@ours.network/fleet 0.5.0 → 0.5.1

package/LICENSE

@@ -6,7 +6,7 @@ FSL-1.1-Apache-2.0
 
 ## Notice
 
-Copyright 2026 ours.network contributors
+Copyright 2026 Adapt Framework Solutions Ltd
 
 ## Terms and Conditions
 

package/README.md

@@ -1,6 +1,6 @@
 # ours-fleet
 
-**Run a fleet of persistent, identity-bound AI agents — across different agent
+**Run a fleet of persistent, securely isolated, identity-bound AI agents — across different agent
 harnesses — from one declarative file.**
 
 ## What is this?
@@ -178,12 +178,51 @@ roles:
       # mem_palace: false                      # claude-code: disable memory plugin
       # permission_mode: dontAsk               # claude-code: launch permission mode —
       #   one of default | acceptEdits | plan | dontAsk | bypassPermissions
+    isolation:                          # OS-level sandbox (additive; omit = today's behavior)
+      backend: auto                     # auto | bubblewrap | podman | none   (default auto)
+      on_unavailable: warn              # warn (un-isolated + marker) | strict (refuse)   (default warn)
+      network: broker                   # broker | deny | allow | allowlist   (default broker)
+      fs: { read: [/opt/toolchains], write: [] }   # extra binds (state dir + cwd always included)
+      resources: { mem: 2G, cpu: "1.5", pids: 512 }
+      secrets: ["/host/tok:/run/secrets/tok"]      # host:container, mounted read-only
 ```
 
 Merge order: `fleet.yaml` ← `fleet.d/*.yaml`; a duplicate role name is a hard
 error naming both files. Identities and roles are decoupled — removing a role
 never deletes an identity.
 
+## Agent isolation
+
+Each role can be sandboxed at the environment level via an `isolation:` block —
+**fully additive: a role with no block behaves exactly as before.** The agent's
+tmux-pane process is wrapped in [bubblewrap](https://github.com/containers/bubblewrap)
+(rootless, no setuid), resource-limited by `systemd-run --user --scope`.
+
+An empty `isolation: {}` gives a sensible default posture: filesystem-confined to
+the state dir + `cwd`, the ours key store / other agents' state / `~/.ssh` / `~/.aws`
+all invisible, ours messaging still works, no hard resource caps.
+
+- **`backend`** — `auto` (bubblewrap if usable, else degrade per `on_unavailable`),
+  or force `bubblewrap` / `none`. (`podman` is planned.)
+- **`on_unavailable`** — `warn` (default, fail-open: run un-isolated, log, and drop a
+  `.isolation-degraded` marker in the state dir) or `strict` (fail closed: refuse to launch).
+- **`network`** — `broker` (default; ours messaging works), `deny` (no network),
+  `allow` (unrestricted), `allowlist` (planned). *Current status:* `deny` fully
+  unshares the network; `broker` keeps host networking so the loopback ours daemon
+  stays reachable — full broker egress-hardening is a follow-up.
+- **`fs.read` / `fs.write`** — extra read-only / read-write binds on top of the durable set.
+- **`resources`** — `mem` (→ `MemoryMax` + `MemorySwapMax=0`, a hard OOM bound),
+  `cpu` cores (→ `CPUQuota`), `pids` (→ `TasksMax`). CPU degrades to a warning if the
+  cpu cgroup controller isn't delegated (mem/pids still enforced).
+- **`secrets`** — `host:container` pairs, mounted read-only; the only way host files
+  enter the sandbox.
+
+`ours-fleet doctor` reports bubblewrap availability, cgroup delegation, and each
+role's effective isolation; `ours-fleet config` prints a per-role isolation summary.
+Isolation composes with `model`, `permission_mode`, and `ROUTINES.md`. See
+[SECURITY.md](SECURITY.md#agent-isolation-sandboxing) for the threat model and the
+rootless prerequisites.
+
 ## Development
 
