@ours.network/fleet 1.1.5 → 1.2.0-nightly.10

package/dist/session/codex-app-server-transport.js

@@ -55,7 +55,7 @@ export class CodexAppServerTransport {
             throw new Error('Codex app-server command is empty');
         const child = spawn(options.argv[0], options.argv.slice(1), {
             cwd: options.cwd,
-            env: { ...process.env, ...options.env },
+            env: { ...(options.env?.FLEET_OURS_MANAGED === '1' ? {} : process.env), ...options.env },
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         // `pid` is assigned synchronously on a successful local spawn. Checking it

package/dist/session/codex-app-server.js

@@ -879,6 +879,21 @@ export class CodexAppServerSession {
             this.transport.respond(id, { currentTimeAt: Math.floor(Date.now() / 1_000) });
             return;
         }
+        if (method === 'mcpServer/elicitation/request') {
+            const schema = params.requestedSchema;
+            // The permission UI can answer a confirmation, but cannot collect form
+            // fields or perform URL-based verification on the user's behalf.
+            if (params.mode !== 'form' || !isObject(schema) || schema.type !== 'object'
+                || !isObject(schema.properties) || Object.keys(schema.properties).length
+                || (schema.required !== undefined
+                    && (!Array.isArray(schema.required) || schema.required.length))) {
+                this.options.log(`[${this.options.name}] codex app-server: unsupported MCP elicitation form`);
+                this.transport.respond(id, { action: 'decline', content: null, _meta: null });
+                return;
+            }
+            this.requestPermission(method, id, params);
+            return;
+        }
         if (method === 'item/tool/requestUserInput') {
             this.options.log(`[${this.options.name}] codex app-server: requestUserInput has no interactive Fleet mapping; returning no answers`);
             this.transport.respond(id, { answers: {} });
@@ -896,9 +911,11 @@ export class CodexAppServerSession {
             { optionId: 'allow_session', name: 'Allow for session', kind: 'allow_always', native: 'acceptForSession' },
             { optionId: 'deny_once', name: 'Deny', kind: 'reject_once', native: 'decline' },
             { optionId: 'cancel', name: 'Cancel', kind: 'reject_once', native: 'cancel' },
-        ].filter(option => method === 'item/fileChange/requestApproval'
-            || method === 'item/permissions/requestApproval'
-            || !available.length || available.includes(option.native))
+        ].filter(option => method === 'mcpServer/elicitation/request'
+            ? option.optionId !== 'allow_session'
+            : method === 'item/fileChange/requestApproval'
+                || method === 'item/permissions/requestApproval'
+                || !available.length || available.includes(option.native))
             .map(({ native: _native, ...option }) => option);
         const pending = {
             requestId, method, toolCallId, options,
@@ -909,7 +926,8 @@ export class CodexAppServerSession {
         // `approval=allow` covers native operations inside the declared boundary;
         // it must never silently widen filesystem or network authority.
         if (this.options.permissions.approval === 'allow'
-            && method !== 'item/permissions/requestApproval') {
+            && method !== 'item/permissions/requestApproval'
+            && method !== 'mcpServer/elicitation/request') {
             this.transport.respond(requestId, this.permissionResponse(pending, 'accept'));
             this.resolvePermission(permissionId, pending, 'allowed', 'automatic', 'allow_once', 'permissions.approval=allow', 'the native request is inside the configured Codex boundary');
             return;
@@ -925,7 +943,9 @@ export class CodexAppServerSession {
         this.readiness = 'awaiting_permission';
         const timeoutMs = this.options.permissionTimeoutMs ?? PERMISSION_TIMEOUT_MS;
         const expiresAt = new Date(Date.now() + timeoutMs).toISOString();
-        const title = string(params.command) ?? string(params.reason)
+        const title = (method === 'mcpServer/elicitation/request'
+            ? `${string(params.serverName) ?? 'MCP'}: ${string(params.message) ?? 'Confirmation requested'}`
+            : undefined) ?? string(params.command) ?? string(params.reason)
             ?? (method === 'item/fileChange/requestApproval' ? 'Apply file changes'
                 : method === 'item/permissions/requestApproval' ? 'Grant additional permissions'
                     : 'Run command');
@@ -993,6 +1013,12 @@ export class CodexAppServerSession {
         return !turnId || !this.activeTurn.nativeTurnId || turnId === this.activeTurn.nativeTurnId;
     }
     permissionResponse(pending, decision) {
+        if (pending.method === 'mcpServer/elicitation/request')
+            return {
+                action: decision === 'acceptForSession' ? 'accept' : decision,
+                content: decision.startsWith('accept') ? {} : null,
+                _meta: null,
+            };
         if (pending.method !== 'item/permissions/requestApproval')
             return { decision };
         const requested = pending.requestedPermissions ?? {};

