@ours.network/fleet 1.1.0-nightly.2 → 1.1.0-nightly.21

package/dist/rooms-tasks/provision.js

@@ -1,18 +1,27 @@
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
 import { parse } from 'yaml';
 import { advanceSaga, setSagaError, updateMemberSeats, updateMemberStartup, activateRoom, getRoomRecord, } from './room-state.js';
 import { activateTask, updateTaskMembers, blockTask, unblockTask, getTask, } from './task-state.js';
+import { storedRoomLaunchPolicy } from './types.js';
 import { spawnTemp } from '../spawn.js';
-import { findRole } from '../config.js';
+import { effectivePermissionMode } from '../permissions.js';
+import { selectionOrigin, summarizeResolvedLaunch, } from '../lifecycle-summary.js';
+import { canonicalJson } from '../canonical-json.js';
+import { readLaunchSnapshot, redactLaunchDefinition } from './launch-snapshot.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from '../fleet-proxy.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { closeManagedRoom } from './close.js';
+import { withFileLock } from '../atomic-file.js';
+import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
+import { TaskStateError, taskDeletionState } from './task-state.js';
 import { buildRoomMemberTask, sha256Text } from './member-startup.js';
 import { agentDir } from '../paths.js';
 import { readProvenance } from '../creation.js';
 import { readTempSupervisor, secureStoppedTempArchive, tempArchiveForCreationAction, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { recordFleetAuditPresentation } from '../fleet-command-audit.js';
 export function getBinPath() {
     try {
         return realpathSync(process.argv[1]);
@@ -21,6 +30,23 @@ export function getBinPath() {
         return process.argv[1];
     }
 }
+function selectionSummary(selection) {
+    if ('ref' in selection)
+        return `ref:${selection.ref} (reference)`;
+    return `inline:sha256:${createHash('sha256').update(canonicalJson(selection.inline)).digest('hex').slice(0, 16)} (inline)`;
+}
+function permissionSummary(definition) {
+    const permissions = definition.permissions;
+    if (!permissions)
+        return undefined;
+    return `approval=${permissions.approval},filesystem=${permissions.filesystem},unattended=${permissions.unattended}`;
+}
+function launchDefinition(definition) {
+    return {
+        projection: redactLaunchDefinition(definition),
+        fingerprint: createHash('sha256').update(canonicalJson(definition)).digest('hex'),
+    };
+}
 async function spawnRoomMember(options, binPath) {
     const stateDir = process.env[FLEET_PROXY_STATE_DIR_ENV];
     if (!stateDir)
@@ -41,8 +67,27 @@ async function spawnRoomMember(options, binPath) {
         statePath: result.statePath,
         creationActionId: result.creationActionId,
         callerRole: result.caller,
+        ...(result.configuration ? { configuration: result.configuration } : {}),
     };
 }
+/**
+ * Launch-boundary capture: the exact ResolvedRole the spawn persisted,
+ * whitelisted into the operator-facing presentation. Capture is required for
+ * every launched room member — launchMatches has already proved role.yaml
+ * readable, and effectivePermissionMode is total over registered harnesses —
+ * so a failure here is a capture defect and must surface, not degrade to the
+ * legacy rendering.
