@ours.network/fleet 0.18.1 → 0.19.0-nightly.2

package/README.md

@@ -68,6 +68,8 @@ The state dir contract:
 | `.identity`, `.cwd`, `.session-id`, `.booted`, `.exit-status`, `.config-path` | supervisor | dot-marker state — session resume and boot bookkeeping |
 | `.monitor-state.json`, `.monitor-status` | supervisor monitor | atomic body-free cursor/pending state and health |
 | `.owner-channel-state.json` | owner-channel bridge | bounded wire-ID dedupe only; never message/reply plaintext |
+| `.owner-channel-message-recovery.json` | owner-channel bridge | mode-0600 body-free message claim journal: wire ID, history sequence, and claim time only |
+| `.owner-channel-attachment-recovery.json` | owner-channel bridge | mode-0600 attachment route journal; never filenames, paths, transcript text, or bytes |
 | `.owner-channel-binder.lock/`, `.owner-channel-binder.json` | owner-channel supervisor | mode-0600 role/identity + PID/start-marker ownership and release metadata; never mail plaintext or credentials |
 | `.session-events.jsonl`, `.control.sock`, `.control-token` | ACP backend | bounded typed console projection and private attachment control |
 
@@ -79,7 +81,7 @@ The state dir contract:
 | tmux | roles using `session: tmux` (the default) | `apt install tmux` / `brew install tmux` |
 | Node ≥ 22 | Claude roles using `session: acp` | required by the maintained Claude ACP adapter |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours-mcp` daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/mcp && ours-mcp start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -208,27 +210,12 @@ offline shell and no stale fleet state.
 The console provides evidence-separated inventory and status, ACP activity and
 permission controls, redacted logs, typed text send, confirmed lifecycle
 actions, transactional permanent/temporary creation, and a shared tmux browser
-terminal. Identity is fixed to the role name. Creation uses the current
-authenticated identity existence check and reports verified, missing, or
-unknown evidence; a newly launched harness follows its generated first-boot
-instructions to choose or create and bind the identity. The console never
-claims that the host created an identity and never deletes one.
-
-ACP tool diffs are normalized before they enter the durable conversation
-ledger. Small diffs retain their existing before/after representation. When an
-adapter reports an oversized whole-file snapshot, fleet stores only the changed
-region with path, operation, original byte counts, digest, and boundedness
-metadata. Each retained changed side is capped at 64 KiB as a UTF-8-safe,
-newest-content tail. The tail advances to a line boundary when a complete line
-fits. If one logical line alone exceeds the cap, fleet retains its newest
-UTF-8-safe suffix and records that it starts mid-line, together with omitted-byte
-count and digest. Paths retain at most a 4 KiB suffix with the same explicit
-size/digest/omission provenance, and a 320 KiB cap covers the complete normalized
-update. An append therefore cannot replay a large historical file while hiding
-the current appended text. The live web-console transcript projects only events
-from the current runner generation and excludes adapter `session/load` replay;
-those replay events remain in the durable ledger with `agent_replay` provenance
-for diagnosis and recovery rather than appearing as current work.
+terminal. Identity is fixed to the role name. Creation uses the authenticated
+daemon inventory and reports verified, missing, or unknown evidence. A missing
+permanent role identity is created deterministically before launch with local
+discovery and auto-accept enabled, then the provisioning lease is released so
+the harness only has to bind it. Fleet never silently replaces or force-adopts
+an existing identity.
 
 For a temporary role, those first-boot instructions preserve and bind an
 existing identity when one is present. If the assigned identity is missing,
@@ -236,8 +223,9 @@ the role capability-detects the ours MCP `create_temporary_identity` tool and
 uses it when available, so the newly created identity is owned and cleaned up
 by that connector session lifecycle. Older ours servers remain compatible via
 `create_identity`. A collision or creation error stops for operator review;
-fleet never force-adopts or deletes identity state. Permanent roles continue to
-use normal `create_identity` bootstrap behavior.
+fleet never force-adopts or deletes identity state. Permanent roles are
+provisioned by fleet before launch and never delegate normal identity creation
+to the harness.
 