package/dist/spawn.js

@@ -1,3 +1,6 @@
+import { randomUUID } from 'node:crypto';
+import { storeRoomSecret, storeTemporaryLaunch, preparePermanentAssignment } from './agent-ours/service.js';
+import { ensureWorkspace } from './rooms-tasks/workspace.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -7,7 +10,7 @@ import { validateIsolationConfig } from './isolation/policy.js';
 import { loadConfig, findRole, splitRootFor, validateMonitorConfig, } from './config.js';
 import { applyRole, up } from './ops.js';
 import { START_STAGGER_FILE } from './runner.js';
-import { buildProvenance, daemonIdentityProvisioner, ensureIdentity, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
+import { buildProvenance, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
 import { VERSION } from './version.js';
 import { recordGeneratedAgentSource } from './generated-agent-source.js';
 import './harness/claude-code.js';
@@ -239,22 +242,12 @@ export async function spawnPermanent(o, deps, creation = {}) {
     return withCreationTransaction({ role: o.name, identity: effectiveIdentity(o) }, async (tx) => {
         assertNameFree(o);
         const cfg = loadConfig(o.configPath);
-        // Establish the identity BEFORE the service is enabled, and record
-        // what was actually guaranteed so the briefing can say something true.
+        // Pin an existing assignment without binding; the supervisor provisions
+        // a missing role identity before starting its harness.
         creation.onStage?.('checking_identity');
-        const guarantee = await ensureIdentity(effectiveIdentity(o), { bio: prepared.role.bio, persona: prepared.role.persona }, creation.identityProvisioner ?? deps.identityProvisioner ?? daemonIdentityProvisioner(), deps.log);
-        creation.onStage?.('checking_identity', {
-            result: guarantee.evidence, guarantee: guarantee.state,
-        });
-        if (guarantee.state === 'created')
-            // We minted it; a failed creation must not leave an orphan identity
-            // behind. Only ever removes an identity THIS transaction created.
-            tx.record({
-                stage: `ours identity ${effectiveIdentity(o)}`,
-                undo: async () => {
-                    await creation.identityProvisioner?.remove?.(effectiveIdentity(o));
-                },
-            });
+        const assignment = await preparePermanentAssignment(prepared.role);
+        const guarantee = { state: assignment, evidence: assignment === 'verified' ? 'verified' : 'missing' };
+        creation.onStage?.('checking_identity', { result: guarantee.evidence, guarantee: guarantee.state });
         const agentRoot = join(splitRootFor(o.configPath ?? defaultConfigPath()), 'agents');
         mkdirSync(agentRoot, { recursive: true });
         creation.onStage?.('writing_role');
@@ -329,6 +322,12 @@ export async function spawnTemp(o, binPath, launch = independentSupervisor, crea
     if (o.isolationFile)
         readIsolationFile(o.isolationFile); // fail before reserving
     const prepared = resolvedSpawn(o); // canonical validation before mutation
+    if (o.roomMemberStartup?.workspace) {
+        const workspace = o.roomMemberStartup.workspace;
+        if (prepared.role.cwd !== workspace.path)
+            throw new Error('room member cwd must equal its recorded owned workspace');
+        ensureWorkspace(workspace);
+    }
     // Retire only supervisors whose recorded owner is definitively stopped. This
     // bounded pass keeps the active roster clean without deleting old evidence.
     await reclaimStaleTempState();
@@ -354,6 +353,10 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
         temporaryLoopSource: o.loopSource ?? (temporaryLoops?.length ? 'agent-template' : 'omitted'),
         roomMemberStartup: o.roomMemberStartup,
     };
+    storeTemporaryLaunch(role, o.creationActionId ?? randomUUID());
+    storeRoomSecret(role);
+    if (role.roomMemberStartup)
+        role.roomMemberStartup = { ...role.roomMemberStartup, invite: '' };
     onStage?.('writing_role');
     const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified' });
     const provenance = buildProvenance({