+ */
+function presentationFromStatePath(statePath, settings, coworkRole) {
+    const resolved = parse(readFileSync(join(statePath, 'role.yaml'), 'utf8'));
+    return summarizeResolvedLaunch(resolved, {
+        role: selectionOrigin(settings.definition.role),
+        brain: selectionOrigin(settings.definition.brain),
+        template: settings.template,
+        permissionMode: effectivePermissionMode(resolved),
+        missionFallback: coworkRole,
+    });
+}
 function shortId(id) { return id.slice(0, 8); }
 function expandMembers(template, prefix) {
     const result = [];
@@ -52,28 +97,32 @@ function expandMembers(template, prefix) {
                 name: `${prefix}-${slot.slot}-${i}`,
                 slot: slot.slot,
                 coworkRole: slot.role,
-                roleRef: slot.role_ref,
-                overrides: slot.overrides,
+                agentTemplate: slot.agent_template,
+                launchDefinitionId: slot.launch_definition_id ?? slot.agent_template,
+                agentTemplateHash: slot.agent_template_hash,
+                loopSource: slot.loop_source ?? 'omitted',
             });
         }
     }
     return result;
 }
-function settingsFor(member, cfg) {
-    let refRole;
-    try {
-        refRole = findRole(cfg, member.roleRef);
-    }
-    catch { /* no ref role */ }
-    const permissions = member.overrides?.permissions;
+function settingsFor(member, cfg, sealed) {
+    const definition = sealed
+        ? sealed[member.launchDefinitionId]
+        : cfg.agentTemplates?.[member.agentTemplate];
+    if (!definition)
+        throw new Error(sealed
+            ? `Sealed Agent definition '${member.launchDefinitionId}' not found`
+            : `Agent Template '${member.agentTemplate}' not found`);
+    const role = definition.role;
     return {
-        model: member.overrides?.model ?? refRole?.model,
-        harness: member.overrides?.harness ?? refRole?.harness,
-        cwd: member.overrides?.cwd ?? refRole?.cwd,
-        persona: member.overrides?.persona ?? refRole?.persona,
-        approval: permissions?.approval,
-        filesystem: permissions?.filesystem,
-        unattended: permissions?.unattended,
+        definition: structuredClone(definition),
+        ...('inline' in role && typeof role.inline.persona === 'string'
+            ? { persona: role.inline.persona } : {}),
+        template: member.agentTemplate,
+        templateHash: member.agentTemplateHash
+            ?? createHash('sha256').update(canonicalJson(definition)).digest('hex'),
+        loopSource: member.loopSource,
     };
 }
 function roomTask(input, member, settings, members, roomIdentityCid, ownerSeatCid) {
@@ -96,7 +145,7 @@ function roomTask(input, member, settings, members, roomIdentityCid, ownerSeatCi
         })),
     });
 }
-function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid, expectedInviteId) {
+function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid, expectedInviteId, anonymous = false) {
     const provenance = readProvenance(dir);
     if (provenance?.creationActionId !== actionId || provenance.role !== member.name)
         return false;
@@ -104,13 +153,12 @@ function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid,
         const role = parse(readFileSync(`${dir}/role.yaml`, 'utf8'));
         const startup = role.roomMemberStartup;
         return role.identity === member.name
-            && typeof role.mission === 'string'
-            && sha256Text(role.mission) === taskSha
             && startup?.room_id === roomId
             && startup.room_identity_cid === roomIdentityCid
             && startup.identity_name === member.name
             && startup.role === member.coworkRole
-            && startup.task === role.mission
+            && (startup.anonymous ?? false) === anonymous
+            && sha256Text(startup.task ?? '') === taskSha
             && (expectedInviteId === undefined || startup.invite_id === expectedInviteId)
             && typeof startup.invite === 'string'
             && startup.invite.length > 0;
@@ -120,21 +168,22 @@ function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid,
     }
 }
 async function retainRunningLaunch(input) {
-    const { provision, member, task, roomIdentityCid } = input;
+    const { provision, member, settings, task, roomIdentityCid } = input;
     let seat = getRoomRecord(provision.roomId).member_seats
         .find(candidate => candidate.role_name === member.name);
     const dir = agentDir(member.name, true);
