@ours.network/fleet 1.1.0-nightly.25 → 1.1.0-nightly.26

package/dist/owner-channel/commands.d.ts

@@ -1,7 +1,7 @@
 import type { InterruptOutcome, SessionEvent, SessionSnapshot } from '../session/types.js';
 import type { RoomOrchestrationRecord, TaskOutcome, TaskRecord, TaskTerminalIntent, TaskListRecord } from '../rooms-tasks/types.js';
 import { type OwnerCommentsState } from './notices.js';
-import type { CreateRoomRequest, CreateTaskRequest, TaskRoomApplicationService } from '../application/task-room-service.js';
+import type { CreateRoomRequest, CreateTaskRequest, TaskProvisioningOutcome, TaskRoomApplicationService } from '../application/task-room-service.js';
 import type { TaskState } from '../rooms-tasks/types.js';
 /**
  * Fleet-level effects a deterministic owner command may trigger. Production
@@ -19,6 +19,9 @@ export interface OwnerFleetOps {
     settleTask(taskId: string): Promise<void>;
     /** Settle an accepted task deletion outside the caller role's supervisor lifecycle. */
     settleTaskDeletion(taskId: string): Promise<void>;
+    /** Continue an accepted provisioning saga until convergence. */
+    provisionTask(taskId: string): Promise<void>;
+    /** Explicit recovery may also route terminal and deletion intents. */
     recoverTask(taskId: string): Promise<void>;
 }
 /**
@@ -58,7 +61,9 @@ export interface OwnerCommandContext {
     terminalTask(taskId: string, kind: TaskTerminalIntent['kind'], outcome?: TaskOutcome): Promise<void>;
     recoverTask(taskId: string): Promise<void>;
     createTask(input: Omit<CreateTaskRequest, 'actor'>): Promise<TaskRecord>;
-    startTask(taskId: string): Promise<TaskRecord>;
+    startTask(taskId: string): Promise<TaskProvisioningOutcome | TaskRecord>;
+    awaitTask?(taskId: string): Promise<TaskProvisioningOutcome>;
+    taskProvisioningOutcome?(taskId: string): TaskProvisioningOutcome;
     listTasks(filter?: {
         state?: TaskState | TaskState[];
         list?: string;

package/dist/owner-channel/commands.js

@@ -106,6 +106,24 @@ const taskAction = (title, task, fields = []) => renderMarkdownResult({
         ...fields,
     ],
 });
+const taskProvisioningAction = (outcome) => {
+    if (outcome.kind === 'failed')
+        return renderMarkdownFailure({
+            kind: 'state', subject: `/task await ${outcome.task.task_id}`,
+            detail: outcome.blocker ?? 'Provisioning reached a terminal failure.',
+            action: outcome.next_action ?? `Run /task recover ${outcome.task.task_id}.`,
+        });
+    return taskAction(outcome.kind === 'ready' ? 'Room provisioning complete'
+        : outcome.next_action ? 'Room provisioning needs attention' : 'Room provisioning continues', outcome.task, [
+        ...(outcome.room ? [{ label: 'Room', value: `${outcome.room.room_id} — ${outcome.room.room_name}` }] : []),
+        ...(outcome.launch.template ? [{ label: 'Template', value: outcome.launch.template, kind: 'code' }] : []),
+        { label: 'Members', value: `${outcome.members.active}/${outcome.members.expected} active; ${outcome.members.launched}/${outcome.members.expected} launched` },
+        ...(outcome.blocker ? [{ label: 'Blocker', value: outcome.blocker }] : []),
+        ...(outcome.next_action ? [{ label: 'Next action', value: outcome.next_action }] : []),
+        ...(outcome.kind === 'in_progress'
+            ? [{ label: 'Await', value: `/task await ${outcome.task.task_id}`, kind: 'code' }] : []),
+    ]);
+};
 const roomAction = (title, room, fields = []) => renderMarkdownResult({
     icon: '🏠', title,
     fields: [
@@ -319,6 +337,12 @@ export const ownerCommands = [
                             title: titleParts.join(' '), origin: { type: 'owner_channel' },
                             backlog, template, noRoom, brief: trailingLines, list,
                         });
+                        const provisioning = !backlog && !noRoom && t.room_id
+                            ? ctx.taskProvisioningOutcome?.(t.task_id) : undefined;
+                        if (provisioning) {
+                            await ctx.reply(taskProvisioningAction(provisioning));
+                            break;
+                        }
                         await ctx.reply(taskAction('Task created', t, [
                             { label: 'Title', value: t.title },
                             ...(template ? [{ label: 'Template', value: template, kind: 'code' }] : []),
@@ -419,8 +443,17 @@ export const ownerCommands = [
                     case 'start': {
                         if (!rest[0])
                             throw new OwnerCommandUsageError('usage: /task start <id>');
-                        const t = await ctx.startTask(rest[0]);
-                        await ctx.reply(taskAction('Task started', t));
+                        const started = await ctx.startTask(rest[0]);
+                        await ctx.reply('kind' in started
+                            ? taskProvisioningAction(started) : taskAction('Task started', started));
+                        break;
+                    }
+                    case 'await': {
+                        if (!rest[0])
+                            throw new OwnerCommandUsageError('usage: /task await <id>');
+                        if (!ctx.awaitTask)
+                            throw new Error('task await is unavailable');
+                        await ctx.reply(taskProvisioningAction(await ctx.awaitTask(rest[0])));
                         break;
                     }
                     case 'block': {
@@ -731,6 +764,7 @@ export function fleetCliOps(role, configPath) {
         closeRoom: roomId => launchFleetWorker(['room', '_delete', roomId], `room-delete-${roomId}`, configPath),
         settleTask: taskId => launchFleetWorker(['task', '_settle', taskId], `task-settle-${taskId}`, configPath),
         settleTaskDeletion: taskId => launchFleetWorker(['task', '_settle_delete', taskId], `task-delete-${taskId}`, configPath),
+        provisionTask: taskId => launchFleetWorker(['task', '_provision', taskId], `task-provision-${taskId}`, configPath),
         recoverTask: taskId => launchFleetWorker(['task', '_recover', taskId], `task-recover-${taskId}`, configPath),
     };
 }

