@ours.network/fleet 1.2.0-nightly.23 → 1.2.0-nightly.25

package/README.md

@@ -1820,3 +1820,8 @@ See [predefined Brain models and runtime requirements](presets/README.md) for th
 
 Room layouts describe room composition with shared or fresh participant sessions and independent room closure.
 See [Room layouts](docs/room-layouts.md) for YAML examples and CLI commands.
+
+
+### Dedicated notification service
+
+Configure the web backend with `OURS_NOTIFICATIONS_ORIGIN` and a Fleet-scoped `OURS_NOTIFICATIONS_PRODUCER_TOKEN`. It reads each local supervisor ledger incrementally with persistent checkpoints under web state, correlating owner browser/channel prompts with terminal completion. Monitor/startup turns do not notify. First installation skips existing history; no agent restart or conversation controller is needed. Persist web state across deployment/restarts. Reads are bounded to 256 KiB per role per tick, and oversized model/media records are skipped across chunks. Expose `/notifications` through the generic authenticated prefix gateway with a server-side user token and `stripBrowserContext: true`; producer tokens stay server-side. All browser sessions of this single-owner console map to one stable notification account. See [ours-notifications](https://github.com/adapt-toolkit/ours-notifications) for configuration/API/release details.

package/dist/application/task-layouts.d.ts

@@ -31,6 +31,8 @@ export interface TaskLayoutView {
     rooms: TaskLayoutRoomView[];
     participants: Array<{
         key: string;
+        participant?: string;
+        room?: string;
         agent_template?: string;
         owned: boolean;
         retired: boolean;

package/dist/application/task-layouts.js

@@ -153,7 +153,8 @@ export class TaskLayouts {
                 };
             }),
             participants: Object.entries(state.participants).map(([key, p]) => ({
-                key, agent_template: state.definition.participants[key]?.agent_template, owned: p.owned, retired: Boolean(p.retired),
+                key, ...(p.participant ? { participant: p.participant, room: p.room } : {}),
+                agent_template: state.definition.participants[p.participant ?? key]?.agent_template, owned: p.owned, retired: Boolean(p.retired),
                 ...(p.instance?.agent ? { agent: p.instance.agent } : {}), ...(p.instance?.cid ? { cid: p.instance.cid } : {}),
             })),
         };

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.23",
-  "buildId": "84a9c6c0a54c",
-  "commit": "75b0bebdb33a4ace4713015f7a7f49adc330f6e4",
+  "version": "1.2.0-nightly.25",
+  "buildId": "a567036edf8d",
+  "commit": "59ceeac2bb5c52f0861fe19d3c20e5e884d37c6c",
   "dirty": true,
-  "builtAt": "2026-09-30T10:20:51.847Z",
+  "builtAt": "2026-09-30T20:02:41.728Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/notifications/fleet-producer.d.ts

@@ -0,0 +1,18 @@
+import { type ProducerConfig } from './outbox.js';
+/** Read durable supervisor ledgers without restarting agents or attaching a
+ * conversation controller. Each tick reads at most 256 KiB per role, from its
+ * checkpoint; it never loads a complete transcript or requests model history. */
+export declare class FleetNotificationProducer {
+    private readonly roots;
+    private readonly stateDir;
+    private readonly config;
+    private readonly warn;
+    private readonly queues;
+    private readonly timer;
+    private readonly existing;
+    constructor(roots: string[], stateDir: string, config: ProducerConfig, warn?: (line: string) => void);
+    private names;
+    poll(): void;
+    drain(): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/notifications/fleet-producer.js