     const taskSha = sha256Text(task);
+    const anonymous = storedRoomLaunchPolicy(getRoomRecord(provision.roomId)?.room_policy).anonymous;
     if ((seat.launch?.state === 'intent' || seat.launch?.state === 'launched'
         || seat.launch?.state === 'failed') && existsSync(dir)) {
-        if (!seat.launch.action_id || !launchMatches(dir, member, seat.launch.action_id, taskSha, provision.roomId, roomIdentityCid, seat.invite_id)) {
+        if (!seat.launch.action_id || !launchMatches(dir, member, seat.launch.action_id, taskSha, provision.roomId, roomIdentityCid, seat.invite_id, anonymous)) {
             const provenance = readProvenance(dir);
             const adoptable = (seat.launch.state === 'intent' || seat.launch.state === 'failed')
                 && Boolean(seat.launch.caller_role)
                 && provenance?.surface === 'agent'
                 && provenance.callerRole === seat.launch.caller_role
                 && typeof provenance.creationActionId === 'string'
-                && launchMatches(dir, member, provenance.creationActionId, taskSha, provision.roomId, roomIdentityCid, seat.invite_id);
+                && launchMatches(dir, member, provenance.creationActionId, taskSha, provision.roomId, roomIdentityCid, seat.invite_id, anonymous);
             if (!adoptable)
                 throw new Error(`existing launch for ${member.name} does not match its durable intent`);
             updateMemberStartup(provision.roomId, member.name, { launch: {
@@ -152,9 +201,14 @@ async function retainRunningLaunch(input) {
             throw new Error(`existing launch for ${member.name} has unknown liveness`);
         const retainedLaunch = seat.launch;
         if (live === 'running') {
+            // A crash between spawn and the seat update (or a pre-upgrade launch)
+            // can retain a running member without a captured presentation; backfill
+            // it from the same persisted resolved role the match was proved against.
+            const presentation = retainedLaunch.presentation
+                ?? presentationFromStatePath(dir, settings, member.coworkRole);
             updateMemberStartup(provision.roomId, member.name, { launch: {
                     ...retainedLaunch, state: 'launched', launch_id: supervisor.launchId,
-                    updated_at: new Date().toISOString(),
+                    presentation, updated_at: new Date().toISOString(),
                 } });
             return true;
         }
@@ -169,7 +223,7 @@ async function retainRunningLaunch(input) {
         if (!seat.launch.launch_id || !seat.launch.action_id)
             throw new Error(`missing durable launch identity for disappeared ${member.name}`);
         const archive = await secureStoppedTempArchive(member.name, seat.launch.launch_id);
-        if (!launchMatches(archive, member, seat.launch.action_id, taskSha, provision.roomId, roomIdentityCid, seat.invite_id)) {
+        if (!launchMatches(archive, member, seat.launch.action_id, taskSha, provision.roomId, roomIdentityCid, seat.invite_id, anonymous)) {
             throw new Error(`archive for disappeared ${member.name} does not match its durable intent`);
         }
         updateMemberStartup(provision.roomId, member.name, { launch: {
@@ -181,7 +235,7 @@ async function retainRunningLaunch(input) {
         if (!seat.launch.action_id)
             throw new Error(`missing action ID for disappeared launch intent ${member.name}`);
         const archive = tempArchiveForCreationAction(member.name, seat.launch.action_id);
-        if (!archive || !launchMatches(archive.path, member, seat.launch.action_id, taskSha, provision.roomId, roomIdentityCid, seat.invite_id)) {
+        if (!archive || !launchMatches(archive.path, member, seat.launch.action_id, taskSha, provision.roomId, roomIdentityCid, seat.invite_id, anonymous)) {
             throw new Error(`launch intent for ${member.name} has no exact live or terminated archive evidence`);
         }
         updateMemberStartup(provision.roomId, member.name, { launch: {
@@ -191,7 +245,25 @@ async function retainRunningLaunch(input) {
     }
     return false;
 }
+/**
+ * Member-launch publication window: for a task-bound room, the durable launch
+ * intent, spawn, and launch record publish under the common task-operation
+ * lock so an accepted deletion linearizes strictly before (bounded abort — no
+ * spawn happens) or strictly after (the seat's launch record is visible to
+ * deletion retirement). The lock is held per member only, never across
+ * seat-wait loops.
