@ours.network/fleet 1.0.5 → 1.1.0-nightly.10

package/README.md

@@ -8,8 +8,8 @@ harnesses — from one declarative file.**
 An AI coding agent in a terminal dies when you close the laptop. `ours-fleet`
 turns such sessions into **roles**: long-lived agents that
 
-- **run through a selectable session backend** — existing detached tmux consoles
-  or structured ACP sessions — which you can attach to, peek at, or prompt,
+- **run through structured ACP sessions** behind a shared Codex/Claude Code
+  agent-session interface, which you can inspect or prompt,
 - are **supervised** — systemd (Linux) or launchd (macOS) restarts them on crash
   and brings them back after a reboot,
 - **resume their context** across restarts (when the harness supports it),
@@ -19,10 +19,10 @@ turns such sessions into **roles**: long-lived agents that
 - can **spawn subagents** (permanent or temporary) and **oversee** them: peek into
   a ward's console, answer a stuck prompt, nudge it back to work.
 
-The whole fleet is described in one hand-written `~/fleet.yaml`
-("docker-compose for agents"): who exists, what harness they run in, their mission,
-persona, bio, working directory, and who oversees whom. `ours-fleet up` makes
-reality match the file.
+The fleet uses a v2 manifest plus typed documents: `~/fleet.yaml` holds
+fleet-wide operational policy and automation, while `~/fleet/agents`,
+`~/fleet/roles`, and `~/fleet/brains` hold bare Agent, Role, and Brain documents.
+`ours-fleet up` makes reality match that trusted split source set.
 
 **Harness-agnostic by design.** The core never assumes a specific agent CLI; each
 harness is a small adapter (how to launch, how to resume, how to wire config).
@@ -31,21 +31,22 @@ public — each additional harness (Gemini CLI, OpenCode, …) is a small adapte
 A single fleet can mix harnesses per role:
 
 ```yaml
-roles:
-  Reviewer:                 # runs in Claude Code
-    harness: claude-code
-  Prototyper:                # runs in Codex CLI
-    harness: codex
+# ~/fleet/agents/Reviewer.yaml
+role: { ref: reviewer }
+brain: { inline: { harness: claude-code, session: acp } }
+
+# ~/fleet/agents/Prototyper.yaml
+role: { inline: { mission: Build prototypes } }
+brain: { inline: { harness: codex, session: acp } }
 ```
 
 ## How it works
 
 ```
-~/fleet.yaml + ~/fleet.d/*.yaml           your declaration
+~/fleet.yaml + ~/fleet/{agents,roles,brains,room_templates}/*.yaml   your declaration
         │  ours-fleet up
         ▼
-briefing.md per role  ──►  tmux session  ──►  harness CLI (claude …)
-                       └─►  ACP client   ──►  ACP agent (codex-acp …)
+briefing.md per role  ──►  agent session adapter  ──►  ACP client/session  ──►  ACP agent
         ▲                        │
  systemd --user / launchd ───────┘   restart on crash, start at boot/login
 ```
@@ -78,7 +79,6 @@ The state dir contract:
 | What | Why | Install |
 |---|---|---|
 | Node ≥ 20 | runs `ours-fleet` itself | nodejs.org, `apt`, or `brew` |
-| tmux | roles using `session: tmux` (the default) | `apt install tmux` / `brew install tmux` |
 | Node ≥ 22 | Claude roles using `session: acp` | required by the maintained Claude ACP adapter |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
 | `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
@@ -91,15 +91,15 @@ equivalent); logs land in `~/.ours-fleet/logs/`.
 
 ```sh
 npm i -g @ours.network/fleet
-ours-fleet init      # units/dirs/linger for this user
+ours-fleet init      # units/dirs/linger + missing standard presets
 ours-fleet doctor    # verifies everything above, with actionable messages
 ```
 
 The maintained Codex and Claude ACP adapters install as optional dependencies of
 `ours-fleet` and are resolved internally; users do not install adapter commands
 or add them to `PATH`. An explicit `session_options.acp.command` remains
-available for custom adapters. On Node 20–21, tmux and Codex ACP remain
-available, while maintained Claude ACP requires upgrading to Node 22.
+available for custom adapters. On Node 20–21, Codex ACP remains available,
+while maintained Claude ACP requires upgrading to Node 22.
 
