@ours.network/fleet 1.1.0-nightly.8 → 1.1.0

package/dist/docs.js

@@ -6,11 +6,11 @@
  */
 export const AI_DOCS = `# ours-fleet reference
 
-ours-fleet runs persistent or temporary, identity-bound AI roles through the
-structured ACP session path:
+ours-fleet runs persistent or temporary, identity-bound AI roles through a
+provider-neutral managed-session interface:
 
 - harness: \`claude-code\` or \`codex\`
-- session: \`acp\` (default and only supported value)
+- session: \`acp\` (default) or \`codex-app-server\` (Codex only)
 - lifetime: permanent (supervised, restartable) or \`spawn --temp\`
 
 ## Discover and validate
@@ -24,15 +24,24 @@ ours-fleet version [--json]             # build identity, capabilities, every in
 \`\`\`
 
 Configuration v2 is \`~/fleet.yaml\` plus typed bare documents under the exact
-stem directories \`~/fleet/agents\`, \`~/fleet/roles\`, \`~/fleet/brains\`, and
+stem directories \`~/fleet/agents\`, \`~/fleet/agent_templates\`, \`~/fleet/roles\`, \`~/fleet/brains\`, and
 \`~/fleet/room_templates\`.
 The manifest owns fleet-wide operational defaults and automation; each Agent
 selects one inline/ref Role and Brain and carries its operational fields.
+Agent Templates under \`~/fleet/agent_templates\` are inert reusable launch definitions;
+only explicit files under \`~/fleet/agents\` are persistent lifecycle instances.
+Room members use \`agent_template\` and receive immutable content-addressed snapshots.
+An Agent Template may declare up to 64 temporary-only named \`loops\`; persistent Agent
+instances reject them. Each loop requires \`interval\` (1m..30d) and bounded
+nonblank \`prompt\`, with optional \`enabled\` (default true), \`initial_delay\`
+(default interval, 0s..30d), and \`jitter\` (default 0s, < interval, <=1h).
+Execution is fixed skip-if-busy with no ordinary missed-tick backlog/replay;
+restart recovery may preserve at most one recent late occurrence.
 Legacy top-level \`roles:\` and \`fleet.d\` are rejected. Validate the complete
 trusted source set with \`config\` and \`doctor\` before starting or restarting.
 
 Permanent \`spawn\` writes \`~/fleet/agents/Name.yaml\`. The web console edits an
-explicit \`{manifest, agents}\` model while Role/Brain presets remain read-only.
+explicit \`{manifest, agents, agent_templates}\` model while Role/Brain presets remain read-only.
 Its aggregate revision includes every Agent/Role/Brain/Room-template source, previews a
 redacted per-document diff in an exact-stem private staging tree, and saves under
 one root lock with a private multi-file backup and full rollback. A no-op is
@@ -79,7 +88,7 @@ PATH order.
 ## Lifecycle and console commands
 
 \`\`\`sh
-ours-fleet init [-c FILE]               # seed missing presets; never replace an existing file
+ours-fleet init [-c FILE]               # interactive missing-default seed; TTY required
 ours-fleet up|down [Name...]
 ours-fleet restart [Name...]            # preserve/resume harness context
 ours-fleet force-restart [Name...]      # fresh context; briefing is reloaded
@@ -92,6 +101,27 @@ ours-fleet watchdog-report <name> [run-id] [--list] [--json]
 ours-fleet watchdog-run <name>
 \`\`\`
 