+ */
 async function launchMember(input) {
+    const taskId = input.provision.taskId;
+    if (!taskId)
+        return launchMemberUnlocked(input);
+    return withFileLock(taskOperationLockPath(taskId), () => {
+        if (taskDeletionState(taskId) !== 'none')
+            throw new Error(`task ${taskId} is pending deletion; aborting member launch for ${input.member.name}`);
+        return launchMemberUnlocked(input);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+async function launchMemberUnlocked(input) {
     const { provision, member, settings, startup } = input;
     const seat = getRoomRecord(provision.roomId).member_seats
         .find(candidate => candidate.role_name === member.name);
@@ -199,10 +271,14 @@ async function launchMember(input) {
     let effectiveActionId = actionId;
     const attempt = (seat.launch?.attempt ?? 0) + 1;
     const taskSha = sha256Text(startup.task);
+    const effectiveAgentDefinition = structuredClone(settings.definition);
+    const { projection: agentDefinition, fingerprint: agentFingerprint } = launchDefinition(effectiveAgentDefinition);
     const proxyCaller = process.env[FLEET_PROXY_STATE_DIR_ENV]
         ? process.env[FLEET_PROXY_CALLER_ENV] : undefined;
     updateMemberStartup(provision.roomId, member.name, { launch: {
             state: 'intent', attempt, action_id: actionId, mission_sha256: taskSha,
+            agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
+            agent_template: settings.template, agent_template_hash: settings.templateHash,
             ...(proxyCaller ? { caller_role: proxyCaller } : {}),
             updated_at: new Date().toISOString(),
         } });
@@ -211,13 +287,10 @@ async function launchMember(input) {
             name: member.name,
             temp: true,
             identity: member.name,
-            mission: startup.task,
-            model: settings.model,
-            harness: settings.harness,
-            cwd: settings.cwd,
-            approval: settings.approval,
-            filesystem: settings.filesystem,
-            unattended: settings.unattended,
+            agentDefinition: settings.definition,
+            ...(settings.loopSource === 'cli' && settings.definition.loops === undefined
+                ? { noLoops: true } : {}),
+            loopSource: settings.loopSource,
             surface: 'agent',
             creationActionId: actionId,
             roomMemberStartup: startup,
@@ -227,27 +300,48 @@ async function launchMember(input) {
         if (launched.creationActionId !== actionId) {
             updateMemberStartup(provision.roomId, member.name, { launch: {
                     state: 'intent', attempt, action_id: launched.creationActionId,
-                    mission_sha256: taskSha, updated_at: new Date().toISOString(),
+                    mission_sha256: taskSha, agent_definition: agentDefinition,
+                    agent_fingerprint: agentFingerprint,
+                    agent_template: settings.template, agent_template_hash: settings.templateHash,
+                    updated_at: new Date().toISOString(),
                     ...(launched.callerRole ? { caller_role: launched.callerRole } : {}),
                 } });
         }
         const supervisor = readTempSupervisor(launchedDir);
-        if (!supervisor || supervisor.role !== member.name || !launchMatches(launchedDir, member, launched.creationActionId, taskSha, provision.roomId, startup.room_identity_cid, startup.invite_id)) {
+        if (!supervisor || supervisor.role !== member.name || !launchMatches(launchedDir, member, launched.creationActionId, taskSha, provision.roomId, startup.room_identity_cid, startup.invite_id, startup.anonymous ?? false)) {
             throw new Error(`new launch for ${member.name} did not persist matching provenance`);
         }
+        const presentation = launched.configuration
+            ? { ...launched.configuration, template: settings.template,
+                ...(launched.configuration.mission ? {} : { mission: member.coworkRole }) }
+            : presentationFromStatePath(launchedDir, settings, member.coworkRole);
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'launched', attempt, action_id: launched.creationActionId, mission_sha256: taskSha,
+                agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
