@ours.network/fleet 0.18.1 → 0.19.0-nightly.2

package/dist/harness/codex.js

@@ -5,7 +5,7 @@ import { agentDir, home } from '../paths.js';
 import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { resolveBundledAcpAgent, } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
 const OPTION_KEYS = [
     'launcher', 'sandbox', 'approval', 'permission_mode', 'search', 'profile', 'config', 'add_dirs',
     'monitor',
@@ -51,7 +51,9 @@ function sandboxMode(role) {
         throw new Error(`invalid harness_options.sandbox "${s}"; allowed: ${SANDBOX_MODES.join(', ')}`);
     return s;
 }
-function modeForSandbox(sandbox) {
+/** codex-acp exposes the same sandbox postures as named ACP agent modes. */
+function acpAgentMode(role) {
+    const sandbox = sandboxMode(role);
     if (sandbox === 'read-only')
         return 'read-only';
     if (sandbox === 'workspace-write')
@@ -60,26 +62,6 @@ function modeForSandbox(sandbox) {
         return 'agent-full-access';
     return undefined;
 }
-/**
- * Resolve the coupled Codex ACP mode.
- *
- * The portable approval contract owns the default mode selection: `allow`
- * means the adapter's fully non-interactive yolo preset and `auto` means its
- * ordinary agent preset. This intentionally means that Codex ACP cannot retain
- * an independent neutral filesystem posture for those two modes. An explicit
- * native sandbox remains authoritative and selects its corresponding preset.
- */
-function acpAgentMode(role) {
-    const explicitSandbox = role.harness_options?.sandbox;
-    if (explicitSandbox != null)
-        return modeForSandbox(sandboxMode(role));
-    if (role.permissions?.approval === 'allow')
-        return 'agent-full-access';
-    if (role.permissions?.approval === 'auto')
-        return 'agent';
-    const sandbox = sandboxMode(role);
-    return modeForSandbox(sandbox);
-}
 function acpModePermissions(mode) {
     if (mode === 'read-only')
         return { approval: 'on-request', sandbox: 'read-only' };
@@ -87,10 +69,6 @@ function acpModePermissions(mode) {
         return { approval: 'never', sandbox: 'danger-full-access' };
     return { approval: 'on-request', sandbox: 'workspace-write' };
 }
-/** The sandbox Codex will actually receive from the selected coupled ACP mode. */
-function acpRuntimeSandbox(role) {
-    return acpModePermissions(acpAgentMode(role)).sandbox;
-}
 function fleetModeForApproval(nativeMode) {
     if (nativeMode === 'never')
         return 'allow';
@@ -124,18 +102,6 @@ function launcherMode(role) {
 function bundledCodexAcp() {
     return resolveBundledAcpAgent(CODEX_ACP_PACKAGE, 'codex-acp', 'codex-acp');
 }
-/** Bind launch argv and metadata provenance to one already-completed resolution. */
-export function codexAcpLaunchForResolution(resolution) {
-    const permissionMetadataSource = resolution.bundled
-        && resolution.version === BUNDLED_CODEX_ACP_VERSION
-        && resolution.manifestPath !== undefined
-        ? 'codex-acp'
-        : undefined;
-    return {
-        argv: [...resolution.argv],
-        ...(permissionMetadataSource ? { permissionMetadataSource } : {}),
-    };
-}
 function canOverrideBundledAcpApproval() {
     const resolution = bundledCodexAcp();
     return resolution.bundled && resolution.version === BUNDLED_CODEX_ACP_VERSION
@@ -181,7 +147,7 @@ function codexAcpEnvironment(role, dirs) {
     return {
         CODEX_PATH: command,
         [CODEX_PROXY_APPROVAL_ENV]: approvalPolicy(role) ?? 'on-request',
-        [CODEX_PROXY_SANDBOX_ENV]: acpRuntimeSandbox(role),
+        [CODEX_PROXY_SANDBOX_ENV]: sandboxMode(role) ?? 'workspace-write',
         [CODEX_PROXY_MANIFEST_ENV]: resolution.manifestPath,
         ...(process.env.CODEX_PATH ? { [CODEX_PROXY_REAL_PATH_ENV]: process.env.CODEX_PATH } : {}),
     };
@@ -319,16 +285,7 @@ export function makeCodexAdapter(exec = realExec) {
             if (requested === 'ours-codex' && !hasOursCodex)
                 throw new Error('harness_options.launcher is ours-codex, but ours-codex is not on PATH; install @ours.network/codex or use launcher: auto');
             const command = requested === 'codex' ? 'codex' : hasOursCodex ? 'ours-codex' : 'codex';
-            return {
-                argv: [],
-                // OURS_BIND_IDENTITY is the connector's startup bind seed — see the note in
-                // claude-code.ts's prepareSession. It belongs on EVERY harness that runs a
-                // role with an ours identity, not just claude-code: a seed that works on one
