@ours.network/fleet 0.18.0-nightly.2 → 0.18.0-nightly.4

package/README.md

@@ -79,7 +79,7 @@ The state dir contract:
 | tmux | roles using `session: tmux` (the default) | `apt install tmux` / `brew install tmux` |
 | Node ≥ 22 | Claude roles using `session: acp` | required by the maintained Claude ACP adapter |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours-mcp` daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/mcp && ours-mcp start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -640,13 +640,14 @@ agent's briefing tells it **not** to arm a native harness Monitor.
 
 With `monitor.mode: native`, ours-fleet does not start its supervisor monitor;
 the generated briefing instead instructs the harness to arm its own wake
-mechanism (`ours-mcp watch` for Claude Code, or the Codex
+mechanism (the structured `ours api watch-notifications` JSONL stream for Claude Code,
+or the Codex
 `arm_monitor`/`foreground_monitor` flow). The old `monitor.enabled: true|false`
 form remains accepted as a compatibility alias for `fleet|native`, respectively,
 but new configuration should use `mode`.
 
 `inject: full` (pushing message bodies
-inline) is on the roadmap and needs two new ours-mcp daemon endpoints; today all
+inline) is on the roadmap and needs two new daemon endpoints; today all
 roles deliver `notification` lines and drain via `get_messages`.
 
 ACP stdio remains private to the persistent runner. `send`, `peek`, and the basic
@@ -874,7 +875,7 @@ Processed wire IDs are durably bounded for deduplication, while
 message and response bodies stay out of fleet state. Delivery is at-least-once
 across a crash (the bridge requeues fetched input before starting a turn); true
 exactly-once processing would require a leased claim/idempotency primitive in
-ours-mcp.
+the ours daemon.
 
 Inbound owner attachments use the same authenticated-CID and exact-wire routing
 boundary. Fleet first calls the metadata-only `list_incoming_files`, groups a
@@ -885,7 +886,7 @@ unauthorized sender is ignored without retrieval or reply. A rejected authorized
 request receives a bounded reason correlated to its file wire.
 
 Retrieved files must be regular, non-symlink paths whose byte count and SHA-256
-match ours-mcp metadata. Fleet additionally checks content signatures against the
+match typed SDK metadata. Fleet additionally checks content signatures against the
 declared MIME, sanitizes traversal/control characters from names, and copies each
 file into a random request-scoped directory at mode 0700 with files at mode 0600.
 The `[fleet-owner]` turn receives only bounded metadata, the private local paths,
@@ -896,17 +897,17 @@ the agent must use the audio path rather than inventing text.
 Request files are removed after final delivery and stale directories are removed
 after `retention_ms`. A bounded mode-0600 recovery journal stores only owner CID
 and wire routing metadata—never filenames, paths, captions, transcripts, or file
-bytes. If ours-mcp already marked a selected file processed when fleet restarts,
-fleet resumes only that journaled wire with `save_file`; a deferred managed-agent
+bytes. If the daemon already marked a selected file processed when fleet restarts,
+fleet resumes only that journaled wire with the SDK file-fetch operation; a deferred managed-agent
 caption is replayed with its journaled processed files before the group is
 admitted or relayed. Conversation route state migrates from v1 to a bounded v2
 source-wire index so a correlated group keeps the authenticated owner selected by
 its original request even after later owner traffic. Recovered voice is explicitly
 marked transcript-unavailable. Corrupt recovery state disables attachment
-admission. The host must run an ours-mcp version whose
-`list_incoming_files`, selective `get_files`, and `save_file` schemas support
-these guarantees; `ours-mcp voice-status --json` reports whether transcription
-is currently configured.
+admission. The host must run an ours daemon compatible with SDK 2.0.1 whose
+typed incoming-file, selective retrieval, and file-fetch operations support
+these guarantees; `ours config show --json` reports `sttConfigured` without
+revealing provider credentials.
 
 Managed-agent file egress is a separate trust direction. It retains the same
 metadata provenance checks, count/per-file/request byte caps, regular-file and
@@ -952,7 +953,7 @@ pass the legacy `ours-fleet spawn --monitor` flag) to record explicit persistent
 for the harness-native monitor, including supervised restarts. This does not choose the
 wake owner; use `monitor.mode: fleet|native` for that. In the standard-Codex fallback, the agent separately surfaces the
 `ours-codex` recommendation before asking to enter `foreground_monitor`. It never backgrounds
-`ours-mcp watch`, because a detached watch cannot wake a Codex turn. The foreground
+the structured CLI watcher, because a detached process cannot wake a Codex turn. The foreground
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
@@ -1036,7 +1037,7 @@ picks the most recently active session **in the role's `cwd`**. This works
 cleanly as long as each role has its own `cwd` (the common case); two roles
 sharing an identical `cwd` could have their resumes cross — give them distinct
 working directories if that matters. MCP and monitor wiring is provided by
-[`@ours.network/codex`](https://github.com/adapt-toolkit/ours-mcp/tree/main/packages/codex);
+[`@ours.network/codex`](https://www.npmjs.com/package/@ours.network/codex);
 the core ours skill discovers fleet behavior through `ours-fleet docs`.
 `ours-fleet doctor --harness codex` verifies the CLI, ours plugin, and enhanced launcher/fallback.
 

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.18.0-nightly.2",
-  "buildId": "3ca1204392e7",
-  "commit": "8da7b56012fd83c164332cc7c39ccaf7c4f13cbb",
+  "version": "0.18.0-nightly.4",
+  "buildId": "35a3c2d21eb9",
+  "commit": "1b5b2fa89f60b64b80877d23d45211fb970e4242",
   "dirty": true,
-  "builtAt": "2026-08-17T19:38:25.144Z",
+  "builtAt": "2026-08-21T08:23:47.864Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/creation.d.ts

@@ -1,5 +1,5 @@
+import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
 import { type LockDeps } from './atomic-file.js';
-import { type FetchLike } from './monitor.js';
 export type ReservationKind = 'role' | 'identity';
 export interface Reservation {
     kind: ReservationKind;
@@ -82,11 +82,10 @@ export declare function clearStaleReservations(olderThanMs?: number, now?: numbe
  * Identity provisioning (7.3). The fleet must know — before the harness starts
  * — whether the role's identity exists, and create it when it does not.
  *
- * `exists()` is answerable today: the daemon's authenticated `/identities`
- * endpoint is already used by doctor. `create()` is NOT: `ours-mcp` exposes only
- * `create-root`, and role identities are minted through the MCP `create_identity`
- * tool inside an agent session. So creation is a seam, injected by whoever can
- * satisfy it, and its absence is reported rather than papered over.
+ * `exists()` is answered through the typed SDK daemon inventory. `create()` is
+ * intentionally still a seam: fleet preserves application-owned identity
+ * creation/binding, especially the session-owned lifetime of temporary roles.
+ * Its absence is reported rather than papered over.
  */
 export interface IdentityProvisioner {
     /** Does this identity exist? `unknown` when the daemon could not be asked. */
@@ -128,16 +127,17 @@ export declare function ensureIdentity(name: string, profile: {
     persona?: string;
 }, provisioner: IdentityProvisioner | undefined, log?: (line: string) => void): Promise<IdentityGuarantee>;
 /**
- * Ask the running ours daemon whether an identity exists, over the same
- * authenticated endpoint doctor already probes. Answers `unknown` rather than
- * guessing when the daemon cannot be reached — an unreachable daemon is not
- * evidence that the identity is missing.
+ * Ask the running ours daemon whether an identity exists through SDK 2's
+ * coherence-checking attach path. Answers `unknown` rather than guessing when
+ * the daemon cannot be reached — an unreachable daemon is not evidence that
+ * the identity is missing.
  *
- * It deliberately has no `create()`: role identities are minted through the MCP
- * `create_identity` tool, and inventing a daemon endpoint we cannot test is the
- * failure mode this release exists to stop.
+ * It deliberately has no `create()`: roles still own identity selection and
+ * binding inside their application session, and temporary identities must stay
+ * owned by that session so daemon cleanup semantics remain intact.
  */
-export declare function daemonIdentityProvisioner(env?: NodeJS.ProcessEnv, fetchImpl?: FetchLike): IdentityProvisioner;
+type IdentityInventoryClient = Pick<OursClient, 'identities'>;
+export declare function daemonIdentityProvisioner(env?: NodeJS.ProcessEnv, attachClient?: (options: AttachOursClientOptions) => Promise<IdentityInventoryClient>): IdentityProvisioner;
 /** Atomically write a role's fleet.d file, journalling it for rollback. */
 export declare function writeRoleFile(tx: CreationTransaction, file: string, contents: string): void;
 /** Where a setting's effective value came from. */
@@ -207,3 +207,4 @@ export declare function creationBuildNote(p: CreationProvenance): string | undef
 export declare function formatProvenance(p: CreationProvenance): string[];
 /** Classify one setting: an explicit CLI value, a fleet default, or built-in. */
 export declare function provenanceOf(cliValue: unknown, fleetDefault: unknown, builtIn?: unknown): ProvenanceEntry;
+export {};

package/dist/creation.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { attachOursClient, } from '@ours.network/sdk/client';
 import { replaceFileAtomically, withFileLock } from './atomic-file.js';
 import { stateRoot } from './paths.js';
-import { resolveEndpoint } from './monitor.js';
 import { buildInfo, UNKNOWN_BUILD } from './provenance.js';
 /**
  * One creation transaction: role name and ours identity reserved together,
@@ -189,27 +189,21 @@ export async function ensureIdentity(name, profile, provisioner, log = () => { }
         detail: 'created during spawn, with its bio and persona published',
     };
 }
-/**
- * Ask the running ours daemon whether an identity exists, over the same
- * authenticated endpoint doctor already probes. Answers `unknown` rather than
- * guessing when the daemon cannot be reached — an unreachable daemon is not
- * evidence that the identity is missing.
- *
- * It deliberately has no `create()`: role identities are minted through the MCP
- * `create_identity` tool, and inventing a daemon endpoint we cannot test is the
- * failure mode this release exists to stop.
- */
-export function daemonIdentityProvisioner(env = process.env, fetchImpl = (u, i) => globalThis.fetch(u, i)) {
+export function daemonIdentityProvisioner(env = process.env, attachClient = attachOursClient) {
     return {
         async exists(name) {
-            const ep = resolveEndpoint(env);
-            const resp = await fetchImpl(`${ep.origin}/identities`, { headers: ep.headers });
-            if (!resp.ok)
-                return 'unknown';
-            const body = await resp.json();
-            if (!Array.isArray(body.identities))
+            try {
+                const client = await attachClient({
+                    env, leaseToken: `ours-fleet-identity-preflight-${process.pid}`, clientPid: process.pid,
+                });
+                const identities = await client.identities();
+                if (!Array.isArray(identities))
+                    return 'unknown';
+                return identities.some(identity => identity.name === name);
+            }
+            catch {
                 return 'unknown';
-            return body.identities.some(i => (typeof i === 'string' ? i : i?.name) === name);
+            }
         },
     };
 }

