@ours.network/fleet 1.1.0-nightly.1 → 1.1.0-nightly.2

package/README.md

@@ -19,10 +19,10 @@ turns such sessions into **roles**: long-lived agents that
 - can **spawn subagents** (permanent or temporary) and **oversee** them: peek into
   a ward's console, answer a stuck prompt, nudge it back to work.
 
-The whole fleet is described in one hand-written `~/fleet.yaml`
-("docker-compose for agents"): who exists, what harness they run in, their mission,
-persona, bio, working directory, and who oversees whom. `ours-fleet up` makes
-reality match the file.
+The fleet uses a v2 manifest plus typed documents: `~/fleet.yaml` holds
+fleet-wide operational policy and automation, while `~/fleet/agents`,
+`~/fleet/roles`, and `~/fleet/brains` hold bare Agent, Role, and Brain documents.
+`ours-fleet up` makes reality match that trusted split source set.
 
 **Harness-agnostic by design.** The core never assumes a specific agent CLI; each
 harness is a small adapter (how to launch, how to resume, how to wire config).
@@ -31,17 +31,19 @@ public — each additional harness (Gemini CLI, OpenCode, …) is a small adapte
 A single fleet can mix harnesses per role:
 
 ```yaml
-roles:
-  Reviewer:                 # runs in Claude Code
-    harness: claude-code
-  Prototyper:                # runs in Codex CLI
-    harness: codex
+# ~/fleet/agents/Reviewer.yaml
+role: { ref: reviewer }
+brain: { inline: { harness: claude-code, session: acp } }
+
+# ~/fleet/agents/Prototyper.yaml
+role: { inline: { mission: Build prototypes } }
+brain: { inline: { harness: codex, session: acp } }
 ```
 
 ## How it works
 
 ```
-~/fleet.yaml + ~/fleet.d/*.yaml           your declaration
+~/fleet.yaml + ~/fleet/{agents,roles,brains}/*.yaml   your declaration
         │  ours-fleet up
         ▼
 briefing.md per role  ──►  agent session adapter  ──►  ACP client/session  ──►  ACP agent
@@ -105,8 +107,9 @@ become that account and repeat.
 ## Quickstart
 
 ```sh
+cp -R "$(npm root -g)/@ours.network/fleet/examples/fleet" ~/fleet
 cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
-$EDITOR ~/fleet.yaml          # name your roles, missions, personas
+$EDITOR ~/fleet/agents/*.yaml # compose Role + Brain and operational settings
 ours-fleet up                 # boot the fleet (staggered)
 ours-fleet ls                 # running consoles
 ours-fleet attach Alice       # watch one live (Ctrl-b d to leave)
@@ -252,27 +255,19 @@ Security boundaries:
 - tests use temporary fleet homes and fake supervisors/identity providers—never
   active role state.
 
-Permanent spawns are written to `~/fleet.d/<Name>.yaml`; the CLI never edits your
-hand-written `~/fleet.yaml`. `ours-fleet rm <Name>` unspawns.
-
-The web console is the one writer that can touch the base file, and it saves the
-file as a whole document: its setup wizard and configuration editor may create,
-change or remove any top-level block, including `vars:`, `defaults:`, `roles:`,
-`watchdogs:` and `loops:`. (`defaults:`, `watchdogs:` and `loops:` can only live
-in the base file — a `~/fleet.d/*.yaml` drop-in may declare `roles:` and nothing
-else.) Top-level keys the console does not recognise are round-tripped untouched.
-
-Console edits are applied as surgical splices against the file's exact bytes, so
-an unchanged save is a byte-for-byte no-op and lines outside the edit keep their
-comments, spacing and quoting. One bounded exception: changing the *length* of a
-block sequence — adding or removing an entry under `watch:`, `oversee:`, `roles:`
-or `wake_sources:` — rewrites that one collection as a whole, which drops inline
-comments written on its individual items. The loss is confined to the collection
-you edited, is shown in the diff before anything is written, and can be declined
-by not saving. Each write is revision-guarded, reviewed as a diff of the real
-file, validated with the real loader, and preceded by a timestamped backup.
-Values under `env:` — and the `vars:` entries they interpolate — are masked in
-the diff and never leave the host.
+Permanent spawns write a bare Agent document to
+`~/fleet/agents/<Name>.yaml`; generated-source ownership is recorded so removal
+never deletes an unproven hand-written neighbor. `ours-fleet rm <Name>` unspawns.
+
+The web editor reads and writes the split document model explicitly as
+`{manifest, agents}`. Role and Brain presets are visible through Agent refs but
+remain read-only. Saves use one aggregate revision over the manifest and all
+Agent/Role/Brain sources, validate an exact-stem private staging tree, show a
+deterministic redacted diff per document, and hold one manifest-root lock.
+Changed/deleted files are backed up together; any partial failure restores every
+document or reports the private recovery directory. An unchanged save is a
+byte-for-byte no-op and creates no backup. Nested environment, authentication,
+invite, and isolation secrets never leave the host.
 