-                // harness and silently does nothing on the other is the same class of defect
-                // as a config key that only works on one session type.
-                env: { OURS_BIND_IDENTITY: role.identity, ...codexAcpEnvironment(role, dirs) },
-                command,
-            };
+            return { argv: [], env: codexAcpEnvironment(role, dirs), command };
         },
         buildLaunch(role, mode, _s, prep) {
             const stateDir = roleStateDir(role);
@@ -342,30 +299,17 @@ export function makeCodexAdapter(exec = realExec) {
         },
         buildAcpLaunch(role, prep) {
             const configured = role.session_options?.acp?.command;
-            // Resolve once: both argv and permission-metadata provenance must describe
-            // the same artifact. A bare PATH fallback is launchable for compatibility,
-            // but is never authenticated for protected-MCP auto-approval.
-            const resolved = configured == null
-                ? codexAcpLaunchForResolution(bundledCodexAcp())
-                : undefined;
             const argv = Array.isArray(configured)
                 ? [...configured]
                 : typeof configured === 'string'
                     ? ['sh', '-c', configured]
-                    : resolved.argv;
+                    : bundledAcpAgent(CODEX_ACP_PACKAGE, 'codex-acp', 'codex-acp');
             const initialMode = acpAgentMode(role);
             return {
                 argv,
                 env: initialMode ? { ...prep.env, INITIAL_AGENT_MODE: initialMode } : prep.env,
-                ...(resolved?.permissionMetadataSource
-                    ? { permissionMetadataSource: resolved.permissionMetadataSource } : {}),
             };
         },
-        // INITIAL_AGENT_MODE covers session/new in codex-acp; session/set_mode
-        // keeps resumed/loaded sessions and live status on the identical mode.
-        acpPermissionModeId(role) {
-            return acpAgentMode(role);
-        },
         isolationPaths(role, _dirs) {
             const codexHome = join(home(), '.codex');
             const profile = role.harness_options?.profile;
@@ -418,9 +362,7 @@ export function makeCodexAdapter(exec = realExec) {
                 const mode = acpAgentMode(role) ?? 'agent';
                 const configured = role.session_options?.acp?.command;
                 const overrideAvailable = configured == null && canOverrideBundledAcpApproval();
-                const actual = overrideAvailable
-                    ? { approval, sandbox: acpRuntimeSandbox(role) }
-                    : acpModePermissions(mode);
+                const actual = overrideAvailable ? { approval, sandbox } : acpModePermissions(mode);
                 const exact = actual.approval === approval && actual.sandbox === sandbox;
                 return {
                     ...translated,
@@ -430,9 +372,10 @@ export function makeCodexAdapter(exec = realExec) {
                             ? `custom ACP command cannot be verified against approval=${approval} sandbox=${sandbox}; `
                                 + `its '${mode}' mode is conservatively treated as approval=${actual.approval} `
                                 + `sandbox=${actual.sandbox}`
-                            : `Codex ACP mode '${mode}' couples approval and filesystem as `
-                                + `approval=${actual.approval} sandbox=${actual.sandbox}; this does not exactly `
-                                + `represent approval=${approval} sandbox=${sandbox}`],
+                            : `codex-acp mode '${mode}' actually uses approval=${actual.approval} `
+                                + `sandbox=${actual.sandbox}, and the bundled ${BUNDLED_CODEX_ACP_VERSION} `
+                                + `app-server override is unavailable; this does not exactly represent `
+                                + `approval=${approval} sandbox=${sandbox}`],
                     capabilities: codexCapabilities(actual.approval, actual.sandbox),
                 };
             }
@@ -468,7 +411,6 @@ export function makeCodexAdapter(exec = realExec) {
             currentIdentityTool: 'current_identity',
             sendTool: 'send_message',
             getMessagesTool: 'get_messages',
-            watchCommand: id => `ours-mcp watch "${id}"`,
             monitorInstruction: (id, configuredRole) => {
                 const consented = configuredRole?.harness_options?.monitor === true;
                 const consent = consented

