@ours.network/fleet 0.19.0-nightly.1 → 0.19.0-nightly.11

package/dist/rooms-tasks/terminal.d.ts

@@ -0,0 +1,23 @@
+import { type RoomCloseDeps } from './close.js';
+import type { CoworkAdapter } from './cowork-adapter.js';
+import type { TaskOutcome, TaskRecord, TaskTerminalIntent } from './types.js';
+export interface TaskTerminalInput {
+    taskId: string;
+    kind: TaskTerminalIntent['kind'];
+    roomId?: string;
+    outcome?: TaskOutcome;
+}
+/** Persist first-wins terminal intent before any acknowledgement or close effect. */
+export declare function acceptTaskTerminalIntent(input: TaskTerminalInput): Promise<TaskRecord>;
+export interface SettleTaskTerminalDeps {
+    roomClose?: RoomCloseDeps;
+    afterRoomClosed?(): void | Promise<void>;
+}
+/** Close the recorded room, then atomically settle the persisted task intent. */
+export declare function settleTaskTerminalIntent(input: {
+    taskId: string;
+    cowork: Pick<CoworkAdapter, 'closeRoom'>;
+    deps?: SettleTaskTerminalDeps;
+}): Promise<TaskRecord>;
+/** Persist failure to launch an external settle worker under the same task lock. */
+export declare function recordTaskTerminalIntentError(taskId: string, error: string, recoveryHint: string): Promise<TaskRecord>;

package/dist/rooms-tasks/terminal.js

@@ -0,0 +1,53 @@
+import { join } from 'node:path';
+import { withFileLock } from '../atomic-file.js';
+import { stateRoot } from '../paths.js';
+import { closeManagedRoom } from './close.js';
+import { beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
+const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
+function taskOperationLockPath(taskId) {
+    return join(stateRoot(), 'locks', 'task-terminal', encodeURIComponent(taskId));
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Persist first-wins terminal intent before any acknowledgement or close effect. */
+export function acceptTaskTerminalIntent(input) {
+    return withFileLock(taskOperationLockPath(input.taskId), () => {
+        const accepted = beginTaskTerminalIntent(input.taskId, input);
+        if (!input.roomId)
+            return finishTaskTerminalIntent(input.taskId);
+        return accepted;
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+/** Close the recorded room, then atomically settle the persisted task intent. */
+export function settleTaskTerminalIntent(input) {
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const current = getTask(input.taskId);
+        const intent = current.terminal_intent;
+        if (!intent)
+            throw new Error(`task ${input.taskId} has no accepted terminal intent`);
+        if (intent.status === 'settled')
+            return current;
+        try {
+            if (intent.room_id) {
+                const room = await closeManagedRoom({
+                    roomId: intent.room_id,
+                    cowork: input.cowork,
+                    deps: input.deps?.roomClose,
+                });
+                if (room.state !== 'closed')
+                    throw new Error(`room ${intent.room_id} did not close`);
+                await input.deps?.afterRoomClosed?.();
+            }
+            return finishTaskTerminalIntent(input.taskId);
+        }
+        catch (error) {
+            setTaskTerminalIntentError(input.taskId, errorText(error), `Retry 'ours-fleet task recover ${input.taskId}'.`);
+            throw error;
+        }
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+/** Persist failure to launch an external settle worker under the same task lock. */
+export function recordTaskTerminalIntentError(taskId, error, recoveryHint) {
+    return withFileLock(taskOperationLockPath(taskId), () => setTaskTerminalIntentError(taskId, error, recoveryHint), {}, TASK_OPERATION_LOCK_STALE_MS);
+}

