@ours.network/fleet 0.15.4 → 0.15.5

package/README.md

@@ -328,7 +328,7 @@ roles:
     owner_channel:                      # optional trusted owner ingress; requires session: acp
       identity: "Name Owner Channel"     # existing, dedicated ours identity bound only by fleet
       owners: [owner-contact-cid]        # authenticated ours contact IDs, never display names
-      agent: managed-agent-cid           # exact role identity CID allowed to relay messages outward
+      agent: managed-agent-cid           # exact role CID allowed to relay messages/files outward
       interrupt: false                  # false queues; true cancels current work first
       progress_interval_ms: 30000        # fleet-generated progress notices; 0 disables
       attachments:                      # secure inbound documents, images, and voice
@@ -651,15 +651,16 @@ These commands require a running ACP role with `owner_channel` enabled. Missing,
 stopped, tmux, disabled, draining, and unavailable-MCP targets fail without
 starting a second client, binding an identity, or opening a network listener.
 
-The managed agent has one outbound rule: use its ordinary ours `send_message`
-tool to message the channel identity. Fleet checks that the authenticated sender
-CID exactly equals `agent`, then forwards the body as a new message to the owner
-CID that most recently sent inbound channel mail. This applies equally to progress,
-blockers, suggestions, and proactive notes: there is no task/request/update type.
-The agent never chooses an owner recipient. A single configured owner is the safe
-fallback; multiple owners without route history fail closed instead of guessing or
-broadcasting. Different devices sharing one ours identity share one CID, while
-separate authorized identities naturally hand off the route when either sends.
+The managed agent can use its ordinary ours `send_message` or `send_file` tool to
+message the channel identity. Fleet checks that the authenticated sender CID
+exactly equals `agent`, then forwards the body/file to a resolved authenticated
+owner route. This applies equally to blockers, suggestions, proactive notes, and
+ordinary files: there is no model-selected owner recipient. An explicit reply wire
+pins a file to that wire's owner; otherwise the latest authenticated owner is used.
+A single configured owner is the safe fallback; multiple owners without route
+history fail closed instead of guessing or broadcasting. Different devices sharing
+one ours identity share one CID, while separate authorized identities naturally
+hand off the unscoped route when either sends.
 
 Messages from CIDs which are neither an owner nor the configured agent are never
 injected or relayed. Fleet consumes the attempt, does not answer its sender, and
@@ -671,18 +672,32 @@ An owner request follows one ordered lifecycle on its authenticated source wire:
 
 1. Fleet sends an immediate receipt describing started, queued, or interrupting state.
 2. Periodic fleet-generated summaries may report allowlisted ACP activity shapes.
-3. The agent may send any non-final message to the channel identity through its
+3. On maintained Codex ACP adapters, assistant chunks carrying the exact
+   `_meta.codex.phase = "commentary"` marker are automatically batched and forwarded
+   on this request's fixed owner CID/source wire. Unknown or absent phases are never
+   inferred as commentary; thoughts, tools, permissions, prompts, and raw events are
+   excluded by event kind. Older adapters therefore retain final-only behavior.
+4. The agent may also send any non-final or out-of-turn message through its
    ordinary ours MCP tool. CID authentication is the message gate; no task ID,
    request ID, phase, reply reference, or routing command is used.
-4. The agent may send a caption and one or more files to the channel identity.
+ 4. The agent may send a caption and one or more files to the channel identity.
    A reply reference selects the authenticated owner of that exact source wire;
    an uncorrelated group uses the latest authenticated owner (or the sole-owner
    fallback). Fleet resolves that route once, admits every file before emitting
    any part, then sends the caption and files to the same owner on the same route.
-5. Fleet independently emits exactly one final ACP response (or a sanitized
+ 5. Fleet independently emits exactly one final ACP response (or a sanitized
    terminal outcome). Successful owner-request turns send regular files from the
    request outbox afterward, correlated to the same source wire.
 