 Each OS user manages their own fleet — to host roles under a sandboxed account,
 become that account and repeat.
@@ -107,8 +107,9 @@ become that account and repeat.
 ## Quickstart
 
 ```sh
-cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
-$EDITOR ~/fleet.yaml          # name your roles, missions, personas
+ours-fleet init               # safe to repeat: creates missing files, never replaces edits
+ours-fleet config             # validates Agents, Roles, Brains, and Room templates
+$EDITOR ~/fleet/agents/*.yaml # compose Role + Brain and operational settings
 ours-fleet up                 # boot the fleet (staggered)
 ours-fleet ls                 # running consoles
 ours-fleet attach Alice       # watch one live (Ctrl-b d to leave)
@@ -125,22 +126,19 @@ ours-fleet spawn Worker --mission "own the worker repo" \
 ours-fleet spawn --temp Scout --mission "one-off research"   # gone on exit/reboot
 
 # Codex role: ours-codex is preferred automatically; plain codex is the fallback
-ours-fleet spawn Coder --harness codex --model gpt-5.4 \
-  --session acp --approval ask --filesystem workspace \
-  --profile fleet --search --monitor --coordinator FleetCoordinator
-# Note: --monitor is legacy consent for Codex's native monitor. Choose the
-# wake owner separately in fleet.yaml with monitor.mode: fleet|native.
+ours-fleet spawn Coder --brain codex-fleet --role developer \
+  --approval ask --filesystem workspace --coordinator FleetCoordinator
 ```
 
 Inside a managed ACP role, `ours-fleet spawn` is transparently routed through
-that role's live supervisor. `ours-fleet spawn --role DeveloperX --temp` is the
-minimal form: omitted harness, session, cwd, coordinator, neutral permissions,
-fleet monitor policy, and same-harness model inherit from the caller. Explicit
-flags win; changing harness without a model lets the selected harness/fleet
-defaults choose one. After creation succeeds, fleet can deterministically notify
+that role's live supervisor. `ours-fleet spawn DeveloperX --temp` is the
+minimal form: omitted Brain/Role selections, cwd, coordinator, neutral permissions,
+and fleet monitor policy inherit from the caller. Identity, environment, owner routing,
+room startup, and sensitive inline Brain values do not. Explicit flags win. After
+creation succeeds, fleet can deterministically notify
 the caller's owner channel with the caller and spawned-role details. This is an
-honest-actor convenience and attribution path, not a security boundary; tmux,
-host shells, and deliberately bypassed absolute binaries retain direct behavior.
+honest-actor convenience and attribution path, not a security boundary; host
+shells and deliberately bypassed absolute binaries retain direct behavior.
 
 ## Local web console
 
@@ -209,8 +207,8 @@ offline shell and no stale fleet state.
 
 The console provides evidence-separated inventory and status, ACP activity and
 permission controls, redacted logs, typed text send, confirmed lifecycle
-actions, transactional permanent/temporary creation, and a shared tmux browser
-terminal. Identity is fixed to the role name. Creation uses the authenticated
+actions, and transactional permanent/temporary creation. Identity is fixed to
+the role name. Creation uses the authenticated
 daemon inventory and reports verified, missing, or unknown evidence. A missing
 permanent role identity is created deterministically before launch with local
 discovery and auto-accept enabled, then the provisioning lease is released so
@@ -243,41 +241,30 @@ never force-adopts or deletes identity state. Permanent roles are
 provisioned by fleet before launch and never delegate normal identity creation
 to the harness.
 
-`node-pty` is optional: if its native module cannot load, ACP and all
-non-terminal features remain available and tmux Terminal is disabled with a
-diagnostic.
+The web console uses structured ACP activity rather than exposing a raw agent terminal.
 