package/dist/startup-readiness.d.ts

@@ -0,0 +1,13 @@
+import { type DaemonGenerationProbe } from './daemon-recovery.js';
+export declare const STARTUP_WAIT_MS = 240000;
+export declare const STARTUP_RETRY_MS = 5000;
+interface ReadinessDeps {
+    probe(env: NodeJS.ProcessEnv): Promise<DaemonGenerationProbe>;
+    now(): number;
+    sleep(ms: number): Promise<void>;
+    log(message: string): void;
+    env: NodeJS.ProcessEnv;
+}
+/** Read-only preflight: never binds identities, starts a harness or edits its ledger. */
+export declare function waitForRoleDaemon(name: string, configPath?: string, partial?: Partial<ReadinessDeps>): Promise<void>;
+export {};

package/dist/startup-readiness.js

@@ -0,0 +1,38 @@
+import { agentDir } from './paths.js';
+import { findRole, loadConfig } from './config.js';
+import { resolveConfigPath } from './runner.js';
+import { probeDaemonGeneration } from './daemon-recovery.js';
+export const STARTUP_WAIT_MS = 240_000;
+export const STARTUP_RETRY_MS = 5_000;
+/** Read-only preflight: never binds identities, starts a harness or edits its ledger. */
+export async function waitForRoleDaemon(name, configPath, partial = {}) {
+    const deps = {
+        probe: env => probeDaemonGeneration(((url, init) => globalThis.fetch(url, {
+            ...init, signal: AbortSignal.timeout(10_000),
+        })), env),
+        now: Date.now,
+        sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+        log: message => process.stderr.write(message + '\n'),
+        env: process.env,
+        ...partial,
+    };
+    const path = resolveConfigPath(agentDir(name), configPath);
+    const role = findRole(loadConfig(path), name);
+    const env = { ...deps.env, ...role.env };
+    const deadline = deps.now() + STARTUP_WAIT_MS;
+    let lastReason = '';
+    while (deps.now() < deadline) {
+        const result = await deps.probe(env);
+        if (result.state === 'ready') {
+            deps.log(`[${name}] daemon ready; starting supervised agent`);
+            return;
+        }
+        // Only structured diagnostic codes, never endpoint responses or credentials.
+        const reason = /^[A-Z][A-Z0-9_]*$/.test(result.reason) ? result.reason : 'DAEMON_UNAVAILABLE';
+        if (reason !== lastReason)
+            deps.log(`[${name}] waiting for configured daemon: ${reason}`);
+        lastReason = reason;
+        await deps.sleep(Math.min(STARTUP_RETRY_MS, Math.max(0, deadline - deps.now())));
+    }
+    throw new Error(`Daemon not ready (${lastReason}); service manager will retry startup`);
+}