+Commentary uses a 750 ms latency flush plus paragraph and 1,600-character/6,400-byte
+boundaries, with at most 32 updates and 512 in-memory fragment dedupe keys per turn.
+The terminal boundary flushes commentary before the final. Replay-marked fragments,
+wrong turns, wrong typed origins, missing message IDs, and unsafe/ambiguous content
+fail closed. Commentary plaintext buffers and fragment keys are memory-only; bounded
+wire-and-batch digests plus sending/delivered/uncertain status are persisted before
+transport. Thus reconnect replay and crash recovery never blindly resend the same
+batch, while an uncertain in-flight update may be omitted rather than duplicated.
+
 Fleet chooses the stored latest authenticated owner for every managed-agent
 message; the model supplies only text and the channel contact. Relay audit logs
 contain hashed wire prefixes and sizes, never bodies. A durable pre-send marker
@@ -813,6 +828,19 @@ admission. The host must run an ours-mcp version whose
 these guarantees; `ours-mcp voice-status --json` reports whether transcription
 is currently configured.
 
+Managed-agent file egress is a separate trust direction. It retains the same
+metadata provenance checks, count/per-file/request byte caps, regular-file and
+no-symlink reads, actual byte-count/SHA-256 verification, filename sanitization,
+private staging, fixed owner routing, and bounded body-free recovery metadata.
+It deliberately does not consult `attachments.enabled` or `allowed_mime`; MIME is
+still detected during byte validation, but a declared-versus-detected mismatch is
+not an egress deny gate. Markdown, HTML, octet-stream, unknown extensions, and normal
+binaries are therefore routable only from the exact configured `agent` CID.
+Owner-to-agent admission above remains byte-for-byte strict. Each outbound file
+gets a durable pre-send marker: a failed/ambiguous send becomes `uncertain` and is
+not blindly retried, while files not yet attempted remain recoverable after restart.
+Logs contain counts and byte totals, never filenames or raw bytes.
+
 Owner channels currently require `session: acp`. Fleet needs structured,
 turn-correlated assistant output for automatic replies; scraping a tmux pane
 cannot reliably distinguish the final answer from thoughts, tool output, or

package/dist/owner-channel/attachments.d.ts

@@ -45,8 +45,15 @@ export interface AdmittedAttachment {
 export declare function parseIncomingAttachments(raw: unknown): IncomingAttachment[];
 export declare function parseRetrievedAttachments(raw: unknown, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
 export declare function validateAttachmentSelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
+/**
+ * Managed-agent -> owner egress limits. This intentionally does not consult
+ * `enabled` or `allowed_mime`: those are owner -> agent admission policy.
+ */
+export declare function validateAttachmentRelaySelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
 export declare function prepareAttachmentDirectory(root: string, requestId: string): Promise<string>;
-export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig): Promise<AdmittedAttachment[]>;
+export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig, options?: {
+    mimePolicy?: 'strict' | 'report-only';
+}): Promise<AdmittedAttachment[]>;
 export declare function recoveredAttachment(file: IncomingAttachment, path: string): Promise<RetrievedAttachment>;
 export declare function removeRequestDirectory(path: string): Promise<void>;
 export declare function cleanupAttachmentRoot(root: string, now: number, retentionMs: number, limit?: number): Promise<number>;
@@ -56,6 +63,9 @@ export interface PendingAttachmentRequest {
     originWireId: string;
     fileWireIds: string[];
     createdAt: number;
+    /** Present only for exact-managed-agent -> owner relay recovery. */
+    relayContact?: string;
+    relayReplyTo?: string;
 }
 export declare class AttachmentRecoveryState {
     private readonly path;