+\`init\` is an interactive missing-default workflow that preserves existing files byte-for-byte.
+It names the resolved manifest and split directory, asks a default-No confirmation,
+then subscriptions (Codex, Claude, or both), model assignment (one explicit model for
+every job or explicit development/review/coordination choices), one reasoning level,
+and a final default-No review. Quick/Balanced/Thorough generate low/medium/high.
+Model pickers show packaged supported IDs; catalog membership is not a recommendation
+or entitlement claim. Run \`ours-fleet doctor\` for local Codex availability; Claude
+entitlement is checked when a role launches. The generated brains contain no
+\`model_chain\`, so Fleet never silently substitutes another model.
+
+At either confirmation, N, Enter, Escape, Ctrl-C, Ctrl-D, or EOF cancels. In a picker,
+Escape, Ctrl-C, Ctrl-D, or EOF cancels; Enter records the highlight or continues a
+non-empty multi-select, N is ignored, and an empty subscription selection remains blocked.
+Every cancellation before final approval performs no host or configuration mutation.
+Redirected/non-TTY invocation is refused with the same guarantee. After the final Yes,
+host setup precedes publication. Path ownership/type/mode/symlink and
+same-filesystem checks run before host setup and again under a per-setup lock. Publication
+stages and validates the complete combined setup, backs up whichever old target(s) exist,
+and retains a private recovery record. A hard process/host termination cannot promise
+rollback; inspect host integration and private init stage/recovery evidence.
+
 \`peek\`, \`attach\`, and text \`send\` use the structured agent session.
 Attachment also accepts \`/permit <permission-id> <option-id>\`, \`/interrupt\`,
 and \`/detach\`.
@@ -162,7 +192,7 @@ Permanent spawn writes \`~/fleet/agents/Name.yaml\` and starts a supervised role
 \`--temp\` writes active state under \`~/.ours-fleet/tmp\` and starts an independent
 transient supervisor (a collected systemd unit or submitted launchd job). It is
 not enabled across reboot and does not die when the role that spawned it restarts.
-Brain definitions own the ACP session backend. When a temporary role's bound identity
+Brain definitions own the managed session backend. When a temporary role's bound identity
 closes or its session ends, the supervisor, monitor and live roster entry retire
 together; state moves intact to \`~/.ours-fleet/recovery/temporary\` with a
 termination record. Failed launches use the same archive rather than deleting
@@ -194,21 +224,19 @@ only sustained authoritative absence closes the role. Unreachable, malformed, or
 valid-but-empty daemon indexes are ambiguous and reset closure debounce rather
 than becoming cleanup authority.
 
-Inside a managed ACP role, every \`ours-fleet\` CLI attempt first crosses one
-authenticated supervisor audit boundary before Commander parsing or side effects.
-The original CLI remains the executor inside the role's existing OS sandbox. The
-supervisor writes a deterministic, structurally redacted raw argv invocation to the
-role's existing Owner-visible channel, then permits explicit Agent/Task/Room/template
-and safe read-only routes. Operator lifecycle/control, hidden worker, and unknown
-routes are denied but remain audited. A correlated outcome repeats the same redacted
-argv and records a safe success/failure classification plus known resource IDs.
-
-Invocation delivery must be confirmed before execution. Delivery ambiguity fails
-closed. If outcome delivery becomes uncertain after an effect, Fleet records the
-known effect state and never reruns or blindly retries it. Durable correlation state
-makes incomplete and uncertain attempts observable across supervisor restart. Spawn
-still uses the typed supervisor creation service for inheritance, but its former
-standalone announcement is replaced by the canonical audit pair.
+Inside a managed role, public \`ours-fleet\` commands cross an authenticated
+supervisor attribution boundary before Commander parsing. The original CLI remains
+the executor inside the role's existing OS sandbox, and ordinary CLI validation is
+the source of truth. Hidden worker entry points remain internal; public lifecycle and
+operator commands are not restricted by the proxy.
+
+Command invocation, raw argv, read-only work, validation failures, and generic
+outcomes are never forwarded to the Owner-visible channel. Fleet announces only
+confirmed Agent, Task, and Room lifecycle changes. Local diagnostics retain
+structurally redacted command metadata. Lifecycle delivery uncertainty is logged,
+never recursively announced, and never reruns or blindly retries an effect.
+Room participant summaries describe creation and activation. Fleet has no public
+post-create Room membership mutation, so it does not claim a separate membership event.
 
 Omitted Brain and Role selections, working directory, coordinator, neutral permissions,
 and fleet monitor policy inherit from the calling Agent. Explicit options always win.
@@ -223,6 +251,12 @@ Brain owns harness, session, model, reasoning effort, token limits, and native h
 options. Removed runtime flags are rejected with migration guidance rather than silently
 reinterpreted. A selection is a stable ID or an explicit \`inline:{...}\` mapping.
 
