@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.20

package/README.md

@@ -52,11 +52,10 @@ briefing.md per role  ──►  agent session adapter  ──►  native app-se
 ```
 
 Each role gets a state dir (`~/.ours-fleet/agents/<Name>/`) holding its briefing,
-logs, routines, and session markers. On boot the agent reads its briefing: bind
-identity, publish bio/persona, announce to its coordinator, work — while the
+logs, routines, and session markers. Before boot, the supervisor binds the assigned identity and prepares its room.
+The agent then reads its briefing and starts work — while the
 supervisor delivers its mail wakes as `[fleet-monitor]` console lines (see
-[Mail monitor](#mail-monitor)). Set `monitor.mode: native` when the harness
-should own mail wake instead. On crash the supervisor relaunches it and the
+[Mail monitor](#mail-monitor)). Managed ours sessions use supervisor-owned mail wakes. On crash the supervisor relaunches it and the
 harness resumes the same session.
 
 The state dir contract:
@@ -80,7 +79,7 @@ The state dir contract:
 |---|---|---|
 | Node ≥ 22 | runs `ours-fleet` and its maintained adapters | nodejs.org, `apt`, or `brew` |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `ours-install client --config /absolute/private/profile.json --integrations fleet --fleet-settings /absolute/fleet-settings.json` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -140,7 +139,11 @@ the caller's owner channel with the caller and spawned-role details. This is an
 honest-actor convenience and attribution path, not a security boundary; host
 shells and deliberately bypassed absolute binaries retain direct behavior.
 
-## Local web console
+## Local web API
+
+Frontend source and builds are maintained in the standalone `ours-web` repository. Fleet builds only its backend API. Configure a separately built frontend static root when serving the unified application through the gateway. The former console source is preserved there under `legacy-fleet/`.
+
+### Console API usage
 
 The interactive console is packaged with `@ours.network/fleet` and binds to
 IPv4 loopback by default. Remote or proxy exposure is always explicit:
@@ -231,15 +234,11 @@ from the current runner generation and excludes adapter `session/load` replay;
 those replay events remain in the durable ledger with `agent_replay` provenance
 for diagnosis and recovery rather than appearing as current work.
 
-For every temporary role, the first-boot instructions call ours MCP
-`create_temporary_identity` with the exact assigned name, so the new identity
-is owned and cleaned up by that connector session lifecycle. Temporary roles
-never bind pre-existing identities or fall back to permanent `create_identity`.
-Fleet does not inspect, preserve, or provision an ours identity for temp spawn.
-A collision, missing tool, or creation error stops for operator review; fleet
-never force-adopts or deletes identity state. Permanent roles are
-provisioned by fleet before launch and never delegate normal identity creation
-to the harness.
+The Fleet supervisor creates and binds the assigned identity before the harness
+starts. Temporary identities survive harness reconnects and are released only when
+the logical run ends. Permanent identities remain available after the supervisor
+releases ownership. Agents receive ready tools; no model-owned identity bootstrap
+or onboarding skill is required.
 
 The web console uses structured ACP activity rather than exposing a raw agent terminal.
 
@@ -381,9 +380,9 @@ preserve at most one recent late occurrence. The trusted authoring file and
 private sealed role snapshot retain exact prompt text; resolved launch, task,
 room, provenance, and audit presentation surfaces show only bytes and SHA-256.
 
-Every packaged `Developer`, `Critic`, and `LocalCoordinator` Agent Template uses
+Every packaged `Developer`, `Engineer`, `Critic`, and `LocalCoordinator` Agent Template uses
 `monitor.mode: fleet` with `monitor.interrupt: after_tool`. Consequently every
-member of the standard `single`, `pair`, and `team` Room Templates resolves to
+member of the standard `single`, `pair`, `team`, and `engineering` Room Templates resolves to
 that policy. A custom Agent Template or explicit per-member override remains
 authoritative and is merged key by key without rewriting unrelated values.
 
@@ -529,7 +528,7 @@ ours-fleet up
 
 ### Rooms and tasks
 
-Init installs editable `single`, `pair`, and `team` definitions under
+Init installs editable `single`, `pair`, `team`, and `engineering` definitions under
 `~/fleet/room_templates/`, plus every exact-cased Agent, Role, and Brain they
 reference. Inspect them with `ours-fleet template list` and
 `ours-fleet template show team`. After configuring the authenticated owner below:
@@ -538,8 +537,25 @@ reference. Inspect them with `ours-fleet template list` and
 ours-fleet task create --title "Solo task" --template single
 ours-fleet task create --title "Reviewed change" --template pair
 ours-fleet task create --title "Phased delivery" --template team
+ours-fleet task create --title "Gated feature build" --template engineering
 ```
 