package/dist/harness/types.d.ts

@@ -1,4 +1,3 @@
-import type { McpServer } from '@agentclientprotocol/sdk';
 import type { CommonPermissions, FleetPermissionMode, ResolvedRole } from '../config.js';
 export interface PrereqCheck {
     name: string;
@@ -22,39 +21,14 @@ export interface SessionPrep {
     env: Record<string, string>;
     /** Optional launcher selected after runtime prerequisite probing. */
     command?: string;
-    /**
-     * The settings overlay prepareSession wrote, if it wrote one.
-     *
-     * The tmux launch delivers this as `--settings <path>` in `argv`; an ACP agent
-     * takes no flags, so it needs the PATH rather than the flag. Recorded here so
-     * the two deliveries read one value instead of each re-deriving the filename.
-     */
-    settingsOverlay?: string;
-    /**
-     * The MCP config file prepareSession wrote for `harness_options.mcp_servers`,
-     * if the role declared any. Same reason as `settingsOverlay`: the tmux launch
-     * passes the file, the ACP launch has to send the servers themselves.
-     */
-    mcpConfigFile?: string;
 }
-/**
- * One MCP server as ACP's `session/new` declares it.
- *
- * ⚠ THE PROTOCOL'S OWN TYPE, DELIBERATELY NOT A LOCAL RESTATEMENT. `mcpServers`
- * goes onto the wire unchanged, so a hand-written near-copy would compile while
- * being subtly wrong — `env` and `headers` are REQUIRED arrays, and the stdio
- * variant is the one with no `type` field at all. Aliasing it also keeps
- * `session/new`'s response type inferable, which a structural stand-in silently
- * broke (every field of the result degraded to `unknown`).
- */
-export type AcpMcpServer = McpServer;
 export interface Launch {
     argv: string[];
     env: Record<string, string>;
 }
-export interface AcpLaunch extends Launch {
-    /** Metadata vocabulary authenticated by the exact ACP artifact in argv. */
-    permissionMetadataSource?: 'codex-acp';
+export interface AcpLaunch {
+    argv: string[];
+    env: Record<string, string>;
 }
 /**
  * The result of expressing neutral `permissions:` in a harness's own terms.
@@ -93,7 +67,6 @@ export interface BriefingVocab {
     currentIdentityTool: string;
     sendTool: string;
     getMessagesTool: string;
-    watchCommand(identity: string): string;
     monitorInstruction(identity: string, role?: ResolvedRole): string;
     /** Wake-source wording for a role whose monitor is supervisor-owned (monitor.mode=fleet). */
     supervisedWakeNote(identity: string, role?: ResolvedRole): string;
@@ -122,13 +95,7 @@ export interface HarnessAdapter {
     id: string;
     supportsResume: boolean;
     checkPrereqs(): Promise<PrereqReport>;
-    /**
-     * `role` is the SESSION-AWARE half: some harness options can only be honoured
-     * on some session types, and an option that is silently dropped is worse than
-     * one that is refused. Optional so an adapter that has nothing session-specific
-     * to say keeps its one-argument implementation.
-     */
-    validateOptions(opts: unknown, role?: ResolvedRole): ValidationError[];
+    validateOptions(opts: unknown): ValidationError[];
     prepareSession(role: ResolvedRole, dirs: RoleDirs): Promise<SessionPrep>;
     buildLaunch(role: ResolvedRole, mode: 'fresh' | 'resume', s: SessionState, prep: SessionPrep): Launch;
     buildAcpLaunch?(role: ResolvedRole, prep: SessionPrep): AcpLaunch;
@@ -138,23 +105,6 @@ export interface HarnessAdapter {
      * agent's default. Omit for a harness whose ACP agent has no modes.
      */
     acpPermissionModeId?(role: ResolvedRole): string | undefined;
-    /**
-     * The MCP servers this role declares, for the `mcpServers` array of ACP's
-     * `session/new` / `resume` / `load`. Empty (or omitted) leaves the agent's own
-     * configuration alone, which is what fleet has always sent.
-     */
-    acpMcpServers?(role: ResolvedRole): AcpMcpServer[];
-    /**
-     * Agent-specific `_meta` for `session/new` — how a capability the CLI takes as
-     * a flag reaches an ACP agent that accepts no flags.
-     *
-     * ⚠ THIS IS A PER-AGENT VOCABULARY, NOT PROTOCOL. `_meta` is free-form in ACP,
-     * so what an adapter puts here is only honoured by the agent it was written
-     * for. An adapter must therefore return nothing for an ACP command it did not
-     * choose, and the options that depend on it must be refused at validation for
-     * such a role rather than sent and silently ignored.
-     */
-    acpSessionMeta?(role: ResolvedRole, prep: SessionPrep): Record<string, unknown> | undefined;
     /** Effective portable policy and harness-native approval mode after native overrides win. */
     effectivePermissionMode?(role: ResolvedRole): {
         fleetMode: FleetPermissionMode;

