@ours.network/fleet 1.1.0-nightly.12 → 1.1.0-nightly.13

package/dist/rooms-tasks/task-state.js

@@ -116,6 +116,15 @@ function assertNoPendingTerminalIntent(task) {
         throw new TaskStateError(`task ${task.task_id} has a pending '${task.terminal_intent.kind}' terminal intent`);
     }
 }
+/**
+ * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
+ * mutation, terminal settlement, and room publication must fail boundedly.
+ */
+export function assertNoPendingDeletion(task) {
+    if (task.deletion?.status === 'pending') {
+        throw new TaskStateError(`task ${task.task_id} is pending deletion; run 'ours-fleet task delete ${task.task_id} ${task.task_id}' to retry cleanup`);
+    }
+}
 export function createTask(input) {
     const key = input.idempotency_key ?? randomUUID();
     const existing = findByIdempotencyKey(key);
@@ -151,6 +160,7 @@ export function getTask(id) { return withTaskLock(id, () => readTask(id)); }
 export function updateTaskExecutionPlan(id, executionPlan) {
     return withTaskLock(id, () => {
         const task = readTask(id);
+        assertNoPendingDeletion(task);
         if (task.execution_plan && task.execution_plan.plan_hash !== executionPlan.plan_hash)
             throw new TaskStateError(`task ${id} execution plan mismatch`);
         task.execution_plan = executionPlan;
@@ -172,6 +182,8 @@ export function listTasks(filter) {
         try {
             const id = f.slice(0, -5);
             const t = withTaskLock(id, () => presentTask(JSON.parse(readFileSync(join(dir, f), 'utf8'))));
+            if (t.deletion?.status === 'pending' && !filter?.includeDeleting)
+                continue;
             if ((!states || states.includes(t.state)) && (!filter?.listId || t.list_id === filter.listId))
                 tasks.push(t);
         }
@@ -184,6 +196,7 @@ export function listTasks(filter) {
 export function moveTaskToList(id, listId) {
     return withTaskLock(id, () => {
         const task = readTask(id);
+        assertNoPendingDeletion(task);
         task.list_id = listId;
         writeTask(task);
         return readTask(id);
@@ -195,6 +208,7 @@ export function findByIdempotencyKey(key) {
 export function startTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'provisioning');
         t.state = 'provisioning';
@@ -206,6 +220,7 @@ export function startTask(id) {
 export function activateTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'active');
         t.state = 'active';
@@ -217,6 +232,7 @@ export function activateTask(id) {
 export function blockTask(id, reason) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         if (TASK_TERMINAL_STATES.includes(t.state))
             throw new TaskStateError(`cannot block a '${t.state}' task`);
@@ -228,6 +244,7 @@ export function blockTask(id, reason) {
 export function unblockTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         if (!t.blocked)
             throw new TaskStateError('task is not blocked');
@@ -239,6 +256,7 @@ export function unblockTask(id) {
 export function reviewTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'review');
         t.state = 'review';
@@ -250,6 +268,7 @@ export function reviewTask(id) {
 export function completeTask(id, outcome) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'done');
         t.state = 'done';
@@ -264,6 +283,7 @@ export function completeTask(id, outcome) {
 export function cancelTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         if (!TASK_CANCELLABLE_STATES.includes(t.state))
             throw new TaskStateError(`cannot cancel a '${t.state}' task`);
@@ -281,6 +301,7 @@ function sameOutcome(left, right) {
 export function beginTaskTerminalIntent(id, input) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         const existing = t.terminal_intent;
         if (existing) {
             if (existing.kind !== input.kind || existing.room_id !== input.roomId
@@ -334,6 +355,7 @@ export function setTaskTerminalIntentError(id, error, recoveryHint) {
 export function finishTaskTerminalIntent(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         const intent = t.terminal_intent;
         if (!intent)
             throw new TaskStateError(`task ${id} has no terminal intent`);
@@ -364,6 +386,7 @@ export function finishTaskTerminalIntent(id) {
 export function failTask(id, error) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'failed');
         t.state = 'failed';
@@ -377,6 +400,7 @@ export function failTask(id, error) {
 export function updateTaskRoom(id, roomId, roomIdentityCid) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         t.room_id = roomId;
         t.room_identity_cid = roomIdentityCid;
@@ -387,6 +411,7 @@ export function updateTaskRoom(id, roomId, roomIdentityCid) {
 export function updateTaskTemplate(id, template) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         t.template = template;
         writeTask(t);
@@ -396,31 +421,330 @@ export function updateTaskTemplate(id, template) {
 export function updateTaskMembers(id, members) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         t.member_roles = members;
         writeTask(t);
         return t;
     });
 }
-/** Remove a completed task from Fleet's backlog. Missing tasks are an idempotent no-op. */
-export function deleteTask(id) {
+function presentTaskLenient(record) {
+    try {
+        return presentTask(record);
+    }
+    catch {
+        // A broken list reference must never make a task undeletable.
