@ours.network/fleet 1.1.0-nightly.2 → 1.1.0-nightly.21

package/README.md

@@ -8,7 +8,7 @@ harnesses — from one declarative file.**
 An AI coding agent in a terminal dies when you close the laptop. `ours-fleet`
 turns such sessions into **roles**: long-lived agents that
 
-- **run through structured ACP sessions** behind a shared Codex/Claude Code
+- **run through structured managed sessions** behind one provider-neutral
   agent-session interface, which you can inspect or prompt,
 - are **supervised** — systemd (Linux) or launchd (macOS) restarts them on crash
   and brings them back after a reboot,
@@ -37,16 +37,16 @@ brain: { inline: { harness: claude-code, session: acp } }
 
 # ~/fleet/agents/Prototyper.yaml
 role: { inline: { mission: Build prototypes } }
-brain: { inline: { harness: codex, session: acp } }
+brain: { inline: { harness: codex, session: codex-app-server } }
 ```
 
 ## How it works
 
 ```
-~/fleet.yaml + ~/fleet/{agents,roles,brains}/*.yaml   your declaration
+~/fleet.yaml + ~/fleet/{agents,agent_templates,roles,brains,room_templates}/*.yaml   your declaration
         │  ours-fleet up
         ▼
-briefing.md per role  ──►  agent session adapter  ──►  ACP client/session  ──►  ACP agent
+briefing.md per role  ──►  agent session adapter  ──►  native app-server or ACP transport
         ▲                        │
  systemd --user / launchd ───────┘   restart on crash, start at boot/login
 ```
@@ -72,7 +72,7 @@ The state dir contract:
 | `.owner-channel-message-recovery.json` | owner-channel bridge | mode-0600 body-free message claim journal: wire ID, history sequence, and claim time only |
 | `.owner-channel-attachment-recovery.json` | owner-channel bridge | mode-0600 attachment route journal; never filenames, paths, transcript text, or bytes |
 | `.owner-channel-binder.lock/`, `.owner-channel-binder.json` | owner-channel supervisor | mode-0600 role/identity + PID/start-marker ownership and release metadata; never mail plaintext or credentials |
-| `.session-events.jsonl`, `.control.sock`, `.control-token` | ACP backend | bounded typed console projection and private attachment control |
+| `.session-events.jsonl`, `.control.sock`, `.control-token` | managed session backend | bounded typed console projection and private attachment control |
 
 ## Prerequisites
 
@@ -91,15 +91,16 @@ equivalent); logs land in `~/.ours-fleet/logs/`.
 
 ```sh
 npm i -g @ours.network/fleet
-ours-fleet init      # units/dirs/linger for this user
+ours-fleet init      # interactive reviewed defaults + host setup
 ours-fleet doctor    # verifies everything above, with actionable messages
 ```
 
-The maintained Codex and Claude ACP adapters install as optional dependencies of
-`ours-fleet` and are resolved internally; users do not install adapter commands
-or add them to `PATH`. An explicit `session_options.acp.command` remains
-available for custom adapters. On Node 20–21, Codex ACP remains available,
-while maintained Claude ACP requires upgrading to Node 22.
+Native Codex roles use the logged-in Codex CLI's `app-server` command directly.
+The maintained Codex and Claude ACP adapters remain bundled optional dependencies
+and are resolved internally; users do not install adapter commands or add them to
+`PATH`. Explicit `session_options.codex_app_server.command` and
+`session_options.acp.command` overrides remain available. On Node 20–21, native
+Codex and Codex ACP remain available, while maintained Claude ACP requires Node 22.
 
 Each OS user manages their own fleet — to host roles under a sandboxed account,
 become that account and repeat.
@@ -107,8 +108,8 @@ become that account and repeat.
