@ours.network/fleet 0.10.4 → 0.11.1

package/dist/isolation/runtime.js

@@ -0,0 +1,136 @@
+import { accessSync, closeSync, constants, existsSync, openSync, readFileSync, readSync, realpathSync, } from 'node:fs';
+import { createRequire } from 'node:module';
+import { delimiter, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+const SYSTEM_ROOTS = ['/usr', '/bin', '/sbin', '/lib', '/lib64', '/etc'];
+const inside = (path, root) => path === root || path.startsWith(root + sep);
+function canonical(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+function commandPath(command, pathValue) {
+    const candidates = isAbsolute(command) || command.includes(sep)
+        ? [resolve(command)]
+        : pathValue.split(delimiter).filter(Boolean).map(dir => resolve(dir, command));
+    for (const candidate of candidates) {
+        try {
+            accessSync(candidate, constants.X_OK);
+            return canonical(candidate);
+        }
+        catch { /* keep searching PATH */ }
+    }
+    return undefined;
+}
+function packageRoot(path) {
+    let dir = existsSync(path) ? dirname(path) : path;
+    for (;;) {
+        const manifest = join(dir, 'package.json');
+        if (existsSync(manifest))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+function dependencyManifest(manifestPath, name) {
+    const localRequire = createRequire(manifestPath);
+    try {
+        return localRequire.resolve(`${name}/package.json`);
+    }
+    catch {
+        // Some packages do not export package.json. Their main entry still gives us
+        // a point from which to find the owning package root.
+        try {
+            const entry = localRequire.resolve(name);
+            const root = packageRoot(entry);
+            return root ? join(root, 'package.json') : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+function addPackageClosure(root, paths, seen) {
+    const canonicalRoot = canonical(root);
+    if (seen.has(canonicalRoot))
+        return;
+    seen.add(canonicalRoot);
+    paths.add(canonicalRoot);
+    const manifestPath = join(canonicalRoot, 'package.json');
+    try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const names = new Set([
+            ...Object.keys(manifest.dependencies ?? {}),
+            ...Object.keys(manifest.optionalDependencies ?? {}),
+            ...Object.keys(manifest.peerDependencies ?? {}),
+        ]);
+        for (const name of names) {
+            const dependency = dependencyManifest(manifestPath, name);
+            if (dependency)
+                addPackageClosure(dirname(dependency), paths, seen);
+        }
+    }
+    catch { /* a malformed/unreadable manifest cannot contribute a closure */ }
+}
+function isNodeScript(path) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+        const bytes = Buffer.alloc(128);
+        const count = readSync(fd, bytes, 0, bytes.length, 0);
+        return /^#!.*\bnode\b/.test(bytes.subarray(0, count).toString('utf8'));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Resolve the concrete runtime closure for an already-selected harness launch.
+ * System roots are already present in every isolation policy; everything else
+ * is returned as an exact read-only executable or npm package-root bind.
+ */
+export function resolveLaunchRuntime(argv, options = {}) {
+    if (!argv.length)
+        return { argv: [], readPaths: [] };
+    const nodeExecutable = canonical(options.nodeExecutable ?? process.execPath);
+    const executable = commandPath(argv[0], options.path ?? process.env.PATH ?? '');
+    const resolvedArgv = executable ? [executable, ...argv.slice(1)] : [...argv];
+    const paths = new Set();
+    const packages = new Set();
+    const consider = (path) => {
+        if (!isAbsolute(path) || !existsSync(path))
+            return;
+        const real = canonical(path);
+        const root = packageRoot(real);
+        if (root)
+            addPackageClosure(root, paths, packages);
+        else
+            paths.add(real);
+        if (real === nodeExecutable || isNodeScript(real))
+            paths.add(nodeExecutable);
+    };
+    if (executable)
+        consider(executable);
+    // A direct Node launch's first existing absolute non-option argument is its
+    // module entrypoint. Other absolute arguments are harness inputs/settings,
+    // not runtime code, and already follow the ordinary filesystem policy.
+    if (executable === nodeExecutable) {
+        const entrypointIndex = argv.findIndex((arg, index) => index > 0 && !arg.startsWith('-') && isAbsolute(arg) && existsSync(arg));
+        if (entrypointIndex !== -1) {
+            resolvedArgv[entrypointIndex] = canonical(argv[entrypointIndex]);
+            consider(resolvedArgv[entrypointIndex]);
+        }
+    }
+    return {
+        argv: resolvedArgv,
+        readPaths: [...paths].filter(path => !SYSTEM_ROOTS.some(root => inside(path, root))),
+    };
+}