package/dist/owner-channel/attachments.js

@@ -118,6 +118,23 @@ export function validateAttachmentSelection(files, config) {
     }
     return undefined;
 }
+/**
+ * Managed-agent -> owner egress limits. This intentionally does not consult
+ * `enabled` or `allowed_mime`: those are owner -> agent admission policy.
+ */
+export function validateAttachmentRelaySelection(files, config) {
+    if (files.length > config.max_files_per_request)
+        return `the relay exceeds the ${config.max_files_per_request}-file limit`;
+    let total = 0;
+    for (const file of files) {
+        if (file.size > config.max_file_bytes)
+            return `a relayed file exceeds the ${config.max_file_bytes}-byte limit`;
+        total += file.size;
+        if (!Number.isSafeInteger(total) || total > config.max_request_bytes)
+            return `the relay exceeds the ${config.max_request_bytes}-byte total limit`;
+    }
+    return undefined;
+}
 export async function prepareAttachmentDirectory(root, requestId) {
     mkdirSync(root, { recursive: true, mode: 0o700 });
     const rootStat = lstatSync(root);
@@ -134,7 +151,7 @@ export async function prepareAttachmentDirectory(root, requestId) {
     await chmod(dir, 0o700);
     return dir;
 }
-export async function admitAttachments(files, dir, config) {
+export async function admitAttachments(files, dir, config, options = {}) {
     const admitted = [];
     let total = 0;
     for (let index = 0; index < files.length; index++) {
@@ -163,7 +180,8 @@ export async function admitAttachments(files, dir, config) {
             throw new Error('retrieved attachments exceed the request size limit');
         const declaredMime = policyMime(file);
         const detectedMime = detectMime(bytes, declaredMime);
-        if (!mimeCompatible(declaredMime, detectedMime))
+        if ((options.mimePolicy ?? 'strict') === 'strict'
+            && !mimeCompatible(declaredMime, detectedMime))
             throw new Error(`retrieved attachment content does not match declared MIME ${declaredMime}`);
         const filename = sanitizeFilename(file.filename);
         const finalPath = join(dir, `${index + 1}-${file.wireId.slice(0, 12)}-${filename}`);
@@ -327,7 +345,10 @@ function validPending(value) {
         && Array.isArray(item.fileWireIds) && item.fileWireIds.length >= 1 && item.fileWireIds.length <= 32
         && item.fileWireIds.every(wire => WIRE.test(wire))
         && new Set(item.fileWireIds).size === item.fileWireIds.length
-        && Number.isSafeInteger(item.createdAt) && item.createdAt >= 0;
+        && Number.isSafeInteger(item.createdAt) && item.createdAt >= 0
+        && (item.relayContact === undefined || CID.test(item.relayContact))
+        && (item.relayReplyTo === undefined || WIRE.test(item.relayReplyTo))
+        && (item.relayReplyTo === undefined || item.relayContact !== undefined);
 }
 export function safeField(value, max) {
     return Array.from(String(value ?? '').normalize('NFC')

package/dist/owner-channel/channel.d.ts

@@ -225,6 +225,8 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private effectiveOwners;
     private authorizationIntegrity;
     private complete;
+    /** Model-authored commentary only; raw protocol/tool data never reaches here. */
+    private safeCommentary;
     private ownerAttachmentPrompt;
     private ownerPrompt;
     private outboxDir;