package/dist/docs.d.ts

@@ -4,7 +4,7 @@
  * Keep this concise enough to place directly in an agent context. Unlike
  * Commander's per-command help, this describes how the pieces compose.
  */
-export declare const AI_DOCS = "# ours-fleet reference\n\nours-fleet runs persistent or temporary, identity-bound AI roles. A role selects\na harness independently from its session backend:\n\n- harness: `claude-code` or `codex`\n- session: `tmux` (default) or `acp`\n- lifetime: permanent (supervised, restartable) or `spawn --temp`\n\n## Discover and validate\n\n```sh\nours-fleet docs                         # this complete reference (`man` is an alias)\nours-fleet help <command>               # exact flags for one command\nours-fleet config [-c FILE]             # validate and print the merged plan; no changes\nours-fleet doctor [-c FILE] [--harness codex|claude-code]\nours-fleet version [--json]             # build identity, capabilities, every install on PATH\n```\n\nDefault configuration is `~/fleet.yaml` plus sorted `~/fleet.d/*.yaml` role\ndrop-ins. An explicit `-c FILE` replaces `~/fleet.yaml`; fleet.d still adds\nroles. Validate with `config` and `doctor` before starting or restarting.\n\nThe CLI never writes the base file: `spawn` writes `~/fleet.d/Name.yaml`. The\nweb console does write it, as a whole document \u2014 its setup wizard and\nconfiguration editor may create, change or remove any top-level block, including\n`vars:`, `defaults:`, `roles:`, `watchdogs:` and `loops:`. Only the base\nfile may hold `defaults:`, `watchdogs:` and `loops:`; a fleet.d drop-in may\ndeclare `roles:` and nothing else. Unrecognised top-level keys are round-tripped\nuntouched. Console edits are applied as surgical splices against the file's exact\nbytes, so an unchanged save is byte-identical and lines outside the edit keep their\ncomments and spacing. One exception: changing the length of a block sequence\n(`watch:`, `oversee:`, `roles:`, `wake_sources:`) may replace that collection\nwholesale and drop inline comments written on its items; lines outside that\ncollection remain byte-preserved. Each save is revision-guarded, reviewed as a diff\nof the real file before anything is written, validated by the real loader, and\nbacked up next to the file first.\n\n## Build identity and install provenance\n\n`--version` prints a semver and nothing else, and a semver does NOT identify an\nartifact. Version bumps land in a release commit of their own, so every build cut\nbetween two releases carries the PREVIOUS version while already containing new\nbehaviour. One host ran two installs that both reported 0.16.0 \u2014 same version,\ndifferent build. One accepted `monitor.interrupt: after_tool`, the other\nrejected it as invalid. Their\n`dist/cli.js` were byte-identical \u2014 the divergence was in other modules.\n\nEvery build therefore stamps `dist/build-info.json` with a build id (first 12 hex\nof a sha256 over the rest of `dist/`), the commit it was cut from, and the\ncapability tokens the shipped code declares \u2014 for example\n`monitor.interrupt.after_tool`. Ask any executable what it is:\n\n```sh\nours-fleet version                      # ours-fleet 0.17.0+9f1c2a3b4d5e, capabilities, PATH installs\nours-fleet version --json               # the same as machine-readable JSON, no environment values\n```\n\nRead a capability, never a version number, to decide whether a setting is\nsupported. When a build rejects a value it knows the name of, it says which\ncapability is missing and which build rejected it, because another install on the\nsame host may accept the identical file. `config` prints the build that resolved\nthe plan; `status <Name>` says so when the build reporting on a role is not the\none that created it (roles record their creating build in `creation.json`).\n\n`ours-fleet doctor` runs an `install` check that lists every `ours-fleet` on\nPATH plus the one executing, and FAILS when two installs share a semver but are\ndifferent builds, or when the running artifact is a DIFFERENT artifact from the\none PATH resolves to. A second prefix holding identical content is not a skew\nand is not reported. A PATH entry the shell would not execute \u2014 a directory, or\na file without its execute bit \u2014 is not counted as an install at all.\nInstalls built before this stamp existed report `+unknown`; they are compared by\nhashing their `dist/` instead, so two pre-provenance installs are still told\napart. To fix a flagged host, remove or update the stale install \u2014 do not rely on\nPATH order.\n\n## Lifecycle and console commands\n\n```sh\nours-fleet init\nours-fleet up|down [Name...]\nours-fleet restart [Name...]            # preserve/resume harness context\nours-fleet force-restart [Name...]      # fresh context; briefing is reloaded\nours-fleet ls\nours-fleet status|peek|attach|logs Name\nours-fleet logs -f Name\nours-fleet send Name \"prompt\"\nours-fleet send Name --key Enter        # tmux only\nours-fleet rm Name\nours-fleet watchdog-report <name> [run-id] [--list] [--json]\nours-fleet watchdog-run <name>\n```\n\n`peek`, `attach`, and text `send` work with tmux and ACP. ACP attachment\nalso accepts `/permit <permission-id> <option-id>`, `/interrupt`, and\n`/detach`. Raw `--key` input is tmux-only.\n\n## Local web console\n\nThe npm package includes the web console; installed users do not clone the repo\nor run `npm run build`:\n\n```sh\nnpm i -g @ours.network/fleet\nours-fleet init\nours-fleet doctor\nours-fleet web                         # install/update service, start, pair browser\n```\n\nThe normal command uses stable `http://127.0.0.1:49271/`, installs an\nowner-level systemd user service (Linux) or LaunchAgent (macOS), and opens a\nfive-minute one-use pairing link in the local browser. After pairing, bookmark\nthe plain URL or install the PWA. To pair a new, signed-out, or revoked browser,\nrun `ours-fleet web open`.\n\n```sh\nours-fleet web status\nours-fleet web start|stop|restart\nours-fleet web open\nours-fleet web revoke-all              # revoke every browser and active session\nours-fleet web uninstall\nours-fleet web serve --port 0 --no-open # isolated foreground/testing mode\n```\n\nThe console is IPv4-loopback-only by default. Both `localhost` and\n`127.0.0.1` are accepted locally. For an nginx/TLS reverse proxy, keep the\ndefault bind and declare the exact browser origin:\n\n`ours-fleet web install --public-origin https://fleet.example.com --password-file /secure/fleet-password`\n\nFleet reads the password file during setup and persists only a salted scrypt\nverifier. New browsers authenticate and retain rotating HttpOnly/SameSite\ntrusted-device credentials. If nginx already authenticates, the operator may\ndeliberately select `--no-password`; the CLI and browser warn that anyone\nreaching the origin can control the fleet. First setup requires an explicit\nchoice: `--password-file` or `--pairing` for protected access, or\n`--no-password` for intentional unprotected access.\n\nUse `--bind ADDRESS` only for an intentional direct listen. A non-loopback\nbind is rejected unless `--public-origin` is also present. Host/Origin checks\nuse the declaration and do not trust forwarded headers. Configure nginx to\nproxy HTTP and WebSocket upgrades to `127.0.0.1:49271` and terminate TLS;\nfleet accepts nginx's loopback upstream Host, so no Host rewrite is required.\nBrowser credentials add Secure for HTTPS, and `revoke-all` invalidates all\ntrusted devices. Role creation offers harness-scoped known-model choices\nwhile still accepting a typed model ID; blank explicitly uses the selected\nharness's own default.\n\n## Spawn\n\n```sh\nours-fleet spawn [--temp] [Name | --role Name] \\\n  --harness codex|claude-code --session tmux|acp \\\n  --mission \"one line\" --cwd /absolute/path --identity Identity \\\n  --coordinator Coordinator --model MODEL \\\n  --approval ask|auto|allow \\\n  --filesystem read-only|workspace|unrestricted \\\n  --unattended deny|wait \\\n  --bio-file /path/bio.md --persona-file /path/persona.md\n```\n\nPermanent spawn writes `~/fleet.d/Name.yaml` and starts a supervised role.\n`--temp` writes active state under `~/.ours-fleet/tmp` and starts an independent\ntransient supervisor (a collected systemd unit or submitted launchd job). It is\nnot enabled across reboot and does not die when the role that spawned it restarts.\nBoth lifetimes support `--session acp`. When a temporary role's bound identity\ncloses or its session ends, the supervisor, monitor and live roster entry retire\ntogether; state moves intact to `~/.ours-fleet/recovery/temporary` with a\ntermination record. Failed launches use the same archive rather than deleting\ntheir briefing, provenance, logs or partial supervisor metadata.\n\nNamed `down` and `rm` commands can target an exact state-backed temporary role\neven though it is absent from merged fleet YAML. The recorded transient unit/job\nis authoritative. Missing/incomplete ownership metadata is reconciled only from\nan exact `_run-temp <role>` process-table match: one match may be adopted, zero\nsettles as stopped, and ambiguity or an unreadable table fails closed. Launching\nrecords receive a bounded grace so a not-yet-registered transient unit cannot be\nmistaken for a stopped one. Stale recorded supervisors are reclaimed in bounded\nbatches by moving their state to the same recovery archive, never by blind deletion.\n\nTemporary-role identity bootstrap is capability-based. The generated briefing\nfirst tries to bind the exact assigned identity and preserves it when it already\nexists. If missing, it uses ours MCP `create_temporary_identity` when that tool\nis exposed, tying a newly-created identity to the connector session lifecycle;\nolder servers fall back to `create_identity`. Collisions and creation errors\nstop safely without force-adopting or deleting identity state. Permanent roles\nretain normal `create_identity` behavior.\n\nThe temporary supervisor treats its first positive identity observation as the\nlifecycle readiness gate: a cold harness may take as long as needed to read its\nbriefing and bind, without a fixed first-bind retirement timer. After readiness,\nonly sustained authoritative absence closes the role. Unreachable, malformed, or\nvalid-but-empty daemon indexes are ambiguous and reset closure debounce rather\nthan becoming cleanup authority.\n\nInside a managed ACP role, the same CLI automatically routes a real `spawn`\nthrough that role's authenticated supervisor control socket. `--role Name` is\naccepted as an alternative to the positional name, so a minimal delegated call\nis `ours-fleet spawn --role DeveloperX --temp`. The supervisor records the\ncalling role, performs creation, and only after success sends a structured\nspawn notice through the caller's owner channel when one is configured.\n\nOmitted harness, session, working directory, coordinator, neutral permissions,\nfleet monitor policy, and (when the harness is unchanged) model inherit from the\ncalling role. Explicit options always win. Selecting a different harness without\n`--model` leaves model selection to that harness/fleet defaults rather than\ncopying an incompatible caller model. This automatic proxy is a convenience and\nattribution mechanism, not an isolation boundary: an unrestricted role can still\ninvoke another binary path directly. Tmux roles and host/operator shells keep the\nordinary direct CLI behavior.\n\nCodex-specific spawn flags: `--sandbox`, `--permission-mode`, `--launcher`,\n`--profile`, `--search`, repeatable `--codex-config key=value`, repeatable\n`--add-dir`, and legacy `--monitor` (consent for the native Codex monitor,\nnot the `monitor.mode` wake-owner selector). Run `ours-fleet help spawn` for\nexact values.\n\n## fleet.yaml\n\n```yaml\nvars:\n  work_root: /home/me/work\nstart_stagger_ms: 0\ndefaults:\n  harness: codex\n  session: acp\n  model: gpt-model-id\n  permissions:\n    approval: ask\n    filesystem: workspace\n    unattended: deny\n  monitor:\n    mode: fleet                          # fleet (default) | native\nroles:\n  Coordinator:\n    harness: codex\n    session: acp\n    identity: Coordinator\n    cwd: ${work_root}/project\n    mission: Coordinate work and delegate implementation.\n    model: gpt-model-id\n    permissions:\n      approval: ask\n      filesystem: workspace\n      unattended: deny\n    session_options:                    # advanced overrides; normally omit\n      # acp:\n      #   command: [/custom/codex-acp, --flag]\n      tmux:\n        boot_grace_ms: 10000\n    monitor:\n      mode: fleet                        # fleet supervisor | native harness monitor\n      interrupt: false                    # false queues; true cancels; after_tool steers at an ACP tool boundary\n      wake_sources: [message_received, file_received, local_contact_request, pending_message]\n      batch_ms: 2000\n      inject: notification\n      turn_fail_threshold: 3\n    harness_options:\n      launcher: auto\n      sandbox: workspace-write\n      approval: on-request\n      search: false\n      profile: fleet\n      add_dirs: [/data/shared]\n      config:\n        model_reasoning_effort: high\n    bio: Public role card and when peers should engage it.\n    persona: Local operating contract, boundaries, and escalation policy.\n    briefing_file: /absolute/custom-briefing.md\n    coordinator: AnotherCoordinator\n    env:\n      KEY: value\n    oversee:\n      - { role: Worker, interval: 5m }\nwatchdogs:\n  nightwatch:                       # [A-Za-z0-9_-], must not collide with a role name\n    coordinator: FleetCoordinator   # required \u2014 where alerts go\n    # everything below is optional\n    enabled: true                   # default true; false = configured but never scheduled\n    interval: 10m                   # default 10m; 30s | 10m | 2h, minimum 1m\n    watch: [Alice, CodexReviewer]   # explicit lists are exact; omit for configured + live temp roles\n    harness: claude-code            # default: defaults.harness\n    model: claude-fable-5           # default: same resolution rule roles use (resolveRoleModel)\n    session: acp                    # default: defaults.session\n    identity: Watchdog-nightwatch   # default: Watchdog-<name>\n    timeout: 5m                     # default 5m; a run past this is killed and recorded as error\n    keep_reports: 50                # default 50 reports retained per watchdog\n    alert_cooldown: 60m             # default 60m before the same finding alerts again\n    prompt_file: /abs/extra.md      # optional extra focus, APPENDED to the fixed contract\n    isolation:                      # optional; omitted means no OS sandbox, like an ordinary role\n      backend: bubblewrap           # when present, the ordinary role isolation schema applies\n      network: broker\n      fs: { read: [/opt/watch-data] }\n```\n\nA watchdog observes and reports; it never restarts, stops, spawns, or removes a\nrole, answers a pending permission, edits a workspace, or approves anything on\nthe owner's behalf. `watchdogs:` may appear only in the base config\n(`~/fleet.yaml` or `-c FILE`), not in `~/fleet.d/*.yaml` drop-ins.\nWatchdogs are not isolated by default. An explicit watchdog `isolation:` block\nuses the same policy schema as a role and is applied unchanged; declare every\nextra filesystem access required by a custom prompt there.\nWhen `watch:` is omitted, each run watches the configured roles plus temporary\nfleet roles that are live when the run starts. An explicit `watch:` list is\nnever augmented.\n\nRole values override defaults. `${name}` substitutes entries from `vars`.\nOther role fields include `max_tokens`, `autocompact_pct`, and `isolation`.\nUse README.md for the complete isolation policy and resource-cap schema.\n\n## Permissions\n\nPrefer the harness-neutral `permissions` block:\n\n- `approval: ask|auto|allow`: portable permission policy. `deny` remains a\n  deprecated, fail-closed compatibility alias for existing fleet files.\n- `filesystem: read-only|workspace|unrestricted`: filesystem intent\n- `unattended: deny|wait`: what ACP does when no console can answer a request\n\nThe backend translates this common intent. Harness-native settings in\n`harness_options` take precedence where supplied. Do not choose\n`allow`/`unrestricted`, Codex `never`/`danger-full-access`, or Claude\n`bypassPermissions` without explicit authorization.\n\n### Creation-time isolation\n\n`ours-fleet spawn --isolation-file <path>` supplies a role's sandbox policy at\ncreation, so the FIRST launch is already confined \u2014 a role that only gains\n`isolation:` on a later `up` ran unsandboxed until then.\n\nThe file holds exactly the `isolation:` mapping documented above and nothing\nelse \u2014 the same schema, validated by the same code, so a policy written here\ncannot mean something different from the identical block in fleet.yaml:\n\n```yaml\nnetwork: deny\nfs:\n  read: [/opt/reference]\nresources:\n  mem: 2G\n```\n\nInvalid files are rejected before anything is created: no config, no state\ndirectory, no identity reservation. Works for both permanent and `--temp` roles.\n\n### Never-prompt failure\n\nThe failure this section exists to prevent leaves no error message anywhere.\n\nAn unattended role has no console. When the harness needs a permission decision\nthere is nobody to ask, so the request is refused INSIDE the harness \u2014 no\nprompt, no error, no log line. The agent simply does less than its briefing told\nit to, reports success, and nothing distinguishes that from having done the\nwork. Two settings produce it:\n\n1. a permission mode that suppresses the prompt without granting the action\n   (Claude `dontAsk`, which is why neutral `allow` maps to\n   `bypassPermissions` instead); and\n2. `unattended: deny`, which refuses every request that reaches it.\n\n**Automatic decisions are now recorded.** Every permission request decided\nwithout a human emits a completed event into\n`~/.ours-fleet/agents/<Name>/.session-events.jsonl` carrying the decision,\nwhether policy or a person made it, the policy that produced it\n(`permissions.unattended=deny` vs `permissions.approval=deny`/`=allow`),\nthe reason, and the option selected. `ours-fleet peek` and `attach` render\nthem. Automatic denial asks for a one-shot rejection, never a standing one, so a\nsingle unattended refusal cannot disable a tool for the rest of the session.