@@ -0,0 +1,129 @@
+import { closeSync, existsSync, lstatSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { NotificationOutbox } from './outbox.js';
+/** Read durable supervisor ledgers without restarting agents or attaching a
+ * conversation controller. Each tick reads at most 256 KiB per role, from its
+ * checkpoint; it never loads a complete transcript or requests model history. */
+export class FleetNotificationProducer {
+    roots;
+    stateDir;
+    config;
+    warn;
+    queues = new Map();
+    timer;
+    existing = new Set();
+    constructor(roots, stateDir, config, warn = () => { }) {
+        this.roots = roots;
+        this.stateDir = stateDir;
+        this.config = config;
+        this.warn = warn;
+        for (const root of roots)
+            for (const name of this.names(root))
+                this.existing.add(join(root, name));
+        this.poll();
+        this.timer = setInterval(() => this.poll(), 1000);
+        this.timer.unref();
+    }
+    names(root) {
+        try {
+            return readdirSync(root, { withFileTypes: true }).filter(d => d.isDirectory() && /^[a-zA-Z0-9_-]+$/.test(d.name)).map(d => d.name);
+        }
+        catch {
+            return [];
+        }
+    }
+    poll() {
+        for (const root of this.roots)
+            for (const roleId of this.names(root)) {
+                const roleDir = join(root, roleId), dir = join(roleDir, '.conversation');
+                try {
+                    if (!existsSync(dir) || lstatSync(dir).isSymbolicLink())
+                        continue;
+                    const segments = readdirSync(dir).filter(n => /^events-\d{6}\.jsonl$/.test(n) && !lstatSync(join(dir, n)).isSymbolicLink()).sort();
+                    if (!segments.length)
+                        continue;
+                    let outbox = this.queues.get(roleDir);
+                    if (!outbox) {
+                        const key = createHash('sha256').update(roleDir).digest('hex');
+                        outbox = new NotificationOutbox(join(this.stateDir, key + '.json'), this.config, async (value, eventId) => ({ eventId, title: `${roleId}: agent completed`, body: 'Your agent finished responding. Open the chat to view the result.',
+                            url: `/fleet/chats?chat=${encodeURIComponent(roleId)}&detail=1`, ...value }), this.warn);
+                        if (!outbox.checkpoint) {
+                            const segment = this.existing.has(roleDir) ? segments.at(-1) : segments[0];
+                            outbox.saveCheckpoint({ segment, offset: this.existing.has(roleDir) ? statSync(join(dir, segment)).size : 0, prompts: [] });
+                        }
+                        this.queues.set(roleDir, outbox);
+                    }
+                    const saved = outbox.checkpoint;
+                    const current = { ...saved, prompts: [...saved.prompts], messages: { ...saved.messages } };
+                    let index = segments.indexOf(current.segment);
+                    if (index < 0) {
+                        this.warn('Notification ledger segment unavailable; checkpoint retained');
+                        continue;
+                    }
+                    const file = join(dir, current.segment), size = statSync(file).size;
+                    if (size < current.offset) {
+                        this.warn('Notification ledger truncated; checkpoint retained');
+                        continue;
+                    }
+                    if (size === current.offset && index < segments.length - 1) {
+                        current.segment = segments[++index];