package/dist/owner-channel/channel.js

@@ -10,7 +10,7 @@ import { OursMcpClient } from './mcp.js';
 import { ownerNotices } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
-import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, } from './attachments.js';
+import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
@@ -19,6 +19,11 @@ const OWNER_UPDATE_MAX_BYTES = 1_024;
 const PROACTIVE_MESSAGE_MAX_CHARS = 4_000;
 const PROACTIVE_MESSAGE_MAX_BYTES = 16_384;
 const RELAY_NACK_MEMORY = 512;
+const COMMENTARY_FLUSH_MS = 750;
+const COMMENTARY_MAX_CHARS = 1_600;
+const COMMENTARY_MAX_BYTES = 6_400;
+const COMMENTARY_MAX_UPDATES = 32;
+const COMMENTARY_DEDUPE_LIMIT = 512;
 /** A relay attempt that failed only because no owner route exists yet. */
 class RelayUnroutableError extends Error {
 }
@@ -686,6 +691,8 @@ export class OwnerChannel {
             const active = {
                 contact: sender.id, wireId: originWireId, requestId, outboundTail: receipt,
                 finalizing: false, updateCount: 0, updateDigests: new Set(), handledWireIds,
+                commentaryBuffer: '', commentaryCount: 0, commentaryKeys: new Set(),
+                commentaryDisabled: false,
             };
             this.activeRequests.set(requestId, active);
             const cleanupDir = requestDir;
@@ -823,6 +830,8 @@ export class OwnerChannel {
         const active = {
             contact: sender.id, wireId, requestId, outboundTail: receipt, finalizing: false,
             updateCount: 0, updateDigests: new Set(), handledWireIds: [wireId],
+            commentaryBuffer: '', commentaryCount: 0, commentaryKeys: new Set(),
+            commentaryDisabled: false,
         };
         this.activeRequests.set(requestId, active);
         const task = this.complete(active, outbox, queued, activityCursor)
@@ -1007,7 +1016,7 @@ export class OwnerChannel {
             const contact = await this.routableContact(route);
             const rejection = !this.attachmentRecovery.integrity()
                 ? 'attachment recovery state is unavailable'
-                : validateAttachmentSelection(group.files, this.attachmentConfig);
+                : validateAttachmentRelaySelection(group.files, this.attachmentConfig);
             if (rejection)
                 throw new Error(rejection);
             const transactionId = this.requestId(`managed-agent-attachment:${handledWireIds.slice().sort().join(':')}`);
@@ -1034,7 +1043,7 @@ export class OwnerChannel {
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
             retrieved.sort((a, b) => order.get(a.wireId) - order.get(b.wireId));
-            const admitted = await admitAttachments(retrieved, requestDir, this.attachmentConfig);
+            const admitted = await admitAttachments(retrieved, requestDir, this.attachmentConfig, { mimePolicy: 'report-only' });
             const digest = createHash('sha256').update(`managed-agent-attachment\0${handledWireIds.slice().sort().join('\0')}`).digest('hex');
             const sending = this.conversations.beginSend(route.contact, digest, Date.now(), 0, 'all');
             try {
@@ -1197,6 +1206,95 @@ export class OwnerChannel {
         let startedAt;
         let phase = 'starting request';
         let timer;
+        const flushCommentary = () => {
+            if (active.commentaryTimer)
+                clearTimeout(active.commentaryTimer);
+            active.commentaryTimer = undefined;
+            const text = active.commentaryBuffer.trim();
+            active.commentaryBuffer = '';
+            if (!text || active.commentaryDisabled || active.finalizing)
+                return;
+            if (active.commentaryCount >= COMMENTARY_MAX_UPDATES) {
+                active.commentaryDisabled = true;
+                return;
+            }
+            let safe;
+            try {
+                safe = this.safeCommentary(text);
+            }
+            catch (error) {
+                active.commentaryDisabled = true;
+                this.logError('ACP commentary forwarding disabled for unsafe content', error);
+                return;
+            }
+            const digest = createHash('sha256')
+                .update(`owner-commentary\0${active.wireId}\0${safe}`).digest('hex');
+            let sending;
+            try {
+                sending = this.conversations.beginSend(active.contact, digest, Date.now(), 0, 'all');
+            }
+            catch (error) {
+                if (error instanceof DuplicateSendError)
+                    return;
+                active.commentaryDisabled = true;
+                this.logError('ACP commentary forwarding disabled by dedupe state', error);
+                return;
+            }
+            active.commentaryCount++;
+            active.outboundTail = active.outboundTail
+                .then(async () => {
+                try {
+                    if (!this.isEffectiveOwner(active.contact))
+                        throw new Error('initiating owner is no longer authorized');
+                    await this.send(active.contact, safe, active.wireId);
+                }