package/dist/owner-channel/lifecycle-outbox.d.ts

@@ -0,0 +1,24 @@
+import { type FleetAuditPresentation } from '../fleet-command-audit.js';
+type LifecycleDelivery = 'pending' | 'delivered' | 'uncertain';
+interface LifecycleOutboxEntry {
+    digest: string;
+    presentation: FleetAuditPresentation;
+    delivery: LifecycleDelivery;
+}
+/** Durable lifecycle acceptance queue; plaintext is limited to validated concise presentations. */
+export declare class FleetLifecycleOutbox {
+    private readonly path;
+    private entries;
+    private corruptReason?;
+    constructor(path: string);
+    integrity(): {
+        ok: boolean;
+        error?: string;
+    };
+    enqueue(presentations: FleetAuditPresentation[]): void;
+    pending(): readonly LifecycleOutboxEntry[];
+    finish(digest: string, delivery: Exclude<LifecycleDelivery, 'pending'>): void;
+    private assertHealthy;
+    private persist;
+}
+export {};

package/dist/owner-channel/lifecycle-outbox.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, readFileSync } from 'node:fs';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { lifecycleEventDigestBasis, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
+const DIGEST = /^[a-f0-9]{64}$/u;
+const LIMIT = 5_000;
+/** Durable lifecycle acceptance queue; plaintext is limited to validated concise presentations. */
+export class FleetLifecycleOutbox {
+    path;
+    entries = [];
+    corruptReason;
+    constructor(path) {
+        this.path = path;
+        if (!existsSync(path))
+            return;
+        try {
+            const value = JSON.parse(readFileSync(path, 'utf8'));
+            if (value.version !== 1 || !Array.isArray(value.entries) || value.entries.length > LIMIT)
+                throw new Error('invalid lifecycle outbox');
+            const digests = new Set();
+            for (const entry of value.entries) {
+                validateFleetAuditPresentations([entry?.presentation]);
+                if (!DIGEST.test(entry.digest)
+                    || !['pending', 'delivered', 'uncertain'].includes(entry.delivery)
+                    || digests.has(entry.digest))
+                    throw new Error('invalid lifecycle outbox entry');
+                digests.add(entry.digest);
+            }
+            this.entries = structuredClone(value.entries);
+            chmodSync(path, 0o600);
+        }
+        catch {
+            this.corruptReason = 'invalid persisted Fleet lifecycle outbox';
+            this.entries = [];
+            try {
+                chmodSync(path, 0o600);
+            }
+            catch { /* remain fail-closed */ }
+        }
+    }
+    integrity() {
+        return this.corruptReason ? { ok: false, error: this.corruptReason } : { ok: true };
+    }
+    enqueue(presentations) {
+        this.assertHealthy();
+        validateFleetAuditPresentations(presentations);
+        let changed = false;
+        for (const presentation of presentations) {
+            const digest = createHash('sha256').update(lifecycleEventDigestBasis(presentation)).digest('hex');
+            if (this.entries.some(entry => entry.digest === digest))
+                continue;
+            if (this.entries.length >= LIMIT) {
+                const settled = this.entries.findIndex(entry => entry.delivery !== 'pending');
+                if (settled < 0)
+                    throw new Error(`Fleet lifecycle outbox is limited to ${LIMIT} pending events`);
+                this.entries.splice(settled, 1);
+            }
+            this.entries.push({ digest, presentation: structuredClone(presentation), delivery: 'pending' });
+            changed = true;
+        }
+        if (changed)
+            this.persist();
+    }
+    pending() {
+        this.assertHealthy();
+        return this.entries.filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
+    }
+    finish(digest, delivery) {
+        this.assertHealthy();
+        const entry = this.entries.find(candidate => candidate.digest === digest);
+        if (!entry)
+            throw new Error('unknown Fleet lifecycle outbox entry');
+        if (entry.delivery === delivery)
+            return;
+        if (entry.delivery !== 'pending')
+            throw new Error('conflicting Fleet lifecycle delivery state');
+        entry.delivery = delivery;
+        this.persist();
+    }
+    assertHealthy() {
+        if (this.corruptReason)
+            throw new Error(this.corruptReason);
+    }
+    persist() {
+        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, entries: this.entries })}\n`, 0o600);
+    }
+}

