@ours.network/fleet 1.0.5 → 1.1.0-nightly.10

package/dist/docs.js

@@ -6,11 +6,11 @@
  */
 export const AI_DOCS = `# ours-fleet reference
 
-ours-fleet runs persistent or temporary, identity-bound AI roles. A role selects
-a harness independently from its session backend:
+ours-fleet runs persistent or temporary, identity-bound AI roles through the
+structured ACP session path:
 
 - harness: \`claude-code\` or \`codex\`
-- session: \`tmux\` (default) or \`acp\`
+- session: \`acp\` (default and only supported value)
 - lifetime: permanent (supervised, restartable) or \`spawn --temp\`
 
 ## Discover and validate
@@ -23,24 +23,20 @@ ours-fleet doctor [-c FILE] [--harness codex|claude-code]
 ours-fleet version [--json]             # build identity, capabilities, every install on PATH
 \`\`\`
 
-Default configuration is \`~/fleet.yaml\` plus sorted \`~/fleet.d/*.yaml\` role
-drop-ins. An explicit \`-c FILE\` replaces \`~/fleet.yaml\`; fleet.d still adds
-roles. Validate with \`config\` and \`doctor\` before starting or restarting.
-
-The CLI never writes the base file: \`spawn\` writes \`~/fleet.d/Name.yaml\`. The
-web console does write it, as a whole document — its setup wizard and
-configuration editor may create, change or remove any top-level block, including
-\`vars:\`, \`defaults:\`, \`roles:\`, \`watchdogs:\` and \`loops:\`. Only the base
-file may hold \`defaults:\`, \`watchdogs:\` and \`loops:\`; a fleet.d drop-in may
-declare \`roles:\` and nothing else. Unrecognised top-level keys are round-tripped
-untouched. Console edits are applied as surgical splices against the file's exact
-bytes, so an unchanged save is byte-identical and lines outside the edit keep their
-comments and spacing. One exception: changing the length of a block sequence
-(\`watch:\`, \`oversee:\`, \`roles:\`, \`wake_sources:\`) may replace that collection
-wholesale and drop inline comments written on its items; lines outside that
-collection remain byte-preserved. Each save is revision-guarded, reviewed as a diff
-of the real file before anything is written, validated by the real loader, and
-backed up next to the file first.
+Configuration v2 is \`~/fleet.yaml\` plus typed bare documents under the exact
+stem directories \`~/fleet/agents\`, \`~/fleet/roles\`, \`~/fleet/brains\`, and
+\`~/fleet/room_templates\`.
+The manifest owns fleet-wide operational defaults and automation; each Agent
+selects one inline/ref Role and Brain and carries its operational fields.
+Legacy top-level \`roles:\` and \`fleet.d\` are rejected. Validate the complete
+trusted source set with \`config\` and \`doctor\` before starting or restarting.
+
+Permanent \`spawn\` writes \`~/fleet/agents/Name.yaml\`. The web console edits an
+explicit \`{manifest, agents}\` model while Role/Brain presets remain read-only.
+Its aggregate revision includes every Agent/Role/Brain/Room-template source, previews a
+redacted per-document diff in an exact-stem private staging tree, and saves under
+one root lock with a private multi-file backup and full rollback. A no-op is
+byte-identical and creates no backup.
 
 ## Build identity and install provenance
 
@@ -83,7 +79,7 @@ PATH order.
 ## Lifecycle and console commands
 
 \`\`\`sh
-ours-fleet init
+ours-fleet init [-c FILE]               # seed missing presets; never replace an existing file
 ours-fleet up|down [Name...]
 ours-fleet restart [Name...]            # preserve/resume harness context
 ours-fleet force-restart [Name...]      # fresh context; briefing is reloaded
@@ -91,15 +87,14 @@ ours-fleet ls
 ours-fleet status|peek|attach|logs Name
 ours-fleet logs -f Name
 ours-fleet send Name "prompt"
-ours-fleet send Name --key Enter        # tmux only
 ours-fleet rm Name
 ours-fleet watchdog-report <name> [run-id] [--list] [--json]
 ours-fleet watchdog-run <name>
 \`\`\`
 
-\`peek\`, \`attach\`, and text \`send\` work with tmux and ACP. ACP attachment
-also accepts \`/permit <permission-id> <option-id>\`, \`/interrupt\`, and
-\`/detach\`. Raw \`--key\` input is tmux-only.
+\`peek\`, \`attach\`, and text \`send\` use the structured agent session.
+Attachment also accepts \`/permit <permission-id> <option-id>\`, \`/interrupt\`,
+and \`/detach\`.
 