+`engineering` pairs a gate-pipeline `Engineer` with the standard `Critic`. The
+Engineer works every non-trivial task through ordered gates — scope and a numbered
+Definition of Done before code, an over-engineering check, spec before
+implementation, test-first, review, a sized security pass, docs, and evidence-backed
+DoD verification — invoking an installed gate-pipeline skill when one is present and
+walking the same gates by hand otherwise. The seat is labelled `Engineer`, so a
+gated seat is never mistaken for a plain `Developer`. To make it the default for
+development tasks, set `tasks: { default_room_template: engineering }` in
+`fleet.yaml`.
+
+The `engineering` starter expresses a prompt-level workflow mandate; Fleet does not enforce
+the gates at runtime or install pipeline skills. The Engineer label identifies that mandate,
+not a completed review. When migrating an existing install, a newly added Engineer uses
+the existing Developer template's brain selection and keeps the packaged restrictive permissions.
+Existing customized Engineer files are preserved.
+
 The default `team` gives only its LocalCoordinator Agent Template a 15-minute
 continuity loop. Each idle-only pass uses authenticated assigned-room evidence,
 posts at most one missing interval update or status request, and reports `STALLED`
@@ -593,8 +609,9 @@ non-owner-controlled parent fail closed before host setup and are rechecked unde
 per-setup init lock before publication.
 
 The generated task experiences are fixed consequences, not extra questions: `single`
-uses `Developer`; `pair` uses `Developer` with an independent `Critic`; and `team` uses
-task-local `LocalCoordinator`, `Developer`, and `Critic`. The persistent
+uses `Developer`; `pair` uses `Developer` with an independent `Critic`; `team` uses
+task-local `LocalCoordinator`, `Developer`, and `Critic`; and `engineering` uses the
+gate-pipeline `Engineer` with an independent `Critic`. The persistent
 `FleetCoordinator` uses the separate packaged `Coordinator` contract and coordination
 model.
 
@@ -649,10 +666,10 @@ originating task. Existing active rooms are not retroactively migrated, and room
 with Owner attachment disabled receive no Owner grant.
 
 Fleet launches each template member with a dedicated one-time Cowork invite.
-The generated temporary-agent briefing contains the exact identity name, invite,
-Cowork role, and task. The agent creates that identity itself with ours MCP
-`create_temporary_identity`, accepts the invite with `add_contact`, and starts
-work immediately. A room is ready only after the Cowork room (and its task, when
+The supervisor accepts the startup invite and verifies the provisioned identity CID
+in the authenticated room seat before starting the model. The generated briefing
+contains the assigned identity, room, role and task, without invite material.
+A room is ready only after the Cowork room (and its task, when
 task-bound) is durably active, every configured member seat is authenticated and active with its matching
 live Fleet launch, and the configured Owner seat is active when owner attachment is
 enabled. There is no briefing hash, startup ACK, or separate role-briefing readiness
@@ -671,12 +688,35 @@ continuation is serialized per Task and remains alive until convergence or an
 Owner-action blocker. Re-running `task start <id>` safely resumes the same durable
 provisioning operation after the blocker is corrected or a process restarts.
 
+Live health is distinct from durable lifecycle. `task show TASK --json` adds a
+`readiness` observation for active tasks (`ready`, `degraded`, or `unknown`); human
+and authenticated Owner task-show output display the same observation. Task start/work
+continue to reject unavailable health with `task_not_ready`. A same-role untracked
+seat or a changed recorded launch cannot satisfy an original slot. Each control,
+liveness, and production Cowork probe is bounded; members are checked sequentially,
+so total latency grows with room size. These are point-in-time observations, not
+proof that a timed-out session is dead or permission to respawn it.
+
+Before deliberate recovery, Fleet Coordinator must inspect existing room seats and
+the exact old launch's termination record and worklog under `recovery/temporary`.
+Keep original slot records and archives intact; record verified old/new identity
+and launch provenance privately. Never restore archived identity state or reuse
+consumed invites. A same-role seat is only a possible replacement, not proven ownership.
+
+A replacement's empty inbox does not establish that no work is pending. Paginate
+scoped room/operator history to the end, retain the cursor privately, authenticate
+historical Owner instructions from identity metadata, and compare replies, worklogs,
+and already-completed actions before resuming. Ask the Owner when authority or
+completion is uncertain. Transfer only necessary non-secret context; never replay
+instructions blindly. Observation does not adopt seats, launch replacements, change
+lifecycle, or modify retained recovery evidence.
+
 Set `room.anonymous: true` on a room template, or pass `--anonymous` to
 `task create`, `task start`, `task work`, or `room create`, to create an
 anonymous Cowork room. `--no-anonymous` explicitly overrides an anonymous
 template. Fleet records the resolved value before room creation so retries keep
-the same choice. Temporary members of an anonymous room are instructed to call
-`create_temporary_identity` with `expose_local=false`. Their generated briefings
+the same choice. The supervisor creates anonymous room members with local contact-book exposure
+disabled. Their generated briefings
 do not disclose or compare an Owner participant CID. A participant-originated
 instruction has Owner authority only when the authenticated Cowork room envelope
 attributes that participant seat the exact `Owner` role. Literal text, display
@@ -1353,8 +1393,9 @@ The command override is exact: Fleet does not append `--profile`, `--search`, or
 
