@ours.network/fleet 1.0.5 → 1.1.0-nightly.2

package/README.md

@@ -8,8 +8,8 @@ harnesses — from one declarative file.**
 An AI coding agent in a terminal dies when you close the laptop. `ours-fleet`
 turns such sessions into **roles**: long-lived agents that
 
-- **run through a selectable session backend** — existing detached tmux consoles
-  or structured ACP sessions — which you can attach to, peek at, or prompt,
+- **run through structured ACP sessions** behind a shared Codex/Claude Code
+  agent-session interface, which you can inspect or prompt,
 - are **supervised** — systemd (Linux) or launchd (macOS) restarts them on crash
   and brings them back after a reboot,
 - **resume their context** across restarts (when the harness supports it),
@@ -19,10 +19,10 @@ turns such sessions into **roles**: long-lived agents that
 - can **spawn subagents** (permanent or temporary) and **oversee** them: peek into
   a ward's console, answer a stuck prompt, nudge it back to work.
 
-The whole fleet is described in one hand-written `~/fleet.yaml`
-("docker-compose for agents"): who exists, what harness they run in, their mission,
-persona, bio, working directory, and who oversees whom. `ours-fleet up` makes
-reality match the file.
+The fleet uses a v2 manifest plus typed documents: `~/fleet.yaml` holds
+fleet-wide operational policy and automation, while `~/fleet/agents`,
+`~/fleet/roles`, and `~/fleet/brains` hold bare Agent, Role, and Brain documents.
+`ours-fleet up` makes reality match that trusted split source set.
 
 **Harness-agnostic by design.** The core never assumes a specific agent CLI; each
 harness is a small adapter (how to launch, how to resume, how to wire config).
@@ -31,21 +31,22 @@ public — each additional harness (Gemini CLI, OpenCode, …) is a small adapte
 A single fleet can mix harnesses per role:
 
 ```yaml
-roles:
-  Reviewer:                 # runs in Claude Code
-    harness: claude-code
-  Prototyper:                # runs in Codex CLI
-    harness: codex
+# ~/fleet/agents/Reviewer.yaml
+role: { ref: reviewer }
+brain: { inline: { harness: claude-code, session: acp } }
+
+# ~/fleet/agents/Prototyper.yaml
+role: { inline: { mission: Build prototypes } }
+brain: { inline: { harness: codex, session: acp } }
 ```
 
 ## How it works
 
 ```
-~/fleet.yaml + ~/fleet.d/*.yaml           your declaration
+~/fleet.yaml + ~/fleet/{agents,roles,brains}/*.yaml   your declaration
         │  ours-fleet up
         ▼
-briefing.md per role  ──►  tmux session  ──►  harness CLI (claude …)
-                       └─►  ACP client   ──►  ACP agent (codex-acp …)
+briefing.md per role  ──►  agent session adapter  ──►  ACP client/session  ──►  ACP agent
         ▲                        │
  systemd --user / launchd ───────┘   restart on crash, start at boot/login
 ```
@@ -78,7 +79,6 @@ The state dir contract:
 | What | Why | Install |
 |---|---|---|
 | Node ≥ 20 | runs `ours-fleet` itself | nodejs.org, `apt`, or `brew` |
-| tmux | roles using `session: tmux` (the default) | `apt install tmux` / `brew install tmux` |
 | Node ≥ 22 | Claude roles using `session: acp` | required by the maintained Claude ACP adapter |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
 | `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
@@ -98,8 +98,8 @@ ours-fleet doctor    # verifies everything above, with actionable messages
 The maintained Codex and Claude ACP adapters install as optional dependencies of
 `ours-fleet` and are resolved internally; users do not install adapter commands
 or add them to `PATH`. An explicit `session_options.acp.command` remains
-available for custom adapters. On Node 20–21, tmux and Codex ACP remain
-available, while maintained Claude ACP requires upgrading to Node 22.
+available for custom adapters. On Node 20–21, Codex ACP remains available,
+while maintained Claude ACP requires upgrading to Node 22.
 