+        const listId = record.list_id ?? DEFAULT_TASK_LIST_ID;
+        return { ...record, list_id: listId, list_name: listId === DEFAULT_TASK_LIST_ID ? 'default' : listId };
+    }
+}
+/**
+ * Lenient read for deletion settlement and status surfaces: a broken list
+ * reference must never make a task unreadable or undeletable. Missing records
+ * throw the canonical task-not-found error; other read failures propagate.
+ */
+export function getDeletingTask(id) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
-        const p = taskPath(id);
-        let task;
         try {
-            task = JSON.parse(readFileSync(p, 'utf8'));
+            return presentTaskLenient(JSON.parse(readFileSync(taskPath(id), 'utf8')));
         }
         catch (error) {
             if (isNotFoundError(error))
-                return false;
+                throw new TaskStateError(`task not found: ${id}`);
+            throw error;
+        }
+    });
+}
+/** Cheap durable deletion-epoch probe for room/member publication guards. */
+export function taskDeletionState(id) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        try {
+            const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+            return stored.deletion?.status === 'pending' ? 'pending' : 'none';
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return 'absent';
+            throw error;
+        }
+    });
+}
+export const deletionReceiptsDir = () => join(stateRoot(), 'deletion-receipts');
+function deletionReceiptPath(id) {
+    return join(deletionReceiptsDir(), `${id}.json`);
+}
+export function readTaskDeletionReceipt(id) {
+    assertCanonicalTaskId(id);
+    try {
+        return JSON.parse(readFileSync(deletionReceiptPath(id), 'utf8'));
+    }
+    catch (error) {
+        if (isNotFoundError(error))
+            return undefined;
+        throw error;
+    }
+}
+function writeDeletionReceiptForIntent(stored) {
+    const deletion = stored.deletion;
+    mkdirSync(deletionReceiptsDir(), { recursive: true });
+    const receipt = {
+        schema_version: 1,
+        task_id: stored.task_id,
+        title: stored.title.slice(0, 256),
+        accepted_at: deletion.accepted_at,
+        actor: deletion.actor,
+        original_state: stored.state,
+        room_id: deletion.room_id,
+        member_count: deletion.members.length,
+    };
+    replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
+}
+/**
+ * Ensure the acceptance receipt exists before any cleanup side effect,
+ * backfilling it from the durable intent (heals a crash between the intent
+ * write and the receipt write). Fails closed: a receipt write error aborts
+ * settlement rather than deleting resources without audit evidence.
+ */
+export function ensureTaskDeletionReceipt(id) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        if (!readTaskDeletionReceipt(id))
+            writeDeletionReceiptForIntent(stored);
+    });
+}
+/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+export function completeTaskDeletionReceipt(id) {
+    const receipt = readTaskDeletionReceipt(id);
+    if (!receipt || receipt.settled_at)
+        return;
+    receipt.settled_at = new Date().toISOString();
+    receipt.result = 'deleted';
+    replaceFileAtomically(deletionReceiptPath(id), JSON.stringify(receipt, null, 2) + '\n');
+}
+/**
+ * Persist the first-wins durable deletion intent. Accepts every lifecycle
+ * state, takes precedence over a pending terminal intent, and never touches
+ * remote resources. Repeat requests while pending re-arm settlement; a request
+ * for a missing record reports the idempotent already-absent outcome.