+Packaged Developer, Critic, and LocalCoordinator Agent Templates set
+\`monitor: { mode: fleet, interrupt: after_tool }\`. Every member of the standard
+\`single\`, \`pair\`, and \`team\` Room Templates therefore resolves to fleet-owned,
+after-tool delivery. Explicit per-member and custom Agent Template values remain
+authoritative and merge key by key.
+
 ## fleet.yaml
 
 \`\`\`yaml
@@ -256,7 +290,7 @@ An Agent is a separate bare document under \`~/fleet/agents/<ID>.yaml\`:
 
 \`\`\`yaml
 role: { inline: { mission: Coordinate work and delegate implementation. } }
-brain: { inline: { harness: codex, session: acp, model: gpt-model-id } }
+brain: { inline: { harness: codex, session: codex-app-server, model: gpt-model-id } }
 identity: Coordinator
 cwd: \${work_root}/project
 oversee: [{ agent: Worker, interval: 5m }]
@@ -296,14 +330,46 @@ ours-fleet template show team [-c FILE]
 ours-fleet task create --title "Solo task" --template single [-c FILE]
 ours-fleet task create --title "Reviewed change" --template pair [-c FILE]
 ours-fleet task create --title "Phased delivery" --template team [-c FILE]
+ours-fleet spawn --temp Scout --role SELECTION --brain SELECTION --loops-file PRIVATE.yaml
+ours-fleet task start TASK --member developer --loops-file PRIVATE.yaml
+ours-fleet task start TASK --member critic --no-loops
 \`\`\`
 
+\`--loops-file\` must be an owner-only, non-symlink regular file <=1 MB containing
+exactly one top-level non-empty \`loops:\` mapping. \`--no-loops\` explicitly
+disables loops. They are mutually exclusive and rejected for permanent spawn.
+For a grouped room member the whole CLI block overrides its Agent Template;
+the template overrides omission. Omission preserves historical no-loop behavior
+and never inherits manifest wildcard loops. Fleet validates before side effects,
+seals normalized timings plus exact private prompts, and reuses that snapshot for
+idempotent start, retry, recovery, and replacement. Trusted authoring and the
+private sealed runtime retain exact prompts; resolved launch, task, room,
+provenance, and audit presentations show source, policy, timing, prompt bytes,
+and prompt SHA-256 instead of prompt text.
+
 An alternate manifest \`-c /path/custom.yaml\` uses \`/path/custom/\` as its split
 root. Repeated init only fills missing files and never adopts a newer default.
-For explicit adoption, copy one file from init's reported packaged source beside
-the target as \`.new-default\`, inspect \`diff -u TARGET TARGET.new-default\`, then
-replace TARGET yourself. Upgrades from hardcoded templates require one
-\`ours-fleet init\` (or \`init -c FILE\`) migration pass. A manifest-level template
+Exact known revision-3 through revision-5 packaged-bootstrap and generated role defaults have an exact-semantic,
+fail-closed migration (dry-run by default):
+
+\`ours-fleet migrate-role-defaults [-c FILE]\`
+\`ours-fleet migrate-role-defaults [-c FILE] --write\`
+
+Review removals, replacements, additions, preserved custom files, staging path,
+and recovery path. Same-named custom files stay byte-identical; dangling custom
+references refuse publication, and a successful rerun is a no-op. For explicit
+single-file adoption, copy from init's reported packaged source beside the target
+as \`.new-default\`, inspect \`diff -u TARGET TARGET.new-default\`, then replace it.
+
+The exact generated six-worker legacy starter Agent set has its own fail-closed
+migration (dry-run by default):
+
+\`ours-fleet migrate-agent-templates [-c FILE]\`
+\`ours-fleet migrate-agent-templates [-c FILE] --write\`
+
+Review the dry-run moves, addition, staging path, and retained recovery-backup path
+before \`--write\`. Customized/partial known starters and unsafe trees refuse without
+mutation; unrelated custom persistent Agents remain persistent. A manifest-level template
 may shadow a same-named file only with \`override_builtin: true\` and a higher
 version; this compatibility marker is deprecated and reported as a diagnostic.
 
