@ours.network/fleet 1.1.0-nightly.22 → 1.1.0-nightly.23

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.0-nightly.22",
-  "buildId": "bfb51e6ced00",
-  "commit": "5447c29d81481c7880fa9cf5bfbbcc2ff294950f",
+  "version": "1.1.0-nightly.23",
+  "buildId": "de853a9ef3d8",
+  "commit": "f970d01c44d8a5cad2627c1bdde833e412508613",
   "dirty": true,
-  "builtAt": "2026-09-01T19:41:56.761Z",
+  "builtAt": "2026-09-02T07:30:34.670Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/owner-channel/channel.d.ts

@@ -225,6 +225,8 @@ export declare class OwnerChannel implements OwnerChannelHandle {
         resourceIds?: Record<string, string>;
         presentations?: FleetAuditPresentation[];
     }): Promise<FleetAuditAttempt>;
+    private flushPendingFleetCommandAudits;
+    private deliverFleetCommandOutcome;
     recover(epoch: string): Promise<void>;
     private recoveryStage;
     private writeShutdownState;

package/dist/owner-channel/channel.js

@@ -199,6 +199,7 @@ export class OwnerChannel {
         }
         this.startedOnce = true;
         this.ready = true;
+        await this.flushPendingFleetCommandAudits();
         // Do not make role startup wait for an old owner request to finish a turn.
         // watchLoop itself drains before every establishment, including this first
         // one, so there is no drain-to-tip race.
@@ -301,33 +302,50 @@ export class OwnerChannel {
                 return attempt;
             if (attempt.outcome?.delivery === 'uncertain')
                 return attempt;
-            let uncertain = false;
-            try {
-                for (const event of attempt.outcome?.presentations ?? []) {
-                    try {
-                        await this.sendProactiveMessage(renderFleetLifecycleEvent(event), `fleet-lifecycle\0${lifecycleEventDigestBasis(event)}`, 0);
-                    }
-                    catch (error) {
-                        if (error instanceof DuplicateSendError) {
-                            if (error.status !== 'delivered')
-                                uncertain = true;
-                            this.options.log(`[${this.options.role}] duplicate Fleet lifecycle event suppressed`);
-                            continue;
-                        }
-                        throw error;
-                    }
-                }
-            }
-            catch (error) {
-                uncertain = true;
-                this.logError(`fleet lifecycle delivery uncertain correlation=${attempt.correlationId}`, error);
-            }
-            attempt = this.commandAudits.outcome(attempt.correlationId, this.options.role, uncertain ? 'uncertain' : 'delivered');
-            return attempt;
+            // Before the Owner sink is attached, ordinary commands have nothing to
+            // deliver. Lifecycle presentations remain in the never-attempted
+            // `sending` state and are flushed exactly once when start() makes the
+            // authenticated sink ready. A restart converts them to `uncertain`, so
+            // effects are never replayed after an unproven delivery boundary.
+            if (!attempt.outcome?.presentations?.length)
+                return this.commandAudits.outcome(attempt.correlationId, this.options.role, 'delivered');
+            if (!this.ready)
+                return attempt;
+            return this.deliverFleetCommandOutcome(attempt);
         });
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
     }
+    async flushPendingFleetCommandAudits() {
+        for (const attempt of this.commandAudits.list())
+            if (attempt.outcome?.delivery === 'sending')
+                await this.deliverFleetCommandOutcome(attempt);
+    }
+    async deliverFleetCommandOutcome(attempt) {
+        let uncertain = false;
+        try {
+            for (const event of attempt.outcome?.presentations ?? []) {
+                try {
+                    await this.sendProactiveMessage(renderFleetLifecycleEvent(event), `fleet-lifecycle\0${lifecycleEventDigestBasis(event)}`, 0);
+                }
+                catch (error) {
+                    if (error instanceof DuplicateSendError) {
+                        if (error.status !== 'delivered')
+                            uncertain = true;
+                        this.options.log(`[${this.options.role}] duplicate Fleet lifecycle event suppressed`);
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+        }
+        catch (error) {
+            uncertain = true;
+            this.logError(`fleet lifecycle delivery uncertain correlation=${attempt.correlationId}`, error);
+        }
+        attempt = this.commandAudits.outcome(attempt.correlationId, this.options.role, uncertain ? 'uncertain' : 'delivered');
+        return attempt;
+    }
     recover(epoch) {
         if (this.stopping)
             return Promise.reject(new Error('owner channel is stopping'));