 `node-pty` is optional: if its native module cannot load, ACP and all
 non-terminal features remain available and tmux Terminal is disabled with a
@@ -360,10 +348,6 @@ defaults:
   max_tokens: 500000                    # session cap (harness-interpreted)
   monitor:
     mode: fleet                         # fleet (default) | native
-  worklog:                              # built-ins shown; set false to opt out
-    max_kb: 1024                        # rotate only above this active-log size
-    keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
-    max_archives: 12                    # recent beside log; older preserved cold
 roles:
   Name:                                 # [A-Za-z0-9_-]+
     harness: claude-code
@@ -383,7 +367,7 @@ roles:
       batch_ms: 2000                    # coalesce a burst into one line (default 2000)
       inject: notification              # notification (default) | full (bodies inline; roadmap)
     owner_channel:                      # optional trusted owner ingress; requires session: acp
-      identity: "Name Owner Channel"     # existing, dedicated ours identity bound only by fleet
+      identity: "Name Owner Channel"     # dedicated identity; fleet creates it with safe local defaults
       owners: [owner-contact-cid]        # authenticated ours contact IDs, never display names
       agent: managed-agent-cid           # exact role CID allowed to relay messages/files outward
       interrupt: false                  # false queues; true cancels current work first
@@ -450,11 +434,6 @@ role's `harness_options`, so a fleet can set common Codex permission/profile def
 and override individual keys per role. `monitor` merges the same way — a role block
 overrides `defaults.monitor` key-by-key.
 
-Every supervised role is a client of the operator-configured ours daemon. Fleet
-forces `OURS_AUTOSTART=0` in both tmux and ACP harness processes, after role environment
-overlays, so `env.OURS_AUTOSTART` cannot transfer shared daemon lifecycle ownership to an
-agent. Operators and explicit installer/setup flows remain responsible for starting it.
-
 ### Scheduled agent loops
 
 Top-level `loops` schedule literal prompts from trusted local YAML. Enabled targets
@@ -545,13 +524,10 @@ native settings actually grant, against a fixed floor:
 those requests with nobody to see it. With `unattended: wait` it **warns**,
 since a human can still attach a console and answer.
 
-**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`.
-`auto` selects Codex ACP `agent` (`on-request` + `workspace-write`) / Claude
-`acceptEdits`. `allow` selects Codex ACP's fully non-interactive yolo mode,
-reported by the adapter as `agent-full-access` (`never` +
-`danger-full-access`); Claude uses `bypassPermissions`. For Codex tmux, where the
-approval and sandbox flags remain independent, `auto` is `on-request` and
-`allow` is `never` while `filesystem` still chooses the sandbox.
+**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`,
+`auto` to Codex `on-request` / Claude `acceptEdits`, and `allow` to Codex
+`never` / Claude `bypassPermissions`, the non-interactive modes that actually
+permit the actions the role was authorized to take.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
 `allow` role previously ran unable to do its job. Legacy `deny` is accepted
 only for compatibility and retains its conservative Codex `on-request` /
@@ -563,14 +539,10 @@ ACP exposes agent-specific session mode IDs and `session/set_mode`, but no
 portable permission-policy capability. Fleet uses that primitive where an
 adapter has a corresponding mode and otherwise translates at the adapter. The
 bundled Codex ACP adapter couples approval and sandboxing in its advertised
-mode IDs. Consequently, neutral `allow` selects `agent-full-access` and widens
-`filesystem: workspace` or `read-only` to `danger-full-access`; neutral `auto`
-selects `agent` and uses `workspace-write` even when the neutral filesystem
-value differs. An explicit `harness_options.sandbox` still wins and selects its
-corresponding ACP preset; explicit native approval overrides also win. Fleet
-reports a coupled-mode mismatch as approximate in `config`/`doctor`, and
-per-role `isolation:` remains the boundary for an `allow` ACP role. Live session
-metadata reports the normalized policy and the exact native mode selected.
+mode IDs, so fleet preserves the selected sandbox preset and enforces approval
+independently on the app-server turn request. Thus `allow` + `workspace` is
+actually `never` + `workspace-write`, never `danger-full-access`. Live session
+metadata reports the normalized policy and the ACP sandbox-preset ID.
 
 ### Isolation at creation time
 
@@ -672,13 +644,14 @@ agent's briefing tells it **not** to arm a native harness Monitor.
 