@@ -331,8 +397,37 @@ Fleet launches each template member with a dedicated one-time Cowork invite.
 The generated temporary-agent briefing contains the exact identity name, invite,
 Cowork role, and task. The agent creates that identity itself with ours MCP
 \`create_temporary_identity\`, accepts the invite with \`add_contact\`, and starts
-work immediately. Fleet activates the room from Cowork's authenticated seat; there
-is no briefing hash, startup ACK, or separate role-briefing readiness gate.
+work immediately. A room is ready only after the Cowork room (and its task, when
+task-bound) is durably active, every configured member seat is authenticated and active with its matching
+live Fleet launch, and the configured Owner seat is active when owner attachment is
+enabled. There is no briefing hash, startup ACK, or separate role-briefing readiness
+gate.
+
+Normal Task provisioning emits exactly one authenticated Owner lifecycle notice after
+the ready predicate above is true; standalone Room provisioning likewise emits one
+ready notice. Intermediate task, saga, member-spawn, timeout, and recoverable-failure
+transitions stay in local state and logs. A terminal failed Task emits one actionable
+failure notice; the command result carries the exact blocker and canonical recovery
+action.
+
+\`task start\` and create-and-start wait for readiness. If their bounded wait expires,
+they return an explicit \`in_progress\` result and start a safe continuation. The detached
+continuation is serialized per Task and remains alive until convergence or an
+Owner-action blocker. Re-running \`task start <id>\` safely resumes the same durable
+provisioning operation after the blocker is corrected or a process restarts.
+
+Set \`room.anonymous: true\` on a room template, or pass \`--anonymous\` to
+\`task create\`, \`task start\`, \`task work\`, or \`room create\`, to create an
+anonymous Cowork room. \`--no-anonymous\` explicitly overrides an anonymous
+template. Fleet records the resolved value before room creation so retries keep
+the same choice. Temporary members of an anonymous room are instructed to call
+\`create_temporary_identity\` with \`expose_local=false\`. Their generated briefings
+do not disclose or compare an Owner participant CID. A participant-originated
+instruction has Owner authority only when the authenticated Cowork room envelope
+attributes that participant seat the exact \`Owner\` role. Literal text, display
+names, ordinary direct messages, and room-authored or rest-role messages with an
+Owner-looking label never grant that authority. Non-anonymous rooms remain pinned
+to the exact authenticated Owner CID.
 
 Human task and room results use the same compact Markdown presentation in the
 CLI and authenticated owner channel: a short heading, icon-plus-word status,
@@ -382,11 +477,24 @@ The prerelease configuration names \`tasks.close_room_on_done\` and
 semantics. Older prerelease \`closed\` room records are deleted directly the next
 time \`room list\` reconciles Fleet with Cowork.
 
-\`ours-fleet task delete <id> <id>\` removes only a \`done\` task's Fleet backlog
-record. The exact task ID is required twice for confirmation. Delete rejects every
-other task state, never changes any room state, and reports an already-missing
-task as an idempotent no-op. The Owner-channel equivalent is
-\`/task delete <id> <id>\`.
+\`ours-fleet task delete <id> <id>\` permanently deletes a task in ANY lifecycle
+state — backlog, provisioning, active, blocked, review, done, cancelled, failed,
+or partially settled. The exact task ID is required twice for confirmation. A
+durable deletion intent is persisted before any side effect; the cleanup worker
+then retires managed room members with evidence, closes and deletes an attached
+room (tolerating already-missing remote rooms), releases the sealed launch
+snapshot, and unlinks the task record last. While cleanup settles the task is
+hidden from normal listings and every lifecycle mutation is rejected; if
+cleanup cannot complete (for example Cowork is unreachable), the deletion stays
+in a precise resumable state — repeat the identical delete command to converge
+after outages, crashes, or restarts. Deletion
+never fabricates a \`done\` transition. A metadata-only deletion receipt
+(acceptance actor, original state, timestamps, completion) is retained under
+\`deletion-receipts/\` as durable audit evidence. An already-missing task is an
+idempotent no-op. The Owner-channel equivalent is \`/task delete <id> <id>\`; the
+management API equivalent is \`DELETE /api/v1/tasks/<id>?confirm=<id>\` (200 when
+settled, 202 while pending; \`GET /api/v1/tasks?includeDeleting=true\` exposes
+deletion-pending tasks to operators).
 
 ## Permissions
 
@@ -395,12 +503,13 @@ Prefer the harness-neutral \`permissions\` block:
 - \`approval: ask|auto|allow\`: portable permission policy. \`deny\` remains a
   deprecated, fail-closed compatibility alias for existing fleet files.
 - \`filesystem: read-only|workspace|unrestricted\`: filesystem intent
-- \`unattended: deny|wait\`: what ACP does when no console can answer a request
+- \`unattended: deny|wait\`: what a managed session does when no console can
+  answer a request
 
-The backend translates this common intent. Harness-native settings in
-\`harness_options\` take precedence where supplied. Do not choose
-\`allow\`/\`unrestricted\`, Codex \`never\`/\`danger-full-access\`, or Claude
-\`bypassPermissions\` without explicit authorization.
+The backend translates this common intent. Native Codex app-server roles reject
+permission aliases in \`harness_options\`; Codex ACP and Claude retain their
+legacy native-override compatibility. Do not choose \`allow\`/\`unrestricted\`
+or Claude \`bypassPermissions\` without explicit authorization.
 