 Each OS user manages their own fleet — to host roles under a sandboxed account,
 become that account and repeat.
@@ -107,8 +107,9 @@ become that account and repeat.
 ## Quickstart
 
 ```sh
+cp -R "$(npm root -g)/@ours.network/fleet/examples/fleet" ~/fleet
 cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
-$EDITOR ~/fleet.yaml          # name your roles, missions, personas
+$EDITOR ~/fleet/agents/*.yaml # compose Role + Brain and operational settings
 ours-fleet up                 # boot the fleet (staggered)
 ours-fleet ls                 # running consoles
 ours-fleet attach Alice       # watch one live (Ctrl-b d to leave)
@@ -139,8 +140,8 @@ fleet monitor policy, and same-harness model inherit from the caller. Explicit
 flags win; changing harness without a model lets the selected harness/fleet
 defaults choose one. After creation succeeds, fleet can deterministically notify
 the caller's owner channel with the caller and spawned-role details. This is an
-honest-actor convenience and attribution path, not a security boundary; tmux,
-host shells, and deliberately bypassed absolute binaries retain direct behavior.
+honest-actor convenience and attribution path, not a security boundary; host
+shells and deliberately bypassed absolute binaries retain direct behavior.
 
 ## Local web console
 
@@ -209,8 +210,8 @@ offline shell and no stale fleet state.
 
 The console provides evidence-separated inventory and status, ACP activity and
 permission controls, redacted logs, typed text send, confirmed lifecycle
-actions, transactional permanent/temporary creation, and a shared tmux browser
-terminal. Identity is fixed to the role name. Creation uses the authenticated
+actions, and transactional permanent/temporary creation. Identity is fixed to
+the role name. Creation uses the authenticated
 daemon inventory and reports verified, missing, or unknown evidence. A missing
 permanent role identity is created deterministically before launch with local
 discovery and auto-accept enabled, then the provisioning lease is released so
@@ -243,41 +244,30 @@ never force-adopts or deletes identity state. Permanent roles are
 provisioned by fleet before launch and never delegate normal identity creation
 to the harness.
 
-`node-pty` is optional: if its native module cannot load, ACP and all
-non-terminal features remain available and tmux Terminal is disabled with a
-diagnostic.
+The web console uses structured ACP activity rather than exposing a raw agent terminal.
 
 Security boundaries:
 
 - configured `Host` and `Origin`, CSRF, one-time WebSocket tickets, and explicit
   bind/origin policy are enforced server-side;
 - cwd values must resolve beneath configured local roots;
-- terminal bytes are intentionally unredacted and are never copied into audit
-  records; normal logs are bounded and redacted;
-- tests use temporary fleet homes, fake supervisors/identity providers, and
-  isolated tmux sockets—never active role state.
-
-Permanent spawns are written to `~/fleet.d/<Name>.yaml`; the CLI never edits your
-hand-written `~/fleet.yaml`. `ours-fleet rm <Name>` unspawns.
-
-The web console is the one writer that can touch the base file, and it saves the
-file as a whole document: its setup wizard and configuration editor may create,
-change or remove any top-level block, including `vars:`, `defaults:`, `roles:`,
-`watchdogs:` and `loops:`. (`defaults:`, `watchdogs:` and `loops:` can only live
-in the base file — a `~/fleet.d/*.yaml` drop-in may declare `roles:` and nothing
-else.) Top-level keys the console does not recognise are round-tripped untouched.
-
-Console edits are applied as surgical splices against the file's exact bytes, so
-an unchanged save is a byte-for-byte no-op and lines outside the edit keep their
-comments, spacing and quoting. One bounded exception: changing the *length* of a
-block sequence — adding or removing an entry under `watch:`, `oversee:`, `roles:`
-or `wake_sources:` — rewrites that one collection as a whole, which drops inline
-comments written on its individual items. The loss is confined to the collection
-you edited, is shown in the diff before anything is written, and can be declined
-by not saving. Each write is revision-guarded, reviewed as a diff of the real
-file, validated with the real loader, and preceded by a timestamped backup.
-Values under `env:` — and the `vars:` entries they interpolate — are masked in
-the diff and never leave the host.
+- normal logs are bounded and redacted;
+- tests use temporary fleet homes and fake supervisors/identity providers—never
+  active role state.
+
+Permanent spawns write a bare Agent document to
+`~/fleet/agents/<Name>.yaml`; generated-source ownership is recorded so removal
+never deletes an unproven hand-written neighbor. `ours-fleet rm <Name>` unspawns.
+
+The web editor reads and writes the split document model explicitly as
+`{manifest, agents}`. Role and Brain presets are visible through Agent refs but
+remain read-only. Saves use one aggregate revision over the manifest and all
+Agent/Role/Brain sources, validate an exact-stem private staging tree, show a
+deterministic redacted diff per document, and hold one manifest-root lock.
+Changed/deleted files are backed up together; any partial failure restores every
+document or reports the private recovery directory. An unchanged save is a
+byte-for-byte no-op and creates no backup. Nested environment, authentication,
+invite, and isolation secrets never leave the host.
 
 From inside Claude Code, Codex, or Hermes with the core `ours` plugin installed,
 say **"spawn an ours agent …"**. The core skill checks for `ours-fleet`, installs
@@ -292,20 +282,19 @@ them and unsticks them:
 