\n\nA role that can auto-deny logs one line at startup saying so.\n\nTo detect an under-permissioned role BEFORE it runs, use the capability floor\nbelow: `ours-fleet doctor` fails such a role rather than letting it discover\nthe problem silently at work.\n\n### The unattended capability floor\n\nAn unattended role has no console, so a permission request cannot be answered \u2014\nit is refused, silently, inside the harness. The agent then does less than it\nwas told to and reports no error. To make that visible before launch,\n`ours-fleet config` and `ours-fleet doctor` resolve each role's neutral\npermissions through its harness and check the result against a fixed floor:\n\n- `read-state` \u2014 read its briefing, ROUTINES.md, and WORKLOG.md\n- `write-state` \u2014 append its WORKLOG and its own state files\n- `messaging` \u2014 bind its identity, send and receive ours mail\n- `monitor` \u2014 arm and observe its mail monitor\n- `workspace-edit` \u2014 edit and test files in its working directory\n- `status-commands` \u2014 run the inspection commands its briefing prescribes\n\n`doctor` reports this per role as `unattended floor: <Role>`. A role with\n`unattended: deny` that cannot meet the floor FAILS doctor, because it will\ndeny those requests with nobody to see it; with `unattended: wait` it warns,\nbecause a human can still attach and answer.\n\nSecurity meaning: `ask` maps to Codex `untrusted` and Claude `default`;\n`auto` maps to Codex `on-request` and Claude `acceptEdits`; and\n`approval: allow` maps to Codex `never` and Claude `bypassPermissions`,\nwhich genuinely permits the actions the role was authorized to take \u2014\n`dontAsk` only suppresses the prompt while still refusing the action. Nothing\nother than an explicit `allow` becomes non-interactive. Legacy `deny` keeps\nits conservative Codex `on-request` / Claude `plan` translation. `allow` is therefore a real grant and\nrequires explicit authorization; per-role `isolation:` remains the outer\nboundary that a permission mode cannot cross.\n\nACP carries agent-advertised session mode IDs and `session/set_mode`, but those\nIDs are agent-specific and ACP defines no portable permission-policy capability.\nFleet therefore uses the ACP primitive where an adapter exposes a matching mode\nand otherwise performs the harness translation above. The bundled Codex ACP\nadapter couples approval and sandboxing in its advertised mode IDs, so fleet\nkeeps the selected sandbox preset and enforces the independently translated\napproval policy on the app-server turn request. For example, `allow` plus\n`workspace` is really `approval=never sandbox=workspace-write`; it is never\nwidened to `danger-full-access`. The live session reports both its effective\nnormalized mode and the ACP sandbox-preset ID.\n\nSee also: `spawn --approval/--filesystem/--unattended` set this intent at\ncreation, and `ours-fleet config` prints each role's neutral settings, their\nnative translation, and any warning \u2014 the same text `doctor` reports.\n\nClaude `harness_options`: `permission_mode` (default, acceptEdits, plan,\ndontAsk, bypassPermissions), `plugins`, `mem_palace`, and\n`mem_palace_midsession_autosave`.\n\nCodex `harness_options`: `launcher` (auto, ours-codex, codex), `sandbox`\n(read-only, workspace-write, danger-full-access), `approval` or\n`permission_mode` (untrusted, on-request, never), `profile`, `search`,\n`config`, `add_dirs`, and `monitor`.\n\n## ACP adapters\n\nThe maintained `@agentclientprotocol/codex-acp` and\n`@agentclientprotocol/claude-agent-acp` runtimes are bundled automatically as\noptional ours-fleet dependencies. The supervisor resolves their executable\nentrypoints internally, so default ACP roles do not depend on global PATH.\nThe maintained Claude adapter requires Node 22; tmux and Codex ACP continue to\nwork on the ours-fleet core minimum of Node 20.\n\nOverride an adapter only when necessary with `session_options.acp.command`\n(string or argv list). If optional dependencies were deliberately omitted,\nours-fleet falls back to a compatible globally installed `codex-acp` or\n`claude-agent-acp`. `ours-fleet doctor -c FILE` verifies the resolved adapter.\n\n## Reliable mail wake\n\n`monitor.mode` selects exactly one wake owner:\n\n- `fleet` (default): the ours-fleet supervisor consumes body-free daemon\n  events and advances its durable cursor only after delivery is accepted. ACP\n  uses live steering when supported and falls back to structured\n  `session/prompt`; tmux uses verified console injection.\n- `native`: ours-fleet starts no supervisor monitor; the generated briefing\n  instructs Claude Code or Codex to arm its harness-native wake mechanism.\n\nSet `monitor.interrupt: true` in fleet mode to cancel active work before every\nconfigured wake. Set it to `after_tool` to preserve an active ACP tool (and any\npending permission), then steer the wake at the first tool-terminal boundary\nwithout cancellation. A hung boundary is bounded at 120 seconds and falls back\nto non-cancelling steering/queueing; adapters without authenticated tool events\nuse the same conservative fallback. Explicit human/control interrupts remain\nimmediate. The policy is content-blind because the supervisor cannot inspect\nencrypted message bodies. Message bodies are released only when the role calls\nthe ours `get_messages` tool.\n\nThe default is `false`. For a temporary role whose mission intentionally arrives\nafter its readiness announcement, set `mode: fleet` and `interrupt: true`\nexplicitly. The readiness announcement does not change the transport: the\nmission remains ordinary ours mail, fleet injects only the body-free wake, and\nthe role calls `get_messages` before acting. Every later configured wake uses\nthe same interruption policy.\n\nLegacy `monitor.enabled: true|false` remains accepted as an alias for\n`mode: fleet|native`; use `mode` in new configuration. Codex's separate\n`harness_options.monitor: true` is native-monitor consent, not monitor-owner\nselection.\nInspect `ours-fleet status Name`, `peek Name`, role logs, and\n`~/.ours-fleet/agents/Name/.monitor-status` when diagnosing delivery.\n\n## Trusted owner channel\n\nAn ACP role may declare a separate, existing ours identity which fleet \u2014 never\nthe agent \u2014 binds:\n\n```yaml\nowner_channel:\n  identity: Coordinator Owner Channel\n  owners: [authenticated-owner-contact-cid]\n  agent: authenticated-managed-agent-cid\n  interrupt: false\n  progress_interval_ms: 30000\n  comments: true\n  attachments:\n    enabled: true\n    max_files_per_request: 4\n    max_file_bytes: 10485760\n    max_request_bytes: 20971520\n    retention_ms: 86400000\n    allowed_mime: [application/pdf, text/plain, image/png, audio/ogg]\n```\n\nThis does not replace the role identity. Normal identity mail remains untrusted\npeer input: the agent reads it through `get_messages` and replies through\n`send_message`. Mail arriving on the dedicated channel from a CID in `owners`\nis injected as a direct `[fleet-owner]` prompt. Mail from the exact `agent`\nCID is forwarded as a new message to the latest authenticated owner conversation;\nits files may also be relayed through this channel. A reply reference selects the\nowner of that authenticated source wire instead of the latest conversation.\nEvery other CID is rejected and warned about without reflecting its body. Fleet sends\naccepted/queued/progress/interrupted/failure notices and routes the ACP turn's\nfinal assistant text back to the authenticated sender with its source wire ID.\nFor file replies, fleet injects a request-specific outbox path into the owner\nprompt. The agent copies completed artifacts there; fleet sends every regular\nfile from the channel identity with the same source wire ID and removes the\ntemporary outbox only after successful delivery. For proactive or in-turn agent\nattachments, the agent calls ours `send_file` to the channel identity and may\npair it with a reply-linked caption; fleet, not the agent, chooses the owner.\nOwner messages whose trimmed text starts with `/` are deterministic\nsupervisor commands and never enter the model: `/help` (alias `/commands`),\n`/status`, `/comments [status|on|off]`, `/interrupt`, `/clear`,\n`/compact`, `/model <model-id>`, `/restart`, `/force-restart`, `/ls`,\n`/peek`, `/worklog`, and\n`/version`. Unknown or malformed commands answer with the help text instead of\nbeing forwarded; plain messages reach the agent unchanged. `/clear`,\n`/compact`, and `/model` are forwarded only when the role's bundled ACP\nadapter executes them locally (claude-code: all three; codex: `/compact`\nonly) and are otherwise refused with a notice, so slash text never reaches the\nmodel as a prompt.\n\nWhile a request runs, the agent's live ACP commentary is relayed as messages\nprefixed with the single stable label `\uD83D\uDFE1 Live update:`, so an owner can see\nexactly which messages the setting controls. `owner_channel.comments`\n(default `true`, so existing channels keep their current behavior) is the\nRESTART BASELINE; `/comments on|off` changes only the running session and is\ndeliberately not persisted, so a restart always returns to the checked-in\nconfiguration. `/comments status` reports the live value, the baseline, and\nwhether the backend emits live comments at all. Suppressing live comments never\nsuppresses receipts, progress notices, or the final answer.\n\nOwner documents, images, and voice messages use the same authenticated sender\nand source-wire boundary. Fleet inspects body-free metadata first and rejects\ndisabled, over-count, over-size, or disallowed-MIME requests before selective\nretrieval. Unauthorized CIDs are never retrieved or answered. Reply-linked text\nand files from the same sender become one ordered request; a file-only wake also\nstarts a turn. Retrieved bytes must match their structured size and SHA-256,\ntheir content signature must match the declared MIME, and symlinks or non-regular\npaths fail closed. Sanitized copies live only in a mode-0700 request directory as\nmode-0600 files and are removed after completion or bounded stale retention.\n\nVoice prompts include a bounded transcript only when ours-mcp reports success.\nFailure or unavailability is explicit and preserves the private audio path as the\nfallback. Run `ours-mcp voice-status --json` to inspect the host configuration.\nA mode-0600 crash journal contains only authenticated CID and wire routing data;\nit never stores captions, filenames, paths, transcript text, or bytes. Journaled\npost-retrieval files resume selectively through `save_file`. A deferred agent\ncaption is replayed with its processed files before the group is admitted. Fleet\nresolves one authenticated owner route before retrieving bytes, admits every file\nbefore emitting the caption or any file, and sends every part to that same route.\nUnknown correlated routes remain queued without retrieval and receive one bounded\ncorrelated notice. Admission rejection consumes the whole group with one NACK;\nonce emission starts, a transport error becomes terminal uncertain delivery and\nthe group is never blind-retried. Bounded v2 source-wire routing state is migrated\nfrom v1 on read. Corrupt state disables attachment admission rather than weakening\nprovenance checks.\n\nThe channel identity must be unique and must not be a role identity. The bridge\npersists bounded wire IDs only, never message/reply plaintext, and requeues input\nbefore starting its turn for at-least-once crash recovery. It currently requires\n`session: acp`: tmux has no structured, turn-correlated final answer, and pane\nscraping cannot provide the same reliable reply guarantee.\n\n### Live contact and owner administration\n\nThe supervisor which is already running the ACP role remains the sole binder of\n`owner_channel.identity`. The CLI reaches that exact live `OwnerChannel`\nthrough the role's token-authenticated, mode-0600 Unix control socket for contact\ninspection and setup; it never starts another ours client and never force-binds:\n\nRapid supervised restart is serialized by a role-scoped single-binder lease.\nThe predecessor closes its authenticated control socket and MCP proxy before\nreleasing ownership. The replacement waits at most five seconds and retries the\ndaemon bind only when PID/start-marker metadata proves the holder was the same\nrole and owner-channel identity. Foreign, live, corrupt, or otherwise\nunverifiable ownership remains fail-closed; fleet never uses `force=true`.\n\nIf that matching predecessor misses the bound, its still-authenticated control\nroute may send one fixed, digest-deduplicated recovery notice through the latest\nauthenticated owner conversation (or the sole configured owner). Notice\nplaintext is never persisted. With no safe deterministic route fleet guesses no\nrecipient and leaves the actionable failure in the web console and role logs.\nThe remote recovery action is `/restart`; inspect repeated failures with\n`ours-fleet logs <Role>` or the web console.\n\n```sh\nours-fleet owner-channel contact list <Role>\nours-fleet owner-channel contact invite <Role> [--name <label>]\nours-fleet owner-channel contact add <Role> (--invite-file <path> | --invite-stdin) [--name <label>]\nours-fleet owner-channel owner list <Role>\nours-fleet owner-channel owner authorize <Role> <exact-64-hex-contact-cid>\nours-fleet owner-channel owner revoke <Role> <exact-64-hex-contact-cid>\n```\n\nContact establishment and owner authorization are separate security steps.\n`contact add` never authorizes: invite redemption is pending until the peer\nverifies it. Once `contact list` reports the established contact, authorize\nits exact immutable CID explicitly. Invite creation emits invite material only\non stdout; acceptance reads it from a file or stdin, not argv.\n\nConfigured `owners` remain the baseline. On legacy channels without `agent`,\nlive authorizations/revocations are an immediately effective, restart-persistent\noverlay. Managed-agent CID gating makes fleet configuration authoritative and\ndisables live owner mutation and direct control-socket sends. `owner list` labels\nbaseline versus dynamic entries and effective status. The atomic mode-0600 file\ncontains bounded CIDs and audit actions only. Corruption disables all effective\nowners and refuses mutation rather than resurrecting authority; revoking the\nlast effective owner is always refused.\n\nA missing/stopped role, tmux session, role without `owner_channel`, unavailable\nMCP client, or a role entering shutdown returns an actionable error with no\nside effects. Management uses no network listener and never logs or persists\ninvite material.\n\nFor any non-final message\u2014progress, blocker, suggestion, or later proactive note\u2014\nthe managed agent calls ordinary ours `send_message` to the channel identity.\nFleet checks only that the authenticated sender CID exactly equals `agent`, then\nforwards the text as a new message. There is no task/request/update type, phase,\nreply correlation, or owner recipient argument. A sole owner is the safe fallback;\nwith multiple owners and no inbound route history the relay fails closed. Devices\nsharing one identity share its CID; separate owner identities hand off the route\nwhen either sends channel mail. The ACP final is separate: fleet extracts it from\nthe completed turn and deterministically replies to the initiating owner wire.\n\nThe bounded mode-0600 route state stores CIDs, wire IDs, timestamps, delivery state,\nand hashes but never message plaintext. Unauthorized attempts produce a bounded\nCID-only owner warning; attempted bodies are neither reflected nor persisted.\n\nFor a mobile owner, establish the contact first, wait for peer verification,\nauthorize its exact CID, and revoke that same CID when access ends. The bounded\nmode-0600 CID overlay survives supervisor restart and remains fail-closed on\ncorruption. Update bodies remain memory-only. After a crash/restart, unfinished\ndeferred owner input follows the existing at-least-once replay path; the restarted\nsupervisor remains the sole binder.\n\n## Stable config and YAML migration\n\n`ours-fleet config --json` emits schemaVersion 1 resolved plans. Environment\nvalues and mission/persona/bio bodies are withheld; environment keys are sorted\nand values are marked redacted. Additive fields may appear in schema 1, while a\nremoval or semantic reuse requires a new schema version.\n\nYAML parsing always rejects duplicate keys. The current default\n`--yaml-mode compat` warns with file/line/column for anchors, aliases, explicit\ntags, non-scalar keys, and multiple documents. Use `--yaml-mode strict` in CI\nnow; strict becomes the next-major default and compat is the temporary migration\nescape hatch.\n\n## Bounded worklogs, auth proxy, and model recovery\n\nAn optional `worklog: { max_kb, keep_tail_kb, max_archives }` policy rotates a\nstable snapshot at fleet-owned lifecycle points. Concurrent changes defer\nrotation. Archives remain beside WORKLOG.md with the same sensitive-state\nboundary; retention deletes only recognized fleet archive names.\n\n`auth_proxy: { kind: anthropic, base_url, required, health_url }` is Claude-only\nand loopback-only. Fleet injects only ANTHROPIC_BASE_URL and doctor rejects\ncredential env keys. The privileged reference companion is\n`contrib/anthropic-auth-proxy.mjs`; deploy it separately as a dedicated account\nwith a 0600 token file and per-role listener access. Fleet never installs it or\nreads its credential.\n\n`model_chain` is an ordered authorization list and its first entry must equal\n`model`. Only sustained high-confidence entitlement/quota 429 evidence advances\none entry. Transient 429, overload, auth, policy, and unknown errors never\ndown-shift. Runtime state is atomic in .model-recovery.json; exhaustion is\nfail-closed and held down. Change the declared chain/model and restart to\nreconcile explicitly; no chain preserves detection-only behavior.\n";
