n  uses live steering when supported and falls back to structured\n  `session/prompt`; tmux uses verified console injection.\n- `native`: ours-fleet starts no supervisor monitor; the generated briefing\n  instructs Claude Code or Codex to arm its harness-native wake mechanism.\n\nSet `monitor.interrupt: true` in fleet mode to cancel active work before every\nconfigured wake. The policy is content-blind because the supervisor cannot\ninspect encrypted message bodies. Message bodies are released only when the\nrole calls the ours `get_messages` tool.\n\nLegacy `monitor.enabled: true|false` remains accepted as an alias for\n`mode: fleet|native`; use `mode` in new configuration. Codex's separate\n`harness_options.monitor: true` is native-monitor consent, not monitor-owner\nselection.\nInspect `ours-fleet status Name`, `peek Name`, role logs, and\n`~/.ours-fleet/agents/Name/.monitor-status` when diagnosing delivery.\n\n## Stable config and YAML migration\n\n`ours-fleet config --json` emits schemaVersion 1 resolved plans. Environment\nvalues and mission/persona/bio bodies are withheld; environment keys are sorted\nand values are marked redacted. Additive fields may appear in schema 1, while a\nremoval or semantic reuse requires a new schema version.\n\nYAML parsing always rejects duplicate keys. The current default\n`--yaml-mode compat` warns with file/line/column for anchors, aliases, explicit\ntags, non-scalar keys, and multiple documents. Use `--yaml-mode strict` in CI\nnow; strict becomes the next-major default and compat is the temporary migration\nescape hatch.\n\n## Bounded worklogs, auth proxy, and model recovery\n\nAn optional `worklog: { max_kb, keep_tail_kb, max_archives }` policy rotates a\nstable snapshot at fleet-owned lifecycle points. Concurrent changes defer\nrotation. Archives remain beside WORKLOG.md with the same sensitive-state\nboundary; retention deletes only recognized fleet archive names.\n\n`auth_proxy: { kind: anthropic, base_url, required, health_url }` is Claude-only\nand loopback-only. Fleet injects only ANTHROPIC_BASE_URL and doctor rejects\ncredential env keys. The privileged reference companion is\n`contrib/anthropic-auth-proxy.mjs`; deploy it separately as a dedicated account\nwith a 0600 token file and per-role listener access. Fleet never installs it or\nreads its credential.\n\n`model_chain` is an ordered authorization list and its first entry must equal\n`model`. Only sustained high-confidence entitlement/quota 429 evidence advances\none entry. Transient 429, overload, auth, policy, and unknown errors never\ndown-shift. Runtime state is atomic in .model-recovery.json; exhaustion is\nfail-closed and held down. Change the declared chain/model and restart to\nreconcile explicitly; no chain preserves detection-only behavior.\n";
 /**
  * What every shipped spawn-skill variant must say, and must not say (7.1).
  *

package/dist/docs.js

@@ -272,6 +272,40 @@ Legacy \`monitor.enabled: true|false\` remains accepted as an alias for
 selection.
 Inspect \`ours-fleet status Name\`, \`peek Name\`, role logs, and
 \`~/.ours-fleet/agents/Name/.monitor-status\` when diagnosing delivery.
+
+## Stable config and YAML migration
+
+\`ours-fleet config --json\` emits schemaVersion 1 resolved plans. Environment
+values and mission/persona/bio bodies are withheld; environment keys are sorted
+and values are marked redacted. Additive fields may appear in schema 1, while a
+removal or semantic reuse requires a new schema version.
+
+YAML parsing always rejects duplicate keys. The current default
+\`--yaml-mode compat\` warns with file/line/column for anchors, aliases, explicit
+tags, non-scalar keys, and multiple documents. Use \`--yaml-mode strict\` in CI
+now; strict becomes the next-major default and compat is the temporary migration
+escape hatch.
+
+## Bounded worklogs, auth proxy, and model recovery
+
+An optional \`worklog: { max_kb, keep_tail_kb, max_archives }\` policy rotates a
+stable snapshot at fleet-owned lifecycle points. Concurrent changes defer
+rotation. Archives remain beside WORKLOG.md with the same sensitive-state
+boundary; retention deletes only recognized fleet archive names.
+
+\`auth_proxy: { kind: anthropic, base_url, required, health_url }\` is Claude-only
+and loopback-only. Fleet injects only ANTHROPIC_BASE_URL and doctor rejects
+credential env keys. The privileged reference companion is
+\`contrib/anthropic-auth-proxy.mjs\`; deploy it separately as a dedicated account
+with a 0600 token file and per-role listener access. Fleet never installs it or
+reads its credential.
+
+\`model_chain\` is an ordered authorization list and its first entry must equal
+\`model\`. Only sustained high-confidence entitlement/quota 429 evidence advances
+one entry. Transient 429, overload, auth, policy, and unknown errors never
+down-shift. Runtime state is atomic in .model-recovery.json; exhaustion is
+fail-closed and held down. Change the declared chain/model and restart to
+reconcile explicitly; no chain preserves detection-only behavior.
 `;
 /**
  * What every shipped spawn-skill variant must say, and must not say (7.1).

