@ours.network/fleet 1.1.0-nightly.21 → 1.1.0-nightly.23

package/README.md

@@ -517,6 +517,15 @@ ours-fleet task create --title "Reviewed change" --template pair
 ours-fleet task create --title "Phased delivery" --template team
 ```
 
+The default `team` gives only its LocalCoordinator Agent Template a 15-minute
+continuity loop. Each idle-only pass uses authenticated assigned-room evidence,
+posts at most one missing interval update or status request, and reports `STALLED`
+only after concrete stopped/blocked evidence or the role's documented request/ETA
+window. Stable history/checkpoint fingerprints suppress duplicates; `single` and
+`pair` remain loop-free. This preset does not widen permissions: task planning and
+launch still fail closed when the selected harness cannot supply the configured
+unattended messaging and checkpoint capabilities.
+
 `ours-fleet init -c /path/custom.yaml` reviews the literal resolved manifest and
 `/path/custom/` split directory before doing anything. It requires a TTY and two
 default-No confirmations. You select Codex, Claude, or both; then either one explicit
@@ -547,11 +556,12 @@ task-local `LocalCoordinator`, `Developer`, and `Critic`. The persistent
 `FleetCoordinator` uses the separate packaged `Coordinator` contract and coordination
 model.
 
-Revision-3 role defaults have an explicit fail-closed adoption command: first run
+Revision-3 role defaults and exact revision-4 LocalCoordinator/team defaults have an
+explicit fail-closed adoption command: first run
 `ours-fleet migrate-role-defaults -c FILE` for a zero-write plan, review every removal,
 replacement, addition, preserved custom file, staging path, and recovery path, then rerun
 with `--write`. Only exact semantic matches for packaged-bootstrap and generated
-revision-3 forms are changed; same-named customized files remain byte-identical, and a
+revision-3/4 forms are changed; same-named customized files remain byte-identical, and a
 dangling custom reference refuses publication. Rerunning the migration is a no-op.
 
 For manual adoption of a single newer packaged file, copy the reported source beside the

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.0-nightly.21",
-  "buildId": "32d8b887e2f4",
-  "commit": "a56b31845896d4c26d6c9488f276a2e3ba644834",
+  "version": "1.1.0-nightly.23",
+  "buildId": "de853a9ef3d8",
+  "commit": "f970d01c44d8a5cad2627c1bdde833e412508613",
   "dirty": true,
-  "builtAt": "2026-09-01T14:48:16.620Z",
+  "builtAt": "2026-09-02T07:30:34.670Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/owner-channel/channel.d.ts

@@ -225,6 +225,8 @@ export declare class OwnerChannel implements OwnerChannelHandle {
         resourceIds?: Record<string, string>;
         presentations?: FleetAuditPresentation[];
     }): Promise<FleetAuditAttempt>;
+    private flushPendingFleetCommandAudits;
+    private deliverFleetCommandOutcome;
     recover(epoch: string): Promise<void>;
     private recoveryStage;
     private writeShutdownState;

package/dist/owner-channel/channel.js

@@ -199,6 +199,7 @@ export class OwnerChannel {
         }
         this.startedOnce = true;
         this.ready = true;
+        await this.flushPendingFleetCommandAudits();
         // Do not make role startup wait for an old owner request to finish a turn.
         // watchLoop itself drains before every establishment, including this first
         // one, so there is no drain-to-tip race.
@@ -301,33 +302,50 @@ export class OwnerChannel {
                 return attempt;
             if (attempt.outcome?.delivery === 'uncertain')
                 return attempt;
-            let uncertain = false;
-            try {
-                for (const event of attempt.outcome?.presentations ?? []) {
-                    try {
-                        await this.sendProactiveMessage(renderFleetLifecycleEvent(event), `fleet-lifecycle\0${lifecycleEventDigestBasis(event)}`, 0);
-                    }
-                    catch (error) {
-                        if (error instanceof DuplicateSendError) {
-                            if (error.status !== 'delivered')
-                                uncertain = true;
-                            this.options.log(`[${this.options.role}] duplicate Fleet lifecycle event suppressed`);
-                            continue;
-                        }
-                        throw error;
-                    }
-                }
-            }
-            catch (error) {
-                uncertain = true;
-                this.logError(`fleet lifecycle delivery uncertain correlation=${attempt.correlationId}`, error);
-            }
-            attempt = this.commandAudits.outcome(attempt.correlationId, this.options.role, uncertain ? 'uncertain' : 'delivered');
-            return attempt;
+            // Before the Owner sink is attached, ordinary commands have nothing to
+            // deliver. Lifecycle presentations remain in the never-attempted
+            // `sending` state and are flushed exactly once when start() makes the
+            // authenticated sink ready. A restart converts them to `uncertain`, so
+            // effects are never replayed after an unproven delivery boundary.
