@ours.network/fleet 0.18.0-nightly.6 → 0.18.1

package/README.md

@@ -68,8 +68,6 @@ The state dir contract:
 | `.identity`, `.cwd`, `.session-id`, `.booted`, `.exit-status`, `.config-path` | supervisor | dot-marker state — session resume and boot bookkeeping |
 | `.monitor-state.json`, `.monitor-status` | supervisor monitor | atomic body-free cursor/pending state and health |
 | `.owner-channel-state.json` | owner-channel bridge | bounded wire-ID dedupe only; never message/reply plaintext |
-| `.owner-channel-message-recovery.json` | owner-channel bridge | mode-0600 body-free message claim journal: wire ID, history sequence, and claim time only |
-| `.owner-channel-attachment-recovery.json` | owner-channel bridge | mode-0600 attachment route journal; never filenames, paths, transcript text, or bytes |
 | `.owner-channel-binder.lock/`, `.owner-channel-binder.json` | owner-channel supervisor | mode-0600 role/identity + PID/start-marker ownership and release metadata; never mail plaintext or credentials |
 | `.session-events.jsonl`, `.control.sock`, `.control-token` | ACP backend | bounded typed console projection and private attachment control |
 
@@ -81,7 +79,7 @@ The state dir contract:
 | tmux | roles using `session: tmux` (the default) | `apt install tmux` / `brew install tmux` |
 | Node ≥ 22 | Claude roles using `session: acp` | required by the maintained Claude ACP adapter |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
+| `ours-mcp` daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/mcp && ours-mcp start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -216,6 +214,22 @@ unknown evidence; a newly launched harness follows its generated first-boot
 instructions to choose or create and bind the identity. The console never
 claims that the host created an identity and never deletes one.
 
+ACP tool diffs are normalized before they enter the durable conversation
+ledger. Small diffs retain their existing before/after representation. When an
+adapter reports an oversized whole-file snapshot, fleet stores only the changed
+region with path, operation, original byte counts, digest, and boundedness
+metadata. Each retained changed side is capped at 64 KiB as a UTF-8-safe,
+newest-content tail. The tail advances to a line boundary when a complete line
+fits. If one logical line alone exceeds the cap, fleet retains its newest
+UTF-8-safe suffix and records that it starts mid-line, together with omitted-byte
+count and digest. Paths retain at most a 4 KiB suffix with the same explicit
+size/digest/omission provenance, and a 320 KiB cap covers the complete normalized
+update. An append therefore cannot replay a large historical file while hiding
+the current appended text. The live web-console transcript projects only events
+from the current runner generation and excludes adapter `session/load` replay;
+those replay events remain in the durable ledger with `agent_replay` provenance
+for diagnosis and recovery rather than appearing as current work.
+
 For a temporary role, those first-boot instructions preserve and bind an
 existing identity when one is present. If the assigned identity is missing,
 the role capability-detects the ours MCP `create_temporary_identity` tool and
@@ -346,6 +360,10 @@ defaults:
   max_tokens: 500000                    # session cap (harness-interpreted)
   monitor:
     mode: fleet                         # fleet (default) | native
+  worklog:                              # built-ins shown; set false to opt out
+    max_kb: 1024                        # rotate only above this active-log size
+    keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
+    max_archives: 12                    # recent beside log; older preserved cold
 roles:
   Name:                                 # [A-Za-z0-9_-]+
     harness: claude-code
@@ -432,6 +450,11 @@ role's `harness_options`, so a fleet can set common Codex permission/profile def
 and override individual keys per role. `monitor` merges the same way — a role block
 overrides `defaults.monitor` key-by-key.
 
+Every supervised role is a client of the operator-configured ours daemon. Fleet
+forces `OURS_AUTOSTART=0` in both tmux and ACP harness processes, after role environment
+overlays, so `env.OURS_AUTOSTART` cannot transfer shared daemon lifecycle ownership to an
+agent. Operators and explicit installer/setup flows remain responsible for starting it.
+
 ### Scheduled agent loops
 
 Top-level `loops` schedule literal prompts from trusted local YAML. Enabled targets
@@ -522,10 +545,13 @@ native settings actually grant, against a fixed floor:
 those requests with nobody to see it. With `unattended: wait` it **warns**,
 since a human can still attach a console and answer.
 