package/dist/doctor.d.ts

@@ -1,8 +1,10 @@
 import { type Exec } from './exec.js';
+import type { YamlMode } from './config-yaml.js';
 import { type FetchLike } from './monitor.js';
 import type { PrereqReport } from './harness/types.js';
 /** Host-level + per-harness prerequisite report with actionable messages. */
 export declare function doctor(opts?: {
     harness?: string;
     configPath?: string;
+    yamlMode?: YamlMode;
 }, exec?: Exec, platform?: NodeJS.Platform, fetchImpl?: FetchLike): Promise<PrereqReport>;

package/dist/doctor.js

@@ -48,7 +48,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // The configuration is a checked prerequisite in its own right. A config the
     // `config` command rejects must fail here too, with the same cause — while the
     // host checks below still run, because they are what the operator needs next.
-    const loaded = loadConfigResult(opts.configPath);
+    const loaded = loadConfigResult(opts.configPath, opts.yamlMode);
     const roles = loaded.ok ? loaded.roles : [];
     checks.push(loaded.ok
         ? { name: 'config', ok: true, detail: loaded.files.join(' + ') || '(none — no fleet.yaml or fleet.d)' }
@@ -56,6 +56,13 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     checks.push(loaded.ok
         ? { name: 'roles', ok: true, detail: `${roles.length} configured` }
         : { name: 'roles', ok: false, detail: 'unknown — the configuration did not load' });
+    if (loaded.ok)
+        for (const diagnostic of loaded.diagnostics)
+            checks.push({
+                name: `yaml: ${diagnostic.kind}`,
+                ok: true,
+                detail: `warning: ${diagnostic.message}`,
+            });
     if (roles.length === 0 || roles.some(role => (role.session ?? 'tmux') === 'tmux')) {
         const tmux = await exec('tmux', ['-V']);
         checks.push({
@@ -134,6 +141,37 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     + `grants only ${analysis.capabilities.join(', ') || '(nothing)'}`,
         });
     }
+    for (const role of roles.filter(candidate => candidate.auth_proxy !== undefined)) {
+        const proxy = role.auth_proxy;
+        const credentialKeys = Object.keys(role.env ?? {}).filter(key => /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|AUTHORIZATION)$/i.test(key)
+            || /authorization/i.test(key));
+        checks.push({
+            name: `auth proxy secrets: ${role.name}`,
+            ok: credentialKeys.length === 0,
+            detail: credentialKeys.length
+                ? `proxy-enabled role also exposes credential env key(s): ${credentialKeys.join(', ')}`
+                : 'credential-free role environment',
+        });
+        let ok = false;
+        let detail;
+        try {
+            const response = await fetchImpl(proxy.health_url, {
+                signal: AbortSignal.timeout(2_000),
+            });
+            ok = response.ok;
+            detail = response.ok
+                ? `reachable (${proxy.health_url})`
+                : `HTTP ${response.status} from ${proxy.health_url}`;
+        }
+        catch (e) {
+            detail = `unreachable (${proxy.health_url}): ${e.message}`;
+        }
+        checks.push({
+            name: `auth proxy: ${role.name}`,
+            ok: ok || !proxy.required,
+            detail: `${detail}${proxy.required ? ' [required]' : ' [optional]'}`,
+        });
+    }
     // Isolation reporting (AC-9). Backend availability is advisory — isolation is
     // opt-in per role (OQ-1), so a missing bwrap must not fail doctor for fleets that
     // don't use it. Only a role that DECLARES isolation and cannot get it under
@@ -272,10 +310,10 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     }
     return { ok: checks.every(c => c.ok), checks };
 }
-function loadConfigResult(configPath) {
+function loadConfigResult(configPath, yamlMode) {
     try {
-        const cfg = loadConfig(configPath);
-        return { ok: true, roles: cfg.roles, files: cfg.files };
+        const cfg = loadConfig(configPath, { yamlMode });
+        return { ok: true, roles: cfg.roles, files: cfg.files, diagnostics: cfg.diagnostics };
     }
     catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/dist/harness/claude-code.js