package/dist/loops/manager.d.ts

@@ -68,32 +68,8 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
     private armAbandon;
     private finish;
     private advance;
-    /**
-     * Coalesce a backlog into one skip. The counters alone say how many
-     * occurrences were lost but never when or for how long, so the window is
-     * recorded too and carried on the state until a run is actually told about it
-     * — a dropped pass has to stay visible to the next one, not just to whoever
-     * was reading the log at the time.
-     */
     private skipMissed;
-    /**
-     * Restart is not, by itself, a reason to lose an occurrence a running manager
-     * would still have run. `poll` tolerates lateness up to one full interval and
-     * runs the tick late; this path used to drop anything already due however
-     * recently, so a role restarted seconds after its own tick came due lost it
-     * outright. For an oversight role that is precisely the pass which would have
-     * recorded why it restarted, so the failure erased its own witness.
-     *
-     * The tolerance is the only thing shared with `poll`. A backlog at least one
-     * interval deep is still coalesced into a single skip and never replayed —
-     * after a long outage exactly one occurrence survives, and `schedule` then
-     * arms it through the ordinary path rather than firing a burst here.
-     *
-     * Running the survivor late cannot outpace the configured cadence: `advance`
-     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
-     * time, so a loop that keeps restarting still runs at most once per interval.
-     */
-    private skipRestartBacklog;
+    private skipRestartMisses;
     /**
      * A run the store could not record is dropped, not retried: the cursor has
      * already moved, so this can never become a busy loop, and the outage is
@@ -110,10 +86,5 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
      * until the process was restarted.
      */
     private recover;
-    /**
-     * The envelope is the only channel a scheduled pass has for learning about
-     * the passes that did not happen. A gap stated here is what lets an oversight
-     * role report its own outage instead of resuming as if nothing was missed.
-     */
     private envelope;
 }

