@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.20

package/dist/init-wizard.js

@@ -7,13 +7,18 @@ import { packagedPresetRoot } from './preset-bootstrap.js';
 import { listTemplates } from './rooms-tasks/templates.js';
 const WORK_KINDS = ['development', 'review', 'coordination'];
 const ROLE_WORK = {
-    Developer: 'development', Critic: 'review',
+    Developer: 'development', Engineer: 'development', Critic: 'review',
     LocalCoordinator: 'coordination', Coordinator: 'coordination', FleetCoordinator: 'coordination',
 };
 const REASONING_EFFORT = {
     quick: 'low', balanced: 'medium', thorough: 'high',
 };
 const MODEL_LABELS = {
+    'gpt-6-sol': 'GPT-6 Sol',
+    'gpt-6-luna': 'GPT-6 Luna',
+    'claude-fable-5-1': 'Claude Fable 5.1',
+    'claude-opus-5-5': 'Claude Opus 5.5',
+    'claude-haiku-4-5-20251001': 'Claude Haiku 4.5',
     'gpt-6-astra': 'GPT-6 Astra',
     'gpt-5.6-sol': 'GPT-5.6 Sol',
     'gpt-5.6-terra': 'GPT-5.6 Terra',
@@ -33,10 +38,10 @@ export function validateCatalog(value, path = 'supported model catalog') {
     for (const model of value.models) {
         if (!['codex', 'claude-code'].includes(model.harness) || model.session !== 'acp'
             || typeof model.model !== 'string' || !MODEL_LABELS[model.model]
-            || !Array.isArray(model.efforts) || model.efforts.length === 0
+            || !Array.isArray(model.efforts)
             || new Set(model.efforts).size !== model.efforts.length
             || model.efforts.some(effort => !['low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(effort))
-            || !['low', 'medium', 'high'].every(effort => model.efforts.includes(effort)))
+            || (model.efforts.length > 0 && !['low', 'medium', 'high'].every(effort => model.efforts.includes(effort))))
             throw new Error(`unsupported model state in ${path}`);
         const tuple = `${model.harness}\0${model.session}\0${model.model}`;
         if (tuples.has(tuple))
@@ -90,7 +95,9 @@ export async function askInitQuestions(prompter, configuration) {
         return undefined;
     if (subscriptions.length === 0)
         throw new Error('Select at least one subscription.');
-    const available = catalog().models.filter(model => subscriptions.includes(subscriptionFor(model)));
+    // The wizard assigns low/medium/high; no-effort models remain available as named presets.
+    const available = catalog().models.filter(model => subscriptions.includes(subscriptionFor(model))
+        && model.efforts.length > 0);
     if (!available.length)
         throw new Error('None of the selected subscriptions has a supported model.');
     prompter.note([
@@ -163,6 +170,7 @@ export function formatSetupSummary(answers, configuration) {
         '  One-agent work: one Developer',
         '  Reviewed pair: Developer + independent Critic',
         '  Team: LocalCoordinator + Developer + Critic',
+        '  Gated engineering: Engineer (gate pipeline) + independent Critic',
         '  FleetCoordinator: coordination model',
         '',
         'After the final Yes, Fleet performs host service setup before publishing the complete configuration.',
@@ -221,7 +229,7 @@ export function generateSetup(answers) {
         if (tuples.size !== 1)
             throw new Error('one-model assignment requires the same exact model for development, review, and coordination');
     }
-    for (const role of ['Coordinator', 'LocalCoordinator', 'Developer', 'Critic']) {
+    for (const role of ['Coordinator', 'LocalCoordinator', 'Developer', 'Engineer', 'Critic']) {
         files.set(`roles/${role}.yaml`, preset(`roles/${role}.yaml`));
         if (role === 'Coordinator')
             continue;
@@ -236,8 +244,10 @@ export function generateSetup(answers) {
     }
     files.set('agents/FleetCoordinator.yaml', preset('agents/FleetCoordinator.yaml')
         .replace('brain: { ref: claude-default }', 'brain: { ref: coordination }'));
-    for (const name of ['single', 'pair', 'team'])
+    for (const name of ['single', 'pair', 'team', 'engineering']) {
         files.set(`room_templates/${name}.yaml`, preset(`room_templates/${name}.yaml`));
+        files.set(`room_layouts/${name}.yaml`, preset(`room_layouts/${name}.yaml`));
+    }
     return { files, answers };
 }
 /** Run the mutation boundary only after the complete questionnaire is accepted. */
@@ -385,7 +395,7 @@ function writeStaged(stageManifest, setup) {
         replaceFileAtomically(target, contents, 0o600);
         fsyncPath(target);
     }
-    for (const kind of ['agents', 'agent_templates', 'roles', 'brains', 'room_templates'])
+    for (const kind of ['agents', 'agent_templates', 'roles', 'brains', 'room_templates', 'room_layouts'])
         fsyncPath(join(stageRoot, kind));
     fsyncPath(stageRoot);
     fsyncPath(dirname(stageManifest));
@@ -394,8 +404,8 @@ function validateStaged(stageManifest) {
     const config = loadConfig(stageManifest, { yamlMode: 'strict' });
     const templates = listTemplates(config.roomTemplates ?? {});
     const names = new Set(templates.map(template => template.name));
-    if (!['pair', 'single', 'team'].every(name => names.has(name)))
-        throw new Error('generated setup did not resolve the default single, pair, and team experiences');
+    if (!['pair', 'single', 'team', 'engineering'].every(name => names.has(name)))
+        throw new Error('generated setup did not resolve the default single, pair, team, and engineering experiences');
     for (const template of templates)
         for (const member of template.members)
             if (!config.agentTemplates?.[member.agent_template])