+ *
+ * Low-level record mutation only. Callers serialize acceptance with settlement
+ * through deletion.ts, which holds the common task-operation lock.
+ */
+export function beginTaskDeletionIntent(id, actor) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        let stored;
+        try {
+            stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return { status: 'already_absent' };
             throw error;
         }
-        if (task.state !== 'done') {
-            throw new TaskStateError(`cannot delete a '${task.state}' task; only 'done' tasks can be deleted`);
+        if (stored.deletion?.status === 'pending') {
+            // Heal a crash between the intent write and the receipt write.
+            if (!readTaskDeletionReceipt(id))
+                writeDeletionReceiptForIntent(stored);
+            return { status: 'pending', task: presentTaskLenient(stored) };
+        }
+        const now = new Date().toISOString();
+        stored.deletion = {
+            status: 'pending',
+            accepted_at: now,
+            actor,
+            room_id: stored.room_id,
+            members: (stored.member_roles ?? []).map(member => ({
+                name: member.name, identity_cid: member.identity_cid, phase: 'pending', updated_at: now,
+            })),
+        };
+        writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
+        return { status: 'accepted', task: presentTaskLenient(stored) };
+    });
+}
+/** Record an actionable settlement failure; the task stays hidden and recoverable. */
+export function setTaskDeletionError(id, error, recoveryHint) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        stored.deletion.first_failure ??= error;
+        stored.deletion.first_recovery_hint ??= recoveryHint;
+        stored.deletion.error = error;
+        const previousErrorAt = Date.parse(stored.deletion.error_at ?? '');
+        stored.deletion.error_at = new Date(Math.max(Date.now(), Number.isFinite(previousErrorAt) ? previousErrorAt + 1 : 0)).toISOString();
+        stored.deletion.recovery_hint = recoveryHint;
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+const DELETION_MEMBER_PHASE_ORDER = {
+    pending: 0, stop_requested: 1, liveness_absent: 2, archive_secured: 3, identity_absent: 4,
+};
+/** Marker proving a member never launched, mirroring close.ts's short path. */
+export const DELETION_MEMBER_NEVER_LAUNCHED = 'never-launched';
+/** Marker proving absence verified against temp state AND the CID-wide identity scan. */
+export const DELETION_MEMBER_ABSENT_VERIFIED = 'absent-verified';
+/**
+ * Advance a member retirement cursor carried by the deletion intent. Only
+ * adjacent forward transitions are legal — plus the explicit
+ * pending → identity_absent short path proved by the 'never-launched' marker —
+ * so no managed agent can be claimed retired without the full evidence chain.
+ * launch_id and archive_path are immutable once recorded; same-phase retries
+ * are idempotent but must not change evidence.