 Security boundaries:
 
 - configured `Host` and `Origin`, CSRF, one-time WebSocket tickets, and explicit
   bind/origin policy are enforced server-side;
 - cwd values must resolve beneath configured local roots;
-- terminal bytes are intentionally unredacted and are never copied into audit
-  records; normal logs are bounded and redacted;
-- tests use temporary fleet homes, fake supervisors/identity providers, and
-  isolated tmux sockets—never active role state.
-
-Permanent spawns are written to `~/fleet.d/<Name>.yaml`; the CLI never edits your
-hand-written `~/fleet.yaml`. `ours-fleet rm <Name>` unspawns.
-
-The web console is the one writer that can touch the base file, and it saves the
-file as a whole document: its setup wizard and configuration editor may create,
-change or remove any top-level block, including `vars:`, `defaults:`, `roles:`,
-`watchdogs:` and `loops:`. (`defaults:`, `watchdogs:` and `loops:` can only live
-in the base file — a `~/fleet.d/*.yaml` drop-in may declare `roles:` and nothing
-else.) Top-level keys the console does not recognise are round-tripped untouched.
-
-Console edits are applied as surgical splices against the file's exact bytes, so
-an unchanged save is a byte-for-byte no-op and lines outside the edit keep their
-comments, spacing and quoting. One bounded exception: changing the *length* of a
-block sequence — adding or removing an entry under `watch:`, `oversee:`, `roles:`
-or `wake_sources:` — rewrites that one collection as a whole, which drops inline
-comments written on its individual items. The loss is confined to the collection
-you edited, is shown in the diff before anything is written, and can be declined
-by not saving. Each write is revision-guarded, reviewed as a diff of the real
-file, validated with the real loader, and preceded by a timestamped backup.
-Values under `env:` — and the `vars:` entries they interpolate — are masked in
-the diff and never leave the host.
+- normal logs are bounded and redacted;
+- tests use temporary fleet homes and fake supervisors/identity providers—never
+  active role state.
+
+Permanent spawns write a bare Agent document to
+`~/fleet/agents/<Name>.yaml`; generated-source ownership is recorded so removal
+never deletes an unproven hand-written neighbor. `ours-fleet rm <Name>` unspawns.
+
+The web editor reads and writes the split document model explicitly as
+`{manifest, agents}`. Role and Brain presets are visible through Agent refs but
+remain read-only. Saves use one aggregate revision over the manifest and all
+Agent/Role/Brain sources, validate an exact-stem private staging tree, show a
+deterministic redacted diff per document, and hold one manifest-root lock.
+Changed/deleted files are backed up together; any partial failure restores every
+document or reports the private recovery directory. An unchanged save is a
+byte-for-byte no-op and creates no backup. Nested environment, authentication,
+invite, and isolation secrets never leave the host.
 
 From inside Claude Code, Codex, or Hermes with the core `ours` plugin installed,
 say **"spawn an ours agent …"**. The core skill checks for `ours-fleet`, installs
@@ -292,20 +279,19 @@ them and unsticks them:
 
 ```sh
 ours-fleet peek Worker          # what is it doing?
-ours-fleet send Worker --key 1  # answer the menu it's stuck on
 ours-fleet send Worker "continue with the tests, then report"
 ```
 
-Declare standing assignments in `fleet.yaml` (rendered into the overseer's
+Declare standing assignments in the overseer's bare Agent document (rendered into its
 briefing) — or just write "keep an eye on Alice and Bob every 5 minutes" in a
 persona; the bundled `oversee-agents` skill defines what that means operationally:
 
 ```yaml
-roles:
-  FleetCoordinator:
-    oversee:
-      - { role: Alice, interval: 5m }
-      - { role: Bob,   interval: 5m }
+role: { ref: coordinator }
+brain: { ref: claude-default }
+oversee:
+  - { agent: Alice, interval: 5m }
+  - { agent: Bob,   interval: 5m }
 ```
 