package/dist/monitor.d.ts

@@ -88,33 +88,6 @@ export interface MonitorDeps {
  * turns they trigger keep dying.
  */
 export type StatusCause = 'connectivity' | 'delivery' | 'modal' | 'offline' | 'turns-failing' | 'safe-boundary' | 'auth';
-/** Best-effort daemon config (issue #17): the fields the MCP client reads. */
-interface DaemonConfig {
-    apiToken?: string;
-    port?: number;
-    stateDir?: string;
-}
-/**
- * Read the daemon config the way the MCP client does — best-effort. Any missing,
- * malformed, or unreadable config yields `{}` so token resolution falls through
- * (issue #17). Only the well-typed fields we consume are surfaced.
- */
-export declare function readDaemonConfig(env: NodeJS.ProcessEnv): DaemonConfig;
-/**
- * Resolve the daemon API token exactly like the MCP client (issue #17), a 3-step
- * chain: `OURS_API_TOKEN` (trimmed) → config `apiToken` (trimmed) → the 0600 owner
- * token at `<stateDir>/daemon-token`. Never generates a token; a failed read of
- * any source (missing/unreadable) silently falls through to the next.
- */
-export declare function resolveApiToken(env: NodeJS.ProcessEnv, file?: DaemonConfig): string | undefined;
-export interface DaemonEndpoint {
-    origin: string;
-    port: number;
-    configPath: string;
-    stateDir: string;
-    url(name: string): string;
-    headers: Record<string, string>;
-}
 export type IdentityPresence = {
     state: 'present';
     temporary: boolean;
@@ -125,16 +98,12 @@ export type IdentityPresence = {
     state: 'unknown';
     detail: string;
 };
-/** Resolve the daemon endpoint + auth header from env → config → defaults. */
-export declare function resolveEndpoint(env: NodeJS.ProcessEnv, includeToken?: boolean): DaemonEndpoint;
 /**
  * Ask the daemon's authoritative identity index. The notifications endpoint is
  * intentionally unsuitable for lifecycle: it serves an empty 200 page for a
  * valid but missing identity, which made a closed temp identity look healthy.
  */
 export declare function probeIdentityPresence(name: string, fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: IdentityProbeDeps): Promise<IdentityPresence>;
-/** Actionable, secret-free description of every token source for this profile. */
-export declare function authResolutionHint(ep: DaemonEndpoint): string;
 /** Keep only the events whose type the role asked to wake on. */
 export declare function filterEvents(events: NotifyEvent[], wakeSources: string[]): NotifyEvent[];
 /**
@@ -196,8 +165,7 @@ export declare class Monitor {
     private readonly identity;
     private readonly cfg;
     private readonly deps;
-    private readonly ep?;
-    private readonly profile?;
+    private readonly profile;
     private readonly profileKey;
     private readonly monitorLeaseToken;
     private profileClientPromise?;
@@ -263,4 +231,3 @@ export declare class Monitor {
     private writeStatus;
 }
 export declare function createMonitor(o: MonitorOpts): Monitor;
-export {};

