@ours.network/fleet 1.1.0-nightly.8 → 1.1.0-nightly.9

package/dist/rooms-tasks/cli.js

@@ -215,35 +215,81 @@ const taskActionMarkdown = (title, task, fields = []) => {
         ],
     });
 };
-function safeBrainSummary(definition) {
-    const brain = definition?.brain;
-    if (!brain || typeof brain !== 'object' || Array.isArray(brain))
+function safeSelectionSummary(definition, kind) {
+    const selected = definition?.[kind];
+    if (!selected || typeof selected !== 'object' || Array.isArray(selected))
         return 'unresolved';
-    const selection = brain;
+    const selection = selected;
+    if (selection.kind === 'ref' && typeof selection.id === 'string')
+        return `ref:${selection.id} (reference)`;
+    if (selection.kind === 'inline' && typeof selection.fingerprint === 'string')
+        return `inline:${selection.fingerprint} (inline)`;
     if (typeof selection.ref === 'string')
         return `ref:${selection.ref}`;
     if (!Object.hasOwn(selection, 'inline'))
         return 'unresolved';
-    const fingerprint = createHash('sha256').update(JSON.stringify(selection.inline)).digest('hex').slice(0, 16);
+    const canonical = (value) => Array.isArray(value)
+        ? `[${value.map(canonical).join(',')}]`
+        : value && typeof value === 'object'
+            ? `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b))
+                .map(([key, child]) => `${JSON.stringify(key)}:${canonical(child)}`).join(',')}}`
+            : JSON.stringify(value);
+    const fingerprint = createHash('sha256').update(canonical(selection.inline)).digest('hex').slice(0, 16);
     return `inline:sha256:${fingerprint}`;
 }
-function auditTask(operation, task, previousState, newState = task.state) {
+function safePermissionsSummary(definition) {
+    const permissions = definition?.permissions;
+    if (!permissions || typeof permissions !== 'object' || Array.isArray(permissions))
+        return undefined;
+    const policy = permissions;
+    const fields = ['approval', 'filesystem', 'unattended'].flatMap(key => typeof policy[key] === 'string' ? [`${key}=${policy[key]}`] : []);
+    return fields.length ? fields.join(',') : undefined;
+}
+function auditTask(operation, task, previousState, newState = task.state, revision) {
+    const materialSameState = operation === 'block' || operation === 'unblock' || operation === 'settling';
+    if (previousState === newState && !materialSameState)
+        return;
     recordFleetAuditResource('task', task.task_id);
     if (task.room_id)
         recordFleetAuditResource('room', task.room_id);
     const room = task.room_id ? getRoomRecord(task.room_id) : undefined;
-    const brains = new Map(room?.member_seats.map(seat => [seat.role_name, safeBrainSummary(seat.launch?.agent_definition)]) ?? []);
-    recordFleetAuditPresentation({ kind: 'task', operation, id: task.task_id, title: task.title,
+    const definitions = new Map(room?.member_seats.map(seat => [seat.role_name, seat.launch?.agent_definition]) ?? []);
+    const semanticOperation = operation === 'recover'
+        ? newState === 'active' ? 'work' : newState === 'done' ? 'done'
+            : newState === 'cancelled' ? 'cancel' : undefined
+        : operation;
+    if (!semanticOperation)
+        return;
+    recordFleetAuditPresentation({ kind: 'task', operation: semanticOperation, id: task.task_id, title: task.title,
         previousState, newState,
+        revision: revision ?? task.blocked?.at ?? task.ended_at ?? task.started_at ?? task.created_at,
+        list: task.list_name ?? 'default',
         template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
-        roomId: task.room_id, agents: task.member_roles.map(member => ({ name: member.name,
-            brain: brains.get(member.name) ?? 'unresolved', role: member.cowork_role })) });
+        roomId: task.room_id, agents: [...task.member_roles].sort((a, b) => a.name.localeCompare(b.name)).map(member => ({ name: member.name,
+            brain: safeSelectionSummary(definitions.get(member.name), 'brain'),
+            role: safeSelectionSummary(definitions.get(member.name), 'role') === 'unresolved'
+                ? member.cowork_role : safeSelectionSummary(definitions.get(member.name), 'role'),
+            permissions: safePermissionsSummary(definitions.get(member.name)) })) });
