@ours.network/fleet 1.1.0-nightly.2 → 1.1.0-nightly.20

package/dist/docs.js

@@ -6,11 +6,11 @@
  */
 export const AI_DOCS = `# ours-fleet reference
 
-ours-fleet runs persistent or temporary, identity-bound AI roles through the
-structured ACP session path:
+ours-fleet runs persistent or temporary, identity-bound AI roles through a
+provider-neutral managed-session interface:
 
 - harness: \`claude-code\` or \`codex\`
-- session: \`acp\` (default and only supported value)
+- session: \`acp\` (default) or \`codex-app-server\` (Codex only)
 - lifetime: permanent (supervised, restartable) or \`spawn --temp\`
 
 ## Discover and validate
@@ -24,15 +24,19 @@ ours-fleet version [--json]             # build identity, capabilities, every in
 \`\`\`
 
 Configuration v2 is \`~/fleet.yaml\` plus typed bare documents under the exact
-stem directories \`~/fleet/agents\`, \`~/fleet/roles\`, and \`~/fleet/brains\`.
+stem directories \`~/fleet/agents\`, \`~/fleet/agent_templates\`, \`~/fleet/roles\`, \`~/fleet/brains\`, and
+\`~/fleet/room_templates\`.
 The manifest owns fleet-wide operational defaults and automation; each Agent
 selects one inline/ref Role and Brain and carries its operational fields.
+Agent Templates under \`~/fleet/agent_templates\` are inert reusable launch definitions;
+only explicit files under \`~/fleet/agents\` are persistent lifecycle instances.
+Room members use \`agent_template\` and receive immutable content-addressed snapshots.
 Legacy top-level \`roles:\` and \`fleet.d\` are rejected. Validate the complete
 trusted source set with \`config\` and \`doctor\` before starting or restarting.
 
 Permanent \`spawn\` writes \`~/fleet/agents/Name.yaml\`. The web console edits an
-explicit \`{manifest, agents}\` model while Role/Brain presets remain read-only.
-Its aggregate revision includes every Agent/Role/Brain source, previews a
+explicit \`{manifest, agents, agent_templates}\` model while Role/Brain presets remain read-only.
+Its aggregate revision includes every Agent/Role/Brain/Room-template source, previews a
 redacted per-document diff in an exact-stem private staging tree, and saves under
 one root lock with a private multi-file backup and full rollback. A no-op is
 byte-identical and creates no backup.
@@ -78,7 +82,7 @@ PATH order.
 ## Lifecycle and console commands
 
 \`\`\`sh
-ours-fleet init
+ours-fleet init [-c FILE]               # interactive missing-default seed; TTY required
 ours-fleet up|down [Name...]
 ours-fleet restart [Name...]            # preserve/resume harness context
 ours-fleet force-restart [Name...]      # fresh context; briefing is reloaded
@@ -91,6 +95,27 @@ ours-fleet watchdog-report <name> [run-id] [--list] [--json]
 ours-fleet watchdog-run <name>
 \`\`\`
 
+\`init\` is an interactive missing-default workflow that preserves existing files byte-for-byte.
+It names the resolved manifest and split directory, asks a default-No confirmation,
+then subscriptions (Codex, Claude, or both), model assignment (one explicit model for
+every job or explicit development/review/coordination choices), one reasoning level,
+and a final default-No review. Quick/Balanced/Thorough generate low/medium/high.
+Model pickers show packaged supported IDs; catalog membership is not a recommendation
+or entitlement claim. Run \`ours-fleet doctor\` for local Codex availability; Claude
+entitlement is checked when a role launches. The generated brains contain no
+\`model_chain\`, so Fleet never silently substitutes another model.
+
+At either confirmation, N, Enter, Escape, Ctrl-C, Ctrl-D, or EOF cancels. In a picker,
+Escape, Ctrl-C, Ctrl-D, or EOF cancels; Enter records the highlight or continues a
+non-empty multi-select, N is ignored, and an empty subscription selection remains blocked.
+Every cancellation before final approval performs no host or configuration mutation.
+Redirected/non-TTY invocation is refused with the same guarantee. After the final Yes,
+host setup precedes publication. Path ownership/type/mode/symlink and
+same-filesystem checks run before host setup and again under a per-setup lock. Publication
+stages and validates the complete combined setup, backs up whichever old target(s) exist,
+and retains a private recovery record. A hard process/host termination cannot promise
+rollback; inspect host integration and private init stage/recovery evidence.
+
 \`peek\`, \`attach\`, and text \`send\` use the structured agent session.
 Attachment also accepts \`/permit <permission-id> <option-id>\`, \`/interrupt\`,
 and \`/detach\`.
@@ -149,21 +174,19 @@ harness's own default.
 ## Spawn
 
