@ours.network/fleet 0.17.7 → 0.18.0-nightly.2

package/dist/runner.js

@@ -59,15 +59,10 @@ const defaultDeps = () => ({
     },
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
-/** Fleet roles consume the operator-owned daemon; a role session never starts it. */
-const FLEET_OURS_AUTOSTART = '0';
 /** Environment injected only into the managed harness process. */
 export function managedFleetProxyEnv(role, stateDir) {
     return {
         ...(role.env ?? {}),
-        // This must win over both inherited/configured auto-start. ACP agents run
-        // directly rather than through ours-codex, so the runner owns this fence.
-        OURS_AUTOSTART: FLEET_OURS_AUTOSTART,
         [FLEET_PROXY_STATE_DIR_ENV]: stateDir,
         [FLEET_PROXY_CALLER_ENV]: role.name,
     };
@@ -111,14 +106,11 @@ async function executeManagedSpawn(caller, configPath, requested, log) {
         session: preview.session,
         ...(preview.model ? { model: preview.model } : {}),
         monitor: { mode: preview.monitor.mode, interrupt: preview.monitor.interrupt },
-        permissionMode: effectivePermissionMode(preview),
         inherited,
         creationActionId,
     };
     log(`[${caller.name}] managed fleet proxy spawned ${result.lifetime} role ${result.role} `
-        + `harness=${result.harness} session=${result.session} `
-        + `permission=${result.permissionMode.fleetMode} `
-        + `native=${result.permissionMode.nativeMode}`);
+        + `harness=${result.harness} session=${result.session}`);
     return result;
 }
 /**
@@ -148,10 +140,6 @@ export function recordMonitorOwner(dir, owner) {
 export function buildPaneCommand(launch, roleEnv, exitStatusPath, paneArgv = launch.argv) {
     const env = {
         PATH: process.env.PATH ?? '', COLORTERM: 'truecolor', ...launch.env, ...(roleEnv ?? {}),
-        // Tmux roles have the same daemon-client boundary as ACP roles. Keep this
-        // last so neither harness preparation nor a role env block can take over
-        // the shared daemon lifecycle.
-        OURS_AUTOSTART: FLEET_OURS_AUTOSTART,
     };
     // Interactive panes should advertise colour even when the supervisor itself
     // was launched with NO_COLOR. A role may still deliberately opt back in to
@@ -542,10 +530,6 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             permissions: perms,
             modeId: adapter.acpPermissionModeId?.(role),
             permissionMode: effectivePermissionMode(role),
-            // Provenance travels with the exact ACP launch. Keeping it out of a
-            // role-only adapter hook prevents a PATH fallback or resolver skew from
-            // claiming metadata trust for an argv it did not authenticate.
-            permissionMetadataSource: launch.permissionMetadataSource,
             log: deps.log,
         });
         pid = acpSession.pid;
@@ -993,16 +977,8 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
             continue;
         }
         const fastFailSecs = fastFailSecsFor(name, opts.configPath);
-        // The fast-fail boundary starts a recovery episode; it must not also be
-        // the boundary that declares recovery successful. Otherwise alternating
-        // 19s and 20s deaths erase one another forever. Require the configured
-        // number of fast-fail windows to survive before closing an active streak.
-        // This hysteresis stays adapter-relative (100s for the current 20s/5-attempt
-        // policy) and still lets a genuinely sustained session reset the breaker.
-        const stableRecoverySecs = fastFailSecs * RESTART_FAIL_THRESHOLD;
-        const recoveryFailed = result.elapsedSecs < fastFailSecs
-            || (ledger.consecutiveImmediateFailures > 0 && result.elapsedSecs < stableRecoverySecs);
-        if (!recoveryFailed) {
+        const immediate = result.elapsedSecs < fastFailSecs;
+        if (!immediate) {
             // A session that ran for a while is not a restart loop, whatever ended it.
             writeRestartLedger(dir, {
                 ...emptyLedger(),