@@ -240,6 +240,17 @@ export function makeClaudeCodeAdapter(exec = realExec) {
                 capabilities: claudeCapabilities(native, permissions.filesystem),
             };
         },
+        effectivePermissions(role) {
+            const translated = this.translatePermissions(role.permissions);
+            if (!translated.supported)
+                return translated;
+            const native = permissionMode(role) ?? 'default';
+            return {
+                ...translated,
+                native: { permission_mode: native },
+                capabilities: claudeCapabilities(native, role.permissions.filesystem),
+            };
+        },
         vocabulary: {
             bindTool: 'choose_identity',
             createTool: 'create_identity',

package/dist/harness/codex.js

@@ -258,6 +258,18 @@ export function makeCodexAdapter(exec = realExec) {
                 capabilities: codexCapabilities(approval, sandbox),
             };
         },
+        effectivePermissions(role) {
+            const translated = this.translatePermissions(role.permissions);
+            if (!translated.supported)
+                return translated;
+            const approval = approvalPolicy(role) ?? 'on-request';
+            const sandbox = sandboxMode(role) ?? 'workspace-write';
+            return {
+                ...translated,
+                native: { approval, sandbox },
+                capabilities: codexCapabilities(approval, sandbox),
+            };
+        },
         vocabulary: {
             bindTool: 'choose_identity',
             createTool: 'create_identity',

package/dist/harness/types.d.ts

@@ -103,6 +103,8 @@ export interface HarnessAdapter {
      * explicitly declare that it cannot. Enforced at registration.
      */
     translatePermissions(permissions: CommonPermissions): PermissionTranslation;
+    /** Permission result after native harness_options precedence is applied. */
+    effectivePermissions?(role: ResolvedRole): PermissionTranslation;
     /**
      * The permission settings this role states NATIVELY in `harness_options`,
      * keyed the same way `translatePermissions().native` is, so the two can be

package/dist/model-recovery.d.ts

@@ -0,0 +1,42 @@
+import type { ResolvedRole } from './config.js';
+export type FailureClass = 'model-entitlement-or-quota' | 'transient-rate-limit' | 'overload' | 'authentication' | 'policy' | 'unknown-api-error';
+export interface FailureEvidence {
+    class: FailureClass;
+    httpStatus?: number;
+    model?: string;
+    confidence: 'low' | 'medium' | 'high';
+    source: 'claude-pane' | 'acp' | 'auth-proxy';
+    observedAt: string;
+}
+export interface ModelRecoveryLedger {
+    schemaVersion: 1;
+    chainFingerprint: string;
+    declaredModel: string;
+    effectiveModel: string;
+    index: number;
+    evidenceCount: number;
+    evidenceSource?: FailureEvidence['source'];
+    lastEvidenceAt?: string;
+    transitionedAt?: string;
+    heldDown: boolean;
+    reconciledAt: string;
+}
+export type RecoveryAction = {
+    kind: 'none';
+    ledger: ModelRecoveryLedger;
+} | {
+    kind: 'advance';
+    from: string;
+    to: string;
+    ledger: ModelRecoveryLedger;
+} | {
+    kind: 'hold';
+    model: string;
+    ledger: ModelRecoveryLedger;
+};
+export declare function classifyFailureText(text: string, source?: FailureEvidence['source'], observedAt?: string): FailureEvidence | undefined;
+export declare function reconcileModelRecovery(dir: string, role: ResolvedRole, now?: string): ModelRecoveryLedger | undefined;
+export declare function recordModelFailure(dir: string, role: ResolvedRole, evidence: FailureEvidence, threshold?: number): RecoveryAction;
+export declare function effectiveModelForRole(dir: string, role: ResolvedRole): string | undefined;
+export declare function modelRecoveryHeld(dir: string): boolean;
+export declare function resetModelRecovery(dir: string, role: ResolvedRole): ModelRecoveryLedger | undefined;