package/dist/supervisor/launchd.js

@@ -14,8 +14,15 @@ const LAST_EXIT_RE = /^\s*last exit (?:code|status|reason)\s*=\s*(.+?)\s*$/mi;
 const STATE_RE = /^\s*state\s*=\s*(.+?)\s*$/m;
 const agentsDir = () => join(home(), 'Library', 'LaunchAgents');
 const plistPath = (name) => join(agentsDir(), `${labelFor(name)}.plist`);
+const xml = (value) => value
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&apos;');
 function plist(name, binPath) {
     const log = join(logsRoot(), `${name}.log`);
+    const config = process.env.OURS_CONFIG;
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -23,7 +30,7 @@ function plist(name, binPath) {
   <key>Label</key><string>${labelFor(name)}</string>
   <key>ProgramArguments</key>
   <array><string>${binPath}</string><string>_run</string><string>${name}</string></array>
-  <!-- The runner owns the child-session restart loop. launchd must only
+${config ? `  <key>EnvironmentVariables</key><dict><key>OURS_CONFIG</key><string>${xml(config)}</string></dict>\n` : ''}  <!-- The runner owns the child-session restart loop. launchd must only
        recover the runner PROCESS crashing: a bare KeepAlive would resume the
        uncounted relaunch loop and restart a deliberately held-down agent. -->
   <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>

package/dist/supervisor/systemd.js

@@ -100,10 +100,15 @@ export function makeSystemdBackend(exec = realExec) {
             writeFileSync(join(unitDir, UNIT_TEMPLATE), `[Unit]
 Description=ours-fleet agent %i
 After=default.target
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 ${environmentLines}
+# Wait outside the runner so boot-time daemon unavailability cannot consume
+# the agent crash budget. Selection comes from the same role and profile.
+ExecStartPre=${unitArg(process.execPath)} ${unitArg(binPath)} _wait-daemon %i
+TimeoutStartSec=270
 ExecStart=${unitArg(process.execPath)} ${unitArg(binPath)} _run %i
 # The RUNNER owns the child-session restart loop, with a counted, backed-off
 # circuit breaker. systemd must only recover the runner PROCESS crashing —

package/dist/temp-supervisor-recovery.d.ts

@@ -0,0 +1,3 @@
+export declare const TEMP_RECYCLE_EXIT = 75;
+/** Keep the service's main process alive while replacing a PID-scoped worker. */
+export declare function runTempSupervisor(name: string, entrypoint: string, initial?: () => Promise<void>): Promise<void>;

package/dist/temp-supervisor-recovery.js

@@ -0,0 +1,46 @@
+import { spawn } from 'node:child_process';
+import { runTemp, SupervisorRecycleRequiredError } from './runner.js';
+export const TEMP_RECYCLE_EXIT = 75;
+/** Keep the service's main process alive while replacing a PID-scoped worker. */
+export async function runTempSupervisor(name, entrypoint, initial = () => runTemp(name)) {
+    try {
+        await initial();
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof SupervisorRecycleRequiredError))
+            throw error;
+    }
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const child = spawn(process.execPath, [entrypoint, '_run-temp-worker', name], {
+            stdio: 'inherit',
+            env: process.env,
+        });
+        let stopping = false;
+        const term = () => {
+            stopping = true;
+            child.kill('SIGTERM');
+        }, interrupt = () => {
+            stopping = true;
+            child.kill('SIGINT');
+        };
+        process.on('SIGTERM', term);
+        process.on('SIGINT', interrupt);
+        let code;
+        try {
+            code = await new Promise((resolve, reject) => {
+                child.once('error', reject);
+                child.once('exit', resolve);
+            });
+        }
+        finally {
+            process.off('SIGTERM', term);
+            process.off('SIGINT', interrupt);
+        }
+        if (code === 0 || stopping)
+            return;
+        if (code !== TEMP_RECYCLE_EXIT)
+            throw Error(`Temporary supervisor replacement exited with ${code}`);
+    }
+    throw Error('Temporary supervisor recycle limit reached; identity retained for explicit recovery');
+}