package/dist/isolation/types.d.ts

@@ -63,6 +63,8 @@ export interface WrapContext {
      * them for itself or for its peers.
      */
     harnessSharedPaths?: string[];
+    /** Exact launcher/interpreter/module closure required by the selected command. */
+    runtimeReadPaths?: string[];
     brokerEndpoint?: string;
 }
 /**

package/dist/ops.d.ts

@@ -16,6 +16,22 @@ export interface OpsDeps {
      * `ours-fleet up` has no transaction to tell.
      */
     onInstalled?(outcome: InstallOutcome): void;
+    /**
+     * Optional: supervises the single watchdog-scheduler process (Task 10).
+     * Absent for callers that predate watchdogs — `up`/`down` must never throw
+     * just because this hook is missing.
+     */
+    watchdogService?: {
+        /** `changed` is true when the unit/plist content itself differs from what's on disk (or was absent). */
+        install(binPath: string, configPath?: string): Promise<{
+            changed: boolean;
+        }>;
+        start(): Promise<void>;
+        stop(): Promise<void>;
+        /** Bounces an already-running scheduler so a config change actually reaches it — `start()` is a no-op on an active unit. */
+        restart(): Promise<void>;
+        supervised(): boolean;
+    };
 }
 /** Materialize a role's state dir from config: briefing + markers. Returns the dir. */
 export declare function applyRole(role: ResolvedRole, opts?: {