+ */
+export function advanceTaskDeletionMember(id, name, phase, launchId, archivePath) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        const cursor = stored.deletion.members.find(member => member.name === name);
+        if (!cursor)
+            throw new TaskStateError(`task ${id} deletion has no member cursor '${name}'`);
+        if (cursor.launch_id !== undefined && launchId !== undefined && launchId !== cursor.launch_id)
+            throw new TaskStateError(`task ${id} deletion member '${name}' launch ownership proof is immutable`);
+        if (cursor.archive_path !== undefined && archivePath !== undefined && archivePath !== cursor.archive_path)
+            throw new TaskStateError(`task ${id} deletion member '${name}' archive evidence is immutable`);
+        const step = DELETION_MEMBER_PHASE_ORDER[phase] - DELETION_MEMBER_PHASE_ORDER[cursor.phase];
+        const launch = cursor.launch_id ?? launchId;
+        if (step < 0)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot move back from '${cursor.phase}' to '${phase}'`);
+        if (step === 0)
+            return presentTaskLenient(stored); // idempotent retry, evidence already verified
+        const neverLaunched = cursor.phase === 'pending' && phase === 'identity_absent'
+            && (launch === DELETION_MEMBER_NEVER_LAUNCHED || launch === DELETION_MEMBER_ABSENT_VERIFIED);
+        if (step !== 1 && !neverLaunched)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot skip from '${cursor.phase}' to '${phase}' without evidence`);
+        if (launch === undefined)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot reach '${phase}' without a launch ownership proof`);
+        if (phase === 'archive_secured' && (cursor.archive_path ?? archivePath) === undefined)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot reach 'archive_secured' without archive evidence`);
+        cursor.phase = phase;
+        cursor.launch_id = launch;
+        if (archivePath !== undefined)
+            cursor.archive_path = archivePath;
+        cursor.updated_at = new Date().toISOString();
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+function findCursorForSeat(id, stored, seat) {
+    const cursor = stored.deletion.members.find(member => member.name === seat.role_name);
+    if (cursor && seat.identity_cid
+        && cursor.identity_cid.toLowerCase() !== seat.identity_cid.toLowerCase())
+        throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' identity CID mismatch between cursor and room seat`);
+    return cursor;
+}
+/**
+ * Durably register cursors for late-provisioned members before retirement
+ * begins: provisioning publishes room seats before updateTaskMembers, so the
+ * acceptance snapshot can be empty while live seats exist. Seats without a
+ * recorded identity CID are not registered here — until a CID is recorded
+ * there is no managed identity to orphan, and the room record still carries
+ * those seats through the close saga that follows.
+ */
+export function upsertTaskDeletionMembersFromSeats(id, seats) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        const now = new Date().toISOString();
+        for (const seat of seats) {
+            if (!seat.identity_cid)
+                continue;
+            if (!findCursorForSeat(id, stored, seat)) {
+                stored.deletion.members.push({
+                    name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now,
+                });
+            }
+        }
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+/**
+ * The pre-room-delete checkpoint: import completed retirement evidence from
+ * room seats into the deletion cursors, so a crash between room-record
+ * deletion and task unlink retries from durable cursors instead of
+ * reconstructing consumed evidence. Call ONLY after closeManagedRoom has
+ * completed retirement and BEFORE cowork.deleteRoom/deleteRoomRecord.
+ *
+ * The room saga is trusted for phase jumps, but partial or corrupt retained
+ * records must not become false success: every seat must be identity_absent;
+ * a real launch requires archive evidence; an identity-less seat is accepted
+ * only via the never-launched proof.
+ */
+export function importTaskDeletionRetirementEvidence(id, seats) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        const now = new Date().toISOString();
+        for (const seat of seats) {
+            const evidence = seat.retirement;
+            if (evidence?.phase !== 'identity_absent')
+                throw new TaskStateError(`task ${id} deletion cannot checkpoint member '${seat.role_name}' before completed retirement`);
+            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED;
+            if (!neverLaunched && evidence.archive_path === undefined)
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' retirement evidence lacks its archive`);
+            if (!seat.identity_cid) {
+                if (neverLaunched)
+                    continue; // provably never held a managed identity
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
+            }
+            let cursor = findCursorForSeat(id, stored, seat);
+            if (!cursor) {
+                cursor = { name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now };
+                stored.deletion.members.push(cursor);
+            }
+            if (DELETION_MEMBER_PHASE_ORDER[evidence.phase] < DELETION_MEMBER_PHASE_ORDER[cursor.phase])
+                continue;
+            if (cursor.launch_id !== undefined && cursor.launch_id !== evidence.launch_id)
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' launch ownership proof is immutable`);
+            if (cursor.archive_path !== undefined && evidence.archive_path !== undefined
+                && cursor.archive_path !== evidence.archive_path)
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' archive evidence is immutable`);
+            cursor.phase = evidence.phase;
+            cursor.launch_id = evidence.launch_id;
+            if (evidence.archive_path !== undefined)
+                cursor.archive_path = evidence.archive_path;
+            cursor.updated_at = now;
+        }
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+/**
+ * Physically remove a deletion-pending task record. Settlement-only: callers
+ * must have completed member retirement and room cleanup first. Missing
+ * records are the idempotent already-settled outcome.