 From inside Claude Code, Codex, or Hermes with the core `ours` plugin installed,
 say **"spawn an ours agent …"**. The core skill checks for `ours-fleet`, installs
@@ -290,16 +285,16 @@ ours-fleet peek Worker          # what is it doing?
 ours-fleet send Worker "continue with the tests, then report"
 ```
 
-Declare standing assignments in `fleet.yaml` (rendered into the overseer's
+Declare standing assignments in the overseer's bare Agent document (rendered into its
 briefing) — or just write "keep an eye on Alice and Bob every 5 minutes" in a
 persona; the bundled `oversee-agents` skill defines what that means operationally:
 
 ```yaml
-roles:
-  FleetCoordinator:
-    oversee:
-      - { role: Alice, interval: 5m }
-      - { role: Bob,   interval: 5m }
+role: { ref: coordinator }
+brain: { ref: claude-default }
+oversee:
+  - { agent: Alice, interval: 5m }
+  - { agent: Bob,   interval: 5m }
 ```
 
 ## Command reference
@@ -342,28 +337,30 @@ in its state dir) across supervisor-triggered restarts — systemd/launchd re-in
 agent process with no arguments, so without this the role would silently fall back to
 the default `~/fleet.yaml` on its very first crash-restart and fail to resolve.
 
-## fleet.yaml reference
+## split configuration field reference
 
-```yaml
+The following is a schematic field inventory, not a single YAML document. Host
+settings belong in `~/fleet.yaml`; reusable behavior and harness settings belong
+in `~/fleet/roles/<id>.yaml` and `~/fleet/brains/<id>.yaml`; operational fields
+belong in `~/fleet/agents/<id>.yaml`.
+
+```text
 vars: { work_root: /home/me/work }      # ${var} substitution anywhere below
+api_version: ours.network/fleet/v2
 start_stagger_ms: 0                     # delay between agent LAUNCHES (host-wide, ms); 0 = no stagger
 defaults:
-  harness: claude-code                  # for roles that don't set one
-  session: acp                          # supported Fleet↔agent session path
   permissions:                         # common intent, translated by each harness/backend
     approval: ask                       # ask | auto | allow (`deny` is a deprecated alias)
     filesystem: workspace               # read-only | workspace | unrestricted
     unattended: deny                    # deny | wait
-  model: claude-fable-5                 # default model for roles that don't set one (per-role model / --model wins)
-  max_tokens: 500000                    # session cap (harness-interpreted)
   monitor:
     mode: fleet                         # fleet (default) | native
   worklog:                              # built-ins shown; set false to opt out
     max_kb: 1024                        # rotate only above this active-log size
     keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
     max_archives: 12                    # recent beside log; older preserved cold
-roles:
-  Name:                                 # [A-Za-z0-9_-]+
+Agent document:
+  Name:                                 # filename stem; [A-Za-z0-9_-]+
     harness: claude-code
     session: acp                         # optional; ACP is the only supported session
     session_options:
@@ -400,7 +397,7 @@ roles:
     bio: |                              # public card (published as bio)
     briefing_file: curated.md           # replaces the generated narrative
     env: { KEY: value }                 # extra session env
-    oversee: [{ role: X, interval: 5m }]
+    oversee: [{ agent: X, interval: 5m }]
     harness_options:                    # adapter-owned, adapter-validated
       plugins: { "name@marketplace": false }   # claude-code: plugin overrides
       # mem_palace: false                      # claude-code: disable memory plugin
@@ -438,13 +435,12 @@ loops:                                    # trusted local scheduled ACP turns
       If nothing material changed, complete silently without an owner report.
 ```
 