package/dist/model-recovery.js

@@ -0,0 +1,120 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+const fingerprint = (chain) => createHash('sha256').update(JSON.stringify(chain)).digest('hex');
+const pathOf = (dir) => join(dir, '.model-recovery.json');
+export function classifyFailureText(text, source = 'claude-pane', observedAt = new Date().toISOString()) {
+    const tail = text.split('\n').slice(-30).join('\n');
+    const status = tail.match(/\b(?:HTTP\s*)?(401|403|429|529)\b/i)?.[1];
+    const httpStatus = status ? Number(status) : undefined;
+    const base = { httpStatus, source, observedAt };
+    if (httpStatus === 529 || /\boverload(?:ed)?\b/i.test(tail))
+        return { ...base, class: 'overload', confidence: 'high' };
+    if (httpStatus === 401 || httpStatus === 403 || /\binvalid (?:api )?key\b/i.test(tail))
+        return { ...base, class: 'authentication', confidence: 'high' };
+    if (/\bpolicy|usage policy|content policy\b/i.test(tail))
+        return { ...base, class: 'policy', confidence: 'high' };
+    if (httpStatus === 429) {
+        const entitlement = /\b(model|subscription|plan)\b.{0,80}\b(not (?:available|included|enabled|covered)|unsupported|access)\b/i.test(tail)
+            || /\b(quota|usage limit|billing limit)\b.{0,80}\b(exceeded|reached|unavailable)\b/i.test(tail);
+        return {
+            ...base,
+            class: entitlement ? 'model-entitlement-or-quota' : 'transient-rate-limit',
+            confidence: entitlement ? 'high' : 'medium',
+        };
+    }
+    if (/\bAPI Error\b/i.test(tail))
+        return { ...base, class: 'unknown-api-error', confidence: 'low' };
+    return undefined;
+}
+export function reconcileModelRecovery(dir, role, now = new Date().toISOString()) {
+    const chain = role.model_chain;
+    if (!chain)
+        return undefined;
+    const fp = fingerprint(chain);
+    let existing;
+    try {
+        existing = JSON.parse(readFileSync(pathOf(dir), 'utf8'));
+    }
+    catch {
+        existing = undefined;
+    }
+    if (existing?.schemaVersion === 1 && existing.chainFingerprint === fp
+        && chain[existing.index] === existing.effectiveModel)
+        return existing;
+    const ledger = {
+        schemaVersion: 1,
+        chainFingerprint: fp,
+        declaredModel: chain[0],
+        effectiveModel: chain[0],
+        index: 0,
+        evidenceCount: 0,
+        heldDown: false,
+        reconciledAt: now,
+    };
+    writeModelRecovery(dir, ledger);
+    return ledger;
+}
+export function recordModelFailure(dir, role, evidence, threshold = 3) {
+    const ledger = reconcileModelRecovery(dir, role, evidence.observedAt);
+    if (!ledger)
+        throw new Error('model recovery requires model_chain');
+    if (ledger.heldDown || evidence.class !== 'model-entitlement-or-quota'
+        || evidence.confidence !== 'high'
+        || (evidence.model !== undefined && evidence.model !== ledger.effectiveModel))
+        return { kind: 'none', ledger };
+    const next = {
+        ...ledger,
+        evidenceCount: ledger.evidenceCount + 1,
+        evidenceSource: evidence.source,
+        lastEvidenceAt: evidence.observedAt,
+    };
+    if (next.evidenceCount < threshold) {
+        writeModelRecovery(dir, next);
+        return { kind: 'none', ledger: next };
+    }
+    if (next.index + 1 >= role.model_chain.length) {
+        const held = { ...next, heldDown: true, transitionedAt: evidence.observedAt };
+        writeModelRecovery(dir, held);
+        writeStatus(dir, held);
+        return { kind: 'hold', model: held.effectiveModel, ledger: held };
+    }
+    const advanced = {
+        ...next,
+        index: next.index + 1,
+        effectiveModel: role.model_chain[next.index + 1],
+        evidenceCount: 0,
+        transitionedAt: evidence.observedAt,
+    };
+    writeModelRecovery(dir, advanced);
+    writeStatus(dir, advanced);
+    return { kind: 'advance', from: ledger.effectiveModel, to: advanced.effectiveModel, ledger: advanced };
+}
+export function effectiveModelForRole(dir, role) {
+    return reconcileModelRecovery(dir, role)?.effectiveModel ?? role.model;
+}
+export function modelRecoveryHeld(dir) {
+    if (!existsSync(pathOf(dir)))
+        return false;
+    try {
+        return JSON.parse(readFileSync(pathOf(dir), 'utf8')).heldDown === true;
+    }
+    catch {
+        return true;
+    } // fail closed on corrupt authorization state
+}
+export function resetModelRecovery(dir, role) {
+    const path = pathOf(dir);
+    if (existsSync(path))
+        replaceFileAtomically(path, '');
+    return reconcileModelRecovery(dir, role);
+}
+const writeModelRecovery = (dir, ledger) => replaceFileAtomically(pathOf(dir), `${JSON.stringify(ledger, null, 2)}\n`);
+const writeStatus = (dir, ledger) => replaceFileAtomically(join(dir, '.model-status'), `${JSON.stringify({
+    schemaVersion: 1,
+    declaredModel: ledger.declaredModel,
+    effectiveModel: ledger.effectiveModel,
+    heldDown: ledger.heldDown,
+    transitionedAt: ledger.transitionedAt,
+}, null, 2)}\n`);

