@ours.network/fleet 1.1.0-nightly.3 → 1.1.0-nightly.30

package/dist/rooms-tasks/templates.js

@@ -1,94 +1,58 @@
 import { createHash } from 'node:crypto';
-const TEAM = {
-    name: 'team',
-    version: 1,
-    builtin: true,
-    description: 'Phased task pipeline: Architect specifies, Developer implements, Tester verifies',
-    room: { quiet_membership: false, anonymous: false },
-    contract: [
-        'Architect produces a spec and posts it to the room. Work pauses for owner approval.',
-        'Developer implements per approved spec.',
-        'Tester verifies spec conformance and test coverage.',
-        'Completion requires tester sign-off.',
-    ].join('\n'),
-    members: [
-        { slot: 'architect', role: 'Architect', count: 1, agent: { ref: 'Architect' } },
-        { slot: 'developer', role: 'Developer', count: 1, agent: { ref: 'Developer' } },
-        { slot: 'tester', role: 'Tester', count: 1, agent: { ref: 'Tester' } },
-    ],
-};
-const PAIR = {
-    name: 'pair',
-    version: 1,
-    builtin: true,
-    description: 'Deliberation pair: Secretary writes code, Critic reviews — every decision deliberated together',
-    room: { quiet_membership: false, anonymous: false },
-    contract: [
-        'Secretary and Critic deliberate every decision together before acting.',
-        'Secretary writes code; Critic reviews and challenges.',
-        'No material change lands without both agreeing.',
-        'Completion requires joint sign-off.',
-    ].join('\n'),
-    members: [
-        { slot: 'secretary', role: 'Secretary', count: 1, agent: { ref: 'Secretary' } },
-        { slot: 'critic', role: 'Critic', count: 1, agent: { ref: 'Critic' } },
-    ],
-};
-const SINGLE = {
-    name: 'single',
-    version: 1,
-    builtin: true,
-    description: 'Solo agent: one general-purpose agent works the task with owner oversight',
-    room: { quiet_membership: false, anonymous: false },
-    contract: [
-        'Agent works the task autonomously, consulting the owner when blocked.',
-        'Owner reviews and approves completion.',
-    ].join('\n'),
-    members: [
-        { slot: 'agent', role: 'Agent', count: 1, agent: { ref: 'Agent' } },
-    ],
-};
-export const BUILTIN_TEMPLATES = [TEAM, PAIR, SINGLE];
+import { canonicalJson } from '../canonical-json.js';
+import { redactLaunchDefinition, sealLaunchSnapshot } from './launch-snapshot.js';
 export function hashTemplate(t) {
-    const canonical = JSON.stringify({
+    const canonical = canonicalJson({
         name: t.name, version: t.version, description: t.description,
         room: t.room, contract: t.contract, members: t.members,
     });
     return createHash('sha256').update(canonical).digest('hex');
 }
-export function snapshotTemplate(t) {
-    return { ...t, content_hash: hashTemplate(t) };
+export function snapshotTemplate(t, agentTemplates) {
+    const { sourceFile: _, ...semantic } = t;
+    return { ...semantic, members: semantic.members.map(member => {
+            const definition = agentTemplates?.[member.agent_template];
+            return {
+                ...member,
+                ...(definition ? {
+                    agent_projection: redactLaunchDefinition(definition),
+                    agent_template_hash: createHash('sha256').update(canonicalJson(definition)).digest('hex'),
+                } : {}),
+            };
+        }), content_hash: agentTemplates ? createHash('sha256').update(canonicalJson({
+            template: hashTemplate(t),
+            members: semantic.members.map(member => ({
+                agent_template: member.agent_template,
+                agent_template_hash: agentTemplates?.[member.agent_template]
+                    ? createHash('sha256').update(canonicalJson(agentTemplates[member.agent_template])).digest('hex')
+                    : null,
+            })),
+        })).digest('hex') : hashTemplate(t) };
+}
+/** Explicit mutation boundary immediately before Task/Room plan persistence. */
+export function sealTemplateSnapshot(snapshot, agentTemplates, launchDefinitions) {
+    const referenced = Object.fromEntries([...new Set(snapshot.members.map(member => member.launch_definition_id ?? member.agent_template))]
+        .sort().map(id => {
+        const member = snapshot.members.find(candidate => (candidate.launch_definition_id ?? candidate.agent_template) === id);
+        const definition = launchDefinitions?.[id] ?? agentTemplates[member.agent_template];
+        if (!definition)
+            throw new Error(`Agent Template '${id}' not found`);
+        return [id, definition];
+    }));
+    return { ...snapshot, launch_snapshot_hash: sealLaunchSnapshot(referenced) };
 }
 export function resolveTemplate(name, customTemplates) {
     const atIdx = name.lastIndexOf('@');
     const baseName = atIdx > 0 ? name.slice(0, atIdx) : name;
     const versionStr = atIdx > 0 ? name.slice(atIdx + 1) : undefined;
     const version = versionStr ? parseInt(versionStr, 10) : undefined;
-    const custom = customTemplates[baseName];
-    if (custom) {
-        if (version !== undefined && custom.version !== version)
-            return undefined;
-        return custom;
-    }
-    const builtin = BUILTIN_TEMPLATES.find(b => b.name === baseName);
-    if (builtin) {
-        if (version !== undefined && builtin.version !== version)
-            return undefined;
-        return builtin;
-    }
-    return undefined;
+    const template = customTemplates[baseName];
+    if (!template || (version !== undefined && template.version !== version))
+        return undefined;
+    return template;
 }
 export function listTemplates(customTemplates) {
-    const result = [];
-    const overridden = new Set();
-    for (const [name, t] of Object.entries(customTemplates)) {
-        result.push({ ...t, name });
-        if (BUILTIN_TEMPLATES.some(b => b.name === name))
-            overridden.add(name);
-    }
-    for (const b of BUILTIN_TEMPLATES) {
-        if (!overridden.has(b.name))
-            result.push(b);
-    }
-    return result.sort((a, b) => a.name.localeCompare(b.name));
+    return Object.entries(customTemplates)
+        .map(([name, template]) => ({ ...template, name }))
+        .sort((a, b) => a.name.localeCompare(b.name));
 }