package/dist/monitor.js

@@ -1,6 +1,5 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { clientProfileKey, readClientProfile, } from './client-profile.js';
@@ -42,124 +41,28 @@ const TURN_OBSERVE_INTERVAL_MS = 1_500;
 const DEFAULT_TURN_FAIL_THRESHOLD = 3; // fallback when the resolved config omits it
 class AuthError extends Error {
 }
-/** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
-const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
-/** Preserve the daemon's legacy env integer semantics: parseInt, invalid → absent. */
-function envInt(env, name) {
-    const raw = env[name];
-    if (raw === undefined)
-        return undefined;
-    const n = parseInt(raw, 10);
-    return Number.isNaN(n) ? undefined : n;
-}
-/**
- * Read the daemon config the way the MCP client does — best-effort. Any missing,
- * malformed, or unreadable config yields `{}` so token resolution falls through
- * (issue #17). Only the well-typed fields we consume are surfaced.
- */
-export function readDaemonConfig(env) {
-    try {
-        const p = JSON.parse(readFileSync(daemonConfigPath(env), 'utf8'));
-        const o = {};
-        if (typeof p.apiToken === 'string' && p.apiToken.trim())
-            o.apiToken = p.apiToken.trim();
-        if (typeof p.port === 'number' && Number.isFinite(p.port))
-            o.port = p.port;
-        if (typeof p.stateDir === 'string')
-            o.stateDir = p.stateDir;
-        return o;
-    }
-    catch {
-        return {};
-    }
-}
-/**
- * Resolve the daemon API token exactly like the MCP client (issue #17), a 3-step
- * chain: `OURS_API_TOKEN` (trimmed) → config `apiToken` (trimmed) → the 0600 owner
- * token at `<stateDir>/daemon-token`. Never generates a token; a failed read of
- * any source (missing/unreadable) silently falls through to the next.
- */
-export function resolveApiToken(env, file = readDaemonConfig(env)) {
-    const e = env.OURS_API_TOKEN?.trim();
-    if (e)
-        return e;
-    if (file.apiToken)
-        return file.apiToken;
-    const sd = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
-    try {
-        const t = readFileSync(join(sd, 'daemon-token'), 'utf8').trim();
-        if (t)
-            return t;
-    }
-    catch { /* missing/unreadable (e.g. cross-user 0600) → fall through */ }
-    return undefined;
-}
-/** Resolve the daemon endpoint + auth header from env → config → defaults. */
-export function resolveEndpoint(env, includeToken = true) {
-    const file = readDaemonConfig(env);
-    const port = envInt(env, 'OURS_PORT') ?? file.port ?? DEFAULT_PORT;
-    const configPath = daemonConfigPath(env);
-    const stateDir = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
-    const token = includeToken ? resolveApiToken(env, file) : undefined;
-    const origin = `http://127.0.0.1:${port}`;
-    return {
-        origin,
-        port,
-        configPath,
-        stateDir,
-        url: (name) => `${origin}/identities/${encodeURIComponent(name)}/notifications`,
-        headers: token ? { 'x-ours-api-token': token } : {},
-    };
-}
 /**
  * Ask the daemon's authoritative identity index. The notifications endpoint is
  * intentionally unsuitable for lifecycle: it serves an empty 200 page for a
  * valid but missing identity, which made a closed temp identity look healthy.
  */
 export async function probeIdentityPresence(name, fetch, env, deps = {}) {
-    const profile = readClientProfile(env);
-    if (profile) {
-        let client;
-        try {
-            client = await (deps.attachClient?.({
-                endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
-                credentialPath: profile.credentialPath,
-                sessionMode: 'external', leaseToken: randomUUID(), env: {},
-            }) ?? attachOursClient({
-                endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
-                credentialPath: profile.credentialPath,
-                sessionMode: 'external', leaseToken: randomUUID(), env: {},
-            }));
-            return classifyIdentityPresence(name, await client.identities());
-        }
-        catch {
-            return { state: 'unknown', detail: 'selected identity index is unavailable' };
-        }
-        finally {
-            await client?.close().catch(() => undefined);
-        }
-    }
-    const ep = resolveEndpoint(env);
-    let response;
+    let client;
     try {
-        response = await fetch(`${ep.origin}/identities`, { headers: ep.headers });
-    }
-    catch (error) {
-        return { state: 'unknown', detail: `identity index unreachable (${msg(error)})` };
-    }
-    if (!response.ok)
-        return {
-            state: 'unknown',
-            detail: response.status === 401
-                ? `daemon rejected the API token (401) — ${authResolutionHint(ep)}`
-                : `identity index returned HTTP ${response.status}`,
+        const profile = readClientProfile(env);
+        const options = {
+            endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+            credentialPath: profile.credentialPath,
+            sessionMode: 'external', leaseToken: randomUUID(), env: {},
         };
-    try {
-        const body = await response.json();
-        return classifyIdentityPresence(name, body.identities);
+        client = await (deps.attachClient?.(options) ?? attachOursClient(options));
+        return classifyIdentityPresence(name, await client.identities());