package/dist/rooms-tasks/cli.js

@@ -1,10 +1,10 @@
 import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
+import { join } from 'node:path';
 import { loadConfig, ConfigError } from '../config.js';
 import { provisionMembers, getBinPath } from './provision.js';
-import { launchFleetWorker } from './external-worker.js';
-import { resolveTemplate, sealTemplateSnapshot, snapshotTemplate, } from './templates.js';
-import { acquireLaunchSnapshotLock, releaseLaunchSnapshot } from './launch-snapshot.js';
+import { launchFleetWorker, presentFleetWorkerLifecycle } from './external-worker.js';
+import { resolveTemplate, snapshotTemplate, } from './templates.js';
 import { parseGroupedMemberArgs, readMembersFile } from './member-overrides.js';
 const MEMBER_ARG_FLAGS = new Set([
     '--member', '--agent-template', '--brain', '--role', '--approval', '--filesystem', '--unattended',
@@ -39,14 +39,16 @@ function cliAnonymousOverride(argv) {
         throw new Error('--anonymous and --no-anonymous are mutually exclusive');
     return enabled ? true : disabled ? false : undefined;
 }
-import { getTask, getDeletingTask, activateTask, TaskStateError, } from './task-state.js';
-import { createRoomRecord, getRoomRecord, advanceSaga, setOwnerSeat, setSagaError, activateRoom, RoomStateError, } from './room-state.js';
-import { createCoworkAdapter, CoworkProtocolError } from './cowork-adapter.js';
+import { getTask, getDeletingTask, TaskStateError, } from './task-state.js';
+import { getRoomRecord, RoomStateError, } from './room-state.js';
+import { createCoworkAdapter } from './cowork-adapter.js';
 import { markdownCode, markdownProse, renderMarkdownFailure, renderMarkdownList, renderMarkdownResult, roomStatus, taskStatus, } from './markdown.js';
-import { TaskRoomApplicationError, TaskRoomApplicationService } from '../application/task-room-service.js';
+import { recordTaskProvisioningOutcome, TaskRoomApplicationError, TaskRoomApplicationService, } from '../application/task-room-service.js';
 import { TaskListError } from './task-lists.js';
-import { recordFleetAuditFailure, recordFleetAuditPresentation, recordFleetAuditResource, } from '../fleet-command-audit.js';
+import { beginFleetAuditCollection, consumeFleetAuditCollection, recordFleetAuditFailure, recordFleetAuditPresentation, recordFleetAuditResource, } from '../fleet-command-audit.js';
 import { renderAgentConfiguration } from '../lifecycle-summary.js';
+import { withFileLock } from '../atomic-file.js';
+import { stateRoot } from '../paths.js';
 class TaskRoomPublicError extends Error {
     code;
     fields;
@@ -65,6 +67,11 @@ function taskRoomPublicError(code, fields = {}) {
     }));
     return new TaskRoomPublicError(code, validated);
 }
+async function presentDetachedProvisioningOutcome(outcome) {
+    beginFleetAuditCollection();
+    recordTaskProvisioningOutcome(outcome);
+    await presentFleetWorkerLifecycle(consumeFleetAuditCollection().presentations ?? []);
+}
 function taskRoomPublicFailure(error) {
     const f = error.fields;
     switch (error.code) {
@@ -251,6 +258,36 @@ const taskActionMarkdown = (title, task, fields = []) => {
         ],
     });
 };
+function provisioningMarkdown(outcome) {
+    const room = outcome.room;
+    if (outcome.kind === 'failed')
+        return renderMarkdownFailure({
+            kind: 'state', subject: `task start ${outcome.task.task_id}`,
+            detail: outcome.blocker ?? 'Provisioning reached a terminal failure.',
+            action: outcome.next_action ?? `Run ours-fleet task recover ${outcome.task.task_id}.`,
+        });
+    return renderMarkdownResult({
+        icon: outcome.kind === 'ready' ? '✅' : outcome.next_action ? '⚠️' : '⏳',
+        title: outcome.kind === 'ready' ? 'Room provisioning complete'
+            : outcome.next_action ? 'Room provisioning needs attention' : 'Room provisioning continues',
+        fields: [
+            { label: 'Task', value: `${outcome.task.task_id} — ${outcome.task.title}` },
+            ...(room ? [{ label: 'Room', value: `${room.room_id} — ${room.room_name}` }] : []),
+            ...(outcome.launch.template ? [{ label: 'Template', value: outcome.launch.template, kind: 'code' }] : []),
+            { label: 'Launch', value: `anonymous=${outcome.launch.anonymous ? 'yes' : 'no'}, owner=${outcome.launch.owner_attached ? 'attached' : 'not-attached'}` },