package/dist/rooms-tasks/terminal.d.ts

@@ -1,6 +1,9 @@
 import { type RoomCloseDeps } from './close.js';
 import type { CoworkAdapter } from './cowork-adapter.js';
 import type { TaskOutcome, TaskRecord, TaskTerminalIntent } from './types.js';
+export declare const TASK_OPERATION_LOCK_STALE_MS: number;
+/** Common per-task operation lock serializing terminal, deletion, and recovery acceptance. */
+export declare function taskOperationLockPath(taskId: string): string;
 export interface TaskTerminalInput {
     taskId: string;
     kind: TaskTerminalIntent['kind'];

package/dist/rooms-tasks/terminal.js

@@ -2,10 +2,11 @@ import { join } from 'node:path';
 import { withFileLock } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
 import { deleteManagedRoom } from './close.js';
-import { beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
+import { assertNoPendingDeletion, beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
 import { getRoomRecord } from './room-state.js';
-const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
-function taskOperationLockPath(taskId) {
+export const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
+/** Common per-task operation lock serializing terminal, deletion, and recovery acceptance. */
+export function taskOperationLockPath(taskId) {
     return join(stateRoot(), 'locks', 'task-terminal', encodeURIComponent(taskId));
 }
 function errorText(error) {
@@ -24,6 +25,9 @@ export function acceptTaskTerminalIntent(input) {
 export function settleTaskTerminalIntent(input) {
     return withFileLock(taskOperationLockPath(input.taskId), async () => {
         const current = getTask(input.taskId);
+        // Deletion supersedes a pending terminal intent: fail boundedly before any
+        // room side effect so the deletion worker owns all remaining cleanup.
+        assertNoPendingDeletion(current);
         const intent = current.terminal_intent;
         if (!intent)
             throw new Error(`task ${input.taskId} has no accepted terminal intent`);
@@ -45,7 +49,9 @@ export function settleTaskTerminalIntent(input) {
             return finishTaskTerminalIntent(input.taskId);
         }
         catch (error) {
-            setTaskTerminalIntentError(input.taskId, errorText(error), `Retry 'ours-fleet task recover ${input.taskId}'.`);
+            setTaskTerminalIntentError(input.taskId, errorText(error), intent.kind === 'cancelled'
+                ? `Retry 'ours-fleet task cancel ${input.taskId} ${input.taskId}'.`
+                : `Retry 'ours-fleet task done ${input.taskId}'.`);
             throw error;
         }
     }, {}, TASK_OPERATION_LOCK_STALE_MS);