package/dist/session/acp.d.ts

@@ -5,21 +5,6 @@ import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCom
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
-/**
- * How long a steering-started turn is presumed to still own the adapter after
- * its last update. Such a turn has no prompt id, so it never reports a
- * stopReason and there is no exact end to observe — silence is the only signal
- * available, and this is the bound that turns it into a decision.
- *
- * Sized from the fleet's own scheduled-run history: across 1513 completed
- * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
- * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
- * adapter is still working and re-admit a prompt into a busy turn, which is the
- * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
- * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
- * live role.
- */
-export declare const STEERING_OCCUPANCY_IDLE_MS = 150000;
 /** Server-generated typed provenance followed by the exact human-authored body. */
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
@@ -35,8 +20,6 @@ export interface AcpSessionOptions {
     modeId?: string;
     /** Adapter-resolved live permission policy; separate from ACP agent-specific session modes. */
     permissionMode?: NonNullable<SessionSnapshot['permissionMode']>;
-    /** Adapter-authenticated request-metadata vocabulary; never inferred from ACP `_meta`. */
-    permissionMetadataSource?: 'codex-acp';
     log(line: string): void;
     /** Test seam for the cancel-escalation grace period; production uses the default. */
     cancelGraceMs?: number;
@@ -48,8 +31,6 @@ export interface AcpSessionOptions {
     controllerGraceMs?: number;
     /** Test seam; production uses AFTER_TOOL_BOUNDARY_TIMEOUT_MS. */
     afterToolBoundaryTimeoutMs?: number;
-    /** Test seam; production uses STEERING_OCCUPANCY_IDLE_MS. */
-    steeringOccupancyIdleMs?: number;
 }
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
@@ -77,12 +58,6 @@ export declare class AcpSession implements SessionHandle {
     private connection;
     private sessionId?;
     private readiness;
-    /**
-     * Last non-replayed session update from the agent. `readiness` cannot answer
-     * "is this agent working" for a steered turn (FLEET-002), and this is the
-     * evidence that can.
-     */
-    private lastUpdateAt?;
     private lastError?;
     private promptTail;
     private queueDepth;
@@ -98,13 +73,6 @@ export declare class AcpSession implements SessionHandle {
     private cancelEscalation?;
     private cancelForceKill?;
     private cancelRecoveryReason?;
-    /**
-     * Held while a steering-started turn is believed to own the adapter. It is a
-     * lease, not a latch: `steeringRelease` always fires, so the role can never be
-     * stranded busy by a wake whose turn ended without telling anyone.
-     */
-    private steeringOccupied;
-    private steeringRelease?;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -126,20 +94,6 @@ export declare class AcpSession implements SessionHandle {
      */
     private recoverOpenPrompts;
     isAlive(): boolean;
-    /**
-     * Take the occupancy lease for a turn the adapter started on its own behalf.
-     * Refreshed by every adapter update, so it tracks work actually happening
-     * rather than a fixed guess at how long a wake takes.
-     */
-    private holdSteeringOccupancy;
-    private refreshSteeringOccupancy;
-    /**
-     * Every exit from occupancy comes through here, including the ones that are
-     * not the timer: a real turn boundary, close, and adapter exit. A lease that
-     * can leak is worse than the bug it fixes — it would leave the role reporting
-     * `running` forever and starve scheduled admission permanently.
-     */
-    private releaseSteeringOccupancy;
     snapshot(): SessionSnapshot;
     private toolCall;
     private reserveTool;
@@ -231,15 +185,6 @@ export declare class AcpSession implements SessionHandle {
      */
     private settleAutomatically;
     private withinAutomaticBoundary;
-    /**
-     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
-     * execute request. The marker is meaningful only together with the runner's
-     * independently supplied, adapter-authenticated metadata vocabulary and effective
-     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
-     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
-     * malformed requests on the ordinary fail-closed path.
-     */
-    private isEffectiveCodexProtectedMcpApproval;
     private recordUpdate;
     /**
      * Codex ACP's phase extension is the only currently supported visibility