 ## Local web console
 
@@ -155,21 +150,19 @@ harness's own default.
 ## Spawn
 
 \`\`\`sh
-ours-fleet spawn [--temp] [Name | --role Name] \\
-  --harness codex|claude-code --session tmux|acp \\
-  --mission "one line" --cwd /absolute/path --identity Identity \\
-  --coordinator Coordinator --model MODEL \\
+ours-fleet spawn [--temp] [Name | --name Name] \\
+  --brain BRAIN_ID --role ROLE_ID \\
+  --cwd /absolute/path --identity Identity --coordinator Coordinator \\
   --approval ask|auto|allow \\
   --filesystem read-only|workspace|unrestricted \\
-  --unattended deny|wait \\
-  --bio-file /path/bio.md --persona-file /path/persona.md
+  --unattended deny|wait --isolation-file /path/isolation.yaml
 \`\`\`
 
-Permanent spawn writes \`~/fleet.d/Name.yaml\` and starts a supervised role.
+Permanent spawn writes \`~/fleet/agents/Name.yaml\` and starts a supervised role.
 \`--temp\` writes active state under \`~/.ours-fleet/tmp\` and starts an independent
 transient supervisor (a collected systemd unit or submitted launchd job). It is
 not enabled across reboot and does not die when the role that spawned it restarts.
-Both lifetimes support \`--session acp\`. When a temporary role's bound identity
+Brain definitions own the ACP session backend. When a temporary role's bound identity
 closes or its session ends, the supervisor, monitor and live roster entry retire
 together; state moves intact to \`~/.ours-fleet/recovery/temporary\` with a
 termination record. Failed launches use the same archive rather than deleting
@@ -201,88 +194,47 @@ only sustained authoritative absence closes the role. Unreachable, malformed, or
 valid-but-empty daemon indexes are ambiguous and reset closure debounce rather
 than becoming cleanup authority.
 
-Inside a managed ACP role, the same CLI automatically routes a real \`spawn\`
-through that role's authenticated supervisor control socket. \`--role Name\` is
-accepted as an alternative to the positional name, so a minimal delegated call
-is \`ours-fleet spawn --role DeveloperX --temp\`. The supervisor records the
-calling role, performs creation, and only after success sends a structured
-spawn notice through the caller's owner channel when one is configured.
-
-Omitted harness, session, working directory, coordinator, neutral permissions,
-fleet monitor policy, and (when the harness is unchanged) model inherit from the
-calling role. Explicit options always win. Selecting a different harness without
-\`--model\` leaves model selection to that harness/fleet defaults rather than
-copying an incompatible caller model. This automatic proxy is a convenience and
+Inside a managed ACP role, public \`ours-fleet\` commands cross an authenticated
+supervisor attribution boundary before Commander parsing. The original CLI remains
+the executor inside the role's existing OS sandbox, and ordinary CLI validation is
+the source of truth. Hidden worker entry points remain internal; public lifecycle and
+operator commands are not restricted by the proxy.
+
+Command invocation, raw argv, read-only work, validation failures, and generic
+outcomes are never forwarded to the Owner-visible channel. Fleet announces only
+confirmed Agent, Task, and Room lifecycle changes. Local diagnostics retain
+structurally redacted command metadata. Lifecycle delivery uncertainty is logged,
+never recursively announced, and never reruns or blindly retries an effect.
+Room participant summaries describe creation and activation. Fleet has no public
+post-create Room membership mutation, so it does not claim a separate membership event.
+
+Omitted Brain and Role selections, working directory, coordinator, neutral permissions,
+and fleet monitor policy inherit from the calling Agent. Explicit options always win.
+Identity, mission/profile text, environment, owner routing, auth proxy, room startup,
+isolation, worklog, and sensitive inline Brain values never inherit implicitly.
+This automatic proxy is a convenience and
 attribution mechanism, not an isolation boundary: an unrestricted role can still
-invoke another binary path directly. Tmux roles and host/operator shells keep the
-ordinary direct CLI behavior.
+invoke another binary path directly. Host/operator shells keep the ordinary direct
+CLI behavior.
 