package/dist/rooms-tasks/types.d.ts

@@ -5,6 +5,7 @@
  * membership, and archive. Messenger Server owns owner presentation.
  * Fleet stores only IDs, CIDs, orchestration state, and saga cursors.
  */
+import type { AgentLaunchConfiguration } from '../lifecycle-summary.js';
 export type TaskState = 'backlog' | 'provisioning' | 'active' | 'review' | 'done' | 'cancelled' | 'failed';
 export declare const TASK_TERMINAL_STATES: readonly TaskState[];
 export declare const TASK_CANCELLABLE_STATES: readonly TaskState[];
@@ -44,6 +45,47 @@ export interface TaskTerminalIntent {
     first_failure?: string;
     first_recovery_hint?: string;
 }
+/** Origin evidence for an accepted deletion; retained until the record is unlinked. */
+export type TaskDeletionActor = {
+    kind: 'local_control';
+    surface: 'cli' | 'web';
+} | {
+    kind: 'authenticated_owner';
+    surface: 'messenger';
+    cid: string;
+};
+export type TaskDeletionMemberPhase = 'pending' | 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
+/**
+ * Durable retirement cursor for a managed member when no room orchestration
+ * record exists to carry the equivalent seat cursor.
+ */
+export interface TaskDeletionMemberCursor {
+    name: string;
+    identity_cid: string;
+    phase: TaskDeletionMemberPhase;
+    launch_id?: string;
+    archive_path?: string;
+    updated_at: string;
+}
+/**
+ * First-wins durable deletion intent. There is no settled status: settlement
+ * ends by unlinking the task record, so physical absence is the completion
+ * evidence. While pending, the task is hidden from normal operation and every
+ * lifecycle mutation or room publication is rejected.
+ */
+export interface TaskDeletionIntent {
+    status: 'pending';
+    accepted_at: string;
+    actor: TaskDeletionActor;
+    room_id?: string;
+    /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
+    members: TaskDeletionMemberCursor[];
+    error?: string;
+    error_at?: string;
+    recovery_hint?: string;
+    first_failure?: string;
+    first_recovery_hint?: string;
+}
 export interface TaskRecord {
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
@@ -56,6 +98,14 @@ export interface TaskRecord {
     state: TaskState;
     blocked?: TaskBlocked;
     template?: TaskTemplateRef;
+    execution_plan?: {
+        schema_version: 1;
+        snapshot: TemplateSnapshot;
+        room_policy?: RoomLaunchPolicy;
+        overrides: Record<string, unknown>;
+        overrides_hash: string;
+        plan_hash: string;
+    };
     no_room?: boolean;
     room_id?: string;
     room_identity_cid?: string;
@@ -67,6 +117,7 @@ export interface TaskRecord {
     ended_at?: string;
     outcome?: TaskOutcome;
     terminal_intent?: TaskTerminalIntent;
+    deletion?: TaskDeletionIntent;
 }
 export interface TaskListRecord {
     list_id: string;
@@ -82,7 +133,7 @@ export interface SagaCursor {
     error?: string;
     recovery_hint?: string;
 }
-export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'uncertain';
+export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_authorization' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'uncertain';
 export interface RoomRoleBriefingDefinition {
     role: string;
     text: string;
@@ -103,6 +154,13 @@ export interface RoomMemberLaunchState {
     /** Redacted, deterministic effective Agent launch definition retained for retry inspection. */
     agent_definition?: Record<string, unknown>;
     agent_fingerprint?: string;
+    agent_template?: string;
+    agent_template_hash?: string;
+    /**