+                catch {
+                    this.conversations.finishSend(sending.id, 'uncertain');
+                    throw new Error('ACP commentary delivery outcome is uncertain');
+                }
+                this.conversations.finishSend(sending.id, 'delivered');
+            })
+                .catch(error => this.logError('ACP commentary delivery failed', error));
+        };
+        const acceptCommentary = (event) => {
+            if (active.commentaryDisabled || active.finalizing || event.turnId !== queued.promptId
+                || event.kind !== 'agent_text' || event.messagePhase !== 'commentary'
+                || event.replayed || event.origin?.kind !== 'owner'
+                || event.origin.requestId !== active.requestId
+                || typeof event.messageId !== 'string' || !event.messageId
+                || typeof event.text !== 'string' || !event.text)
+                return;
+            const key = createHash('sha256')
+                .update(`${event.messageId}\0${event.text}`).digest('hex');
+            if (active.commentaryKeys.has(key))
+                return;
+            active.commentaryKeys.add(key);
+            if (active.commentaryKeys.size > COMMENTARY_DEDUPE_LIMIT)
+                active.commentaryKeys.delete(active.commentaryKeys.values().next().value);
+            let chars = Array.from(active.commentaryBuffer).length;
+            let bytes = Buffer.byteLength(active.commentaryBuffer);
+            for (const point of event.text) {
+                const pointBytes = Buffer.byteLength(point);
+                if (chars >= COMMENTARY_MAX_CHARS || bytes + pointBytes > COMMENTARY_MAX_BYTES) {
+                    flushCommentary();
+                    if (active.commentaryDisabled)
+                        return;
+                    chars = 0;
+                    bytes = 0;
+                }
+                active.commentaryBuffer += point;
+                chars++;
+                bytes += pointBytes;
+            }
+            if (/\n\s*\n$/u.test(active.commentaryBuffer)) {
+                flushCommentary();
+                return;
+            }
+            if (!active.commentaryTimer) {
+                active.commentaryTimer = setTimeout(flushCommentary, COMMENTARY_FLUSH_MS);
+                active.commentaryTimer.unref?.();
+            }
+        };
         const reportProgress = () => {
             const events = this.options.session.eventsSince(lastSeq);
             lastSeq = Math.max(lastSeq, this.latestEventSeq(events));
@@ -1235,19 +1333,28 @@ export class OwnerChannel {
             timer = setInterval(reportProgress, progressMs);
             timer.unref();
         };
-        const unsubscribe = progressMs > 0
-            ? this.options.session.subscribe(event => startProgress(event))
-            : undefined;
+        const unsubscribe = typeof this.options.session.subscribe === 'function'
+            ? this.options.session.subscribe(event => {
+                startProgress(event);
+                // Automatic commentary is an ACP phase extension. Other backends and
+                // older adapters retain their established final-only behavior.
+                if (this.options.session.backend === 'acp')
+                    acceptCommentary(event);
+            })
+            : () => undefined;
         startProgress();
         let result;
         try {
             result = await queued.completion;
         }
         finally {
-            unsubscribe?.();
+            unsubscribe();
             if (timer)
                 clearInterval(timer);
+            if (active.commentaryTimer)
+                clearTimeout(active.commentaryTimer);
         }
+        flushCommentary();
         active.finalizing = true;
         await active.outboundTail;
         const output = result.output?.trim();
@@ -1268,6 +1375,20 @@ export class OwnerChannel {
         for (const wire of active.handledWireIds)
             this.state.remember(wire);
     }
+    /** Model-authored commentary only; raw protocol/tool data never reaches here. */
+    safeCommentary(value) {
+        const message = value.trim().normalize('NFC');
+        if (!message)
+            throw new Error('commentary is empty');
+        if (Array.from(message).length > COMMENTARY_MAX_CHARS
+            || Buffer.byteLength(message) > COMMENTARY_MAX_BYTES)
+            throw new Error('commentary batch exceeds its bounded size');
+        if (/\u0000|[\u202a-\u202e\u2066-\u2069]/u.test(message))
+            throw new Error('commentary contains unsafe control characters');
+        if (/-----BEGIN [A-Z ]*PRIVATE KEY-----|(?:api[_ -]?key|access[_ -]?token|authorization|password|secret)\s*[:=]|(?:chain of thought|private reasoning|internal reasoning)|^(?:stdout|stderr|tool (?:output|result)|command):/imu.test(message))
+            throw new Error('commentary appears to contain secret, reasoning, or raw tool content');
+        return message;
+    }
     ownerAttachmentPrompt(sender, wireId, requestId, outbox, files, caption) {
         const lines = [
             '[fleet-owner]',

