@ours.network/fleet 0.18.0-nightly.6 → 0.18.0

package/README.md

@@ -68,8 +68,6 @@ The state dir contract:
 | `.identity`, `.cwd`, `.session-id`, `.booted`, `.exit-status`, `.config-path` | supervisor | dot-marker state — session resume and boot bookkeeping |
 | `.monitor-state.json`, `.monitor-status` | supervisor monitor | atomic body-free cursor/pending state and health |
 | `.owner-channel-state.json` | owner-channel bridge | bounded wire-ID dedupe only; never message/reply plaintext |
-| `.owner-channel-message-recovery.json` | owner-channel bridge | mode-0600 body-free message claim journal: wire ID, history sequence, and claim time only |
-| `.owner-channel-attachment-recovery.json` | owner-channel bridge | mode-0600 attachment route journal; never filenames, paths, transcript text, or bytes |
 | `.owner-channel-binder.lock/`, `.owner-channel-binder.json` | owner-channel supervisor | mode-0600 role/identity + PID/start-marker ownership and release metadata; never mail plaintext or credentials |
 | `.session-events.jsonl`, `.control.sock`, `.control-token` | ACP backend | bounded typed console projection and private attachment control |
 
@@ -81,7 +79,7 @@ The state dir contract:
 | tmux | roles using `session: tmux` (the default) | `apt install tmux` / `brew install tmux` |
 | Node ≥ 22 | Claude roles using `session: acp` | required by the maintained Claude ACP adapter |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
+| `ours-mcp` daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/mcp && ours-mcp start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -216,6 +214,22 @@ unknown evidence; a newly launched harness follows its generated first-boot
 instructions to choose or create and bind the identity. The console never
 claims that the host created an identity and never deletes one.
 
+ACP tool diffs are normalized before they enter the durable conversation
+ledger. Small diffs retain their existing before/after representation. When an
+adapter reports an oversized whole-file snapshot, fleet stores only the changed
+region with path, operation, original byte counts, digest, and boundedness
+metadata. Each retained changed side is capped at 64 KiB as a UTF-8-safe,
+newest-content tail. The tail advances to a line boundary when a complete line
+fits. If one logical line alone exceeds the cap, fleet retains its newest
+UTF-8-safe suffix and records that it starts mid-line, together with omitted-byte
+count and digest. Paths retain at most a 4 KiB suffix with the same explicit
+size/digest/omission provenance, and a 320 KiB cap covers the complete normalized
+update. An append therefore cannot replay a large historical file while hiding
+the current appended text. The live web-console transcript projects only events
+from the current runner generation and excludes adapter `session/load` replay;
+those replay events remain in the durable ledger with `agent_replay` provenance
+for diagnosis and recovery rather than appearing as current work.
+
 For a temporary role, those first-boot instructions preserve and bind an
 existing identity when one is present. If the assigned identity is missing,
 the role capability-detects the ours MCP `create_temporary_identity` tool and
@@ -346,6 +360,10 @@ defaults:
   max_tokens: 500000                    # session cap (harness-interpreted)
   monitor:
     mode: fleet                         # fleet (default) | native
+  worklog:                              # built-ins shown; set false to opt out
+    max_kb: 1024                        # rotate only above this active-log size
+    keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
+    max_archives: 12                    # recent beside log; older preserved cold
 roles:
   Name:                                 # [A-Za-z0-9_-]+
     harness: claude-code
@@ -432,6 +450,11 @@ role's `harness_options`, so a fleet can set common Codex permission/profile def
 and override individual keys per role. `monitor` merges the same way — a role block
 overrides `defaults.monitor` key-by-key.
 
+Every supervised role is a client of the operator-configured ours daemon. Fleet
+forces `OURS_AUTOSTART=0` in both tmux and ACP harness processes, after role environment
+overlays, so `env.OURS_AUTOSTART` cannot transfer shared daemon lifecycle ownership to an
+agent. Operators and explicit installer/setup flows remain responsible for starting it.
+
 ### Scheduled agent loops
 
 Top-level `loops` schedule literal prompts from trusted local YAML. Enabled targets
@@ -522,10 +545,13 @@ native settings actually grant, against a fixed floor:
 those requests with nobody to see it. With `unattended: wait` it **warns**,
 since a human can still attach a console and answer.
 