+     * Operator-facing launch configuration captured from the exact resolved
+     * launch state; the single source for later Task/Room lifecycle reports.
+     */
+    presentation?: AgentLaunchConfiguration;
     launch_id?: string;
     updated_at: string;
     error?: string;
@@ -175,6 +233,8 @@ export interface RoomOrchestrationRecord {
     goal?: string;
     task_id?: string;
     template_snapshot?: TemplateSnapshot;
+    /** Resolved once at launch; legacy absence means non-anonymous. */
+    room_policy?: RoomLaunchPolicy;
     saga: SagaCursor;
     provisioning_detail?: ProvisioningDetail;
     owner_seat_cid?: string;
@@ -192,26 +252,50 @@ export interface TemplateMemberSlot {
     slot: string;
     role: string;
     count: number;
-    /** Canonical Agent definition, or stable reference to a declared Agent. */
-    agent: import('../config.js').AgentDefinition | {
-        ref: string;
-    };
+    /** Stable reference to an inert Agent Template, never a persistent Agent. */
+    agent_template: string;
 }
 export interface TemplateRoomConfig {
     quiet_membership?: boolean;
     anonymous?: boolean;
 }
+export interface RoomLaunchPolicy {
+    anonymous: boolean;
+}
+export declare const LEGACY_ROOM_LAUNCH_POLICY: Readonly<RoomLaunchPolicy>;
+/** Validate durable policy before it can influence room creation or recovery. */
+export declare function storedRoomLaunchPolicy(value: RoomLaunchPolicy | undefined): RoomLaunchPolicy;
 export interface TemplateDefinition {
     name: string;
     version: number;
     description: string;
-    builtin?: boolean;
+    /** Authoring provenance only; excluded from snapshots and semantic hashes. */
+    sourceFile?: string;
     room?: TemplateRoomConfig;
     contract?: string;
     members: TemplateMemberSlot[];
 }
-export interface TemplateSnapshot extends TemplateDefinition {
+export interface TemplateSnapshotMember extends TemplateMemberSlot {
+    /** Source of the effective temporary-loop policy, independent of its sealed value. */
+    loop_source?: 'agent-template' | 'cli' | 'omitted';
+    /** Secret-safe public projection; launch material lives in the sealed snapshot. */
+    agent_projection?: Record<string, unknown>;
+    agent_template_hash?: string;
+    /** Private sealed-snapshot lookup key; harmless provenance, not an identity. */
+    launch_definition_id?: string;
+    role_preset?: {
+        id: string;
+        hash: string;
+    };
+    brain_preset?: {
+        id: string;
+        hash: string;
+    };
+}
+export interface TemplateSnapshot extends Omit<TemplateDefinition, 'members'> {
+    members: TemplateSnapshotMember[];
     content_hash: string;
+    launch_snapshot_hash?: string;
 }
 export interface RoomsOwnerConfig {
     provider: string;
@@ -246,4 +330,6 @@ export declare const ROOMS_COWORK_KEYS: readonly ["config"];
 export declare const ROOMS_DEFAULTS_KEYS: readonly ["template", "attach_owner", "close_when_task_done"];
 export declare const TASKS_KEYS: readonly ["default_room_template", "create_mode", "close_room_on_done", "retain_completed_for"];
 export declare const TEMPLATE_KEYS: readonly ["version", "description", "room", "contract", "members", "override_builtin"];
-export declare const TEMPLATE_MEMBER_KEYS: readonly ["slot", "role", "count", "agent"];
+export declare const TEMPLATE_ROOM_KEYS: readonly ["quiet_membership", "anonymous"];
+/** `agent` is accepted only so validation can emit its actionable migration error. */
+export declare const TEMPLATE_MEMBER_KEYS: readonly ["slot", "role", "count", "agent_template", "agent"];