+export declare const AI_DOCS = "# ours-fleet reference\n\nours-fleet runs persistent or temporary, identity-bound AI roles. A role selects\na harness independently from its session backend:\n\n- harness: `claude-code` or `codex`\n- session: `tmux` (default) or `acp`\n- lifetime: permanent (supervised, restartable) or `spawn --temp`\n\n## Discover and validate\n\n```sh\nours-fleet docs                         # this complete reference (`man` is an alias)\nours-fleet help <command>               # exact flags for one command\nours-fleet config [-c FILE]             # validate and print the merged plan; no changes\nours-fleet doctor [-c FILE] [--harness codex|claude-code]\nours-fleet version [--json]             # build identity, capabilities, every install on PATH\n```\n\nDefault configuration is `~/fleet.yaml` plus sorted `~/fleet.d/*.yaml` role\ndrop-ins. An explicit `-c FILE` replaces `~/fleet.yaml`; fleet.d still adds\nroles. Validate with `config` and `doctor` before starting or restarting.\n\nThe CLI never writes the base file: `spawn` writes `~/fleet.d/Name.yaml`. The\nweb console does write it, as a whole document \u2014 its setup wizard and\nconfiguration editor may create, change or remove any top-level block, including\n`vars:`, `defaults:`, `roles:`, `watchdogs:` and `loops:`. Only the base\nfile may hold `defaults:`, `watchdogs:` and `loops:`; a fleet.d drop-in may\ndeclare `roles:` and nothing else. Unrecognised top-level keys are round-tripped\nuntouched. Console edits are applied as surgical splices against the file's exact\nbytes, so an unchanged save is byte-identical and lines outside the edit keep their\ncomments and spacing. One exception: changing the length of a block sequence\n(`watch:`, `oversee:`, `roles:`, `wake_sources:`) may replace that collection\nwholesale and drop inline comments written on its items; lines outside that\ncollection remain byte-preserved. Each save is revision-guarded, reviewed as a diff\nof the real file before anything is written, validated by the real loader, and\nbacked up next to the file first.\n\n## Build identity and install provenance\n\n`--version` prints a semver and nothing else, and a semver does NOT identify an\nartifact. Version bumps land in a release commit of their own, so every build cut\nbetween two releases carries the PREVIOUS version while already containing new\nbehaviour. One host ran two installs that both reported 0.16.0 \u2014 same version,\ndifferent build. One accepted `monitor.interrupt: after_tool`, the other\nrejected it as invalid. Their\n`dist/cli.js` were byte-identical \u2014 the divergence was in other modules.\n\nEvery build therefore stamps `dist/build-info.json` with a build id (first 12 hex\nof a sha256 over the rest of `dist/`), the commit it was cut from, and the\ncapability tokens the shipped code declares \u2014 for example\n`monitor.interrupt.after_tool`. Ask any executable what it is:\n\n```sh\nours-fleet version                      # ours-fleet 0.17.0+9f1c2a3b4d5e, capabilities, PATH installs\nours-fleet version --json               # the same as machine-readable JSON, no environment values\n```\n\nRead a capability, never a version number, to decide whether a setting is\nsupported. When a build rejects a value it knows the name of, it says which\ncapability is missing and which build rejected it, because another install on the\nsame host may accept the identical file. `config` prints the build that resolved\nthe plan; `status <Name>` says so when the build reporting on a role is not the\none that created it (roles record their creating build in `creation.json`).\n\n`ours-fleet doctor` runs an `install` check that lists every `ours-fleet` on\nPATH plus the one executing, and FAILS when two installs share a semver but are\ndifferent builds, or when the running artifact is a DIFFERENT artifact from the\none PATH resolves to. A second prefix holding identical content is not a skew\nand is not reported. A PATH entry the shell would not execute \u2014 a directory, or\na file without its execute bit \u2014 is not counted as an install at all.\nInstalls built before this stamp existed report `+unknown`; they are compared by\nhashing their `dist/` instead, so two pre-provenance installs are still told\napart. To fix a flagged host, remove or update the stale install \u2014 do not rely on\nPATH order.\n\n## Lifecycle and console commands\n\n```sh\nours-fleet init\nours-fleet up|down [Name...]\nours-fleet restart [Name...]            # preserve/resume harness context\nours-fleet force-restart [Name...]      # fresh context; briefing is reloaded\nours-fleet ls\nours-fleet status|peek|attach|logs Name\nours-fleet logs -f Name\nours-fleet send Name \"prompt\"\nours-fleet send Name --key Enter        # tmux only\nours-fleet rm Name\nours-fleet watchdog-report <name> [run-id] [--list] [--json]\nours-fleet watchdog-run <name>\n```\n\n`peek`, `attach`, and text `send` work with tmux and ACP. ACP attachment\nalso accepts `/permit <permission-id> <option-id>`, `/interrupt`, and\n`/detach`. Raw `--key` input is tmux-only.\n\n## Local web console\n\nThe npm package includes the web console; installed users do not clone the repo\nor run `npm run build`:\n\n```sh\nnpm i -g @ours.network/fleet\nours-fleet init\nours-fleet doctor\nours-fleet web                         # install/update service, start, pair browser\n```\n\nThe normal command uses stable `http://127.0.0.1:49271/`, installs an\nowner-level systemd user service (Linux) or LaunchAgent (macOS), and opens a\nfive-minute one-use pairing link in the local browser. After pairing, bookmark\nthe plain URL or install the PWA. To pair a new, signed-out, or revoked browser,\nrun `ours-fleet web open`.\n\n```sh\nours-fleet web status\nours-fleet web start|stop|restart\nours-fleet web open\nours-fleet web revoke-all              # revoke every browser and active session\nours-fleet web uninstall\nours-fleet web serve --port 0 --no-open # isolated foreground/testing mode\n```\n\nThe console is IPv4-loopback-only by default. Both `localhost` and\n`127.0.0.1` are accepted locally. For an nginx/TLS reverse proxy, keep the\ndefault bind and declare the exact browser origin:\n\n`ours-fleet web install --public-origin https://fleet.example.com --password-file /secure/fleet-password`\n\nFleet reads the password file during setup and persists only a salted scrypt\nverifier. New browsers authenticate and retain rotating HttpOnly/SameSite\ntrusted-device credentials. If nginx already authenticates, the operator may\ndeliberately select `--no-password`; the CLI and browser warn that anyone\nreaching the origin can control the fleet. First setup requires an explicit\nchoice: `--password-file` or `--pairing` for protected access, or\n`--no-password` for intentional unprotected access.\n\nUse `--bind ADDRESS` only for an intentional direct listen. A non-loopback\nbind is rejected unless `--public-origin` is also present. Host/Origin checks\nuse the declaration and do not trust forwarded headers. Configure nginx to\nproxy HTTP and WebSocket upgrades to `127.0.0.1:49271` and terminate TLS;\nfleet accepts nginx's loopback upstream Host, so no Host rewrite is required.\nBrowser credentials add Secure for HTTPS, and `revoke-all` invalidates all\ntrusted devices. Role creation offers harness-scoped known-model choices\nwhile still accepting a typed model ID; blank explicitly uses the selected\nharness's own default.\n\n## Spawn\n\n```sh\nours-fleet spawn [--temp] [Name | --role Name] \\\n  --harness codex|claude-code --session tmux|acp \\\n  --mission \"one line\" --cwd /absolute/path --identity Identity \\\n  --coordinator Coordinator --model MODEL \\\n  --approval ask|auto|allow \\\n  --filesystem read-only|workspace|unrestricted \\\n  --unattended deny|wait \\\n  --bio-file /path/bio.md --persona-file /path/persona.md\n```\n\nPermanent spawn writes `~/fleet.d/Name.yaml` and starts a supervised role.\n`--temp` writes active state under `~/.ours-fleet/tmp` and starts an independent\ntransient supervisor (a collected systemd unit or submitted launchd job). It is\nnot enabled across reboot and does not die when the role that spawned it restarts.\nBoth lifetimes support `--session acp`. When a temporary role's bound identity\ncloses or its session ends, the supervisor, monitor and live roster entry retire\ntogether; state moves intact to `~/.ours-fleet/recovery/temporary` with a\ntermination record. Failed launches use the same archive rather than deleting\ntheir briefing, provenance, logs or partial supervisor metadata.\n\nNamed `down` and `rm` commands can target an exact state-backed temporary role\neven though it is absent from merged fleet YAML. The recorded transient unit/job\nis authoritative. Missing/incomplete ownership metadata is reconciled only from\nan exact `_run-temp <role>` process-table match: one match may be adopted, zero\nsettles as stopped, and ambiguity or an unreadable table fails closed. Launching\nrecords receive a bounded grace so a not-yet-registered transient unit cannot be\nmistaken for a stopped one. Stale recorded supervisors are reclaimed in bounded\nbatches by moving their state to the same recovery archive, never by blind deletion.\n\nTemporary-role identity bootstrap is capability-based. The generated briefing\nfirst tries to bind the exact assigned identity and preserves it when it already\nexists. If missing, it uses ours MCP `create_temporary_identity` when that tool\nis exposed, tying a newly-created identity to the connector session lifecycle;\nolder servers fall back to `create_identity`. Collisions and creation errors\nstop safely without force-adopting or deleting identity state. Permanent roles\nretain normal `create_identity` behavior.\n\nThe temporary supervisor treats its first positive identity observation as the\nlifecycle readiness gate: a cold harness may take as long as needed to read its\nbriefing and bind, without a fixed first-bind retirement timer. After readiness,\nonly sustained authoritative absence closes the role. Unreachable, malformed, or\nvalid-but-empty daemon indexes are ambiguous and reset closure debounce rather\nthan becoming cleanup authority.\n\nInside a managed ACP role, the same CLI automatically routes a real `spawn`\nthrough that role's authenticated supervisor control socket. `--role Name` is\naccepted as an alternative to the positional name, so a minimal delegated call\nis `ours-fleet spawn --role DeveloperX --temp`. The supervisor records the\ncalling role, performs creation, and only after success sends a structured\nspawn notice through the caller's owner channel when one is configured.\n\nOmitted harness, session, working directory, coordinator, neutral permissions,\nfleet monitor policy, and (when the harness is unchanged) model inherit from the\ncalling role. Explicit options always win. Selecting a different harness without\n`--model` leaves model selection to that harness/fleet defaults rather than\ncopying an incompatible caller model. This automatic proxy is a convenience and\nattribution mechanism, not an isolation boundary: an unrestricted role can still\ninvoke another binary path directly. Tmux roles and host/operator shells keep the\nordinary direct CLI behavior.\n\nCodex-specific spawn flags: `--sandbox`, `--permission-mode`, `--launcher`,\n`--profile`, `--search`, repeatable `--codex-config key=value`, repeatable\n`--add-dir`, and legacy `--monitor` (consent for the native Codex monitor,\nnot the `monitor.mode` wake-owner selector). Run `ours-fleet help spawn` for\nexact values.\n\n## fleet.yaml\n\n```yaml\nvars:\n  work_root: /home/me/work\nstart_stagger_ms: 0\ndefaults:\n  harness: codex\n  session: acp\n  model: gpt-model-id\n  permissions:\n    approval: ask\n    filesystem: workspace\n    unattended: deny\n  monitor:\n    mode: fleet                          # fleet (default) | native\nroles:\n  Coordinator:\n    harness: codex\n    session: acp\n    identity: Coordinator\n    cwd: ${work_root}/project\n    mission: Coordinate work and delegate implementation.\n    model: gpt-model-id\n    permissions:\n      approval: ask\n      filesystem: workspace\n      unattended: deny\n    session_options:                    # advanced overrides; normally omit\n      # acp:\n      #   command: [/custom/codex-acp, --flag]\n      tmux:\n        boot_grace_ms: 10000\n    monitor:\n      mode: fleet                        # fleet supervisor | native harness monitor\n      interrupt: false                    # false queues; true cancels; after_tool steers at an ACP tool boundary\n      wake_sources: [message_received, file_received, local_contact_request, pending_message]\n      batch_ms: 2000\n      inject: notification\n      turn_fail_threshold: 3\n    harness_options:\n      launcher: auto\n      sandbox: workspace-write\n      approval: on-request\n      search: false\n      profile: fleet\n      add_dirs: [/data/shared]\n      config:\n        model_reasoning_effort: high\n    bio: Public role card and when peers should engage it.\n    persona: Local operating contract, boundaries, and escalation policy.\n    briefing_file: /absolute/custom-briefing.md\n    coordinator: AnotherCoordinator\n    env:\n      KEY: value\n    oversee:\n      - { role: Worker, interval: 5m }\nwatchdogs:\n  nightwatch:                       # [A-Za-z0-9_-], must not collide with a role name\n    coordinator: FleetCoordinator   # required \u2014 where alerts go\n    # everything below is optional\n    enabled: true                   # default true; false = configured but never scheduled\n    interval: 10m                   # default 10m; 30s | 10m | 2h, minimum 1m\n    watch: [Alice, CodexReviewer]   # explicit lists are exact; omit for configured + live temp roles\n    harness: claude-code            # default: defaults.harness\n    model: claude-fable-5           # default: same resolution rule roles use (resolveRoleModel)\n    session: acp                    # default: defaults.session\n    identity: Watchdog-nightwatch   # default: Watchdog-<name>\n    timeout: 5m                     # default 5m; a run past this is killed and recorded as error\n    keep_reports: 50                # default 50 reports retained per watchdog\n    alert_cooldown: 60m             # default 60m before the same finding alerts again\n    prompt_file: /abs/extra.md      # optional extra focus, APPENDED to the fixed contract\n    isolation:                      # optional; omitted means no OS sandbox, like an ordinary role\n      backend: bubblewrap           # when present, the ordinary role isolation schema applies\n      network: broker\n      fs: { read: [/opt/watch-data] }\n```\n\nA watchdog observes and reports; it never restarts, stops, spawns, or removes a\nrole, answers a pending permission, edits a workspace, or approves anything on\nthe owner's behalf. `watchdogs:` may appear only in the base config\n(`~/fleet.yaml` or `-c FILE`), not in `~/fleet.d/*.yaml` drop-ins.\nWatchdogs are not isolated by default. An explicit watchdog `isolation:` block\nuses the same policy schema as a role and is applied unchanged; declare every\nextra filesystem access required by a custom prompt there.\nWhen `watch:` is omitted, each run watches the configured roles plus temporary\nfleet roles that are live when the run starts. An explicit `watch:` list is\nnever augmented.\n\nRole values override defaults. `${name}` substitutes entries from `vars`.\nOther role fields include `max_tokens`, `autocompact_pct`, and `isolation`.\nUse README.md for the complete isolation policy and resource-cap schema.\n\n## Permissions\n\nPrefer the harness-neutral `permissions` block:\n\n- `approval: ask|auto|allow`: portable permission policy. `deny` remains a\n  deprecated, fail-closed compatibility alias for existing fleet files.\n- `filesystem: read-only|workspace|unrestricted`: filesystem intent\n- `unattended: deny|wait`: what ACP does when no console can answer a request\n\nThe backend translates this common intent. Harness-native settings in\n`harness_options` take precedence where supplied. Do not choose\n`allow`/`unrestricted`, Codex `never`/`danger-full-access`, or Claude\n`bypassPermissions` without explicit authorization.\n\n### Creation-time isolation\n\n`ours-fleet spawn --isolation-file <path>` supplies a role's sandbox policy at\ncreation, so the FIRST launch is already confined \u2014 a role that only gains\n`isolation:` on a later `up` ran unsandboxed until then.\n\nThe file holds exactly the `isolation:` mapping documented above and nothing\nelse \u2014 the same schema, validated by the same code, so a policy written here\ncannot mean something different from the identical block in fleet.yaml:\n\n```yaml\nnetwork: deny\nfs:\n  read: [/opt/reference]\nresources:\n  mem: 2G\n```\n\nInvalid files are rejected before anything is created: no config, no state\ndirectory, no identity reservation. Works for both permanent and `--temp` roles.\n\n### Never-prompt failure\n\nThe failure this section exists to prevent leaves no error message anywhere.\n\nAn unattended role has no console. When the harness needs a permission decision\nthere is nobody to ask, so the request is refused INSIDE the harness \u2014 no\nprompt, no error, no log line. The agent simply does less than its briefing told\nit to, reports success, and nothing distinguishes that from having done the\nwork. Two settings produce it:\n\n1. a permission mode that suppresses the prompt without granting the action\n   (Claude `dontAsk`, which is why neutral `allow` maps to\n   `bypassPermissions` instead); and\n2. `unattended: deny`, which refuses every request that reaches it.\n\n**Automatic decisions are now recorded.** Every permission request decided\nwithout a human emits a completed event into\n`~/.ours-fleet/agents/<Name>/.session-events.jsonl` carrying the decision,\nwhether policy or a person made it, the policy that produced it\n(`permissions.unattended=deny` vs `permissions.approval=deny`/`=allow`),\nthe reason, and the option selected. `ours-fleet peek` and `attach` render\nthem. Automatic denial asks for a one-shot rejection, never a standing one, so a\nsingle unattended refusal cannot disable a tool for the rest of the session.