+                agent_template: settings.template, agent_template_hash: settings.templateHash,
+                presentation,
                 ...(launched.callerRole ? { caller_role: launched.callerRole } : {}),
                 launch_id: supervisor.launchId, updated_at: new Date().toISOString(),
             } });
+        recordFleetAuditPresentation({ kind: 'agent_started', id: member.name, name: member.name,
+            lifetime: 'temporary', brain: selectionSummary(settings.definition.brain),
+            role: selectionSummary(settings.definition.role),
+            harness: presentation.harness, session: 'acp',
+            permissions: permissionSummary(settings.definition), parent: provision.roomId,
+            actionId: launched.creationActionId, inherited: [],
+            configuration: presentation });
     }
     catch (error) {
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'failed', attempt, action_id: effectiveActionId, mission_sha256: taskSha,
+                agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
+                agent_template: settings.template, agent_template_hash: settings.templateHash,
                 ...(proxyCaller ? { caller_role: proxyCaller } : {}),
                 updated_at: new Date().toISOString(),
                 error: error instanceof Error ? error.message : String(error),
             } });
+        recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Agent', id: member.name,
+            state: 'failed', category: 'readiness_failed', eventId: effectiveActionId });
         throw error;
     }
 }
@@ -285,29 +379,56 @@ function reconcileMemberSeats(roomId, members, observed) {
     updateMemberSeats(roomId, seats);
     return { complete, seats };
 }
+function assertCoworkRoomPolicy(room, expectedAnonymous) {
+    if ((room.anonymous ?? false) !== expectedAnonymous)
+        throw new Error(`Cowork anonymity (${String(room.anonymous ?? false)}) does not match Fleet's durable Room policy (${String(expectedAnonymous)})`);
+}
 export async function provisionMembers(input) {
     const { cfg, cowork, roomId, taskId, template } = input;
+    // Deletion-epoch pre-check; each member launch re-checks under the lock.
+    if (taskId && taskDeletionState(taskId) !== 'none')
+        throw new Error(`task ${taskId} is pending deletion; refusing to provision members`);
     const prefix = taskId ? shortId(taskId) : `room-${shortId(roomId)}`;
     const members = expandMembers(template, prefix);
+    // Resolve every Agent before persisting launch intent or touching Cowork membership.
+    const sealed = template.launch_snapshot_hash
+        ? readLaunchSnapshot(template.launch_snapshot_hash) : undefined;
+    const settings = new Map(members.map(member => [member.name, settingsFor(member, cfg, sealed)]));
     const existing = getRoomRecord(roomId);
     if (!existing?.room_identity_cid)
         throw new Error(`room ${roomId} has no pinned room identity CID`);
     const roomIdentityCid = existing.room_identity_cid;
     const ownerSeatCid = existing.owner_seat_cid ?? null;
+    const roomPolicy = storedRoomLaunchPolicy(existing.room_policy);
     const persistedNames = new Set(existing.member_seats.map(seat => seat.role_name));
     const resuming = members.length > 0
         && members.every(member => persistedNames.has(member.name));
     if (!resuming) {
         advanceSaga(roomId, 'create_members', 3);
-        updateMemberSeats(roomId, members.map(member => ({
-            role_name: member.name,
-            slot: member.slot,
-            cowork_role: member.coworkRole,
-            seat_state: 'pending',
-            launch: { state: 'pending', attempt: 0, updated_at: new Date().toISOString() },
-        })));
+        updateMemberSeats(roomId, members.map(member => {
+            const memberSettings = settings.get(member.name);
+            const evidence = launchDefinition(memberSettings.definition);
+            return ({
+                role_name: member.name,
+                slot: member.slot,
+                cowork_role: member.coworkRole,
+                seat_state: 'pending',
+                launch: { state: 'pending', attempt: 0,
+                    agent_definition: evidence.projection, agent_fingerprint: evidence.fingerprint,
+                    agent_template: memberSettings.template,
+                    agent_template_hash: memberSettings.templateHash,