 ## Quickstart
 
 ```sh
-cp -R "$(npm root -g)/@ours.network/fleet/examples/fleet" ~/fleet
-cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
+ours-fleet init               # interactive; adds missing defaults and preserves existing files
+ours-fleet config             # validates Agents, Roles, Brains, and Room templates
 $EDITOR ~/fleet/agents/*.yaml # compose Role + Brain and operational settings
 ours-fleet up                 # boot the fleet (staggered)
 ours-fleet ls                 # running consoles
@@ -126,19 +127,16 @@ ours-fleet spawn Worker --mission "own the worker repo" \
 ours-fleet spawn --temp Scout --mission "one-off research"   # gone on exit/reboot
 
 # Codex role: ours-codex is preferred automatically; plain codex is the fallback
-ours-fleet spawn Coder --harness codex --model gpt-5.4 \
-  --session acp --approval ask --filesystem workspace \
-  --profile fleet --search --monitor --coordinator FleetCoordinator
-# Note: --monitor is legacy consent for Codex's native monitor. Choose the
-# wake owner separately in fleet.yaml with monitor.mode: fleet|native.
+ours-fleet spawn Coder --brain codex-fleet --role developer \
+  --approval ask --filesystem workspace --coordinator FleetCoordinator
 ```
 
-Inside a managed ACP role, `ours-fleet spawn` is transparently routed through
-that role's live supervisor. `ours-fleet spawn --role DeveloperX --temp` is the
-minimal form: omitted harness, session, cwd, coordinator, neutral permissions,
-fleet monitor policy, and same-harness model inherit from the caller. Explicit
-flags win; changing harness without a model lets the selected harness/fleet
-defaults choose one. After creation succeeds, fleet can deterministically notify
+Inside a managed role, `ours-fleet spawn` is transparently routed through
+that role's live supervisor. `ours-fleet spawn DeveloperX --temp` is the
+minimal form: omitted Brain/Role selections, cwd, coordinator, neutral permissions,
+and fleet monitor policy inherit from the caller. Identity, environment, owner routing,
+room startup, and sensitive inline Brain values do not. Explicit flags win. After
+creation succeeds, fleet can deterministically notify
 the caller's owner channel with the caller and spawned-role details. This is an
 honest-actor convenience and attribution path, not a security boundary; host
 shells and deliberately bypassed absolute binaries retain direct behavior.
@@ -305,7 +303,7 @@ ours-fleet up|down|restart|force-restart [-c FILE] [Name...]
 ours-fleet config [-c FILE]         validate + print merged plan
 ours-fleet ls | attach | peek | logs [-f] | status <Name>
 ours-fleet send <Name> "text"
-ours-fleet spawn [--temp] [<Name> | --role <Name>] [--harness --session --mission --model --approval ...]
+ours-fleet spawn [--temp] [<Name> | --name <Name>] --brain <ID|inline:{...}> --role <ID|inline:{...}> [--approval ...]
 ours-fleet loops validate|list|status
 ours-fleet loops reload <Role>
 ours-fleet loops run-now|disable|enable <Role> <Loop>
@@ -359,13 +357,75 @@ defaults:
     max_kb: 1024                        # rotate only above this active-log size
     keep_tail_kb: 256                   # UTF-8 tail; line-aligned when one fits
     max_archives: 12                    # recent beside log; older preserved cold
-Agent document:
-  Name:                                 # filename stem; [A-Za-z0-9_-]+
-    harness: claude-code
-    session: acp                         # optional; ACP is the only supported session
-    session_options:
-      acp:
-        command: claude-agent-acp        # optional advanced override
+```
+
+Agent Template document (\`~/fleet/agent_templates/Worker.yaml\`) is inert and reusable:
+
+```yaml
+role: { ref: developer }
+brain: { ref: claude-default }
+permissions: { approval: ask, filesystem: workspace, unattended: deny }
+loops:                                   # optional; temporary launches only
+  progress:
+    interval: 10m                        # required; 1m..30d
+    initial_delay: 10m                   # default: interval; 0s..30d
+    jitter: 30s                          # default: 0s; < interval and <=1h
+    enabled: true                        # default true
+    prompt: Continue the assigned work and report only material progress.