 With `monitor.mode: native`, ours-fleet does not start its supervisor monitor;
 the generated briefing instead instructs the harness to arm its own wake
-mechanism (`ours-mcp watch` for Claude Code, or the Codex
+mechanism (the structured `ours api watch-notifications` JSONL stream for Claude Code,
+or the Codex
 `arm_monitor`/`foreground_monitor` flow). The old `monitor.enabled: true|false`
 form remains accepted as a compatibility alias for `fleet|native`, respectively,
 but new configuration should use `mode`.
 
 `inject: full` (pushing message bodies
-inline) is on the roadmap and needs two new ours-mcp daemon endpoints; today all
+inline) is on the roadmap and needs two new daemon endpoints; today all
 roles deliver `notification` lines and drain via `get_messages`.
 
 ACP stdio remains private to the persistent runner. `send`, `peek`, and the basic
@@ -689,8 +662,10 @@ console later; no terminal UI is part of the monitor or session backend.
 ### Trusted owner channel
 
 `owner_channel` adds a second ours identity to a role without changing the
-role's normal identity. Create that dedicated identity in ours first, connect it
-to each owner/controller identity and the managed role identity, put the owners'
+role's normal identity. Fleet creates that dedicated permanent identity when it
+is missing, with local exposure and local auto-accept disabled, and releases the
+provisioning lease before the supervisor binds it. Connect it to each
+owner/controller identity and the managed role identity, put the owners'
 immutable contact CIDs in `owners`, and put the managed role identity's exact CID
 in `agent`. The channel identity must not be any role identity or another role's
 channel identity. Add it to the control plane just like another contact, then
@@ -902,22 +877,26 @@ command path sits behind the authenticated owner-CID check: a non-owner sending
 `/force-restart` or `/model` is silently ignored exactly like any other
 unauthorized mail.
 
-Processed wire IDs are durably bounded for deduplication, while
-message and response bodies stay out of fleet state. Delivery is at-least-once
-across a crash (the bridge requeues fetched input before starting a turn); true
-exactly-once processing would require a leased claim/idempotency primitive in
-ours-mcp.
+Handled wire IDs are durably bounded for deduplication, while message and
+response bodies stay out of fleet state. Before consuming mail, fleet reads the
+body-free oldest-first metadata from `listIncomingMessages`, atomically journals
+the exact wire/sequence slice (at most 200), and calls `getMessages` with that
+exact length. A returned wire/sequence set mismatch fails closed. After a crash,
+journaled bodies are loaded only from persistent history with `getHistoryItem`;
+the journal is pruned only after the existing durable owner-channel state marks
+the wire handled. This provides at-least-once turn delivery without placing
+message plaintext in fleet state.
 
 Inbound owner attachments use the same authenticated-CID and exact-wire routing
-boundary. Fleet first calls the metadata-only `list_incoming_files`, groups a
+boundary. Fleet first calls the metadata-only `listIncomingFiles`, groups a
 file-only wake or a same-sender reply-linked text caption, and checks the enabled,
 count, declared MIME, per-file size, and total-size policy before retrieving any
-bytes. It then calls selective `get_files` only for the admitted wire IDs. An
+bytes. It then calls selective `getFiles` only for the admitted wire IDs. An
 unauthorized sender is ignored without retrieval or reply. A rejected authorized
 request receives a bounded reason correlated to its file wire.
 
 Retrieved files must be regular, non-symlink paths whose byte count and SHA-256
-match ours-mcp metadata. Fleet additionally checks content signatures against the
+match typed SDK metadata. Fleet additionally checks content signatures against the
 declared MIME, sanitizes traversal/control characters from names, and copies each
 file into a random request-scoped directory at mode 0700 with files at mode 0600.
 The `[fleet-owner]` turn receives only bounded metadata, the private local paths,
@@ -928,17 +907,19 @@ the agent must use the audio path rather than inventing text.
 Request files are removed after final delivery and stale directories are removed
 after `retention_ms`. A bounded mode-0600 recovery journal stores only owner CID
 and wire routing metadata—never filenames, paths, captions, transcripts, or file
-bytes. If ours-mcp already marked a selected file processed when fleet restarts,
-fleet resumes only that journaled wire with `save_file`; a deferred managed-agent
-caption is replayed with its journaled processed files before the group is
-admitted or relayed. Conversation route state migrates from v1 to a bounded v2
+bytes. If a selected file is already read when fleet restarts, fleet resolves
+only that journaled wire with `getFileInfo` and retrieves its immutable blob with
+`fetchFile`; a claimed managed-agent caption is loaded from message history and
+rejoined with its journaled read files before the group is admitted or relayed.
+Recovered voice files remain transcript-unavailable and are never sent through
+a second transcription attempt. Conversation route state migrates from v1 to a
+bounded v2
 source-wire index so a correlated group keeps the authenticated owner selected by
-its original request even after later owner traffic. Recovered voice is explicitly
-marked transcript-unavailable. Corrupt recovery state disables attachment
-admission. The host must run an ours-mcp version whose
-`list_incoming_files`, selective `get_files`, and `save_file` schemas support
-these guarantees; `ours-mcp voice-status --json` reports whether transcription
-is currently configured.
+its original request even after later owner traffic. Corrupt recovery state disables attachment
+admission. The host must run an ours daemon compatible with SDK 2.0.1 whose
+typed incoming-file, selective retrieval, and file-fetch operations support
+these guarantees; `ours config show --json` reports `sttConfigured` without
+revealing provider credentials.
 