+                        current.offset = 0;
+                    }
+                    const fd = openSync(join(dir, current.segment), 'r'), buffer = Buffer.alloc(256 * 1024);
+                    let count;
+                    try {
+                        count = readSync(fd, buffer, 0, buffer.length, current.offset);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                    let position = 0;
+                    while (position < count) {
+                        const end = buffer.indexOf(10, position);
+                        if (end < 0 || end >= count) {
+                            // Oversized model/media events are irrelevant to prompt/completion
+                            // correlation. Skip in bounded chunks; retain partial small lines.
+                            if (current.discarding || (position === 0 && count === buffer.length)) {
+                                current.offset += count - position;
+                                current.discarding = true;
+                                this.warn('Notification observer skipping oversized ledger record');
+                            }
+                            break;
+                        }
+                        if (current.discarding) {
+                            current.offset += end - position + 1;
+                            position = end + 1;
+                            current.discarding = false;
+                            continue;
+                        }
+                        const event = JSON.parse(buffer.subarray(position, end).toString('utf8'));
+                        if (event.schemaVersion !== 1 || event.roleId !== roleId)
+                            throw new Error('invalid ledger event');
+                        const prompt = `${event.sessionGeneration}:${event.promptId}`;
+                        if (event.kind === 'prompt.admitted' && event.promptId && ['browser', 'owner_admin_console', 'owner_channel'].includes(event.source ?? '')) {
+                            if (!current.prompts.includes(prompt))
+                                current.prompts.push(prompt);
+                        }
+                        if (['message.chunk', 'message.replace'].includes(event.kind) && event.promptId && event.messageId && current.prompts.includes(prompt))
+                            current.messages[prompt] = event.messageId;
+                        if (event.kind === 'turn.completed' && event.promptId && current.prompts.includes(prompt)) {
+                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { url: `/fleet/chats?chat=${encodeURIComponent(roleId)}&detail=1#fleet-message-${encodeURIComponent(current.messages[prompt] ?? event.promptId)}` }))
+                                break;
+                            current.prompts = current.prompts.filter(p => p !== prompt);
+                            delete current.messages[prompt];
+                        }
+                        current.offset += end - position + 1;
+                        position = end + 1;
+                    }
+                    if (current.segment !== saved.segment || current.offset !== saved.offset)
+                        outbox.saveCheckpoint(current);
+                }
+                catch {
+                    this.warn('Notification ledger admission pending; checkpoint will replay');
+                }
+            }
+    }
+    async drain() { await Promise.all([...this.queues.values()].map(q => q.drain())); }
+    async close() { clearInterval(this.timer); await Promise.all([...this.queues.values()].map(q => q.close())); }
+}