-**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`,
-`auto` to Codex `on-request` / Claude `acceptEdits`, and `allow` to Codex
-`never` / Claude `bypassPermissions`, the non-interactive modes that actually
-permit the actions the role was authorized to take.
+**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`.
+`auto` selects Codex ACP `agent` (`on-request` + `workspace-write`) / Claude
+`acceptEdits`. `allow` selects Codex ACP's fully non-interactive yolo mode,
+reported by the adapter as `agent-full-access` (`never` +
+`danger-full-access`); Claude uses `bypassPermissions`. For Codex tmux, where the
+approval and sandbox flags remain independent, `auto` is `on-request` and
+`allow` is `never` while `filesystem` still chooses the sandbox.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
 `allow` role previously ran unable to do its job. Legacy `deny` is accepted
 only for compatibility and retains its conservative Codex `on-request` /
@@ -537,10 +563,14 @@ ACP exposes agent-specific session mode IDs and `session/set_mode`, but no
 portable permission-policy capability. Fleet uses that primitive where an
 adapter has a corresponding mode and otherwise translates at the adapter. The
 bundled Codex ACP adapter couples approval and sandboxing in its advertised
-mode IDs, so fleet preserves the selected sandbox preset and enforces approval
-independently on the app-server turn request. Thus `allow` + `workspace` is
-actually `never` + `workspace-write`, never `danger-full-access`. Live session
-metadata reports the normalized policy and the ACP sandbox-preset ID.
+mode IDs. Consequently, neutral `allow` selects `agent-full-access` and widens
+`filesystem: workspace` or `read-only` to `danger-full-access`; neutral `auto`
+selects `agent` and uses `workspace-write` even when the neutral filesystem
+value differs. An explicit `harness_options.sandbox` still wins and selects its
+corresponding ACP preset; explicit native approval overrides also win. Fleet
+reports a coupled-mode mismatch as approximate in `config`/`doctor`, and
+per-role `isolation:` remains the boundary for an `allow` ACP role. Live session
+metadata reports the normalized policy and the exact native mode selected.
 
 ### Isolation at creation time
 
@@ -642,14 +672,13 @@ agent's briefing tells it **not** to arm a native harness Monitor.
 
 With `monitor.mode: native`, ours-fleet does not start its supervisor monitor;
 the generated briefing instead instructs the harness to arm its own wake
-mechanism (the structured `ours api watch-notifications` JSONL stream for Claude Code,
-or the Codex
+mechanism (`ours-mcp watch` for Claude Code, or the Codex
 `arm_monitor`/`foreground_monitor` flow). The old `monitor.enabled: true|false`
 form remains accepted as a compatibility alias for `fleet|native`, respectively,
 but new configuration should use `mode`.
 
 `inject: full` (pushing message bodies
-inline) is on the roadmap and needs two new daemon endpoints; today all
+inline) is on the roadmap and needs two new ours-mcp daemon endpoints; today all
 roles deliver `notification` lines and drain via `get_messages`.
 
 ACP stdio remains private to the persistent runner. `send`, `peek`, and the basic
@@ -873,26 +902,22 @@ command path sits behind the authenticated owner-CID check: a non-owner sending
 `/force-restart` or `/model` is silently ignored exactly like any other
 unauthorized mail.
 
-Handled wire IDs are durably bounded for deduplication, while message and
-response bodies stay out of fleet state. Before consuming mail, fleet reads the
-body-free oldest-first metadata from `listIncomingMessages`, atomically journals
-the exact wire/sequence slice (at most 200), and calls `getMessages` with that
-exact length. A returned wire/sequence set mismatch fails closed. After a crash,
-journaled bodies are loaded only from persistent history with `getHistoryItem`;
-the journal is pruned only after the existing durable owner-channel state marks
-the wire handled. This provides at-least-once turn delivery without placing
-message plaintext in fleet state.
+Processed wire IDs are durably bounded for deduplication, while
+message and response bodies stay out of fleet state. Delivery is at-least-once
+across a crash (the bridge requeues fetched input before starting a turn); true
+exactly-once processing would require a leased claim/idempotency primitive in
+ours-mcp.
 