\n\nA role that can auto-deny logs one line at startup saying so.\n\nTo detect an under-permissioned role BEFORE it runs, use the capability floor\nbelow: `ours-fleet doctor` fails such a role rather than letting it discover\nthe problem silently at work.\n\n### The unattended capability floor\n\nAn unattended role has no console, so a permission request cannot be answered \u2014\nit is refused, silently, inside the harness. The agent then does less than it\nwas told to and reports no error. To make that visible before launch,\n`ours-fleet config` and `ours-fleet doctor` resolve each role's neutral\npermissions through its harness and check the result against a fixed floor:\n\n- `read-state` \u2014 read its briefing, ROUTINES.md, and WORKLOG.md\n- `write-state` \u2014 append its WORKLOG and its own state files\n- `messaging` \u2014 bind its identity, send and receive ours mail\n- `monitor` \u2014 arm and observe its mail monitor\n- `workspace-edit` \u2014 edit and test files in its working directory\n- `status-commands` \u2014 run the inspection commands its briefing prescribes\n\n`doctor` reports this per role as `unattended floor: <Role>`. A role with\n`unattended: deny` that cannot meet the floor FAILS doctor, because it will\ndeny those requests with nobody to see it; with `unattended: wait` it warns,\nbecause a human can still attach and answer.\n\nSecurity meaning: `ask` maps to Codex `untrusted` and Claude `default`;\n`auto` maps to Codex `on-request` and Claude `acceptEdits`; and\n`approval: allow` maps to Codex `never` and Claude `bypassPermissions`,\nwhich genuinely permits the actions the role was authorized to take \u2014\n`dontAsk` only suppresses the prompt while still refusing the action. Nothing\nother than an explicit `allow` becomes non-interactive. Legacy `deny` keeps\nits conservative Codex `on-request` / Claude `plan` translation. `allow` is therefore a real grant and\nrequires explicit authorization; per-role `isolation:` remains the outer\nboundary that a permission mode cannot cross.\n\nACP carries agent-advertised session mode IDs and `session/set_mode`, but those\nIDs are agent-specific and ACP defines no portable permission-policy capability.\nFleet therefore uses the ACP primitive where an adapter exposes a matching mode\nand otherwise performs the harness translation above. The bundled Codex ACP\nadapter couples approval and sandboxing in its advertised mode IDs, so fleet\nkeeps the selected sandbox preset and enforces the independently translated\napproval policy on the app-server turn request. For example, `allow` plus\n`workspace` is really `approval=never sandbox=workspace-write`; it is never\nwidened to `danger-full-access`. The live session reports both its effective\nnormalized mode and the ACP sandbox-preset ID.\n\nSee also: `spawn --approval/--filesystem/--unattended` set this intent at\ncreation, and `ours-fleet config` prints each role's neutral settings, their\nnative translation, and any warning \u2014 the same text `doctor` reports.\n\nClaude `harness_options`: `permission_mode` (default, acceptEdits, plan,\ndontAsk, bypassPermissions), `plugins`, `mem_palace`, and\n`mem_palace_midsession_autosave`.\n\nCodex `harness_options`: `launcher` (auto, ours-codex, codex), `sandbox`\n(read-only, workspace-write, danger-full-access), `approval` or\n`permission_mode` (untrusted, on-request, never), `profile`, `search`,\n`config`, `add_dirs`, and `monitor`.\n\n## ACP adapters\n\nThe maintained `@agentclientprotocol/codex-acp` and\n`@agentclientprotocol/claude-agent-acp` runtimes are bundled automatically as\noptional ours-fleet dependencies. The supervisor resolves their executable\nentrypoints internally, so default ACP roles do not depend on global PATH.\nThe maintained Claude adapter requires Node 22; tmux and Codex ACP continue to\nwork on the ours-fleet core minimum of Node 20.\n\nOverride an adapter only when necessary with `session_options.acp.command`\n(string or argv list). If optional dependencies were deliberately omitted,\nours-fleet falls back to a compatible globally installed `codex-acp` or\n`claude-agent-acp`. `ours-fleet doctor -c FILE` verifies the resolved adapter.\n\n## Reliable mail wake\n\n`monitor.mode` selects exactly one wake owner:\n\n- `fleet` (default): the ours-fleet supervisor consumes body-free daemon\n  events and advances its durable cursor only after delivery is accepted. ACP\n  uses live steering when supported and falls back to structured\n  `session/prompt`; tmux uses verified console injection.\n- `native`: ours-fleet starts no supervisor monitor; the generated briefing\n  instructs Claude Code or Codex to arm its harness-native wake mechanism.\n\nSet `monitor.interrupt: true` in fleet mode to cancel active work before every\nconfigured wake. Set it to `after_tool` to preserve an active ACP tool (and any\npending permission), then steer the wake at the first tool-terminal boundary\nwithout cancellation. A hung boundary is bounded at 120 seconds and falls back\nto non-cancelling steering/queueing; adapters without authenticated tool events\nuse the same conservative fallback. Explicit human/control interrupts remain\nimmediate. The policy is content-blind because the supervisor cannot inspect\nencrypted message bodies. Message bodies are released only when the role calls\nthe ours `get_messages` tool.\n\nThe default is `false`. For a temporary role whose mission intentionally arrives\nafter its readiness announcement, set `mode: fleet` and `interrupt: true`\nexplicitly. The readiness announcement does not change the transport: the\nmission remains ordinary ours mail, fleet injects only the body-free wake, and\nthe role calls `get_messages` before acting. Every later configured wake uses\nthe same interruption policy.\n\nLegacy `monitor.enabled: true|false` remains accepted as an alias for\n`mode: fleet|native`; use `mode` in new configuration. Codex's separate\n`harness_options.monitor: true` is native-monitor consent, not monitor-owner\nselection.\nInspect `ours-fleet status Name`, `peek Name`, role logs, and\n`~/.ours-fleet/agents/Name/.monitor-status` when diagnosing delivery.\n\n## Trusted owner channel\n\nAn ACP role may declare a separate, existing ours identity which fleet \u2014 never\nthe agent \u2014 binds:\n\n```yaml\nowner_channel:\n  identity: Coordinator Owner Channel\n  owners: [authenticated-owner-contact-cid]\n  agent: authenticated-managed-agent-cid\n  interrupt: false\n  progress_interval_ms: 30000\n  comments: true\n  attachments:\n    enabled: true\n    max_files_per_request: 4\n    max_file_bytes: 10485760\n    max_request_bytes: 20971520\n    retention_ms: 86400000\n    allowed_mime: [application/pdf, text/plain, image/png, audio/ogg]\n```\n\nThis does not replace the role identity. Normal identity mail remains untrusted\npeer input: the agent reads it through `get_messages` and replies through\n`send_message`. Mail arriving on the dedicated channel from a CID in `owners`\nis injected as a direct `[fleet-owner]` prompt. Mail from the exact `agent`\nCID is forwarded as a new message to the latest authenticated owner conversation;\nits files may also be relayed through this channel. A reply reference selects the\nowner of that authenticated source wire instead of the latest conversation.\nEvery other CID is rejected and warned about without reflecting its body. Fleet sends\naccepted/queued/progress/interrupted/failure notices and routes the ACP turn's\nfinal assistant text back to the authenticated sender with its source wire ID.\nFor file replies, fleet injects a request-specific outbox path into the owner\nprompt. The agent copies completed artifacts there; fleet sends every regular\nfile from the channel identity with the same source wire ID and removes the\ntemporary outbox only after successful delivery. For proactive or in-turn agent\nattachments, the agent calls ours `send_file` to the channel identity and may\npair it with a reply-linked caption; fleet, not the agent, chooses the owner.\nOwner messages whose trimmed text starts with `/` are deterministic\nsupervisor commands and never enter the model: `/help` (alias `/commands`),\n`/status`, `/comments [status|on|off]`, `/interrupt`, `/clear`,\n`/compact`, `/model <model-id>`, `/restart`, `/force-restart`, `/ls`,\n`/peek`, `/worklog`, and\n`/version`. Unknown or malformed commands answer with the help text instead of\nbeing forwarded; plain messages reach the agent unchanged. `/clear`,\n`/compact`, and `/model` are forwarded only when the role's bundled ACP\nadapter executes them locally (claude-code: all three; codex: `/compact`\nonly) and are otherwise refused with a notice, so slash text never reaches the\nmodel as a prompt.\n\nWhile a request runs, the agent's live ACP commentary is relayed as messages\nprefixed with the single stable label `\uD83D\uDFE1 Live update:`, so an owner can see\nexactly which messages the setting controls. `owner_channel.comments`\n(default `true`, so existing channels keep their current behavior) is the\nRESTART BASELINE; `/comments on|off` changes only the running session and is\ndeliberately not persisted, so a restart always returns to the checked-in\nconfiguration. `/comments status` reports the live value, the baseline, and\nwhether the backend emits live comments at all. Suppressing live comments never\nsuppresses receipts, progress notices, or the final answer.\n\nOwner documents, images, and voice messages use the same authenticated sender\nand source-wire boundary. Fleet inspects body-free metadata first and rejects\ndisabled, over-count, over-size, or disallowed-MIME requests before selective\nretrieval. Unauthorized CIDs are never retrieved or answered. Reply-linked text\nand files from the same sender become one ordered request; a file-only wake also\nstarts a turn. Retrieved bytes must match their structured size and SHA-256,\ntheir content signature must match the declared MIME, and symlinks or non-regular\npaths fail closed. Sanitized copies live only in a mode-0700 request directory as\nmode-0600 files and are removed after completion or bounded stale retention.\n\nVoice prompts include a bounded transcript only when typed daemon metadata reports success.\nFailure or unavailability is explicit and preserves the private audio path as the\nfallback. Run `ours config show --json` and inspect `sttConfigured` without\nrevealing provider credentials.\nA mode-0600 crash journal contains only authenticated CID and wire routing data;\nit never stores captions, filenames, paths, transcript text, or bytes. Journaled\npost-retrieval files resume selectively through `save_file`. A deferred agent\ncaption is replayed with its processed files before the group is admitted. Fleet\nresolves one authenticated owner route before retrieving bytes, admits every file\nbefore emitting the caption or any file, and sends every part to that same route.\nUnknown correlated routes remain queued without retrieval and receive one bounded\ncorrelated notice. Admission rejection consumes the whole group with one NACK;\nonce emission starts, a transport error becomes terminal uncertain delivery and\nthe group is never blind-retried. Bounded v2 source-wire routing state is migrated\nfrom v1 on read. Corrupt state disables attachment admission rather than weakening\nprovenance checks.\n\nThe channel identity must be unique and must not be a role identity. The bridge\npersists bounded wire IDs only, never message/reply plaintext, and requeues input\nbefore starting its turn for at-least-once crash recovery. It currently requires\n`session: acp`: tmux has no structured, turn-correlated final answer, and pane\nscraping cannot provide the same reliable reply guarantee.\n\n### Live contact and owner administration\n\nThe supervisor which is already running the ACP role remains the sole binder of\n`owner_channel.identity`. The CLI reaches that exact live `OwnerChannel`\nthrough the role's token-authenticated, mode-0600 Unix control socket for contact\ninspection and setup; it never starts another ours client and never force-binds:\n\nRapid supervised restart is serialized by a role-scoped single-binder lease.\nThe predecessor closes its authenticated control socket and MCP proxy before\nreleasing ownership. The replacement waits at most five seconds and retries the\ndaemon bind only when PID/start-marker metadata proves the holder was the same\nrole and owner-channel identity. Foreign, live, corrupt, or otherwise\nunverifiable ownership remains fail-closed; fleet never uses `force=true`.\n\nIf that matching predecessor misses the bound, its still-authenticated control\nroute may send one fixed, digest-deduplicated recovery notice through the latest\nauthenticated owner conversation (or the sole configured owner). Notice\nplaintext is never persisted. With no safe deterministic route fleet guesses no\nrecipient and leaves the actionable failure in the web console and role logs.\nThe remote recovery action is `/restart`; inspect repeated failures with\n`ours-fleet logs <Role>` or the web console.\n\n```sh\nours-fleet owner-channel contact list <Role>\nours-fleet owner-channel contact invite <Role> [--name <label>]\nours-fleet owner-channel contact add <Role> (--invite-file <path> | --invite-stdin) [--name <label>]\nours-fleet owner-channel owner list <Role>\nours-fleet owner-channel owner authorize <Role> <exact-64-hex-contact-cid>\nours-fleet owner-channel owner revoke <Role> <exact-64-hex-contact-cid>\n```\n\nContact establishment and owner authorization are separate security steps.\n`contact add` never authorizes: invite redemption is pending until the peer\nverifies it. Once `contact list` reports the established contact, authorize\nits exact immutable CID explicitly. Invite creation emits invite material only\non stdout; acceptance reads it from a file or stdin, not argv.\n\nConfigured `owners` remain the baseline. On legacy channels without `agent`,\nlive authorizations/revocations are an immediately effective, restart-persistent\noverlay. Managed-agent CID gating makes fleet configuration authoritative and\ndisables live owner mutation and direct control-socket sends. `owner list` labels\nbaseline versus dynamic entries and effective status. The atomic mode-0600 file\ncontains bounded CIDs and audit actions only. Corruption disables all effective\nowners and refuses mutation rather than resurrecting authority; revoking the\nlast effective owner is always refused.\n\nA missing/stopped role, tmux session, role without `owner_channel`, unavailable\nMCP client, or a role entering shutdown returns an actionable error with no\nside effects. Management uses no network listener and never logs or persists\ninvite material.\n\nFor any non-final message\u2014progress, blocker, suggestion, or later proactive note\u2014\nthe managed agent calls ordinary ours `send_message` to the channel identity.\nFleet checks only that the authenticated sender CID exactly equals `agent`, then\nforwards the text as a new message. There is no task/request/update type, phase,\nreply correlation, or owner recipient argument. A sole owner is the safe fallback;\nwith multiple owners and no inbound route history the relay fails closed. Devices\nsharing one identity share its CID; separate owner identities hand off the route\nwhen either sends channel mail. The ACP final is separate: fleet extracts it from\nthe completed turn and deterministically replies to the initiating owner wire.\n\nThe bounded mode-0600 route state stores CIDs, wire IDs, timestamps, delivery state,\nand hashes but never message plaintext. Unauthorized attempts produce a bounded\nCID-only owner warning; attempted bodies are neither reflected nor persisted.\n\nFor a mobile owner, establish the contact first, wait for peer verification,\nauthorize its exact CID, and revoke that same CID when access ends. The bounded\nmode-0600 CID overlay survives supervisor restart and remains fail-closed on\ncorruption. Update bodies remain memory-only. After a crash/restart, unfinished\ndeferred owner input follows the existing at-least-once replay path; the restarted\nsupervisor remains the sole binder.\n\n## Stable config and YAML migration\n\n`ours-fleet config --json` emits schemaVersion 1 resolved plans. Environment\nvalues and mission/persona/bio bodies are withheld; environment keys are sorted\nand values are marked redacted. Additive fields may appear in schema 1, while a\nremoval or semantic reuse requires a new schema version.\n\nYAML parsing always rejects duplicate keys. The current default\n`--yaml-mode compat` warns with file/line/column for anchors, aliases, explicit\ntags, non-scalar keys, and multiple documents. Use `--yaml-mode strict` in CI\nnow; strict becomes the next-major default and compat is the temporary migration\nescape hatch.\n\n## Bounded worklogs, auth proxy, and model recovery\n\nAn optional `worklog: { max_kb, keep_tail_kb, max_archives }` policy rotates a\nstable snapshot at fleet-owned lifecycle points. Concurrent changes defer\nrotation. Archives remain beside WORKLOG.md with the same sensitive-state\nboundary; retention deletes only recognized fleet archive names.\n\n`auth_proxy: { kind: anthropic, base_url, required, health_url }` is Claude-only\nand loopback-only. Fleet injects only ANTHROPIC_BASE_URL and doctor rejects\ncredential env keys. The privileged reference companion is\n`contrib/anthropic-auth-proxy.mjs`; deploy it separately as a dedicated account\nwith a 0600 token file and per-role listener access. Fleet never installs it or\nreads its credential.\n\n`model_chain` is an ordered authorization list and its first entry must equal\n`model`. Only sustained high-confidence entitlement/quota 429 evidence advances\none entry. Transient 429, overload, auth, policy, and unknown errors never\ndown-shift. Runtime state is atomic in .model-recovery.json; exhaustion is\nfail-closed and held down. Change the declared chain/model and restart to\nreconcile explicitly; no chain preserves detection-only behavior.\n";
 /**
  * What every shipped spawn-skill variant must say, and must not say (7.1).
  *