package/dist/loops/manager.js

@@ -39,7 +39,7 @@ export class ScheduledLoopManager {
     }
     start() {
         if (!this.store.fresh)
-            this.skipRestartBacklog();
+            this.skipRestartMisses();
         this.schedule();
     }
     async stop() {
@@ -143,15 +143,10 @@ export class ScheduledLoopManager {
     async attempt(definition, state, scheduledAt) {
         const runId = `sl_${randomUUID()}`;
         const origin = { kind: 'scheduled-loop', loop: definition.name, runId };
-        // The gap is read here and cleared only if the turn is actually admitted:
-        // an attempt that ends `skipped_busy` or `unavailable` reported it to
-        // nobody, so it has to still be there for the attempt that succeeds.
-        const gap = state.missedGap;
-        const prompt = this.envelope(definition, runId, scheduledAt, gap);
+        const prompt = this.envelope(definition, runId, scheduledAt);
         let claimed = false;
         const result = await this.arbiter.tryScheduled(prompt, origin, () => {
             claimed = true;
-            state.missedGap = null;
             state.activeRunId = runId;
             state.lastRunId = runId;
             state.lastStartedAt = new Date(this.deps.now()).toISOString();
@@ -270,15 +265,7 @@ export class ScheduledLoopManager {
         state.nextScheduledAt = new Date(next).toISOString();
         state.nextDueAt = new Date(next + deterministicJitter(this.role, definition.name, next, definition.jitterMs)).toISOString();
     }
-    /**
-     * Coalesce a backlog into one skip. The counters alone say how many
-     * occurrences were lost but never when or for how long, so the window is
-     * recorded too and carried on the state until a run is actually told about it
-     * — a dropped pass has to stay visible to the next one, not just to whoever
-     * was reading the log at the time.
-     */
     skipMissed(definition, state, now) {
-        const from = state.nextScheduledAt;
         let missed = 0;
         while (Date.parse(state.nextDueAt) <= now) {
             this.advance(definition, state);
@@ -288,43 +275,14 @@ export class ScheduledLoopManager {
         state.counts.skippedMissed = increment(state.counts.skippedMissed, missed);
         state.lastOutcome = 'skipped_missed';
         state.lastFinishedAt = new Date(now).toISOString();
-        // Successive outages before any run lands merge into one gap: the earliest
-        // start wins, so the window always spans the whole silence.
-        const previous = state.missedGap;
-        state.missedGap = {
-            count: increment(previous?.count ?? 0, missed),
-            fromAt: previous?.fromAt ?? from,
-            throughAt: state.lastScheduledAt ?? from,
-            detectedAt: new Date(now).toISOString(),
-        };
         this.store.persist();
-        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed} `
-            + `gap=${from}..${state.missedGap.throughAt} `
-            + `unreported=${state.missedGap.count}`);
+        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed}`);
     }
-    /**
-     * Restart is not, by itself, a reason to lose an occurrence a running manager
-     * would still have run. `poll` tolerates lateness up to one full interval and
-     * runs the tick late; this path used to drop anything already due however
-     * recently, so a role restarted seconds after its own tick came due lost it
-     * outright. For an oversight role that is precisely the pass which would have
-     * recorded why it restarted, so the failure erased its own witness.
-     *
-     * The tolerance is the only thing shared with `poll`. A backlog at least one
-     * interval deep is still coalesced into a single skip and never replayed —
-     * after a long outage exactly one occurrence survives, and `schedule` then
-     * arms it through the ordinary path rather than firing a burst here.
-     *
-     * Running the survivor late cannot outpace the configured cadence: `advance`
-     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
-     * time, so a loop that keeps restarting still runs at most once per interval.
-     */
-    skipRestartBacklog() {
+    skipRestartMisses() {
         const now = this.deps.now();
         for (const definition of this.definitions.values()) {
             const state = this.store.state.loops[definition.name];
-            if (definition.enabled && !state.operatorDisabled
-                && now >= Date.parse(state.nextDueAt) + definition.intervalMs)
+            if (definition.enabled && !state.operatorDisabled && Date.parse(state.nextDueAt) <= now)
                 this.skipMissed(definition, state, now);
         }
     }
@@ -382,38 +340,17 @@ export class ScheduledLoopManager {
             this.deps.clearTimer(this.timer);
         this.arm(backoffMs(this.pollFailures));
     }
-    /**
-     * The envelope is the only channel a scheduled pass has for learning about
-     * the passes that did not happen. A gap stated here is what lets an oversight
-     * role report its own outage instead of resuming as if nothing was missed.
-     */
-    envelope(definition, runId, scheduledAt, gap) {
-        const lateBy = Math.max(0, this.deps.now() - scheduledAt);
+    envelope(definition, runId, scheduledAt) {
         return [
             '[fleet-loop]',
             `loop: ${definition.name}`,
             `run: ${runId}`,
             `scheduled_at: ${new Date(scheduledAt).toISOString()}`,
-            ...(lateBy > 0 ? [`started_late_by_ms: ${lateBy}`] : []),
-            ...(gap ? [
-                `missed_occurrences: ${gap.count}`,
-                `missed_window: ${gap.fromAt}..${gap.throughAt}`,
-                `missed_gap_ms: ${Math.max(0, Date.parse(gap.detectedAt) - Date.parse(gap.fromAt))}`,
-            ] : []),
             'origin: local-trusted-config',
             '',
             'This is a scheduled internal maintenance turn, not an owner message and not ordinary ours mail.',
             'Perform one bounded pass. Do not wait for the next tick. Do not report to an owner unless your',
             'configured policy and an existing authenticated proactive-report route authorize a material report.',
-            // Same single route as the owner-request prompt, and for the same reason.
-            'To send a file, call ours `send_file` with the recipient and the path — to your owner-channel',
-            'identity if this role has one, otherwise directly to the contact who should receive it.',
-            'A file written anywhere else is not delivered and nothing will report that it was not.',
-            ...(gap ? ['',
-                'This loop did not run for the window above: those occurrences were coalesced away while the role',
-                'was unavailable, and this pass is the first since. Treat the gap as part of what you are reporting',
-                'on — it is the record of your own outage, and no later pass will be told about it.',
-            ] : []),
             '',
             definition.prompt,
         ].join('\n');