package/dist/rooms-tasks/types.d.ts

@@ -0,0 +1,260 @@
+/**
+ * Rooms & Tasks domain types for ours-fleet.
+ *
+ * Task and Room are Fleet orchestration records. Cowork owns room content,
+ * membership, and archive. Messenger Server owns owner presentation.
+ * Fleet stores only IDs, CIDs, orchestration state, and saga cursors.
+ */
+export type TaskState = 'backlog' | 'provisioning' | 'active' | 'review' | 'done' | 'cancelled' | 'failed';
+export declare const TASK_TERMINAL_STATES: readonly TaskState[];
+export declare const TASK_CANCELLABLE_STATES: readonly TaskState[];
+export interface TaskBlocked {
+    reason: string;
+    at: string;
+}
+export interface TaskTemplateRef {
+    name: string;
+    version: number;
+    content_hash: string;
+}
+export interface TaskMemberRole {
+    name: string;
+    identity_cid: string;
+    slot: string;
+    cowork_role: string;
+}
+export interface TaskOrigin {
+    type: 'cli' | 'owner_channel';
+    owner_cid?: string;
+}
+export interface TaskOutcome {
+    summary: string;
+    artifacts?: string[];
+}
+export interface TaskTerminalIntent {
+    kind: 'done' | 'cancelled';
+    status: 'pending' | 'settled';
+    room_id?: string;
+    outcome?: TaskOutcome;
+    accepted_at: string;
+    settled_at?: string;
+    error?: string;
+    error_at?: string;
+    recovery_hint?: string;
+    first_failure?: string;
+    first_recovery_hint?: string;
+}
+export interface TaskRecord {
+    task_id: string;
+    title: string;
+    brief?: string;
+    brief_file?: string;
+    state: TaskState;
+    blocked?: TaskBlocked;
+    template?: TaskTemplateRef;
+    no_room?: boolean;
+    room_id?: string;
+    room_identity_cid?: string;
+    member_roles: TaskMemberRole[];
+    origin: TaskOrigin;
+    idempotency_key: string;
+    created_at: string;
+    started_at?: string;
+    ended_at?: string;
+    outcome?: TaskOutcome;
+    terminal_intent?: TaskTerminalIntent;
+}
+export type RoomOrchestrationState = 'provisioning' | 'active' | 'closing' | 'closed';
+export type SagaPhase = 'persist_intent' | 'create_room' | 'attach_owner' | 'create_members' | 'configure_briefings' | 'join_role_groups' | 'wait_seats' | 'launch_work' | 'wait_briefing_acks' | 'activate' | 'completed' | 'failed';
+export interface SagaCursor {
+    phase: SagaPhase;
+    step_index: number;
+    error?: string;
+    recovery_hint?: string;
+}
+export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'waiting_briefing_delivery' | 'waiting_briefing_acks' | 'briefing_delivery_failed' | 'uncertain';
+export interface RoomRoleBriefingDefinition {
+    role: string;
+    text: string;
+    sha256: string;
+    version?: number;
+    state: 'pending' | 'configured' | 'failed';
+    attempts: number;
+    updated_at: string;
+    last_error?: string;
+}
+export interface RoomMemberLaunchState {
+    state: 'pending' | 'intent' | 'launched' | 'stopped' | 'failed';
+    attempt: number;
+    action_id?: string;
+    mission_sha256?: string;
+    launch_id?: string;
+    updated_at: string;
+    error?: string;
+}
+export interface RoomMemberBriefingState {
+    role: string;
+    state: 'pending' | 'relay_queued' | 'relay_failed' | 'acknowledged';
+    message_id?: string;
+    relay_intent_record_id?: string;
+    relay_result_record_id?: string;
+    relay_wire_id?: string;
+    checked_at?: string;
+    acknowledged_at?: string;
+    acknowledgement_message_id?: string;
+    acknowledgement_seq?: number;
+    rejected_ack_count: number;
+    last_rejected_ack_reason?: string;
+    last_rejected_ack_seq?: number;
+    last_processed_seq?: number;
+}
+export type RoomHistoryEvidence = {
+    kind: 'message';
+    seq: number;
+    record_id: string;
+    at: string;
+    message_id: string;
+    category: 'role_briefing' | 'chat';
+    author: {
+        identity: string;
+        display_name: string;
+        role: string;
+    };
+    text: string;
+    recipient_identities: string[];
+    briefing_role?: string;
+    briefing_version?: number;
+} | {
+    kind: 'relay_intent';
+    seq: number;
+    record_id: string;
+    at: string;
+    message_id: string;
+    recipient_identity: string;
+} | {
+    kind: 'relay_result';
+    seq: number;