package/dist/watchdog/briefing.js

@@ -5,22 +5,9 @@ import { formatDuration } from '../duration.js';
  * wasn't verified when configured, fall back to createTool on first run.
  */
 function bindSection(heading, wd, v, guarantee) {
-    const L = ['', heading];
-    L.push(`Call the **${v.bindTool}** tool with name "${wd.identity}" force=true (search the`);
-    L.push('deferred tool registry first if needed).');
-    if (guarantee === 'unverified') {
-        L.push(`- This identity was NOT verified when this watchdog was configured, so it may not`);
-        L.push(`  exist yet. If binding reports no such identity, call **${v.createTool}** name`);
-        L.push(`  "${wd.identity}" once to mint it on this first run, then you are bound. Re-binding`);
-        L.push('  your OWN identity is always allowed.');
-    }
-    else {
-        L.push(`- It was ${guarantee === 'created' ? 'created' : 'verified to exist'} when this`);
-        L.push('  watchdog was configured, so binding should succeed. If it unexpectedly reports no');
-        L.push(`  such identity, call **${v.createTool}** name "${wd.identity}" once and report the`);
-        L.push('  discrepancy — something removed it since.');
-    }
-    return L;
+    return ['', '## Assigned identity',
+        `Your supervisor has bound your identity **${wd.identity}**. The ours tools are ready.`,
+        'No identity setup or skill reading is required.'];
 }
 /**
  * Render a watchdog run's fixed contract (briefing.md-equivalent for a one-shot clean-context

package/dist/watchdog/run.js

@@ -1,3 +1,4 @@
+import { preparePermanentAssignment, releaseManagedAgent } from '../agent-ours/service.js';
 import { closeSync, existsSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { spawn as spawnChild } from 'node:child_process';
 import { join } from 'node:path';
@@ -7,8 +8,7 @@ import { acquireRunLock, formatRunId, pruneReports, releaseRunLock, writeReport
 import { generateNotifierBriefing, generateWatchdogBriefing } from './briefing.js';
 import { computeDigest, reconcileLedger, readLedger, writeLedger } from './alerts.js';
 import { applyRole } from '../ops.js';
-import { daemonIdentityInventoryProvisioner, ensureIdentity, } from '../creation.js';
-import { runOnce, START_STAGGER_FILE } from '../runner.js';
+import { runOnce, loadTempRole, START_STAGGER_FILE } from '../runner.js';
 import { agentDir, tmpRoot } from '../paths.js';
 import { loadConfig, ROLE_NAME_RE, } from '../config.js';
 import { getAdapter } from '../harness/registry.js';
@@ -53,6 +53,7 @@ async function killIfNeeded(reason, child, roleName, sleep) {
         if (reason === 'stable')
             await sleep(HARVEST_GRACE_MS);
         child.kill();
+        await child.exited;
     }
 }
 function defaultLaunchChild(binPath, roleName, runDir) {
@@ -139,7 +140,7 @@ export async function executeWatchdogRun(wd, deps) {
         rmSync(runDir, { recursive: true, force: true });
     let report;
     try {
-        const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityInventoryProvisioner(), deps.log);
+        const guarantee = { state: 'unverified' }; // The child supervisor provisions before its harness starts.
         const cfg = deps.cfg ?? loadConfig();
         const discovered = wd.watchExplicit
             ? []
@@ -272,7 +273,7 @@ export async function executeNotifierRun(wd, text, deps) {
         // A crashed previous run can leave the temp dir behind; start clean.
         if (existsSync(runDir))
             rmSync(runDir, { recursive: true, force: true });
-        const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityInventoryProvisioner(), deps.log);
+        const guarantee = { state: 'unverified' }; // The child supervisor provisions before its harness starts.
         const cfg = deps.cfg ?? loadConfig();
         const role = buildWatchdogRole(wd, cfg);
         const dir = applyRole(role, { temp: true, identityGuarantee: guarantee.state });
@@ -317,5 +318,18 @@ export async function executeNotifierRun(wd, text, deps) {
 }
 /** What `_run-watchdog` calls: one supervised session, no cleanup — the parent harvests. */
 export async function runWatchdogAgent(name) {
-    await runOnce(name, { temp: true });
+    const role = loadTempRole(name);
+    await preparePermanentAssignment(role);
+    let stopping = false;
+    const stop = () => { stopping = true; };
+    process.on('SIGTERM', stop);
+    process.on('SIGINT', stop);
+    try {
+        await runOnce(name, { temp: true, identityLifetime: 'permanent' }, { shouldStop: () => stopping });
+    }
+    finally {
+        process.off('SIGTERM', stop);
+        process.off('SIGINT', stop);
+        await releaseManagedAgent(role);
+    }
 }