     }
-    catch (error) {
-        return { state: 'unknown', detail: `identity index response is unreadable (${msg(error)})` };
+    catch {
+        return { state: 'unknown', detail: 'gateway identity index unavailable; check the shared client profile and issued credential' };
+    }
+    finally {
+        await client?.close().catch(() => undefined);
     }
 }
 function classifyIdentityPresence(name, identities) {
@@ -186,12 +89,6 @@ function classifyIdentityPresence(name, identities) {
             stale: found.stale === true,
         };
 }
-/** Actionable, secret-free description of every token source for this profile. */
-export function authResolutionHint(ep) {
-    const tokenPath = join(ep.stateDir, 'daemon-token');
-    return `set OURS_API_TOKEN, set apiToken in ${JSON.stringify(ep.configPath)}, or ensure ` +
-        `${JSON.stringify(tokenPath)} is readable by the fleet supervisor`;
-}
 /** Keep only the events whose type the role asked to wake on. */
 export function filterEvents(events, wakeSources) {
     const set = new Set(wakeSources);
@@ -414,7 +311,6 @@ export class Monitor {
     identity;
     cfg;
     deps;
-    ep;
     profile;
     profileKey;
     monitorLeaseToken = `ours-fleet-monitor-${process.pid}-${randomUUID()}`;
@@ -441,8 +337,7 @@ export class Monitor {
         this.cfg = o.cfg;
         this.deps = o.deps;
         this.profile = readClientProfile(o.deps.env);
-        this.ep = this.profile ? undefined : resolveEndpoint(o.deps.env);
-        this.profileKey = this.profile ? clientProfileKey(this.profile) : this.ep.origin;
+        this.profileKey = clientProfileKey(this.profile);
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
         this.statePath = join(o.agentDir, '.monitor-state.json');
@@ -470,14 +365,8 @@ export class Monitor {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                if (this.profile) {
-                    this.cursor = null;
-                    this.degrade('auth', e.message);
-                }
-                else {
-                    this.fatal = true;
-                    this.degrade('auth', e.message, 'failed');
-                }
+                this.cursor = null;
+                this.degrade('auth', e.message);
             }
             else {
                 this.cursor = null;
@@ -510,11 +399,6 @@ export class Monitor {
                 catch (e) {
                     if (this.stopped)
                         return;
-                    if (e instanceof AuthError && !this.profile) {
-                        this.fatal = true;
-                        this.degrade('auth', e.message, 'failed');
-                        return;
-                    }
                     backoff = Math.min(backoff + BACKOFF_STEP_MS, BACKOFF_MAX_MS);
                     if (e instanceof AuthError)
                         this.degrade('auth', e.message);
@@ -630,23 +514,19 @@ export class Monitor {
         this.currentAbort = ctrl;
         let timedOut = false;
         const timer = this.deps.timers.set(() => { timedOut = true; ctrl.abort(); }, timeoutMs);
-        let resp;
         try {
-            if (this.profile) {
-                const client = await this.profileClient();
-                const page = await client.readNotificationPage(this.identity, {
-                    since: since === 'tip' ? 'tip' : Number.parseInt(since, 10),
-                    signal: ctrl.signal,
-                    requestTimeoutMs: timeoutMs,
-                });
-                return { cursor: page.cursor, events: page.events };
-            }
-            resp = await this.deps.fetch(`${this.ep.url(this.identity)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
+            const client = await this.profileClient();
+            const page = await client.readNotificationPage(this.identity, {
+                since: since === 'tip' ? 'tip' : Number.parseInt(since, 10),
+                signal: ctrl.signal,
+                requestTimeoutMs: timeoutMs,
+            });
+            return { cursor: page.cursor, events: page.events };
         }
         catch (error) {
             if (timedOut && timeoutKind === 'stall')
                 throw new Error(`notification stream stalled for ${Math.round(timeoutMs / 1000)}s`);
-            if (this.profile && /(?:HTTP\s*401|unauthori[sz]ed|API token)/i.test(msg(error)))
+            if (/(?:HTTP\s*401|unauthori[sz]ed|API token)/i.test(msg(error)))
                 throw new AuthError(`daemon rejected the API token (401) — verify the credential file `
                     + `${JSON.stringify(this.profile.credentialPath)} selected by `
                     + `${JSON.stringify(this.profile.configPath)}`);
@@ -656,15 +536,8 @@ export class Monitor {
             this.deps.timers.clear(timer);
             this.currentAbort = null;
         }
-        if (resp.status === 401)
-            throw new AuthError(`daemon rejected the API token (401) — ${authResolutionHint(this.ep)}`);
-        if (!resp.ok)
-            throw new Error(`daemon returned HTTP ${resp.status}`);
-        return resp.json();
     }
     profileClient() {
-        if (!this.profile)
-            throw new Error('explicit client profile is not selected');
         if (!this.profileClientPromise) {
             const { endpoint, expectedInstanceId, credentialPath } = this.profile;
             const options = {