+    record_id: string;
+    at: string;
+    intent_record_id: string;
+    message_id: string;
+    recipient_identity: string;
+    status: 'queued' | 'send_failed' | 'skipped_removed';
+    wire_id?: string;
+};
+export type MemberRetirementPhase = 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
+export interface MemberRetirement {
+    phase: MemberRetirementPhase;
+    launch_id: string;
+    updated_at: string;
+    archive_path?: string;
+}
+export type RoomClosePhase = 'retire_members' | 'close_cowork' | 'completed';
+export interface RoomCloseCursor {
+    phase: RoomClosePhase;
+    accepted_at: string;
+    error?: string;
+    error_at?: string;
+    recovery_hint?: string;
+    first_failure?: string;
+    first_recovery_hint?: string;
+}
+export interface RoomMemberSeat {
+    role_name: string;
+    identity_cid: string;
+    slot: string;
+    cowork_role: string;
+    seat_state: 'pending' | 'active' | 'removed';
+    launch?: RoomMemberLaunchState;
+    briefing?: RoomMemberBriefingState;
+    retirement?: MemberRetirement;
+}
+export interface RoomOrchestrationRecord {
+    room_id: string;
+    room_identity_cid?: string;
+    room_name: string;
+    goal?: string;
+    task_id?: string;
+    template_snapshot?: TemplateSnapshot;
+    saga: SagaCursor;
+    provisioning_detail?: ProvisioningDetail;
+    owner_seat_cid?: string;
+    owner_invite_fingerprint?: string;
+    role_briefings?: Record<string, RoomRoleBriefingDefinition>;
+    history_cursor?: number;
+    member_seats: RoomMemberSeat[];
+    state: RoomOrchestrationState;
+    created_at: string;
+    activated_at?: string;
+    closed_at?: string;
+    close?: RoomCloseCursor;
+}
+export interface TemplateMemberSlot {
+    slot: string;
+    role: string;
+    count: number;
+    role_ref: string;
+    overrides?: TemplateRoleOverrides;
+}
+export interface TemplateRoleOverrides {
+    harness?: string;
+    model?: string;
+    model_chain?: string[];
+    permissions?: Record<string, unknown>;
+    isolation?: Record<string, unknown>;
+    cwd?: string;
+    env?: Record<string, string>;
+    persona?: string;
+    mission?: string;
+}
+export interface TemplateRoomConfig {
+    quiet_membership?: boolean;
+    anonymous?: boolean;
+}
+export interface TemplateDefinition {
+    name: string;
+    version: number;
+    description: string;
+    builtin?: boolean;
+    room?: TemplateRoomConfig;
+    contract?: string;
+    members: TemplateMemberSlot[];
+}
+export interface TemplateSnapshot extends TemplateDefinition {
+    content_hash: string;
+}
+export interface RoomsOwnerConfig {
+    provider: string;
+    public_invite?: string;
+    public_invite_file?: string;
+    expected_cid: string;
+    role: string;
+}
+export interface RoomsCoworkConfig {
+    config?: string;
+}
+export interface RoomsDefaults {
+    template?: string;
+    attach_owner?: boolean;
+    close_when_task_done?: boolean;
+}
+export interface RoomsConfig {
+    cowork?: RoomsCoworkConfig;
+    owner: RoomsOwnerConfig;
+    defaults?: RoomsDefaults;
+}
+export interface TasksConfig {
+    default_room_template?: string;
+    create_mode?: 'start' | 'backlog';
+    close_room_on_done?: boolean;
+    retain_completed_for?: string;
+}
+export type RoomTemplatesConfig = Record<string, TemplateDefinition>;
+export declare const ROOMS_KEYS: readonly ["cowork", "owner", "defaults"];
+export declare const ROOMS_OWNER_KEYS: readonly ["provider", "public_invite", "public_invite_file", "expected_cid", "role"];
+export declare const ROOMS_COWORK_KEYS: readonly ["config"];
+export declare const ROOMS_DEFAULTS_KEYS: readonly ["template", "attach_owner", "close_when_task_done"];
+export declare const TASKS_KEYS: readonly ["default_room_template", "create_mode", "close_room_on_done", "retain_completed_for"];
+export declare const TEMPLATE_KEYS: readonly ["version", "description", "room", "contract", "members", "override_builtin"];
+export declare const TEMPLATE_MEMBER_KEYS: readonly ["slot", "role", "count", "role_ref", "overrides"];
+export declare const TEMPLATE_OVERRIDE_KEYS: readonly ["harness", "model", "model_chain", "permissions", "isolation", "cwd", "env", "persona", "mission"];