+```
+
+Agent Template-local `loops` are limited to 64 entries, implicitly scoped to the temporary agent, and
+reuse Fleet's scheduled-turn semantics: a busy occurrence is skipped, ordinary
+missed occurrences are not backlogged or replayed, and restart recovery may
+preserve at most one recent late occurrence. The trusted authoring file and
+private sealed role snapshot retain exact prompt text; resolved launch, task,
+room, provenance, and audit presentation surfaces show only bytes and SHA-256.
+
+Direct temporary spawn can set the same whole block from an owner-only regular
+file containing exactly a top-level `loops:` mapping, or explicitly disable it:
+
+```sh
+ours-fleet spawn --temp Scout --role 'inline:{mission: inspect}' --brain 'inline:{harness: codex}' --loops-file ./scout-loops.yaml
+ours-fleet spawn --temp Scout --role 'inline:{mission: inspect}' --brain 'inline:{harness: codex}' --no-loops
+ours-fleet task start TASK --member developer --loops-file ./developer-loops.yaml
+ours-fleet task start TASK --member critic --no-loops
+```
+
+`--loops-file` and `--no-loops` are mutually exclusive and temporary-only.
+For room members they override the selected Agent Template as a whole; the
+Agent Template overrides legacy omission. Omission preserves the historical
+no-loop temporary behavior and never inherits manifest `roles: ["*"]` loops.
+The file must be owned by the current user, mode 0600, non-symlink, no larger
+than 1 MB, and contain a non-empty map. Validation completes before identity,
+Cowork, snapshot, or supervisor side effects. Recovery and replacement reuse
+the private sealed normalized definition even if mutable templates later change.
+
+Persistent Agent instance (\`~/fleet/agents/Name.yaml\`) either remains a canonical
+Role/Brain composition or explicitly reuses a template:
+
+```yaml
+template: Worker
+overrides:
+  cwd: /work/name
+  permissions: { approval: allow }
+```
+
+Templates never create identities, supervisors, sessions, or lifecycle/status rows.
+Map overrides merge recursively; scalars and arrays replace; null deletion is rejected.
+
+Canonical Agent document (\`~/fleet/agents/Name.yaml\`):
+
+```yaml
+role: { ref: RoleID }
+brain: { ref: BrainID }                  # Brain owns harness/model/session/reasoning
+identity: "Display Name"                # ours identity to bind (default: Name)
+cwd: ${work_root}/repo                   # where the harness process runs
+coordinator: FleetCoordinator            # announce target on boot
+```
+
+Additional operational field inventory (schematic, not one YAML document):
+
+```text
     identity: "Display Name"            # ours identity to bind (default: Name)
     cwd: ${work_root}/repo              # where the harness process runs
     coordinator: FleetCoordinator       # announce target on boot
@@ -377,13 +437,13 @@ Agent document:
         - file_received                 #   local_contact_request, pending_message)
       batch_ms: 2000                    # coalesce a burst into one line (default 2000)
       inject: notification              # notification (default) | full (bodies inline; roadmap)
-    owner_channel:                      # optional trusted owner ingress; requires session: acp
+    owner_channel:                      # optional trusted owner ingress; requires a managed session
       identity: "Name Owner Channel"     # dedicated identity; fleet creates it with safe local defaults
       owners: [owner-contact-cid]        # authenticated ours contact IDs, never display names
       agent: managed-agent-cid           # exact role CID allowed to relay messages/files outward
       interrupt: false                  # false queues; true cancels current work first
       progress_interval_ms: 30000        # fleet-generated progress notices; 0 disables
-      comments: true                    # relay live "🟡 Live update:" ACP commentary (default true);
+      comments: true                    # relay live "🟡 Live update:" structured commentary (default true);
                                         #   restart baseline for /comments on|off
       attachments:                      # secure inbound documents, images, and voice
         enabled: true
@@ -403,13 +463,10 @@ Agent document:
       # mem_palace: false                      # claude-code: disable memory plugin
       # permission_mode: dontAsk               # claude-code: launch permission mode —
       #   one of default | acceptEdits | plan | dontAsk | bypassPermissions
-      # sandbox: workspace-write                # codex: --sandbox —
-      #   one of read-only | workspace-write | danger-full-access
-      # approval: never                         # codex: --ask-for-approval —
-      #   one of untrusted | on-request | never
-      # permission_mode: never                  # codex alias for approval
+      # Codex ACP compatibility only: native codex-app-server rejects Codex
+      # permission overrides here; use the common permissions block above.