+            { label: 'Lifecycle', value: outcome.kind },
+            { label: 'Members', value: `${outcome.members.active}/${outcome.members.expected} active; ${outcome.members.launched}/${outcome.members.expected} launched` },
+            ...(outcome.blocker ? [{ label: 'Blocker', value: outcome.blocker }] : []),
+            ...(outcome.next_action ? [{ label: 'Next action', value: outcome.next_action }] : []),
+            ...(outcome.kind === 'in_progress'
+                ? [{ label: 'Await', value: outcome.handle.command, kind: 'code' }] : []),
+        ],
+    });
+}
+async function continueProvisioningInBackground(taskId, configPath) {
+    await launchFleetWorker(['task', '_provision', taskId], `task-provision-${taskId}`, configPath);
+}
+const taskProvisioningWorkerLockPath = (taskId) => join(stateRoot(), 'locks', 'task-provisioning-worker', encodeURIComponent(taskId));
 /**
  * Shared launch-configuration line for CLI member listings. Pre-upgrade seats
  * without a captured presentation keep the minimal listing rather than
@@ -524,98 +561,6 @@ function roomStartupSections(room) {
     }
     return sections;
 }
-async function provisionRoom(cfg, input) {
-    const rooms = cfg.rooms;
-    if (!rooms)
-        throw new ConfigError('rooms: configuration is required');
-    const attachOwner = rooms.defaults?.attach_owner !== false;
-    if (attachOwner && !cfg.ownerInvite)
-        throw new ConfigError('rooms.owner: public_invite or public_invite_file is required when attach_owner is enabled');
-    const cowork = coworkFor(cfg);
-    const goal = input.goal?.trim() || input.name;
-    const unlockSnapshot = input.template ? acquireLaunchSnapshotLock() : undefined;
-    let launchTemplate;
-    let record;
-    try {
-        launchTemplate = input.template
-            ? sealTemplateSnapshot(input.template, cfg.agentTemplates ?? {}) : undefined;
-        const briefing = input.brief?.trim() || launchTemplate?.contract?.trim() || goal;
-        const created = await cowork.createRoom({
-            room_name: input.name,
-            goal,
-            briefing,
-            quiet_membership: launchTemplate?.room?.quiet_membership,
-            anonymous: launchTemplate?.room?.anonymous,
-        });
-        record = createRoomRecord({
-            room_id: created.room_id,
-            room_name: input.name,
-            room_identity_cid: created.identity_cid,
-            task_id: input.taskId,
-            template_snapshot: launchTemplate,
-        });
-        input.onCreated?.(record);
-    }
-    catch (error) {
-        unlockSnapshot?.();
-        if (launchTemplate?.launch_snapshot_hash)
-            releaseLaunchSnapshot(launchTemplate.launch_snapshot_hash);
-        throw error;
-    }
-    unlockSnapshot?.();
-    record = advanceSaga(record.room_id, 'create_room', 1);
-    if (attachOwner) {
-        try {
-            record = advanceSaga(record.room_id, 'attach_owner', 2);
-            const accepted = await cowork.acceptInvite(record.room_id, cfg.ownerInvite, {
-                role: rooms.owner.role,
-                expected_cid: rooms.owner.expected_cid,
-            });
-            record = setOwnerSeat(record.room_id, accepted.seat_cid, cfg.ownerInviteFingerprint ?? '');
-        }
-        catch (error) {
-            const mismatch = error instanceof CoworkProtocolError && /CID|expected/i.test(error.message);
-            setSagaError(record.room_id, error instanceof Error ? error.message : String(error), mismatch
-                ? 'Verify rooms.owner.expected_cid and rotate the configured invite if necessary.'
-                : 'Rotate rooms.owner.public_invite or public_invite_file, then run room recover.', mismatch ? 'owner_cid_mismatch' : 'waiting_owner_invite');
-            const failed = getRoomRecord(record.room_id);
-            if (failed)
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
-                    id: failed.room_id, state: failed.state, category: 'provision_failed',
-                    eventId: `${failed.created_at}:${failed.saga.phase}:${failed.saga.step_index}` });
-            throw error;
-        }
-    }
-    record = advanceSaga(record.room_id, 'create_members', 3);
-    if (launchTemplate && launchTemplate.members.length > 0) {
-        try {
-            record = await provisionMembers({