-Merge order: `fleet.yaml` ← `fleet.d/*.yaml`; a duplicate role name is a hard
-error naming both files. Identities and roles are decoupled — removing a role
-never deletes an identity. `session` is ACP-backed for both supported harnesses.
-`defaults.harness_options` is shallow-merged with each
-role's `harness_options`, so a fleet can set common Codex permission/profile defaults
-and override individual keys per role. `monitor` merges the same way — a role block
-overrides `defaults.monitor` key-by-key.
+The v2 loader reads the manifest, then sorted bare Role, Brain, and Agent
+documents from its exact stem directory. Duplicate filename-derived IDs are a
+hard error. Identities and Agents are decoupled—removing an Agent never deletes
+an identity. Role, Brain, and operational ownership are composed explicitly;
+there is no generic cross-kind merge. Manifest operational defaults such as
+`monitor` and `permissions` merge only within their owning Agent fields.
 
 Every supervised role is a client of the operator-configured ours daemon. Fleet strips the
 obsolete, presence-sensitive `OURS_AUTOSTART` variable from ACP harness
@@ -1037,27 +1033,22 @@ the structured CLI watcher, because a detached process cannot wake a Codex turn.
 wait is re-entered after each handled message; `ours-codex` instead wakes the idle
 session through its App Server integration.
 
-The main Codex controls needed by fleet roles are available declaratively and when spawning:
+The main Codex controls are Brain-owned and also available when spawning:
 
 ```yaml
-defaults:
-  harness: codex
-  model: gpt-5.4
-  harness_options:
-    launcher: auto
-    profile: fleet                 # $CODEX_HOME/fleet.config.toml
-    sandbox: workspace-write
-    approval: on-request
-    monitor: true                  # consent for Codex's native monitor; not the wake-owner selector
-    search: true
-    add_dirs: [/data/shared]
-    config:
-      model_reasoning_effort: high
-
-roles:
-  Reviewer:
-    harness_options:
-      sandbox: read-only           # overrides just this default key
+# ~/fleet/brains/codex-review.yaml
+harness: codex
+session: acp
+model: gpt-5.4
+harness_options:
+  launcher: auto
+  profile: fleet
+  sandbox: read-only
+  approval: on-request
+  monitor: true
+  search: true
+  add_dirs: [/data/shared]
+  config: { model_reasoning_effort: high }
 ```
 
 Equivalent one-off/permanent spawn controls include `--model`, `--permission-mode`,

package/dist/application/role-creation-service.js

@@ -10,6 +10,7 @@ import { FleetError, normalizeError } from './errors.js';
 import { inheritCallerSpawnDefaults } from '../fleet-proxy.js';
 import { effectivePermissionMode } from '../permissions.js';
 import { effectiveRoleModel } from '../model-env.js';
+import { getAdapter } from '../harness/registry.js';
 import { claudeModelCatalog, codexModelCatalog, } from './model-catalog.js';
 const canonical = (value) => {
     if (Array.isArray(value))
@@ -315,8 +316,14 @@ export class RoleCreationService {
             throw new FleetError('invalid_request', 'unsupported lifetime');
         bounded(input.model ?? undefined, 'model', 128);
         bounded(input.reasoningEffort ?? undefined, 'reasoning effort', 16);
-        if (input.reasoningEffort != null && !['low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(input.reasoningEffort))
-            throw new FleetError('invalid_request', 'unsupported reasoning effort');
+        if (input.reasoningEffort != null) {
+            try {
+                getAdapter(input.harness).agentSession.resolveBrain({ effort: input.reasoningEffort });
+            }
+            catch (error) {
+                throw new FleetError('invalid_request', error.message);
+            }
+        }
         bounded(input.mission, 'mission', 4_096);
         bounded(input.coordinator, 'coordinator', 128);
         bounded(input.bio, 'bio', 8_192);