       # launcher: auto                          # codex: auto | ours-codex | codex
-      # profile: fleet                          # codex: $CODEX_HOME/fleet.config.toml
+      # profile: fleet                          # codex ACP only: $CODEX_HOME/fleet.config.toml
       # search: true                            # codex: enable --search (live web search)
       # add_dirs: [/data/shared]                # codex: repeat --add-dir
       # monitor: true                           # explicit persistent consent to arm mail wake
@@ -449,6 +506,62 @@ installer/setup flows remain responsible for starting it.
 
 ### Rooms and tasks
 
+Init installs editable `single`, `pair`, and `team` definitions under
+`~/fleet/room_templates/`, plus every exact-cased Agent, Role, and Brain they
+reference. Inspect them with `ours-fleet template list` and
+`ours-fleet template show team`. After configuring the authenticated owner below:
+
+```sh
+ours-fleet task create --title "Solo task" --template single
+ours-fleet task create --title "Reviewed change" --template pair
+ours-fleet task create --title "Phased delivery" --template team
+```
+
+`ours-fleet init -c /path/custom.yaml` reviews the literal resolved manifest and
+`/path/custom/` split directory before doing anything. It requires a TTY and two
+default-No confirmations. You select Codex, Claude, or both; then either one explicit
+model for every job or explicit development/review/coordination models; then one
+Quick/Balanced/Thorough reasoning level (`low`/`medium`/`high`). Catalog entries are
+supported IDs, not recommendations or entitlement claims: use `ours-fleet doctor` for
+local Codex availability, while Claude entitlement is validated at launch. No
+`model_chain` is generated and Fleet never silently substitutes another model.
+
+A successful rerun adds any missing packaged defaults while preserving every existing
+manifest, Role, Agent Template, and Room Template byte. Explicit adoption of newer defaults
+is a separate reviewable migration. At either confirmation,
+N, Enter, Escape, Ctrl-C, Ctrl-D, or EOF cancels. In a picker, Escape, Ctrl-C, Ctrl-D,
+or EOF cancels; Enter records the highlighted choice (or continues a non-empty multi-select),
+N is ignored, and an empty subscription selection remains blocked. Every cancellation
+before the final Yes performs no host setup or config publication. Non-TTY use stops with
+the same zero-mutation guarantee. After the final Yes, host integration runs before locked
+publication; a hard kill, power loss, or host crash can therefore leave host integration
+or private stage/recovery evidence to inspect.
+Existing targets and their tree must be owner-private regular files/directories on the
+configuration parent's filesystem; symlinks, foreign ownership, unsafe modes, and a
+non-owner-controlled parent fail closed before host setup and are rechecked under the
+per-setup init lock before publication.
+
+The generated task experiences are fixed consequences, not extra questions: `single`
+uses `Developer`; `pair` uses `Developer` with an independent `Critic`; and `team` uses
+task-local `LocalCoordinator`, `Developer`, and `Critic`. The persistent
+`FleetCoordinator` uses the separate packaged `Coordinator` contract and coordination
+model.