 Managed-agent file egress is a separate trust direction. It retains the same
 metadata provenance checks, count/per-file/request byte caps, regular-file and
@@ -984,7 +965,7 @@ pass the legacy `ours-fleet spawn --monitor` flag) to record explicit persistent
 for the harness-native monitor, including supervised restarts. This does not choose the
 wake owner; use `monitor.mode: fleet|native` for that. In the standard-Codex fallback, the agent separately surfaces the
 `ours-codex` recommendation before asking to enter `foreground_monitor`. It never backgrounds
-`ours-mcp watch`, because a detached watch cannot wake a Codex turn. The foreground
+the structured CLI watcher, because a detached process cannot wake a Codex turn. The foreground
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
@@ -1068,7 +1049,7 @@ picks the most recently active session **in the role's `cwd`**. This works
 cleanly as long as each role has its own `cwd` (the common case); two roles
 sharing an identical `cwd` could have their resumes cross — give them distinct
 working directories if that matters. MCP and monitor wiring is provided by
-[`@ours.network/codex`](https://github.com/adapt-toolkit/ours-mcp/tree/main/packages/codex);
+[`@ours.network/codex`](https://www.npmjs.com/package/@ours.network/codex);
 the core ours skill discovers fleet behavior through `ours-fleet docs`.
 `ours-fleet doctor --harness codex` verifies the CLI, ours plugin, and enhanced launcher/fallback.
 
@@ -1140,7 +1121,7 @@ rollout, anchors, aliases, explicit tags, non-scalar keys, and multiple document
 produce source-positioned warnings; opt into enforcement with
 `--yaml-mode strict`. Strict mode will become the next-major default.
 
-WORKLOG rotation is enabled for roles by default with conservative built-ins:
+Long-running roles may opt into bounded durable logs:
 
 ```yaml
 worklog:
@@ -1150,23 +1131,8 @@ worklog:
 ```
 
 Rotation is conservative: a concurrent change aborts the attempt and retries at
-a later fleet lifecycle point. The active log retains a bounded UTF-8 tail,
-advancing to a line boundary when a complete line fits. If one logical line
-alone exceeds the tail budget, its newest suffix remains and
-`.worklog-rotation.json` explicitly records the mid-line start and omitted byte
-count. It also records SHA-256 digests for the archive and retained live bytes
-observed when the manifest is written. The complete prior inode is published
-under a collision-safe UTC name.
-`max_archives` bounds recent archives beside `WORKLOG.md`; older complete
-archives move to `WORKLOG.archives/` and are never deleted. Use `worklog: false` on a role or in
-`defaults` to opt out. Archives may contain the same sensitive material as
-`WORKLOG.md`. Rotation refuses a symlinked/non-regular live log or a symlinked
-cold-archive boundary before replacing the live path, and best-effort removes a
-duplicate link left by a detected failure while the original inode is still
-available. These are ordinary path/error safeguards, not a security boundary
-against a malicious concurrent process with the same Unix authority: intentional
-symlink swaps or archive-directory renames between checks are outside the threat
-model and require OS-level isolation from that process.
+a later fleet lifecycle point. Archives remain in the role state directory and
+may contain the same sensitive material as `WORKLOG.md`.
 