-Codex-specific spawn flags: \`--sandbox\`, \`--permission-mode\`, \`--launcher\`,
-\`--profile\`, \`--search\`, repeatable \`--codex-config key=value\`, repeatable
-\`--add-dir\`, and legacy \`--monitor\` (consent for the native Codex monitor,
-not the \`monitor.mode\` wake-owner selector). Run \`ours-fleet help spawn\` for
-exact values.
+Brain owns harness, session, model, reasoning effort, token limits, and native harness
+options. Removed runtime flags are rejected with migration guidance rather than silently
+reinterpreted. A selection is a stable ID or an explicit \`inline:{...}\` mapping.
 
 ## fleet.yaml
 
 \`\`\`yaml
+api_version: ours.network/fleet/v2
 vars:
   work_root: /home/me/work
 start_stagger_ms: 0
 defaults:
-  harness: codex
-  session: acp
-  model: gpt-model-id
   permissions:
     approval: ask
     filesystem: workspace
     unattended: deny
   monitor:
     mode: fleet                          # fleet (default) | native
-roles:
-  Coordinator:
-    harness: codex
-    session: acp
-    identity: Coordinator
-    cwd: \${work_root}/project
-    mission: Coordinate work and delegate implementation.
-    model: gpt-model-id
-    permissions:
-      approval: ask
-      filesystem: workspace
-      unattended: deny
-    session_options:                    # advanced overrides; normally omit
-      # acp:
-      #   command: [/custom/codex-acp, --flag]
-      tmux:
-        boot_grace_ms: 10000
-    monitor:
-      mode: fleet                        # fleet supervisor | native harness monitor
-      interrupt: false                    # false queues; true cancels; after_tool steers at an ACP tool boundary
-      wake_sources: [message_received, file_received, local_contact_request, pending_message]
-      batch_ms: 2000
-      inject: notification
-      turn_fail_threshold: 3
-    harness_options:
-      launcher: auto
-      sandbox: workspace-write
-      approval: on-request
-      search: false
-      profile: fleet
-      add_dirs: [/data/shared]
-      config:
-        model_reasoning_effort: high
-      mcp_servers:                       # claude-code: per-role MCP servers, additive by default
-        ours: { command: ours-mcp, args: [proxy] }
-      mcp_servers_only: false            # true = ONLY these; drops user/project/plugin servers
-    bio: Public role card and when peers should engage it.
-    persona: Local operating contract, boundaries, and escalation policy.
-    briefing_file: /absolute/custom-briefing.md
-    coordinator: AnotherCoordinator
-    env:
-      KEY: value
-    oversee:
-      - { role: Worker, interval: 5m }
 watchdogs:
   nightwatch:                       # [A-Za-z0-9_-], must not collide with a role name
     coordinator: FleetCoordinator   # required — where alerts go
@@ -290,42 +242,69 @@ watchdogs:
     enabled: true                   # default true; false = configured but never scheduled
     interval: 10m                   # default 10m; 30s | 10m | 2h, minimum 1m
     watch: [Alice, CodexReviewer]   # explicit lists are exact; omit for configured + live temp roles
-    harness: claude-code            # default: defaults.harness
-    model: claude-fable-5           # default: same resolution rule roles use (resolveRoleModel)
-    session: acp                    # default: defaults.session
+    agent: { ref: WatchdogAgent }   # required: declared Agent ID, or canonical inline Agent definition
     identity: Watchdog-nightwatch   # default: Watchdog-<name>
     timeout: 5m                     # default 5m; a run past this is killed and recorded as error
     keep_reports: 50                # default 50 reports retained per watchdog
     alert_cooldown: 60m             # default 60m before the same finding alerts again
     prompt_file: /abs/extra.md      # optional extra focus, APPENDED to the fixed contract
-    isolation:                      # optional; omitted means no OS sandbox, like an ordinary role
-      backend: bubblewrap           # when present, the ordinary role isolation schema applies
-      network: broker
-      fs: { read: [/opt/watch-data] }
+\`\`\`
+
+An Agent is a separate bare document under \`~/fleet/agents/<ID>.yaml\`:
+
+\`\`\`yaml
+role: { inline: { mission: Coordinate work and delegate implementation. } }
+brain: { inline: { harness: codex, session: acp, model: gpt-model-id } }
+identity: Coordinator
+cwd: \${work_root}/project
+oversee: [{ agent: Worker, interval: 5m }]
 \`\`\`
 