 Inbound owner attachments use the same authenticated-CID and exact-wire routing
-boundary. Fleet first calls the metadata-only `listIncomingFiles`, groups a
+boundary. Fleet first calls the metadata-only `list_incoming_files`, groups a
 file-only wake or a same-sender reply-linked text caption, and checks the enabled,
 count, declared MIME, per-file size, and total-size policy before retrieving any
-bytes. It then calls selective `getFiles` only for the admitted wire IDs. An
+bytes. It then calls selective `get_files` only for the admitted wire IDs. An
 unauthorized sender is ignored without retrieval or reply. A rejected authorized
 request receives a bounded reason correlated to its file wire.
 
 Retrieved files must be regular, non-symlink paths whose byte count and SHA-256
-match typed SDK metadata. Fleet additionally checks content signatures against the
+match ours-mcp metadata. Fleet additionally checks content signatures against the
 declared MIME, sanitizes traversal/control characters from names, and copies each
 file into a random request-scoped directory at mode 0700 with files at mode 0600.
 The `[fleet-owner]` turn receives only bounded metadata, the private local paths,
@@ -903,19 +928,17 @@ the agent must use the audio path rather than inventing text.
 Request files are removed after final delivery and stale directories are removed
 after `retention_ms`. A bounded mode-0600 recovery journal stores only owner CID
 and wire routing metadata—never filenames, paths, captions, transcripts, or file
-bytes. If a selected file is already read when fleet restarts, fleet resolves
-only that journaled wire with `getFileInfo` and retrieves its immutable blob with
-`fetchFile`; a claimed managed-agent caption is loaded from message history and
-rejoined with its journaled read files before the group is admitted or relayed.
-Recovered voice files remain transcript-unavailable and are never sent through
-a second transcription attempt. Conversation route state migrates from v1 to a
-bounded v2
+bytes. If ours-mcp already marked a selected file processed when fleet restarts,
+fleet resumes only that journaled wire with `save_file`; a deferred managed-agent
+caption is replayed with its journaled processed files before the group is
+admitted or relayed. Conversation route state migrates from v1 to a bounded v2
 source-wire index so a correlated group keeps the authenticated owner selected by
-its original request even after later owner traffic. Corrupt recovery state disables attachment
-admission. The host must run an ours daemon compatible with SDK 2.0.1 whose
-typed incoming-file, selective retrieval, and file-fetch operations support
-these guarantees; `ours config show --json` reports `sttConfigured` without
-revealing provider credentials.
+its original request even after later owner traffic. Recovered voice is explicitly
+marked transcript-unavailable. Corrupt recovery state disables attachment
+admission. The host must run an ours-mcp version whose
+`list_incoming_files`, selective `get_files`, and `save_file` schemas support
+these guarantees; `ours-mcp voice-status --json` reports whether transcription
+is currently configured.
 
 Managed-agent file egress is a separate trust direction. It retains the same
 metadata provenance checks, count/per-file/request byte caps, regular-file and
@@ -936,6 +959,36 @@ cannot reliably distinguish the final answer from thoughts, tool output, or
 unrelated concurrent work. The config rejects tmux instead of silently offering
 weaker semantics.
 
+## Deterministic harness plugin channels
+
+Plugin channels are per harness and default to stable. Nightly must be selected
+explicitly in the base fleet file:
+
+```yaml
+harnesses:
+  codex:
+    plugin_channel: nightly
+  claude-code:
+    plugin_channel: stable
+```
+
+Install or repair from the existing lock with `ours-fleet plugins install`; move
+a lock deliberately with `ours-fleet plugins update`. Either command may take
+`codex`, `claude-code`, or both when omitted. `ours-fleet plugins status` shows
+the configured channel and exact version.
+
+Each explicit resolution reads the channel's npm dist-tag exactly once, validates
+the result, and persists it under
+`~/.ours-fleet/harness-plugins/<harness>/plugin-lock.json`. Fleet then generates
+a host-local marketplace containing the exact package semver and installs through
+that marketplace. Stable is pinned in exactly the same way as nightly: `latest`
+is never left in an install source. Normal starts, restarts, and reconciliation
+only regenerate marketplace files from the persisted lock; they never query npm,
+run an installer, or silently advance a version. A failed installation can be
+retried with `plugins install` and reuses the same lock.
+An explicitly nightly harness refuses to launch without a nightly lock, and a
+configured/locked channel mismatch fails with the exact `plugins update` command.
+
 ## Codex roles
 