package/dist/loops/state.d.ts

@@ -8,29 +8,11 @@ export interface LoopCounts {
     skippedBusy: number;
     skippedMissed: number;
 }
-/**
- * A coalesced run of occurrences that were never submitted, held until a run
- * actually starts and can be told about it. Without it a dropped occurrence
- * survives only as a counter, which says how many were lost but never when or
- * for how long — and an oversight role cannot report an outage it cannot date.
- */
-export interface LoopMissedGap {
-    /** Occurrences coalesced away, summed across every skip since the last run. */
-    count: number;
-    /** Nominal time of the earliest occurrence in the gap. */
-    fromAt: string;
-    /** Nominal time of the latest occurrence in the gap. */
-    throughAt: string;
-    /** When the manager noticed — the end of the outage, not of the last skip. */
-    detectedAt: string;
-}
 export interface LoopRuntimeState {
     definitionHash: string;
     promptHash: string;
     enabled: boolean;
     operatorDisabled: boolean;
-    /** Unreported gap, cleared by the first run that carries it. */
-    missedGap: LoopMissedGap | null;
     nextScheduledAt: string;
     nextDueAt: string;
     lastScheduledAt: string | null;

package/dist/loops/state.js

@@ -100,9 +100,6 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
-                    // A file written before this field existed restores as undefined; an
-                    // unreported gap is absent, not lost, so normalize rather than trust.
-                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -122,7 +119,6 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
-                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/monitor.js

@@ -42,7 +42,7 @@ class AuthError extends Error {
 }
 /** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
 const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
-/** Match ours-mcp's env integer semantics: parseInt, invalid → absent. */
+/** Preserve the daemon's legacy env integer semantics: parseInt, invalid → absent. */
 function envInt(env, name) {
     const raw = env[name];
     if (raw === undefined)

package/dist/ops.d.ts

@@ -1,6 +1,7 @@
 import type { FleetConfig, ResolvedRole } from './config.js';
 import type { InstallOutcome as BackendInstallOutcome, SupervisorBackend } from './supervisor/types.js';
 import { type Exec } from './exec.js';
+import { type IdentityProvisioner } from './creation.js';
 /** An install outcome tagged with the role it belongs to. */
 export interface InstallOutcome extends BackendInstallOutcome {
     role: string;
@@ -14,6 +15,8 @@ export interface OpsDeps {
     /** Test seam for exact detached-supervisor signaling/liveness. */
     kill?(pid: number, signal: NodeJS.Signals | 0): void;
     sleep?(ms: number): Promise<void>;
+    /** Permanent identity reconciliation seam; temporary roles never use this lifecycle. */
+    identityProvisioner?: IdentityProvisioner;
     /**
      * Called the INSTANT a registration is created, before anything else can
      * fail. A creation transaction that learns about registrations only from