+                    updated_at: new Date().toISOString() },
+            });
+        }));
+    }
+    else {
+        for (const member of members) {
+            const seat = existing.member_seats.find(candidate => candidate.role_name === member.name);
+            const evidence = launchDefinition(settings.get(member.name).definition);
+            if (!seat.launch?.agent_fingerprint || seat.launch.agent_fingerprint !== evidence.fingerprint)
+                throw new Error(`Agent definition drift for ${member.name}; durable launch intent does not match current configuration`);
+        }
     }
-    const settings = new Map(members.map(member => [member.name, settingsFor(member, cfg)]));
     const tasks = new Map(members.map(member => [member.name, roomTask(input, member, settings.get(member.name), members, roomIdentityCid, ownerSeatCid)]));
     const policy = {
         timeoutMs: input.startupWait?.timeoutMs ?? 60_000,
@@ -319,6 +440,7 @@ export async function provisionMembers(input) {
     advanceSaga(roomId, 'join_role_groups', 4);
     try {
         const initialRoom = await cowork.recoverRoom(roomId);
+        assertCoworkRoomPolicy(initialRoom, roomPolicy.anonymous);
         reconcileMemberSeats(roomId, members, initialRoom.seats);
         for (const member of members) {
             const task = tasks.get(member.name);
@@ -326,13 +448,15 @@ export async function provisionMembers(input) {
                 .find(seat => seat.role_name === member.name);
             if (currentSeat.seat_state === 'active') {
                 if (!await retainRunningLaunch({
-                    provision: input, member, task, roomIdentityCid,
+                    provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
                 })) {
                     throw new Error(`active Cowork seat ${member.name} has no matching live Fleet launch`);
                 }
                 continue;
             }
-            if (await retainRunningLaunch({ provision: input, member, task, roomIdentityCid }))
+            if (await retainRunningLaunch({
+                provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
+            }))
                 continue;
             const issued = await cowork.issueInvite(roomId, {
                 mode: 'one_time', role: member.coworkRole, min_accepts: 1,
@@ -353,6 +477,7 @@ export async function provisionMembers(input) {
                         role: member.coworkRole,
                         task,
                         owner_seat_cid: ownerSeatCid,
+                        anonymous: roomPolicy.anonymous,
                     },
                 });
             }
@@ -365,8 +490,17 @@ export async function provisionMembers(input) {
     catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
         setSagaError(roomId, reason, 'Member invite or launch failed. Retry with `task recover`.', 'member_failed');
-        if (taskId)
-            blockTask(taskId, reason);
+        if (taskId) {
+            // A deletion-pending (or already-terminal) task rejects the block
+            // overlay; the original launch failure must still propagate.
+            try {
+                blockTask(taskId, reason);
+            }
+            catch (blockError) {
+                if (!(blockError instanceof TaskStateError))
+                    throw blockError;
+            }
+        }
         throw error;
     }
     advanceSaga(roomId, 'wait_seats', 5);
@@ -374,6 +508,7 @@ export async function provisionMembers(input) {
     let delay = policy.initialDelayMs;
     for (;;) {
         const remote = await cowork.recoverRoom(roomId);
+        assertCoworkRoomPolicy(remote, roomPolicy.anonymous);
         const reconciled = reconcileMemberSeats(roomId, members, remote.seats);
         if (reconciled.complete)
             break;

package/dist/rooms-tasks/room-state.d.ts

@@ -9,6 +9,7 @@ export interface CreateRoomInput {
     room_identity_cid?: string;
     task_id?: string;
     template_snapshot?: import('./types.js').TemplateSnapshot;
+    room_policy?: import('./types.js').RoomLaunchPolicy;
 }
 export declare function createRoomRecord(input: CreateRoomInput): RoomOrchestrationRecord;
 export declare function getRoomRecord(id: string): RoomOrchestrationRecord | undefined;

package/dist/rooms-tasks/room-state.js

@@ -2,6 +2,8 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:f