package/dist/monitor.d.ts

@@ -1,4 +1,5 @@
 import type { MonitorConfig, NotifyEventType } from './config.js';
+import { type FailureEvidence } from './model-recovery.js';
 /** A content-free arrival event as the daemon serves it over the notifications API. */
 export interface NotifyEvent {
     event?: NotifyEventType | string;
@@ -53,6 +54,8 @@ export interface MonitorDeps {
             detail?: string;
         }>;
     };
+    /** Body-free, typed evidence for runner-owned model recovery. */
+    onFailureEvidence?(evidence: FailureEvidence): boolean;
 }
 /**
  * Why the monitor is not healthy. Each cause clears on its OWN recovery signal

package/dist/monitor.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { classifyFailureText } from './model-recovery.js';
 // Code constants (not config — YAGNI, design §2).
 const DEFAULT_PORT = 3050;
 const LONGPOLL_TIMEOUT_MS = 35_000; // > the daemon's 25s hold
@@ -517,8 +518,8 @@ export class Monitor {
         // The wake landed and a turn started; observe how that turn terminates so a
         // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
         // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
-        await this.observeTurnOutcome(pid);
-        return true;
+        const recoveryTriggered = await this.observeTurnOutcome(pid);
+        return !recoveryTriggered;
     }
     /**
      * Watch the pane until the just-triggered turn settles, then fold its outcome
@@ -530,25 +531,30 @@ export class Monitor {
     async observeTurnOutcome(pid) {
         for (let i = 0; i < TURN_OBSERVE_POLLS; i++) {
             if (this.stopped)
-                return; // shutting down — leave status
+                return false; // shutting down — leave status
             if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return; // loop marks offline
+                return false; // loop marks offline
             const capture = await safeCapture(this.deps.tmux, this.name);
             if (!capture.ok) {
                 this.degrade('delivery', 'capture failed during turn observation');
-                return;
+                return false;
             }
             if (looksApiError(capture.pane)) {
+                const evidence = classifyFailureText(capture.pane);
+                const recoveryTriggered = evidence
+                    ? this.deps.onFailureEvidence?.(evidence) === true
+                    : false;
                 this.recordTurn('api-error');
-                return;
+                return recoveryTriggered;
             }
             if (!looksRunning(capture.pane)) {
                 this.recordTurn('completed');
-                return;
+                return false;
             }
             await this.deps.sleep(TURN_OBSERVE_INTERVAL_MS);
         }
         this.recordTurn('inconclusive'); // still running at give-up: hold the streak, don't re-arm
+        return false;
     }
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     recordTurn(outcome) {

package/dist/permissions.d.ts

@@ -8,12 +8,14 @@ import type { UnattendedCapability } from './harness/types.js';
  * — and, being unattended, will report no error while failing to.
  */
 export declare const UNATTENDED_FLOOR: readonly UnattendedCapability[];
+/** Fleet-owned wake delivery removes the native Monitor-tool requirement. */
+export declare function requiredUnattendedFloor(role: ResolvedRole): readonly UnattendedCapability[];
 export interface FloorResult {
     meets: boolean;
     missing: UnattendedCapability[];
 }
 /** Which floor capabilities a set of granted capabilities fails to cover. */
-export declare function checkUnattendedFloor(granted: readonly UnattendedCapability[]): FloorResult;
+export declare function checkUnattendedFloor(granted: readonly UnattendedCapability[], required?: readonly UnattendedCapability[]): FloorResult;
 /**
  * One role's neutral permissions, resolved through its harness adapter.
  *