 ## Command reference
@@ -315,8 +301,8 @@ ours-fleet docs | man                 AI-friendly complete reference
 ours-fleet up|down|restart|force-restart [-c FILE] [Name...]
 ours-fleet config [-c FILE]         validate + print merged plan
 ours-fleet ls | attach | peek | logs [-f] | status <Name>
-ours-fleet send <Name> "text" | --key <K>
-ours-fleet spawn [--temp] [<Name> | --role <Name>] [--harness --session --mission --model --approval ...]
+ours-fleet send <Name> "text"
+ours-fleet spawn [--temp] [<Name> | --name <Name>] --brain <ID|inline:{...}> --role <ID|inline:{...}> [--approval ...]
 ours-fleet loops validate|list|status
 ours-fleet loops reload <Role>
 ours-fleet loops run-now|disable|enable <Role> <Loop>
@@ -348,33 +334,31 @@ in its state dir) across supervisor-triggered restarts — systemd/launchd re-in
 agent process with no arguments, so without this the role would silently fall back to
 the default `~/fleet.yaml` on its very first crash-restart and fail to resolve.
 
-## fleet.yaml reference
+## split configuration field reference
 
-```yaml
+The following is a schematic field inventory, not a single YAML document. Host
+settings belong in `~/fleet.yaml`; reusable behavior and harness settings belong
+in `~/fleet/roles/<id>.yaml` and `~/fleet/brains/<id>.yaml`; operational fields
+belong in `~/fleet/agents/<id>.yaml`.
+
+```text
 vars: { work_root: /home/me/work }      # ${var} substitution anywhere below
+api_version: ours.network/fleet/v2
 start_stagger_ms: 0                     # delay between agent LAUNCHES (host-wide, ms); 0 = no stagger
 defaults:
-  harness: claude-code                  # for roles that don't set one
-  session: tmux                         # tmux (default) | acp
   permissions:                         # common intent, translated by each harness/backend
     approval: ask                       # ask | auto | allow (`deny` is a deprecated alias)
     filesystem: workspace               # read-only | workspace | unrestricted
     unattended: deny                    # deny | wait
-  model: claude-fable-5                 # default model for roles that don't set one (per-role model / --model wins)
-  max_tokens: 500000                    # session cap (harness-interpreted)
   monitor:
     mode: fleet                         # fleet (default) | native
   worklog:                              # built-ins shown; set false to opt out
     max_kb: 1024                        # rotate only above this active-log size
     keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
     max_archives: 12                    # recent beside log; older preserved cold
-roles:
-  Name:                                 # [A-Za-z0-9_-]+
-    harness: claude-code
-    session: acp                         # one flag selects ACP; omit for tmux
-    session_options:
-      acp:
-        command: claude-agent-acp        # optional advanced override
+Agent document (\`~/fleet/agents/Name.yaml\`):
+  role: { ref: RoleID }
+  brain: { ref: BrainID }                # Brain owns harness/model/session/reasoning
     identity: "Display Name"            # ours identity to bind (default: Name)
     cwd: ${work_root}/repo              # where the harness process runs
     coordinator: FleetCoordinator       # announce target on boot
@@ -406,7 +390,7 @@ roles:
     bio: |                              # public card (published as bio)
     briefing_file: curated.md           # replaces the generated narrative
     env: { KEY: value }                 # extra session env
-    oversee: [{ role: X, interval: 5m }]
+    oversee: [{ agent: X, interval: 5m }]