+
+Revision-3 role defaults have an explicit fail-closed adoption command: first run
+`ours-fleet migrate-role-defaults -c FILE` for a zero-write plan, review every removal,
+replacement, addition, preserved custom file, staging path, and recovery path, then rerun
+with `--write`. Only exact semantic matches for packaged-bootstrap and generated
+revision-3 forms are changed; same-named customized files remain byte-identical, and a
+dangling custom reference refuses publication. Rerunning the migration is a no-op.
+
+For manual adoption of a single newer packaged file, copy the reported source beside the
+target as `.new-default`, inspect `diff -u TARGET TARGET.new-default`, then replace the
+target yourself. Rerunning init is not an update. Users with the still older exact generated
+six-worker starter Agent set must first run `ours-fleet migrate-agent-templates -c FILE`
+for its zero-write plan, review every move/addition/recovery path, and rerun with `--write`.
+Customized or ambiguous known starters are refused without mutation; unrelated custom
+persistent Agents are preserved.
+
 Rooms always use `ours-cowork`; there is no room-provider selector. Configure
 the cowork daemon connection and the room owner directly:
 
@@ -477,6 +590,13 @@ Cowork role, and task. The agent creates that identity itself with ours MCP
 work immediately. Fleet activates the room from Cowork's authenticated seat; there
 is no briefing hash, startup ACK, or separate role-briefing readiness gate.
 
+Set `room.anonymous: true` on a room template, or pass `--anonymous` to
+`task create`, `task start`, `task work`, or `room create`, to create an
+anonymous Cowork room. `--no-anonymous` explicitly overrides an anonymous
+template. Fleet records the resolved value before room creation so retries keep
+the same choice. Temporary members of an anonymous room are instructed to call
+`create_temporary_identity` with `expose_local=false`.
+
 Human task and room results use the same compact Markdown presentation in the
 CLI and authenticated owner channel: a short heading, icon-plus-word status,
 code-formatted identifiers, bounded summaries, and actionable recovery or error
@@ -495,8 +615,9 @@ optional `rooms.owner.provider` setting is separate and defaults to
 ### Scheduled agent loops
 
 Top-level `loops` schedule literal prompts from trusted local YAML. Enabled targets
-must use `session: acp`; temporary roles never inherit loops, including `roles:
-["*"]`. Fleet rejects an enabled loop when its explicitly selected base config is
+must use a managed session (`acp` or `codex-app-server`); temporary roles never
+inherit these manifest loops, including `roles: ["*"]`. Only their sealed Agent
+Template/CLI-local `loops` apply. Fleet rejects an enabled loop when its explicitly selected base config is
 a symlink, is owned by another user, or is group/world writable. Prompts are
 bounded and normalized at validation time, but only their size and SHA-256 appear
 in `config`, `list`, logs, or durable state.
@@ -582,11 +703,13 @@ native settings actually grant, against a fixed floor:
 those requests with nobody to see it. With `unattended: wait` it **warns**,
 since a human can still attach a console and answer.
 
-**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`.
-`auto` selects Codex ACP `agent` (`on-request` + `workspace-write`) / Claude
-`acceptEdits`. `allow` selects Codex ACP's fully non-interactive yolo mode,
-reported by the adapter as `agent-full-access` (`never` +
-`danger-full-access`); Claude uses `bypassPermissions`.
+**Security meaning.** For native Codex, Fleet translates `ask` → `untrusted`,
+`auto` → `on-request`, and `allow` → `never`; users configure only the Fleet
+names. `permissions.filesystem` independently maps `read-only` → `read-only`,
+`workspace` → `workspace-write`, and `unrestricted` → `danger-full-access`.