package/dist/notifications/outbox.d.ts

@@ -0,0 +1,31 @@
+export interface NotificationInput {
+    eventId: string;
+    title: string;
+    body: string;
+    url: string;
+}
+export interface ProducerConfig {
+    origin: string;
+    token: string;
+}
+export declare function producerConfig(env?: NodeJS.ProcessEnv): ProducerConfig | undefined;
+/** Durable producer queue. Service dedupe makes crash-after-acceptance replay safe. */
+export declare class NotificationOutbox {
+    private readonly file;
+    private readonly config;
+    private readonly project;
+    private readonly warn;
+    private entries;
+    cursor?: number;
+    checkpoint?: unknown;
+    private running?;
+    private timer;
+    constructor(file: string, config: ProducerConfig, project: (value: unknown, id: string) => Promise<NotificationInput>, warn?: (message: string) => void);
+    private persist;
+    advance(cursor: number): void;
+    saveCheckpoint(checkpoint: unknown): void;
+    enqueue(id: string, value: unknown, cursor?: number | undefined): boolean;
+    drain(): Promise<void>;
+    private drainOnce;
+    close(): Promise<void>;
+}

package/dist/notifications/outbox.js

@@ -0,0 +1,104 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+export function producerConfig(env = process.env) {
+    const origin = env.OURS_NOTIFICATIONS_ORIGIN, token = env.OURS_NOTIFICATIONS_PRODUCER_TOKEN;
+    if (!origin && !token)
+        return;
+    if (!origin || !token || token.length < 32)
+        throw new Error('notifications producer requires origin and scoped token');
+    const url = new URL(origin);
+    if (!['http:', 'https:'].includes(url.protocol) || url.origin !== origin || url.username || url.password)
+        throw new Error('invalid notification service origin');
+    if (url.protocol === 'http:' && !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname))
+        throw new Error('notification credentials require HTTPS or loopback');
+    return { origin, token };
+}
+/** Durable producer queue. Service dedupe makes crash-after-acceptance replay safe. */
+export class NotificationOutbox {
+    file;
+    config;
+    project;
+    warn;
+    entries;
+    cursor;
+    checkpoint;
+    running;
+    timer;
+    constructor(file, config, project, warn = () => { }) {
+        this.file = file;
+        this.config = config;
+        this.project = project;
+        this.warn = warn;
+        mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+        const saved = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { entries: [] };
+        this.entries = Array.isArray(saved) ? saved : saved.entries;
+        this.cursor = saved.cursor;
+        this.checkpoint = saved.checkpoint;
+        if (!Array.isArray(this.entries))
+            throw new Error('invalid notification outbox');
+        this.timer = setInterval(() => { void this.drain(); }, 3000);
+        this.timer.unref();
+    }
+    persist(entries, cursor = this.cursor, checkpoint = this.checkpoint) {
+        const tmp = this.file + '.tmp', fd = openSync(tmp, 'w', 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify({ entries, cursor, checkpoint }));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, this.file);
+        const dir = openSync(dirname(this.file), 'r');
+        try {
+            fsyncSync(dir);
+        }
+        finally {
+            closeSync(dir);
+        }
+        this.entries = entries;
+        this.cursor = cursor;
+        this.checkpoint = checkpoint;
+    }
+    advance(cursor) { this.persist(this.entries, cursor); }
+    saveCheckpoint(checkpoint) { this.persist(this.entries, this.cursor, checkpoint); }
+    enqueue(id, value, cursor = this.cursor) {
+        if (this.entries.some(e => e.id === id)) {
+            if (cursor !== this.cursor)
+                this.advance(cursor);
+            return true;
+        }
+        if (this.entries.length >= 2000)
+            return false;
+        this.persist([...this.entries, { id, value }], cursor);
+        return true;
+    }
+    drain() {
+        return this.running ??= this.drainOnce().finally(() => { this.running = undefined; });
+    }
+    async drainOnce() {
+        for (const entry of [...this.entries].slice(0, 32)) {
+            try {
+                const value = entry.payload ?? await this.project(entry.value, entry.id);
+                // Freeze the canonical projection before any network attempt. A crash
+                // after service acceptance must replay the identical dedupe payload.
+                if (!entry.payload)
+                    this.persist(this.entries.map(e => e.id === entry.id ? { ...e, payload: value } : e));
+                const response = await fetch(this.config.origin + '/api/v1/send', {
+                    method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+                    headers: { Authorization: `Bearer ${this.config.token}`, 'Content-Type': 'application/json' },
+                    body: JSON.stringify(value),
+                });
+                await response.body?.cancel();
+                if (!response.ok)
+                    throw new Error('notification service rejected event');
+                this.persist(this.entries.filter(e => e.id !== entry.id));
+            }
+            catch {
+                this.warn('Notification producer delivery pending; retrying from durable outbox');
+                break;
+            }
+        }
+    }
+    async close() { clearInterval(this.timer); await this.running; }
+}

package/dist/rooms-tasks/layout-binding-client.d.ts

@@ -0,0 +1,11 @@
+import type { LayoutInstance } from './layout.js';
+import type { LayoutControlRequest } from './layout-control.js';
+export type LayoutBindingRequest = Omit<LayoutControlRequest, 'instance'> & {
+    roomId?: string;
+    roomRole?: string;
+};
+export declare const LAYOUT_BINDING_ACTIONS: readonly ["verify", "join", "assign"];
+export declare const localLayoutReference: ({ remote: _remote, ...instance }: LayoutInstance) => LayoutInstance;
+/** Initial support is the same-host, separate-OS-user use case from #194. */
+export declare function layoutBindingOrigin(raw: string): string;
+export declare function callRemoteLayoutBinding(instance: LayoutInstance, request: LayoutBindingRequest, daemonInstanceId: string, fetchImpl?: typeof fetch): Promise<unknown>;