 One-off/permanent spawn selects a Brain that owns model, reasoning, native permission,
 sandbox, profile, launcher, search, monitor consent, native config, and additional roots.
-Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
-role-specific ours daemon, or configure the host default in `~/.ours/config.json`.
+All roles use the shared gateway profile `~/.ours-client/profile.json`.
+`OURS_CONFIG` selects an alternate whole profile. Legacy port/token/state-dir
+overrides are rejected. See the [gateway setup guide](https://github.com/adapt-toolkit/ours-network/blob/prerelease/packages/installer/GATEWAY_SETUP.md).
 
 ## Agent isolation
 
@@ -1653,7 +1694,7 @@ After building Fleet with the selected SDK and CLI artifacts installed, run
 `npm run test:v1-recovery` in an isolated Docker container with external networking
 disabled. The existing test covers retry and terminal failure cases using a
 temporary daemon and no authenticated AI harness. By default both daemon and
-token-update commands use `node_modules/@ours.network/cli/dist/cli.js`;
+token-update commands use `node_modules/@ours.network/daemon/dist/cli.js`;
 `FLEET_DAEMON_CLI` and `FLEET_TOKEN_CLI` can select explicitly prepared CLI entries.
 These package checks do not replace native Fleet/harness or platform acceptance.
 
@@ -1697,3 +1738,85 @@ origin directly. UUID/capability checks still precede credential-bearing calls.
 This adds client HTTPS support, not an HTTPS daemon listener, certificate
 provisioning or automatic reverse-proxy configuration. Existing local HTTP and
 SSH-tunnel profiles continue to work.
+
+See [supervisor-owned ours and migration](docs/supervisor-ours.md) for the runtime contract and review build instructions.
+
+### One-server gateway profile
+
+A private client profile may include `serverUrl`, for example
+`https://ours.example/base`, together with `endpoint` set to
+`https://ours.example/base/daemon`, the existing `expectedInstanceId`, and the
+absolute private `credentialPath`. Fleet preserves that daemon prefix for doctor
+and monitoring and derives `/cowork/management/rpc` from `serverUrl` for room
+management. Requests use the issued server credential, reject redirects, have
+bounded bodies/deadlines, and never replay mutations. This capability is declared
+as `cowork.http-management-v1` in the built artifact.
+
+Explicit Cowork socket, config or state-directory overrides continue to select
+local Unix management. Profiles without `serverUrl` retain legacy behavior. The
+HTTP API grants operator room authority; use the installer's supported private
+or authenticated external gateway entry, and keep its backend ports private.
+
+### Agent ours tools through the supervisor
+
+Operators can invoke the running agent's ordinary ours MCP tools without sending
+an LLM prompt or binding another session to its identity:
+
+```sh
+ours-fleet ours tools Critic1
+ours-fleet ours call Critic1 current_identity
+ours-fleet ours call Critic1 list_contacts
+ours-fleet ours call Critic1 generate_invite --args-file /private/invite-options.json
+ours-fleet ours call Critic1 add_contact --args-file /private/contact.json
+```
+
+`tools` returns the managed MCP tool names and argument schemas, plus the selected
+agent's identity name, CID, and supervisor generation. `call` returns the same
+identity metadata and the MCP result. The private JSON file contains the tool's
+arguments (for example `{"invite":"…"}` for `add_contact`); omitted arguments mean
+`{}`. Protect files containing invites and protect command output containing a
+new invite. Tool errors set a nonzero CLI exit status.
+
+The authenticated REST equivalents are `GET /api/v1/roles/:id/ours/tools` and
+`POST /api/v1/roles/:id/ours/call`, with the normal Fleet session and CSRF token.
+The POST body is `{"tool":"list_contacts","arguments":{}}`. MCP tool errors
+remain in `result.isError`; transport failures use the normal Fleet error envelope.
+Request arguments and results are excluded from the Fleet audit log.
+
+Both interfaces use the supervisor's existing fixed-identity MCP server and tool
+policy. Identity creation, removal, switching, and binding are not exposed. The
+supervisor must be running. Older descriptors are supported only when a unique
+existing runtime journal, instance record, and identity pin prove the selected
+agent and generation, and the same MCP connection confirms its identity and
+lifetime before the operation. This reads existing state without rewriting the
+descriptor or restarting the agent. Missing, ambiguous, stale, or mismatched
+proofs fail closed. Unknown identity descriptions also fail closed. Closing an operator call
+retains the supervisor's identity. An interrupted mutation can have an unknown
+outcome: inspect state before retrying, because there is no automatic retry or
+exactly-once guarantee. Contact acceptance alone does not prove peer verification
+or message delivery. File tools resolve paths in the invoking CLI process or
+Fleet web server's filesystem context, with that process's access permissions.
+
+Task workspace ownership, retention, safe deletion and legacy migration are documented in [Task workspaces](docs/task-workspaces.md).
+
+### Active task readiness after interruption
+
+Task and room list states, and `taskProvisioningOutcome`, describe durable lifecycle
+and provisioning progress; they are not live health checks. Retrying `task start`
+or `task work` on an active task checks the current Cowork room identity and seats,
+member launch ownership, supervisor liveness, and authenticated session status
+before reporting success. Waiting for provisioning completion also checks live
+readiness. This is a point-in-time observation, not proof of an agent-authored reply.
+
+A `task_not_ready` result distinguishes confirmed degradation from unknown health
+(for example, an unavailable control socket). Ask Fleet Coordinator to inspect room
+and member status and choose supported recovery. These checks do not restart agents,
+recreate identities, redeem invites, or rewrite lifecycle state. Temporary room agents
+remain transient across host reboot; retained launch records do not restore them.
+
+See [predefined Brain models and runtime requirements](presets/README.md) for the verified model/effort matrix and regeneration instructions.
+
+### YAML room layouts
+
+Room layouts describe room composition with shared or fresh participant sessions and independent room closure.
+See [Room layouts](docs/room-layouts.md) for YAML examples and CLI commands.

package/dist/agent-ours/bridge.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+/** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
+export declare function runBridge(descriptorPath: string): Promise<void>;