package/dist/ops.js

@@ -1,7 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync, } from 'node:fs';
 import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { agentDir, fleetDDir } from './paths.js';
+import { randomUUID, createHash } from 'node:crypto';
+import { agentDir, fleetDDir, watchdogsRoot } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
@@ -75,8 +75,103 @@ export async function up(cfg, names, deps, configPath, identityGuarantee) {
         outcomes.push(outcome);
         deps.log(`↑ up: ${role.name} (harness: ${role.harness}, identity: ${role.identity}${role.cwd ? `, cwd: ${role.cwd}` : ''})`);
     }
+    await reconcileWatchdogScheduler(cfg, deps, configPath);
     return outcomes;
 }
+const WATCHDOG_FINGERPRINT_FILE = '.config-fingerprint';
+/** Deterministic JSON: object keys sorted recursively, so key-insertion order never affects the hash. */
+function stableStringify(value) {
+    return JSON.stringify(value, (_key, v) => {
+        if (v !== null && typeof v === 'object' && !Array.isArray(v)) {
+            return Object.keys(v).sort()
+                .reduce((acc, k) => { acc[k] = v[k]; return acc; }, {});
+        }
+        return v;
+    });
+}
+/** sha256 over the resolved enabled-watchdog set, stable regardless of config source order (finding #4). */
+function watchdogFingerprint(enabled) {
+    const sorted = [...enabled].sort((a, b) => a.name.localeCompare(b.name));
+    return createHash('sha256').update(stableStringify(sorted)).digest('hex');
+}
+function fingerprintPath() {
+    return join(watchdogsRoot(), WATCHDOG_FINGERPRINT_FILE);
+}
+function readStoredFingerprint() {
+    try {
+        return readFileSync(fingerprintPath(), 'utf8').trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeFingerprint(fingerprint) {
+    mkdirSync(watchdogsRoot(), { recursive: true, mode: 0o700 });
+    writeFileSync(fingerprintPath(), fingerprint + '\n', { mode: 0o600 });
+    chmodSync(fingerprintPath(), 0o600); // mkdirSync/writeFileSync's mode is masked by umask; force it
+}
+/**
+ * Install/start (or stop) the single supervised watchdog-scheduler process
+ * (Task 10) to match the config's enabled watchdogs. Runs on every `up`,
+ * including a named `up <Role>` — cheap and idempotent, and the alternative
+ * (only reconciling on a whole-fleet `up`) would leave a newly-enabled
+ * watchdog unscheduled until the next bare `up`. Never throws: a scheduler
+ * hiccup must not fail the role installs that already succeeded.
+ *
+ * Restarts ONLY when something the scheduler actually needs to pick up
+ * changed (finding #4): an unconditional `restart()` on every `up` —
+ * including a named `up <SomeUnrelatedRole>` — interrupted whatever the
+ * scheduler was mid-run (a 15s stop timeout can kill a long check without a
+ * report). Two independent signals decide: `svc.install()`'s own `changed`
+ * (the unit/plist content — binPath/configPath — differs), and a config
+ * fingerprint over the resolved enabled-watchdog set (sha256, stored at
+ * `<watchdogsRoot>/.config-fingerprint`) — needed because interval/watch/etc.
+ * never appear in the unit content itself (the unit just re-execs `-c
+ * <configPath>`), so `install()` alone can never see them change. Either
+ * signal true -> restart(); neither -> the idempotent start() (a no-op if
+ * already active, otherwise brings up a stopped unit).
+ */
+async function reconcileWatchdogScheduler(cfg, deps, configPath) {
+    const svc = deps.watchdogService;
+    if (!svc)
+        return;
+    const enabled = cfg.watchdogs.filter(w => w.enabled);
+    try {
+        // Check supervised() before any stop (final review #3): on an
+        // unsupervised platform/config, the scheduler was never installed, so
+        // stopping it is not just a no-op — on Linux, stop() throws for a unit
+        // that was never loaded. A watchdog-less fleet must not see that
+        // failure surface as a spurious "! watchdogs scheduler: ..." warning.
+        if (!enabled.length) {
+            if (svc.supervised())
+                await svc.stop();
+            return;
+        }
+        if (!svc.supervised()) {
+            deps.log("! watchdogs configured but OURS_FLEET_SUPERVISOR=none — run 'ours-fleet _run-watchdogs' in the foreground");
+            return;
+        }
+        const { changed: unitChanged } = await svc.install(deps.binPath, configPath);
+        const fingerprint = watchdogFingerprint(enabled);
+        const fingerprintChanged = readStoredFingerprint() !== fingerprint;
+        if (unitChanged || fingerprintChanged) {
+            // restart(), not start(): start() is a no-op on an already-active unit,
+            // so a config change (new/changed watchdogs) would never reach a
+            // scheduler that's already running (final review #4).
+            await svc.restart();
+            deps.log(`↑ watchdogs scheduler (${enabled.map(w => w.name).join(', ')})`);
+        }
+        else {
+            // Idempotent: a no-op on an already-active unit, but still brings up a
+            // stopped one (e.g. the scheduler crashed and systemd gave up retrying).
+            await svc.start();
+        }
+        writeFingerprint(fingerprint);
+    }
+    catch (e) {
+        deps.log(`  ! watchdogs scheduler: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
 export async function down(cfg, names, deps) {
     for (const role of selectRoles(cfg, names)) {
         // Never swallow the backend's reason. "maybe not running" hid real stop
@@ -89,6 +184,20 @@ export async function down(cfg, names, deps) {
             deps.log(`  ! could not stop ${role.name}: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
+    // Only a whole-fleet `down` (no names) stops the scheduler — stopping one
+    // named role is not a decision to stop watching the others (tolerate
+    // absence/errors: a never-installed scheduler must not fail `down`).
+    // supervised() gates the call itself (final review #3): on an
+    // unsupervised platform/config there is nothing installed to stop, and
+    // Linux's stop() throws for a unit that was never loaded.
+    if (names.length === 0 && deps.watchdogService?.supervised()) {
+        try {
+            await deps.watchdogService.stop();
+        }
+        catch (e) {
+            deps.log(`  ! could not stop watchdogs scheduler: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
 }
 /** Re-sync from config + bounce. mode 'keep' resumes context; 'fresh' wipes it. */
 export async function restartRoles(cfg, names, deps, mode, configPath) {