package/dist/rooms-tasks/layout-binding-client.js

@@ -0,0 +1,56 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import { canonicalJson } from '../canonical-json.js';
+export const LAYOUT_BINDING_ACTIONS = ['verify', 'join', 'assign'];
+export const localLayoutReference = ({ remote: _remote, ...instance }) => instance;
+/** Initial support is the same-host, separate-OS-user use case from #194. */
+export function layoutBindingOrigin(raw) {
+    const url = new URL(raw);
+    if (url.protocol !== 'http:' || !['127.0.0.1'].includes(url.hostname)
+        || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+        throw Error('cross-Fleet bindings require an explicit loopback HTTP origin');
+    return url.origin;
+}
+export async function callRemoteLayoutBinding(instance, request, daemonInstanceId, fetchImpl = fetch) {
+    const remote = instance.remote;
+    if (!LAYOUT_BINDING_ACTIONS.includes(request.action))
+        throw Error('cross-Fleet bindings allow only verify, join and assign');
+    if (remote.daemon_instance_id !== daemonInstanceId)
+        throw Error('cross-Fleet binding requires the same daemon instance');
+    const origin = layoutBindingOrigin(remote.url);
+    if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(remote.grant_id) || !isAbsolute(remote.credential_file))
+        throw Error('invalid cross-Fleet binding');
+    const stat = lstatSync(remote.credential_file);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077)
+        || (process.getuid && stat.uid !== process.getuid()) || stat.size > 256)
+        throw Error('untrusted cross-Fleet credential file');
+    const token = readFileSync(remote.credential_file, 'utf8').trim();
+    if (!/^[A-Za-z0-9_-]{43}$/.test(token))
+        throw Error('invalid cross-Fleet credential');
+    let response;
+    try {
+        response = await fetchImpl(`${origin}/api/v1/layout-bindings/${remote.grant_id}/control`, {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(60_000),
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+            body: JSON.stringify({ ...request, instance: localLayoutReference(instance), daemonInstanceId }),
+        });
+    }
+    catch {
+        throw Error('cross-Fleet control unavailable; operation outcome may be unknown');
+    }
+    // Remote errors are not trusted presentation data and may contain private request bytes.
+    if (!response.ok)
+        throw Error(`cross-Fleet binding rejected (${response.status})`);
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw Error('invalid cross-Fleet control response');
+    }
+    if (!result || typeof result !== 'object')
+        throw Error('invalid cross-Fleet control response');
+    if (canonicalJson(result.instance) !== canonicalJson(localLayoutReference(instance)))
+        throw Error('cross-Fleet instance proof changed');
+    return result.result;
+}

package/dist/rooms-tasks/layout-binding-grants.d.ts

@@ -0,0 +1,21 @@
+import type { LayoutInstance, LayoutSupervisor } from './layout.js';
+import { type CoworkAdapter } from './cowork-adapter.js';
+/** Private authorization records in the existing Fleet state; no foreign lifecycle port. */
+export declare class LayoutBindingGrants {
+    private supervisor;
+    private options;
+    constructor(supervisor: LayoutSupervisor, options?: {
+        root?: string;
+        daemonInstanceId?: () => string;
+        cowork?: () => CoworkAdapter;
+    });
+    private get root();
+    private daemonInstanceId;
+    private path;
+    share(instance: LayoutInstance, origin: string, output: string, participant: string): Promise<{
+        grant_id: string;
+        file: string;
+    }>;
+    revoke(id: string): Promise<void>;
+    control(id: string, authorization: string | undefined, raw: unknown): Promise<unknown>;
+}