package/dist/session/acp.js

@@ -16,21 +16,6 @@ const PERMISSION_TIMEOUT_MS = 10 * 60_000;
 const CONTROLLER_GRACE_MS = 12_000;
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120_000;
-/**
- * How long a steering-started turn is presumed to still own the adapter after
- * its last update. Such a turn has no prompt id, so it never reports a
- * stopReason and there is no exact end to observe — silence is the only signal
- * available, and this is the bound that turns it into a decision.
- *
- * Sized from the fleet's own scheduled-run history: across 1513 completed
- * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
- * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
- * adapter is still working and re-admit a prompt into a busy turn, which is the
- * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
- * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
- * live role.
- */
-export const STEERING_OCCUPANCY_IDLE_MS = 150_000;
 const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
 const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
@@ -217,12 +202,6 @@ export class AcpSession {
     connection;
     sessionId;
     readiness = 'starting';
-    /**
-     * Last non-replayed session update from the agent. `readiness` cannot answer
-     * "is this agent working" for a steered turn (FLEET-002), and this is the
-     * evidence that can.
-     */
-    lastUpdateAt;
     lastError;
     promptTail = Promise.resolve();
     queueDepth = 0;
@@ -238,13 +217,6 @@ export class AcpSession {
     cancelEscalation;
     cancelForceKill;
     cancelRecoveryReason;
-    /**
-     * Held while a steering-started turn is believed to own the adapter. It is a
-     * lease, not a latch: `steeringRelease` always fires, so the role can never be
-     * stranded busy by a wake whose turn ended without telling anyone.
-     */
-    steeringOccupied = false;
-    steeringRelease;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -275,7 +247,6 @@ export class AcpSession {
             if (this.cancelForceKill)
                 clearTimeout(this.cancelForceKill);
             this.cancelForceKill = undefined;
-            this.releaseSteeringOccupancy('adapter exited');
             // Record the child's real exit code/signal. The tmux path can only see a
             // shell's `$?`; here the truth is available, so keep it.
             const classified = classifyChildExit(code, signal);
@@ -376,60 +347,17 @@ export class AcpSession {
         // terminal fact (signal exits deliberately leave exitCode null).
         return this.child.exitCode === null && (this.child.signalCode ?? null) === null;
     }
-    /**
-     * Take the occupancy lease for a turn the adapter started on its own behalf.
-     * Refreshed by every adapter update, so it tracks work actually happening
-     * rather than a fixed guess at how long a wake takes.
-     */
-    holdSteeringOccupancy() {
-        if (this.closing || !this.isAlive())
-            return;
-        this.steeringOccupied = true;
-        this.refreshSteeringOccupancy();
-    }
-    refreshSteeringOccupancy() {
-        if (!this.steeringOccupied)
-            return;
-        if (this.steeringRelease)
-            clearTimeout(this.steeringRelease);
-        this.steeringRelease = setTimeout(() => this.releaseSteeringOccupancy('adapter silent'), this.options.steeringOccupancyIdleMs ?? STEERING_OCCUPANCY_IDLE_MS);
-        this.steeringRelease.unref?.();
-    }
-    /**
-     * Every exit from occupancy comes through here, including the ones that are
-     * not the timer: a real turn boundary, close, and adapter exit. A lease that
-     * can leak is worse than the bug it fixes — it would leave the role reporting
-     * `running` forever and starve scheduled admission permanently.
-     */
-    releaseSteeringOccupancy(reason) {
-        if (this.steeringRelease)
-            clearTimeout(this.steeringRelease);
-        this.steeringRelease = undefined;
-        if (!this.steeringOccupied)
-            return;
-        this.steeringOccupied = false;
-        this.options.log(`[${this.options.name}] steering-started turn no longer holds the adapter (${reason})`);
-    }
     snapshot() {
         return {
             backend: 'acp',
             alive: this.isAlive(),
-            // A steering-started turn is real work with no prompt id. Reporting the
-            // session idle while it runs is what let the arbiter admit a scheduled
-            // prompt into a busy adapter, whose `session/prompt` then never returned
-            // a stopReason and ended in a cancellation deadline and a SIGTERM.
-            readiness: this.readiness === 'idle' && this.steeringOccupied
-                ? 'running' : this.readiness,
+            readiness: this.readiness,
             sessionId: this.sessionId,