 A watchdog observes and reports; it never restarts, stops, spawns, or removes a
 role, answers a pending permission, edits a workspace, or approves anything on
 the owner's behalf. \`watchdogs:\` may appear only in the base config
-(\`~/fleet.yaml\` or \`-c FILE\`), not in \`~/fleet.d/*.yaml\` drop-ins.
-Watchdogs are not isolated by default. An explicit watchdog \`isolation:\` block
-uses the same policy schema as a role and is applied unchanged; declare every
-extra filesystem access required by a custom prompt there.
+(\`~/fleet.yaml\` or \`-c FILE\`); Agent/Role/Brain documents never own it.
+The selected Agent owns Brain, Role, permissions, isolation, and every other
+agent setting. Legacy watchdog \`harness\`, \`model\`, \`session\`, and
+\`isolation\` fields fail with migration guidance.
 When \`watch:\` is omitted, each run watches the configured roles plus temporary
 fleet roles that are live when the run starts. An explicit \`watch:\` list is
 never augmented.
 
-Role values override defaults. \`\${name}\` substitutes entries from \`vars\`.
-Other role fields include \`max_tokens\`, \`autocompact_pct\`, and \`isolation\`.
+Agent operational values override manifest operational defaults. Role and Brain
+ownership never cross-merges. \`\${name}\` substitutes entries from \`vars\`.
+Brain fields include \`max_tokens\` and \`autocompact_pct\`; isolation is Agent-owned.
 Use README.md for the complete isolation policy and resource-cap schema.
 
 Supervised roles connect to the operator-configured ours daemon; they do not own its
 lifecycle. Fleet strips the obsolete, presence-sensitive \`OURS_AUTOSTART\` variable from
-tmux and ACP children; \`ours-mcp proxy\` is client-only and never starts a daemon. Start
+agent-session children; \`ours-mcp proxy\` is client-only and never starts a daemon. Start
 the shared daemon only through an explicit operator or installer/setup flow.
 
 ## Rooms and tasks
 
+\`init\` materializes editable \`single\`, \`pair\`, and \`team\` Room templates plus
+their exact-cased Agent, Role, and Brain presets. The command prints the packaged
+preset revision and source directory. Inspect provenance and content before use:
+
+\`\`\`sh
+ours-fleet config [-c FILE]
+ours-fleet template list [-c FILE]
+ours-fleet template show team [-c FILE]
+ours-fleet task create --title "Solo task" --template single [-c FILE]
+ours-fleet task create --title "Reviewed change" --template pair [-c FILE]
+ours-fleet task create --title "Phased delivery" --template team [-c FILE]
+\`\`\`
+
+An alternate manifest \`-c /path/custom.yaml\` uses \`/path/custom/\` as its split
+root. Repeated init only fills missing files and never adopts a newer default.
+For explicit adoption, copy one file from init's reported packaged source beside
+the target as \`.new-default\`, inspect \`diff -u TARGET TARGET.new-default\`, then
+replace TARGET yourself. Upgrades from hardcoded templates require one
+\`ours-fleet init\` (or \`init -c FILE\`) migration pass. A manifest-level template
+may shadow a same-named file only with \`override_builtin: true\` and a higher
+version; this compatibility marker is deprecated and reported as a diagnostic.
+
 Rooms always use \`ours-cowork\`; there is no room-provider selector. Configure
 the cowork daemon connection and room owner directly:
 
@@ -496,9 +475,7 @@ Security meaning: \`ask\` maps to Codex \`untrusted\` and Claude \`default\`.
 \`auto\` selects Codex ACP \`agent\` (\`on-request\` + \`workspace-write\`) and
 Claude \`acceptEdits\`. \`approval: allow\` selects Codex ACP's fully
 non-interactive yolo mode, reported as \`agent-full-access\` (\`never\` +
-\`danger-full-access\`), and Claude \`bypassPermissions\`. Codex tmux retains
-independent approval and sandbox flags: \`auto\` is \`on-request\`, \`allow\`
-is \`never\`, and \`filesystem\` still selects the sandbox. These modes genuinely
+\`danger-full-access\`), and Claude \`bypassPermissions\`. These modes genuinely
 permit the actions the role was authorized to take —
 \`dontAsk\` only suppresses the prompt while still refusing the action. Nothing
 other than an explicit \`allow\` becomes non-interactive. Legacy \`deny\` keeps
@@ -531,16 +508,15 @@ dontAsk, bypassPermissions), \`plugins\`, \`mem_palace\`,
 \`mcp_servers\` declares MCP servers for the role, in \`.mcp.json\`'s own shape
 (a map of name to \`{ command, args, env }\`, or \`{ type: http|sse, url,
 headers }\`). By default they are ADDED to whatever the OS user running the role
-already has configured, on both session types: tmux passes \`--mcp-config\`, and
-ACP sends them in \`session/new\`.
+already has configured. The Claude Code adapter sends them in \`session/new\`.
 