package/dist/owner-channel/state.d.ts

@@ -41,6 +41,7 @@ export declare class OwnerConversationState {
     route(effective: Set<string>): {
         contact: string;
         basis: OwnerConversationRouteBasis;
+        replyToWireId?: string;
     };
     routeForWire(wireId: string, effective: Set<string>): {
         contact: string;

package/dist/owner-channel/state.js

@@ -43,7 +43,7 @@ export class OwnerChannelState {
 }
 const CONVERSATION_LIMIT = 64;
 const WIRE_ROUTE_LIMIT = 512;
-const PROACTIVE_SEND_LIMIT = 256;
+const PROACTIVE_SEND_LIMIT = 2_048;
 const PROACTIVE_MIN_INTERVAL_MS = 30_000;
 const HEX_64_LOWER = /^[a-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
@@ -158,7 +158,10 @@ export class OwnerConversationState {
         if (candidates.length) {
             if (candidates[1]?.lastInboundAt === candidates[0].lastInboundAt)
                 throw new Error('proactive owner route is ambiguous');
-            return { contact: candidates[0].contact, basis: 'last-inbound' };
+            return {
+                contact: candidates[0].contact, basis: 'last-inbound',
+                replyToWireId: candidates[0].lastInboundWireId,
+            };
         }
         if (canonical.size === 1)
             return { contact: [...effective][0], basis: 'sole-owner' };
@@ -180,7 +183,7 @@ export class OwnerConversationState {
         const recent = this.sends.filter(send => canonicalCid(send.contact) === canonical).slice(-128);
         // 'all' scope serves wire-keyed idempotency: a crash replay must not
         // deliver the same wire to a second owner after the route moved.
-        const scope = dedupe === 'all' ? this.sends.slice(-128) : recent;
+        const scope = dedupe === 'all' ? this.sends : recent;
         if (scope.some(send => send.digest === digest))
             throw new DuplicateSendError('duplicate proactive owner message refused');
         const last = recent.at(-1);

package/dist/session/acp.d.ts

@@ -127,6 +127,11 @@ export declare class AcpSession implements SessionHandle {
     private settleAutomatically;
     private withinAutomaticBoundary;
     private recordUpdate;
+    /**
+     * Codex ACP's phase extension is the only currently supported visibility
+     * signal. Never infer commentary from text, message order, or unknown meta.
+     */
+    private codexMessagePhase;
     /** Normalize every ACP update losslessly into the durable ledger. */
     private recordConversationUpdate;
     conversationPage(request?: {