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
             reasoningEffort: this.reasoningEffort,
             permissionMode: this.options.permissionMode,
-            activity: {
-                activeToolCalls: this.activeToolCalls.size,
-                ...(this.lastUpdateAt ? { lastUpdateAt: this.lastUpdateAt } : {}),
-            },
         };
     }
     toolCall(toolCallId) {
@@ -927,7 +855,6 @@ export class AcpSession {
         if (this.controllerGrace)
             clearTimeout(this.controllerGrace);
         this.controllerGrace = undefined;
-        this.releaseSteeringOccupancy('session closed');
         for (const [permissionId, pending] of [...this.pendingPermissions])
             this.settlePendingAutomatically(permissionId, pending, 'cancelled', undefined, 'the session closed while this request was pending');
         this.releaseAllTools();
@@ -1086,10 +1013,6 @@ export class AcpSession {
         }
         finally {
             this.releaseAllTools();
-            // A turn this client owned has ended, so the adapter has reported a
-            // boundary: whatever a steering call started before it is over too. This
-            // is the release path that does not depend on the silence timer.
-            this.releaseSteeringOccupancy('turn boundary');
             if (this.activeTurn?.id === turnId) {
                 this.activeTurn.settle();
                 if (this.cancelEscalation)
@@ -1112,12 +1035,6 @@ export class AcpSession {
             ]);
             if (response.outcome === 'failed')
                 return turnResult(false, 'failed', 'ACP steering failed');
-            // `injected` joined a turn this client already owns and will settle.
-            // `startedNewTurn` created one nobody owns: the adapter is working and
-            // will never answer for it, so admission has to learn about it here or
-            // not at all.
-            if (response.outcome === 'startedNewTurn')
-                this.holdSteeringOccupancy();
             return turnResult(true, 'inconclusive', response.outcome);
         }
         catch (error) {
@@ -1145,17 +1062,6 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
-            // Protected MCP approval is already the tool's narrow gate. Never turn
-            // this one decision into an adapter-wide standing grant.
-            const option = choose(['allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissionMode.fleetMode=allow', 'the trusted Codex adapter authenticated a protected MCP approval request');
-            if (option)
-                this.allowPermission(toolCallId, permissionId);
-            else
-                this.releasePermission(toolCallId, permissionId);
-            return Promise.resolve(response);
-        }
         if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
             const option = choose(['allow_always', 'allow_once']);
             const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
@@ -1282,34 +1188,7 @@ export class AcpSession {
         const cwd = resolve(this.options.cwd);
         return canonicallyWithin(cwd, locations.map(location => resolve(location.path)));
     }
-    /**
-     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
-     * execute request. The marker is meaningful only together with the runner's
-     * independently supplied, adapter-authenticated metadata vocabulary and effective
-     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
-     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
-     * malformed requests on the ordinary fail-closed path.
-     */
-    isEffectiveCodexProtectedMcpApproval(params) {
-        const locations = params.toolCall.locations ?? [];
-        return this.options.permissionMetadataSource === 'codex-acp'
-            && this.options.permissionMode?.fleetMode === 'allow'
-            && params.toolCall.kind === 'execute'
-            && params.toolCall.status === 'pending'
-            && locations.length === 0
-            && params._meta?.is_mcp_tool_approval === true
-            && params.options.some(option => option.optionId === 'allow_once' && option.kind === 'allow_once')
-            && params.options.some(option => option.optionId === 'decline' && option.kind === 'reject_once');
-    }
     recordUpdate(update) {
-        // Replayed history is not current activity: `session/load` would otherwise
-        // make a cold session look like it had just been working. The same reason
-        // keeps it from extending the steering lease, which is evidence the adapter
-        // is working right now — for a steering-started turn, the only evidence.
-        if (!this.replaying) {
-            this.lastUpdateAt = new Date().toISOString();
-            this.refreshSteeringOccupancy();
-        }
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;