+Claude maps `ask` to `default`, `auto` to `acceptEdits`, and `allow` to
+`bypassPermissions`. Codex ACP retains its adapter-specific coupled modes:
+`auto` selects `agent`, while `allow` selects `agent-full-access`.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
 `allow` role previously ran unable to do its job. Legacy `deny` is accepted
 only for compatibility and retains its conservative Codex `on-request` /
@@ -1038,23 +1161,49 @@ The main Codex controls are Brain-owned and also available when spawning:
 ```yaml
 # ~/fleet/brains/codex-review.yaml
 harness: codex
-session: acp
+session: codex-app-server
 model: gpt-5.4
+permissions:
+  approval: auto
+  filesystem: read-only
+  unattended: deny
 harness_options:
   launcher: auto
-  profile: fleet
-  sandbox: read-only
-  approval: on-request
   monitor: true
   search: true
   add_dirs: [/data/shared]
   config: { model_reasoning_effort: high }
 ```
 
-Equivalent one-off/permanent spawn controls include `--model`, `--permission-mode`,
-`--sandbox`, `--profile`, `--launcher`, `--search`, legacy `--monitor` (native
-Codex monitor consent), repeatable
-`--codex-config key=value`, and repeatable `--add-dir`. Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
+`codex-app-server` is the opt-in direct Codex transport. It streams native items
+and message phases, maps Codex approval
+requests into Fleet permissions, supports turn steering/interrupt, and resumes
+the durable Codex thread through Fleet's shared `.session-id` lifecycle.
+Configure its authority only through the shared `permissions:` block;
+`on-request` and other Codex policy names are internal adapter values.
+Codex rejects `--profile` for `app-server`, so native roles also reject
+`harness_options.profile`; use the explicit config map only for non-authority
+settings. Native config currently allows only `model_reasoning_effort`; Codex ACP
+retains its legacy profile and config support.
+Packaged Codex brains and the init wizard continue to select `session: acp` for
+compatibility; Claude Code also uses ACP. Existing durable sessions are not assumed portable
+between unrelated providers; a failed fast resume is handled by Fleet's normal
+bounded fresh-session recovery.
+
+To replace the default launcher for a native Codex role:
+
+```yaml
+session_options:
+  codex_app_server:
+    command: [codex, app-server]
+```
+
+The command override is exact: Fleet does not append `--profile`, `--search`, or
+`app-server`, so include every required argument in the command itself.
+
+One-off/permanent spawn selects a Brain that owns model, reasoning, native permission,
+sandbox, profile, launcher, search, monitor consent, native config, and additional roots.
+Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
 role-specific ours daemon, or configure the host default in `~/.ours/config.json`.
 
 ## Agent isolation

package/dist/agent-recovery-gate.d.ts

@@ -0,0 +1,17 @@
+import type { ConversationEventV1 } from './session/conversation-types.js';
+import type { AgentSession } from './session/types.js';
+export interface AgentRecoveryEvidence {
+    ok: boolean;
+    reason: 'RECOVERY_TOOLS_VERIFIED' | 'RECOVERY_PROMPT_MISSING' | 'RECOVERY_TURN_INCOMPLETE' | 'RECOVERY_TURN_FAILED' | 'RECOVERY_CHOOSE_MISSING' | 'RECOVERY_CURRENT_MISSING' | 'RECOVERY_GET_MESSAGES_MISSING' | 'RECOVERY_TOOL_ORDER_INVALID';
+    chooseIdentity: boolean;
+    currentIdentity: boolean;
+    getMessages: boolean;
+    turnCompleted: boolean;
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export declare function evaluateAgentRecovery(events: readonly ConversationEventV1[], promptId: string, identity: string): AgentRecoveryEvidence;
+export declare function recoverAgentIdentity(session: AgentSession, identity: string): Promise<AgentRecoveryEvidence>;

package/dist/agent-recovery-gate.js

@@ -0,0 +1,135 @@
+const TOOL_NAMES = {
+    choose: new Set(['choose_identity', 'ours.choose_identity', 'mcp__ours__choose_identity']),
+    current: new Set(['current_identity', 'ours.current_identity', 'mcp__ours__current_identity']),