-**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`,
-`auto` to Codex `on-request` / Claude `acceptEdits`, and `allow` to Codex
-`never` / Claude `bypassPermissions`, the non-interactive modes that actually
-permit the actions the role was authorized to take.
+**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`.
+`auto` selects Codex ACP `agent` (`on-request` + `workspace-write`) / Claude
+`acceptEdits`. `allow` selects Codex ACP's fully non-interactive yolo mode,
+reported by the adapter as `agent-full-access` (`never` +
+`danger-full-access`); Claude uses `bypassPermissions`. For Codex tmux, where the
+approval and sandbox flags remain independent, `auto` is `on-request` and
+`allow` is `never` while `filesystem` still chooses the sandbox.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
 `allow` role previously ran unable to do its job. Legacy `deny` is accepted
 only for compatibility and retains its conservative Codex `on-request` /
@@ -537,10 +563,14 @@ ACP exposes agent-specific session mode IDs and `session/set_mode`, but no
 portable permission-policy capability. Fleet uses that primitive where an
 adapter has a corresponding mode and otherwise translates at the adapter. The
 bundled Codex ACP adapter couples approval and sandboxing in its advertised
-mode IDs, so fleet preserves the selected sandbox preset and enforces approval
-independently on the app-server turn request. Thus `allow` + `workspace` is
-actually `never` + `workspace-write`, never `danger-full-access`. Live session
-metadata reports the normalized policy and the ACP sandbox-preset ID.
+mode IDs. Consequently, neutral `allow` selects `agent-full-access` and widens
+`filesystem: workspace` or `read-only` to `danger-full-access`; neutral `auto`
+selects `agent` and uses `workspace-write` even when the neutral filesystem
+value differs. An explicit `harness_options.sandbox` still wins and selects its
+corresponding ACP preset; explicit native approval overrides also win. Fleet
+reports a coupled-mode mismatch as approximate in `config`/`doctor`, and
+per-role `isolation:` remains the boundary for an `allow` ACP role. Live session
+metadata reports the normalized policy and the exact native mode selected.
 
 ### Isolation at creation time
 
@@ -642,14 +672,13 @@ agent's briefing tells it **not** to arm a native harness Monitor.
 
 With `monitor.mode: native`, ours-fleet does not start its supervisor monitor;
 the generated briefing instead instructs the harness to arm its own wake
-mechanism (the structured `ours api watch-notifications` JSONL stream for Claude Code,
-or the Codex
+mechanism (`ours-mcp watch` for Claude Code, or the Codex
 `arm_monitor`/`foreground_monitor` flow). The old `monitor.enabled: true|false`
 form remains accepted as a compatibility alias for `fleet|native`, respectively,
 but new configuration should use `mode`.
 
 `inject: full` (pushing message bodies
-inline) is on the roadmap and needs two new daemon endpoints; today all
+inline) is on the roadmap and needs two new ours-mcp daemon endpoints; today all
 roles deliver `notification` lines and drain via `get_messages`.
 
 ACP stdio remains private to the persistent runner. `send`, `peek`, and the basic
@@ -873,26 +902,22 @@ command path sits behind the authenticated owner-CID check: a non-owner sending
 `/force-restart` or `/model` is silently ignored exactly like any other
 unauthorized mail.
 
-Handled wire IDs are durably bounded for deduplication, while message and
-response bodies stay out of fleet state. Before consuming mail, fleet reads the
-body-free oldest-first metadata from `listIncomingMessages`, atomically journals
-the exact wire/sequence slice (at most 200), and calls `getMessages` with that
-exact length. A returned wire/sequence set mismatch fails closed. After a crash,
-journaled bodies are loaded only from persistent history with `getHistoryItem`;
-the journal is pruned only after the existing durable owner-channel state marks
-the wire handled. This provides at-least-once turn delivery without placing
-message plaintext in fleet state.
+Processed wire IDs are durably bounded for deduplication, while
+message and response bodies stay out of fleet state. Delivery is at-least-once
+across a crash (the bridge requeues fetched input before starting a turn); true
+exactly-once processing would require a leased claim/idempotency primitive in
+ours-mcp.
 