package/dist/paths.d.ts

@@ -14,6 +14,7 @@ export declare const stateRoot: () => string;
 export declare const agentsRoot: () => string;
 export declare const tmpRoot: () => string;
 export declare const logsRoot: () => string;
+export declare const watchdogsRoot: () => string;
 export declare const agentDir: (name: string, temp?: boolean) => string;
 export declare const defaultConfigPath: () => string;
 export declare const fleetDDir: () => string;

package/dist/paths.js

@@ -24,6 +24,7 @@ export const stateRoot = () => join(home(), '.ours-fleet');
 export const agentsRoot = () => join(stateRoot(), 'agents');
 export const tmpRoot = () => join(stateRoot(), 'tmp');
 export const logsRoot = () => join(stateRoot(), 'logs');
+export const watchdogsRoot = () => join(stateRoot(), 'watchdogs');
 export const agentDir = (name, temp = false) => join(temp ? tmpRoot() : agentsRoot(), name);
 export const defaultConfigPath = () => join(home(), 'fleet.yaml');
 export const fleetDDir = () => join(home(), 'fleet.d');

package/dist/resolved-plan.js

@@ -20,6 +20,14 @@ export function resolvedPlan(cfg) {
         startStaggerMs: cfg.startStaggerMs,
         diagnostics: cfg.diagnostics.map(diagnostic => ({ ...diagnostic })),
         roles: cfg.roles.map(resolvedRolePlan),
+        watchdogs: cfg.watchdogs.map(w => sortedObject({
+            name: w.name, sourceFile: w.sourceFile, enabled: w.enabled,
+            intervalMs: w.intervalMs, coordinator: w.coordinator, watch: [...w.watch],
+            harness: w.harness, session: w.session, model: w.model ?? null,
+            identity: w.identity, timeoutMs: w.timeoutMs, keepReports: w.keepReports,
+            alertCooldownMs: w.alertCooldownMs, promptFile: w.promptFile ?? null,
+            isolation: w.isolation ?? null,
+        })),
     };
 }
 export function resolvedRolePlan(role) {

package/dist/runner.js

@@ -11,6 +11,7 @@ import { realExec, shq } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { selectIsolationBackend } from './isolation/registry.js';
 import { resourceArgs, cpuControllerDelegated } from './isolation/resources.js';
+import { resolveLaunchRuntime } from './isolation/runtime.js';
 import { AcpSession } from './session/acp.js';
 import { RoleControlServer } from './session/control.js';
 import { TmuxSession } from './session/tmux.js';
@@ -319,7 +320,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
     const sessionBackend = role.session ?? 'tmux';
-    const launch = sessionBackend === 'acp'
+    let launch = sessionBackend === 'acp'
         ? (() => {
             if (!adapter.buildAcpLaunch)
                 throw new Error(`harness '${role.harness}' does not support the ACP session backend`);
@@ -330,10 +331,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // env prefix + exit capture in buildPaneCommand stay host-side (see §5.3).
     let wrappedArgv = launch.argv;
     if (role.isolation) {
-        // The SAME context config validation and doctor judged (5.2): a policy
-        // checked against a different mount set than the one that launches is not a
-        // check at all.
-        const ctx = { ...isolationContextFor(role), stateDir: dir, runCwd };
+        // Start with the SAME durable context config validation and doctor judged
+        // (5.2), then add the selected launch's exact runtime closure. Those paths
+        // still pass through resolveIsolation's canonical blocklist enforcement.
+        const runtime = resolveLaunchRuntime(launch.argv);
+        launch = { ...launch, argv: runtime.argv };
+        const ctx = {
+            ...isolationContextFor(role), stateDir: dir, runCwd,
+            runtimeReadPaths: runtime.readPaths,
+        };
         const policy = resolveIsolation(role.isolation, ctx);
         const sel = await selectIsolationBackend(policy, deps.exec); // throws on strict + unavailable
         const degradedMarker = join(dir, '.isolation-degraded');