+    messages: new Set(['get_messages', 'ours.get_messages', 'mcp__ours__get_messages']),
+};
+function recordFor(records, event) {
+    if (event.kind !== 'tool.upsert' || !event.toolCallId)
+        return undefined;
+    const payload = event.payload;
+    const previous = records.get(event.toolCallId) ?? {};
+    const next = {
+        ...previous,
+        ...(payload.title !== undefined ? { title: payload.title } : {}),
+        ...(payload.status !== undefined ? { status: payload.status } : {}),
+        ...(payload.rawInput !== undefined ? { rawInput: payload.rawInput } : {}),
+        ...(payload.status === 'completed' ? { completedSeq: event.seq } : {}),
+    };
+    records.set(event.toolCallId, next);
+    return next;
+}
+function objectInput(input) {
+    if (!input || input.truncated || input.redacted || !input.json
+        || typeof input.json !== 'object' || Array.isArray(input.json))
+        return undefined;
+    return input.json;
+}
+function safeChoose(record, identity) {
+    if (!record.title || !TOOL_NAMES.choose.has(record.title) || record.status !== 'completed')
+        return false;
+    const input = objectInput(record.rawInput);
+    if (!input)
+        return false;
+    const keys = Object.keys(input).sort();
+    if (keys.some(key => key !== 'force' && key !== 'name'))
+        return false;
+    return input.name === identity && (input.force === undefined || input.force === false);
+}
+function safeNoOrBoundedInput(record, names, allowed) {
+    if (!record.title || !names.has(record.title) || record.status !== 'completed')
+        return false;
+    if (!record.rawInput)
+        return allowed({});
+    const input = objectInput(record.rawInput);
+    return input !== undefined && allowed(input);
+}
+function safeCurrent(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.current, input => Object.keys(input).length === 0);
+}
+function safeMessages(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.messages, input => {
+        const keys = Object.keys(input);
+        if (keys.some(key => key !== 'limit'))
+            return false;
+        return input.limit === undefined
+            || (Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 200);
+    });
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export function evaluateAgentRecovery(events, promptId, identity) {
+    const ordered = [...events].sort((a, b) => a.seq - b.seq);
+    const admitted = ordered.find(event => event.kind === 'prompt.admitted' && event.promptId === promptId);
+    const empty = (reason) => ({
+        ok: false, reason, chooseIdentity: false, currentIdentity: false,
+        getMessages: false, turnCompleted: false,
+    });
+    if (!admitted)
+        return empty('RECOVERY_PROMPT_MISSING');
+    const terminal = ordered.find(event => event.seq > admitted.seq
+        && event.kind === 'turn.completed'
+        && event.promptId === promptId
+        && event.sessionGeneration === admitted.sessionGeneration);
+    if (!terminal)
+        return empty('RECOVERY_TURN_INCOMPLETE');
+    const outcome = terminal.payload.outcome;
+    if (outcome !== 'completed')
+        return empty('RECOVERY_TURN_FAILED');
+    const records = new Map();
+    for (const event of ordered) {
+        if (event.seq <= admitted.seq || event.seq >= terminal.seq
+            || event.promptId !== promptId
+            || event.sessionGeneration !== admitted.sessionGeneration)
+            continue;
+        recordFor(records, event);
+    }
+    const values = [...records.values()];
+    const chooses = values.filter(record => safeChoose(record, identity));
+    const currents = values.filter(safeCurrent);
+    const messages = values.filter(safeMessages);
+    const chooseIdentity = chooses.length > 0;
+    const currentIdentity = currents.length > 0;
+    const getMessages = messages.length > 0;
+    const base = { chooseIdentity, currentIdentity, getMessages, turnCompleted: true };
+    if (!chooseIdentity)
+        return { ok: false, reason: 'RECOVERY_CHOOSE_MISSING', ...base };
+    if (!currentIdentity)
+        return { ok: false, reason: 'RECOVERY_CURRENT_MISSING', ...base };