package/dist/session/acp.js

@@ -14,6 +14,7 @@ const PERMISSION_TIMEOUT_MS = 10 * 60_000;
 /** Spec §4.3: 10-15 s before a vanished controller triggers the unattended policy. */
 const CONTROLLER_GRACE_MS = 12_000;
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
+const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
 const scheduledTurn = (turn) => turn?.origin?.kind === 'scheduled-loop';
 /**
  * Map typed prompt provenance to the conversation ledger's source vocabulary.
@@ -792,20 +793,29 @@ export class AcpSession {
     }
     recordUpdate(update) {
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
-        this.recordConversationUpdate(update, scheduled);
+        const messagePhase = update.sessionUpdate === 'agent_message_chunk'
+            ? this.codexMessagePhase(update) : undefined;
+        this.recordConversationUpdate(update, scheduled, messagePhase === 'commentary');
         if (update.sessionUpdate === 'config_option_update')
             this.captureRuntimeMetadata(update.configOptions);
         switch (update.sessionUpdate) {
-            case 'agent_message_chunk':
-                if (this.activeTurn && update.content.type === 'text')
+            case 'agent_message_chunk': {
+                const phase = messagePhase;
+                if (this.activeTurn && update.content.type === 'text'
+                    && phase !== 'commentary' && phase !== 'ambiguous')
                     this.activeTurn.output += update.content.text;
                 this.events.emit('agent_text', {
                     turnId: this.activeTurn?.id,
                     origin: this.activeTurn?.origin,
                     text: scheduled ? '[scheduled-loop output redacted]'
                         : update.content.type === 'text' ? update.content.text : `[${update.content.type}]`,
+                    ...(phase === 'commentary' || phase === 'final_answer'
+                        ? { messagePhase: phase } : {}),
+                    ...(typeof update.messageId === 'string' ? { messageId: update.messageId } : {}),
+                    ...(this.replaying ? { replayed: true } : {}),
                 });
                 break;
+            }
             case 'agent_thought_chunk':
                 this.events.emit('thought', {
                     turnId: this.activeTurn?.id,
@@ -836,9 +846,26 @@ export class AcpSession {
                 break;
         }
     }
+    /**
+     * Codex ACP's phase extension is the only currently supported visibility
+     * signal. Never infer commentary from text, message order, or unknown meta.
+     */
+    codexMessagePhase(update) {
+        const meta = update._meta;
+        if (!meta || typeof meta !== 'object' || Array.isArray(meta))
+            return undefined;
+        const codex = meta.codex;
+        if (!codex || typeof codex !== 'object' || Array.isArray(codex))
+            return undefined;
+        const phase = codex.phase;
+        if (phase === undefined)
+            return undefined;
+        return phase === 'commentary' || phase === 'final_answer' ? phase : 'ambiguous';
+    }
     /** Normalize every ACP update losslessly into the durable ledger. */
-    recordConversationUpdate(update, scheduled) {
-        const normalized = normalizeSessionUpdate(update, scheduled ? { redactText: SCHEDULED_LOOP_REDACTION } : {});
+    recordConversationUpdate(update, scheduled, commentary = false) {
+        const normalized = normalizeSessionUpdate(update, scheduled ? { redactText: SCHEDULED_LOOP_REDACTION }
+            : commentary ? { redactText: OWNER_COMMENTARY_REDACTION } : {});
         this.conversation.appendSafe({
             kind: normalized.kind,
             sessionGeneration: this.sessionGeneration,

package/dist/session/events.js

@@ -24,7 +24,12 @@ export class SessionEvents {
             this.events.shift();
         try {
             this.rotateIfNeeded();
-            appendFileSync(this.path, JSON.stringify(event) + '\n', { mode: 0o600 });
+            // Owner-visible commentary remains live/in-memory for the authenticated
+            // bridge, but its plaintext must not become diagnostic state on disk.
+            const persisted = event.kind === 'agent_text' && event.messagePhase === 'commentary'
+                ? { ...event, text: '[assistant commentary redacted]' }
+                : event;
+            appendFileSync(this.path, JSON.stringify(persisted) + '\n', { mode: 0o600 });
         }
         catch { /* diagnostics must never terminate a role */ }
         for (const listener of this.listeners)

package/dist/session/types.d.ts

@@ -149,6 +149,15 @@ export interface SessionEvent {
     toolCallId?: string;
     permissionId?: string;
     text?: string;
+    /**
+     * Adapter-authenticated presentation phase for assistant text. Only the
+     * exact Codex ACP marker is promoted; absence/unknown values stay unset.
+     */
+    messagePhase?: 'commentary' | 'final_answer';
+    /** Stable adapter message/item id when supplied. */
+    messageId?: string;
+    /** True when the adapter is replaying history rather than emitting live work. */
+    replayed?: boolean;
     title?: string;
     status?: string;
     stopReason?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.15.4",
+  "version": "0.15.5",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",