package/dist/docs.js

@@ -552,9 +552,10 @@ their content signature must match the declared MIME, and symlinks or non-regula
 paths fail closed. Sanitized copies live only in a mode-0700 request directory as
 mode-0600 files and are removed after completion or bounded stale retention.
 
-Voice prompts include a bounded transcript only when ours-mcp reports success.
+Voice prompts include a bounded transcript only when typed daemon metadata reports success.
 Failure or unavailability is explicit and preserves the private audio path as the
-fallback. Run \`ours-mcp voice-status --json\` to inspect the host configuration.
+fallback. Run \`ours config show --json\` and inspect \`sttConfigured\` without
+revealing provider credentials.
 A mode-0600 crash journal contains only authenticated CID and wire routing data;
 it never stores captions, filenames, paths, transcript text, or bytes. Journaled
 post-retrieval files resume selectively through \`save_file\`. A deferred agent

package/dist/doctor.js

@@ -112,16 +112,39 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
             detail: tmux.code === 0 ? tmux.stdout.trim() : 'not found — apt install tmux / brew install tmux',
         });
     }
-    const mcp = await exec('ours-mcp', ['--version']);
+    const ours = await exec('ours', ['version', '--json']);
+    let oursVersion;
+    if (ours.code === 0) {
+        try {
+            const value = JSON.parse(ours.stdout);
+            if (value.name === '@ours.network/cli' && typeof value.version === 'string')
+                oursVersion = value.version;
+        }
+        catch { /* malformed structured output is a failed prerequisite below */ }
+    }
     checks.push({
-        name: 'ours-mcp', ok: mcp.code === 0,
-        detail: mcp.code === 0 ? mcp.stdout.trim() : 'not found — npm i -g @ours.network/mcp',
+        name: 'ours CLI', ok: oursVersion !== undefined,
+        detail: oursVersion
+            ? `@ours.network/cli ${oursVersion}`
+            : 'not found or invalid structured output — npm i -g @ours.network/cli',
     });
-    if (mcp.code === 0) {
-        const st = await exec('ours-mcp', ['status']);
+    if (oursVersion !== undefined) {
+        const st = await exec('ours', ['daemon', 'status', '--json']);
+        let state;
+        try {
+            const value = JSON.parse(st.stdout);
+            if (typeof value.state === 'string')
+                state = value.state;
+        }
+        catch { /* malformed structured output fails closed */ }
+        const running = st.code === 0 && state === 'running';
         checks.push({
-            name: 'ours-mcp daemon', ok: st.code === 0,
-            detail: st.code === 0 ? 'running' : 'not running — start it with: ours-mcp start',
+            name: 'ours daemon', ok: running,
+            detail: running
+                ? 'running'
+                : state === 'stopped' || st.code === 3
+                    ? 'not running — start it with: ours daemon start'
+                    : 'status check returned invalid structured output — run: ours daemon status --json',
         });
     }
     if (platform === 'linux') {
@@ -288,7 +311,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch (e) {
             detail = `unreachable on :${endpoint.port} — monitored roles run degraded until it is up ` +
-                `(start it: ours-mcp start) [${e?.message ?? e}]`;
+                `(start it: ours daemon start) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/harness/claude-code.js

@@ -127,8 +127,11 @@ export async function pretrust(dir, deps = {}) {
  * it must be the Monitor TOOL, not a background Bash task (which never wakes the
  * agent on output → an armed-looking but deaf monitor).
  */
+const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+const watchCommand = (id) => 'ours api watch-notifications --input '
+    + shellQuote(JSON.stringify({ identity: id, since: 'tip' })) + ' --json';
 const armMonitor = (id) => 'arm a **persistent Monitor** (the Monitor TOOL — NOT a background Bash command; a ' +
-    `background Bash task never wakes you on output) running \`ours-mcp watch "${id}"\` ` +
+    `background Bash task never wakes you on output) running \`${watchCommand(id)}\` ` +
     'so inbound ours mail wakes you';
 export function makeClaudeCodeAdapter(exec = realExec) {
     return {
@@ -282,7 +285,6 @@ export function makeClaudeCodeAdapter(exec = realExec) {
             currentIdentityTool: 'current_identity',
             sendTool: 'send_message',
             getMessagesTool: 'get_messages',
-            watchCommand: id => `ours-mcp watch "${id}"`,
             monitorInstruction: id => {
                 const m = armMonitor(id);
                 return `${m.charAt(0).toUpperCase()}${m.slice(1)}.`;

package/dist/harness/codex.js

@@ -411,7 +411,6 @@ export function makeCodexAdapter(exec = realExec) {
             currentIdentityTool: 'current_identity',
             sendTool: 'send_message',
             getMessagesTool: 'get_messages',
-            watchCommand: id => `ours-mcp watch "${id}"`,
             monitorInstruction: (id, configuredRole) => {
                 const consented = configuredRole?.harness_options?.monitor === true;
                 const consent = consented

package/dist/harness/types.d.ts

@@ -67,7 +67,6 @@ export interface BriefingVocab {
     currentIdentityTool: string;
     sendTool: string;
     getMessagesTool: string;
-    watchCommand(identity: string): string;
     monitorInstruction(identity: string, role?: ResolvedRole): string;
     /** Wake-source wording for a role whose monitor is supervisor-owned (monitor.mode=fleet). */
     supervisedWakeNote(identity: string, role?: ResolvedRole): string;