package/dist/owner-channel/channel.d.ts

@@ -14,6 +14,8 @@ export interface OwnerChannelOptions {
     harness: string;
     config: OwnerChannelConfig;
     session: AgentSession;
+    /** Ordinary owner input must not cancel the initial briefing turn. */
+    startupPending?: () => boolean;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;
@@ -269,6 +271,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
+    private ownerPromptPolicy;
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the

package/dist/owner-channel/channel.js

@@ -883,8 +883,15 @@ export class OwnerChannel {
         const recovered = [];
         for (const claim of this.messageRecovery.list()) {
             const item = await this.client.getHistoryItem(claim.wireId);
-            if (!item)
-                throw new Error(`journaled owner message ${claim.wireId} is missing from persistent history`);
+            if (!item) {
+                // The daemon has definitively lost this body. Retrying the claim would
+                // block every later owner message, including after a supervisor restart.
+                // Keep transient lookup errors retryable; only an explicit absence skips.
+                this.messageRecovery.pruneHandled(wireId => wireId === claim.wireId);
+                this.options.log(`[${this.options.role}] skipped journaled owner message ${claim.wireId} `
+                    + `(seq=${claim.seq}): missing from persistent history`);
+                continue;
+            }
             recovered.push(this.historyMessage(item, claim));
         }
         const listed = await this.client.listIncomingMessages();
@@ -1123,6 +1130,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');
@@ -1136,8 +1150,7 @@ export class OwnerChannel {
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
             const queued = await queueSessionPrompt(this.options.session, this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
@@ -1263,8 +1276,7 @@ export class OwnerChannel {
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
             queued = await queueSessionPrompt(this.options.session, this.ownerPrompt(sender, text, wireId), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId, displayText: text },
             });
         }
@@ -1309,6 +1321,14 @@ export class OwnerChannel {
         this.completionTasks.add(task);
         return true;
     }
+    ownerPromptPolicy() {
+        if (this.options.startupPending?.())
+            return { interrupt: false, steer: true };
+        return {
+            interrupt: this.options.config.interrupt,
+            ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+        };
+    }
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the
@@ -1378,6 +1398,7 @@ export class OwnerChannel {
                     await this.fleetOps.provisionTask(task.task_id);
                 return outcome;
             }),
+            observeTaskReadiness: taskId => new TaskRoomApplicationService(this.options.configPath).observeTaskReadiness(taskId),
             taskProvisioningOutcome: taskId => new TaskRoomApplicationService(this.options.configPath).taskProvisioningOutcome(taskId),
             listTasks: filter => new TaskRoomApplicationService(this.options.configPath).listTasks(filter),
             groupedTasks: filter => new TaskRoomApplicationService(this.options.configPath).groupedTasks(filter),
@@ -1762,6 +1783,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');