+            if (!attempt.outcome?.presentations?.length)
+                return this.commandAudits.outcome(attempt.correlationId, this.options.role, 'delivered');
+            if (!this.ready)
+                return attempt;
+            return this.deliverFleetCommandOutcome(attempt);
         });
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
     }
+    async flushPendingFleetCommandAudits() {
+        for (const attempt of this.commandAudits.list())
+            if (attempt.outcome?.delivery === 'sending')
+                await this.deliverFleetCommandOutcome(attempt);
+    }
+    async deliverFleetCommandOutcome(attempt) {
+        let uncertain = false;
+        try {
+            for (const event of attempt.outcome?.presentations ?? []) {
+                try {
+                    await this.sendProactiveMessage(renderFleetLifecycleEvent(event), `fleet-lifecycle\0${lifecycleEventDigestBasis(event)}`, 0);
+                }
+                catch (error) {
+                    if (error instanceof DuplicateSendError) {
+                        if (error.status !== 'delivered')
+                            uncertain = true;
+                        this.options.log(`[${this.options.role}] duplicate Fleet lifecycle event suppressed`);
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+        }
+        catch (error) {
+            uncertain = true;
+            this.logError(`fleet lifecycle delivery uncertain correlation=${attempt.correlationId}`, error);
+        }
+        attempt = this.commandAudits.outcome(attempt.correlationId, this.options.role, uncertain ? 'uncertain' : 'delivered');
+        return attempt;
+    }
     recover(epoch) {
         if (this.stopping)
             return Promise.reject(new Error('owner channel is stopping'));

package/dist/preset-migration.d.ts

@@ -31,7 +31,7 @@ interface MigrationHooks {
     beforeLockClaim?: () => void;
     beforeRoleDefaultPublish?: () => void;
 }
-/** Explicit adoption of exact packaged revision-3 role defaults; customized files are never changed. */
+/** Explicit adoption of exact packaged revision-3/4 role defaults; customized files are never changed. */
 export declare function migratePackagedRoleDefaults(configuration: string, options?: {
     write?: boolean;
 }, hooks?: MigrationHooks): RoleDefaultMigrationResult;

package/dist/preset-migration.js

@@ -44,7 +44,14 @@ const V3_GENERATED_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
     'agent_templates/Tester.yaml': '3733db187951353f855dc998f1dd1f66d883eb556a3e6431a7abf4e267f63071',
     'agents/FleetCoordinator.yaml': '70f90797899828c3669c3914e8f873314e48cb9502aff187d2f1fbc9177f6df9',
 });
-const V4_ROLE_DEFAULTS = new Set([
+const V4_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
+    'agent_templates/LocalCoordinator.yaml': 'f04a88b541e655e0039e4dc9834293b5180f6d488a473a6c51b50d0b72dae83b',
+    'room_templates/team.yaml': 'accaa3569781f7acde3f15c89f447f4132f580f936513379c704aad27481e13f',
+});
+const V4_GENERATED_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
+    'agent_templates/LocalCoordinator.yaml': 'cb7c83a835dde9d45bac42cadce2f196f561d2460321c690cdef435f7076f97f',
+});
+const V5_ROLE_DEFAULTS = new Set([
     'roles/Coordinator.yaml', 'roles/LocalCoordinator.yaml', 'roles/Developer.yaml', 'roles/Critic.yaml',
     'agent_templates/LocalCoordinator.yaml', 'agent_templates/Developer.yaml', 'agent_templates/Critic.yaml',
     'room_templates/single.yaml', 'room_templates/pair.yaml', 'room_templates/team.yaml',
@@ -145,7 +152,7 @@ function validateRoleDefaultMigration(stageManifest) {
                 throw new Error(`Room Template '${template.name}' references missing Agent Template '${member.agent_template}'`);
     }
 }
-/** Explicit adoption of exact packaged revision-3 role defaults; customized files are never changed. */
+/** Explicit adoption of exact packaged revision-3/4 role defaults; customized files are never changed. */
 export function migratePackagedRoleDefaults(configuration, options = {}, hooks = {}) {
     const configPath = resolve(configuration);
     const root = splitRootFor(configPath);
@@ -166,18 +173,28 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
         const removals = [];
         const replacements = [];
         const preserved = [];
-        for (const [relative, expected] of Object.entries(V3_ROLE_DEFAULT_FINGERPRINTS)) {
+        const known = new Set([
+            ...Object.keys(V3_ROLE_DEFAULT_FINGERPRINTS),
+            ...Object.keys(V4_ROLE_DEFAULT_FINGERPRINTS),
+        ]);
+        for (const relative of known) {
             const path = join(root, relative);
             if (!existsSync(path))
                 continue;
             const actual = fingerprint(path);
-            if (actual === expected || actual === V3_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative])
-                (V4_ROLE_DEFAULTS.has(relative) ? replacements : removals).push(path);
+            const recognized = [
+                V3_ROLE_DEFAULT_FINGERPRINTS[relative],
+                V3_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
+                V4_ROLE_DEFAULT_FINGERPRINTS[relative],
+                V4_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
+            ].some(expected => expected !== undefined && actual === expected);
+            if (recognized)
+                (V5_ROLE_DEFAULTS.has(relative) ? replacements : removals).push(path);
             else
                 preserved.push(path);
         }
         const additions = [];
-        for (const relative of V4_ROLE_DEFAULTS) {
+        for (const relative of V5_ROLE_DEFAULTS) {
             const path = join(root, relative);