package/dist/session/types.d.ts

@@ -1,16 +1,5 @@
 import type { SessionBackendId } from '../config.js';
 import type { ConversationEventV1, ConversationSnapshot, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
-/**
- * TURN OCCUPANCY, and nothing else: `idle` means no fleet-tracked turn is in
- * flight, which is exactly the question `arbiter.tryScheduled` asks before it
- * admits a prompt. It is NOT a claim that the agent is doing nothing — a wake
- * delivered through the `_session/steering` extension answers `startedNewTurn`
- * and runs a whole turn that fleet never gets a `session/prompt` response for
- * (ACP has no turn-end session update), so `readiness` stays `idle` for its
- * entire duration. Anything reporting activity or liveness to a human must
- * corroborate with `SessionSnapshot.activity` instead of reading `idle` here as
- * "not working".
- */
 export type SessionReadiness = 'starting' | 'idle' | 'running' | 'awaiting_permission' | 'failed';
 export type TurnOutcome = 'completed' | 'refused' | 'cancelled' | 'failed' | 'inconclusive';
 export type TurnCancellationSource = 'owner' | 'local-console' | 'fleet-monitor' | 'scheduled-loop' | 'shutdown';
@@ -181,19 +170,6 @@ export interface SessionSnapshot {
         /** Exact harness-native approval/permission mode used by this runner. */
         nativeMode: string;
     };
-    /**
-     * Observed agent activity, independent of turn occupancy: the evidence a
-     * human-facing surface needs before calling a role idle. Absent on backends
-     * that cannot observe the agent at all (tmux), which is itself honest — no
-     * evidence is not evidence of inactivity.
-     */
-    activity?: SessionActivity;
-}
-export interface SessionActivity {
-    /** ACP tool calls currently reserved (lifecycle open or permission pending). */
-    activeToolCalls: number;
-    /** When the agent last sent ANY session update, replay excluded. */
-    lastUpdateAt?: string;
 }
 export type SessionEventKind = 'state' | 'agent_text' | 'thought' | 'tool_call' | 'tool_update' | 'permission' | 'monitor_delivery' | 'turn_stop' | 'error';
 /** What a settled permission request resolved to. */

package/dist/supervisor/systemd.js

@@ -69,6 +69,33 @@ export function makeSystemdBackend(exec = realExec) {
                     dirname(process.execPath),
                     ...(process.env.PATH ?? '').split(delimiter),
                 ].filter(Boolean))].join(delimiter);
+            // Same reason as PATH, for the other thing a lingering unit cannot inherit:
+            // WHICH ours daemon this fleet was set up against.
+            //
+            // ours-fleet resolves its daemon from OURS_CONFIG / OURS_PORT / OURS_STATE_DIR
+            // and otherwise falls back to ~/.ours and port 3050 (src/monitor.ts). A host
+            // set up against a non-default daemon — the installer's multi-daemon profiles
+            // do exactly this — passes that selection to `ours-fleet init` in the
+            // environment, and it died there: nothing persisted it, so every runner
+            // systemd started at boot resolved the default daemon again, and on a host
+            // where only the non-default daemon exists that is a daemon that is not there.
+            //
+            // ONLY OURS_CONFIG is baked, deliberately. It names which daemon, and leaves
+            // that daemon's own config file authoritative for port and state directory, so
+            // a later edit to it still wins. Baking OURS_PORT/OURS_STATE_DIR would freeze
+            // those into a unit file that outranks the config for ever after — the failure
+            // mode @ours.network/cli avoids for the same reason (packages/cli/src/
+            // service.ts: "The port is deliberately NOT baked").
+            //
+            // Absent from init's environment ⇒ no line, and the unit is byte-for-byte what
+            // it has always been. This teaches fleet nothing about installer profiles; it
+            // persists the selection fleet was initialised with.
+            const unitEnv = ['PATH=' + servicePath];
+            if (process.env.OURS_CONFIG)
+                unitEnv.push('OURS_CONFIG=' + process.env.OURS_CONFIG);
+            const environmentLines = unitEnv
+                .map(value => `Environment="${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`)
+                .join('\n');
             mkdirSync(unitDir, { recursive: true });
             writeFileSync(join(unitDir, UNIT_TEMPLATE), `[Unit]
 Description=ours-fleet agent %i
@@ -76,7 +103,7 @@ After=default.target
 