 }
 function auditRoom(operation, room, previousState, newState = room.state) {
+    if (previousState === newState)
+        return;
     recordFleetAuditResource('room', room.room_id);
-    recordFleetAuditPresentation({ kind: 'room', operation, id: room.room_id, previousState, newState,
+    const semanticOperation = operation === 'recover'
+        ? newState === 'active' ? 'activate' : newState === 'deleted' ? 'delete'
+            : newState === 'closing' ? 'close' : undefined
+        : operation;
+    if (!semanticOperation)
+        return;
+    recordFleetAuditPresentation({ kind: 'room', operation: semanticOperation, id: room.room_id, previousState, newState,
+        revision: room.closed_at ?? room.activated_at ?? room.close?.accepted_at ?? room.created_at,
+        name: room.room_name, taskId: room.task_id,
         template: room.template_snapshot ? `${room.template_snapshot.name}@${room.template_snapshot.version}` : undefined,
-        participants: room.member_seats.map(member => ({ name: member.role_name, role: member.cowork_role })) });
+        participants: [...room.member_seats].sort((a, b) => a.role_name.localeCompare(b.role_name)).map(member => ({ name: member.role_name, id: member.identity_cid,
+            brain: safeSelectionSummary(member.launch?.agent_definition, 'brain'),
+            role: safeSelectionSummary(member.launch?.agent_definition, 'role') === 'unresolved'
+                ? member.cowork_role : safeSelectionSummary(member.launch?.agent_definition, 'role'),
+            permissions: safePermissionsSummary(member.launch?.agent_definition) })) });
 }
 const roomActionMarkdown = (title, room, fields = []) => {
     recordFleetAuditResource('room', room.room_id);
@@ -272,6 +318,10 @@ async function launchTaskSettleWorker(taskId, configPath) {
             actor: { kind: 'local_control', surface: 'cli' }, taskId, error: errorText(error),
             recoveryHint: `External settle worker failed to start. Retry task recover ${taskId}.`,
         });
+        const task = getTask(taskId);
+        recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: taskId,
+            state: task.state, category: 'settlement_failed',
+            eventId: task.terminal_intent?.error_at ?? task.terminal_intent?.accepted_at ?? task.created_at });
         throw error;
     }
     const deadline = Date.now() + PUBLIC_SETTLE_WAIT_MS;
@@ -284,7 +334,11 @@ async function launchTaskSettleWorker(taskId, configPath) {
         }
         await sleep(PUBLIC_SETTLE_POLL_MS);
     }
-    return { task: getTask(taskId), timedOut: true };
+    const task = getTask(taskId);
+    recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: taskId,
+        state: task.state, category: 'settlement_pending',
+        eventId: task.terminal_intent?.accepted_at ?? task.created_at });
+    return { task, timedOut: true };
 }
 async function launchRoomDeleteWorker(roomId, configPath) {
     const previousErrorAt = getRoomRecord(roomId)?.close?.error_at;
@@ -296,6 +350,11 @@ async function launchRoomDeleteWorker(roomId, configPath) {
             actor: { kind: 'local_control', surface: 'cli' }, roomId, error: errorText(error),
             recoveryHint: `External delete worker failed to start. Retry room delete ${roomId} ${roomId}.`,
         });
+        const room = getRoomRecord(roomId);
+        if (room)
+            recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room', id: roomId,
+                state: room.state, category: 'cleanup_failed',
+                eventId: room.close?.error_at ?? room.close?.accepted_at ?? room.created_at });
         throw error;
     }
     const deadline = Date.now() + PUBLIC_SETTLE_WAIT_MS;
@@ -308,7 +367,12 @@ async function launchRoomDeleteWorker(roomId, configPath) {
         }
         await sleep(PUBLIC_SETTLE_POLL_MS);
     }
-    return { deleted: getRoomRecord(roomId) === undefined, timedOut: true };
+    const remaining = getRoomRecord(roomId);
+    if (remaining)
+        recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room', id: roomId,
+            state: remaining.state, category: 'cleanup_pending',
+            eventId: remaining.close?.accepted_at ?? remaining.created_at });
+    return { deleted: remaining === undefined, timedOut: true };
 }
 function loadCfg(opts) {