 Inbound owner attachments use the same authenticated-CID and exact-wire routing
-boundary. Fleet first calls the metadata-only `listIncomingFiles`, groups a
+boundary. Fleet first calls the metadata-only `list_incoming_files`, groups a
 file-only wake or a same-sender reply-linked text caption, and checks the enabled,
 count, declared MIME, per-file size, and total-size policy before retrieving any
-bytes. It then calls selective `getFiles` only for the admitted wire IDs. An
+bytes. It then calls selective `get_files` only for the admitted wire IDs. An
 unauthorized sender is ignored without retrieval or reply. A rejected authorized
 request receives a bounded reason correlated to its file wire.
 
 Retrieved files must be regular, non-symlink paths whose byte count and SHA-256
-match typed SDK metadata. Fleet additionally checks content signatures against the
+match ours-mcp metadata. Fleet additionally checks content signatures against the
 declared MIME, sanitizes traversal/control characters from names, and copies each
 file into a random request-scoped directory at mode 0700 with files at mode 0600.
 The `[fleet-owner]` turn receives only bounded metadata, the private local paths,
@@ -903,19 +928,17 @@ the agent must use the audio path rather than inventing text.
 Request files are removed after final delivery and stale directories are removed
 after `retention_ms`. A bounded mode-0600 recovery journal stores only owner CID
 and wire routing metadata—never filenames, paths, captions, transcripts, or file
-bytes. If a selected file is already read when fleet restarts, fleet resolves
-only that journaled wire with `getFileInfo` and retrieves its immutable blob with
-`fetchFile`; a claimed managed-agent caption is loaded from message history and
-rejoined with its journaled read files before the group is admitted or relayed.
-Recovered voice files remain transcript-unavailable and are never sent through
-a second transcription attempt. Conversation route state migrates from v1 to a
-bounded v2
+bytes. If ours-mcp already marked a selected file processed when fleet restarts,
+fleet resumes only that journaled wire with `save_file`; a deferred managed-agent
+caption is replayed with its journaled processed files before the group is
+admitted or relayed. Conversation route state migrates from v1 to a bounded v2
 source-wire index so a correlated group keeps the authenticated owner selected by
-its original request even after later owner traffic. Corrupt recovery state disables attachment
-admission. The host must run an ours daemon compatible with SDK 2.0.1 whose
-typed incoming-file, selective retrieval, and file-fetch operations support
-these guarantees; `ours config show --json` reports `sttConfigured` without
-revealing provider credentials.
+its original request even after later owner traffic. Recovered voice is explicitly
+marked transcript-unavailable. Corrupt recovery state disables attachment
+admission. The host must run an ours-mcp version whose
+`list_incoming_files`, selective `get_files`, and `save_file` schemas support
+these guarantees; `ours-mcp voice-status --json` reports whether transcription
+is currently configured.
 
 Managed-agent file egress is a separate trust direction. It retains the same
 metadata provenance checks, count/per-file/request byte caps, regular-file and
@@ -961,7 +984,7 @@ pass the legacy `ours-fleet spawn --monitor` flag) to record explicit persistent
 for the harness-native monitor, including supervised restarts. This does not choose the
 wake owner; use `monitor.mode: fleet|native` for that. In the standard-Codex fallback, the agent separately surfaces the
 `ours-codex` recommendation before asking to enter `foreground_monitor`. It never backgrounds
-the structured CLI watcher, because a detached process cannot wake a Codex turn. The foreground
+`ours-mcp watch`, because a detached watch cannot wake a Codex turn. The foreground
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
@@ -1045,7 +1068,7 @@ picks the most recently active session **in the role's `cwd`**. This works
 cleanly as long as each role has its own `cwd` (the common case); two roles
 sharing an identical `cwd` could have their resumes cross — give them distinct
 working directories if that matters. MCP and monitor wiring is provided by
-[`@ours.network/codex`](https://www.npmjs.com/package/@ours.network/codex);
+[`@ours.network/codex`](https://github.com/adapt-toolkit/ours-mcp/tree/main/packages/codex);
 the core ours skill discovers fleet behavior through `ours-fleet docs`.
 `ours-fleet doctor --harness codex` verifies the CLI, ours plugin, and enhanced launcher/fallback.
 
@@ -1117,7 +1140,7 @@ rollout, anchors, aliases, explicit tags, non-scalar keys, and multiple document
 produce source-positioned warnings; opt into enforcement with
 `--yaml-mode strict`. Strict mode will become the next-major default.
 