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
 import type { FleetQueryService } from '../application/fleet-query-service.js';
 import type { RoleRepository } from '../application/role-repository.js';
@@ -31,6 +32,7 @@ export interface WebServices {
     topologyPromote?: TopologyPromoteService;
     removal?: RoleRemovalService;
     taskRooms?: TaskRoomApplicationService;
+    oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
 }
 export interface WebServer {
     app: FastifyInstance;

package/dist/web/server.js

@@ -1,3 +1,4 @@
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -51,7 +52,11 @@ export async function buildWebServer(services, boundary, options = {}) {
         }
     });
     app.setErrorHandler(async (error, request, reply) => {
-        const fleetError = normalizeError(error, request.id);
+        const privateToolParseError = request.routeOptions.url === '/api/v1/roles/:id/ours/call'
+            && error instanceof Error && 'code' in error
+            && typeof error.code === 'string' && error.code.startsWith('FST_ERR_CTP_');
+        const fleetError = normalizeError(privateToolParseError
+            ? new FleetError('invalid_request', 'expected a valid JSON tool request') : error, request.id);
         await audit.record({
             requestId: request.id, action: `${request.method} ${request.routeOptions.url ?? request.url}`,
             result: 'rejected', errorCode: fleetError.code,
@@ -311,6 +316,18 @@ export async function buildWebServer(services, boundary, options = {}) {
         });
         return result;
     });
+    const oursTools = services.oursTools ?? new SupervisorOursTools();
+    app.get('/api/v1/roles/:id/ours/tools', async (request) => {
+        auth.authenticate(request);
+        return oursTools.list(request.params.id);
+    });
+    app.post('/api/v1/roles/:id/ours/call', async (request) => {
+        const session = auth.authenticate(request, true);
+        const result = await oursTools.call(request.params.id, request.body);
+        await audit.record({ requestId: request.id, browser: session.id,
+            action: 'ours.call', result: result.result.isError === true ? 'tool_error' : 'succeeded' });
+        return result;
+    });
     app.get('/api/v1/roles/:id', async (request) => {
         auth.authenticate(request);
         return services.query.detail(request.params.id);