 Install Codex, the native ours plugin, and the fleet CLI once on the fleet host:
@@ -961,7 +1014,7 @@ pass the legacy `ours-fleet spawn --monitor` flag) to record explicit persistent
 for the harness-native monitor, including supervised restarts. This does not choose the
 wake owner; use `monitor.mode: fleet|native` for that. In the standard-Codex fallback, the agent separately surfaces the
 `ours-codex` recommendation before asking to enter `foreground_monitor`. It never backgrounds
-the structured CLI watcher, because a detached process cannot wake a Codex turn. The foreground
+`ours-mcp watch`, because a detached watch cannot wake a Codex turn. The foreground
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
@@ -1045,7 +1098,7 @@ picks the most recently active session **in the role's `cwd`**. This works
 cleanly as long as each role has its own `cwd` (the common case); two roles
 sharing an identical `cwd` could have their resumes cross — give them distinct
 working directories if that matters. MCP and monitor wiring is provided by
-[`@ours.network/codex`](https://www.npmjs.com/package/@ours.network/codex);
+[`@ours.network/codex`](https://github.com/adapt-toolkit/ours-mcp/tree/main/packages/codex);
 the core ours skill discovers fleet behavior through `ours-fleet docs`.
 `ours-fleet doctor --harness codex` verifies the CLI, ours plugin, and enhanced launcher/fallback.
 
@@ -1117,7 +1170,7 @@ rollout, anchors, aliases, explicit tags, non-scalar keys, and multiple document
 produce source-positioned warnings; opt into enforcement with
 `--yaml-mode strict`. Strict mode will become the next-major default.
 
-Long-running roles may opt into bounded durable logs:
+WORKLOG rotation is enabled for roles by default with conservative built-ins:
 
 ```yaml
 worklog:
@@ -1127,8 +1180,23 @@ worklog:
 ```
 
 Rotation is conservative: a concurrent change aborts the attempt and retries at
-a later fleet lifecycle point. Archives remain in the role state directory and
-may contain the same sensitive material as `WORKLOG.md`.
+a later fleet lifecycle point. The active log retains a bounded UTF-8 tail,
+advancing to a line boundary when a complete line fits. If one logical line
+alone exceeds the tail budget, its newest suffix remains and
+`.worklog-rotation.json` explicitly records the mid-line start and omitted byte
+count. It also records SHA-256 digests for the archive and retained live bytes
+observed when the manifest is written. The complete prior inode is published
+under a collision-safe UTC name.
+`max_archives` bounds recent archives beside `WORKLOG.md`; older complete
+archives move to `WORKLOG.archives/` and are never deleted. Use `worklog: false` on a role or in
+`defaults` to opt out. Archives may contain the same sensitive material as
+`WORKLOG.md`. Rotation refuses a symlinked/non-regular live log or a symlinked
+cold-archive boundary before replacing the live path, and best-effort removes a
+duplicate link left by a detected failure while the original inode is still
+available. These are ordinary path/error safeguards, not a security boundary
+against a malicious concurrent process with the same Unix authority: intentional
+symlink swaps or archive-directory renames between checks are outside the threat
+model and require OS-level isolation from that process.
 
 Claude roles can use a credential-free loopback proxy:
 