package/dist/runner.js

@@ -26,6 +26,7 @@ import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-prox
 import { effectivePermissionMode } from './permissions.js';
 import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
 import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
+import { FleetCommandAuditStore } from './fleet-command-audit.js';
 export const SUPERVISOR_RECYCLE_REQUIRED = 'OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED';
 export class SupervisorRecycleRequiredError extends Error {
     code = SUPERVISOR_RECYCLE_REQUIRED;
@@ -70,6 +71,31 @@ const defaultDeps = () => ({
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
 const OBSOLETE_OURS_AUTOSTART_ENV = 'OURS_AUTOSTART';
+function localFleetAuditor(stateDir, caller, log) {
+    const store = new FleetCommandAuditStore(join(stateDir, '.fleet-command-audit.json'));
+    return {
+        async begin(requestId, argv) {
+            let attempt = store.begin(requestId, caller, argv);
+            if (attempt.invocation === 'sending') {
+                log(`[${caller}] fleet proxy command ${attempt.correlationId} `
+                    + `route=${attempt.classification.route} decision=${attempt.classification.decision}`);
+                attempt = store.invocation(attempt.correlationId, caller, 'delivered');
+            }
+            return attempt;
+        },
+        async finish(input) {
+            let attempt = store.finish(input.correlationId, caller, {
+                class: input.class, effect: input.effect,
+                ...(input.exitCode === undefined ? {} : { exitCode: input.exitCode }),
+                ...(input.resourceIds ? { resourceIds: input.resourceIds } : {}),
+                ...(input.presentations ? { presentations: input.presentations } : {}),
+            });
+            if (attempt.outcome?.delivery === 'sending')
+                attempt = store.outcome(attempt.correlationId, caller, 'delivered');
+            return attempt;
+        },
+    };
+}
 /** Environment injected only into the managed harness process. */
 export function managedFleetProxyEnv(role, stateDir) {
     const roleEnv = { ...(role.env ?? {}) };
@@ -612,11 +638,28 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + `${error?.message ?? String(error)}`);
             }
         }
-        control = deps.createControlServer(dir, arbiter, deps.log);
         try {
+            if (role.owner_channel)
+                ownerChannel = deps.createOwnerChannel({
+                    role: name,
+                    harness: role.harness,
+                    config: role.owner_channel,
+                    session: arbiter,
+                    stateDir: dir,
+                    env: role.env,
+                    log: deps.log,
+                    ...(ownerBinder ? { binderLease: ownerBinder } : {}),
+                    ...(configPath ? { configPath } : {}),
+                });
+            control = deps.createControlServer(dir, arbiter, deps.log);
+            control.setFleetAuditor(ownerChannel ? {
+                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
+                finish: input => ownerChannel.finishFleetCommandAudit(input),
+            } : localFleetAuditor(dir, name, deps.log));
             await control.start();
         }
         catch (error) {
+            await ownerChannel?.close().catch(() => undefined);
             ownerBinder?.release();
             await agentSession.close();
             unsubscribeRecovery?.();
@@ -731,18 +774,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
                 + 'keeping temporary supervisor alive');
         sessionStartupComplete = true;
-        if (role.owner_channel) {
-            ownerChannel = deps.createOwnerChannel({
-                role: name,
-                harness: role.harness,
-                config: role.owner_channel,
-                session: arbiter,
-                stateDir: dir,
-                env: role.env,
-                log: deps.log,
-                ...(ownerBinder ? { binderLease: ownerBinder } : {}),
-                ...(configPath ? { configPath } : {}),
-            });
+        if (ownerChannel) {
             try {
                 await ownerChannel.start();
             }
@@ -761,10 +793,6 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         }
         if (ownerChannel) {
             control.setOwnerChannel(ownerChannel);
-            control.setFleetAuditor({
-                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
-                finish: input => ownerChannel.finishFleetCommandAudit(input),
-            });
         }
         reloadLoopConfig = async () => {
             const nextRole = findRole(loadConfig(configPath), name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.1.0-nightly.22",
+  "version": "1.1.0-nightly.23",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",