package/dist/monitor.js

@@ -42,7 +42,7 @@ class AuthError extends Error {
 }
 /** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
 const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
-/** Match ours-mcp's env integer semantics: parseInt, invalid → absent. */
+/** Preserve the daemon's legacy env integer semantics: parseInt, invalid → absent. */
 function envInt(env, name) {
     const raw = env[name];
     if (raw === undefined)

package/dist/owner-channel/channel.d.ts

@@ -1,6 +1,4 @@
-import { type ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type OwnerChannelConfig } from '../config.js';
-import { type FetchLike } from '../monitor.js';
 import { type SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
@@ -17,19 +15,8 @@ export interface OwnerChannelOptions {
     session: SessionHandle;
     stateDir: string;
     env?: Record<string, string>;
-    /**
-     * `ours-mcp` binary for the legacy `watch` child process only. Daemon
-     * operations no longer go through it; they use the ours SDK client.
-     */
-    command?: string;
     log(line: string): void;
     client?: OursOps;
-    /** Legacy child-process test seam; production uses the direct notification API. */
-    watch?: (identity: string) => ChildProcessWithoutNullStreams;
-    /** Test seam for the production direct notification long-poll. */
-    watchFetch?: FetchLike;
-    /** Test seam for the long-poll stall bound; production uses OWNER_WATCH_STALL_MS. */
-    watchStallMs?: number;
     /** Test seam; production uses the detached ours-fleet CLI (`fleetCliOps`). */
     fleet?: OwnerFleetOps;
     /** Forwarded to fleet CLI invocations spawned for owner commands. */
@@ -165,7 +152,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly commentsBaseline;
     private commentsEnabled;
     private stopping;
-    private watchProcess?;
     private watchTask?;
     private watchAbort?;
     private drainTask?;
@@ -273,15 +259,12 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private progressPhase;
     private watchLoop;
     /**
-     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
-     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
-     * caller needs to know because the reason it reports is the only evidence a
-     * durable cursor was ever lost.
+     * `recovered` distinguishes a first-ever start from unreadable persisted
+     * diagnostics. Notification correctness does not depend on this state: every
+     * establishment drains and then replays SDK hints from offset zero.
      */
     private readWatchState;
     private writeWatchState;
-    /** Compatibility path for injected child-process tests; production is direct. */
-    private legacyWatchLoop;
     private errorText;
     private logError;
 }

package/dist/owner-channel/channel.js

@@ -1,12 +1,9 @@
-import { spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
-import { createInterface } from 'node:readline';
 import { join } from 'node:path';
 import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
 import { replaceFileAtomically } from '../atomic-file.js';
-import { resolveEndpoint } from '../monitor.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, interruptOutcome, } from '../session/types.js';
 import { VERSION } from '../version.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
@@ -28,15 +25,7 @@ const COMMENTARY_MAX_CHARS = 1_600;
 const COMMENTARY_MAX_BYTES = 6_400;
 const COMMENTARY_MAX_UPDATES = 32;
 const COMMENTARY_DEDUPE_LIMIT = 512;
-const OWNER_WATCH_STALL_MS = 120_000;
 const OWNER_WATCH_BACKOFF_MAX_MS = 30_000;
-/**
- * Credentials that are wrong now are wrong on the next attempt too. Retrying a
- * permanent 401 forever burns the daemon and hides the real fault behind an
- * endless reconnect log, so the watch stops after this many consecutive auth
- * rejections and records a terminal reason instead.
- */
-const OWNER_WATCH_AUTH_FATAL_ATTEMPTS = 5;
 /** A relay attempt that failed only because no owner route exists yet. */
 class RelayUnroutableError extends Error {
 }
@@ -70,7 +59,6 @@ export class OwnerChannel {
     commentsBaseline;
     commentsEnabled;
     stopping = false;
-    watchProcess;
     watchTask;
     watchAbort;
     drainTask;
@@ -154,9 +142,10 @@ export class OwnerChannel {
             void cleanupAttachmentRoot(this.attachmentRoot, Date.now(), this.attachmentConfig.retention_ms).catch(error => this.logError('attachment crash cleanup failed', error));
         }
         this.ready = true;
-        this.watchTask = this.options.watch ? this.legacyWatchLoop() : this.watchLoop();
         // Do not make role startup wait for an old owner request to finish a turn.
-        void this.drain().catch(error => this.logError('initial drain failed', error));
+        // watchLoop itself drains before every establishment, including this first
+        // one, so there is no drain-to-tip race.
+        this.watchTask = this.watchLoop();
     }
     drain() {
         this.drainRequested = true;
@@ -173,13 +162,8 @@ export class OwnerChannel {
     async close() {
         this.stopping = true;
         this.ready = false;
-        const watch = this.watchProcess;
-        this.watchProcess = undefined;
-        if (watch && watch.exitCode === null)
-            watch.kill('SIGTERM');
         this.watchAbort?.abort();
-        if (!this.options.watch)
-            await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
+        await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
         this.watchTask = undefined;
         await this.managementTail;
         try {
@@ -1583,90 +1567,65 @@ export class OwnerChannel {
         return undefined;
     }
     async watchLoop() {
-        const endpoint = resolveEndpoint({ ...process.env, ...(this.options.env ?? {}) });
-        const fetch = this.options.watchFetch
-            ?? ((url, init) => globalThis.fetch(url, init));
         const sleep = this.options.binderDeps?.sleep
             ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
         const restored = this.readWatchState();
         let state = restored.state;
-        // An unreadable cursor is the ONLY reason to restart at the tip. Say so on
-        // the next successful connect, and drain first: everything the lost cursor
-        // would have pointed at is still in the inbox, which is the authority.
-        let recovering = restored.recovered;
-        let cursor = state?.cursor ?? 'tip';
+        if (restored.recovered)
+            state = this.writeWatchState(state, 'OWNER_WATCH_STATE_RECOVERED');
         let delayMs = 1_000;
-        let authFailures = 0;
-        if (recovering)
-            await this.drain().catch(error => this.logError('cursor recovery drain failed', error));
+        let attempts = 0;
         while (!this.stopping) {
             const ctrl = new AbortController();
             this.watchAbort = ctrl;
-            let stalled = false;
-            let authRejected = false;
-            const timer = setTimeout(() => { stalled = true; ctrl.abort(); }, this.options.watchStallMs ?? OWNER_WATCH_STALL_MS);
-            timer.unref?.();
             try {
-                const response = await fetch(`${endpoint.url(this.options.config.identity)}?since=${cursor}`, { headers: endpoint.headers, signal: ctrl.signal });
-                if (response.status === 401) {
-                    authRejected = true;
-                    authFailures++;
-                    const at = cursor === 'tip' ? state?.cursor ?? 0 : cursor;
-                    if (authFailures >= OWNER_WATCH_AUTH_FATAL_ATTEMPTS) {
-                        state = this.writeWatchState(state, at, 'OWNER_WATCH_AUTH_FATAL', true);
-                        this.options.log(`[${this.options.role}] owner watch stopped `
-                            + `reason=OWNER_WATCH_AUTH_FATAL after ${authFailures} consecutive HTTP 401 responses; `
-                            + 'owner notifications require re-authorization and will not be retried');
+                // This drain is unconditional at EVERY establishment. Starting the SDK
+                // stream at 0 then replays notification hints instead of tip-priming,
+                // so mail arriving after the drain but before the first request cannot
+                // fall into a gap. The inbox is authoritative and its durable wire-ID
+                // dedupe makes replayed hints harmless.
+                await this.drain();
+                if (this.stopping)
+                    return;
+                state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTING', { reconnected: attempts > 0 });
+                attempts++;
+                for await (const _event of this.client.watchNotifications(this.options.config.identity, { since: 0, signal: ctrl.signal })) {
+                    if (this.stopping)
                         return;
-                    }
-                    state = this.writeWatchState(state, at, 'OWNER_WATCH_AUTH_FAILED', true);
-                    throw new Error('OWNER_WATCH_AUTH_FAILED: daemon rejected notification credentials');
-                }
-                if (!response.ok)
-                    throw new Error(`daemon returned HTTP ${response.status}`);
-                const body = await response.json();
-                const next = typeof body.cursor === 'number' ? body.cursor : cursor === 'tip' ? 0 : cursor;
-                const reconnect = (state?.consecutiveFailures ?? 0) > 0;
-                state = this.writeWatchState(state, next, recovering ? 'OWNER_WATCH_CURSOR_RECOVERED' : 'OWNER_WATCH_CONNECTED', false, reconnect);
-                recovering = false;
-                authFailures = 0;
-                cursor = next;
-                delayMs = 1_000;
-                // Notification events are content-free hints. The inbox remains the
-                // authority and its wire-level durable dedupe prevents duplicate turns.
-                if ((body.events?.length ?? 0) > 0)
+                    state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTED', { resetFailures: true });
+                    delayMs = 1_000;
+                    // Notification events contain no bodies and are only wake hints.
+                    // Draining is idempotent at the turn boundary because wire IDs are
+                    // recorded before a managed request is dispatched.
                     await this.drain();
+                }
+                if (!this.stopping)
+                    throw new Error('ours SDK notification stream ended');
             }
             catch (error) {
                 if (this.stopping)
                     return;
-                const reason = stalled
-                    ? 'OWNER_WATCH_STALLED' : 'OWNER_WATCH_STREAM_ERROR';
-                const current = cursor === 'tip' ? state?.cursor ?? 0 : cursor;
-                cursor = current;
-                // Only THIS iteration's auth rejection is already written. A stale
-                // AUTH_FAILED from an earlier attempt must never suppress the cursor,
-                // the failure counter, or a later STALLED transition.
-                if (!authRejected)
-                    state = this.writeWatchState(state, current, reason, true);
+                // SDK 2 deliberately hides transport status behind its typed stream.
+                // Do not parse error prose to rediscover it: every failure follows the
+                // same capped retry path forever, and the pre-establishment drain makes
+                // that retry correctness-preserving.
+                state = this.writeWatchState(state, 'OWNER_WATCH_STREAM_ERROR', { failed: true });
                 this.options.log(`[${this.options.role}] owner watch reconnect `
-                    + `reason=${authRejected ? 'OWNER_WATCH_AUTH_FAILED' : reason} `
-                    + `delay_ms=${delayMs} cursor=${current}`);
+                    + `reason=OWNER_WATCH_STREAM_ERROR delay_ms=${delayMs} `
+                    + `failures=${state.consecutiveFailures}: ${this.errorText(error)}`);
                 await sleep(delayMs);
                 delayMs = Math.min(delayMs * 2, OWNER_WATCH_BACKOFF_MAX_MS);
             }
             finally {
-                clearTimeout(timer);
                 if (this.watchAbort === ctrl)
                     this.watchAbort = undefined;
             }
         }
     }
     /**
-     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
-     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
-     * caller needs to know because the reason it reports is the only evidence a
-     * durable cursor was ever lost.
+     * `recovered` distinguishes a first-ever start from unreadable persisted
+     * diagnostics. Notification correctness does not depend on this state: every
+     * establishment drains and then replays SDK hints from offset zero.
      */
     readWatchState() {
         const path = join(this.options.stateDir, '.owner-channel-watch.json');
@@ -1674,76 +1633,43 @@ export class OwnerChannel {
             return { recovered: false };
         try {
             const value = JSON.parse(readFileSync(path, 'utf8'));
-            if (value.version !== 1 || !Number.isSafeInteger(value.cursor) || value.cursor < 0
+            if ((value.version !== 1 && value.version !== 2)
                 || !Number.isSafeInteger(value.reconnects) || value.reconnects < 0
                 || !Number.isSafeInteger(value.consecutiveFailures) || value.consecutiveFailures < 0)
                 throw new Error('invalid owner watch state');
-            return { state: value, recovered: false };
+            const reasons = new Set([
+                'OWNER_WATCH_CONNECTING', 'OWNER_WATCH_CONNECTED',
+                'OWNER_WATCH_STREAM_ERROR', 'OWNER_WATCH_STATE_RECOVERED',
+            ]);
+            return { state: {
+                    version: 2,
+                    reconnects: value.reconnects,
+                    consecutiveFailures: value.consecutiveFailures,
+                    reason: reasons.has(value.reason)
+                        ? value.reason : 'OWNER_WATCH_CONNECTING',
+                    updatedAt: typeof value.updatedAt === 'string'
+                        ? value.updatedAt : new Date(this.options.binderDeps?.now?.() ?? Date.now()).toISOString(),
+                }, recovered: false };
         }
         catch {
             this.options.log(`[${this.options.role}] owner watch `
-                + 'reason=OWNER_WATCH_CURSOR_RECOVERED invalid cursor state; draining inbox and starting at tip');
+                + 'reason=OWNER_WATCH_STATE_RECOVERED invalid persisted counters; restarting safely');
             return { recovered: true };
         }
     }
-    writeWatchState(previous, cursor, reason, failed, reconnected = false) {
+    writeWatchState(previous, reason, options = {}) {
         const state = {
-            version: 1,
-            cursor,
-            reconnects: (previous?.reconnects ?? 0) + (reconnected ? 1 : 0),
-            consecutiveFailures: failed ? (previous?.consecutiveFailures ?? 0) + 1 : 0,
+            version: 2,
+            reconnects: (previous?.reconnects ?? 0) + (options.reconnected ? 1 : 0),
+            consecutiveFailures: options.failed
+                ? (previous?.consecutiveFailures ?? 0) + 1
+                : options.resetFailures ? 0 : previous?.consecutiveFailures ?? 0,
             reason,
             updatedAt: new Date(this.options.binderDeps?.now?.() ?? Date.now()).toISOString(),
         };
         replaceFileAtomically(join(this.options.stateDir, '.owner-channel-watch.json'), `${JSON.stringify(state)}\n`, 0o600);
         return state;
     }
-    /** Compatibility path for injected child-process tests; production is direct. */
-    async legacyWatchLoop() {
-        let delayMs = 1_000;
-        while (!this.stopping) {
-            try {
-                const child = this.options.watch?.(this.options.config.identity) ?? spawn(this.options.command ?? 'ours-mcp', ['watch', this.options.config.identity], {
-                    env: { ...process.env, ...(this.options.env ?? {}) }, stdio: ['pipe', 'pipe', 'pipe'],
-                });
-                this.watchProcess = child;
-                await new Promise((resolve, reject) => {
-                    if (child.pid) {
-                        resolve();
-                        return;
-                    }
-                    child.once('spawn', resolve);
-                    child.once('error', reject);
-                });
-                createInterface({ input: child.stderr }).on('line', line => this.options.log(`[${this.options.role}] owner watch: ${line}`));
-                delayMs = 1_000;
-                // Drain at every (re)attachment, not only after a future notification:
-                // a failed send/turn leaves the input deferred and may not emit another
-                // watch line by itself.
-                await this.drain();
-                for await (const _line of createInterface({ input: child.stdout })) {
-                    if (this.stopping)
-                        break;
-                    await this.drain();
-                }
-                if (!this.stopping)
-                    throw new Error('watch exited');
-            }
-            catch (error) {
-                if (!this.stopping) {
-                    this.logError('watch failed; retrying', error);
-                    await new Promise(resolve => setTimeout(resolve, delayMs));
-                    delayMs = Math.min(delayMs * 2, 30_000);
-                }
-            }
-            finally {
-                const child = this.watchProcess;
-                this.watchProcess = undefined;
-                if (child && child.exitCode === null)
-                    child.kill('SIGTERM');
-            }
-        }
-    }
     errorText(error) {
         return error?.message ?? String(error);
     }