 ### Creation-time isolation
 
@@ -473,12 +582,14 @@ permissions through its harness and check the result against a fixed floor:
 deny those requests with nobody to see it; with \`unattended: wait\` it warns,
 because a human can still attach and answer.
 
-Security meaning: \`ask\` maps to Codex \`untrusted\` and Claude \`default\`.
-\`auto\` selects Codex ACP \`agent\` (\`on-request\` + \`workspace-write\`) and
-Claude \`acceptEdits\`. \`approval: allow\` selects Codex ACP's fully
-non-interactive yolo mode, reported as \`agent-full-access\` (\`never\` +
-\`danger-full-access\`), and Claude \`bypassPermissions\`. These modes genuinely
-permit the actions the role was authorized to take —
+Security meaning: native Codex maps \`ask\` → \`untrusted\`, \`auto\` →
+\`on-request\`, and \`allow\` → \`never\`; its independent filesystem mapping is
+\`read-only\` → \`read-only\`, \`workspace\` → \`workspace-write\`, and
+\`unrestricted\` → \`danger-full-access\`. Users configure only the Fleet names.
+Claude maps \`ask\` to \`default\`, \`auto\` to \`acceptEdits\`, and \`allow\` to
+\`bypassPermissions\`. Codex ACP retains its adapter-specific coupled modes:
+\`auto\` selects \`agent\`, while \`allow\` selects \`agent-full-access\`. These
+modes genuinely permit the actions the role was authorized to take —
 \`dontAsk\` only suppresses the prompt while still refusing the action. Nothing
 other than an explicit \`allow\` becomes non-interactive. Legacy \`deny\` keeps
 its conservative Codex \`on-request\` / Claude \`plan\` translation. \`allow\` is therefore a real grant and
@@ -533,10 +644,31 @@ refused at validation rather than accepted and dropped. This narrows a role's
 tool surface; it does not stop the harness deferring tool schemas, which is the
 harness's own decision.
 
-Codex \`harness_options\`: \`launcher\` (auto, ours-codex, codex), \`sandbox\`
-(read-only, workspace-write, danger-full-access), \`approval\` or
-\`permission_mode\` (untrusted, on-request, never), \`profile\`, \`search\`,
-\`config\`, \`add_dirs\`, and \`monitor\`.
+Codex \`harness_options\`: \`launcher\` (auto, ours-codex, codex), \`search\`,
+\`config\`, \`add_dirs\`, and \`monitor\`; Codex ACP additionally supports
+\`profile\`. Native app-server roles reject \`profile\` because Codex does not
+accept \`--profile\` for \`app-server\`. They
+must express approval and filesystem authority through the shared
+\`permissions:\` block, never through harness options. The adapter translates
+\`ask|auto|allow\` to Codex \`untrusted|on-request|never\` and translates
+\`read-only|workspace|unrestricted\` to Codex
+\`read-only|workspace-write|danger-full-access\`. Native \`config\` currently
+allows only \`model_reasoning_effort\`; ACP retains the broader Codex config surface.
+
+For Codex, the opt-in \`session: codex-app-server\` directly runs Codex's native
+JSONL app server behind Fleet's provider-neutral session contract. It supports native item
+streaming, commentary/final phases, prompt admission, steering, interruption,
+permission requests, durable conversation projection, and thread resume. Packaged
+Codex brains and the init wizard continue to select \`session: acp\` for compatibility;
+Claude Code also uses ACP. Native Codex defaults to \`codex app-server\` (or \`ours-codex app-server\`
+when launcher auto finds it). Override the exact command when necessary:
+
+\`session_options: { codex_app_server: { command: [codex, app-server] } }\`
+
+An exact command override receives no appended profile, search, or subcommand
+arguments. Native sessions persist their Codex thread in Fleet's \`.session-id\`
+and participate in its bounded fresh/resume recovery; cross-provider conversation
+portability is never assumed.
 
 ## ACP adapters
 
@@ -544,8 +676,7 @@ The maintained \`@agentclientprotocol/codex-acp\` and
 \`@agentclientprotocol/claude-agent-acp\` runtimes are bundled automatically as
 optional ours-fleet dependencies. The supervisor resolves their executable
 entrypoints internally, so default ACP roles do not depend on global PATH.
-The maintained Claude adapter requires Node 22; Codex ACP continues to work on
-the ours-fleet core minimum of Node 20.
+ours-fleet and both maintained adapters require Node 22 or newer.
 