     harness_options:                    # adapter-owned, adapter-validated
       plugins: { "name@marketplace": false }   # claude-code: plugin overrides
       # mem_palace: false                      # claude-code: disable memory plugin
@@ -444,22 +428,39 @@ loops:                                    # trusted local scheduled ACP turns
       If nothing material changed, complete silently without an owner report.
 ```
 
-Merge order: `fleet.yaml` ← `fleet.d/*.yaml`; a duplicate role name is a hard
-error naming both files. Identities and roles are decoupled — removing a role
-never deletes an identity. `session` is independent of `harness`, so changing a
-role from tmux to ACP does not change its identity, mission, monitor, or permission
-contract. `defaults.harness_options` is shallow-merged with each
-role's `harness_options`, so a fleet can set common Codex permission/profile defaults
-and override individual keys per role. `monitor` merges the same way — a role block
-overrides `defaults.monitor` key-by-key.
+The v2 loader reads the manifest, then sorted bare Role, Brain, and Agent
+documents from its exact stem directory. Duplicate filename-derived IDs are a
+hard error. Identities and Agents are decoupled—removing an Agent never deletes
+an identity. Role, Brain, and operational ownership are composed explicitly;
+there is no generic cross-kind merge. Manifest operational defaults such as
+`monitor` and `permissions` merge only within their owning Agent fields.
 
 Every supervised role is a client of the operator-configured ours daemon. Fleet strips the
-obsolete, presence-sensitive `OURS_AUTOSTART` variable from both tmux and ACP harness
+obsolete, presence-sensitive `OURS_AUTOSTART` variable from ACP harness
 processes. `ours-mcp proxy` is client-only and never starts a daemon; operators and explicit
 installer/setup flows remain responsible for starting it.
 
 ### Rooms and tasks
 
+Init installs editable `single`, `pair`, and `team` definitions under
+`~/fleet/room_templates/`, plus every exact-cased Agent, Role, and Brain they
+reference. Inspect them with `ours-fleet template list` and
+`ours-fleet template show team`. After configuring the authenticated owner below:
+
+```sh
+ours-fleet task create --title "Solo task" --template single
+ours-fleet task create --title "Reviewed change" --template pair
+ours-fleet task create --title "Phased delivery" --template team
+```
+
+`ours-fleet init -c /path/custom.yaml` seeds `/path/custom/` instead. Init reports
+the packaged preset revision and source directory and only seeds missing files.
+It never upgrades an edited preset. To adopt a newer packaged file explicitly,
+copy the reported source file beside the existing target as `.new-default`, review
+`diff -u`, then replace the target yourself. This is the sole adoption operation;
+rerunning init is not an update. Users upgrading from hardcoded templates should
+run init once (with the same `-c` selection they normally use).
+
 Rooms always use `ours-cowork`; there is no room-provider selector. Configure
 the cowork daemon connection and the room owner directly:
 
@@ -597,9 +598,7 @@ since a human can still attach a console and answer.
 `auto` selects Codex ACP `agent` (`on-request` + `workspace-write`) / Claude
 `acceptEdits`. `allow` selects Codex ACP's fully non-interactive yolo mode,
 reported by the adapter as `agent-full-access` (`never` +
-`danger-full-access`); Claude uses `bypassPermissions`. For Codex tmux, where the
-approval and sandbox flags remain independent, `auto` is `on-request` and
-`allow` is `never` while `filesystem` still chooses the sandbox.