 When \`mcp_servers\` is absent, Fleet sends ACP's protocol-required empty
 \`mcpServers\` array without an exclusive override, so the agent keeps its inherited
 servers. An explicitly empty configured set is different: Fleet preserves that intent
 through the bundled adapter's compatibility path and disables every inherited server.
 
-\`mcp_servers_only: true\` makes the declared set EXCLUSIVE — \`--strict-mcp-config\`
-on tmux, \`strictMcpConfig\` on ACP. It is all-or-nothing and it ignores every
+\`mcp_servers_only: true\` makes the declared set EXCLUSIVE through
+\`strictMcpConfig\`. It is all-or-nothing and it ignores every
 other MCP configuration: project \`.mcp.json\`, user settings, and **plugins**.
 The ours connector is normally installed as a plugin, so a strict role that does
 not re-declare it has no \`send_message\` and no \`get_messages\` — it cannot even
@@ -566,8 +542,8 @@ The maintained \`@agentclientprotocol/codex-acp\` and
 \`@agentclientprotocol/claude-agent-acp\` runtimes are bundled automatically as
 optional ours-fleet dependencies. The supervisor resolves their executable
 entrypoints internally, so default ACP roles do not depend on global PATH.
-The maintained Claude adapter requires Node 22; tmux and Codex ACP continue to
-work on the ours-fleet core minimum of Node 20.
+The maintained Claude adapter requires Node 22; Codex ACP continues to work on
+the ours-fleet core minimum of Node 20.
 
 Override an adapter only when necessary with \`session_options.acp.command\`
 (string or argv list). If optional dependencies were deliberately omitted,
@@ -581,7 +557,7 @@ ours-fleet falls back to a compatible globally installed \`codex-acp\` or
 - \`fleet\` (default): the ours-fleet supervisor consumes body-free daemon
   events and advances its durable cursor only after delivery is accepted. ACP
   uses live steering when supported and falls back to structured
-  \`session/prompt\`; tmux uses verified console injection.
+  \`session/prompt\`.
 - \`native\`: ours-fleet starts no supervisor monitor; the generated briefing
   instructs Claude Code or Codex to arm its harness-native wake mechanism.
 
@@ -712,8 +688,8 @@ provenance checks.
 The channel identity must be unique and must not be a role identity. The bridge
 persists bounded wire IDs only, never message/reply plaintext, and requeues input
 before starting its turn for at-least-once crash recovery. It currently requires
-\`session: acp\`: tmux has no structured, turn-correlated final answer, and pane
-scraping cannot provide the same reliable reply guarantee.
+the structured agent-session interface backed by ACP so correlated final replies
+retain their delivery guarantee.
 
 ### Live contact and owner administration
 
@@ -761,7 +737,7 @@ contains bounded CIDs and audit actions only. Corruption disables all effective
 owners and refuses mutation rather than resurrecting authority; revoking the
 last effective owner is always refused.
 
-A missing/stopped role, tmux session, role without \`owner_channel\`, unavailable
+A missing/stopped role, role without \`owner_channel\`, unavailable
 MCP client, or a role entering shutdown returns an actionable error with no
 side effects. Management uses no network listener and never logs or persists
 invite material.