 import { join } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { storedRoomLaunchPolicy } from './types.js';
+import { releaseLaunchSnapshot } from './launch-snapshot.js';
 export const roomsDir = () => join(stateRoot(), 'rooms');
 function roomPath(id) { return join(roomsDir(), `${id}.json`); }
 export class RoomStateError extends Error {
@@ -18,8 +20,13 @@ function writeRoom(record) {
 }
 export function createRoomRecord(input) {
     const existing = getRoomRecord(input.room_id);
-    if (existing)
+    if (existing) {
+        const before = storedRoomLaunchPolicy(existing.room_policy);
+        const requested = storedRoomLaunchPolicy(input.room_policy);
+        if (JSON.stringify(before) !== JSON.stringify(requested))
+            throw new RoomStateError(`room ${input.room_id} launch policy mismatch`);
         return existing;
+    }
     const record = {
         room_id: input.room_id,
         room_name: input.room_name,
@@ -27,6 +34,7 @@ export function createRoomRecord(input) {
         room_identity_cid: input.room_identity_cid,
         task_id: input.task_id,
         template_snapshot: input.template_snapshot,
+        room_policy: input.room_policy,
         saga: { phase: 'persist_intent', step_index: 0 },
         member_seats: [],
         state: 'provisioning',
@@ -46,8 +54,11 @@ export function getRoomRecord(id) {
 /** Remove a terminal orchestration record from the live room inventory. */
 export function deleteRoomRecord(id) {
     const path = roomPath(id);
+    const hash = getRoomRecord(id)?.template_snapshot?.launch_snapshot_hash;
     if (existsSync(path))
         rmSync(path);
+    if (hash)
+        releaseLaunchSnapshot(hash);
 }
 export function listRoomRecords(filter) {
     const dir = roomsDir();

package/dist/rooms-tasks/task-state.d.ts

@@ -1,12 +1,18 @@
-import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent } from './types.js';
+import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
 }
+/**
+ * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
+ * mutation, terminal settlement, and room publication must fail boundedly.
+ */
+export declare function assertNoPendingDeletion(task: TaskRecord): void;
 export interface CreateTaskInput {
     title: string;
     brief?: string;
     brief_file?: string;
     template?: TaskTemplateRef;
+    execution_plan?: TaskRecord['execution_plan'];
     origin: TaskOrigin;
     idempotency_key?: string;
     start?: boolean;
@@ -16,9 +22,11 @@ export interface CreateTaskInput {
 }
 export declare function createTask(input: CreateTaskInput): TaskRecord;
 export declare function getTask(id: string): TaskRecord;
+export declare function updateTaskExecutionPlan(id: string, executionPlan: NonNullable<TaskRecord['execution_plan']>): TaskRecord;
 export declare function listTasks(filter?: {
     state?: TaskState | TaskState[];
     listId?: string;
+    includeDeleting?: boolean;
 }): TaskRecord[];
 export declare function moveTaskToList(id: string, listId: string): TaskRecord;
 export declare function findByIdempotencyKey(key: string): TaskRecord | undefined;
@@ -43,5 +51,109 @@ export declare function failTask(id: string, error: string): TaskRecord;
 export declare function updateTaskRoom(id: string, roomId: string, roomIdentityCid: string): TaskRecord;
 export declare function updateTaskTemplate(id: string, template: TaskTemplateRef): TaskRecord;
 export declare function updateTaskMembers(id: string, members: TaskMemberRole[]): TaskRecord;
-/** Remove a completed task from Fleet's backlog. Missing tasks are an idempotent no-op. */
-export declare function deleteTask(id: string): boolean;
+/**
+ * Lenient read for deletion settlement and status surfaces: a broken list
+ * reference must never make a task unreadable or undeletable. Missing records
+ * throw the canonical task-not-found error; other read failures propagate.
+ */
+export declare function getDeletingTask(id: string): TaskRecord;
+/** Cheap durable deletion-epoch probe for room/member publication guards. */
+export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
+/**
+ * Durable, surface-independent audit evidence for a permanent deletion. The
+ * receipt outlives the task record: written with the acceptance intent, and
+ * completed before settlement is reported. Metadata only — never brief or
+ * room content.