package/dist/application/fleet-query-service.js

@@ -1,5 +1,6 @@
 import { lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { classifyActivity } from '../session/activity.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { readExitRecord, readRestartLedger } from '../runner.js';
@@ -55,6 +56,10 @@ function sessionOverall(supervisor, session, restart, monitor, isolation, proble
     if (session.reachability === 'online'
         && (session.readiness === 'running' || session.readiness === 'awaiting_permission'))
         return 'busy';
+    // `readiness: idle` alone never justifies `ready`. A steered wake turn is
+    // invisible to readiness (FLEET-002), so observed activity outranks it.
+    if (session.reachability === 'online' && session.activity.state === 'active')
+        return 'busy';
     if (session.reachability === 'online' && session.readiness === 'idle')
         return 'ready';
     if (session.reachability === 'offline'
@@ -153,6 +158,7 @@ export class FleetQueryService {
                     protocolVersion: snapshot.protocolVersion, features: snapshot.features,
                     runtimeModel: snapshot.runtimeModel, reasoningEffort: snapshot.reasoningEffort,
                     permissionMode: snapshot.permissionMode,
+                    activity: classifyActivity(snapshot.activity),
                 };
             }
             catch (error) {
@@ -164,6 +170,7 @@ export class FleetQueryService {
                         : failure === 'control-unavailable' ? 'unavailable' : 'unknown',
                     readiness: offline ? 'failed' : 'unknown',
                     evidence: 'authoritative', lastError: clean(error.message),
+                    activity: { state: 'unobservable' },
                 };
             }
         }
@@ -174,18 +181,23 @@ export class FleetQueryService {
                     backend: 'tmux', reachability: has ? 'online' : supervisor === 'stopped' ? 'offline' : 'unknown',
                     readiness: has ? 'idle' : supervisor === 'running' ? 'starting' : 'failed',
                     evidence: 'inferred',
+                    // tmux exposes no agent-side evidence at all, and `readiness: idle`
+                    // here is a pane-liveness inference, not an activity claim.
+                    activity: { state: 'unobservable' },
                 };
             }
             catch (error) {
                 return {
                     backend: 'tmux', reachability: 'unknown', readiness: 'unknown',
                     evidence: 'inferred', lastError: clean(error.message),
+                    activity: { state: 'unobservable' },
                 };
             }
         }
         return {
             backend: 'unknown', reachability: supervisor === 'stopped' ? 'offline' : 'unknown',
             readiness: supervisor === 'stopped' ? 'failed' : 'unknown', evidence: 'inferred',
+            activity: { state: 'unobservable' },
         };
     }
 }

package/dist/application/role-creation-service.js

@@ -118,7 +118,9 @@ export class RoleCreationService {
         };
         const warnings = [];
         if (request.permissions.approval === 'allow')
-            warnings.push('approval=allow maps to an elevated native permission mode');
+            warnings.push(effective.harness === 'codex' && effective.session === 'acp'
+                ? 'approval=allow maps to elevated Codex ACP agent-full-access and widens the native sandbox to danger-full-access'
+                : 'approval=allow maps to an elevated native permission mode');
         if (request.permissions.filesystem === 'unrestricted')
             warnings.push('filesystem=unrestricted grants access outside the workspace');
         if (request.permissions.unattended === 'wait')

package/dist/application/types.d.ts

@@ -72,6 +72,17 @@ export interface RoleStatus {
         runtimeModel?: SessionSnapshot['runtimeModel'];
         reasoningEffort?: SessionSnapshot['reasoningEffort'];
         permissionMode?: SessionSnapshot['permissionMode'];
+        /**
+         * Activity evidence, kept separate from `readiness` on purpose: `readiness`
+         * answers "is a fleet-tracked turn in flight" (the prompt-admission gate),
+         * NOT "is this agent working". `state` is the only field a human-facing
+         * surface may use to call a role idle or stalled.
+         */
+        activity: {
+            state: 'active' | 'quiet' | 'unobservable';
+            activeToolCalls?: number;
+            lastUpdateAt?: string;
+        };
     };
     restart: {
         circuit: 'closed' | 'open';

package/dist/briefing.js

@@ -168,6 +168,11 @@ export function generateBriefing(role, v, opts) {
         L.push('Never translate any other failure into "dead". A busy agent, an unanswered control');
         L.push('plane and a confirmed stop look identical if you only look at one command.');
         L.push('');
+        L.push('`ours-fleet status` reports `session.readiness`, which is TURN OCCUPANCY only: a mail');
+        L.push('wake delivered by steering runs a whole turn with readiness pinned at `idle`. Read the');
+        L.push('`activity:` line beside it — `active` means the role is working — and never call a role');
+        L.push('idle or stalled from `readiness=idle` alone.');
+        L.push('');
         L.push('Then judge the console content: stuck on a prompt/menu/trust dialog → answer it directly');
         L.push('with `ours-fleet send <Name> "<text>"` (or `--key <K>` for raw keys); idle with work');
         L.push('assigned → nudge; actively working → do nothing, and do not mistake a long turn for a');
@@ -178,8 +183,10 @@ export function generateBriefing(role, v, opts) {
     L.push('it survives restarts.');
     if (role.worklog) {
         L.push(`Fleet rotates it above ${role.worklog.max_kb} KiB, keeps approximately the newest ` +
-            `${role.worklog.keep_tail_kb} KiB here, and retains ${role.worklog.max_archives} archives ` +
-            'beside it. Continue writing only WORKLOG.md.');
+            `${role.worklog.keep_tail_kb} KiB here, and keeps ${role.worklog.max_archives} recent archives ` +
+            'beside it. Older complete archives move to WORKLOG.archives without deletion; ' +
+            '.worklog-rotation.json identifies the latest archive for restart provenance. ' +
+            'Continue writing only WORKLOG.md.');
     }
     L.push('', '## Routines');
     L.push(`If \`${opts.routinesPath}\` exists, re-read it at the START of every wake — before acting`);