 Claude roles can use a credential-free loopback proxy:
 

package/dist/application/fleet-query-service.js

@@ -1,6 +1,5 @@
 import { lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { classifyActivity } from '../session/activity.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { readExitRecord, readRestartLedger } from '../runner.js';
@@ -56,10 +55,6 @@ function sessionOverall(supervisor, session, restart, monitor, isolation, proble
     if (session.reachability === 'online'
         && (session.readiness === 'running' || session.readiness === 'awaiting_permission'))
         return 'busy';
-    // `readiness: idle` alone never justifies `ready`. A steered wake turn is
-    // invisible to readiness (FLEET-002), so observed activity outranks it.
-    if (session.reachability === 'online' && session.activity.state === 'active')
-        return 'busy';
     if (session.reachability === 'online' && session.readiness === 'idle')
         return 'ready';
     if (session.reachability === 'offline'
@@ -158,7 +153,6 @@ export class FleetQueryService {
                     protocolVersion: snapshot.protocolVersion, features: snapshot.features,
                     runtimeModel: snapshot.runtimeModel, reasoningEffort: snapshot.reasoningEffort,
                     permissionMode: snapshot.permissionMode,
-                    activity: classifyActivity(snapshot.activity),
                 };
             }
             catch (error) {
@@ -170,7 +164,6 @@ export class FleetQueryService {
                         : failure === 'control-unavailable' ? 'unavailable' : 'unknown',
                     readiness: offline ? 'failed' : 'unknown',
                     evidence: 'authoritative', lastError: clean(error.message),
-                    activity: { state: 'unobservable' },
                 };
             }
         }
@@ -181,23 +174,18 @@ export class FleetQueryService {
                     backend: 'tmux', reachability: has ? 'online' : supervisor === 'stopped' ? 'offline' : 'unknown',
                     readiness: has ? 'idle' : supervisor === 'running' ? 'starting' : 'failed',
                     evidence: 'inferred',
-                    // tmux exposes no agent-side evidence at all, and `readiness: idle`
-                    // here is a pane-liveness inference, not an activity claim.
-                    activity: { state: 'unobservable' },
                 };
             }
             catch (error) {
                 return {
                     backend: 'tmux', reachability: 'unknown', readiness: 'unknown',
                     evidence: 'inferred', lastError: clean(error.message),
-                    activity: { state: 'unobservable' },
                 };
             }
         }
         return {
             backend: 'unknown', reachability: supervisor === 'stopped' ? 'offline' : 'unknown',
             readiness: supervisor === 'stopped' ? 'failed' : 'unknown', evidence: 'inferred',
-            activity: { state: 'unobservable' },
         };
     }
 }

package/dist/application/role-creation-service.js

@@ -118,9 +118,7 @@ export class RoleCreationService {
         };
         const warnings = [];
         if (request.permissions.approval === 'allow')
-            warnings.push(effective.harness === 'codex' && effective.session === 'acp'
-                ? 'approval=allow maps to elevated Codex ACP agent-full-access and widens the native sandbox to danger-full-access'
-                : 'approval=allow maps to an elevated native permission mode');
+            warnings.push('approval=allow maps to an elevated native permission mode');
         if (request.permissions.filesystem === 'unrestricted')
             warnings.push('filesystem=unrestricted grants access outside the workspace');
         if (request.permissions.unattended === 'wait')
@@ -208,9 +206,12 @@ export class RoleCreationService {
                 throw new FleetError('stale_state', `identity '${action.roleId}' appeared after preview; review and confirm reuse`);
             }
             const creation = {
-                // Deliberately strip any mutation methods from the test seam. The web
-                // uses today's read-only daemon preflight; first-boot owns create/bind.
-                identityProvisioner: { exists: name => this.identityProvisioner.exists(name) },
+                // Permanent identity infrastructure is reconciled before launch. A
+                // temporary identity must still be created by its eventual connector
+                // session because that exact lease owns cleanup.
+                identityProvisioner: preview.effective.lifetime === 'permanent'
+                    ? this.identityProvisioner
+                    : { exists: name => this.identityProvisioner.exists(name) },
                 onStage: (stage, evidence) => this.coreStage(action, stage, evidence),
             };
             if (preview.effective.lifetime === 'permanent') {
@@ -220,7 +221,9 @@ export class RoleCreationService {
                 await spawnTemp(this.spawnOptions(preview.request, action.actionId), this.options.binPath, this.options.tempLauncher, creation);
             }
             this.stage(action, 'launched', 'launch accepted; readiness not yet confirmed');
-            this.stage(action, 'identity_bootstrap_pending', 'the harness must choose or create and bind its identity from the generated briefing');
+            this.stage(action, 'identity_bootstrap_pending', preview.effective.lifetime === 'permanent'
+                ? 'fleet established the permanent identity; the harness must bind it from the generated briefing'
+                : 'the harness must choose or create and bind its session-owned temporary identity from the generated briefing');
             this.stage(action, 'waiting_for_session');
             const ready = await this.waitForReady(action.roleId, action.session);
             if (ready === 'ready') {