 ```sh
 ours-fleet peek Worker          # what is it doing?
-ours-fleet send Worker --key 1  # answer the menu it's stuck on
 ours-fleet send Worker "continue with the tests, then report"
 ```
 
-Declare standing assignments in `fleet.yaml` (rendered into the overseer's
+Declare standing assignments in the overseer's bare Agent document (rendered into its
 briefing) — or just write "keep an eye on Alice and Bob every 5 minutes" in a
 persona; the bundled `oversee-agents` skill defines what that means operationally:
 
 ```yaml
-roles:
-  FleetCoordinator:
-    oversee:
-      - { role: Alice, interval: 5m }
-      - { role: Bob,   interval: 5m }
+role: { ref: coordinator }
+brain: { ref: claude-default }
+oversee:
+  - { agent: Alice, interval: 5m }
+  - { agent: Bob,   interval: 5m }
 ```
 
 ## Command reference
@@ -315,7 +304,7 @@ ours-fleet docs | man                 AI-friendly complete reference
 ours-fleet up|down|restart|force-restart [-c FILE] [Name...]
 ours-fleet config [-c FILE]         validate + print merged plan
 ours-fleet ls | attach | peek | logs [-f] | status <Name>
-ours-fleet send <Name> "text" | --key <K>
+ours-fleet send <Name> "text"
 ours-fleet spawn [--temp] [<Name> | --role <Name>] [--harness --session --mission --model --approval ...]
 ours-fleet loops validate|list|status
 ours-fleet loops reload <Role>
@@ -348,30 +337,32 @@ in its state dir) across supervisor-triggered restarts — systemd/launchd re-in
 agent process with no arguments, so without this the role would silently fall back to
 the default `~/fleet.yaml` on its very first crash-restart and fail to resolve.
 
-## fleet.yaml reference
+## split configuration field reference
 
-```yaml
+The following is a schematic field inventory, not a single YAML document. Host
+settings belong in `~/fleet.yaml`; reusable behavior and harness settings belong
+in `~/fleet/roles/<id>.yaml` and `~/fleet/brains/<id>.yaml`; operational fields
+belong in `~/fleet/agents/<id>.yaml`.
+
+```text
 vars: { work_root: /home/me/work }      # ${var} substitution anywhere below
+api_version: ours.network/fleet/v2
 start_stagger_ms: 0                     # delay between agent LAUNCHES (host-wide, ms); 0 = no stagger
 defaults:
-  harness: claude-code                  # for roles that don't set one
-  session: tmux                         # tmux (default) | acp
   permissions:                         # common intent, translated by each harness/backend
     approval: ask                       # ask | auto | allow (`deny` is a deprecated alias)
     filesystem: workspace               # read-only | workspace | unrestricted
     unattended: deny                    # deny | wait
-  model: claude-fable-5                 # default model for roles that don't set one (per-role model / --model wins)
-  max_tokens: 500000                    # session cap (harness-interpreted)
   monitor:
     mode: fleet                         # fleet (default) | native
   worklog:                              # built-ins shown; set false to opt out
     max_kb: 1024                        # rotate only above this active-log size
     keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
     max_archives: 12                    # recent beside log; older preserved cold
-roles:
-  Name:                                 # [A-Za-z0-9_-]+
+Agent document:
+  Name:                                 # filename stem; [A-Za-z0-9_-]+
     harness: claude-code
-    session: acp                         # one flag selects ACP; omit for tmux
+    session: acp                         # optional; ACP is the only supported session
     session_options:
       acp:
         command: claude-agent-acp        # optional advanced override
@@ -406,7 +397,7 @@ roles:
     bio: |                              # public card (published as bio)
     briefing_file: curated.md           # replaces the generated narrative
     env: { KEY: value }                 # extra session env
-    oversee: [{ role: X, interval: 5m }]
+    oversee: [{ agent: X, interval: 5m }]
     harness_options:                    # adapter-owned, adapter-validated
       plugins: { "name@marketplace": false }   # claude-code: plugin overrides
       # mem_palace: false                      # claude-code: disable memory plugin
@@ -444,17 +435,15 @@ loops:                                    # trusted local scheduled ACP turns
       If nothing material changed, complete silently without an owner report.
 ```
 