+`danger-full-access`); Claude uses `bypassPermissions`.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
 `allow` role previously ran unable to do its job. Legacy `deny` is accepted
 only for compatibility and retains its conservative Codex `on-request` /
@@ -689,8 +688,8 @@ their boots ~4 s apart instead of firing all seven at once.
 With `monitor.mode: fleet` (the default), the **ours-fleet supervisor** delivers
 a role's mail wakes: the per-role runner long-polls the ours daemon's notification API and
 submits a single `[fleet-monitor] N new messages from … — run get_messages` prompt
-through the selected backend. ACP uses live steering when its adapter supports it
-and falls back to structured `session/prompt`; tmux uses verified console input.
+through the shared agent session. ACP uses live steering when its adapter supports it
+and falls back to structured `session/prompt`.
 Set `monitor.interrupt: true` on roles where every configured wake should cancel
 the active turn before the notification is delivered. This is intentionally
 content-blind: the supervisor cannot inspect encrypted message bodies, so all
@@ -700,8 +699,7 @@ tool result or pending permission. Fleet waits for terminal ACP tool/update
 evidence, then steers the wake without calling `session.cancel`. If the tool is
 still active after 120 seconds, or the adapter cannot expose authenticated tool
 boundaries/steering, fleet visibly degrades to non-cancelling steering or queued
-delivery. Tmux never receives `C-c` for `after_tool`. Explicit human and control
-interrupts remain immediate.
+delivery. Explicit human and control interrupts remain immediate.
 The default is `false`: a role that must begin a post-readiness mission
 immediately, including second-and-later mail received while it is working, must
 set `monitor.mode: fleet` and `monitor.interrupt: true` explicitly. Readiness and
@@ -794,8 +792,8 @@ invites, message bodies, credentials, or keys. A corrupt overlay fails closed
 (no effective owners and no mutation), and the last effective owner cannot be
 revoked.
 
-These commands require a running ACP role with `owner_channel` enabled. Missing,
-stopped, tmux, disabled, draining, and unavailable-MCP targets fail without
+These commands require a running role with `owner_channel` enabled. Missing,
+stopped, disabled, draining, and unavailable-MCP targets fail without
 starting a second client, binding an identity, or opening a network listener.
 
 The managed agent can use its ordinary ours `send_message` or `send_file` tool to
@@ -1015,11 +1013,8 @@ gets a durable pre-send marker: a failed/ambiguous send becomes `uncertain` and
 not blindly retried, while files not yet attempted remain recoverable after restart.
 Logs contain counts and byte totals, never filenames or raw bytes.
 
-Owner channels currently require `session: acp`. Fleet needs structured,
-turn-correlated assistant output for automatic replies; scraping a tmux pane
-cannot reliably distinguish the final answer from thoughts, tool output, or
-unrelated concurrent work. The config rejects tmux instead of silently offering
-weaker semantics.
+Owner channels use the structured agent-session interface for turn-correlated
+assistant output and reliable automatic replies.
 
 ## Codex roles
 
@@ -1050,40 +1045,34 @@ the structured CLI watcher, because a detached process cannot wake a Codex turn.
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
-The main Codex controls needed by fleet roles are available declaratively and when spawning:
+The main Codex controls are Brain-owned and also available when spawning:
 