 Override an adapter only when necessary with \`session_options.acp.command\`
 (string or argv list). If optional dependencies were deliberately omitted,
@@ -589,7 +720,7 @@ Inspect \`ours-fleet status Name\`, \`peek Name\`, role logs, and
 
 ## Trusted owner channel
 
-An ACP role may declare a separate ours identity which fleet — never the agent —
+Any managed role may declare a separate ours identity which fleet — never the agent —
 creates when missing and binds:
 
 \`\`\`yaml
@@ -642,6 +773,13 @@ adapter executes them locally (claude-code: all three; codex: \`/compact\`
 only) and are otherwise refused with a notice, so slash text never reaches the
 model as a prompt.
 
+The supervisor advertises the same primary registry entries as recipient-scoped
+ours typed commands. Their single arguments field is converted back to the text
+after the slash command name and enters the same dispatcher; aliases stay
+slash-only. Typed handlers repeat the live authenticated Owner-CID check before
+dispatch and return a null protocol completion because the existing correlated
+owner-channel reply remains the result.
+
 While a request runs, the agent's live ACP commentary is relayed as messages
 prefixed with the single stable label \`🟡 Live update:\`, so an owner can see
 exactly which messages the setting controls. \`owner_channel.comments\`
@@ -690,12 +828,12 @@ provenance checks.
 The channel identity must be unique and must not be a role identity. The bridge
 persists bounded wire IDs only, never message/reply plaintext, and requeues input
 before starting its turn for at-least-once crash recovery. It currently requires
-the structured agent-session interface backed by ACP so correlated final replies
-retain their delivery guarantee.
+the structured agent-session interface so correlated final replies retain their
+delivery guarantee.
 
 ### Live contact and owner administration
 
-The supervisor which is already running the ACP role remains the sole binder of
+The supervisor which is already running the managed role remains the sole binder of
 \`owner_channel.identity\`. The CLI reaches that exact live \`OwnerChannel\`
 through the role's token-authenticated, mode-0600 Unix control socket for contact
 inspection and setup; it never starts another ours client and never force-binds:

package/dist/doctor.d.ts

@@ -15,5 +15,7 @@ export declare function doctor(opts?: {
         path?: string;
         argv1?: string;
     };
+    /** Override the local Codex model cache path (tests). */
+    codexCatalogPath?: string;
 }, exec?: Exec, platform?: NodeJS.Platform, fetchImpl?: FetchLike, attachDaemon?: AttachDoctorDaemon): Promise<PrereqReport>;
 export {};