+ */
+export function unlinkDeletedTask(id) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        let stored;
+        try {
+            stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return false;
+            throw error;
         }
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
         try {
-            unlinkSync(p);
+            unlinkSync(taskPath(id));
         }
         catch (error) {
             if (isNotFoundError(error))

package/dist/rooms-tasks/terminal.d.ts

@@ -1,6 +1,9 @@
 import { type RoomCloseDeps } from './close.js';
 import type { CoworkAdapter } from './cowork-adapter.js';
 import type { TaskOutcome, TaskRecord, TaskTerminalIntent } from './types.js';
+export declare const TASK_OPERATION_LOCK_STALE_MS: number;
+/** Common per-task operation lock serializing terminal, deletion, and recovery acceptance. */
+export declare function taskOperationLockPath(taskId: string): string;
 export interface TaskTerminalInput {
     taskId: string;
     kind: TaskTerminalIntent['kind'];

package/dist/rooms-tasks/terminal.js

@@ -2,10 +2,11 @@ import { join } from 'node:path';
 import { withFileLock } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
 import { deleteManagedRoom } from './close.js';
-import { beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
+import { assertNoPendingDeletion, beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
 import { getRoomRecord } from './room-state.js';
-const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
-function taskOperationLockPath(taskId) {
+export const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
+/** Common per-task operation lock serializing terminal, deletion, and recovery acceptance. */
+export function taskOperationLockPath(taskId) {
     return join(stateRoot(), 'locks', 'task-terminal', encodeURIComponent(taskId));
 }
 function errorText(error) {
@@ -24,6 +25,9 @@ export function acceptTaskTerminalIntent(input) {
 export function settleTaskTerminalIntent(input) {
     return withFileLock(taskOperationLockPath(input.taskId), async () => {
         const current = getTask(input.taskId);
+        // Deletion supersedes a pending terminal intent: fail boundedly before any
+        // room side effect so the deletion worker owns all remaining cleanup.
+        assertNoPendingDeletion(current);
         const intent = current.terminal_intent;
         if (!intent)
             throw new Error(`task ${input.taskId} has no accepted terminal intent`);

package/dist/rooms-tasks/types.d.ts

@@ -5,6 +5,7 @@
  * membership, and archive. Messenger Server owns owner presentation.
  * Fleet stores only IDs, CIDs, orchestration state, and saga cursors.
  */
+import type { AgentLaunchConfiguration } from '../lifecycle-summary.js';
 export type TaskState = 'backlog' | 'provisioning' | 'active' | 'review' | 'done' | 'cancelled' | 'failed';
 export declare const TASK_TERMINAL_STATES: readonly TaskState[];
 export declare const TASK_CANCELLABLE_STATES: readonly TaskState[];
@@ -44,6 +45,47 @@ export interface TaskTerminalIntent {
     first_failure?: string;
     first_recovery_hint?: string;
 }
+/** Origin evidence for an accepted deletion; retained until the record is unlinked. */
+export type TaskDeletionActor = {
+    kind: 'local_control';
+    surface: 'cli' | 'web';
+} | {
+    kind: 'authenticated_owner';
+    surface: 'messenger';
+    cid: string;
+};
+export type TaskDeletionMemberPhase = 'pending' | 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
+/**
+ * Durable retirement cursor for a managed member when no room orchestration
+ * record exists to carry the equivalent seat cursor.