 ```sh
@@ -202,8 +241,33 @@ software built by a small independent team, running the broker and relay service
 at their own cost. If this is useful to you, please consider chipping in:
 **→ https://github.com/adapt-toolkit/ours-donate**
 
-## License
+## Licence, status & warranty
+
+> **Alpha software.** ours-fleet is part of **ours.network**, which is early,
+> experimental, **alpha-stage** software. It is under active development, its
+> behaviour and interfaces may change without notice, and it is **not
+> production-ready**.
+
+> **No warranty / not security-audited.** ours.network has **not** been
+> independently security-audited. It is provided **"as is", without warranty of
+> any kind**, and you use it **at your own risk**. See [`LICENSE`](LICENSE) and
+> [`SECURITY.md`](SECURITY.md).
+
+**ours.network** is owned and licensed by **Adapt Framework Solutions Ltd**. It
+is released under the **Functional Source License, Version 1.1
+([FSL-1.1-Apache-2.0](LICENSE))** — **source-available, not open source** during
+the FSL period. Each release **converts to Apache 2.0 two years after it is
+published**.
+
+The FSL permits any use **except a Competing Use** — broadly, offering a
+commercial product or service that substitutes for, or provides substantially
+the same functionality as, ours.network. Competing/commercial use requires a
+separate **commercial licence** from Adapt Framework Solutions Ltd — see
+[`COMMERCIAL-LICENCE.md`](COMMERCIAL-LICENCE.md) (contact:
+**license@adaptframework.solutions**).
+
+ours.network builds on Adapt Framework Solutions Ltd's own FSL-licensed core (the
+`@adapt-toolkit` packages); **Adapt itself is not part of this release** and is
+licensed separately.
 
-[FSL-1.1-Apache-2.0](LICENSE) — Functional Source License, converting to
-Apache-2.0 two years after each release. Free for any use except offering a
-competing product or service. Copyright 2026 ours.network contributors.
+Copyright 2026 Adapt Framework Solutions Ltd.

package/dist/cli.js

@@ -56,6 +56,16 @@ cOpt(program.command('config').description('validate + print the merged plan (no
                 console.log(`    mission:     ${r.mission.split('\n')[0]}`);
             if (r.oversee?.length)
                 console.log(`    oversees:    ${r.oversee.map(o => `${o.role}@${o.interval}`).join(', ')}`);
+            if (r.isolation) {
+                const iso = r.isolation;
+                const caps = [
+                    iso.resources?.mem && `mem=${iso.resources.mem}`,
+                    iso.resources?.cpu && `cpu=${iso.resources.cpu}`,
+                    iso.resources?.pids !== undefined && `pids=${iso.resources.pids}`,
+                ].filter(Boolean).join(',') || 'none';
+                console.log(`    isolation:   backend=${iso.backend ?? 'auto'} net=${iso.network ?? 'broker'} `
+                    + `on_unavailable=${iso.on_unavailable ?? 'warn'} caps=${caps}`);
+            }
         }
     }
     catch (e) {