-Merge order: `fleet.yaml` ← `fleet.d/*.yaml`; a duplicate role name is a hard
-error naming both files. Identities and roles are decoupled — removing a role
-never deletes an identity. `session` is independent of `harness`, so changing a
-role from tmux to ACP does not change its identity, mission, monitor, or permission
-contract. `defaults.harness_options` is shallow-merged with each
-role's `harness_options`, so a fleet can set common Codex permission/profile defaults
-and override individual keys per role. `monitor` merges the same way — a role block
-overrides `defaults.monitor` key-by-key.
+The v2 loader reads the manifest, then sorted bare Role, Brain, and Agent
+documents from its exact stem directory. Duplicate filename-derived IDs are a
+hard error. Identities and Agents are decoupled—removing an Agent never deletes
+an identity. Role, Brain, and operational ownership are composed explicitly;
+there is no generic cross-kind merge. Manifest operational defaults such as
+`monitor` and `permissions` merge only within their owning Agent fields.
 
 Every supervised role is a client of the operator-configured ours daemon. Fleet strips the
-obsolete, presence-sensitive `OURS_AUTOSTART` variable from both tmux and ACP harness
+obsolete, presence-sensitive `OURS_AUTOSTART` variable from ACP harness
 processes. `ours-mcp proxy` is client-only and never starts a daemon; operators and explicit
 installer/setup flows remain responsible for starting it.
 