+    if (!getMessages)
+        return { ok: false, reason: 'RECOVERY_GET_MESSAGES_MISSING', ...base };
+    const orderedChain = chooses.some(choose => currents.some(current => messages.some(message => choose.completedSeq !== undefined && current.completedSeq !== undefined
+        && message.completedSeq !== undefined
+        && choose.completedSeq < current.completedSeq
+        && current.completedSeq < message.completedSeq)));
+    if (!orderedChain)
+        return { ok: false, reason: 'RECOVERY_TOOL_ORDER_INVALID', ...base };
+    return { ok: true, reason: 'RECOVERY_TOOLS_VERIFIED', ...base };
+}
+export async function recoverAgentIdentity(session, identity) {
+    if (!session.subscribeConversation)
+        return {
+            ok: false, reason: 'RECOVERY_PROMPT_MISSING', chooseIdentity: false,
+            currentIdentity: false, getMessages: false, turnCompleted: false,
+        };
+    const events = [];
+    const unsubscribe = session.subscribeConversation(event => events.push(event));
+    try {
+        const queued = await session.queuePrompt([
+            '[fleet-recovery] The shared ours daemon restarted.',
+            `Call ours choose_identity with name ${JSON.stringify(identity)} and force false.`,
+            'Then call current_identity, then get_messages. Complete all three in that order.',
+            'Do not create/delete identities, force-bind, interrupt, or restart any service/session.',
+        ].join('\n'), { origin: { kind: 'fleet-monitor' } });
+        await queued.completion;
+        // Conversation publication is synchronous with terminal settlement in the
+        // in-tree ACP store; filtering by exact promptId/sessionGeneration remains
+        // the authority even if unrelated events arrived concurrently.
+        return evaluateAgentRecovery(events, queued.promptId, identity);
+    }
+    finally {
+        unsubscribe();
+    }
+}

package/dist/application/capabilities.js

@@ -1,7 +1,10 @@
+import { sessionBackendCapabilities } from '../session/types.js';
 export function roleCapabilities(role, status, context = {}) {
-    const backend = role.configuredBackend ?? (role.detectedBackend === 'acp' ? 'acp' : undefined);
+    const backend = role.configuredBackend
+        ?? (role.detectedBackend === 'acp' || role.detectedBackend === 'codex-app-server'
+            ? role.detectedBackend : undefined);
     const online = status.session.reachability === 'online';
-    const acp = backend === 'acp';
+    const session = backend ? sessionBackendCapabilities(backend, role.config?.harness) : undefined;
     const protocolVersion = context.controlProtocolVersion ?? 1;
     const inactive = status.overall === 'offline'
         || (!online && status.supervisor.liveness === 'stopped');
@@ -10,11 +13,20 @@ export function roleCapabilities(role, status, context = {}) {
         inventory: true,
         status: true,
         output: {
-            recent: acp, stream: acp && protocolVersion >= 2,
-            structured: acp, replayCursor: acp && protocolVersion >= 2,
+            recent: Boolean(session?.streaming),
+            stream: Boolean(session?.streaming) && protocolVersion >= 2,
+            structured: Boolean(session?.durableConversation),
+            replayCursor: Boolean(session?.durableConversation) && protocolVersion >= 2,
+        },
+        input: {
+            text: online && Boolean(session?.promptInput),
+            interrupt: online && Boolean(session?.interrupt),
+            steering: online && Boolean(session?.steering),
+        },
+        permissions: {
+            observe: Boolean(session?.permissions),
+            respond: online && Boolean(session?.permissions),
         },
-        input: { text: online && acp, interrupt: online && acp, steering: false },
-        permissions: { observe: acp, respond: acp && online },
         lifecycle: {
             start: role.lifetime === 'permanent' && status.supervisor.liveness !== 'running',
             stop: role.lifetime === 'permanent' && !inactive && status.supervisor.liveness !== 'stopped',