package/dist/rooms-tasks/types.js

@@ -0,0 +1,20 @@
+/**
+ * Rooms & Tasks domain types for ours-fleet.
+ *
+ * Task and Room are Fleet orchestration records. Cowork owns room content,
+ * membership, and archive. Messenger Server owns owner presentation.
+ * Fleet stores only IDs, CIDs, orchestration state, and saga cursors.
+ */
+export const TASK_TERMINAL_STATES = ['done', 'cancelled', 'failed'];
+export const TASK_CANCELLABLE_STATES = ['backlog', 'provisioning', 'active', 'review'];
+// ── Validation keys ─────────────────────────────────────────────────────
+export const ROOMS_KEYS = ['cowork', 'owner', 'defaults'];
+export const ROOMS_OWNER_KEYS = ['provider', 'public_invite', 'public_invite_file', 'expected_cid', 'role'];
+export const ROOMS_COWORK_KEYS = ['config'];
+export const ROOMS_DEFAULTS_KEYS = ['template', 'attach_owner', 'close_when_task_done'];
+export const TASKS_KEYS = ['default_room_template', 'create_mode', 'close_room_on_done', 'retain_completed_for'];
+export const TEMPLATE_KEYS = ['version', 'description', 'room', 'contract', 'members', 'override_builtin'];
+export const TEMPLATE_MEMBER_KEYS = ['slot', 'role', 'count', 'role_ref', 'overrides'];
+export const TEMPLATE_OVERRIDE_KEYS = [
+    'harness', 'model', 'model_chain', 'permissions', 'isolation', 'cwd', 'env', 'persona', 'mission',
+];

package/dist/spawn.d.ts

@@ -1,5 +1,5 @@
 import type { IsolationConfig } from './isolation/types.js';
-import { type ApprovalMode, type FilesystemMode, type ResolvedRole, type RoleConfig, type MonitorConfig, type SessionBackendId, type UnattendedMode } from './config.js';
+import { type ApprovalMode, type FilesystemMode, type ResolvedRole, type RoleConfig, type MonitorConfig, type SessionBackendId, type UnattendedMode, type RoomStartupGate } from './config.js';
 import { type OpsDeps } from './ops.js';
 import { type CreationDeps, type CreationProvenance } from './creation.js';
 import './harness/claude-code.js';
@@ -46,6 +46,8 @@ export interface SpawnOpts {
     creationActionId?: string;
     /** Set only by a live role supervisor after a role-scoped proxy request. */
     callerRole?: string;
+    /** Trusted Fleet-internal gate for a Cowork room member; not a CLI/config surface. */
+    roomStartupGate?: RoomStartupGate;
     /** Internal provenance labels for values filled by the caller's supervisor. */
     inheritedFromCaller?: string[];
     /**

package/dist/spawn.js

@@ -429,6 +429,7 @@ async function spawnTempInner(o, binPath, launch, tx, guarantee, onStage) {
         worklog: resolveWorklogPolicy(cfg.defaults.worklog, fromOpts.worklog),
         auth_proxy: resolveAuthProxy(cfg.defaults.auth_proxy, fromOpts.auth_proxy),
         sourceFile: '(temp)',
+        roomStartupGate: o.roomStartupGate,
     };
     role.env = {
         ...(cfg.defaults.env ?? {}),

package/dist/temp-lifecycle.d.ts

@@ -46,11 +46,24 @@ export declare function markTempSupervisorActive(dir: string, pid?: number): Pro
 export declare function requestedTempStopReason(dir: string): 'operator-stop' | undefined;
 /** Move retired state out of the live roster without deleting any evidence. */
 export declare function archiveTempState(role: string, reason: TempTerminationReason, outcome: TempTerminationRecord['outcome'], detail: string, now?: Date): string | undefined;
-interface TempLifecycleDeps {
+/** Resolve only an exact role+launch archive; names and timestamps are never proof. */
+export declare function tempArchiveForLaunch(role: string, launchId: string): string | undefined;
+/** Resolve one terminated archive by exact role + durable creation action. */
+export declare function tempArchiveForCreationAction(role: string, creationActionId: string): {
+    path: string;
+    launchId: string;
+} | undefined;
+/**
+ * Preserve a definitively stopped launch as recovery evidence, or prove that
+ * its supervisor already did so. Never creates a second archive.
+ */
+export declare function secureStoppedTempArchive(role: string, launchId: string, deps?: TempLifecycleDeps): Promise<string>;
+export interface TempLifecycleDeps {
     exec?: Exec;
     now?(): number;
     kill?(pid: number, signal: NodeJS.Signals | 0): void;
     log?(line: string): void;
+    sleep?(ms: number): Promise<void>;
 }
 export declare function tempSupervisorLiveness(dir: string, deps?: TempLifecycleDeps): Promise<'running' | 'stopped' | 'unknown'>;
 export declare function stopTempSupervisor(role: string, deps?: TempLifecycleDeps): Promise<'stopped' | 'already-stopped'>;
@@ -59,4 +72,3 @@ export declare function stopTempSupervisor(role: string, deps?: TempLifecycleDep
  * Unknown/legacy/live entries are preserved; absence of proof is never cleanup authority.
  */
 export declare function reclaimStaleTempState(deps?: TempLifecycleDeps): Promise<string[]>;
-export {};