 \`\`\`sh
-ours-fleet spawn [--temp] [Name | --role Name] \\
-  --harness codex|claude-code --session acp \\
-  --mission "one line" --cwd /absolute/path --identity Identity \\
-  --coordinator Coordinator --model MODEL \\
+ours-fleet spawn [--temp] [Name | --name Name] \\
+  --brain BRAIN_ID --role ROLE_ID \\
+  --cwd /absolute/path --identity Identity --coordinator Coordinator \\
   --approval ask|auto|allow \\
   --filesystem read-only|workspace|unrestricted \\
-  --unattended deny|wait \\
-  --bio-file /path/bio.md --persona-file /path/persona.md
+  --unattended deny|wait --isolation-file /path/isolation.yaml
 \`\`\`
 
 Permanent spawn writes \`~/fleet/agents/Name.yaml\` and starts a supervised role.
 \`--temp\` writes active state under \`~/.ours-fleet/tmp\` and starts an independent
 transient supervisor (a collected systemd unit or submitted launchd job). It is
 not enabled across reboot and does not die when the role that spawned it restarts.
-Both lifetimes support \`--session acp\`. When a temporary role's bound identity
+Brain definitions own the managed session backend. When a temporary role's bound identity
 closes or its session ends, the supervisor, monitor and live roster entry retire
 together; state moves intact to \`~/.ours-fleet/recovery/temporary\` with a
 termination record. Failed launches use the same archive rather than deleting
@@ -195,27 +218,32 @@ only sustained authoritative absence closes the role. Unreachable, malformed, or
 valid-but-empty daemon indexes are ambiguous and reset closure debounce rather
 than becoming cleanup authority.
 
-Inside a managed ACP role, the same CLI automatically routes a real \`spawn\`
-through that role's authenticated supervisor control socket. \`--role Name\` is
-accepted as an alternative to the positional name, so a minimal delegated call
-is \`ours-fleet spawn --role DeveloperX --temp\`. The supervisor records the
-calling role, performs creation, and only after success sends a structured
-spawn notice through the caller's owner channel when one is configured.
-
-Omitted harness, session, working directory, coordinator, neutral permissions,
-fleet monitor policy, and (when the harness is unchanged) model inherit from the
-calling role. Explicit options always win. Selecting a different harness without
-\`--model\` leaves model selection to that harness/fleet defaults rather than
-copying an incompatible caller model. This automatic proxy is a convenience and
+Inside a managed role, public \`ours-fleet\` commands cross an authenticated
+supervisor attribution boundary before Commander parsing. The original CLI remains
+the executor inside the role's existing OS sandbox, and ordinary CLI validation is
+the source of truth. Hidden worker entry points remain internal; public lifecycle and
+operator commands are not restricted by the proxy.
+
+Command invocation, raw argv, read-only work, validation failures, and generic
+outcomes are never forwarded to the Owner-visible channel. Fleet announces only
+confirmed Agent, Task, and Room lifecycle changes. Local diagnostics retain
+structurally redacted command metadata. Lifecycle delivery uncertainty is logged,
+never recursively announced, and never reruns or blindly retries an effect.
+Room participant summaries describe creation and activation. Fleet has no public
+post-create Room membership mutation, so it does not claim a separate membership event.
+
+Omitted Brain and Role selections, working directory, coordinator, neutral permissions,
+and fleet monitor policy inherit from the calling Agent. Explicit options always win.
+Identity, mission/profile text, environment, owner routing, auth proxy, room startup,
+isolation, worklog, and sensitive inline Brain values never inherit implicitly.
+This automatic proxy is a convenience and
 attribution mechanism, not an isolation boundary: an unrestricted role can still
 invoke another binary path directly. Host/operator shells keep the ordinary direct
 CLI behavior.
 