             if (!existsSync(path))
                 additions.push(path);

package/dist/runner.js

@@ -26,6 +26,7 @@ import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-prox
 import { effectivePermissionMode } from './permissions.js';
 import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
 import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
+import { FleetCommandAuditStore } from './fleet-command-audit.js';
 export const SUPERVISOR_RECYCLE_REQUIRED = 'OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED';
 export class SupervisorRecycleRequiredError extends Error {
     code = SUPERVISOR_RECYCLE_REQUIRED;
@@ -70,6 +71,31 @@ const defaultDeps = () => ({
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
 const OBSOLETE_OURS_AUTOSTART_ENV = 'OURS_AUTOSTART';
+function localFleetAuditor(stateDir, caller, log) {
+    const store = new FleetCommandAuditStore(join(stateDir, '.fleet-command-audit.json'));
+    return {
+        async begin(requestId, argv) {
+            let attempt = store.begin(requestId, caller, argv);
+            if (attempt.invocation === 'sending') {
+                log(`[${caller}] fleet proxy command ${attempt.correlationId} `
+                    + `route=${attempt.classification.route} decision=${attempt.classification.decision}`);
+                attempt = store.invocation(attempt.correlationId, caller, 'delivered');
+            }
+            return attempt;
+        },
+        async finish(input) {
+            let attempt = store.finish(input.correlationId, caller, {
+                class: input.class, effect: input.effect,
+                ...(input.exitCode === undefined ? {} : { exitCode: input.exitCode }),
+                ...(input.resourceIds ? { resourceIds: input.resourceIds } : {}),
+                ...(input.presentations ? { presentations: input.presentations } : {}),
+            });
+            if (attempt.outcome?.delivery === 'sending')
+                attempt = store.outcome(attempt.correlationId, caller, 'delivered');
+            return attempt;
+        },
+    };
+}
 /** Environment injected only into the managed harness process. */
 export function managedFleetProxyEnv(role, stateDir) {
     const roleEnv = { ...(role.env ?? {}) };
@@ -612,11 +638,28 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + `${error?.message ?? String(error)}`);
             }
         }
-        control = deps.createControlServer(dir, arbiter, deps.log);
         try {
+            if (role.owner_channel)
+                ownerChannel = deps.createOwnerChannel({
+                    role: name,
+                    harness: role.harness,
+                    config: role.owner_channel,
+                    session: arbiter,
+                    stateDir: dir,
+                    env: role.env,
+                    log: deps.log,
+                    ...(ownerBinder ? { binderLease: ownerBinder } : {}),
+                    ...(configPath ? { configPath } : {}),
+                });
+            control = deps.createControlServer(dir, arbiter, deps.log);
+            control.setFleetAuditor(ownerChannel ? {
+                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
+                finish: input => ownerChannel.finishFleetCommandAudit(input),
+            } : localFleetAuditor(dir, name, deps.log));
             await control.start();
         }
         catch (error) {
+            await ownerChannel?.close().catch(() => undefined);
             ownerBinder?.release();
             await agentSession.close();
             unsubscribeRecovery?.();
@@ -731,18 +774,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
                 + 'keeping temporary supervisor alive');
         sessionStartupComplete = true;
-        if (role.owner_channel) {
-            ownerChannel = deps.createOwnerChannel({
-                role: name,
-                harness: role.harness,
-                config: role.owner_channel,
-                session: arbiter,
-                stateDir: dir,
-                env: role.env,
-                log: deps.log,
-                ...(ownerBinder ? { binderLease: ownerBinder } : {}),
-                ...(configPath ? { configPath } : {}),
-            });
+        if (ownerChannel) {
             try {
                 await ownerChannel.start();
             }
@@ -761,10 +793,6 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         }
         if (ownerChannel) {
             control.setOwnerChannel(ownerChannel);
-            control.setFleetAuditor({
-                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
-                finish: input => ownerChannel.finishFleetCommandAudit(input),
-            });
         }
         reloadLoopConfig = async () => {
             const nextRole = findRole(loadConfig(configPath), name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.1.0-nightly.21",
+  "version": "1.1.0-nightly.23",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/presets/fleet/agent_templates/LocalCoordinator.yaml

@@ -2,3 +2,48 @@ role: { ref: LocalCoordinator }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
 permissions: { approval: ask, filesystem: workspace, unattended: deny }
+loops:
+  continuity:
+    interval: 15m
+    prompt: |
+      Perform one bounded, observation-only continuity pass for the assigned task room. Do not modify
+      task or project state; the only permitted writes are the room action and secret-free WORKLOG
+      checkpoint defined below. Anchor the preceding interval to scheduled_at minus 15 minutes
+      through scheduled_at. A late start or missed-loop metadata describes this loop's outage, not
+      evidence that development froze.