package/dist/owner-channel/commands.d.ts

@@ -1,3 +1,4 @@
+import type { TaskReadinessIssue } from '../rooms-tasks/live-readiness.js';
 import type { InterruptOutcome, SessionEvent, SessionSnapshot } from '../session/types.js';
 import type { RoomOrchestrationRecord, TaskOutcome, TaskRecord, TaskTerminalIntent, TaskListRecord } from '../rooms-tasks/types.js';
 import { type OwnerCommentsState } from './notices.js';
@@ -58,6 +59,9 @@ export interface OwnerCommandContext {
     terminalTask(taskId: string, kind: TaskTerminalIntent['kind'], outcome?: TaskOutcome): Promise<void>;
     createTask(input: Omit<CreateTaskRequest, 'actor'>): Promise<TaskRecord>;
     startTask(taskId: string): Promise<TaskProvisioningOutcome | TaskRecord>;
+    observeTaskReadiness?(taskId: string): Promise<{
+        state: 'ready';
+    } | TaskReadinessIssue>;
     taskProvisioningOutcome?(taskId: string): TaskProvisioningOutcome;
     listTasks(filter?: {
         state?: TaskState | TaskState[];

package/dist/owner-channel/commands.js

@@ -47,6 +47,11 @@ function isKnownOwnerRoomState(message) {
     ].some(pattern => pattern.test(message));
 }
 function ownerTaskFailure(error) {
+    if (error instanceof TaskRoomApplicationError && error.code === 'task_not_ready')
+        return {
+            kind: 'state', detail: error.message,
+            action: 'Ask Fleet Coordinator to inspect room and member status and choose supported recovery.',
+        };
     if (error instanceof TaskListError)
         return {
             kind: error.code === 'list_not_found' ? 'not_found'
@@ -301,6 +306,7 @@ export const ownerCommands = [
             const trailingLines = argLines.slice(1).join('\n').trim() || undefined;
             const showTask = async (id) => {
                 const { task: t } = ctx.getTask(id);
+                const readiness = t.state === 'active' ? await ctx.observeTaskReadiness?.(id) : undefined;
                 await ctx.reply(renderMarkdownResult({
                     icon: '📋', title: 'Task details',
                     fields: [
@@ -308,6 +314,8 @@ export const ownerCommands = [
                         { label: 'Title', value: t.title },
                         { label: 'Status', value: taskStatus(t.state), kind: 'markdown' },
                         { label: 'List', value: t.list_name ?? 'default', kind: 'code' },
+                        ...(readiness ? [{ label: 'Readiness', value: readiness.state },
+                            ...('reason' in readiness ? [{ label: 'Reason', value: readiness.reason }] : [])] : []),
                         ...(t.blocked ? [{ label: 'Blocked', value: t.blocked.reason }] : []),
                         ...(t.template ? [{ label: 'Template', value: `${t.template.name}@${t.template.version}`, kind: 'code' }] : []),
                         ...(t.room_id ? [{ label: 'Room', value: t.room_id, kind: 'code' }] : []),

package/dist/owner-channel/lifecycle-outbox.js

@@ -1,6 +1,6 @@
+import { redactErasedContent, writePrivacyFilteredLedger } from '../erased-resources.js';
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, readFileSync } from 'node:fs';
-import { replaceFileAtomically } from '../atomic-file.js';
 import { lifecycleEventDigestBasis, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
 const DIGEST = /^[a-f0-9]{64}$/u;
 const LIMIT = 5_000;
@@ -63,7 +63,7 @@ export class FleetLifecycleOutbox {
     }
     pending() {
         this.assertHealthy();
-        return this.entries.filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
+        return redactErasedContent(this.entries).filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
     }
     finish(digest, delivery) {
         this.assertHealthy();
@@ -82,6 +82,7 @@ export class FleetLifecycleOutbox {
             throw new Error(this.corruptReason);
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, entries: this.entries })}\n`, 0o600);
+        this.entries = redactErasedContent(this.entries);
+        writePrivacyFilteredLedger(this.path, { version: 1, entries: this.entries });
     }
 }