-Codex-specific spawn flags: \`--sandbox\`, \`--permission-mode\`, \`--launcher\`,
-\`--profile\`, \`--search\`, repeatable \`--codex-config key=value\`, repeatable
-\`--add-dir\`, and legacy \`--monitor\` (consent for the native Codex monitor,
-not the \`monitor.mode\` wake-owner selector). Run \`ours-fleet help spawn\` for
-exact values.
+Brain owns harness, session, model, reasoning effort, token limits, and native harness
+options. Removed runtime flags are rejected with migration guidance rather than silently
+reinterpreted. A selection is a stable ID or an explicit \`inline:{...}\` mapping.
 
 ## fleet.yaml
 
@@ -238,25 +266,19 @@ watchdogs:
     enabled: true                   # default true; false = configured but never scheduled
     interval: 10m                   # default 10m; 30s | 10m | 2h, minimum 1m
     watch: [Alice, CodexReviewer]   # explicit lists are exact; omit for configured + live temp roles
-    harness: claude-code            # default: built-in claude-code
-    model: claude-fable-5           # default: same resolution rule roles use (resolveRoleModel)
-    session: acp                    # default: built-in ACP
+    agent: { ref: WatchdogAgent }   # required: declared Agent ID, or canonical inline Agent definition
     identity: Watchdog-nightwatch   # default: Watchdog-<name>
     timeout: 5m                     # default 5m; a run past this is killed and recorded as error
     keep_reports: 50                # default 50 reports retained per watchdog
     alert_cooldown: 60m             # default 60m before the same finding alerts again
     prompt_file: /abs/extra.md      # optional extra focus, APPENDED to the fixed contract
-    isolation:                      # optional; omitted means no OS sandbox, like an ordinary role
-      backend: bubblewrap           # when present, the ordinary role isolation schema applies
-      network: broker
-      fs: { read: [/opt/watch-data] }
 \`\`\`
 
 An Agent is a separate bare document under \`~/fleet/agents/<ID>.yaml\`:
 
 \`\`\`yaml
 role: { inline: { mission: Coordinate work and delegate implementation. } }
-brain: { inline: { harness: codex, session: acp, model: gpt-model-id } }
+brain: { inline: { harness: codex, session: codex-app-server, model: gpt-model-id } }
 identity: Coordinator
 cwd: \${work_root}/project
 oversee: [{ agent: Worker, interval: 5m }]
@@ -266,9 +288,9 @@ A watchdog observes and reports; it never restarts, stops, spawns, or removes a
 role, answers a pending permission, edits a workspace, or approves anything on
 the owner's behalf. \`watchdogs:\` may appear only in the base config
 (\`~/fleet.yaml\` or \`-c FILE\`); Agent/Role/Brain documents never own it.
-Watchdogs are not isolated by default. An explicit watchdog \`isolation:\` block
-uses the same policy schema as a role and is applied unchanged; declare every
-extra filesystem access required by a custom prompt there.
+The selected Agent owns Brain, Role, permissions, isolation, and every other
+agent setting. Legacy watchdog \`harness\`, \`model\`, \`session\`, and
+\`isolation\` fields fail with migration guidance.
 When \`watch:\` is omitted, each run watches the configured roles plus temporary
 fleet roles that are live when the run starts. An explicit \`watch:\` list is
 never augmented.
@@ -285,6 +307,45 @@ the shared daemon only through an explicit operator or installer/setup flow.
 