package/dist/application/types.d.ts

@@ -72,17 +72,6 @@ export interface RoleStatus {
         runtimeModel?: SessionSnapshot['runtimeModel'];
         reasoningEffort?: SessionSnapshot['reasoningEffort'];
         permissionMode?: SessionSnapshot['permissionMode'];
-        /**
-         * Activity evidence, kept separate from `readiness` on purpose: `readiness`
-         * answers "is a fleet-tracked turn in flight" (the prompt-admission gate),
-         * NOT "is this agent working". `state` is the only field a human-facing
-         * surface may use to call a role idle or stalled.
-         */
-        activity: {
-            state: 'active' | 'quiet' | 'unobservable';
-            activeToolCalls?: number;
-            lastUpdateAt?: string;
-        };
     };
     restart: {
         circuit: 'closed' | 'open';

package/dist/briefing.js

@@ -59,17 +59,15 @@ export function generateBriefing(role, v, opts) {
     else if (guarantee === 'unverified') {
         L.push(`2. BIND your ours identity: call the **${v.bindTool}** tool with`);
         L.push(`   name "${id}" force=true (search the deferred tool registry first if needed).`);
-        L.push(`   - This identity was NOT verified when your role was created, so it may not exist.`);
-        L.push(`     If binding reports no such identity, call **${v.createTool}** name "${id}" once`);
-        L.push('     to mint it, then you are bound. Re-binding your OWN identity is always allowed.');
+        L.push(`   - This permanent identity was NOT verified before launch. If it does not exist, STOP`);
+        L.push('     and report the infrastructure error; identity creation belongs to the fleet lifecycle.');
     }
     else {
         L.push(`2. BIND your ours identity: call the **${v.bindTool}** tool with`);
         L.push(`   name "${id}" force=true (search the deferred tool registry first if needed).`);
         L.push(`   - It was ${guarantee === 'created' ? 'created' : 'verified to exist'} when your role`);
-        L.push('     was created, so binding should succeed. If it unexpectedly reports no such');
-        L.push(`     identity, call **${v.createTool}** name "${id}" once and report the discrepancy —`);
-        L.push('     something removed it after your role was created.');
+        L.push('     was started, so binding should succeed. If it unexpectedly reports no such identity,');
+        L.push('     STOP and report the infrastructure race; do not create or replace it yourself.');
     }
     L.push(`3. RECONCILE your profile (idempotent): call **${v.currentIdentityTool}** and read your`);
     L.push('   current bio and persona, so you only write below when they actually differ.');
@@ -168,11 +166,6 @@ export function generateBriefing(role, v, opts) {
         L.push('Never translate any other failure into "dead". A busy agent, an unanswered control');
         L.push('plane and a confirmed stop look identical if you only look at one command.');
         L.push('');
-        L.push('`ours-fleet status` reports `session.readiness`, which is TURN OCCUPANCY only: a mail');
-        L.push('wake delivered by steering runs a whole turn with readiness pinned at `idle`. Read the');
-        L.push('`activity:` line beside it — `active` means the role is working — and never call a role');
-        L.push('idle or stalled from `readiness=idle` alone.');
-        L.push('');
         L.push('Then judge the console content: stuck on a prompt/menu/trust dialog → answer it directly');
         L.push('with `ours-fleet send <Name> "<text>"` (or `--key <K>` for raw keys); idle with work');
         L.push('assigned → nudge; actively working → do nothing, and do not mistake a long turn for a');
@@ -183,10 +176,8 @@ export function generateBriefing(role, v, opts) {
     L.push('it survives restarts.');
     if (role.worklog) {
         L.push(`Fleet rotates it above ${role.worklog.max_kb} KiB, keeps approximately the newest ` +
-            `${role.worklog.keep_tail_kb} KiB here, and keeps ${role.worklog.max_archives} recent archives ` +
-            'beside it. Older complete archives move to WORKLOG.archives without deletion; ' +
-            '.worklog-rotation.json identifies the latest archive for restart provenance. ' +
-            'Continue writing only WORKLOG.md.');
+            `${role.worklog.keep_tail_kb} KiB here, and retains ${role.worklog.max_archives} archives ` +
+            'beside it. Continue writing only WORKLOG.md.');
     }
     L.push('', '## Routines');
     L.push(`If \`${opts.routinesPath}\` exists, re-read it at the START of every wake — before acting`);