package/dist/build-info.json

@@ -1,10 +1,11 @@
 {
-  "version": "0.18.0-nightly.6",
-  "buildId": "a6e98a19befa",
-  "commit": "9d10eff5b5b241926326894479810dbae7b026a2",
-  "dirty": true,
-  "builtAt": "2026-08-21T22:28:07.994Z",
+  "version": "0.18.0",
+  "buildId": "61cc47d629af",
+  "commit": "3d60e26d8f751537a7aab6a3df8b75eafa182cd0",
+  "dirty": false,
+  "builtAt": "2026-08-22T08:40:59.670Z",
   "capabilities": [
-    "monitor.interrupt.after_tool"
+    "monitor.interrupt.after_tool",
+    "harness.plugins.exact-lock"
   ]
 }

package/dist/capabilities.d.ts

@@ -14,7 +14,9 @@
  */
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export declare const CAP_MONITOR_INTERRUPT_AFTER_TOOL = "monitor.interrupt.after_tool";
-export declare const CAPABILITIES: readonly ["monitor.interrupt.after_tool"];
+/** Exact, persisted stable/nightly harness plugin resolution and local marketplaces. */
+export declare const CAP_HARNESS_PLUGIN_LOCK = "harness.plugins.exact-lock";
+export declare const CAPABILITIES: readonly ["monitor.interrupt.after_tool", "harness.plugins.exact-lock"];
 export type Capability = (typeof CAPABILITIES)[number];
 /** Does this build declare `token`? */
 export declare const hasCapability: (token: string) => boolean;

package/dist/capabilities.js

@@ -14,8 +14,11 @@
  */
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export const CAP_MONITOR_INTERRUPT_AFTER_TOOL = 'monitor.interrupt.after_tool';
+/** Exact, persisted stable/nightly harness plugin resolution and local marketplaces. */
+export const CAP_HARNESS_PLUGIN_LOCK = 'harness.plugins.exact-lock';
 export const CAPABILITIES = [
     CAP_MONITOR_INTERRUPT_AFTER_TOOL,
+    CAP_HARNESS_PLUGIN_LOCK,
 ];
 /** Does this build declare `token`? */
 export const hasCapability = (token) => CAPABILITIES.includes(token);