 ## Rooms and tasks
 
+\`init\` materializes editable \`single\`, \`pair\`, and \`team\` Room templates plus
+their exact-cased Agent, Role, and Brain presets. The command prints the packaged
+preset revision and source directory. Inspect provenance and content before use:
+
+\`\`\`sh
+ours-fleet config [-c FILE]
+ours-fleet template list [-c FILE]
+ours-fleet template show team [-c FILE]
+ours-fleet task create --title "Solo task" --template single [-c FILE]
+ours-fleet task create --title "Reviewed change" --template pair [-c FILE]
+ours-fleet task create --title "Phased delivery" --template team [-c FILE]
+\`\`\`
+
+An alternate manifest \`-c /path/custom.yaml\` uses \`/path/custom/\` as its split
+root. Repeated init only fills missing files and never adopts a newer default.
+Revision-3 packaged-bootstrap and generated role defaults have an exact-semantic,
+fail-closed migration (dry-run by default):
+
+\`ours-fleet migrate-role-defaults [-c FILE]\`
+\`ours-fleet migrate-role-defaults [-c FILE] --write\`
+
+Review removals, replacements, additions, preserved custom files, staging path,
+and recovery path. Same-named custom files stay byte-identical; dangling custom
+references refuse publication, and a successful rerun is a no-op. For explicit
+single-file adoption, copy from init's reported packaged source beside the target
+as \`.new-default\`, inspect \`diff -u TARGET TARGET.new-default\`, then replace it.
+
+The exact generated six-worker legacy starter Agent set has its own fail-closed
+migration (dry-run by default):
+
+\`ours-fleet migrate-agent-templates [-c FILE]\`
+\`ours-fleet migrate-agent-templates [-c FILE] --write\`
+
+Review the dry-run moves, addition, staging path, and retained recovery-backup path
+before \`--write\`. Customized/partial known starters and unsafe trees refuse without
+mutation; unrelated custom persistent Agents remain persistent. A manifest-level template
+may shadow a same-named file only with \`override_builtin: true\` and a higher
+version; this compatibility marker is deprecated and reported as a diagnostic.
+
 Rooms always use \`ours-cowork\`; there is no room-provider selector. Configure
 the cowork daemon connection and room owner directly:
 
@@ -312,6 +373,13 @@ Cowork role, and task. The agent creates that identity itself with ours MCP
 work immediately. Fleet activates the room from Cowork's authenticated seat; there
 is no briefing hash, startup ACK, or separate role-briefing readiness gate.
 
+Set \`room.anonymous: true\` on a room template, or pass \`--anonymous\` to
+\`task create\`, \`task start\`, \`task work\`, or \`room create\`, to create an
+anonymous Cowork room. \`--no-anonymous\` explicitly overrides an anonymous
+template. Fleet records the resolved value before room creation so retries keep
+the same choice. Temporary members of an anonymous room are instructed to call
+\`create_temporary_identity\` with \`expose_local=false\`.
+
 Human task and room results use the same compact Markdown presentation in the
 CLI and authenticated owner channel: a short heading, icon-plus-word status,
 code-formatted identifiers, bounded summaries, and actionable recovery or error
@@ -360,11 +428,24 @@ The prerelease configuration names \`tasks.close_room_on_done\` and
 semantics. Older prerelease \`closed\` room records are deleted directly the next
 time \`room list\` reconciles Fleet with Cowork.
 
-\`ours-fleet task delete <id> <id>\` removes only a \`done\` task's Fleet backlog
-record. The exact task ID is required twice for confirmation. Delete rejects every
-other task state, never changes any room state, and reports an already-missing
-task as an idempotent no-op. The Owner-channel equivalent is
-\`/task delete <id> <id>\`.
+\`ours-fleet task delete <id> <id>\` permanently deletes a task in ANY lifecycle
+state — backlog, provisioning, active, blocked, review, done, cancelled, failed,
+or partially settled. The exact task ID is required twice for confirmation. A
+durable deletion intent is persisted before any side effect; the cleanup worker
+then retires managed room members with evidence, closes and deletes an attached
+room (tolerating already-missing remote rooms), releases the sealed launch
+snapshot, and unlinks the task record last. While cleanup settles the task is
+hidden from normal listings and every lifecycle mutation is rejected; if
+cleanup cannot complete (for example Cowork is unreachable), the deletion stays
+in a precise recoverable state — repeat the delete command or run
+\`task recover <id>\` to converge after outages, crashes, or restarts. Deletion
+never fabricates a \`done\` transition. A metadata-only deletion receipt
+(acceptance actor, original state, timestamps, completion) is retained under
+\`deletion-receipts/\` as durable audit evidence. An already-missing task is an
+idempotent no-op. The Owner-channel equivalent is \`/task delete <id> <id>\`; the
+management API equivalent is \`DELETE /api/v1/tasks/<id>?confirm=<id>\` (200 when
+settled, 202 while pending; \`GET /api/v1/tasks?includeDeleting=true\` exposes
+deletion-pending tasks to operators).
 