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.18.1",
-  "buildId": "1f620d26f86b",
-  "commit": "3440b37a924055a4479e0e0e424c1cdd69570847",
-  "dirty": false,
-  "builtAt": "2026-08-22T12:32:39.824Z",
+  "version": "0.19.0-nightly.2",
+  "buildId": "13880d55bd06",
+  "commit": "ccf83082de238e6dc8ddb1bc557d2b7ffc7e816f",
+  "dirty": true,
+  "builtAt": "2026-08-23T08:33:08.792Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.js

@@ -25,9 +25,8 @@ import { stringify } from 'yaml';
 import { resolvedRolePlan } from './resolved-plan.js';
 import { creationBuildNote, formatProvenance, readProvenance } from './creation.js';
 import { doctor } from './doctor.js';
-import { allWarnings, analyzeFleetPermissions, effectivePermissionMode, formatNative, } from './permissions.js';
+import { allWarnings, analyzeFleetPermissions, formatNative } from './permissions.js';
 import { AI_DOCS } from './docs.js';
-import { classifyActivity, describeSessionState } from './session/activity.js';
 import { controlRequest, controlSocketPath, followControl, livenessNote, } from './session/control.js';
 import { SessionControlError } from './session/types.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
@@ -38,6 +37,7 @@ import { WebAccessStore, passwordAccess, validatePublicOrigin } from './web/acce
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
 import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
+import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
 // sudo/su shells lack XDG_RUNTIME_DIR, breaking every systemctl/journalctl
 // --user child (supervisor commands, logs, doctor). Derive it before dispatch. (#9)
 deriveXdgRuntimeDir();
@@ -364,14 +364,8 @@ program.command('ls').description('list running fleet sessions')
                 continue;
             try {
                 const response = await controlRequest(stateDir, { command: 'status' }, 2_000);
-                const result = response.result;
-                if (response.ok && result?.alive) {
-                    // Activity, not readiness: an idle-readiness role may be running a
-                    // steered wake turn (FLEET-002), so `ls` reports what was observed.
-                    const observed = classifyActivity(result.activity);
-                    acp.push(`${name}: acp${observed.state === 'active' ? ' (working)'
-                        : observed.state === 'quiet' ? ' (no recent agent activity)' : ''}`);
-                }
+                if (response.ok && response.result?.alive)
+                    acp.push(`${name}: acp`);
             }
             catch { /* ignore stale sockets */ }
         }
@@ -512,14 +506,6 @@ program.command('status <name>').description('unit/agent state')
     else if (ledger.consecutiveImmediateFailures > 0)
         console.log(`restarts: ${ledger.consecutiveImmediateFailures} consecutive immediate `
             + `failures, next delay ${ledger.nextDelayMs}ms (${ledger.lastReason})`);
-    // A kill the supervisor never saw leaves no other trace here. Say it out
-    // loud rather than letting the absence of a failure streak read as "fine".
-    if (ledger.lastTermination?.class === 'abrupt')
-        console.log(`last termination: ABRUPT — the previous supervisor run (started `
-            + `${ledger.lastTermination.runStartedAt ?? 'unknown'}) died without an orderly exit; `
-            + `observed ${ledger.lastTermination.observedAt}`
-            + `\n  abrupt terminations recorded: ${ledger.abruptTerminations ?? 1}`
-            + `\n  cause (signal / OOM-kill): journalctl --user -u ours-fleet-agent@${name}.service`);
     const modelStatus = joinPath(agentDir(name), '.model-status');
     if (existsSync(modelStatus)) {
         try {
@@ -538,14 +524,8 @@ program.command('status <name>').description('unit/agent state')
     if (stateDir) {
         try {
             const response = await controlRequest(stateDir, { command: 'status' }, 2_000);
-            if (response.ok) {
-                const snapshot = response.result;
+            if (response.ok)
                 console.log(`session: ${JSON.stringify(response.result)}`);
-                // `readiness` is turn occupancy, never an activity claim: a steered
-                // wake turn runs to completion with readiness pinned at `idle`