-                cfg,
-                cowork,
-                roomId: record.room_id,
-                taskId: input.taskId,
-                template: launchTemplate,
-                binPath: getBinPath(),
-                brief: input.brief,
-                goal: input.goal,
-            });
-        }
-        catch (error) {
-            const failed = getRoomRecord(record.room_id);
-            if (failed)
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
-                    id: failed.room_id, state: failed.state, category: 'provision_failed',
-                    eventId: `${failed.created_at}:${failed.saga.phase}:${failed.saga.step_index}` });
-            throw error;
-        }
-    }
-    else {
-        record = activateRoom(record.room_id);
-        if (input.taskId)
-            activateTask(input.taskId);
-    }
-    return record;
-}
 export function registerTemplateCommands(parent, cOpt) {
     const templateCmd = parent.command('template').description('room template operations');
     cOpt(templateCmd.command('list'))
@@ -721,7 +666,8 @@ export function registerTaskCommands(parent, cOpt) {
         .action(async (opts, command) => {
         try {
             const members = cliMemberOverrides(opts.membersFile, commandArgv(command));
-            const record = await taskRoomService(opts.configuration).createTask({
+            const service = taskRoomService(opts.configuration);
+            const record = await service.createTask({
                 actor: { kind: 'local_control', surface: 'cli' }, title: opts.title,
                 brief: opts.brief, briefFile: opts.briefFile, template: opts.template,
                 backlog: opts.backlog, noRoom: opts.room === false,
@@ -730,8 +676,19 @@ export function registerTaskCommands(parent, cOpt) {
                 list: opts.list,
                 members,
             });
+            const provisioning = !opts.backlog && opts.room !== false && record.room_id
+                ? service.taskProvisioningOutcome(record.task_id) : undefined;
+            if (provisioning?.kind === 'in_progress' && !provisioning.next_action)
+                await continueProvisioningInBackground(record.task_id, opts.configuration);
+            if (provisioning)
+                recordTaskProvisioningOutcome(provisioning);
             if (opts.json) {
-                console.log(JSON.stringify({ schema_version: 1, task: record }, null, 2));
+                console.log(JSON.stringify({ schema_version: 1, task: record,
+                    ...(provisioning ? { provisioning } : {}) }, null, 2));
+                return;
+            }
+            if (provisioning) {
+                console.log(provisioningMarkdown(provisioning));
                 return;
             }
             console.log(taskActionMarkdown('Task created', record, [
@@ -936,16 +893,21 @@ export function registerTaskCommands(parent, cOpt) {
         .option('--json', 'JSON output')
         .action(async (id, opts, command) => {
         try {
-            const t = await taskRoomService(opts.configuration).startTask({
+            const service = taskRoomService(opts.configuration);
+            const t = await service.startTask({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id,
                 template: opts.template, members: cliMemberOverrides(opts.membersFile, commandArgv(command)),
                 anonymous: cliAnonymousOverride(commandArgv(command)),
             });
+            const provisioning = service.taskProvisioningOutcome(t.task_id);
+            if (provisioning.kind === 'in_progress' && !provisioning.next_action)
+                await continueProvisioningInBackground(t.task_id, opts.configuration);
+            recordTaskProvisioningOutcome(provisioning);
             if (opts.json) {
-                console.log(JSON.stringify({ schema_version: 1, task: t }, null, 2));
+                console.log(JSON.stringify({ schema_version: 1, task: t, provisioning }, null, 2));
                 return;
             }
-            console.log(taskActionMarkdown('Task started', t));
+            console.log(provisioningMarkdown(provisioning));
         }
         catch (e) {
             if (e instanceof TaskRoomApplicationError && e.code === 'task_template_drift')
@@ -958,6 +920,37 @@ export function registerTaskCommands(parent, cOpt) {