package/dist/watchdog/alerts.d.ts

@@ -0,0 +1,34 @@
+import type { WatchdogReport, WatchdogRoleStatus } from './report.js';
+import type { WatchManifest } from './briefing.js';
+/**
+ * Severity ordering, lowest to highest (must match the briefing contract's alert-rules
+ * sentence verbatim, src/watchdog/briefing.ts): healthy = idle (0) < unknown (1) < stale (2)
+ * < blocked = unreachable (3) < off_briefing (4).
+ */
+export declare const WATCHDOG_STATUS_RANK: Record<WatchdogRoleStatus, number>;
+export interface OpenFinding {
+    role: string;
+    status: WatchdogRoleStatus;
+    since: string;
+    lastAlertedAt: string | null;
+}
+export interface AlertLedger {
+    version: 1;
+    open: Record<string, OpenFinding>;
+    heldDownAlerted: boolean;
+}
+/** Missing or corrupt ledger file yields a clean empty ledger rather than throwing. */
+export declare function readLedger(name: string): AlertLedger;
+export declare function writeLedger(name: string, l: AlertLedger): void;
+/**
+ * Reconcile rules (spec §5): an `error`-status report carries no role evidence, so the ledger
+ * is returned unchanged. For each finding with rank > 0: an existing open entry keeps its
+ * `since` and updates `status` on escalation/de-escalation; a new one opens with `since = now`.
+ * Any role reported `healthy`/`idle` closes (deletes) its open entry. Every role named in
+ * `report.alerts` gets `lastAlertedAt = now`. Roles absent from the report keep their entries —
+ * a watchdog with a narrowed `watch:` set doesn't silently resolve findings it never inspected.
+ * Never mutates `l` — always returns a new ledger object.
+ */
+export declare function reconcileLedger(l: AlertLedger, report: WatchdogReport, now: Date): AlertLedger;
+/** Ledger's open findings + cooldown, in the shape watch.json's `digest` field carries (Task 7 writes it, run reads it back). */
+export declare function computeDigest(l: AlertLedger, cooldownMs: number, now: Date): WatchManifest['digest'];

package/dist/watchdog/alerts.js

@@ -0,0 +1,78 @@
+import { chmodSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { watchdogDir } from './store.js';
+/**
+ * Severity ordering, lowest to highest (must match the briefing contract's alert-rules
+ * sentence verbatim, src/watchdog/briefing.ts): healthy = idle (0) < unknown (1) < stale (2)
+ * < blocked = unreachable (3) < off_briefing (4).
+ */
+export const WATCHDOG_STATUS_RANK = {
+    healthy: 0, idle: 0, unknown: 1, stale: 2, blocked: 3, unreachable: 3, off_briefing: 4,
+};
+function emptyLedger() {
+    return { version: 1, open: {}, heldDownAlerted: false };
+}
+function ledgerPath(name) {
+    return join(watchdogDir(name), 'alerts.json');
+}
+/** Missing or corrupt ledger file yields a clean empty ledger rather than throwing. */
+export function readLedger(name) {
+    try {
+        return JSON.parse(readFileSync(ledgerPath(name), 'utf8'));
+    }
+    catch {
+        return emptyLedger();
+    }
+}
+export function writeLedger(name, l) {
+    const path = ledgerPath(name);
+    writeFileSync(path, JSON.stringify(l, null, 2) + '\n', { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/**
+ * Reconcile rules (spec §5): an `error`-status report carries no role evidence, so the ledger
+ * is returned unchanged. For each finding with rank > 0: an existing open entry keeps its
+ * `since` and updates `status` on escalation/de-escalation; a new one opens with `since = now`.
+ * Any role reported `healthy`/`idle` closes (deletes) its open entry. Every role named in
+ * `report.alerts` gets `lastAlertedAt = now`. Roles absent from the report keep their entries —
+ * a watchdog with a narrowed `watch:` set doesn't silently resolve findings it never inspected.
+ * Never mutates `l` — always returns a new ledger object.
+ */
+export function reconcileLedger(l, report, now) {
+    if (report.status === 'error')
+        return l;
+    const open = { ...l.open };
+    const nowIso = now.toISOString();
+    for (const finding of report.roles) {
+        const rank = WATCHDOG_STATUS_RANK[finding.status];
+        if (rank > 0) {
+            const existing = open[finding.role];
+            open[finding.role] = {
+                role: finding.role,
+                status: finding.status,
+                since: existing ? existing.since : nowIso,
+                lastAlertedAt: existing ? existing.lastAlertedAt : null,
+            };
+        }
+        else {
+            delete open[finding.role];
+        }
+    }
+    for (const alert of report.alerts) {
+        if (open[alert.role])
+            open[alert.role] = { ...open[alert.role], lastAlertedAt: nowIso };
+    }
+    return { ...l, open };
+}
+/** Ledger's open findings + cooldown, in the shape watch.json's `digest` field carries (Task 7 writes it, run reads it back). */
+export function computeDigest(l, cooldownMs, now) {
+    return {
+        cooldown_ms: cooldownMs,
+        open: Object.values(l.open).map(f => ({
+            role: f.role,
+            status: f.status,
+            since: f.since,
+            realert_after: f.lastAlertedAt ? new Date(new Date(f.lastAlertedAt).getTime() + cooldownMs).toISOString() : null,
+        })),
+    };
+}