 ```yaml
-defaults:
-  harness: codex
-  model: gpt-5.4
-  harness_options:
-    launcher: auto
-    profile: fleet                 # $CODEX_HOME/fleet.config.toml
-    sandbox: workspace-write
-    approval: on-request
-    monitor: true                  # consent for Codex's native monitor; not the wake-owner selector
-    search: true
-    add_dirs: [/data/shared]
-    config:
-      model_reasoning_effort: high
-
-roles:
-  Reviewer:
-    harness_options:
-      sandbox: read-only           # overrides just this default key
+# ~/fleet/brains/codex-review.yaml
+harness: codex
+session: acp
+model: gpt-5.4
+harness_options:
+  launcher: auto
+  profile: fleet
+  sandbox: read-only
+  approval: on-request
+  monitor: true
+  search: true
+  add_dirs: [/data/shared]
+  config: { model_reasoning_effort: high }
 ```
 
-Equivalent one-off/permanent spawn controls include `--model`, `--permission-mode`,
-`--sandbox`, `--profile`, `--launcher`, `--search`, legacy `--monitor` (native
-Codex monitor consent), repeatable
-`--codex-config key=value`, and repeatable `--add-dir`. Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
+One-off/permanent spawn selects a Brain that owns model, reasoning, native permission,
+sandbox, profile, launcher, search, monitor consent, native config, and additional roots.
+Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
 role-specific ours daemon, or configure the host default in `~/.ours/config.json`.
 
 ## Agent isolation
 
 Each role can be sandboxed at the environment level via an `isolation:` block —
 **fully additive: a role with no block behaves exactly as before.** The agent's
-tmux-pane process is wrapped in [bubblewrap](https://github.com/containers/bubblewrap)
+agent process is wrapped in [bubblewrap](https://github.com/containers/bubblewrap)
 (rootless, no setuid), resource-limited by `systemd-run --user --scope`.
 
 An empty `isolation: {}` gives a sensible default posture: filesystem-confined to

package/dist/agent-recovery-gate.d.ts

@@ -0,0 +1,17 @@
+import type { ConversationEventV1 } from './session/conversation-types.js';
+import type { AgentSession } from './session/types.js';
+export interface AgentRecoveryEvidence {
+    ok: boolean;
+    reason: 'RECOVERY_TOOLS_VERIFIED' | 'RECOVERY_PROMPT_MISSING' | 'RECOVERY_TURN_INCOMPLETE' | 'RECOVERY_TURN_FAILED' | 'RECOVERY_CHOOSE_MISSING' | 'RECOVERY_CURRENT_MISSING' | 'RECOVERY_GET_MESSAGES_MISSING' | 'RECOVERY_TOOL_ORDER_INVALID';
+    chooseIdentity: boolean;
+    currentIdentity: boolean;
+    getMessages: boolean;
+    turnCompleted: boolean;
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export declare function evaluateAgentRecovery(events: readonly ConversationEventV1[], promptId: string, identity: string): AgentRecoveryEvidence;
+export declare function recoverAgentIdentity(session: AgentSession, identity: string): Promise<AgentRecoveryEvidence>;

package/dist/agent-recovery-gate.js

@@ -0,0 +1,135 @@
+const TOOL_NAMES = {
+    choose: new Set(['choose_identity', 'ours.choose_identity', 'mcp__ours__choose_identity']),
+    current: new Set(['current_identity', 'ours.current_identity', 'mcp__ours__current_identity']),
+    messages: new Set(['get_messages', 'ours.get_messages', 'mcp__ours__get_messages']),
+};
+function recordFor(records, event) {
+    if (event.kind !== 'tool.upsert' || !event.toolCallId)
+        return undefined;
+    const payload = event.payload;
+    const previous = records.get(event.toolCallId) ?? {};
+    const next = {
+        ...previous,
+        ...(payload.title !== undefined ? { title: payload.title } : {}),
+        ...(payload.status !== undefined ? { status: payload.status } : {}),
+        ...(payload.rawInput !== undefined ? { rawInput: payload.rawInput } : {}),
+        ...(payload.status === 'completed' ? { completedSeq: event.seq } : {}),
+    };
+    records.set(event.toolCallId, next);
+    return next;
+}
+function objectInput(input) {
+    if (!input || input.truncated || input.redacted || !input.json
+        || typeof input.json !== 'object' || Array.isArray(input.json))
+        return undefined;
+    return input.json;
+}
+function safeChoose(record, identity) {
+    if (!record.title || !TOOL_NAMES.choose.has(record.title) || record.status !== 'completed')
+        return false;
+    const input = objectInput(record.rawInput);
+    if (!input)
+        return false;
+    const keys = Object.keys(input).sort();
+    if (keys.some(key => key !== 'force' && key !== 'name'))
+        return false;
+    return input.name === identity && (input.force === undefined || input.force === false);
+}
+function safeNoOrBoundedInput(record, names, allowed) {
+    if (!record.title || !names.has(record.title) || record.status !== 'completed')
+        return false;
+    if (!record.rawInput)