             dieTaskRoom(e);
         }
     });
+    cOpt(taskCmd.command('await <id>'))
+        .description('await the same bounded room-provisioning operation')
+        .option('--wait-ms <ms>', 'bounded wait in milliseconds', '60000')
+        .option('--json', 'JSON output')
+        .action(async (id, opts) => {
+        try {
+            const waitMs = Number(opts.waitMs);
+            if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > 600_000)
+                throw new Error('--wait-ms must be an integer from 0 to 600000');
+            const service = taskRoomService(opts.configuration);
+            const initial = service.taskProvisioningOutcome(id);
+            if (initial.kind === 'in_progress')
+                await continueProvisioningInBackground(id, opts.configuration);
+            const outcome = await service.awaitTaskProvisioning({
+                actor: { kind: 'local_control', surface: 'cli' }, taskId: id, waitMs,
+            });
+            recordTaskProvisioningOutcome(outcome);
+            if (opts.json) {
+                console.log(JSON.stringify({ schema_version: 1, provisioning: outcome }, null, 2));
+                return;
+            }
+            console.log(provisioningMarkdown(outcome));
+            if (outcome.kind === 'failed')
+                process.exitCode = 1;
+        }
+        catch (e) {
+            if (opts.json)
+                die(e);
+            dieTaskRoom(e);
+        }
+    });
     taskCmd.command('block <id>')
         .description('mark a task as blocked')
         .requiredOption('--reason <reason>', 'blocking reason')
@@ -1191,8 +1184,11 @@ export function registerTaskCommands(parent, cOpt) {
                 })()
                 : begin.result;
             const t = recovered.task;
-            auditTask('recover', t, previous);
             const room = recovered.room;
+            if (previous === 'provisioning' && t.state === 'active' && room?.state === 'active')
+                recordTaskProvisioningOutcome(app.taskProvisioningOutcome(t.task_id));
+            else
+                auditTask('recover', t, previous);
             const recoveryActions = recovered.issues.map(issue => {
                 if (issue.code === 'terminal_pending')
                     return `Terminal intent remains pending — retry task recover ${id}`;
@@ -1262,6 +1258,43 @@ export function registerTaskCommands(parent, cOpt) {
             dieTaskRoom(e);
         }
     });
+    cOpt(taskCmd.command('_provision <id>', { hidden: true }))
+        .description('internal: continue an accepted room-provisioning operation')
+        .option('--json', 'JSON output')
+        .action(async (id, opts) => {
+        try {
+            await withFileLock(taskProvisioningWorkerLockPath(id), async () => {
+                const app = taskRoomService(opts.configuration);
+                for (;;) {
+                    const before = app.taskProvisioningOutcome(id);
+                    if (before.kind !== 'in_progress') {
+                        await presentDetachedProvisioningOutcome(before);
+                        return;
+                    }
+                    const recovery = await app.beginTaskRecovery({
+                        actor: { kind: 'internal_worker', surface: 'cli' }, taskId: id,
+                    });
+                    // Provisioning continuation never settles deletion or terminal
+                    // intents; explicit task recover retains that broader authority.
+                    if (recovery.kind !== 'final')
+                        return;
+                    const outcome = app.taskProvisioningOutcome(id);
+                    if (outcome.kind !== 'in_progress') {
+                        await presentDetachedProvisioningOutcome(outcome);
+                        return;
+                    }
+                    if (outcome.next_action)
+                        return;
+                    await sleep(1_000);
+                }
+            }, {}, 10 * 60_000);
+        }
+        catch (e) {
+            if (opts.json)
+                die(e);
+            dieTaskRoom(e);
+        }
+    });
     cOpt(taskCmd.command('_settle_delete <id>', { hidden: true }))
         .description('internal: settle a previously accepted task deletion')
         .option('--json', 'JSON output')