package/docs/task-workspaces.md

@@ -0,0 +1,98 @@
+# Task workspaces and artifact retention
+
+New Tasks allocate a private workspace at
+`$OURS_FLEET_HOME/.ours-fleet/workspaces/tasks/<task-id>` (the user's home is the
+default for `OURS_FLEET_HOME`). New standalone Rooms use
+`.ours-fleet/workspaces/rooms/<room-id>`. A linked Room shares its Task's workspace.
+The absolute path, owner kind/ID and random ownership token are stored in the
+record before directory allocation; `.fleet-workspace.json` proves ownership.
+The path is visible in Task/Room JSON from both CLI and API. A folder of the same
+name without the matching marker is never adopted.
+
+Every newly managed member starts at that exact workspace, including retries.
+An explicit template/member `cwd` remains in the sealed input execution plan as
+source context, but the owned workspace overrides the effective launch cwd.
+Copy or clone required source into the workspace; Fleet does not move or delete
+the configured source directory. Briefings explain this rule. Use separate
+per-agent branches/directories inside the workspace for concurrent edits.
+
+All execution artifacts, dependency checkouts and worktrees belong inside the
+workspace. Clone each repository there first, then use `git worktree add` with
+destinations inside the same workspace. Git's native worktree registry is the
+registry of record. Fleet audits `.git`, `commondir` and reverse `gitdir` links
+before deletion; both the common repository and all registered worktrees must
+be inside the workspace. An external repository's worktree inside the workspace,
+or an internal repository's worktree outside it, blocks deletion. No broad
+`git worktree prune`, branch deletion, reset or modification of unrelated Git
+metadata is performed. Removing the owned repositories also removes their
+complete internal worktree registries, including dirty and stale owned entries.
+
+| Operation | Workspace and execution artifacts | Member runtime evidence |
+| --- | --- | --- |
+| Complete, fail, cancel | Retained while Task is recorded | Retained in Fleet recovery archives |
+| Linked Room retirement or deletion | Task workspace retained | Retained |
+| Internal standalone Room retirement | Room workspace retained | Retained |
+| Explicit Task deletion | Removed after member retirement | All proven owned retired launches removed |
+| Explicit standalone Room deletion | Removed after member retirement | All proven owned retired launches removed |
+
+Internal room close means retirement, not destructive Task deletion.
+The existing CLI `room close ID ID` remains a deprecated alias for explicit
+`room delete ID ID`: it deletes standalone room-owned artifacts, but always
+retains a linked Task workspace. Its repeated-ID confirmation is unchanged. To remove a Task's
+artifacts, explicitly delete the Task. Cancellation is not deletion. Automatic
+compatibility cleanup of legacy closed Rooms skips records with owned workspaces.
+These choices reconcile close/remove wording with the requirement that completed,
+recorded Tasks retain all artifacts.
+
+Fleet's active member state (briefings, logs, session state and WORKLOG) remains
+under `.ours-fleet/tmp` while supervisors run, then in
+`.ours-fleet/recovery/temporary`. The launch stores the workspace descriptor.
+Explicit deletion first proves managed agents retired, then identifies all
+matching archived launches, including failed and replaced attempts, using the
+workspace descriptor plus role and termination/launch evidence. It preflights
+these archives and atomically transfers them to `.fleet-retired-agents` in the
+workspace before removal. Unrelated archives are not adopted by a name prefix.
+Fleet audit receipts, creation/termination journals and shared infrastructure
+logs are audit metadata and intentionally outlive Task artifact deletion.
+
+Provisioning serializes Task operation then Room close locks, including bounded
+seat waits, so concurrent retries cannot publish competing members and deletion
+cannot race a member launch. Local published Rooms are reused if the Task link
+write was interrupted. Workspace allocation publishes a marked staging directory;
+restart reuses the durable token. Deletion renames the validated workspace to a
+token-specific sibling tombstone before removal. A crash during removal resumes
+that exact tombstone; the Task record is unlinked last. Before collecting archives,
+Task deletion durably checkpoints verified retirement evidence. Retries verify
+any remaining original archive and still refuse replacement live member state
+or a recreated identity even after the archive has been consumed. Failed deletion
+remains retryable with its recorded error.
+
+Deletion rejects traversal, foreign recorded paths, changed markers and symlinked
+workspace ancestors. Ordinary artifact symlinks are unlinked without following
+their targets. Git control symlinks and foreign pointers are refused. As with
+Fleet's other filesystem lifecycle operations, a hostile same-UID process that
+mutates paths during validation requires OS isolation; application checks are
+not a security boundary against that process. Fleet enforces launch cwd and
+safe deletion; unrestricted agents can still write outside cwd, so the artifact
+placement rule also requires agent compliance and/or filesystem isolation.
+
+## Compatibility and limits
+
+Records from before this feature without `workspace` remain unmanaged. Existing
+agents retain their cwd and exact briefing/fingerprint so restart matching works.
+Fleet never claims an old cwd, an outcome artifact path, or a legacy recovery
+archive as owned merely because it was mentioned by a Task. Create a new managed
+Task and explicitly copy desired artifacts to migrate; deleting a legacy Task
+continues its previous lifecycle and does not delete arbitrary old files.
+
+Changing `OURS_FLEET_HOME` does not silently rebase recorded absolute ownership
+paths. Restore the original state root or explicitly migrate records and files
+with the supervisors stopped; mismatched paths fail closed. Archive transfer
+uses same-filesystem rename and reports a recoverable failure across mounts.
+
+Cowork's remote create operation has no idempotency key in this interface. A crash
+after remote creation but before local Room publication is an existing uncertain
+remote result; this change deduplicates locally recorded rooms and does not claim
+to solve that remote transaction window. Inspect remote room ownership before
+retrying ambiguous remote creation. No services or installed Fleet code are
+changed by building or testing this feature.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.1.5",
+  "version": "1.2.0-nightly.10",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -18,6 +18,7 @@
     "examples",
     "presets",
     "README.md",
+    "docs/task-workspaces.md",
     "LICENSE"
   ],
   "engines": {
@@ -34,14 +35,16 @@
     "test:e2e": "npm run build && playwright test",
     "dev:web": "vite",
     "prepack": "npm run build",
-    "prepublishOnly": "npm run build && npm test"
+    "prepublishOnly": "npm run build && npm test",
+    "test:v1-recovery": "node test/fleet-v1-recovery.integration.mjs retry && node test/fleet-v1-recovery.integration.mjs terminal-after-failure && node test/fleet-v1-recovery.integration.mjs terminal-release-failure"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "1.0.1",
-    "@ours.network/sdk": "3.7.0",
+    "@ours.network/cli": "2.8.1-nightly.9",
+    "@ours.network/mcp": "1.2.0-nightly.7",
+    "@ours.network/sdk": "3.8.1-nightly.11",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "react": "^19.1.1",
@@ -55,6 +58,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
+    "@ours.network/daemon": "3.8.1-nightly.3",
     "@playwright/test": "^1.54.1",
     "@types/node": "^20.14.0",
     "@types/react": "^19.1.9",