package/dist/agent-ours/bridge.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { connect } from 'node:net';
+import { access, mkdir, open, readFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { MAX_CHUNK_BYTES, MAX_FRAME_BYTES, Wire } from './wire.js';
+/** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
+export async function runBridge(descriptorPath) {
+    const descriptor = JSON.parse(await readFile(descriptorPath, 'utf8'));
+    if (typeof descriptor.socket !== 'string' ||
+        typeof descriptor.capability !== 'string' ||
+        !Number.isInteger(descriptor.generation))
+        throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    if (process.env.FLEET_OURS_BRIDGE_EXPECTED) {
+        const expected = JSON.parse(process.env.FLEET_OURS_BRIDGE_EXPECTED);
+        const digest = createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex');
+        if (expected.transportDigest !== digest)
+            throw Error('SUPERVISOR_TRANSPORT_CHANGED');
+        if (['role', 'identity', 'cid', 'generation'].some(key => descriptor[key] !== expected[key]))
+            throw Error('SUPERVISOR_SELECTION_CHANGED');
+    }
+    const wire = new Wire(connect(descriptor.socket));
+    const handles = new Map();
+    const cleanup = async () => {
+        for (const row of handles.values())
+            await row.file.close().catch(() => { });
+        handles.clear();
+    };
+    let admitted = false;
+    let stdin = Buffer.alloc(0);
+    let chain = Promise.resolve();
+    const fail = () => {
+        wire.close();
+        process.stdin.pause();
+        void cleanup();
+    };
+    wire.onClose = fail;
+    wire.onFrame = (raw) => {
+        if (raw?.kind === 'ready') {
+            if (admitted)
+                throw Error('DUPLICATE_READY');
+            admitted = true;
+            process.stdin.resume();
+            return;
+        }
+        if (!admitted)
+            throw Error('BRIDGE_NOT_READY');
+        if (raw?.kind === 'mcp') {
+            const line = JSON.stringify(raw.value) + '\n';
+            if (!process.stdout.write(line)) {
+                wire.socket.pause();
+                process.stdout.once('drain', () => wire.socket.resume());
+            }
+            return;
+        }
+        if (raw?.kind !== 'fs' || typeof raw.id !== 'string' || typeof raw.call !== 'string')
+            throw Error('INVALID_BRIDGE_FRAME');
+        chain = chain
+            .then(async () => {
+            try {
+                const { op, args, call } = raw;
+                let value;
+                if (op === 'probe') {
+                    try {
+                        await access(args.path, constants.R_OK);
+                        value = true;
+                    }
+                    catch {
+                        value = false;
+                    }
+                }
+                else if (op === 'read-open' || op === 'write-open') {
+                    if (handles.size >= 32 ||
+                        typeof args.handle !== 'string' ||
+                        handles.has(args.handle) ||
+                        typeof args.path !== 'string')
+                        throw Error('FILE_LIMIT');
+                    const path = resolve(args.path);
+                    if (op === 'write-open')
+                        await mkdir(dirname(path), { recursive: true });
+                    const file = await open(path, op === 'write-open' ? 'w' : 'r');
+                    handles.set(args.handle, { file, call, write: op === 'write-open' });
+                    value =
+                        op === 'write-open'
+                            ? path
+                            : { filename: basename(path), size: (await file.stat()).size };