package/dist/rooms-tasks/external-worker.d.ts

@@ -1,3 +1,11 @@
+import type { FleetAuditPresentation } from '../fleet-command-audit.js';
+/** Lifecycle-only return path for a trusted worker; never authorizes a fresh Fleet attempt. */
+export declare const FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV = "OURS_FLEET_WORKER_LIFECYCLE_STATE_DIR";
 export declare function fleetWorkerEnv(source?: NodeJS.ProcessEnv): Record<string, string>;
+/** Present a detached worker's durable outcome through the authenticated Owner sink. */
+export declare function presentFleetWorkerLifecycle(presentations: FleetAuditPresentation[], deps?: {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+}): Promise<void>;
 /** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
 export declare function launchFleetWorker(args: string[], operation: string, configPath?: string): Promise<void>;

package/dist/rooms-tasks/external-worker.js

@@ -1,18 +1,56 @@
 import { execFile, spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV } from '../fleet-proxy.js';
+import { controlRequest } from '../session/control.js';
+import { SessionControlError } from '../session/types.js';
+/** Lifecycle-only return path for a trusted worker; never authorizes a fresh Fleet attempt. */
+export const FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV = 'OURS_FLEET_WORKER_LIFECYCLE_STATE_DIR';
+const LIFECYCLE_ACCEPT_TIMEOUT_MS = 10 * 60_000;
+const LIFECYCLE_RETRY_MS = 250;
 export function fleetWorkerEnv(source = process.env) {
     const inheritedKeys = [
         'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_CONFIG',
         'OURS_PORT', 'OURS_STATE_DIR', 'OURS_API_TOKEN', 'OURS_COWORK_CONFIG',
     ];
     const env = Object.fromEntries(inheritedKeys.flatMap(key => source[key] === undefined ? [] : [[key, source[key]]]));
+    const lifecycleStateDir = source[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV]
+        ?? source[FLEET_PROXY_STATE_DIR_ENV];
+    if (lifecycleStateDir)
+        env[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV] = lifecycleStateDir;
     // Explicit defense: trusted settle/recover/delete/close workers are effects
     // nested inside the outer audited command, never fresh agent attempts.
     delete env[FLEET_PROXY_STATE_DIR_ENV];
     delete env[FLEET_PROXY_CALLER_ENV];
     return env;
 }
+/** Present a detached worker's durable outcome through the authenticated Owner sink. */
+export async function presentFleetWorkerLifecycle(presentations, deps = {
+    now: Date.now, sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+}) {
+    const stateDir = process.env[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV];
+    if (!stateDir || !presentations.length)
+        return;
+    const deadline = deps.now() + LIFECYCLE_ACCEPT_TIMEOUT_MS;
+    for (;;) {
+        try {
+            const response = await controlRequest(stateDir, {
+                command: 'fleet_audit_present', audit: { presentations },
+            }, 15_000);
+            if (!response.ok)
+                throw new SessionControlError(response.kind ?? 'backend', response.error ?? 'detached Fleet lifecycle delivery failed');
+            return;
+        }
+        catch (error) {
+            // Missing token/socket and refused connect are classified before any
+            // request can cross the server boundary, so only this class is safe to
+            // retry. Timeout/backend/response failures may be uncertain and stop.
+            if (!(error instanceof SessionControlError)
+                || error.kind !== 'control-unavailable' || deps.now() >= deadline)
+                throw error;
+            await deps.sleep(LIFECYCLE_RETRY_MS);
+        }
+    }
+}
 /** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
 export function launchFleetWorker(args, operation, configPath) {
     const cli = [process.argv[1], ...args, ...(configPath ? ['-c', configPath] : [])];