package/presets/fleet/roles/Coordinator.yaml

@@ -12,6 +12,28 @@ persona: |
   Only execute task work yourself when the owner explicitly orders you to override this boundary
   for that specific task.
 
+  Agent identity and contact management requested by the owner is Fleet management work.
+  For requests such as "generate an invite for this agent", "accept this invite for that agent",
+  "list its contacts", or "send this message as that agent", select the named agent and call the
+  corresponding deterministic supervisor operation through the Fleet CLI or REST API. The
+  supervisor owns and binds that agent's identity; verify that the selected agent and returned
+  identity match the owner's request. Use the shared supervisor tool interface for these
+  operations, including generate_invite, add_contact, list_contacts, and send_message.
+  Discover schemas with `ours-fleet ours tools <agent>`; invoke with
+  `ours-fleet ours call <agent> <tool> --args-file <private-json-file>` (omit the file for {}).
+  REST equivalents are GET `/api/v1/roles/<agent>/ours/tools` and POST
+  `/api/v1/roles/<agent>/ours/call` with body {"tool":"<tool>","arguments":{...}}.
+  Use the normal authenticated Fleet session and CSRF token for REST calls.
+  Do not ask the agent in its conversation to perform these operations, send the invite to its
+  LLM session, or use session steering as an identity-management API. Do not create a separate
+  identity, choose or rebind an identity, force a binding, or restart a supervisor to perform a
+  contact operation. If the supported supervisor operation is unavailable or identity matching
+  fails, report that exact blocker and retain the request without attempting a substitute path.
+  Keep invite inputs in the supported private-file or request-body channel, out of logs and
+  unrelated rooms. Report the operation's actual result: accepting an invite may leave contact
+  verification pending, so do not claim that contact establishment or message delivery is complete
+  until the corresponding result confirms it.
+
   For every new task:
   1. Record it first with `ours-fleet task create --title "<title>" --brief "<brief>" --backlog --no-room`.
   2. Ask the owner which room template to use: `single`, `pair`, or `team`.