package/dist/application/role-removal-service.js

@@ -4,6 +4,7 @@ import { loadConfig, ROLE_NAME_RE } from '../config.js';
 import { agentDir, stateRoot } from '../paths.js';
 import { rmRole } from '../ops.js';
 import { FleetError } from './errors.js';
+import { provesGeneratedAgentSource } from '../generated-agent-source.js';
 export class RoleRemovalService {
     options;
     constructor(options) {
@@ -45,8 +46,9 @@ export class RoleRemovalService {
             `Stop and uninstall the exact backend registration for '${requested}'.`,
             `Archive then remove ${lifetime === 'temporary' ? temporaryState : permanentState}.`,
         ];
-        if (role?.sourceFile.includes('/fleet.d/'))
-            effects.push(`Remove spawned configuration ${role.sourceFile}.`);
+        const generatedSource = role && provesGeneratedAgentSource(agentDir(requested), cfg.files[0], role.sourceFile);
+        if (generatedSource)
+            effects.push(`Remove generated Agent configuration ${role.sourceFile}.`);
         else if (role)
             effects.push(`Keep hand-written configuration ${role.sourceFile}; the role can be recreated from it.`);
         else
@@ -76,7 +78,8 @@ export class RoleRemovalService {
         mkdirSync(recoveryPath, { recursive: true, mode: 0o700 });
         if (existsSync(sourceState))
             cpSync(sourceState, join(recoveryPath, 'state'), { recursive: true });
-        if (role?.sourceFile.includes('/fleet.d/') && existsSync(role.sourceFile))
+        if (role && provesGeneratedAgentSource(agentDir(preview.role), cfg.files[0], role.sourceFile)
+            && existsSync(role.sourceFile))
             cpSync(role.sourceFile, join(recoveryPath, basename(role.sourceFile)));
         if (role || preview.lifetime === 'temporary')
             await rmRole(cfg, preview.role, this.options.ops);

package/dist/application/types.d.ts

@@ -18,7 +18,7 @@ export interface ResolvedRoleView {
         sandbox?: string;
     };
     oversee?: Array<{
-        role: string;
+        agent: string;
         interval: string;
     }>;
 }

package/dist/briefing.js

@@ -196,12 +196,12 @@ export function generateBriefing(role, v, opts) {
         L.push('', '## Oversight assignments');
         L.push('These agents are your wards — you keep them unstuck:');
         for (const o of role.oversee)
-            L.push(`- **${o.role}** — check every ${o.interval}`);
+            L.push(`- **${o.agent}** — check every ${o.interval}`);
         L.push('');
         L.push('Procedure (see also the oversee-agents skill if available). On each tick, for each ward');
         L.push('run BOTH — they answer different questions:');
         for (const o of role.oversee)
-            L.push(`\`ours-fleet status ${o.role}\` then \`ours-fleet peek ${o.role}\``);
+            L.push(`\`ours-fleet status ${o.agent}\` then \`ours-fleet peek ${o.agent}\``);
         L.push('');
         L.push('**One console command is not a liveness verdict.** A `peek` or `send` that fails tells');
         L.push('you what happened to YOUR REQUEST, and only one of its outcomes says the agent is gone.');

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.0-nightly.1",
-  "buildId": "bf3c406ba57c",
-  "commit": "10d6da8bfd9903d216bce80a9ef89a42c282f8d9",
+  "version": "1.1.0-nightly.2",
+  "buildId": "da774e6be6b1",
+  "commit": "f8890b0449f4142a0c27a195e1351555fe599186",
   "dirty": true,
-  "builtAt": "2026-08-30T07:44:27.551Z",
+  "builtAt": "2026-08-30T15:08:00.155Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.js

@@ -6,11 +6,12 @@ import { join as joinPath, resolve as resolvePath } from 'node:path';
 import { createInterface } from 'node:readline';
 import { Command } from 'commander';
 import { VERSION } from './version.js';
+import { INIT_COMPLETION_GUIDANCE } from './init-guidance.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, runningLabel, } from './provenance.js';
 import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir } from './paths.js';
 import { findRole, loadConfig } from './config.js';
 import { formatDuration } from './duration.js';
-import { resolvedPlan } from './resolved-plan.js';
+import { redactSensitive, resolvedPlan } from './resolved-plan.js';
 import { pickBackend } from './supervisor/index.js';
 import { up, down } from './ops.js';
 import { readRestartLedger, runSupervised, runTemp } from './runner.js';
@@ -76,7 +77,7 @@ const program = new Command()
     .description('Fleet of persistent, identity-bound AI agents — selectable harnesses over ACP sessions.')
     .enablePositionalOptions()
     .version(VERSION);
-const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'config file (default: ~/fleet.yaml + ~/fleet.d/)');
+const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'manifest (default: ~/fleet.yaml; documents under ~/fleet/)');
 const collect = (value, previous) => [...previous, value];
 program.command('docs')
     .alias('man')
@@ -260,14 +261,16 @@ cOpt(program.command('config').description('validate + print the merged plan (no
                 console.log(`    cwd:         ${r.cwd}`);
             if (r.model)
                 console.log(`    model:       ${r.model}`);
+            if (r.effort)
+                console.log(`    effort:      ${r.effort}`);
             if (r.harness_options && Object.keys(r.harness_options).length)
-                console.log(`    options:     ${JSON.stringify(r.harness_options)}`);
+                console.log(`    options:     ${JSON.stringify(redactSensitive(r.harness_options))}`);
             if (r.coordinator)
                 console.log(`    coordinator: ${r.coordinator}`);
             if (r.mission)
                 console.log(`    mission:     ${r.mission.split('\n')[0]}`);
             if (r.oversee?.length)
-                console.log(`    oversees:    ${r.oversee.map(o => `${o.role}@${o.interval}`).join(', ')}`);
+                console.log(`    oversees:    ${r.oversee.map(o => `${o.agent}@${o.interval}`).join(', ')}`);
             if (r.isolation) {
                 const iso = r.isolation;
                 const caps = [
@@ -1253,7 +1256,7 @@ program.command('init').description('one-time host setup (units, dirs, linger)')
         mkdirSync(d, { recursive: true });
     for (const m of await pickBackend().init(binPath))
         console.log(m);
-    console.log('\nNext: copy examples/fleet.yaml to ~/fleet.yaml, edit, then: ours-fleet up');
+    console.log(INIT_COMPLETION_GUIDANCE);
 });
 const webCommand = cOpt(program.command('web').description('start or open the secure localhost fleet web console'))
     .enablePositionalOptions()