-Long-running roles may opt into bounded durable logs:
+WORKLOG rotation is enabled for roles by default with conservative built-ins:
 
 ```yaml
 worklog:
@@ -1127,8 +1150,23 @@ worklog:
 ```
 
 Rotation is conservative: a concurrent change aborts the attempt and retries at
-a later fleet lifecycle point. Archives remain in the role state directory and
-may contain the same sensitive material as `WORKLOG.md`.
+a later fleet lifecycle point. The active log retains a bounded UTF-8 tail,
+advancing to a line boundary when a complete line fits. If one logical line
+alone exceeds the tail budget, its newest suffix remains and
+`.worklog-rotation.json` explicitly records the mid-line start and omitted byte
+count. It also records SHA-256 digests for the archive and retained live bytes
+observed when the manifest is written. The complete prior inode is published
+under a collision-safe UTC name.
+`max_archives` bounds recent archives beside `WORKLOG.md`; older complete
+archives move to `WORKLOG.archives/` and are never deleted. Use `worklog: false` on a role or in
+`defaults` to opt out. Archives may contain the same sensitive material as
+`WORKLOG.md`. Rotation refuses a symlinked/non-regular live log or a symlinked
+cold-archive boundary before replacing the live path, and best-effort removes a
+duplicate link left by a detected failure while the original inode is still
+available. These are ordinary path/error safeguards, not a security boundary
+against a malicious concurrent process with the same Unix authority: intentional
+symlink swaps or archive-directory renames between checks are outside the threat
+model and require OS-level isolation from that process.
 
 Claude roles can use a credential-free loopback proxy:
 

package/dist/application/fleet-query-service.js

@@ -1,5 +1,6 @@
 import { lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { classifyActivity } from '../session/activity.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { readExitRecord, readRestartLedger } from '../runner.js';
@@ -55,6 +56,10 @@ function sessionOverall(supervisor, session, restart, monitor, isolation, proble
     if (session.reachability === 'online'
         && (session.readiness === 'running' || session.readiness === 'awaiting_permission'))
         return 'busy';
+    // `readiness: idle` alone never justifies `ready`. A steered wake turn is
+    // invisible to readiness (FLEET-002), so observed activity outranks it.
+    if (session.reachability === 'online' && session.activity.state === 'active')
+        return 'busy';
     if (session.reachability === 'online' && session.readiness === 'idle')
         return 'ready';
     if (session.reachability === 'offline'
@@ -153,6 +158,7 @@ export class FleetQueryService {
                     protocolVersion: snapshot.protocolVersion, features: snapshot.features,
                     runtimeModel: snapshot.runtimeModel, reasoningEffort: snapshot.reasoningEffort,
                     permissionMode: snapshot.permissionMode,
+                    activity: classifyActivity(snapshot.activity),
                 };
             }
             catch (error) {
@@ -164,6 +170,7 @@ export class FleetQueryService {
                         : failure === 'control-unavailable' ? 'unavailable' : 'unknown',
                     readiness: offline ? 'failed' : 'unknown',
                     evidence: 'authoritative', lastError: clean(error.message),
+                    activity: { state: 'unobservable' },
                 };
             }
         }
@@ -174,18 +181,23 @@ export class FleetQueryService {
                     backend: 'tmux', reachability: has ? 'online' : supervisor === 'stopped' ? 'offline' : 'unknown',
                     readiness: has ? 'idle' : supervisor === 'running' ? 'starting' : 'failed',
                     evidence: 'inferred',
+                    // tmux exposes no agent-side evidence at all, and `readiness: idle`
+                    // here is a pane-liveness inference, not an activity claim.
+                    activity: { state: 'unobservable' },
                 };
             }
             catch (error) {
                 return {
                     backend: 'tmux', reachability: 'unknown', readiness: 'unknown',
                     evidence: 'inferred', lastError: clean(error.message),
+                    activity: { state: 'unobservable' },
                 };
             }
         }
         return {
             backend: 'unknown', reachability: supervisor === 'stopped' ? 'offline' : 'unknown',
             readiness: supervisor === 'stopped' ? 'failed' : 'unknown', evidence: 'inferred',
+            activity: { state: 'unobservable' },
         };
     }
 }