package/dist/permissions.js

@@ -1,4 +1,7 @@
 import { getAdapter } from './harness/registry.js';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { home } from './paths.js';
 /**
  * The capability floor every unattended role must clear. These are not
  * nice-to-haves: an agent that cannot read its briefing, append its worklog,
@@ -9,9 +12,15 @@ import { getAdapter } from './harness/registry.js';
 export const UNATTENDED_FLOOR = [
     'read-state', 'write-state', 'messaging', 'monitor', 'workspace-edit', 'status-commands',
 ];
+/** Fleet-owned wake delivery removes the native Monitor-tool requirement. */
+export function requiredUnattendedFloor(role) {
+    return role.monitor?.mode === 'fleet'
+        ? UNATTENDED_FLOOR.filter(capability => capability !== 'monitor')
+        : UNATTENDED_FLOOR;
+}
 /** Which floor capabilities a set of granted capabilities fails to cover. */
-export function checkUnattendedFloor(granted) {
-    const missing = UNATTENDED_FLOOR.filter(c => !granted.includes(c));
+export function checkUnattendedFloor(granted, required = UNATTENDED_FLOOR) {
+    const missing = required.filter(c => !granted.includes(c));
     return { meets: missing.length === 0, missing };
 }
 /**
@@ -50,7 +59,8 @@ export function analyzeRolePermissions(role) {
     catch (e) {
         return { ...base, supported: false, warnings: [`role '${role.name}': ${e.message}`] };
     }
-    const translation = adapter.translatePermissions(role.permissions);
+    const neutral = adapter.translatePermissions(role.permissions);
+    let translation = adapter.effectivePermissions?.(role) ?? neutral;
     if (!translation.supported) {
         return {
             ...base, supported: false,
@@ -58,8 +68,14 @@ export function analyzeRolePermissions(role) {
                     `permissions — ${translation.reason}`],
         };
     }
-    const conflicts = findConflicts(role, translation.native, adapter.nativePermissionOverrides(role.harness_options));
-    const floor = checkUnattendedFloor(translation.capabilities);
+    const inspection = inspectClaudeDontAskSettings(role);
+    if (inspection && translation.supported) {
+        translation = { ...translation, capabilities: inspection.capabilities };
+    }
+    const conflicts = neutral.supported
+        ? findConflicts(role, neutral.native, adapter.nativePermissionOverrides(role.harness_options))
+        : [];
+    const floor = checkUnattendedFloor(translation.capabilities, requiredUnattendedFloor(role));
     const floorSeverity = role.permissions.unattended === 'deny' ? 'fail' : 'warn';
     return {
         ...base,
@@ -74,7 +90,65 @@ export function analyzeRolePermissions(role) {
             `capability floor — missing ${floor.missing.join(', ')} ` +
             `(${formatNative(translation.native)}; unattended=${role.permissions.unattended} means these ` +
             `requests will ${role.permissions.unattended === 'deny' ? 'be denied silently' : 'block the turn'})`),
-        warnings: translation.warnings.map(w => `role '${role.name}': ${w}`),