@@ -597,9 +586,7 @@ since a human can still attach a console and answer.
 `auto` selects Codex ACP `agent` (`on-request` + `workspace-write`) / Claude
 `acceptEdits`. `allow` selects Codex ACP's fully non-interactive yolo mode,
 reported by the adapter as `agent-full-access` (`never` +
-`danger-full-access`); Claude uses `bypassPermissions`. For Codex tmux, where the
-approval and sandbox flags remain independent, `auto` is `on-request` and
-`allow` is `never` while `filesystem` still chooses the sandbox.
+`danger-full-access`); Claude uses `bypassPermissions`.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
 `allow` role previously ran unable to do its job. Legacy `deny` is accepted
 only for compatibility and retains its conservative Codex `on-request` /
@@ -689,8 +676,8 @@ their boots ~4 s apart instead of firing all seven at once.
 With `monitor.mode: fleet` (the default), the **ours-fleet supervisor** delivers
 a role's mail wakes: the per-role runner long-polls the ours daemon's notification API and
 submits a single `[fleet-monitor] N new messages from … — run get_messages` prompt
-through the selected backend. ACP uses live steering when its adapter supports it
-and falls back to structured `session/prompt`; tmux uses verified console input.
+through the shared agent session. ACP uses live steering when its adapter supports it
+and falls back to structured `session/prompt`.
 Set `monitor.interrupt: true` on roles where every configured wake should cancel
 the active turn before the notification is delivered. This is intentionally
 content-blind: the supervisor cannot inspect encrypted message bodies, so all
@@ -700,8 +687,7 @@ tool result or pending permission. Fleet waits for terminal ACP tool/update
 evidence, then steers the wake without calling `session.cancel`. If the tool is
 still active after 120 seconds, or the adapter cannot expose authenticated tool
 boundaries/steering, fleet visibly degrades to non-cancelling steering or queued
-delivery. Tmux never receives `C-c` for `after_tool`. Explicit human and control
-interrupts remain immediate.
+delivery. Explicit human and control interrupts remain immediate.
 The default is `false`: a role that must begin a post-readiness mission
 immediately, including second-and-later mail received while it is working, must
 set `monitor.mode: fleet` and `monitor.interrupt: true` explicitly. Readiness and
@@ -794,8 +780,8 @@ invites, message bodies, credentials, or keys. A corrupt overlay fails closed
 (no effective owners and no mutation), and the last effective owner cannot be
 revoked.
 
-These commands require a running ACP role with `owner_channel` enabled. Missing,
-stopped, tmux, disabled, draining, and unavailable-MCP targets fail without
+These commands require a running role with `owner_channel` enabled. Missing,
+stopped, disabled, draining, and unavailable-MCP targets fail without
 starting a second client, binding an identity, or opening a network listener.
 
 The managed agent can use its ordinary ours `send_message` or `send_file` tool to
@@ -1015,11 +1001,8 @@ gets a durable pre-send marker: a failed/ambiguous send becomes `uncertain` and
 not blindly retried, while files not yet attempted remain recoverable after restart.
 Logs contain counts and byte totals, never filenames or raw bytes.
 
-Owner channels currently require `session: acp`. Fleet needs structured,
-turn-correlated assistant output for automatic replies; scraping a tmux pane
-cannot reliably distinguish the final answer from thoughts, tool output, or
-unrelated concurrent work. The config rejects tmux instead of silently offering
-weaker semantics.
+Owner channels use the structured agent-session interface for turn-correlated
+assistant output and reliable automatic replies.
 
 ## Codex roles
 
@@ -1050,27 +1033,22 @@ the structured CLI watcher, because a detached process cannot wake a Codex turn.
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
-The main Codex controls needed by fleet roles are available declaratively and when spawning:
+The main Codex controls are Brain-owned and also available when spawning:
 
 ```yaml
-defaults:
-  harness: codex
-  model: gpt-5.4
-  harness_options:
-    launcher: auto
-    profile: fleet                 # $CODEX_HOME/fleet.config.toml
-    sandbox: workspace-write
-    approval: on-request
-    monitor: true                  # consent for Codex's native monitor; not the wake-owner selector
-    search: true
-    add_dirs: [/data/shared]
-    config:
-      model_reasoning_effort: high
-
-roles:
-  Reviewer:
-    harness_options:
-      sandbox: read-only           # overrides just this default key
+# ~/fleet/brains/codex-review.yaml
+harness: codex
+session: acp
+model: gpt-5.4
+harness_options:
+  launcher: auto
+  profile: fleet
+  sandbox: read-only
+  approval: on-request
+  monitor: true
+  search: true
+  add_dirs: [/data/shared]
+  config: { model_reasoning_effort: high }
 ```
 
 Equivalent one-off/permanent spawn controls include `--model`, `--permission-mode`,
@@ -1083,7 +1061,7 @@ role-specific ours daemon, or configure the host default in `~/.ours/config.json
 
 Each role can be sandboxed at the environment level via an `isolation:` block —
 **fully additive: a role with no block behaves exactly as before.** The agent's
-tmux-pane process is wrapped in [bubblewrap](https://github.com/containers/bubblewrap)
+agent process is wrapped in [bubblewrap](https://github.com/containers/bubblewrap)
 (rootless, no setuid), resource-limited by `systemd-run --user --scope`.
 