package/dist/application/role-creation-service.js

@@ -118,7 +118,9 @@ export class RoleCreationService {
         };
         const warnings = [];
         if (request.permissions.approval === 'allow')
-            warnings.push('approval=allow maps to an elevated native permission mode');
+            warnings.push(effective.harness === 'codex' && effective.session === 'acp'
+                ? 'approval=allow maps to elevated Codex ACP agent-full-access and widens the native sandbox to danger-full-access'
+                : 'approval=allow maps to an elevated native permission mode');
         if (request.permissions.filesystem === 'unrestricted')
             warnings.push('filesystem=unrestricted grants access outside the workspace');
         if (request.permissions.unattended === 'wait')

package/dist/application/types.d.ts

@@ -72,6 +72,17 @@ export interface RoleStatus {
         runtimeModel?: SessionSnapshot['runtimeModel'];
         reasoningEffort?: SessionSnapshot['reasoningEffort'];
         permissionMode?: SessionSnapshot['permissionMode'];
+        /**
+         * Activity evidence, kept separate from `readiness` on purpose: `readiness`
+         * answers "is a fleet-tracked turn in flight" (the prompt-admission gate),
+         * NOT "is this agent working". `state` is the only field a human-facing
+         * surface may use to call a role idle or stalled.
+         */
+        activity: {
+            state: 'active' | 'quiet' | 'unobservable';
+            activeToolCalls?: number;
+            lastUpdateAt?: string;
+        };
     };
     restart: {
         circuit: 'closed' | 'open';

package/dist/briefing.js

@@ -168,6 +168,11 @@ export function generateBriefing(role, v, opts) {
         L.push('Never translate any other failure into "dead". A busy agent, an unanswered control');
         L.push('plane and a confirmed stop look identical if you only look at one command.');
         L.push('');
+        L.push('`ours-fleet status` reports `session.readiness`, which is TURN OCCUPANCY only: a mail');
+        L.push('wake delivered by steering runs a whole turn with readiness pinned at `idle`. Read the');
+        L.push('`activity:` line beside it — `active` means the role is working — and never call a role');
+        L.push('idle or stalled from `readiness=idle` alone.');
+        L.push('');
         L.push('Then judge the console content: stuck on a prompt/menu/trust dialog → answer it directly');
         L.push('with `ours-fleet send <Name> "<text>"` (or `--key <K>` for raw keys); idle with work');
         L.push('assigned → nudge; actively working → do nothing, and do not mistake a long turn for a');
@@ -178,8 +183,10 @@ export function generateBriefing(role, v, opts) {
     L.push('it survives restarts.');
     if (role.worklog) {
         L.push(`Fleet rotates it above ${role.worklog.max_kb} KiB, keeps approximately the newest ` +
-            `${role.worklog.keep_tail_kb} KiB here, and retains ${role.worklog.max_archives} archives ` +
-            'beside it. Continue writing only WORKLOG.md.');
+            `${role.worklog.keep_tail_kb} KiB here, and keeps ${role.worklog.max_archives} recent archives ` +
+            'beside it. Older complete archives move to WORKLOG.archives without deletion; ' +
+            '.worklog-rotation.json identifies the latest archive for restart provenance. ' +
+            'Continue writing only WORKLOG.md.');
     }
     L.push('', '## Routines');
     L.push(`If \`${opts.routinesPath}\` exists, re-read it at the START of every wake — before acting`);

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.18.0-nightly.6",
-  "buildId": "a6e98a19befa",
-  "commit": "9d10eff5b5b241926326894479810dbae7b026a2",
-  "dirty": true,
-  "builtAt": "2026-08-21T22:28:07.994Z",
+  "version": "0.18.1",
+  "buildId": "1f620d26f86b",
+  "commit": "3440b37a924055a4479e0e0e424c1cdd69570847",
+  "dirty": false,
+  "builtAt": "2026-08-22T12:32:39.824Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.js