package/dist/rooms-tasks/types.js

@@ -7,6 +7,17 @@
  */
 export const TASK_TERMINAL_STATES = ['done', 'cancelled', 'failed'];
 export const TASK_CANCELLABLE_STATES = ['backlog', 'provisioning', 'active', 'review'];
+export const LEGACY_ROOM_LAUNCH_POLICY = Object.freeze({
+    anonymous: false,
+});
+/** Validate durable policy before it can influence room creation or recovery. */
+export function storedRoomLaunchPolicy(value) {
+    if (value === undefined)
+        return { ...LEGACY_ROOM_LAUNCH_POLICY };
+    if (typeof value.anonymous !== 'boolean')
+        throw new Error('invalid durable Room launch policy; anonymous must be a boolean');
+    return { ...value };
+}
 // ── Validation keys ─────────────────────────────────────────────────────
 export const ROOMS_KEYS = ['cowork', 'owner', 'defaults'];
 export const ROOMS_OWNER_KEYS = ['provider', 'public_invite', 'public_invite_file', 'expected_cid', 'role'];
@@ -14,4 +25,6 @@ export const ROOMS_COWORK_KEYS = ['config'];
 export const ROOMS_DEFAULTS_KEYS = ['template', 'attach_owner', 'close_when_task_done'];
 export const TASKS_KEYS = ['default_room_template', 'create_mode', 'close_room_on_done', 'retain_completed_for'];
 export const TEMPLATE_KEYS = ['version', 'description', 'room', 'contract', 'members', 'override_builtin'];
-export const TEMPLATE_MEMBER_KEYS = ['slot', 'role', 'count', 'agent'];
+export const TEMPLATE_ROOM_KEYS = ['quiet_membership', 'anonymous'];
+/** `agent` is accepted only so validation can emit its actionable migration error. */
+export const TEMPLATE_MEMBER_KEYS = ['slot', 'role', 'count', 'agent_template', 'agent'];

package/dist/runner.d.ts

@@ -1,11 +1,13 @@
 import { type ResolvedRole } from './config.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
+import { type DaemonGenerationProbe } from './daemon-recovery.js';
 import { type Exec } from './exec.js';
 import { RoleControlServer } from './session/control.js';
 import type { AgentSession, ExitRecord, TurnResult } from './session/types.js';
 import type { AgentSessionAdapter, AgentSessionStartOptions } from './harness/agent-session.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';
+import { ScheduledLoopManager, type ScheduledLoopManagerHandle } from './loops/manager.js';
 export interface RunnerDeps {
     exec: Exec;
     cpuDelegated(): boolean;
@@ -15,6 +17,7 @@ export interface RunnerDeps {
     log(line: string): void;
     /** HTTP transport for the monitor's daemon long-poll (injectable for tests). */
     fetch: FetchLike;
+    probeGeneration(env: NodeJS.ProcessEnv): Promise<DaemonGenerationProbe>;
     /** Construct the supervisor mail monitor (injectable so tests stub it out). */
     createMonitor(opts: MonitorOpts): MonitorHandle;
     /** Construct trusted owner ingress (injectable for lifecycle tests). */
@@ -23,7 +26,9 @@ export interface RunnerDeps {
     /** Neutral construction seam for deterministic runner lifecycle tests. */
     startAgentSession(adapter: AgentSessionAdapter, options: AgentSessionStartOptions): Promise<AgentSession>;
     /** Construct the authenticated role control route (injectable where sockets are unavailable). */
-    createControlServer(stateDir: string, session: AgentSession, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
+    createControlServer(stateDir: string, session: AgentSession, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setFleetAuditor' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
+    /** Construct scheduled-loop execution (injectable for fail-closed startup tests). */
+    createLoopManager(...args: ConstructorParameters<typeof ScheduledLoopManager>): ScheduledLoopManagerHandle;
     /** Acquire the cross-process owner-channel binder lease before replacing the control socket. */
     acquireOwnerBinder(stateDir: string, role: string, identity: string): Promise<OwnerBinderLease>;
     /** Ask the still-authenticated predecessor to emit the fixed recovery notice. */
@@ -31,6 +36,11 @@ export interface RunnerDeps {
     /** Lets a test (or a shutdown path) end the supervised restart loop. */
     shouldStop?(): boolean;
 }
+export declare const SUPERVISOR_RECYCLE_REQUIRED = "OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED";
+export declare class SupervisorRecycleRequiredError extends Error {
+    readonly code = "OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED";
+    constructor();
+}
 /** Environment injected only into the managed harness process. */
 export declare function managedFleetProxyEnv(role: ResolvedRole, stateDir: string): Record<string, string>;
 /**
@@ -176,4 +186,4 @@ export declare function runSupervised(name: string, opts?: {
     allowResumeRotation?: boolean;
 }, d: Partial<RunnerDeps>) => Promise<AttemptResult>): Promise<RestartLedger>;
 /** Temp-agent entrypoint: run once, journal why it ended, then archive its evidence. */
-export declare function runTemp(name: string, deps?: Partial<RunnerDeps>): Promise<void>;
+export declare function runTemp(name: string, deps?: Partial<RunnerDeps>, attempt?: typeof runOnce): Promise<void>;