package/dist/cli.js

@@ -25,8 +25,9 @@ import { stringify } from 'yaml';
 import { resolvedRolePlan } from './resolved-plan.js';
 import { creationBuildNote, formatProvenance, readProvenance } from './creation.js';
 import { doctor } from './doctor.js';
-import { allWarnings, analyzeFleetPermissions, formatNative } from './permissions.js';
+import { allWarnings, analyzeFleetPermissions, effectivePermissionMode, formatNative, } from './permissions.js';
 import { AI_DOCS } from './docs.js';
+import { classifyActivity, describeSessionState } from './session/activity.js';
 import { controlRequest, controlSocketPath, followControl, livenessNote, } from './session/control.js';
 import { SessionControlError } from './session/types.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
@@ -35,6 +36,7 @@ import { requestWebControl } from './web/control.js';
 import { WebServiceManager } from './web/service.js';
 import { WebAccessStore, passwordAccess, validatePublicOrigin } from './web/access.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
+import { installHarnessPlugin, readHarnessPluginLock, selectedHarnessPluginIds, } from './harness-plugins.js';
 import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
 // sudo/su shells lack XDG_RUNTIME_DIR, breaking every systemctl/journalctl
@@ -65,6 +67,51 @@ const program = new Command()
     .version(VERSION);
 const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'config file (default: ~/fleet.yaml + ~/fleet.d/)');
 const collect = (value, previous) => [...previous, value];
+const pluginsCommand = program.command('plugins')
+    .description('install exact, persisted stable/nightly harness plugins');
+const changeHarnessPlugins = (update) => async (names, opts) => {
+    try {
+        const cfg = loadConfig(opts.configuration);
+        for (const harness of selectedHarnessPluginIds(names)) {
+            const channel = cfg.harnessPlugins[harness].plugin_channel;
+            const result = await installHarnessPlugin(harness, channel, { update });
+            console.log(`${harness}: ${result.lock.package}@${result.lock.version} `
+                + `(${channel}, ${result.resolved ? 'resolved and locked' : 'reused lock'})`);
+            console.log(`  lock: ${result.lockPath}`);
+            console.log(`  marketplace: ${result.marketplacePath}`);
+        }
+    }
+    catch (e) {
+        die(e);
+    }
+};
+cOpt(pluginsCommand.command('install [harnesses...]')
+    .description('install from the configured channel; reuse an existing same-channel lock'))
+    .action(changeHarnessPlugins(false));
+cOpt(pluginsCommand.command('update [harnesses...]')
+    .description('resolve configured channels once, persist exact versions, and install them'))
+    .action(changeHarnessPlugins(true));
+cOpt(pluginsCommand.command('status [harnesses...]')
+    .description('show configured channels and persisted exact versions'))
+    .action((names, opts) => {
+    try {
+        const cfg = loadConfig(opts.configuration);
+        for (const harness of selectedHarnessPluginIds(names)) {
+            const configured = cfg.harnessPlugins[harness].plugin_channel;
+            const lock = readHarnessPluginLock(harness);
+            if (!lock) {
+                console.log(`${harness}: configured=${configured}, unlocked `
+                    + `(run \`ours-fleet plugins install ${harness}\`)`);
+                continue;
+            }
+            const mismatch = lock.channel === configured ? '' : `, CONFIG MISMATCH (locked=${lock.channel})`;
+            console.log(`${harness}: configured=${configured}, ${lock.package}@${lock.version}${mismatch}`);
+        }
+    }
+    catch (e) {
+        die(e);
+    }
+});
 program.command('docs')
     .alias('man')
     .description('print the complete AI-friendly command and configuration reference')
@@ -363,8 +410,14 @@ program.command('ls').description('list running fleet sessions')
                 continue;
             try {
                 const response = await controlRequest(stateDir, { command: 'status' }, 2_000);
-                if (response.ok && response.result?.alive)
-                    acp.push(`${name}: acp`);
+                const result = response.result;
+                if (response.ok && result?.alive) {
+                    // Activity, not readiness: an idle-readiness role may be running a
+                    // steered wake turn (FLEET-002), so `ls` reports what was observed.
+                    const observed = classifyActivity(result.activity);
+                    acp.push(`${name}: acp${observed.state === 'active' ? ' (working)'
+                        : observed.state === 'quiet' ? ' (no recent agent activity)' : ''}`);
+                }
             }
             catch { /* ignore stale sockets */ }
         }
@@ -505,6 +558,14 @@ program.command('status <name>').description('unit/agent state')
     else if (ledger.consecutiveImmediateFailures > 0)
         console.log(`restarts: ${ledger.consecutiveImmediateFailures} consecutive immediate `
             + `failures, next delay ${ledger.nextDelayMs}ms (${ledger.lastReason})`);