package/dist/doctor.js

@@ -14,6 +14,7 @@ import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, BIN_NAME, } from './provenance.js';
 import { readDaemonRecoveryStatus } from './daemon-recovery.js';
+import { codexModelCatalog } from './application/model-catalog.js';
 /** Which cgroup-v2 controllers are delegated to this user manager (advisory). */
 function cgroupDelegationDetail() {
     try {
@@ -107,6 +108,22 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 ok: true,
                 detail: `warning: ${diagnostic.message}`,
             });
+    if (loaded.ok) {
+        const packaged = Object.entries(loaded.brainPresets ?? {}).flatMap(([id, brain]) => brain.harness === 'codex' && typeof brain.model === 'string' && typeof brain.effort === 'string'
+            ? [{ id, model: brain.model, effort: brain.effort }] : [])
+            .sort((a, b) => a.id.localeCompare(b.id));
+        if (packaged.length) {
+            const runtime = codexModelCatalog(opts.codexCatalogPath);
+            const available = new Set(runtime.models.flatMap(model => model.reasoningEfforts.map(effort => `${model.id}\0${effort}`)));
+            const missing = packaged.filter(({ model, effort }) => !available.has(`${model}\0${effort}`));
+            checks.push({ name: 'brain catalog: Codex runtime drift', ok: true,
+                detail: runtime.models.length
+                    ? missing.length ? `warning: packaged Brain preset(s) absent from local Codex catalog: ${missing
+                        .map(({ id, model, effort }) => `${id} (${model}/${effort})`).join(', ')}`
+                        : `all ${packaged.length} packaged Codex model/effort pairs are present locally`
+                    : runtime.warnings.join('; ') });
+        }
+    }
     for (const role of roles) {
         const recovery = readDaemonRecoveryStatus(agentDir(role.name));
         if (!recovery)
@@ -160,16 +177,16 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         const { listTemplates, resolveTemplate } = await import('./rooms-tasks/templates.js');
         const customs = loaded.roomTemplates ?? {};
         const templates = listTemplates(customs);
-        const roleNames = new Set(roles.map(r => r.name));
+        const agentTemplateNames = new Set(Object.keys(loaded.agentTemplates ?? {}));
         for (const t of templates) {
             const badRefs = t.members
-                .filter(m => 'ref' in m.agent && !roleNames.has(m.agent.ref))
-                .map(m => 'ref' in m.agent ? m.agent.ref : '');
+                .filter(m => !agentTemplateNames.has(m.agent_template))
+                .map(m => m.agent_template);
             if (badRefs.length) {
                 checks.push({
                     name: `template: ${t.name}@${t.version}`,
                     ok: true,
-                    detail: `warning: Agent ref(s) ${badRefs.join(', ')} not found in configured Agents`,
+                    detail: `warning: Agent Template(s) ${badRefs.join(', ')} not found`,
                 });
             }
         }
@@ -527,6 +544,23 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 : `${command} not found or failed — install the ACP adapter or set session_options.acp.command`,
         });
     }
+    for (const role of roles.filter(role => role.session === 'codex-app-server')) {
+        const configured = role.session_options?.codex_app_server?.command;
+        const launcher = role.harness_options?.launcher;
+        const command = Array.isArray(configured)
+            ? configured[0]
+            : typeof configured === 'string'
+                ? configured.trim().split(/\s+/)[0]
+                : launcher === 'ours-codex' ? 'ours-codex' : 'codex';
+        const result = await exec('sh', ['-c', 'command -v "$1" >/dev/null 2>&1', 'sh', command]);
+        checks.push({
+            name: `codex-app-server: ${role.name}`,
+            ok: result.code === 0,
+            detail: result.code === 0
+                ? `${command} available`
+                : `${command} not found — install Codex CLI or set session_options.codex_app_server.command`,
+        });
+    }
     return { ok: checks.every(c => c.ok), checks };
 }
 function loadConfigResult(configPath, yamlMode) {
@@ -535,6 +569,8 @@ function loadConfigResult(configPath, yamlMode) {
         return {
             ok: true, roles: cfg.roles, files: cfg.files, diagnostics: cfg.diagnostics,
             rooms: cfg.rooms, roomTemplates: cfg.roomTemplates, tasks: cfg.tasks,
+            agentTemplates: cfg.agentTemplates,
+            brainPresets: cfg.brainPresets,
             ownerInviteFingerprint: cfg.ownerInviteFingerprint,
         };
     }