-                // (FLEET-002). Say which question each field answers.
-                console.log(describeSessionState(snapshot.readiness, snapshot.activity));
-            }
         }
         catch {
             console.log('session: acp control unavailable');
@@ -656,10 +636,7 @@ function renderLoopRows(role, state, loop) {
     return Object.entries(state.loops).filter(([name]) => !loop || name === loop).map(([name, item]) => `${role}/${name} ${item.enabled && !item.operatorDisabled ? 'enabled' : 'disabled'} `
         + `${item.activeRunId ? 'running' : 'idle'} next=${item.nextDueAt} last=${item.lastOutcome ?? 'never'} `
         + `counts=${item.counts.started}/${item.counts.completed}/${item.counts.failed} `
-        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`
-        + (item.missedGap
-            ? ` gap=${item.missedGap.count}@${item.missedGap.fromAt}..${item.missedGap.throughAt}`
-            : ''));
+        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`);
 }
 cOpt(loopsCommand.command('status [role] [loop]').description('show live or stored loop state'))
     .option('--json', 'emit stable JSON')
@@ -1113,7 +1090,7 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
     .option('--coordinator <name>', 'announce target')
     .option('--model <id>', 'model id to launch on (e.g. claude-fable-5); default: launcher default')
     .option('--permission-mode <mode>', 'harness permission mode (Codex: untrusted|on-request|never; Claude: native values)')
-    .option('--approval <mode>', 'fleet permission mode: ask|auto|allow (Codex ACP allow selects agent-full-access; deny is deprecated)')
+    .option('--approval <mode>', 'fleet permission mode: ask|auto|allow (deny is deprecated)')
     .option('--filesystem <mode>', 'common filesystem intent: read-only|workspace|unrestricted')
     .option('--unattended <mode>', 'permission behavior without a console: deny|wait')
     .option('--sandbox <mode>', 'Codex sandbox: read-only|workspace-write|danger-full-access')
@@ -1185,17 +1162,13 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             console.log(`spawned ${result.lifetime} agent '${result.role}' through `
                 + `${result.caller}'s fleet proxy (state: ${result.statePath})`);
             console.log(`  ${result.harness}/${result.session}`
-                + `${result.model ? ` model=${result.model}` : ''}`
-                + (result.permissionMode
-                    ? `; permission=${result.permissionMode.fleetMode} native=${result.permissionMode.nativeMode}`
-                    : '') + '; '
+                + `${result.model ? ` model=${result.model}` : ''}; `
                 + `monitor=${result.monitor.mode} interrupt=${result.monitor.interrupt}`);
             if (result.inherited.length)
                 console.log(`  inherited omitted defaults from ${result.caller}: ${result.inherited.join(', ')}`);
             console.log(`→ watch it: ours-fleet peek ${result.role}   |   attach: ours-fleet attach ${result.role}`);
             return;
         }
-        const plannedPermissionMode = effectivePermissionMode(spawnDryRun(o).resolvedRole);
         if (o.temp) {
             const dir = await spawnTemp(o, binPath);
             console.log(`spawned temp agent '${roleName}' (state: ${dir}; gone on exit/reboot)`);
@@ -1213,8 +1186,6 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             for (const line of formatProvenance(lastProvenance))
                 console.log(line);
         }
-        console.log(`  permission=${plannedPermissionMode.fleetMode} `
-            + `native=${plannedPermissionMode.nativeMode}`);
         console.log(`→ watch it: ours-fleet peek ${roleName}   |   attach: ours-fleet attach ${roleName}`);
     }
     catch (e) {
@@ -1433,6 +1404,10 @@ function configureWebAccess(opts) {
             + 'or --pairing for protection, or --no-password only for intentional unprotected access');
     return undefined;
 }
+// ── rooms & tasks ──────────────────────────────────────────────────────────
+registerTemplateCommands(program, cOpt);
+registerTaskCommands(program, cOpt);
+registerRoomCommands(program, cOpt);
 program.command('_run <name>', { hidden: true }).description('internal: supervisor entrypoint')
     .option('-c, --configuration <file>')
     .action(async (name, opts) => {