+                }
+                else {
+                    const row = handles.get(args.handle);
+                    if (!row) {
+                        if (op === 'close') {
+                            value = null;
+                        }
+                        else
+                            throw Error('UNKNOWN_FILE_HANDLE');
+                    }
+                    else {
+                        if (row.call !== call)
+                            throw Error('FOREIGN_FILE_CALL');
+                        if (op === 'close') {
+                            handles.delete(args.handle);
+                            await row.file.close();
+                            value = null;
+                        }
+                        else if (op === 'read' && !row.write) {
+                            const buffer = Buffer.alloc(MAX_CHUNK_BYTES);
+                            const { bytesRead } = await row.file.read(buffer);
+                            value = bytesRead ? buffer.subarray(0, bytesRead).toString('base64') : null;
+                        }
+                        else if (op === 'write' && row.write) {
+                            if (typeof args.data !== 'string' ||
+                                args.data.length > Math.ceil(MAX_CHUNK_BYTES / 3) * 4)
+                                throw Error('FILE_CHUNK_LIMIT');
+                            const buffer = Buffer.from(args.data, 'base64');
+                            let offset = 0;
+                            while (offset < buffer.length) {
+                                const r = await row.file.write(buffer, offset, buffer.length - offset);
+                                if (!r.bytesWritten)
+                                    throw Error('SHORT_WRITE');
+                                offset += r.bytesWritten;
+                            }
+                            value = null;
+                        }
+                        else
+                            throw Error('INVALID_FILE_OPERATION');
+                    }
+                }
+                await wire.send({ kind: 'fs-result', id: raw.id, value });
+            }
+            catch {
+                await wire.send({ kind: 'fs-result', id: raw.id, error: 'FILE_OPERATION_FAILED' });
+            }
+        })
+            .catch(fail);
+    };
+    process.stdin.pause();
+    process.stdin.on('data', (chunk) => {
+        stdin = Buffer.concat([stdin, chunk]);
+        for (;;) {
+            const end = stdin.indexOf(10);
+            if (end < 0) {
+                if (stdin.length > MAX_FRAME_BYTES)
+                    fail();
+                return;
+            }
+            if (end > MAX_FRAME_BYTES) {
+                fail();
+                return;
+            }
+            const line = stdin.subarray(0, end);
+            stdin = stdin.subarray(end + 1);
+            try {
+                const value = JSON.parse(line.toString('utf8'));
+                process.stdin.pause();
+                void wire.send({ kind: 'mcp', value }).then(() => process.stdin.resume(), fail);
+            }
+            catch {
+                fail();
+                return;
+            }
+        }
+    });
+    process.stdin.on('end', fail);
+    process.stdout.on('error', fail);
+    await wire.send({
+        kind: 'hello',
+        capability: descriptor.capability,
+        generation: descriptor.generation,
+    });
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    runBridge(process.env.FLEET_OURS_BRIDGE_DESCRIPTOR ?? '').catch(() => {
+        process.stderr.write('Fleet ours bridge unavailable\n');
+        process.exitCode = 1;
+    });
+}