package/dist/fleet-command-audit.d.ts

@@ -1,3 +1,5 @@
+import { type AgentLaunchConfiguration } from './lifecycle-summary.js';
+import type { SessionBackendId } from './config.js';
 export type FleetCommandDecision = 'allow' | 'deny' | 'unsupported';
 export type FleetCommandOutcomeClass = 'success' | 'validation' | 'denied' | 'runtime' | 'timeout' | 'proxy' | 'delivery';
 export declare class FleetCliExit extends Error {
@@ -8,53 +10,98 @@ export declare class FleetCliExit extends Error {
 }
 export type FleetAuditPresentation = {
     kind: 'agent_started';
+    eventId: string;
+    id: string;
     name: string;
     lifetime: 'permanent' | 'temporary';
     brain: string;
     role: string;
     harness: string;
-    session: 'acp';
+    session: SessionBackendId;
     model?: string;
     permissions?: string;
     parent: string;
     actionId: string;
     inherited: string[];
+    configuration?: AgentLaunchConfiguration;
 } | {
     kind: 'task';
-    operation: string;
+    operation: 'create' | 'start' | 'work' | 'block' | 'unblock' | 'review' | 'done' | 'cancel' | 'finish' | 'delete' | 'settling';
+    eventId: string;
     id: string;
     title?: string;
     previousState?: string;
     newState: string;
     template?: string;
     roomId?: string;
+    roomName?: string;
+    reason?: string;
+    revision?: string;
+    list?: string;
     agents: Array<{
         name: string;
         brain?: string;
         role: string;
+        permissions?: string;
+        configuration?: AgentLaunchConfiguration;
     }>;
 } | {
     kind: 'room';
-    operation: string;
+    operation: 'create' | 'activate' | 'close' | 'delete';
+    eventId: string;
     id: string;
     previousState?: string;
     newState: string;
+    revision?: string;
+    name?: string;
     template?: string;
+    taskId?: string;
+    anonymous?: boolean;
+    memberCount?: number;
+    ownerAttached?: boolean;
     participants: Array<{
         name: string;
+        id?: string;
+        brain?: string;
         role: string;
+        permissions?: string;
+        configuration?: AgentLaunchConfiguration;
     }>;
+} | {
+    kind: 'lifecycle_failure';
+    eventId: string;
+    resource: 'Agent' | 'Task' | 'Room';
+    id: string;
+    label?: string;
+    state: string;
+    category: 'provision_failed' | 'provision_pending' | 'readiness_failed' | 'settlement_failed' | 'settlement_pending' | 'cleanup_failed' | 'cleanup_pending';
 };
+/** Commands are Owner-silent unless they record one of these semantic lifecycle kinds. */
+export declare const FLEET_LIFECYCLE_EVENT_KINDS: readonly ["agent_started", "task", "room", "lifecycle_failure"];
+/** Stable semantic dedupe basis: resource kind + stable resource ID + transition/action ID. */
+export declare function lifecycleEventDigestBasis(value: FleetAuditPresentation): string;
 export declare function beginFleetAuditCollection(): void;
+export declare function setFleetAuditLifecycleCheckpoint(checkpoint: ((presentations: FleetAuditPresentation[]) => Promise<void>) | undefined): void;
+/**
+ * Deliver already-recorded lifecycle events while a managed command is still
+ * running. On a failed checkpoint the events remain in the final audit batch,
+ * so a temporary Owner-channel outage loses timing, never the notice itself.
+ */
+export declare function checkpointFleetAuditPresentations(): Promise<void>;
 export declare function recordFleetAuditResource(kind: 'agent' | 'task' | 'room', id: string | undefined): void;
-export declare function recordFleetAuditPresentation(value: FleetAuditPresentation): void;
+type FleetAuditPresentationInput = FleetAuditPresentation extends infer T ? T extends FleetAuditPresentation ? Omit<T, 'eventId'> & {
+    eventId?: string;
+} : never : never;
+/** Immutable, single-line human label captured before mutable Task/Room state can disappear. */
+export declare function fleetPresentationLabel(value: unknown): string | undefined;
+export declare function recordFleetAuditPresentation(value: FleetAuditPresentationInput): void;
 export declare function recordFleetAuditFailure(failure: {
     class: FleetCommandOutcomeClass;
     effect: 'not_started' | 'completed' | 'unknown';
 }): void;
 export declare function consumeFleetAuditCollection(): {
     resourceIds?: Record<string, string>;
-    presentation?: FleetAuditPresentation;
+    presentations?: FleetAuditPresentation[];
     failure?: {
         class: FleetCommandOutcomeClass;
         effect: 'not_started' | 'completed' | 'unknown';
@@ -81,7 +128,7 @@ export interface FleetAuditAttempt {
         effect: 'not_started' | 'completed' | 'unknown';
         delivery: 'sending' | 'delivered' | 'uncertain';
         resourceIds?: Record<string, string>;
-        presentation?: FleetAuditPresentation;
+        presentations?: FleetAuditPresentation[];
     };
 }
 export declare const fleetProxyCommandInventory: Readonly<{
@@ -90,6 +137,7 @@ export declare const fleetProxyCommandInventory: Readonly<{
 export declare const fleetProxyTopLevelInventory: Readonly<{
     safeRead: string[];
     agent: string[];
+    public: string[];
     denied: string[];
     hidden: string[];
     aliases: string[];
@@ -125,7 +173,9 @@ export declare function validateFleetAuditFinish(value: unknown): asserts value
     exitCode?: number;
     effect: 'not_started' | 'completed' | 'unknown';
     resourceIds?: Record<string, string>;
-    presentation?: FleetAuditPresentation;
+    presentations?: FleetAuditPresentation[];
 };
-export declare function renderFleetAuditInvocation(attempt: FleetAuditAttempt): string;
-export declare function renderFleetAuditOutcome(attempt: FleetAuditAttempt): string;
+export declare function validateFleetAuditPresentations(value: unknown): asserts value is FleetAuditPresentation[];
+/** Compact Owner presentation. It intentionally has no command, argv, environment, or correlation data. */
+export declare function renderFleetLifecycleEvent(value: FleetAuditPresentation): string;
+export {};