package/dist/temp-lifecycle.js

@@ -191,6 +191,96 @@ export function archiveTempState(role, reason, outcome, detail, now = new Date()
     }
     return paths.target;
 }
+function isArchiveForLaunch(path, role, launchId) {
+    const supervisor = readTempSupervisor(path);
+    if (supervisor?.role !== role || supervisor.launchId !== launchId)
+        return false;
+    try {
+        return readFileSync(join(path, TEMP_TERMINATION_FILE), 'utf8')
+            .split('\n')
+            .filter(Boolean)
+            .some(line => {
+            const record = JSON.parse(line);
+            return record.version === 1 && record.role === role && record.launchId === launchId;
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve only an exact role+launch archive; names and timestamps are never proof. */
+export function tempArchiveForLaunch(role, launchId) {
+    let entries;
+    try {
+        entries = readdirSync(archiveRoot(), { withFileTypes: true })
+            .filter(entry => entry.isDirectory() && !entry.isSymbolicLink() && !entry.name.startsWith('.'))
+            .map(entry => join(archiveRoot(), entry.name));
+    }
+    catch {
+        return undefined;
+    }
+    const matches = entries.filter(path => isArchiveForLaunch(path, role, launchId));
+    if (matches.length > 1) {
+        throw new Error(`temporary role '${role}' launch ${launchId} has ${matches.length} recovery archives; refusing ambiguity`);
+    }
+    return matches[0];
+}
+/** Resolve one terminated archive by exact role + durable creation action. */
+export function tempArchiveForCreationAction(role, creationActionId) {
+    let entries;
+    try {
+        entries = readdirSync(archiveRoot(), { withFileTypes: true })
+            .filter(entry => entry.isDirectory() && !entry.isSymbolicLink() && !entry.name.startsWith('.'))
+            .map(entry => join(archiveRoot(), entry.name));
+    }
+    catch {
+        return undefined;
+    }
+    const matches = entries.flatMap(path => {
+        const supervisor = readTempSupervisor(path);
+        if (!supervisor || supervisor.role !== role || !isArchiveForLaunch(path, role, supervisor.launchId))
+            return [];
+        try {
+            const provenance = JSON.parse(readFileSync(join(path, 'creation.json'), 'utf8'));
+            return provenance.role === role && provenance.creationActionId === creationActionId
+                ? [{ path, launchId: supervisor.launchId }] : [];
+        }
+        catch {
+            return [];
+        }
+    });
+    if (matches.length > 1) {
+        throw new Error(`temporary role '${role}' action ${creationActionId} has ${matches.length} recovery archives; refusing ambiguity`);
+    }
+    return matches[0];
+}
+/**
+ * Preserve a definitively stopped launch as recovery evidence, or prove that
+ * its supervisor already did so. Never creates a second archive.
+ */
+export async function secureStoppedTempArchive(role, launchId, deps = {}) {
+    const dir = join(tmpRoot(), role);
+    if (existsSync(dir)) {
+        const supervisor = readTempSupervisor(dir);
+        if (!supervisor || supervisor.role !== role || supervisor.launchId !== launchId) {
+            throw new Error(`temporary role '${role}' no longer matches recorded launch ${launchId}; refusing to archive`);
+        }
+        const live = await tempSupervisorLiveness(dir, deps);
+        if (live !== 'stopped') {
+            throw new Error(`temporary role '${role}' supervisor is ${live}; refusing to archive before proven stop`);
+        }
+        const archived = archiveTempState(role, 'operator-stop', 'retired', 'room close proved the supervisor stopped; full role evidence preserved');
+        if (!archived || !isArchiveForLaunch(archived, role, launchId)) {
+            throw new Error(`temporary role '${role}' archive could not be verified for launch ${launchId}`);
+        }
+        return archived;
+    }
+    const archived = tempArchiveForLaunch(role, launchId);
+    if (!archived) {
+        throw new Error(`temporary role '${role}' live state disappeared without an exact recovery archive for launch ${launchId}`);
+    }
+    return archived;
+}
 /** Finish bounded archive renames interrupted by process or host termination. */
 function recoverInterruptedArchives(now) {
     let names;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.19.0-nightly.1",
+  "version": "0.19.0-nightly.11",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",