     return loadConfig(opts.configuration);
@@ -410,21 +474,36 @@ async function provisionRoom(cfg, input) {
             setSagaError(record.room_id, error instanceof Error ? error.message : String(error), mismatch
                 ? 'Verify rooms.owner.expected_cid and rotate the configured invite if necessary.'
                 : 'Rotate rooms.owner.public_invite or public_invite_file, then run room recover.', mismatch ? 'owner_cid_mismatch' : 'waiting_owner_invite');
+            const failed = getRoomRecord(record.room_id);
+            if (failed)
+                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
+                    id: failed.room_id, state: failed.state, category: 'provision_failed',
+                    eventId: `${failed.created_at}:${failed.saga.phase}:${failed.saga.step_index}` });
             throw error;
         }
     }
     record = advanceSaga(record.room_id, 'create_members', 3);
     if (input.template && input.template.members.length > 0) {
-        record = await provisionMembers({
-            cfg,
-            cowork,
-            roomId: record.room_id,
-            taskId: input.taskId,
-            template: input.template,
-            binPath: getBinPath(),
-            brief: input.brief,
-            goal: input.goal,
-        });
+        try {
+            record = await provisionMembers({
+                cfg,
+                cowork,
+                roomId: record.room_id,
+                taskId: input.taskId,
+                template: input.template,
+                binPath: getBinPath(),
+                brief: input.brief,
+                goal: input.goal,
+            });
+        }
+        catch (error) {
+            const failed = getRoomRecord(record.room_id);
+            if (failed)
+                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
+                    id: failed.room_id, state: failed.state, category: 'provision_failed',
+                    eventId: `${failed.created_at}:${failed.saga.phase}:${failed.saga.step_index}` });
+            throw error;
+        }
     }
     else {
         record = activateRoom(record.room_id);
@@ -529,7 +608,6 @@ export function registerTaskCommands(parent, cOpt) {
                 idempotencyKey: opts.idempotencyKey, origin: { type: 'cli' },
                 list: opts.list,
             });
-            auditTask('create', record, 'none');
             if (opts.json) {
                 console.log(JSON.stringify({ schema_version: 1, task: record }, null, 2));
                 return;
@@ -716,11 +794,9 @@ export function registerTaskCommands(parent, cOpt) {
         .option('--json', 'JSON output')
         .action(async (id, opts) => {
         try {
-            const previous = getTask(id).state;
             const t = await taskRoomService(opts.configuration).startTask({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id,
             });
-            auditTask('start', t, previous);
             if (opts.json) {
                 console.log(JSON.stringify({ schema_version: 1, task: t }, null, 2));
                 return;
@@ -766,11 +842,12 @@ export function registerTaskCommands(parent, cOpt) {
         .option('--json', 'JSON output')
         .action((id, opts) => {
         try {
-            const previous = getTask(id).state;
+            const prior = getTask(id);
+            const previous = prior.state;
             const t = taskRoomService().unblockTask({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id,
             });
-            auditTask('unblock', t, previous);
+            auditTask('unblock', t, previous, t.state, prior.blocked?.at);
             if (opts.json) {
                 console.log(JSON.stringify({ schema_version: 1, task: t }, null, 2));
                 return;
@@ -820,6 +897,8 @@ export function registerTaskCommands(parent, cOpt) {
             const plan = await taskRoomService(opts.configuration).completeTask({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id, outcome,
             });
+            if (plan.task.terminal_intent?.status === 'pending')
+                auditTask('settling', plan.task, previous, previous, plan.task.terminal_intent.accepted_at);
             const settled = plan.settlementRequired
                 ? await launchTaskSettleWorker(id, opts.configuration)