+ */
+export interface TaskDeletionReceipt {
+    schema_version: 1;
+    task_id: string;
+    title: string;
+    accepted_at: string;
+    actor: TaskDeletionActor;
+    original_state: TaskState;
+    room_id?: string;
+    member_count: number;
+    settled_at?: string;
+    result?: 'deleted';
+}
+export declare const deletionReceiptsDir: () => string;
+export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt | undefined;
+/**
+ * Ensure the acceptance receipt exists before any cleanup side effect,
+ * backfilling it from the durable intent (heals a crash between the intent
+ * write and the receipt write). Fails closed: a receipt write error aborts
+ * settlement rather than deleting resources without audit evidence.
+ */
+export declare function ensureTaskDeletionReceipt(id: string): void;
+/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+export declare function completeTaskDeletionReceipt(id: string): void;
+export type TaskDeletionAcceptance = {
+    status: 'accepted' | 'pending';
+    task: TaskRecord;
+} | {
+    status: 'already_absent';
+};
+/**
+ * Persist the first-wins durable deletion intent. Accepts every lifecycle
+ * state, takes precedence over a pending terminal intent, and never touches
+ * remote resources. Repeat requests while pending re-arm settlement; a request
+ * for a missing record reports the idempotent already-absent outcome.
+ *
+ * Low-level record mutation only. Callers serialize acceptance with settlement
+ * through deletion.ts, which holds the common task-operation lock.
+ */
+export declare function beginTaskDeletionIntent(id: string, actor: TaskDeletionActor): TaskDeletionAcceptance;
+/** Record an actionable settlement failure; the task stays hidden and recoverable. */
+export declare function setTaskDeletionError(id: string, error: string, recoveryHint: string): TaskRecord;
+/** Marker proving a member never launched, mirroring close.ts's short path. */
+export declare const DELETION_MEMBER_NEVER_LAUNCHED = "never-launched";
+/** Marker proving absence verified against temp state AND the CID-wide identity scan. */
+export declare const DELETION_MEMBER_ABSENT_VERIFIED = "absent-verified";
+/**
+ * Advance a member retirement cursor carried by the deletion intent. Only
+ * adjacent forward transitions are legal — plus the explicit
+ * pending → identity_absent short path proved by the 'never-launched' marker —
+ * so no managed agent can be claimed retired without the full evidence chain.
+ * launch_id and archive_path are immutable once recorded; same-phase retries
+ * are idempotent but must not change evidence.
+ */
+export declare function advanceTaskDeletionMember(id: string, name: string, phase: TaskDeletionMemberPhase, launchId?: string, archivePath?: string): TaskRecord;
+interface SeatEvidence {
+    role_name: string;
+    identity_cid?: string;
+    retirement?: {
+        phase: TaskDeletionMemberPhase;
+        launch_id: string;
+        archive_path?: string;
+    };
+}
+/**
+ * Durably register cursors for late-provisioned members before retirement
+ * begins: provisioning publishes room seats before updateTaskMembers, so the
+ * acceptance snapshot can be empty while live seats exist. Seats without a
+ * recorded identity CID are not registered here — until a CID is recorded
+ * there is no managed identity to orphan, and the room record still carries
+ * those seats through the close saga that follows.
+ */
+export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+/**
+ * The pre-room-delete checkpoint: import completed retirement evidence from
+ * room seats into the deletion cursors, so a crash between room-record
+ * deletion and task unlink retries from durable cursors instead of
+ * reconstructing consumed evidence. Call ONLY after closeManagedRoom has
+ * completed retirement and BEFORE cowork.deleteRoom/deleteRoomRecord.
+ *
+ * The room saga is trusted for phase jumps, but partial or corrupt retained
+ * records must not become false success: every seat must be identity_absent;
+ * a real launch requires archive evidence; an identity-less seat is accepted
+ * only via the never-launched proof.
+ */
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+/**
+ * Physically remove a deletion-pending task record. Settlement-only: callers
+ * must have completed member retirement and room cleanup first. Missing
+ * records are the idempotent already-settled outcome.
+ */
+export declare function unlinkDeletedTask(id: string): boolean;
+export {};