@@ -25,8 +25,9 @@ import { stringify } from 'yaml';
 import { resolvedRolePlan } from './resolved-plan.js';
 import { creationBuildNote, formatProvenance, readProvenance } from './creation.js';
 import { doctor } from './doctor.js';
-import { allWarnings, analyzeFleetPermissions, formatNative } from './permissions.js';
+import { allWarnings, analyzeFleetPermissions, effectivePermissionMode, formatNative, } from './permissions.js';
 import { AI_DOCS } from './docs.js';
+import { classifyActivity, describeSessionState } from './session/activity.js';
 import { controlRequest, controlSocketPath, followControl, livenessNote, } from './session/control.js';
 import { SessionControlError } from './session/types.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
@@ -363,8 +364,14 @@ program.command('ls').description('list running fleet sessions')
                 continue;
             try {
                 const response = await controlRequest(stateDir, { command: 'status' }, 2_000);
-                if (response.ok && response.result?.alive)
-                    acp.push(`${name}: acp`);
+                const result = response.result;
+                if (response.ok && result?.alive) {
+                    // Activity, not readiness: an idle-readiness role may be running a
+                    // steered wake turn (FLEET-002), so `ls` reports what was observed.
+                    const observed = classifyActivity(result.activity);
+                    acp.push(`${name}: acp${observed.state === 'active' ? ' (working)'
+                        : observed.state === 'quiet' ? ' (no recent agent activity)' : ''}`);
+                }
             }
             catch { /* ignore stale sockets */ }
         }
@@ -505,6 +512,14 @@ program.command('status <name>').description('unit/agent state')
     else if (ledger.consecutiveImmediateFailures > 0)
         console.log(`restarts: ${ledger.consecutiveImmediateFailures} consecutive immediate `
             + `failures, next delay ${ledger.nextDelayMs}ms (${ledger.lastReason})`);
+    // A kill the supervisor never saw leaves no other trace here. Say it out
+    // loud rather than letting the absence of a failure streak read as "fine".
+    if (ledger.lastTermination?.class === 'abrupt')
+        console.log(`last termination: ABRUPT — the previous supervisor run (started `
+            + `${ledger.lastTermination.runStartedAt ?? 'unknown'}) died without an orderly exit; `
+            + `observed ${ledger.lastTermination.observedAt}`
+            + `\n  abrupt terminations recorded: ${ledger.abruptTerminations ?? 1}`
+            + `\n  cause (signal / OOM-kill): journalctl --user -u ours-fleet-agent@${name}.service`);
     const modelStatus = joinPath(agentDir(name), '.model-status');
     if (existsSync(modelStatus)) {
         try {
@@ -523,8 +538,14 @@ program.command('status <name>').description('unit/agent state')
     if (stateDir) {
         try {
             const response = await controlRequest(stateDir, { command: 'status' }, 2_000);
-            if (response.ok)
+            if (response.ok) {
+                const snapshot = response.result;
                 console.log(`session: ${JSON.stringify(response.result)}`);
+                // `readiness` is turn occupancy, never an activity claim: a steered
+                // wake turn runs to completion with readiness pinned at `idle`
+                // (FLEET-002). Say which question each field answers.
+                console.log(describeSessionState(snapshot.readiness, snapshot.activity));
+            }
         }
         catch {
             console.log('session: acp control unavailable');
@@ -635,7 +656,10 @@ function renderLoopRows(role, state, loop) {
     return Object.entries(state.loops).filter(([name]) => !loop || name === loop).map(([name, item]) => `${role}/${name} ${item.enabled && !item.operatorDisabled ? 'enabled' : 'disabled'} `
         + `${item.activeRunId ? 'running' : 'idle'} next=${item.nextDueAt} last=${item.lastOutcome ?? 'never'} `
         + `counts=${item.counts.started}/${item.counts.completed}/${item.counts.failed} `
-        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`);
+        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`
+        + (item.missedGap
+            ? ` gap=${item.missedGap.count}@${item.missedGap.fromAt}..${item.missedGap.throughAt}`
+            : ''));
 }
 cOpt(loopsCommand.command('status [role] [loop]').description('show live or stored loop state'))
     .option('--json', 'emit stable JSON')
@@ -1089,7 +1113,7 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
     .option('--coordinator <name>', 'announce target')
     .option('--model <id>', 'model id to launch on (e.g. claude-fable-5); default: launcher default')
     .option('--permission-mode <mode>', 'harness permission mode (Codex: untrusted|on-request|never; Claude: native values)')
-    .option('--approval <mode>', 'fleet permission mode: ask|auto|allow (deny is deprecated)')
+    .option('--approval <mode>', 'fleet permission mode: ask|auto|allow (Codex ACP allow selects agent-full-access; deny is deprecated)')
     .option('--filesystem <mode>', 'common filesystem intent: read-only|workspace|unrestricted')
     .option('--unattended <mode>', 'permission behavior without a console: deny|wait')
     .option('--sandbox <mode>', 'Codex sandbox: read-only|workspace-write|danger-full-access')
@@ -1161,13 +1185,17 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             console.log(`spawned ${result.lifetime} agent '${result.role}' through `
                 + `${result.caller}'s fleet proxy (state: ${result.statePath})`);
             console.log(`  ${result.harness}/${result.session}`
-                + `${result.model ? ` model=${result.model}` : ''}; `
+                + `${result.model ? ` model=${result.model}` : ''}`
+                + (result.permissionMode
+                    ? `; permission=${result.permissionMode.fleetMode} native=${result.permissionMode.nativeMode}`
+                    : '') + '; '
                 + `monitor=${result.monitor.mode} interrupt=${result.monitor.interrupt}`);
             if (result.inherited.length)
                 console.log(`  inherited omitted defaults from ${result.caller}: ${result.inherited.join(', ')}`);
             console.log(`→ watch it: ours-fleet peek ${result.role}   |   attach: ours-fleet attach ${result.role}`);
             return;
         }
+        const plannedPermissionMode = effectivePermissionMode(spawnDryRun(o).resolvedRole);
         if (o.temp) {
             const dir = await spawnTemp(o, binPath);
             console.log(`spawned temp agent '${roleName}' (state: ${dir}; gone on exit/reboot)`);
@@ -1185,6 +1213,8 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             for (const line of formatProvenance(lastProvenance))
                 console.log(line);
         }
+        console.log(`  permission=${plannedPermissionMode.fleetMode} `
+            + `native=${plannedPermissionMode.nativeMode}`);
         console.log(`→ watch it: ours-fleet peek ${roleName}   |   attach: ours-fleet attach ${roleName}`);
     }
     catch (e) {