 An empty `isolation: {}` gives a sensible default posture: filesystem-confined to

package/dist/application/capabilities.d.ts

@@ -1,6 +1,5 @@
 import type { RoleRecord, RoleCapabilities, RoleStatus } from './types.js';
 export interface CapabilityContext {
-    terminalPtyAvailable?: boolean;
     controlProtocolVersion?: number;
 }
 export declare function roleCapabilities(role: RoleRecord, status: RoleStatus, context?: CapabilityContext): RoleCapabilities;

package/dist/application/capabilities.js

@@ -1,30 +1,20 @@
 export function roleCapabilities(role, status, context = {}) {
-    const backend = role.configuredBackend ?? (role.detectedBackend === 'acp' || role.detectedBackend === 'tmux' ? role.detectedBackend : undefined);
+    const backend = role.configuredBackend ?? (role.detectedBackend === 'acp' ? 'acp' : undefined);
     const online = status.session.reachability === 'online';
     const acp = backend === 'acp';
-    const tmux = backend === 'tmux';
     const protocolVersion = context.controlProtocolVersion ?? 1;
     const inactive = status.overall === 'offline'
         || (!online && status.supervisor.liveness === 'stopped');
-    const terminalAvailable = tmux && online && context.terminalPtyAvailable === true;
-    const terminalReason = terminalAvailable ? undefined
-        : !tmux ? 'wrong_backend'
-            : !online ? 'offline'
-                : 'pty_unavailable';
     return {
         protocolVersion,
         inventory: true,
         status: true,
         output: {
-            recent: acp || tmux, stream: (acp && protocolVersion >= 2) || terminalAvailable,
+            recent: acp, stream: acp && protocolVersion >= 2,
             structured: acp, replayCursor: acp && protocolVersion >= 2,
         },
-        input: { text: online && (acp || tmux), rawKeys: terminalAvailable, interrupt: online && acp, steering: false },
+        input: { text: online && acp, interrupt: online && acp, steering: false },
         permissions: { observe: acp, respond: acp && online },
-        terminal: {
-            available: terminalAvailable, reason: terminalReason,
-            multiViewer: terminalAvailable, writerLease: terminalAvailable,
-        },
         lifecycle: {
             start: role.lifetime === 'permanent' && status.supervisor.liveness !== 'running',
             stop: role.lifetime === 'permanent' && !inactive && status.supervisor.liveness !== 'stopped',

package/dist/application/fleet-query-service.d.ts

@@ -1,13 +1,11 @@
 import type { SupervisorBackend } from '../supervisor/types.js';
 import { controlRequest } from '../session/control.js';
-import { Tmux } from '../tmux.js';
 import { type CapabilityContext } from './capabilities.js';
 import { RoleRepository } from './role-repository.js';
 import type { RoleCapabilities, RoleRecord, RoleStatus } from './types.js';
 export interface FleetQueryOptions {
     repository: RoleRepository;
     supervisor: SupervisorBackend;
-    tmux?: Tmux;
     control?: typeof controlRequest;
     capabilityContext?: CapabilityContext;
     /**
@@ -24,7 +22,6 @@ export interface FleetQueryOptions {
 }
 export declare class FleetQueryService {
     private readonly options;
-    private readonly tmux;
     private readonly control;
     constructor(options: FleetQueryOptions);
     list(): Promise<Array<{