+        return allowed({});
+    const input = objectInput(record.rawInput);
+    return input !== undefined && allowed(input);
+}
+function safeCurrent(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.current, input => Object.keys(input).length === 0);
+}
+function safeMessages(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.messages, input => {
+        const keys = Object.keys(input);
+        if (keys.some(key => key !== 'limit'))
+            return false;
+        return input.limit === undefined
+            || (Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 200);
+    });
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export function evaluateAgentRecovery(events, promptId, identity) {
+    const ordered = [...events].sort((a, b) => a.seq - b.seq);
+    const admitted = ordered.find(event => event.kind === 'prompt.admitted' && event.promptId === promptId);
+    const empty = (reason) => ({
+        ok: false, reason, chooseIdentity: false, currentIdentity: false,
+        getMessages: false, turnCompleted: false,
+    });
+    if (!admitted)
+        return empty('RECOVERY_PROMPT_MISSING');
+    const terminal = ordered.find(event => event.seq > admitted.seq
+        && event.kind === 'turn.completed'
+        && event.promptId === promptId
+        && event.sessionGeneration === admitted.sessionGeneration);
+    if (!terminal)
+        return empty('RECOVERY_TURN_INCOMPLETE');
+    const outcome = terminal.payload.outcome;
+    if (outcome !== 'completed')
+        return empty('RECOVERY_TURN_FAILED');
+    const records = new Map();
+    for (const event of ordered) {
+        if (event.seq <= admitted.seq || event.seq >= terminal.seq
+            || event.promptId !== promptId
+            || event.sessionGeneration !== admitted.sessionGeneration)
+            continue;
+        recordFor(records, event);
+    }
+    const values = [...records.values()];
+    const chooses = values.filter(record => safeChoose(record, identity));
+    const currents = values.filter(safeCurrent);
+    const messages = values.filter(safeMessages);
+    const chooseIdentity = chooses.length > 0;
+    const currentIdentity = currents.length > 0;
+    const getMessages = messages.length > 0;
+    const base = { chooseIdentity, currentIdentity, getMessages, turnCompleted: true };
+    if (!chooseIdentity)
+        return { ok: false, reason: 'RECOVERY_CHOOSE_MISSING', ...base };
+    if (!currentIdentity)
+        return { ok: false, reason: 'RECOVERY_CURRENT_MISSING', ...base };
+    if (!getMessages)
+        return { ok: false, reason: 'RECOVERY_GET_MESSAGES_MISSING', ...base };
+    const orderedChain = chooses.some(choose => currents.some(current => messages.some(message => choose.completedSeq !== undefined && current.completedSeq !== undefined
+        && message.completedSeq !== undefined
+        && choose.completedSeq < current.completedSeq
+        && current.completedSeq < message.completedSeq)));
+    if (!orderedChain)
+        return { ok: false, reason: 'RECOVERY_TOOL_ORDER_INVALID', ...base };
+    return { ok: true, reason: 'RECOVERY_TOOLS_VERIFIED', ...base };
+}
+export async function recoverAgentIdentity(session, identity) {
+    if (!session.subscribeConversation)
+        return {
+            ok: false, reason: 'RECOVERY_PROMPT_MISSING', chooseIdentity: false,
+            currentIdentity: false, getMessages: false, turnCompleted: false,
+        };
+    const events = [];
+    const unsubscribe = session.subscribeConversation(event => events.push(event));
+    try {
+        const queued = await session.queuePrompt([
+            '[fleet-recovery] The shared ours daemon restarted.',
+            `Call ours choose_identity with name ${JSON.stringify(identity)} and force false.`,
+            'Then call current_identity, then get_messages. Complete all three in that order.',
+            'Do not create/delete identities, force-bind, interrupt, or restart any service/session.',
+        ].join('\n'), { origin: { kind: 'fleet-monitor' } });
+        await queued.completion;
+        // Conversation publication is synchronous with terminal settlement in the
+        // in-tree ACP store; filtering by exact promptId/sessionGeneration remains
+        // the authority even if unrelated events arrived concurrently.
+        return evaluateAgentRecovery(events, queued.promptId, identity);
+    }
+    finally {
+        unsubscribe();
+    }
+}

package/dist/application/capabilities.d.ts

@@ -1,6 +1,5 @@
 import type { RoleRecord, RoleCapabilities, RoleStatus } from './types.js';
 export interface CapabilityContext {
-    terminalPtyAvailable?: boolean;
     controlProtocolVersion?: number;
 }
 export declare function roleCapabilities(role: RoleRecord, status: RoleStatus, context?: CapabilityContext): RoleCapabilities;