package/dist/config.d.ts

@@ -11,6 +11,9 @@ export interface WorklogPolicy {
     keep_tail_kb: number;
     max_archives: number;
 }
+export type WorklogPolicyInput = Partial<WorklogPolicy> | false;
+/** Conservative built-in policy; `worklog: false` is the explicit opt-out. */
+export declare const DEFAULT_WORKLOG_POLICY: Readonly<WorklogPolicy>;
 export interface AuthProxyConfig {
     kind: 'anthropic';
     base_url: string;
@@ -130,10 +133,10 @@ export interface RoleConfig {
     isolation?: IsolationConfig;
     monitor?: Partial<MonitorConfig>;
     owner_channel?: OwnerChannelConfigInput;
-    worklog?: WorklogPolicy;
+    worklog?: WorklogPolicyInput;
     auth_proxy?: Partial<AuthProxyConfig>;
 }
-export interface ResolvedRole extends Omit<RoleConfig, 'model' | 'owner_channel'> {
+export interface ResolvedRole extends Omit<RoleConfig, 'model' | 'owner_channel' | 'worklog'> {
     name: string;
     harness: string;
     session: SessionBackendId;
@@ -193,7 +196,7 @@ export declare function canonicalCid(value: string): string;
 export declare function resolveOwnerChannelConfig(defaults: unknown, role: OwnerChannelConfigInput | undefined, session: SessionBackendId, file?: string, name?: string): OwnerChannelConfig | undefined;
 export declare function resolveModelChain(model: string | undefined, chain: string[] | undefined, file?: string, name?: string): string[] | undefined;
 export declare function resolveAuthProxy(defaults: unknown, role: Partial<AuthProxyConfig> | undefined, file?: string, name?: string): AuthProxyConfig | undefined;
-export declare function resolveWorklogPolicy(defaults: unknown, role: WorklogPolicy | undefined, file?: string, name?: string): WorklogPolicy | undefined;
+export declare function resolveWorklogPolicy(defaults: unknown, role: WorklogPolicyInput | undefined, file?: string, name?: string): WorklogPolicy | undefined;
 export declare function resolvePermissions(defaults: unknown, role: Partial<CommonPermissions> | undefined, file?: string, name?: string): CommonPermissions;
 /**
  * Merge `defaults.monitor` under the role's own `monitor:` key-by-key, validate the