package/dist/owner-channel/ours-client.js

@@ -1,7 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { extname, join } from 'node:path';
-import { readDaemonConfig, resolveEndpoint } from '../monitor.js';
+import { extname } from 'node:path';
 import { readClientProfile } from '../client-profile.js';
 import { OursError, attachOursClient, } from '@ours.network/sdk/client';
 /** Any failure of a daemon operation. Never carries a message body or a token. */
@@ -131,24 +130,10 @@ export class OursSdkClient {
             return;
         const environment = { ...process.env, ...this.env };
         const profile = readClientProfile(environment);
-        // Reuse existing connection configuration. Identity selection checks the
-        // daemon capability before reading the client's protected token delivery file.
-        const endpoint = !profile && environment.OURS_DAEMON_ID
-            ? resolveEndpoint(environment, false) : undefined;
-        const token = endpoint ? environment.OURS_API_TOKEN?.trim() || readDaemonConfig(environment).apiToken : undefined;
-        const options = profile ? {
+        const options = {
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath,
             sessionMode: 'external', leaseToken: this.leaseToken, env: {},
-        } : endpoint ? {
-            endpoint: endpoint.origin, expectedInstanceId: environment.OURS_DAEMON_ID,
-            sessionMode: 'external', leaseToken: this.leaseToken,
-            ...(token ? { token } : { credentialPath: join(endpoint.stateDir, 'daemon-token') }),
-        } : {
-            env: environment,
-            leaseToken: this.leaseToken,
-            clientPid: process.pid,
-            fetch: notificationDeadlineFetch(this.deps.fetch ?? globalThis.fetch, this.deps.notificationRequestDeadlineMs ?? NOTIFICATION_REQUEST_DEADLINE_MS),
         };
         this.client = await (this.deps.attachClient?.(options) ?? attachOursClient(options));
         this.terminalReleasePending = true;

package/dist/preset-migration.js

@@ -69,8 +69,11 @@ const V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
 });
 const CURRENT_ROLE_DEFAULTS = new Set([
     'roles/Coordinator.yaml', 'roles/LocalCoordinator.yaml', 'roles/Developer.yaml', 'roles/Critic.yaml',
+    'roles/Engineer.yaml',
     'agent_templates/LocalCoordinator.yaml', 'agent_templates/Developer.yaml', 'agent_templates/Critic.yaml',
+    'agent_templates/Engineer.yaml',
     'room_templates/single.yaml', 'room_templates/pair.yaml', 'room_templates/team.yaml',
+    'room_templates/engineering.yaml',
     'agents/FleetCoordinator.yaml',
 ]);
 export const legacyStarterMigrationManifest = Object.freeze({
@@ -258,6 +261,18 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
                 unlinkSync(target);
             copyFileSync(join(source, relative), target, constants.COPYFILE_EXCL);
             chmodSync(target, 0o600);
+            // New Engineer seats use the existing Developer's selected brain. This
+            // preserves wizard/custom provider choices without copying permissions.
+            if (relative === 'agent_templates/Engineer.yaml' && classified.additions.includes(path)) {
+                const developer = join(root, 'agent_templates/Developer.yaml');
+                if (existsSync(developer)) {
+                    const value = parseFleetDocument(developer, readFileSync(developer, 'utf8'), 'strict').value;
+                    if (value.brain !== undefined && JSON.stringify(value.brain) !== JSON.stringify({ ref: 'claude-default' })) {
+                        const bytes = readFileSync(target, 'utf8').replace('brain: { ref: claude-default }', () => `brain: ${JSON.stringify(value.brain)}`);
+                        writeFileSync(target, bytes, { mode: 0o600 });
+                    }
+                }
+            }
             fsyncPath(target);
         }
         for (const kind of ['roles', 'agent_templates', 'room_templates', 'agents'])