+    // A kill the supervisor never saw leaves no other trace here. Say it out
+    // loud rather than letting the absence of a failure streak read as "fine".
+    if (ledger.lastTermination?.class === 'abrupt')
+        console.log(`last termination: ABRUPT — the previous supervisor run (started `
+            + `${ledger.lastTermination.runStartedAt ?? 'unknown'}) died without an orderly exit; `
+            + `observed ${ledger.lastTermination.observedAt}`
+            + `\n  abrupt terminations recorded: ${ledger.abruptTerminations ?? 1}`
+            + `\n  cause (signal / OOM-kill): journalctl --user -u ours-fleet-agent@${name}.service`);
     const modelStatus = joinPath(agentDir(name), '.model-status');
     if (existsSync(modelStatus)) {
         try {
@@ -523,8 +584,14 @@ program.command('status <name>').description('unit/agent state')
     if (stateDir) {
         try {
             const response = await controlRequest(stateDir, { command: 'status' }, 2_000);
-            if (response.ok)
+            if (response.ok) {
+                const snapshot = response.result;
                 console.log(`session: ${JSON.stringify(response.result)}`);
+                // `readiness` is turn occupancy, never an activity claim: a steered
+                // wake turn runs to completion with readiness pinned at `idle`
+                // (FLEET-002). Say which question each field answers.
+                console.log(describeSessionState(snapshot.readiness, snapshot.activity));
+            }
         }
         catch {
             console.log('session: acp control unavailable');
@@ -635,7 +702,10 @@ function renderLoopRows(role, state, loop) {
     return Object.entries(state.loops).filter(([name]) => !loop || name === loop).map(([name, item]) => `${role}/${name} ${item.enabled && !item.operatorDisabled ? 'enabled' : 'disabled'} `
         + `${item.activeRunId ? 'running' : 'idle'} next=${item.nextDueAt} last=${item.lastOutcome ?? 'never'} `
         + `counts=${item.counts.started}/${item.counts.completed}/${item.counts.failed} `
-        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`);
+        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`
+        + (item.missedGap
+            ? ` gap=${item.missedGap.count}@${item.missedGap.fromAt}..${item.missedGap.throughAt}`
+            : ''));
 }
 cOpt(loopsCommand.command('status [role] [loop]').description('show live or stored loop state'))
     .option('--json', 'emit stable JSON')
@@ -1089,7 +1159,7 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
     .option('--coordinator <name>', 'announce target')
     .option('--model <id>', 'model id to launch on (e.g. claude-fable-5); default: launcher default')
     .option('--permission-mode <mode>', 'harness permission mode (Codex: untrusted|on-request|never; Claude: native values)')
-    .option('--approval <mode>', 'fleet permission mode: ask|auto|allow (deny is deprecated)')
+    .option('--approval <mode>', 'fleet permission mode: ask|auto|allow (Codex ACP allow selects agent-full-access; deny is deprecated)')
     .option('--filesystem <mode>', 'common filesystem intent: read-only|workspace|unrestricted')
     .option('--unattended <mode>', 'permission behavior without a console: deny|wait')
     .option('--sandbox <mode>', 'Codex sandbox: read-only|workspace-write|danger-full-access')
@@ -1161,13 +1231,17 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             console.log(`spawned ${result.lifetime} agent '${result.role}' through `
                 + `${result.caller}'s fleet proxy (state: ${result.statePath})`);
             console.log(`  ${result.harness}/${result.session}`
-                + `${result.model ? ` model=${result.model}` : ''}; `
+                + `${result.model ? ` model=${result.model}` : ''}`
+                + (result.permissionMode
+                    ? `; permission=${result.permissionMode.fleetMode} native=${result.permissionMode.nativeMode}`
+                    : '') + '; '
                 + `monitor=${result.monitor.mode} interrupt=${result.monitor.interrupt}`);
             if (result.inherited.length)
                 console.log(`  inherited omitted defaults from ${result.caller}: ${result.inherited.join(', ')}`);
             console.log(`→ watch it: ours-fleet peek ${result.role}   |   attach: ours-fleet attach ${result.role}`);
             return;
         }
+        const plannedPermissionMode = effectivePermissionMode(spawnDryRun(o).resolvedRole);
         if (o.temp) {
             const dir = await spawnTemp(o, binPath);
             console.log(`spawned temp agent '${roleName}' (state: ${dir}; gone on exit/reboot)`);
@@ -1185,6 +1259,8 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             for (const line of formatProvenance(lastProvenance))
                 console.log(line);
         }
+        console.log(`  permission=${plannedPermissionMode.fleetMode} `
+            + `native=${plannedPermissionMode.nativeMode}`);
         console.log(`→ watch it: ours-fleet peek ${roleName}   |   attach: ours-fleet attach ${roleName}`);
     }
     catch (e) {