package/dist/config.d.ts

@@ -3,7 +3,7 @@ import type { IsolationConfig, WrapContext } from './isolation/types.js';
 import type { ResolvedWatchdog } from './watchdog/config.js';
 import type { ResolvedLoop, ResolvedRoleLoop } from './loops/config.js';
 export interface OverseeEntry {
-    role: string;
+    agent: string;
     interval: string;
 }
 export interface WorklogPolicy {
@@ -123,6 +123,8 @@ export interface RoleConfig {
     briefing_file?: string;
     /** Explicit null means use the selected harness's own default, bypassing fleet defaults. */
     model?: string | null;
+    /** Neutral Brain reasoning effort, retained for inspection after adapter translation. */
+    effort?: string;
     model_chain?: string[];
     max_tokens?: number;
     autocompact_pct?: number;
@@ -166,14 +168,37 @@ export interface ResolvedRole extends Omit<RoleConfig, 'model' | 'owner_channel'
     worklog?: WorklogPolicy;
     auth_proxy?: AuthProxyConfig;
     loops?: ResolvedRoleLoop[];
+    provenance?: Record<string, FieldProvenance>;
     /** Internal/transient: never accepted as a user-authored RoleConfig key. */
     roomMemberStartup?: RoomMemberStartup;
 }
+export interface FieldProvenance {
+    sourceFile: string;
+    sourcePointer: string;
+    sourceKind: 'Agent' | 'Role' | 'Brain' | 'Manifest' | 'built-in';
+    sourceId?: string;
+    origin: 'explicit' | 'typed-default' | 'built-in';
+    viaReference?: {
+        sourcePointer: string;
+        kind: 'Role' | 'Brain';
+        id: string;
+    };
+    transforms: Array<{
+        kind: 'substitution' | 'adapter-normalization' | 'validation-default';
+        detail: string;
+    }>;
+}
 export interface FleetConfig {
     roles: ResolvedRole[];
     vars: Record<string, string>;
     defaults: Record<string, unknown>;
     files: string[];
+    configMode?: 'split-v2';
+    sourceDocuments?: Array<{
+        kind: 'Manifest' | 'Agent' | 'Role' | 'Brain';
+        id?: string;
+        path: string;
+    }>;
     /** Fleet-wide delay (ms) enforced between agent launches to avoid boot bursts (0 = none). */
     startStaggerMs: number;
     /** Warning-first non-plain YAML migration diagnostics, in source order. */
@@ -204,7 +229,8 @@ export declare function resolveRoleModel(model: string | null | undefined, harne
  */
 export declare function isolationContextFor(role: ResolvedRole): WrapContext;
 export declare const ROLE_NAME_RE: RegExp;
-/** Load ~/fleet.yaml (or an explicit path) merged with ~/fleet.d/*.yaml drop-ins. */
+export declare function splitRootFor(base: string): string;
+/** Load a v2 manifest and bare Agent/Role/Brain documents from its stem directory. */
 export declare function loadConfig(configPath?: string, options?: {
     yamlMode?: YamlMode;
 }): FleetConfig;