 ## Permissions
 
@@ -373,12 +454,13 @@ Prefer the harness-neutral \`permissions\` block:
 - \`approval: ask|auto|allow\`: portable permission policy. \`deny\` remains a
   deprecated, fail-closed compatibility alias for existing fleet files.
 - \`filesystem: read-only|workspace|unrestricted\`: filesystem intent
-- \`unattended: deny|wait\`: what ACP does when no console can answer a request
+- \`unattended: deny|wait\`: what a managed session does when no console can
+  answer a request
 
-The backend translates this common intent. Harness-native settings in
-\`harness_options\` take precedence where supplied. Do not choose
-\`allow\`/\`unrestricted\`, Codex \`never\`/\`danger-full-access\`, or Claude
-\`bypassPermissions\` without explicit authorization.
+The backend translates this common intent. Native Codex app-server roles reject
+permission aliases in \`harness_options\`; Codex ACP and Claude retain their
+legacy native-override compatibility. Do not choose \`allow\`/\`unrestricted\`
+or Claude \`bypassPermissions\` without explicit authorization.
 
 ### Creation-time isolation
 
@@ -451,12 +533,14 @@ permissions through its harness and check the result against a fixed floor:
 deny those requests with nobody to see it; with \`unattended: wait\` it warns,
 because a human can still attach and answer.
 
-Security meaning: \`ask\` maps to Codex \`untrusted\` and Claude \`default\`.
-\`auto\` selects Codex ACP \`agent\` (\`on-request\` + \`workspace-write\`) and
-Claude \`acceptEdits\`. \`approval: allow\` selects Codex ACP's fully
-non-interactive yolo mode, reported as \`agent-full-access\` (\`never\` +
-\`danger-full-access\`), and Claude \`bypassPermissions\`. These modes genuinely
-permit the actions the role was authorized to take —
+Security meaning: native Codex maps \`ask\` → \`untrusted\`, \`auto\` →
+\`on-request\`, and \`allow\` → \`never\`; its independent filesystem mapping is
+\`read-only\` → \`read-only\`, \`workspace\` → \`workspace-write\`, and
+\`unrestricted\` → \`danger-full-access\`. Users configure only the Fleet names.
+Claude maps \`ask\` to \`default\`, \`auto\` to \`acceptEdits\`, and \`allow\` to
+\`bypassPermissions\`. Codex ACP retains its adapter-specific coupled modes:
+\`auto\` selects \`agent\`, while \`allow\` selects \`agent-full-access\`. These
+modes genuinely permit the actions the role was authorized to take —
 \`dontAsk\` only suppresses the prompt while still refusing the action. Nothing
 other than an explicit \`allow\` becomes non-interactive. Legacy \`deny\` keeps
 its conservative Codex \`on-request\` / Claude \`plan\` translation. \`allow\` is therefore a real grant and
@@ -511,10 +595,31 @@ refused at validation rather than accepted and dropped. This narrows a role's
 tool surface; it does not stop the harness deferring tool schemas, which is the
 harness's own decision.
 