                 : { task: plan.task, timedOut: false };
@@ -856,6 +935,8 @@ export function registerTaskCommands(parent, cOpt) {
             const plan = await taskRoomService(opts.configuration).cancelTask({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id,
             });
+            if (plan.task.terminal_intent?.status === 'pending')
+                auditTask('settling', plan.task, previous, previous, plan.task.terminal_intent.accepted_at);
             const settled = plan.settlementRequired
                 ? await launchTaskSettleWorker(id, opts.configuration)
                 : { task: plan.task, timedOut: false };
@@ -1037,12 +1118,10 @@ export function registerTaskCommands(parent, cOpt) {
         .option('--json', 'JSON output')
         .action(async (id, opts) => {
         try {
-            const previous = getTask(id).state;
             const result = await taskRoomService(opts.configuration).ensureTaskWork({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id, template: opts.template,
             });
             const t = result.task;
-            auditTask('work', t, previous);
             if (result.status === 'already_active') {
                 if (opts.json) {
                     console.log(JSON.stringify({ schema_version: 1, task: t, status: 'already_active' }, null, 2));
@@ -1089,6 +1168,8 @@ export function registerTaskCommands(parent, cOpt) {
             const plan = await taskRoomService(opts.configuration).finishTask({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id, outcome,
             });
+            if (plan.task.terminal_intent?.status === 'pending')
+                auditTask('settling', plan.task, previous, previous, plan.task.terminal_intent.accepted_at);
             const settled = plan.settlementRequired
                 ? await launchTaskSettleWorker(id, opts.configuration)
                 : { task: plan.task, timedOut: false };
@@ -1133,7 +1214,6 @@ export function registerRoomCommands(parent, cOpt) {
                 actor: { kind: 'local_control', surface: 'cli' }, name: opts.name,
                 template: opts.template, goal: opts.goal, brief: opts.brief, briefFile: opts.briefFile,
             });
-            auditRoom('create', record, 'none');
             if (opts.json) {
                 console.log(JSON.stringify({ schema_version: 1, room: record }, null, 2));
                 return;
@@ -1219,8 +1299,6 @@ export function registerRoomCommands(parent, cOpt) {
         .action(async (id, opts) => {
         try {
             const { room, orchestration } = await taskRoomService(opts.configuration).getRoomDetail(id);
-            if (orchestration)
-                auditRoom('open', orchestration, orchestration.state);
             const url = `http://localhost:4460/room/${id}`;
             if (opts.json) {
                 console.log(JSON.stringify({ schema_version: 1, room_id: id, url, room_name: room.room_name }, null, 2));
@@ -1247,8 +1325,6 @@ export function registerRoomCommands(parent, cOpt) {
         .action(async (id, opts) => {
         try {
             const { orchestration: r, members } = await taskRoomService(opts.configuration).getRoomMembers(id);
-            if (r)
-                auditRoom('members', r, r.state);
             if (opts.json) {
                 console.log(JSON.stringify({
                     schema_version: 1,
@@ -1286,9 +1362,12 @@ export function registerRoomCommands(parent, cOpt) {
             await taskRoomService(opts.configuration).requestRoomDeletion({
                 actor: { kind: 'local_control', surface: 'cli' }, roomId: id,
             });
+            const closing = getRoomRecord(id);
+            if (previous && closing && previous.state !== closing.state)
+                auditRoom('close', closing, previous.state, closing.state);
             const settled = await launchRoomDeleteWorker(id, opts.configuration);
-            if (previous)
-                auditRoom('delete', previous, previous.state, settled.deleted ? 'deleted' : 'closing');
+            if (closing)
+                auditRoom('delete', closing, closing.state, settled.deleted ? 'deleted' : 'closing');
             if (opts.json) {
                 console.log(JSON.stringify({ schema_version: 1, room_id: id, deleted: settled.deleted }, null, 2));
                 return;