package/dist/watchdog/briefing.d.ts

@@ -0,0 +1,65 @@
+import type { ResolvedWatchdog } from './config.js';
+import type { BriefingVocab } from '../harness/types.js';
+/** One entry in `watch.json`'s `roles` array — where to find a watched role's state. */
+export interface WatchManifestRole {
+    name: string;
+    stateDir: string;
+}
+/**
+ * The fixed run manifest a watchdog run reads at `manifestPath` (7.3 §3, Task 7 writes it,
+ * Task 12+ digest reads it back). It carries everything the run needs to identify itself in
+ * report.json (`watchdog`, `run_id`, `started_at`) plus the suppression digest that makes
+ * alerting idempotent across runs.
+ */
+export interface WatchManifest {
+    watchdog: string;
+    run_id: string;
+    coordinator: string;
+    started_at: string;
+    roles: WatchManifestRole[];
+    digest: {
+        cooldown_ms: number;
+        open: Array<{
+            role: string;
+            status: string;
+            since: string;
+            realert_after: string | null;
+        }>;
+    };
+}
+export interface WatchdogBriefingOpts {
+    wd: ResolvedWatchdog;
+    manifestPath: string;
+    reportPath: string;
+    vocabulary: BriefingVocab;
+    /** What spawn actually established about the watchdog's ours identity (7.3, decision 3). */
+    identityGuarantee: 'verified' | 'created' | 'unverified';
+    /** Raw prompt_file content, appended as extra focus — never a replacement (owner decision 1). */
+    promptFocus?: string;
+}
+/**
+ * Render a watchdog run's fixed contract (briefing.md-equivalent for a one-shot clean-context
+ * run): bind, observe-only rules, procedure, status vocabulary, evidence rules, alert rules,
+ * report schema, and — if the watchdog configures one — an appended prompt_file focus.
+ *
+ * The contract is fixed for every watchdog (spec §5: "The schema is fixed for every watchdog,
+ * including ones with a prompt_file; the override adds focus, never fields"), so every section
+ * below is unconditional except the identity-guarantee wording and the trailing focus append.
+ */
+export declare function generateWatchdogBriefing(opts: WatchdogBriefingOpts): string;
+export interface NotifierBriefingOpts {
+    wd: ResolvedWatchdog;
+    vocabulary: BriefingVocab;
+    /** What spawn actually established about the watchdog's ours identity (7.3, decision 3). */
+    identityGuarantee: 'verified' | 'created' | 'unverified';
+    /** The exact message to relay — the scheduler composed this, the notifier only delivers it. */
+    text: string;
+}
+/**
+ * Render a scheduler-alert notifier run's entire contract: a minimal one-shot agent whose sole
+ * job is to bind its identity, send one exact message to the coordinator, and write `sent.json`
+ * as its completion sentinel. Used only for scheduler-level alerts (e.g. held-down) — the fleet
+ * process itself cannot send ours messages (deviation 4), so this is how it delegates the send.
+ * Unlike `generateWatchdogBriefing`, there is no report.json, no manifest, and no inspection.
+ */
+export declare function generateNotifierBriefing(opts: NotifierBriefingOpts): string;