package/dist/doctor.js

@@ -1,7 +1,24 @@
 import { userInfo } from 'node:os';
+import { readFileSync } from 'node:fs';
 import { realExec } from './exec.js';
 import { loadConfig } from './config.js';
 import { getAdapter } from './harness/registry.js';
+import { agentDir, home } from './paths.js';
+import { resolveIsolation } from './isolation/policy.js';
+import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
+/** Which cgroup-v2 controllers are delegated to this user manager (advisory). */
+function cgroupDelegationDetail() {
+    try {
+        const uid = process.getuid?.() ?? 0;
+        const c = readFileSync(`/sys/fs/cgroup/user.slice/user-${uid}.slice/cgroup.controllers`, 'utf8').split(/\s+/);
+        const has = (n) => (c.includes(n) ? 'yes' : 'no');
+        return `memory=${has('memory')} pids=${has('pids')} cpu=${has('cpu')}` +
+            (c.includes('cpu') ? '' : ' — cpu caps degrade to a warning (one-time: Delegate=cpu)');
+    }
+    catch {
+        return 'unknown (not cgroup-v2 or no delegation info)';
+    }
+}
 /** Host-level + per-harness prerequisite report with actionable messages. */
 export async function doctor(opts = {}, exec = realExec, platform = process.platform) {
     const checks = [];
@@ -37,9 +54,47 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 : `not enabled — run: ours-fleet init (or: sudo loginctl enable-linger ${user})`,
         });
     }
+    // Isolation reporting (AC-9). Backend availability is advisory — isolation is
+    // opt-in per role (OQ-1), so a missing bwrap must not fail doctor for fleets that
+    // don't use it. Only a role that DECLARES isolation and cannot get it under
+    // `strict` is a hard failure.
+    const roles = loadConfigSafe(opts.configPath);
+    const bw = await makeBubblewrapBackend(exec).available();
+    checks.push({
+        name: 'isolation: bubblewrap', ok: true,
+        detail: bw.ok
+            ? `available — ${bw.detail}`
+            : `not available: ${bw.detail} (only needed for roles declaring isolation:)`,
+    });
+    if (platform === 'linux')
+        checks.push({ name: 'isolation: cgroup delegation', ok: true, detail: cgroupDelegationDetail() });
+    for (const r of roles.filter(r => r.isolation)) {
+        const stateDir = agentDir(r.name);
+        const policy = resolveIsolation(r.isolation, { stateDir, runCwd: r.cwd ?? stateDir, home: home() });
+        const caps = [
+            policy.resources.mem && `mem=${policy.resources.mem}`,
+            policy.resources.cpu && `cpu=${policy.resources.cpu}`,
+            policy.resources.pids !== undefined && `pids=${policy.resources.pids}`,
+        ].filter(Boolean).join(',') || 'none';
+        const wantsBwrap = policy.backend === 'auto' || policy.backend === 'bubblewrap';
+        let ok = true, detail;
+        if (policy.backend === 'none')
+            detail = 'backend=none (explicitly un-sandboxed)';
+        else if (wantsBwrap && bw.ok)
+            detail = `backend=bubblewrap net=${policy.network} caps=${caps}`;
+        else if (wantsBwrap && policy.onUnavailable === 'strict') {
+            ok = false;
+            detail = 'WILL REFUSE to launch (strict): bubblewrap unavailable';
+        }
+        else if (wantsBwrap)
+            detail = `degraded->un-isolated (warn): bubblewrap unavailable; caps=${caps} still apply`;
+        else
+            detail = `backend=${policy.backend} (not yet implemented)`;
+        checks.push({ name: `isolation: ${r.name}`, ok, detail });
+    }
     const harnesses = opts.harness
         ? [opts.harness]
-        : [...new Set(loadConfigSafe(opts.configPath).map(r => r.harness))];
+        : [...new Set(roles.map(r => r.harness))];
     for (const h of harnesses) {
         try {
             const rep = await getAdapter(h).checkPrereqs();

package/dist/runner.js

@@ -75,10 +75,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         const ctx = { stateDir: dir, runCwd, home: home() };
         const policy = resolveIsolation(role.isolation, ctx);
         const sel = await selectIsolationBackend(policy, deps.exec); // throws on strict + unavailable
-        if (sel.degraded)
+        const degradedMarker = join(dir, '.isolation-degraded');
+        if (sel.degraded) {
             deps.log(`[${name}] WARNING isolation requested but unavailable -> running UN-ISOLATED: ${sel.detail}`);
-        else
+            writeFileSync(degradedMarker, `${new Date().toISOString()} ${sel.detail}\n`);
+        }
+        else {
             deps.log(`[${name}] isolation: ${sel.backend.id} (net=${policy.network}) ${sel.detail}`);
+            rmSync(degradedMarker, { force: true });
+        }
         paneArgv = sel.backend.wrap(launch.argv, policy, ctx);
         // Resource caps wrap the sandbox from OUTSIDE, at the pane's own cgroup scope
         // (§5.4). Applies even when the sandbox degraded to none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux consoles, systemd/launchd supervision, ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",