package/dist/ops.js

@@ -8,6 +8,7 @@ import { generateBriefing } from './briefing.js';
 import { resetRestartLedger } from './runner.js';
 import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
+import { daemonIdentityProvisioner, reconcilePermanentRoleIdentities, } from './creation.js';
 // Launch staggering now lives at the harness-launch point (the runner's start
 // gate, driven by `start_stagger_ms`), so it covers systemd host-boot too — not
 // just the `up`/`restart` command loop below. The old in-loop FLEET_START_STAGGER
@@ -16,7 +17,7 @@ import { realExec } from './exec.js';
 /** Materialize a role's state dir from config: briefing + markers. Returns the dir. */
 export function applyRole(role, opts = {}) {
     const adapter = getAdapter(role.harness);
-    const errs = adapter.validateOptions(role.harness_options, role);
+    const errs = adapter.validateOptions(role.harness_options);
     if (errs.length)
         throw new Error(`role '${role.name}': ` + errs.map(e => `${e.path}: ${e.message}`).join('; '));
     const dir = agentDir(role.name, opts.temp === true);
@@ -54,7 +55,8 @@ function selectRoles(cfg, names) {
 export async function up(cfg, names, deps, configPath, identityGuarantee) {
     const outcomes = [];
     for (const role of selectRoles(cfg, names)) {
-        const dir = applyRole(role, { configPath, identityGuarantee });
+        const guarantee = await reconcilePermanentRoleIdentities(role, deps.identityProvisioner ?? daemonIdentityProvisioner(), deps.log, identityGuarantee);
+        const dir = applyRole(role, { configPath, identityGuarantee: guarantee });
         // Only a *definite* stop boots fresh so the role reads the briefing we just
         // wrote. A running, restarting, or unprobeable role keeps its context —
         // guessing "stopped" from an unanswered probe silently discards a live
@@ -221,7 +223,10 @@ export async function down(cfg, names, deps) {
 /** Re-sync from config + bounce. mode 'keep' resumes context; 'fresh' wipes it. */
 export async function restartRoles(cfg, names, deps, mode, configPath) {
     for (const role of selectRoles(cfg, names)) {
-        const dir = applyRole(role, { fresh: mode === 'fresh', configPath });
+        const guarantee = await reconcilePermanentRoleIdentities(role, deps.identityProvisioner ?? daemonIdentityProvisioner(), deps.log);
+        const dir = applyRole(role, {
+            fresh: mode === 'fresh', configPath, identityGuarantee: guarantee,
+        });
         resetRestartLedger(dir); // explicit restart closes the circuit
         await deps.backend.restart(role.name);
         deps.log(mode === 'fresh'

package/dist/owner-channel/attachments.d.ts

@@ -1,4 +1,6 @@
+import { type FileHandle } from 'node:fs/promises';
 import type { OwnerAttachmentConfig } from '../config.js';
+import type { OursIncomingFile, OursRetrievedFiles } from './ours-client.js';
 export interface AttachmentReplyRef {
     wire_id: string;
     sentence?: number;
@@ -42,8 +44,14 @@ export interface AdmittedAttachment {
     kind: 'file' | 'voice_message';
     transcription?: Omit<VoiceTranscription, 'audioPath'>;
 }
-export declare function parseIncomingAttachments(raw: unknown): IncomingAttachment[];
-export declare function parseRetrievedAttachments(raw: unknown, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
+/**
+ * Admit the daemon's file listing. The rows are typed now, but every field is
+ * still re-validated here: sender CID, wire id, sizes and ids all cross the
+ * trust boundary and decide routing, so a daemon-side shape change must drop a
+ * row rather than produce a half-built attachment.
+ */
+export declare function parseIncomingAttachments(raw: OursIncomingFile[] | undefined): IncomingAttachment[];
+export declare function parseRetrievedAttachments(raw: OursRetrievedFiles | undefined, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
 export declare function validateAttachmentSelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
 /**
  * Managed-agent -> owner egress limits. This intentionally does not consult
@@ -54,6 +62,21 @@ export declare function prepareAttachmentDirectory(root: string, requestId: stri
 export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig, options?: {
     mimePolicy?: 'strict' | 'report-only';
 }): Promise<AdmittedAttachment[]>;
+/** Injectable short-write seam, so partial writes are provably handled. */
+export interface AttachmentWriteDeps {
+    write?(handle: FileHandle, bytes: Uint8Array, offset: number): Promise<number>;
+}
+/**
+ * Land crash-recovered file bytes inside an already-prepared request directory.
+ *
+ * The MCP path handed the daemon a `dest_path` and let its connector write the
+ * file. Nothing writes on our behalf any more, so this owns both halves of that
+ * contract: the destination is DERIVED from a validated wire id inside `dir`
+ * rather than accepted from a caller, and the file is published by link-after-
+ * fsync, so a crash or a short write can never leave a partial file where the
+ * admission step would read it as complete.
+ */
+export declare function writeRecoveredAttachment(dir: string, wireId: string, bytes: Uint8Array, deps?: AttachmentWriteDeps): Promise<string>;
 export declare function recoveredAttachment(file: IncomingAttachment, path: string): Promise<RetrievedAttachment>;
 export declare function removeRequestDirectory(path: string): Promise<void>;
 export declare function cleanupAttachmentRoot(root: string, now: number, retentionMs: number, limit?: number): Promise<number>;