package/dist/rooms-tasks/provision.js

@@ -13,6 +13,7 @@ import { buildRoomMemberTask, sha256Text } from './member-startup.js';
 import { agentDir } from '../paths.js';
 import { readProvenance } from '../creation.js';
 import { readTempSupervisor, secureStoppedTempArchive, tempArchiveForCreationAction, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { recordFleetAuditPresentation } from '../fleet-command-audit.js';
 export function getBinPath() {
     try {
         return realpathSync(process.argv[1]);
@@ -30,11 +31,30 @@ function canonicalJson(value) {
             .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(',')}}`;
     return JSON.stringify(value);
 }
+function selectionSummary(selection) {
+    if ('ref' in selection)
+        return `ref:${selection.ref} (reference)`;
+    return `inline:sha256:${createHash('sha256').update(canonicalJson(selection.inline)).digest('hex').slice(0, 16)} (inline)`;
+}
+function permissionSummary(definition) {
+    const permissions = definition.permissions;
+    if (!permissions)
+        return undefined;
+    return `approval=${permissions.approval},filesystem=${permissions.filesystem},unattended=${permissions.unattended}`;
+}
 function launchDefinition(definition) {
-    const selectionEvidence = (selection) => 'ref' in selection ? { kind: 'ref', id: selection.ref } : { kind: 'inline' };
+    const selectionEvidence = (selection) => 'ref' in selection ? { kind: 'ref', id: selection.ref } : {
+        kind: 'inline', fingerprint: `sha256:${createHash('sha256')
+            .update(canonicalJson(selection.inline)).digest('hex').slice(0, 16)}`,
+    };
     return {
         projection: {
             brain: selectionEvidence(definition.brain), role: selectionEvidence(definition.role),
+            ...(definition.permissions ? { permissions: {
+                    approval: definition.permissions.approval,
+                    filesystem: definition.permissions.filesystem,
+                    unattended: definition.permissions.unattended,
+                } } : {}),
             operationalFields: Object.keys(definition)
                 .filter(key => key !== 'brain' && key !== 'role').sort(),
         },
@@ -260,6 +280,11 @@ async function launchMember(input) {
                 ...(launched.callerRole ? { caller_role: launched.callerRole } : {}),
                 launch_id: supervisor.launchId, updated_at: new Date().toISOString(),
             } });
+        recordFleetAuditPresentation({ kind: 'agent_started', id: member.name, name: member.name,
+            lifetime: 'temporary', brain: selectionSummary(settings.definition.brain),
+            role: selectionSummary(settings.definition.role), harness: 'resolved', session: 'acp',
+            permissions: permissionSummary(settings.definition), parent: provision.roomId,
+            actionId: launched.creationActionId, inherited: [] });
     }
     catch (error) {
         updateMemberStartup(provision.roomId, member.name, { launch: {
@@ -269,6 +294,8 @@ async function launchMember(input) {
                 updated_at: new Date().toISOString(),
                 error: error instanceof Error ? error.message : String(error),
             } });
+        recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Agent', id: member.name,
+            state: 'failed', category: 'readiness_failed', eventId: effectiveActionId });
         throw error;
     }
 }

package/dist/runner.js

@@ -621,7 +621,19 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             throw error;
         }
         control.setFleetSpawner(async (requested) => {
-            return executeManagedSpawn(role, configPath, requested, deps.log);
+            const event = await executeManagedSpawn(role, configPath, requested, deps.log);
+            // Room-member launches are collected with their Task/Room transaction so
+            // causal delivery is Task → Room → Agents → Room active → Task active.
+            if (!requested.roomMemberStartup && role.owner_channel && ownerChannel?.notifyFleetSpawn) {
+                try {
+                    await ownerChannel.notifyFleetSpawn(event);
+                }
+                catch (error) {
+                    deps.log(`[${name}] Agent lifecycle notice delivery failed: `
+                        + `${error?.message ?? String(error)}`);
+                }
+            }
+            return event;
         });
         resolvedMonitorDeps.delivery = {
             // A wake is only delivered when its turn TERMINATES successfully. A

package/dist/session/control.d.ts

@@ -39,7 +39,7 @@ export interface ControlRequest {
         exitCode?: number;
         effect?: 'not_started' | 'completed' | 'unknown';
         resourceIds?: Record<string, string>;
-        presentation?: FleetAuditPresentation;
+        presentations?: FleetAuditPresentation[];
     };
 }
 export interface ControlResponse {

package/dist/session/control.js

@@ -341,7 +341,7 @@ export class RoleControlServer {
                         correlationId: audit.correlationId, class: audit.class, effect: audit.effect,
                         ...(audit.exitCode === undefined ? {} : { exitCode: audit.exitCode }),
                         ...(audit.resourceIds ? { resourceIds: audit.resourceIds } : {}),
-                        ...(audit.presentation ? { presentation: audit.presentation } : {}),
+                        ...(audit.presentations ? { presentations: audit.presentations } : {}),
                     });
                     this.write(socket, { version: 1, id: request.id, ok: true, result });
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.1.0-nightly.8",
+  "version": "1.1.0-nightly.9",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",