package/dist/application/fleet-query-service.js

@@ -4,7 +4,6 @@ import { classifyActivity } from '../session/activity.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { readExitRecord, readRestartLedger } from '../runner.js';
-import { Tmux } from '../tmux.js';
 import { roleCapabilities } from './capabilities.js';
 import { FleetError } from './errors.js';
 const clean = (value, max = 512) => value.replace(/[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').trim().slice(0, max);
@@ -50,7 +49,7 @@ function sessionOverall(supervisor, session, restart, monitor, isolation, proble
         || problems.some(problem => problem.severity === 'error' || problem.source === 'watchdog')
         || session.readiness === 'failed')
         return 'attention';
-    // A reachable ACP/tmux session is the user's live interaction surface. Its
+    // A reachable agent session is the user's live interaction surface. Its
     // evidence remains authoritative even when a service manager no longer owns
     // the process (for example, a detached ACP session with an inactive unit).
     if (session.reachability === 'online'
@@ -69,11 +68,9 @@ function sessionOverall(supervisor, session, restart, monitor, isolation, proble
 }
 export class FleetQueryService {
     options;
-    tmux;
     control;
     constructor(options) {
         this.options = options;
-        this.tmux = options.tmux ?? new Tmux();
         this.control = options.control ?? controlRequest;
     }
     async list() {
@@ -174,26 +171,6 @@ export class FleetQueryService {
                 };
             }
         }
-        if (intended === 'tmux' || role.detectedBackend === 'tmux') {
-            try {
-                const has = await this.tmux.has(role.id);
-                return {
-                    backend: 'tmux', reachability: has ? 'online' : supervisor === 'stopped' ? 'offline' : 'unknown',
-                    readiness: has ? 'idle' : supervisor === 'running' ? 'starting' : 'failed',
-                    evidence: 'inferred',
-                    // tmux exposes no agent-side evidence at all, and `readiness: idle`
-                    // here is a pane-liveness inference, not an activity claim.
-                    activity: { state: 'unobservable' },
-                };
-            }
-            catch (error) {
-                return {
-                    backend: 'tmux', reachability: 'unknown', readiness: 'unknown',
-                    evidence: 'inferred', lastError: clean(error.message),
-                    activity: { state: 'unobservable' },
-                };
-            }
-        }
         return {
             backend: 'unknown', reachability: supervisor === 'stopped' ? 'offline' : 'unknown',
             readiness: supervisor === 'stopped' ? 'failed' : 'unknown', evidence: 'inferred',

package/dist/application/role-creation-service.d.ts

@@ -12,7 +12,7 @@ export interface CreateRoleSessionRequest {
     /** null means the selected harness's own default; web blank fields send null. */
     model?: string | null;
     reasoningEffort?: string | null;
-    session: 'acp' | 'tmux';
+    session: 'acp';
     cwd?: string;
     lifetime: 'permanent' | 'temporary';
     mission?: string;
@@ -41,7 +41,7 @@ export interface CreationCapabilities {
     harnesses: Array<{
         id: 'codex' | 'claude-code';
         available: boolean;
-        sessions: Array<'acp' | 'tmux'>;
+        sessions: Array<'acp'>;
         defaultModel?: string;
         models: string[];
         modelOptions: HarnessModelOption[];
@@ -71,7 +71,7 @@ export interface CreationPreview {
         name: string;
         identity: string;
         harness: string;
-        session: 'acp' | 'tmux';
+        session: 'acp';
         model?: string;
         reasoningEffort?: string;
         cwd?: string;
@@ -95,7 +95,7 @@ export interface CreationAction {
     actionId: string;
     requestHash: string;
     roleId: string;
-    session: 'acp' | 'tmux';
+    session: 'acp';
     lifetime: 'permanent' | 'temporary';
     state: CreationStage;
     stages: Array<{
@@ -121,7 +121,7 @@ export interface RoleCreationServiceOptions {
     tempLauncher?: SupervisorLauncher;
     allowedCwdRoots?: string[];
     journalDir?: string;
-    probeReady?: (name: string, session: 'acp' | 'tmux') => Promise<'ready' | 'attention' | 'unknown'>;
+    probeReady?: (name: string, session: 'acp') => Promise<'ready' | 'attention' | 'unknown'>;
     onProgress?: (action: CreationAction) => void;
     modelCatalogs?: Partial<Record<'codex' | 'claude-code', () => HarnessModelCatalog>>;
     /** Direct/managed callers must not create or restore the web action journal. */