package/dist/config.js

@@ -4,10 +4,17 @@ import { agentDir, defaultConfigPath, fleetDDir, home } from './paths.js';
 import { parseFleetDocument, } from './config-yaml.js';
 import { harnessRuntimeDir, resolveIsolation, validateIsolationConfig, } from './isolation/policy.js';
 import { getAdapter } from './harness/registry.js';
+import { resolveRoleModelEnv } from './model-env.js';
 import { resolveWatchdogs } from './watchdog/config.js';
 import { resolveLoops } from './loops/config.js';
 import { CAPABILITIES, CAP_MONITOR_INTERRUPT_AFTER_TOOL } from './capabilities.js';
 import { runningLabel } from './provenance.js';
+/** Conservative built-in policy; `worklog: false` is the explicit opt-out. */
+export const DEFAULT_WORKLOG_POLICY = Object.freeze({
+    max_kb: 1024,
+    keep_tail_kb: 256,
+    max_archives: 12,
+});
 /** The 8 content-free event types the ours daemon appends to notifications.log. */
 export const NOTIFY_EVENT_TYPES = [
     'message_received', 'file_received', 'sibling_contact_added', 'local_contact_request',
@@ -217,17 +224,23 @@ export function loadConfig(configPath, options = {}) {
             const harness = r.harness ?? defaults.harness ?? 'claude-code';
             const defaultHarness = defaults.harness ?? 'claude-code';
             const inheritsModelDefaults = harness === defaultHarness && r.model !== null;
-            const model = resolveRoleModel(r.model, r.harness, defaults);
+            if (authProxy && harness !== 'claude-code')
+                throw new ConfigError(`${file}: role '${name}' auth_proxy is supported only by claude-code`);
+            // Environment and runtime model are resolved together so `model:` and the
+            // harness's model pin can never disagree (see src/model-env.ts).
+            const modelEnv = resolveRoleModelEnv({
+                harness,
+                model: resolveRoleModel(r.model, r.harness, defaults),
+                modelWasExplicit: r.model !== undefined,
+                defaultsEnv: (defaults.env ?? {}),
+                roleEnv: r.env,
+                ...(authProxy ? { authProxyBaseUrl: authProxy.base_url } : {}),
+            }, message => new ConfigError(`${file}: role '${name}' ${message}`));
+            const env = modelEnv.env;
+            const model = modelEnv.model;
             const modelChain = resolveModelChain(model, r.model_chain ?? (inheritsModelDefaults
                 ? defaults.model_chain
                 : undefined), file, name);
-            if (authProxy && harness !== 'claude-code')
-                throw new ConfigError(`${file}: role '${name}' auth_proxy is supported only by claude-code`);
-            const env = {
-                ...(defaults.env ?? {}),
-                ...(r.env ?? {}),
-                ...(authProxy ? { ANTHROPIC_BASE_URL: authProxy.base_url } : {}),
-            };
             roles.push({
                 ...r,
                 name,
@@ -461,15 +474,16 @@ export function resolveAuthProxy(defaults, role, file = 'config', name = 'role')
     };
 }
 export function resolveWorklogPolicy(defaults, role, file = 'config', name = 'role') {
-    if (defaults === undefined && role === undefined)
+    if (role === false || (role === undefined && defaults === false))
         return undefined;
-    if (defaults !== undefined && !isPlainObject(defaults))
-        throw new ConfigError(`${file}: defaults.worklog must be a map`);
+    if (defaults !== undefined && defaults !== false && !isPlainObject(defaults))
+        throw new ConfigError(`${file}: defaults.worklog must be a map or false`);
     if (role !== undefined && !isPlainObject(role))
-        throw new ConfigError(`${file}: role '${name}' worklog must be a map`);
+        throw new ConfigError(`${file}: role '${name}' worklog must be a map or false`);
     const merged = {
-        ...(defaults ?? {}),
-        ...(role ?? {}),
+        ...DEFAULT_WORKLOG_POLICY,
+        ...(defaults === false || defaults === undefined ? {} : defaults),
+        ...(role === undefined ? {} : role),
     };
     const bad = Object.keys(merged).filter(key => !['max_kb', 'keep_tail_kb', 'max_archives'].includes(key));
     if (bad.length)