+ */
+export interface TaskDeletionMemberCursor {
+    name: string;
+    identity_cid: string;
+    phase: TaskDeletionMemberPhase;
+    launch_id?: string;
+    archive_path?: string;
+    updated_at: string;
+}
+/**
+ * First-wins durable deletion intent. There is no settled status: settlement
+ * ends by unlinking the task record, so physical absence is the completion
+ * evidence. While pending, the task is hidden from normal operation and every
+ * lifecycle mutation or room publication is rejected.
+ */
+export interface TaskDeletionIntent {
+    status: 'pending';
+    accepted_at: string;
+    actor: TaskDeletionActor;
+    room_id?: string;
+    /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
+    members: TaskDeletionMemberCursor[];
+    error?: string;
+    error_at?: string;
+    recovery_hint?: string;
+    first_failure?: string;
+    first_recovery_hint?: string;
+}
 export interface TaskRecord {
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
@@ -74,6 +116,7 @@ export interface TaskRecord {
     ended_at?: string;
     outcome?: TaskOutcome;
     terminal_intent?: TaskTerminalIntent;
+    deletion?: TaskDeletionIntent;
 }
 export interface TaskListRecord {
     list_id: string;
@@ -112,6 +155,11 @@ export interface RoomMemberLaunchState {
     agent_fingerprint?: string;
     agent_template?: string;
     agent_template_hash?: string;
+    /**
+     * Operator-facing launch configuration captured from the exact resolved
+     * launch state; the single source for later Task/Room lifecycle reports.
+     */
+    presentation?: AgentLaunchConfiguration;
     launch_id?: string;
     updated_at: string;
     error?: string;

package/dist/web/server.js

@@ -183,12 +183,39 @@ export async function buildWebServer(services, boundary, options = {}) {
             throw new FleetError('invalid_request', 'invalid task state filter');
         if (query.groupByList !== undefined && !['true', 'false'].includes(query.groupByList))
             throw new FleetError('invalid_request', 'groupByList must be true or false');
+        if (query.includeDeleting !== undefined && !['true', 'false'].includes(query.includeDeleting))
+            throw new FleetError('invalid_request', 'includeDeleting must be true or false');
         const state = query.state && query.state !== 'all' ? query.state : undefined;
-        const filter = { ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}) };
+        const filter = { ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}),
+            ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) };
         return taskApi(() => query.groupByList === 'true'
             ? { groups: requireTaskRooms().groupedTasks(filter) }
             : { tasks: requireTaskRooms().listTasks(filter) });
     });
+    app.delete('/api/v1/tasks/:id', async (request, reply) => {
+        auth.authenticate(request, true);
+        const taskId = request.params.id;
+        const confirm = request.query.confirm;
+        // Exact-ID-twice confirmation is validated before existence or idempotency.
+        if (confirm !== taskId)
+            throw new FleetError('invalid_request', 'confirm must exactly repeat the task id');
+        const accepted = await taskApi(() => requireTaskRooms().requestTaskDeletion({
+            actor: { kind: 'local_control', surface: 'web' }, taskId,
+        }));
+        if (accepted.status === 'already_absent')
+            return { task_id: taskId, deleted: false, already_absent: true };
+        // Cleanup runs in an external worker outside the request lifecycle; the
+        // request waits boundedly and reports pending — never fabricated success.
+        const outcome = await requireTaskRooms().launchTaskDeletionWorker({ taskId, waitMs: 5_000 });
+        if (outcome.deleted)
+            return { task_id: taskId, deleted: true };
+        reply.code(202);
+        return {
+            task_id: taskId, accepted: true, deletion: 'pending',
+            ...(outcome.error ? { error: outcome.error } : {}),
+            recovery: `Repeat DELETE /api/v1/tasks/${taskId}?confirm=${taskId} or run 'ours-fleet task recover ${taskId}'.`,
+        };
+    });
     app.post('/api/v1/tasks', async (request, reply) => {
         auth.authenticate(request, true);
         const body = request.body;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.1.0-nightly.12",
+  "version": "1.1.0-nightly.13",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",