package/dist/application/role-creation-service.js

@@ -10,6 +10,7 @@ import { FleetError, normalizeError } from './errors.js';
 import { inheritCallerSpawnDefaults } from '../fleet-proxy.js';
 import { effectivePermissionMode } from '../permissions.js';
 import { effectiveRoleModel } from '../model-env.js';
+import { getAdapter } from '../harness/registry.js';
 import { claudeModelCatalog, codexModelCatalog, } from './model-catalog.js';
 const canonical = (value) => {
     if (Array.isArray(value))
@@ -109,13 +110,13 @@ export class RoleCreationService {
             reasons,
             harnesses: [
                 {
-                    id: 'codex', available: true, sessions: ['acp', 'tmux'],
+                    id: 'codex', available: true, sessions: ['acp'],
                     defaultModel: resolveRoleModel(undefined, 'codex', defaults),
                     ...codexModels, catalogSource: 'codex-runtime-catalog', customModelAllowed: true,
                     warnings: codexCatalog.warnings,
                 },
                 {
-                    id: 'claude-code', available: true, sessions: ['acp', 'tmux'],
+                    id: 'claude-code', available: true, sessions: ['acp'],
                     defaultModel: resolveRoleModel(undefined, 'claude-code', defaults),
                     ...claudeModels, catalogSource: 'claude-adapter-2.1', customModelAllowed: true,
                     warnings: claudeCatalog.warnings,
@@ -149,7 +150,7 @@ export class RoleCreationService {
         const effective = {
             name: request.name, identity: request.name,
             harness: request.harness ?? defaults.harness ?? 'claude-code',
-            session: request.session ?? defaults.session ?? 'tmux',
+            session: request.session ?? defaults.session ?? 'acp',
             model: resolveRoleModel(request.model, request.harness, defaults),
             reasoningEffort: request.reasoningEffort ?? undefined,
             cwd, lifetime: request.lifetime,
@@ -264,9 +265,7 @@ export class RoleCreationService {
             this.stage(action, 'waiting_for_session');
             const ready = await this.waitForReady(action.roleId, action.session);
             if (ready === 'ready') {
-                action.openPath = action.session === 'acp'
-                    ? `/roles/${encodeURIComponent(action.roleId)}/activity`
-                    : `/roles/${encodeURIComponent(action.roleId)}/terminal`;
+                action.openPath = `/roles/${encodeURIComponent(action.roleId)}/activity`;
                 this.stage(action, 'session_reachable', 'session is reachable; identity binding has no structured evidence in this version');
             }
             else if (ready === 'attention') {
@@ -311,14 +310,20 @@ export class RoleCreationService {
             throw new FleetError('invalid_request', 'invalid role name');
         if (!['codex', 'claude-code'].includes(input.harness))
             throw new FleetError('invalid_request', 'unsupported harness');
-        if (!['acp', 'tmux'].includes(input.session))
+        if (input.session !== 'acp')
             throw new FleetError('invalid_request', 'unsupported session backend');
         if (!['permanent', 'temporary'].includes(input.lifetime))
             throw new FleetError('invalid_request', 'unsupported lifetime');
         bounded(input.model ?? undefined, 'model', 128);
         bounded(input.reasoningEffort ?? undefined, 'reasoning effort', 16);
-        if (input.reasoningEffort != null && !['low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(input.reasoningEffort))
-            throw new FleetError('invalid_request', 'unsupported reasoning effort');
+        if (input.reasoningEffort != null) {
+            try {
+                getAdapter(input.harness).agentSession.resolveBrain({ effort: input.reasoningEffort });
+            }
+            catch (error) {
+                throw new FleetError('invalid_request', error.message);
+            }
+        }
         bounded(input.mission, 'mission', 4_096);
         bounded(input.coordinator, 'coordinator', 128);
         bounded(input.bio, 'bio', 8_192);