package/dist/agent-ours/controller.d.ts

@@ -0,0 +1,14 @@
+import { RuntimeJournal } from './state.js';
+/** Reuse Fleet's process-lifetime binder to serialize startup and cleanup. */
+export declare class RuntimeController {
+    private readonly lease;
+    readonly privateDir: string;
+    readonly journal: RuntimeJournal;
+    private active;
+    private constructor();
+    static acquire(root: string, daemon: string, name: string, instance: string): Promise<RuntimeController>;
+    assertFence: () => void;
+    successor(): string;
+    resumeGeneration(): number;
+    unlock(): void;
+}

package/dist/agent-ours/controller.js

@@ -0,0 +1,60 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { acquireOwnerBinderLease } from '../owner-channel/binder.js';
+import { binderKey, RuntimeJournal } from './state.js';
+/** Reuse Fleet's process-lifetime binder to serialize startup and cleanup. */
+export class RuntimeController {
+    lease;
+    privateDir;
+    journal;
+    active = true;
+    constructor(lease, privateDir) {
+        this.lease = lease;
+        this.privateDir = privateDir;
+        this.journal = new RuntimeJournal(privateDir);
+    }
+    static async acquire(root, daemon, name, instance) {
+        const dir = join(root, binderKey(daemon, name));
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const lease = await acquireOwnerBinderLease(dir, 'agent-ours', name);
+        const controller = new RuntimeController(lease, dir);
+        if (controller.journal.read()?.instance && controller.journal.read().instance !== instance) {
+            lease.release();
+            throw Error('RUNTIME_INSTANCE_MISMATCH');
+        }
+        return controller;
+    }
+    assertFence = () => {
+        if (!this.active)
+            throw Error('STALE_RUNTIME_CONTROLLER');
+    };
+    successor() {
+        this.assertFence();
+        const state = this.journal.read();
+        if (state?.phase !== 'RELEASED')
+            throw Error('PREDECESSOR_NOT_RELEASED');
+        const archive = join(this.privateDir, `retired-${state.instance}`);
+        mkdirSync(archive, { mode: 0o700 });
+        for (const file of ['state.json', 'owner.json', 'instance.json'])
+            renameSync(join(this.privateDir, file), join(archive, file));
+        return randomUUID();
+    }
+    resumeGeneration() {
+        this.assertFence();
+        const s = this.journal.read();
+        if (!s)
+            return 1;
+        if (['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED'].includes(s.phase))
+            throw Error('RUNTIME_RETIRED_OR_FAILED');
+        if (!s.cid)
+            throw Error('UNCERTAIN_PROVISIONING');
+        this.journal.commit({ ...s, generation: s.generation + 1, phase: 'RECOVERING' }, s.revision);
+        return s.generation + 1;
+    }
+    unlock() {
+        this.assertFence();
+        this.lease.release();
+        this.active = false;
+    }
+}

package/dist/agent-ours/correspondence.d.ts

@@ -0,0 +1,10 @@
+/** Read-only operations exposed by the identity-owning supervisor. */
+export interface AgentHistoryQuery {
+    peer_cid: string;
+    limit?: number;
+    before_seq?: number;
+}
+export interface SupervisorCorrespondence {
+    contacts(): Promise<unknown>;
+    history(request: AgentHistoryQuery): Promise<unknown>;
+}

package/dist/agent-ours/correspondence.js

@@ -0,0 +1 @@
+export {};

package/dist/agent-ours/file-rpc.d.ts

@@ -0,0 +1,23 @@
+import type { FileExecutionContext } from '@ours.network/mcp/server';
+import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
+import { type Wire } from './wire.js';
+/** Call-scoped callbacks carry no daemon credentials or upload receipts. */
+export declare class FileCallbacks implements FileExecutionContext {
+    private readonly wire;
+    private pending;
+    constructor(wire: Wire);
+    receive(frame: any): void;
+    close(): void;
+    private rpc;
+    canRead(path: string, extra: ToolRequestExtra): Promise<boolean>;
+    read(path: string, extra: ToolRequestExtra): Promise<{
+        filename: any;
+        size: any;
+        body: ReadableStream<Uint8Array<ArrayBufferLike>>;
+        close: () => Promise<void>;
+    }>;
+    write(path: string, body: ReadableStream<Uint8Array>, extra: ToolRequestExtra): Promise<{
+        path: string;
+        size: number;
+    }>;
+}