package/dist/doctor.js

@@ -13,6 +13,7 @@ import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, BIN_NAME, } from './provenance.js';
+import { readDaemonRecoveryStatus } from './daemon-recovery.js';
 /** Which cgroup-v2 controllers are delegated to this user manager (advisory). */
 function cgroupDelegationDetail() {
     try {
@@ -94,7 +95,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     const loaded = loadConfigResult(opts.configPath, opts.yamlMode);
     const roles = loaded.ok ? loaded.roles : [];
     checks.push(loaded.ok
-        ? { name: 'config', ok: true, detail: loaded.files.join(' + ') || '(none — no fleet.yaml or fleet.d)' }
+        ? { name: 'config', ok: true, detail: loaded.files.join(' + ') }
         : { name: 'config', ok: false, detail: loaded.error });
     checks.push(loaded.ok
         ? { name: 'roles', ok: true, detail: `${roles.length} configured` }
@@ -106,6 +107,19 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 ok: true,
                 detail: `warning: ${diagnostic.message}`,
             });
+    for (const role of roles) {
+        const recovery = readDaemonRecoveryStatus(agentDir(role.name));
+        if (!recovery)
+            continue;
+        const paths = ['agent', 'owner']
+            .map(name => `${name}=${recovery.paths[name].state}`)
+            .join(', ');
+        checks.push({
+            name: `daemon recovery: ${role.name}`,
+            ok: recovery.state === 'recovered',
+            detail: `${recovery.state}; ${paths}; epoch ${recovery.epoch || 'unavailable'}`,
+        });
+    }
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
@@ -149,13 +163,13 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         const roleNames = new Set(roles.map(r => r.name));
         for (const t of templates) {
             const badRefs = t.members
-                .filter(m => m.role_ref && !roleNames.has(m.role_ref))
-                .map(m => m.role_ref);
+                .filter(m => 'ref' in m.agent && !roleNames.has(m.agent.ref))
+                .map(m => 'ref' in m.agent ? m.agent.ref : '');
             if (badRefs.length) {
                 checks.push({
                     name: `template: ${t.name}@${t.version}`,
                     ok: true,
-                    detail: `warning: role_ref(s) ${badRefs.join(', ')} not found in configured roles`,
+                    detail: `warning: Agent ref(s) ${badRefs.join(', ')} not found in configured Agents`,
                 });
             }
         }
@@ -226,13 +240,6 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
-    if (roles.length === 0 || roles.some(role => (role.session ?? 'tmux') === 'tmux')) {
-        const tmux = await exec('tmux', ['-V']);
-        checks.push({
-            name: 'tmux', ok: tmux.code === 0,
-            detail: tmux.code === 0 ? tmux.stdout.trim() : 'not found — apt install tmux / brew install tmux',
-        });
-    }
     try {
         const client = await attachDaemon({
             env: process.env,