package/dist/owner-channel/ours-client.d.ts

@@ -1,4 +1,4 @@
-import { OursClient, type OursClientOptions } from '@ours.network/sdk/client';
+import { OursClient, type AttachOursClientOptions, type NotificationEvent } from '@ours.network/sdk/client';
 /** Any failure of a daemon operation. Never carries a message body or a token. */
 export declare class OursDaemonError extends Error {
 }
@@ -19,11 +19,14 @@ export type OursInboundMessage = OursMessagesPayload['messages'][number];
 export type OursIncomingFile = Res<'listIncomingFiles'>[number];
 export type OursRetrievedFiles = Res<'getFiles'>;
 export type OursRetrievedFile = OursRetrievedFiles['files'][number];
+export type OursNotificationEvent = NotificationEvent;
+export declare class OursWatchDeadlineError extends OursDaemonError {
+}
 /**
  * The daemon operations the owner channel needs, one typed method each.
  *
  * This interface deliberately has no generic `callTool(name, args): unknown`
- * escape hatch. The MCP surface had one, and because ours-mcp answers every
+ * escape hatch. The legacy MCP connector answered every
  * tool with `{content:[{type:'text',...}]}` and no `structuredContent`, the
  * transport fell back to returning the daemon's English sentence — which the
  * channel then pattern-matched (an invite blob sliced out of a prose sentence,
@@ -43,6 +46,10 @@ export interface OursOps {
     }): Promise<OursAddContactResult>;
     getMessages(): Promise<OursMessagesPayload>;
     deferMessages(msgIds: number[]): Promise<void>;
+    watchNotifications(identity: string, options?: {
+        since?: number | 'tip';
+        signal?: AbortSignal;
+    }): AsyncGenerator<OursNotificationEvent, void, undefined>;
     listIncomingFiles(): Promise<OursIncomingFile[]>;
     getFiles(wireIds: string[]): Promise<OursRetrievedFiles>;
     /**
@@ -75,15 +82,19 @@ export declare function oursErrorCode(error: unknown): string | undefined;
 /** The identity is bound by another live session; a predecessor may still be releasing it. */
 export declare const OURS_BOUND_ELSEWHERE = "BOUND_ELSEWHERE";
 export interface OursSdkClientDeps {
-    /** Test seam; production builds an `OursClient` from the resolved endpoint. */
-    createClient?(options: OursClientOptions): OursClient;
+    /** Test seam; production uses the SDK's coherence-checking application attach path. */
+    attachClient?(options: AttachOursClientOptions): OursClient | Promise<OursClient>;
+    /** Underlying transport and deadline seams for deterministic half-open tests. */
+    fetch?: typeof globalThis.fetch;
+    notificationRequestDeadlineMs?: number;
+    readFile?(path: string): Promise<Uint8Array>;
 }
 /**
  * The owner-channel's daemon client: one `OursClient` over the local ours HTTP
  * API, owning exactly one identity binding.
  *
  * Lease lifetime. The lease token IS the session, so each channel instance mints
- * its own and hands it back in `close()`. That replaces the `ours-mcp proxy`
+ * its own and hands it back in `close()`. That replaces the connector proxy's
  * shell-PID fence, which existed because a supervised attempt had to make its
  * lease reclaimable while the supervisor itself stayed alive: an explicit
  * release does that deterministically, and `clientPid` still covers the case
@@ -106,6 +117,10 @@ export declare class OursSdkClient implements OursOps {
     }): Promise<OursAddContactResult>;
     getMessages(): Promise<OursMessagesPayload>;
     deferMessages(msgIds: number[]): Promise<void>;
+    watchNotifications(identity: string, options?: {
+        since?: number | 'tip';
+        signal?: AbortSignal;
+    }): AsyncGenerator<OursNotificationEvent, void, undefined>;
     listIncomingFiles(): Promise<OursIncomingFile[]>;
     getFiles(wireIds: string[]): Promise<OursRetrievedFiles>;
     fetchFile(wireId: string): Promise<Uint8Array>;

package/dist/owner-channel/ours-client.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
-import { OursClient, OursError } from '@ours.network/sdk/client';
-import { resolveApiToken, resolveEndpoint } from '../monitor.js';
+import { readFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { OursError, attachOursClient, } from '@ours.network/sdk/client';
 /** Any failure of a daemon operation. Never carries a message body or a token. */
 export class OursDaemonError extends Error {
 }
@@ -12,6 +13,73 @@ export class OursDaemonError extends Error {
  */
 export class OursSendRefusedError extends OursDaemonError {
 }
+// The daemon normally returns a quiet long-poll within 25 seconds. Keep the
+// client-side fence comfortably above it so ordinary quiet periods do not
+// recycle a healthy stream, while a half-open socket still heals on its own.
+const NOTIFICATION_REQUEST_DEADLINE_MS = 120_000;
+// SDK sendFile({path}) inferred these common types before reading the path in
+// the daemon process. Staged uploads move that read into fleet, so preserve the
+// same advertised MIME rather than silently turning every attachment into an
+// octet stream. Importing the SDK root just for its helper would also pull the
+// daemon runtime into this client-only process.
+const FILE_MIME_BY_EXTENSION = {
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif',
+    '.webp': 'image/webp', '.svg': 'image/svg+xml', '.bmp': 'image/bmp', '.ico': 'image/x-icon',
+    '.pdf': 'application/pdf', '.txt': 'text/plain', '.md': 'text/markdown',
+    '.json': 'application/json', '.csv': 'text/csv', '.html': 'text/html',
+    '.xml': 'application/xml', '.zip': 'application/zip', '.gz': 'application/gzip',
+    '.tar': 'application/x-tar', '.mp3': 'audio/mpeg', '.wav': 'audio/wav',
+    '.mp4': 'video/mp4', '.mov': 'video/quicktime',
+};
+function mimeFromFilename(filename) {
+    return FILE_MIME_BY_EXTENSION[extname(filename).toLowerCase()] ?? 'application/octet-stream';
+}
+export class OursWatchDeadlineError extends OursDaemonError {
+}
+function notificationRequest(input) {
+    const url = typeof input === 'string' || input instanceof URL ? String(input) : input.url;
+    return /\/identities\/[^/]+\/notifications(?:\?|$)/.test(url);
+}
+function notificationDeadlineFetch(fetchImpl, deadlineMs) {
+    return async (input, init) => {
+        if (!notificationRequest(input))
+            return fetchImpl(input, init);
+        const ctrl = new AbortController();
+        const upstream = init?.signal;
+        let rejectFence;
+        const fence = new Promise((_resolve, reject) => { rejectFence = reject; });
+        const abortUpstream = () => {
+            const reason = upstream?.reason
+                ?? new DOMException('ours notification request aborted', 'AbortError');
+            ctrl.abort(reason);
+            // Shutdown must not wait for the deadline when a custom fetch ignores
+            // AbortSignal either.
+            rejectFence(reason);
+        };
+        if (upstream?.aborted)
+            abortUpstream();
+        else
+            upstream?.addEventListener('abort', abortUpstream, { once: true });
+        const timer = setTimeout(() => {
+            const error = new OursWatchDeadlineError('ours notification request deadline exceeded');
+            ctrl.abort(error);
+            // Do not rely on a custom or half-open fetch implementation to honor
+            // AbortSignal: the fence itself must always settle the request.
+            rejectFence(error);
+        }, deadlineMs);
+        timer.unref?.();
+        try {
+            return await Promise.race([
+                fetchImpl(input, { ...init, signal: ctrl.signal }),
+                fence,
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+            upstream?.removeEventListener('abort', abortUpstream);
+        }
+    };
+}
 /**
  * The typed error code of a daemon operation, or undefined when the failure was
  * not one (transport, abort, programming error). `instanceof` is checked first;
@@ -35,7 +103,7 @@ export const OURS_BOUND_ELSEWHERE = 'BOUND_ELSEWHERE';
  * API, owning exactly one identity binding.
  *
  * Lease lifetime. The lease token IS the session, so each channel instance mints
- * its own and hands it back in `close()`. That replaces the `ours-mcp proxy`
+ * its own and hands it back in `close()`. That replaces the connector proxy's
  * shell-PID fence, which existed because a supervised attempt had to make its
  * lease reclaimable while the supervisor itself stayed alive: an explicit
  * release does that deterministically, and `clientPid` still covers the case
@@ -56,17 +124,16 @@ export class OursSdkClient {
         if (this.client)
             return;
         const environment = { ...process.env, ...this.env };
-        // Reuse fleet's own daemon resolution so this client and the notification
-        // watch loop can never disagree about which daemon they are talking to.
-        const endpoint = resolveEndpoint(environment);
-        const apiToken = resolveApiToken(environment);
+        // SDK 2's supported application path resolves endpoint, state root, and
+        // token as one coherent selection, proves the daemon's state root before
+        // sending credentials, and only then constructs the client.
         const options = {
-            url: endpoint.origin,
+            env: environment,
             leaseToken: this.leaseToken,
             clientPid: process.pid,
-            ...(apiToken ? { apiToken } : {}),
+            fetch: notificationDeadlineFetch(this.deps.fetch ?? globalThis.fetch, this.deps.notificationRequestDeadlineMs ?? NOTIFICATION_REQUEST_DEADLINE_MS),
         };
-        this.client = this.deps.createClient?.(options) ?? new OursClient(options);
+        this.client = await (this.deps.attachClient?.(options) ?? attachOursClient(options));
     }
     async bindIdentity(name) {
         // force is pinned off: the owner channel never evicts another live session
@@ -88,6 +155,9 @@ export class OursSdkClient {
     async deferMessages(msgIds) {
         await this.ops().deferMessages({ msg_ids: msgIds });
     }
+    watchNotifications(identity, options) {
+        return this.ops().watchNotifications(identity, options);
+    }
     async listIncomingFiles() {
         return this.ops().listIncomingFiles();
     }
@@ -106,7 +176,7 @@ export class OursSdkClient {
             contact: a.contact, text: a.text,
             ...(a.replyToWireId ? { reply_to_wire_id: a.replyToWireId } : {}),
         });
-        // Parity with ours-mcp 0.16.0: only `refused` was a tool error. `migrating`,
+        // Legacy parity: only `refused` was a tool error. `migrating`,
         // `deferred` and `e2e` are accepted-and-queued outcomes that it reported as
         // success, so they must not become failures here.
         if (verdict.kind === 'refused')
@@ -114,11 +184,18 @@ export class OursSdkClient {
                 + 're-established after an upgrade; it was not sent and not downgraded');
     }
     async sendFile(a) {
+        // The shared daemon may be owned by a different OS process/user and must
+        // never be expected to open fleet-private outbox paths. SDK 2 stages bytes
+        // read by THIS process, then sends only the opaque upload receipt.
+        const bytes = await (this.deps.readFile?.(a.path) ?? readFile(a.path));
+        const staged = await this.ops().uploadFile(bytes, {
+            filename: a.filename, mime: mimeFromFilename(a.filename),
+        });
         const verdict = await this.ops().sendFile({
-            contact: a.contact, path: a.path, filename: a.filename,
+            contact: a.contact, upload_id: staged.upload_id, filename: a.filename,
             ...(a.replyToWireId ? { reply_to_wire_id: a.replyToWireId } : {}),
         });
-        // Parity with ours-mcp 0.16.0, which treated `migrating` as an error for
+        // Legacy parity treated `migrating` as an error for
         // files and as success for messages: files are not auto-queued behind a
         // migration, so "queued" would be a false delivery claim.
         if (verdict.kind === 'refused' || verdict.kind === 'migrating')

package/dist/supervisor/systemd.js

@@ -64,7 +64,7 @@ export function makeSystemdBackend(exec = realExec) {
             const unitDir = join(home(), '.config', 'systemd', 'user');
             // Lingering user units often start before a login shell imports its PATH.
             // Pin the Node runtime and persist the install-time PATH so the runner and
-            // children such as `ours-mcp proxy` resolve the same tools after reboot.
+            // structured operator CLI resolve the same tools after reboot.
             const servicePath = [...new Set([
                     dirname(process.execPath),
                     ...(process.env.PATH ?? '').split(delimiter),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.18.0-nightly.2",
+  "version": "0.18.0-nightly.4",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -38,7 +38,8 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/sdk": "1.3.1",
+    "@ours.network/cli": "1.0.1",
+    "@ours.network/sdk": "2.0.1",
     "@xterm/addon-fit": "0.10.0",
     "@xterm/addon-serialize": "0.13.0",
     "@xterm/headless": "5.5.0",