-Codex \`harness_options\`: \`launcher\` (auto, ours-codex, codex), \`sandbox\`
-(read-only, workspace-write, danger-full-access), \`approval\` or
-\`permission_mode\` (untrusted, on-request, never), \`profile\`, \`search\`,
-\`config\`, \`add_dirs\`, and \`monitor\`.
+Codex \`harness_options\`: \`launcher\` (auto, ours-codex, codex), \`search\`,
+\`config\`, \`add_dirs\`, and \`monitor\`; Codex ACP additionally supports
+\`profile\`. Native app-server roles reject \`profile\` because Codex does not
+accept \`--profile\` for \`app-server\`. They
+must express approval and filesystem authority through the shared
+\`permissions:\` block, never through harness options. The adapter translates
+\`ask|auto|allow\` to Codex \`untrusted|on-request|never\` and translates
+\`read-only|workspace|unrestricted\` to Codex
+\`read-only|workspace-write|danger-full-access\`. Native \`config\` currently
+allows only \`model_reasoning_effort\`; ACP retains the broader Codex config surface.
+
+For Codex, the opt-in \`session: codex-app-server\` directly runs Codex's native
+JSONL app server behind Fleet's provider-neutral session contract. It supports native item
+streaming, commentary/final phases, prompt admission, steering, interruption,
+permission requests, durable conversation projection, and thread resume. Packaged
+Codex brains and the init wizard continue to select \`session: acp\` for compatibility;
+Claude Code also uses ACP. Native Codex defaults to \`codex app-server\` (or \`ours-codex app-server\`
+when launcher auto finds it). Override the exact command when necessary:
+
+\`session_options: { codex_app_server: { command: [codex, app-server] } }\`
+
+An exact command override receives no appended profile, search, or subcommand
+arguments. Native sessions persist their Codex thread in Fleet's \`.session-id\`
+and participate in its bounded fresh/resume recovery; cross-provider conversation
+portability is never assumed.
 
 ## ACP adapters
 
@@ -567,7 +672,7 @@ Inspect \`ours-fleet status Name\`, \`peek Name\`, role logs, and
 
 ## Trusted owner channel
 
-An ACP role may declare a separate ours identity which fleet — never the agent —
+Any managed role may declare a separate ours identity which fleet — never the agent —
 creates when missing and binds:
 
 \`\`\`yaml
@@ -668,12 +773,12 @@ provenance checks.
 The channel identity must be unique and must not be a role identity. The bridge
 persists bounded wire IDs only, never message/reply plaintext, and requeues input
 before starting its turn for at-least-once crash recovery. It currently requires
-the structured agent-session interface backed by ACP so correlated final replies
-retain their delivery guarantee.
+the structured agent-session interface so correlated final replies retain their
+delivery guarantee.
 
 ### Live contact and owner administration
 
-The supervisor which is already running the ACP role remains the sole binder of
+The supervisor which is already running the managed role remains the sole binder of
 \`owner_channel.identity\`. The CLI reaches that exact live \`OwnerChannel\`
 through the role's token-authenticated, mode-0600 Unix control socket for contact
 inspection and setup; it never starts another ours client and never force-binds:

package/dist/doctor.d.ts

@@ -15,5 +15,7 @@ export declare function doctor(opts?: {
         path?: string;
         argv1?: string;
     };
+    /** Override the local Codex model cache path (tests). */
+    codexCatalogPath?: string;
 }, exec?: Exec, platform?: NodeJS.Platform, fetchImpl?: FetchLike, attachDaemon?: AttachDoctorDaemon): Promise<PrereqReport>;
 export {};