 [Service]
 Type=simple
-Environment="PATH=${servicePath.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"
+${environmentLines}
 ExecStart=${unitArg(process.execPath)} ${unitArg(binPath)} _run %i
 # The RUNNER owns the child-session restart loop, with a counted, backed-off
 # circuit breaker (3.2). systemd must only recover the runner PROCESS crashing —

package/dist/watchdog/briefing.js

@@ -80,13 +80,6 @@ export function generateWatchdogBriefing(opts) {
     L.push('- `healthy` — alive, on-briefing, recent progress.');
     L.push('- `idle` — alive, nothing assigned or nothing to do. Not an anomaly.');
     L.push('- `stale` = no worklog append and no console progress for ≥ 3 intervals.');
-    L.push('');
-    L.push('`session.readiness` from `ours-fleet status` is TURN OCCUPANCY, not activity: a mail');
-    L.push('wake delivered by ACP steering runs an entire turn while readiness stays `idle`. Never');
-    L.push('report `idle` or `stale` from `readiness=idle` alone — corroborate with the');
-    L.push('`activity:` line of the same `status` output (`active` means the agent is working),');
-    L.push('the worklog, or `ours-fleet peek`. `activity: unobservable` is missing evidence, not');
-    L.push('an idle agent.');
     L.push('- `blocked` = waiting on a permission/prompt/modal longer than one interval.');
     L.push('- `off_briefing` — activity contradicts the briefing (wrong repo, out-of-scope work,');
     L.push('  ignored routine).');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.17.7",
+  "version": "0.18.0-nightly.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -38,6 +38,7 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
+    "@ours.network/sdk": "1.3.1",
     "@xterm/addon-fit": "0.10.0",
     "@xterm/addon-serialize": "0.13.0",
     "@xterm/headless": "5.5.0",

package/dist/owner-channel/mcp.d.ts

@@ -1,24 +0,0 @@
-export declare class OursMcpError extends Error {
-}
-export interface OursToolClient {
-    start(): Promise<void>;
-    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
-    close(): Promise<void>;
-}
-/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
-export declare class OursMcpClient implements OursToolClient {
-    private readonly command;
-    private readonly env;
-    private readonly log;
-    private child?;
-    private nextId;
-    private tail;
-    constructor(command?: string, env?: Record<string, string>, log?: (line: string) => void);
-    start(): Promise<void>;
-    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
-    close(): Promise<void>;
-    private request;
-    private requestNow;
-    private notify;
-    private write;
-}