package/dist/fleet-command-audit.d.ts

@@ -0,0 +1,160 @@
+export type FleetCommandDecision = 'allow' | 'deny' | 'unsupported';
+export type FleetCommandOutcomeClass = 'success' | 'validation' | 'denied' | 'runtime' | 'timeout' | 'proxy' | 'delivery';
+export declare class FleetCliExit extends Error {
+    readonly exitCode: number;
+    readonly outcomeClass: FleetCommandOutcomeClass;
+    readonly effect: 'not_started' | 'completed' | 'unknown';
+    constructor(exitCode: number, outcomeClass?: FleetCommandOutcomeClass, effect?: 'not_started' | 'completed' | 'unknown');
+}
+export type FleetAuditPresentation = {
+    kind: 'agent_started';
+    eventId: string;
+    id: string;
+    name: string;
+    lifetime: 'permanent' | 'temporary';
+    brain: string;
+    role: string;
+    harness: string;
+    session: 'acp';
+    model?: string;
+    permissions?: string;
+    parent: string;
+    actionId: string;
+    inherited: string[];
+} | {
+    kind: 'task';
+    operation: 'create' | 'start' | 'work' | 'block' | 'unblock' | 'review' | 'done' | 'cancel' | 'finish' | 'delete' | 'settling';
+    eventId: string;
+    id: string;
+    title?: string;
+    previousState?: string;
+    newState: string;
+    template?: string;
+    roomId?: string;
+    revision?: string;
+    list?: string;
+    agents: Array<{
+        name: string;
+        brain?: string;
+        role: string;
+        permissions?: string;
+    }>;
+} | {
+    kind: 'room';
+    operation: 'create' | 'activate' | 'close' | 'delete';
+    eventId: string;
+    id: string;
+    previousState?: string;
+    newState: string;
+    revision?: string;
+    name?: string;
+    template?: string;
+    taskId?: string;
+    participants: Array<{
+        name: string;
+        id?: string;
+        brain?: string;
+        role: string;
+        permissions?: string;
+    }>;
+} | {
+    kind: 'lifecycle_failure';
+    eventId: string;
+    resource: 'Agent' | 'Task' | 'Room';
+    id: string;
+    state: string;
+    category: 'provision_failed' | 'provision_pending' | 'readiness_failed' | 'settlement_failed' | 'settlement_pending' | 'cleanup_failed' | 'cleanup_pending';
+};
+/** Commands are Owner-silent unless they record one of these semantic lifecycle kinds. */
+export declare const FLEET_LIFECYCLE_EVENT_KINDS: readonly ["agent_started", "task", "room", "lifecycle_failure"];
+/** Stable semantic dedupe basis: resource kind + stable resource ID + transition/action ID. */
+export declare function lifecycleEventDigestBasis(value: FleetAuditPresentation): string;
+export declare function beginFleetAuditCollection(): void;
+export declare function recordFleetAuditResource(kind: 'agent' | 'task' | 'room', id: string | undefined): void;
+type FleetAuditPresentationInput = FleetAuditPresentation extends infer T ? T extends FleetAuditPresentation ? Omit<T, 'eventId'> & {
+    eventId?: string;
+} : never : never;
+export declare function recordFleetAuditPresentation(value: FleetAuditPresentationInput): void;
+export declare function recordFleetAuditFailure(failure: {
+    class: FleetCommandOutcomeClass;
+    effect: 'not_started' | 'completed' | 'unknown';
+}): void;
+export declare function consumeFleetAuditCollection(): {
+    resourceIds?: Record<string, string>;
+    presentations?: FleetAuditPresentation[];
+    failure?: {
+        class: FleetCommandOutcomeClass;
+        effect: 'not_started' | 'completed' | 'unknown';
+    };
+};
+export interface FleetCommandClassification {
+    command: string;
+    route: string;
+    decision: FleetCommandDecision;
+}
+export interface FleetAuditAttempt {
+    version: 1;
+    correlationId: string;
+    requestId: string;
+    caller: string;
+    invokedAt: string;
+    classification: FleetCommandClassification;
+    argv: string[];
+    invocation: 'sending' | 'delivered' | 'uncertain';
+    outcome?: {
+        completedAt: string;
+        class: FleetCommandOutcomeClass;
+        exitCode?: number;
+        effect: 'not_started' | 'completed' | 'unknown';
+        delivery: 'sending' | 'delivered' | 'uncertain';
+        resourceIds?: Record<string, string>;
+        presentations?: FleetAuditPresentation[];
+    };
+}
+export declare const fleetProxyCommandInventory: Readonly<{
+    [k: string]: string[];
+}>;
+export declare const fleetProxyTopLevelInventory: Readonly<{
+    safeRead: string[];
+    agent: string[];
+    public: string[];
+    denied: string[];
+    hidden: string[];
+    aliases: string[];
+}>;
+/** Classify before Commander parsing. Unknown and internal paths fail closed. */
+export declare function classifyFleetArgv(argv: readonly string[]): FleetCommandClassification;
+/** Faithful ordered argv with deterministic structural redaction. */
+export declare function redactFleetArgv(argv: readonly string[]): string[];
+/** Durable write-once attempt ledger; contains redacted argv only. */
+export declare class FleetCommandAuditStore {
+    private readonly path;
+    private readonly deps;
+    private attempts;
+    constructor(path: string, deps?: {
+        now(): Date;
+        uuid(): string;
+    });
+    list(): readonly FleetAuditAttempt[];
+    begin(requestId: string, caller: string, argv: readonly string[]): FleetAuditAttempt;
+    invocation(correlationId: string, caller: string, delivery: 'delivered' | 'uncertain'): FleetAuditAttempt;
+    finish(correlationId: string, caller: string, outcome: Omit<NonNullable<FleetAuditAttempt['outcome']>, 'completedAt' | 'delivery'>): FleetAuditAttempt;
+    outcome(correlationId: string, caller: string, delivery: 'delivered' | 'uncertain'): FleetAuditAttempt;
+    private owned;
+    private persist;
+}
+export declare function validateFleetAuditBegin(value: unknown): asserts value is {
+    requestId: string;
+    argv: string[];
+};
+export declare function validateFleetAuditFinish(value: unknown): asserts value is {
+    correlationId: string;
+    class: FleetCommandOutcomeClass;
+    exitCode?: number;
+    effect: 'not_started' | 'completed' | 'unknown';
+    resourceIds?: Record<string, string>;
+    presentations?: FleetAuditPresentation[];
+};
+/** Compact Owner presentation. It intentionally has no command, argv, environment, or correlation data. */
+export declare function renderFleetLifecycleEvent(value: FleetAuditPresentation): string;
+export {};