+
+      Re-read ROUTINES.md when present and the continuity checkpoint in WORKLOG.md. Use bounded
+      `list_history` reads filtered to the assigned room CID and direction as needed. Do not drain
+      unread mail or mark unrelated mail read. Ignore unrelated contacts and private messages.
+      Use only attributable room/task evidence. Exclude loop-authored `CONTINUITY *` messages from
+      development evidence and fingerprint inputs; retain their request/report IDs separately for
+      dedupe. Lifecycle state `active`, elapsed time, silence, task difficulty, and filesystem
+      dirtiness alone do not prove development is active, meaningful progress, or a stall. Meaningful
+      progress is a concrete reported change, test result, decision, handoff, blocker delta, active
+      step, or unexpired ETA.
+
+      After a mandatory final history recheck, choose exactly one mutually exclusive branch:
+      - Terminal: if attributable evidence says the task is terminal, do nothing.
+      - Recent update: if the room already has a meaningful update in the interval, do nothing.
+      - Ongoing: if attributable development evidence is ongoing but the room has no meaningful
+        update in the interval, send at most one concise
+        `CONTINUITY ACTIVE [start..end]: <observed facts>; next=<known step or ETA>` update.
+      - Unobservable/no evidence: never invent activity. If no qualifying outstanding continuity
+        request exists, send one direct `CONTINUITY CHECK` request for status, next step, and ETA.
+        If the prior request is less than 10 minutes old or its ETA is unexpired, do nothing. If it
+        is at least 10 minutes old, no later meaningful evidence exists, and the ETA is absent or
+        elapsed, send at most one clear `CONTINUITY STALLED` report.
+      - Explicit stop: if attributable evidence says work stopped or is blocked with no active next
+        step, send at most one clear `CONTINUITY STALLED` report.
+
+      Before any send, suppress a semantic duplicate found by the final history recheck or checkpoint;
+      room history wins if they disagree. Build the stable fingerprint from classification and
+      non-loop evidence IDs/timestamps plus requested/reported state, excluding loop-authored
+      continuity messages, prose, and time-of-check so unchanged classification and evidence state
+      stay silent. Store continuity request/report IDs separately. Later meaningful progress resets
+      a prior request or stall. Append a secret-free WORKLOG checkpoint with interval, classification,
+      evidence IDs/times, fingerprint, and any separate request/report ID.
+
+      Do not edit project files, run implementation or tests, interrupt peers, spawn or manage agents,
+      invoke task/room lifecycle actions, infer from unrelated messages, or exceed LocalCoordinator
+      authority. Complete silently when no room action is required.

package/presets/fleet/room_templates/team.yaml

@@ -3,6 +3,7 @@ description: "Locally coordinated team: LocalCoordinator sequences, Developer ex
 room: { quiet_membership: false, anonymous: false }
 contract: |
   LocalCoordinator coordinates sequencing, handoffs, context, and blockers among existing members.
+  LocalCoordinator performs a bounded 15-minute continuity check without taking over implementation.
   Developer owns implementation and verification evidence.
   Critic independently reviews and withholds sign-off on material failures.
   LocalCoordinator has no Fleet lifecycle or agent-management authority.

package/presets/manifest.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "preset_revision": 4,
+  "preset_revision": 5,
   "brain_catalog_revision": 1,
   "description": "ours-fleet standard configuration presets"
 }