package/dist/doctor.js

@@ -13,6 +13,8 @@ import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, BIN_NAME, } from './provenance.js';
+import { readDaemonRecoveryStatus } from './daemon-recovery.js';
+import { codexModelCatalog } from './application/model-catalog.js';
 /** Which cgroup-v2 controllers are delegated to this user manager (advisory). */
 function cgroupDelegationDetail() {
     try {
@@ -106,6 +108,35 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 ok: true,
                 detail: `warning: ${diagnostic.message}`,
             });
+    if (loaded.ok) {
+        const packaged = Object.entries(loaded.brainPresets ?? {}).flatMap(([id, brain]) => brain.harness === 'codex' && typeof brain.model === 'string' && typeof brain.effort === 'string'
+            ? [{ id, model: brain.model, effort: brain.effort }] : [])
+            .sort((a, b) => a.id.localeCompare(b.id));
+        if (packaged.length) {
+            const runtime = codexModelCatalog(opts.codexCatalogPath);
+            const available = new Set(runtime.models.flatMap(model => model.reasoningEfforts.map(effort => `${model.id}\0${effort}`)));
+            const missing = packaged.filter(({ model, effort }) => !available.has(`${model}\0${effort}`));
+            checks.push({ name: 'brain catalog: Codex runtime drift', ok: true,
+                detail: runtime.models.length
+                    ? missing.length ? `warning: packaged Brain preset(s) absent from local Codex catalog: ${missing
+                        .map(({ id, model, effort }) => `${id} (${model}/${effort})`).join(', ')}`
+                        : `all ${packaged.length} packaged Codex model/effort pairs are present locally`
+                    : runtime.warnings.join('; ') });
+        }
+    }
+    for (const role of roles) {
+        const recovery = readDaemonRecoveryStatus(agentDir(role.name));
+        if (!recovery)
+            continue;
+        const paths = ['agent', 'owner']
+            .map(name => `${name}=${recovery.paths[name].state}`)
+            .join(', ');
+        checks.push({
+            name: `daemon recovery: ${role.name}`,
+            ok: recovery.state === 'recovered',
+            detail: `${recovery.state}; ${paths}; epoch ${recovery.epoch || 'unavailable'}`,
+        });
+    }
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
@@ -146,16 +177,16 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         const { listTemplates, resolveTemplate } = await import('./rooms-tasks/templates.js');
         const customs = loaded.roomTemplates ?? {};
         const templates = listTemplates(customs);
-        const roleNames = new Set(roles.map(r => r.name));
+        const agentTemplateNames = new Set(Object.keys(loaded.agentTemplates ?? {}));
         for (const t of templates) {
             const badRefs = t.members
-                .filter(m => m.role_ref && !roleNames.has(m.role_ref))
-                .map(m => m.role_ref);
+                .filter(m => !agentTemplateNames.has(m.agent_template))
+                .map(m => m.agent_template);
             if (badRefs.length) {
                 checks.push({
                     name: `template: ${t.name}@${t.version}`,
                     ok: true,
-                    detail: `warning: role_ref(s) ${badRefs.join(', ')} not found in configured roles`,
+                    detail: `warning: Agent Template(s) ${badRefs.join(', ')} not found`,
                 });
             }
         }
@@ -513,6 +544,23 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 : `${command} not found or failed — install the ACP adapter or set session_options.acp.command`,
         });
     }
+    for (const role of roles.filter(role => role.session === 'codex-app-server')) {
+        const configured = role.session_options?.codex_app_server?.command;
+        const launcher = role.harness_options?.launcher;
+        const command = Array.isArray(configured)
+            ? configured[0]
+            : typeof configured === 'string'
+                ? configured.trim().split(/\s+/)[0]
+                : launcher === 'ours-codex' ? 'ours-codex' : 'codex';
+        const result = await exec('sh', ['-c', 'command -v "$1" >/dev/null 2>&1', 'sh', command]);
+        checks.push({
+            name: `codex-app-server: ${role.name}`,
+            ok: result.code === 0,
+            detail: result.code === 0
+                ? `${command} available`
+                : `${command} not found — install Codex CLI or set session_options.codex_app_server.command`,
+        });
+    }
     return { ok: checks.every(c => c.ok), checks };
 }
 function loadConfigResult(configPath, yamlMode) {
@@ -521,6 +569,8 @@ function loadConfigResult(configPath, yamlMode) {
         return {
             ok: true, roles: cfg.roles, files: cfg.files, diagnostics: cfg.diagnostics,
             rooms: cfg.rooms, roomTemplates: cfg.roomTemplates, tasks: cfg.tasks,
+            agentTemplates: cfg.agentTemplates,
+            brainPresets: cfg.brainPresets,
             ownerInviteFingerprint: cfg.ownerInviteFingerprint,
         };
     }