package/dist/owner-channel/mcp.js

@@ -1,145 +0,0 @@
-import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { createInterface } from 'node:readline';
-export class OursMcpError extends Error {
-}
-/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
-export class OursMcpClient {
-    command;
-    env;
-    log;
-    child;
-    nextId = 0;
-    tail = Promise.resolve();
-    constructor(command = 'ours-mcp', env = {}, log = () => undefined) {
-        this.command = command;
-        this.env = env;
-        this.log = log;
-    }
-    async start() {
-        if (this.child && this.child.exitCode === null)
-            return;
-        // ours-mcp normally records the long-lived client PID so an identity lease
-        // survives connector churn. An owner-channel connector has the opposite
-        // lifecycle: each supervised attempt owns a fresh connector and must make
-        // its lease reclaimable when that connector exits, even though the fleet
-        // supervisor itself remains alive. POSIX exec preserves the shell PID as
-        // the proxy PID, giving the daemon an exact process-lifetime fence without
-        // interpolating the command path into shell text.
-        const child = spawn('/bin/sh', [
-            '-c', 'OURS_CLIENT_PID=$$; export OURS_CLIENT_PID; exec "$1" "$2"',
-            'ours-fleet-owner-proxy', this.command, 'proxy',
-        ], {
-            env: {
-                ...process.env,
-                ...this.env,
-                // Bindings are keyed by this value. Sharing it would silently rebind a
-                // role's normal mailbox or another owner channel.
-                CLAUDE_CODE_SESSION_ID: `ours-fleet-owner-${process.pid}-${randomUUID()}`,
-            },
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        await new Promise((resolve, reject) => {
-            child.once('spawn', resolve);
-            child.once('error', reject);
-        });
-        this.child = child;
-        child.once('exit', (code, signal) => {
-            this.log(`ours-mcp proxy launcher exited (${code ?? signal ?? 'unknown'})`);
-        });
-        child.stdin.on('error', error => this.log(`ours-mcp stdin: ${error.message}`));
-        createInterface({ input: child.stderr }).on('line', line => this.log(`ours-mcp: ${line}`));
-        try {
-            await this.request('initialize', {
-                protocolVersion: '2025-03-26', capabilities: {},
-                clientInfo: { name: 'ours-fleet-owner-channel', version: '1' },
-            });
-            await this.notify('notifications/initialized', {});
-        }
-        catch (error) {
-            await this.close();
-            throw error;
-        }
-    }
-    async callTool(name, args = {}) {
-        const result = await this.request('tools/call', { name, arguments: args });
-        const text = (result.content ?? [])
-            .filter(item => item.type === 'text').map(item => item.text ?? '').join('\n').trim();
-        if (result.isError)
-            throw new OursMcpError(text || `ours tool ${name} failed`);
-        if (result.structuredContent !== undefined)
-            return result.structuredContent;
-        if (!text)
-            return {};
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            return text;
-        }
-    }
-    async close() {
-        const child = this.child;
-        this.child = undefined;
-        if (!child || child.exitCode !== null)
-            return;
-        // EOF asks the proxy to close normally. Once this exact process exits, the
-        // daemon can reclaim its lease even while the supervisor stays alive.
-        child.stdin.end();
-        const exited = await new Promise(resolve => {
-            const timer = setTimeout(() => resolve(false), 1_000);
-            child.once('exit', () => { clearTimeout(timer); resolve(true); });
-        });
-        if (exited || child.exitCode !== null)
-            return;
-        child.kill('SIGTERM');
-        await new Promise(resolve => {
-            const timer = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, 5_000);
-            child.once('exit', () => { clearTimeout(timer); resolve(); });
-        });
-    }
-    request(method, params) {
-        const run = this.tail.then(() => this.requestNow(method, params));
-        this.tail = run.then(() => undefined, () => undefined);
-        return run;
-    }
-    async requestNow(method, params) {
-        const child = this.child;
-        if (!child || child.exitCode !== null)
-            throw new OursMcpError('ours-mcp proxy is not running');
-        const id = ++this.nextId;
-        await this.write(child, { jsonrpc: '2.0', id, method, params });
-        const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
-        try {
-            for await (const line of lines) {
-                let response;
-                try {
-                    response = JSON.parse(line);
-                }
-                catch {
-                    continue;
-                }
-                if (response.id !== id)
-                    continue;
-                if (response.error !== undefined)
-                    throw new OursMcpError(JSON.stringify(response.error));
-                return response.result ?? {};
-            }
-            throw new OursMcpError('ours-mcp proxy closed its output');
-        }
-        finally {
-            lines.close();
-        }
-    }
-    async notify(method, params) {
-        const child = this.child;
-        if (!child || child.exitCode !== null)
-            throw new OursMcpError('ours-mcp proxy is not running');
-        await this.write(child, { jsonrpc: '2.0', method, params });
-    }
-    write(child, value) {
-        return new Promise((resolve, reject) => {
-            child.stdin.write(JSON.stringify(value) + '\n', error => error ? reject(error) : resolve());
-        });
-    }
-}