+        warnings: [
+            ...translation.warnings.map(w => `role '${role.name}': ${w}`),
+            ...(inspection?.warning ? [`role '${role.name}': ${inspection.warning}`] : []),
+        ],
+    };
+}
+function inspectClaudeDontAskSettings(role) {
+    if (role.harness !== 'claude-code'
+        || role.harness_options?.permission_mode !== 'dontAsk')
+        return undefined;
+    const sources = [
+        join(home(), '.claude', 'settings.json'),
+        ...(role.cwd ? [
+            join(role.cwd, '.claude', 'settings.json'),
+            join(role.cwd, '.claude', 'settings.local.json'),
+        ] : []),
+    ];
+    const allow = [];
+    const deny = [];
+    const used = [];
+    for (const source of sources) {
+        if (!existsSync(source))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(source, 'utf8'));
+            if (Array.isArray(parsed.permissions?.allow))
+                allow.push(...parsed.permissions.allow.filter((v) => typeof v === 'string'));
+            if (Array.isArray(parsed.permissions?.deny))
+                deny.push(...parsed.permissions.deny.filter((v) => typeof v === 'string'));
+            used.push(source);
+        }
+        catch (e) {
+            return {
+                capabilities: ['read-state'],
+                warning: `cannot prove Claude dontAsk allow-list because ${source} is unreadable or invalid: `
+                    + `${e.message}`,
+            };
+        }
+    }
+    const permitted = (patterns) => patterns.some(pattern => allow.some(rule => pattern.test(rule)))
+        && !patterns.some(pattern => deny.some(rule => pattern.test(rule)));
+    const capabilities = [];
+    if (permitted([/^Read(?:\(|$)/i]))
+        capabilities.push('read-state');
+    if (permitted([/^Write(?:\(|$)/i, /^Edit(?:\(|$)/i]))
+        capabilities.push('write-state');
+    if (permitted([/^mcp__(?:ours|plugin_ours)__|^ours[:_]/i]))
+        capabilities.push('messaging');
+    if (role.monitor?.mode === 'fleet' || permitted([/^Monitor(?:\(|$)/i]))
+        capabilities.push('monitor');
+    if (permitted([/^Write(?:\(|$)/i, /^Edit(?:\(|$)/i, /^Bash(?:\(|$)/i]))
+        capabilities.push('workspace-edit');
+    if (permitted([/^Bash(?:\(|$)/i]))
+        capabilities.push('status-commands');
+    return {
+        capabilities,
+        warning: used.length
+            ? `Claude dontAsk allow-list inspected from ${used.join(' + ')}`
+            : 'cannot prove Claude dontAsk allow-list: no readable settings source',
     };
 }
 /** Every line a command should show for a role: translation, conflicts, floor. */

package/dist/resolved-plan.d.ts

@@ -0,0 +1,5 @@
+import type { FleetConfig, ResolvedRole } from './config.js';
+export declare const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+/** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
+export declare function resolvedPlan(cfg: FleetConfig): Record<string, unknown>;
+export declare function resolvedRolePlan(role: ResolvedRole): Record<string, unknown>;