package/dist/rooms-tasks/layout-binding-grants.js

@@ -0,0 +1,128 @@
+import { randomBytes, randomUUID, createHash, timingSafeEqual } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, basename, join } from 'node:path';
+import { stringify } from 'yaml';
+import { stateRoot } from '../paths.js';
+import { withFileLock } from '../atomic-file.js';
+import { readClientProfile } from '../client-profile.js';
+import { FleetError } from '../application/errors.js';
+import { assertLayoutFile, validLayoutKey } from './layout-config.js';
+import { canonicalJson } from '../canonical-json.js';
+import { LAYOUT_BINDING_ACTIONS, layoutBindingOrigin } from './layout-binding-client.js';
+import { createCoworkAdapter } from './cowork-adapter.js';
+const digest = (token) => createHash('sha256').update(token).digest('hex');
+function privatePath(path, directory = false) {
+    assertLayoutFile(path, directory);
+    if (lstatSync(path).mode & 0o077)
+        throw new FleetError('forbidden', 'layout grants require owner-only permissions');
+}
+const allowedId = (id) => /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(id);
+/** Private authorization records in the existing Fleet state; no foreign lifecycle port. */
+export class LayoutBindingGrants {
+    supervisor;
+    options;
+    constructor(supervisor, options = {}) {
+        this.supervisor = supervisor;
+        this.options = options;
+    }
+    get root() { return this.options.root ?? join(stateRoot(), 'layout-bindings'); }
+    daemonInstanceId() { return this.options.daemonInstanceId?.() ?? readClientProfile().expectedInstanceId; }
+    path(id) {
+        if (!allowedId(id))
+            throw new FleetError('invalid_request', 'invalid layout binding grant');
+        return join(this.root, `${id}.json`);
+    }
+    async share(instance, origin, output, participant) {
+        layoutBindingOrigin(origin);
+        if (!validLayoutKey(participant) || instance.remote || instance.supervisor !== this.supervisor.id)
+            throw new FleetError('invalid_request', 'only an exact local standalone instance can be shared');
+        await this.supervisor.verify(instance);
+        const daemonInstanceId = this.daemonInstanceId();
+        const token = randomBytes(32).toString('base64url'), id = randomUUID();
+        const credential = `${output}.token`;
+        // Create-only publication: never replace another binding or credential.
+        if (existsSync(output) || existsSync(credential))
+            throw new FleetError('conflict', 'binding output already exists');
+        mkdirSync(this.root, { recursive: true, mode: 0o700 });
+        privatePath(this.root, true);
+        mkdirSync(dirname(output), { recursive: true, mode: 0o700 });
+        assertLayoutFile(dirname(output), true);
+        const grant = { version: 1, digest: digest(token), instance, daemonInstanceId };
+        writeFileSync(this.path(id), JSON.stringify(grant), { mode: 0o600, flag: 'wx' });
+        let tokenWritten = false;
+        try {
+            writeFileSync(credential, `${token}\n`, { mode: 0o600, flag: 'wx' });
+            tokenWritten = true;
+            writeFileSync(output, stringify({ [participant]: { ...instance, remote: {
+                        url: layoutBindingOrigin(origin), grant_id: id, credential_file: basename(credential), daemon_instance_id: daemonInstanceId,
+                    } } }), { mode: 0o600, flag: 'wx' });
+        }
+        catch (error) {
+            rmSync(this.path(id), { force: true });
+            if (tokenWritten)
+                rmSync(credential, { force: true });
+            throw error;
+        }
+        return { grant_id: id, file: output };
+    }
+    async revoke(id) {
+        const path = this.path(id);
+        if (!existsSync(this.root))
+            return;
+        privatePath(this.root, true);
+        await withFileLock(path + '.lock', () => { rmSync(path, { force: true }); });
+    }
+    async control(id, authorization, raw) {
+        const path = this.path(id);
+        if (!existsSync(path))
+            throw new FleetError('unauthorized', 'layout binding is unavailable');
+        privatePath(this.root, true);
+        return withFileLock(path + '.lock', async () => {
+            if (!existsSync(path))
+                throw new FleetError('unauthorized', 'layout binding is unavailable');
+            privatePath(path);
+            const grant = JSON.parse(readFileSync(path, 'utf8'));
+            const token = authorization?.match(/^Bearer ([A-Za-z0-9_-]{43})$/)?.[1];
+            if (!token || grant.version !== 1 || typeof grant.digest !== 'string' || !/^[a-f0-9]{64}$/.test(grant.digest)
+                || !timingSafeEqual(Buffer.from(digest(token)), Buffer.from(grant.digest)))
+                throw new FleetError('unauthorized', 'layout binding is unavailable');
+            const request = raw;
+            if (!request || !LAYOUT_BINDING_ACTIONS.includes(request.action)
+                || Object.keys(request).some(k => !['action', 'instance', 'roomId', 'roomRole', 'roomCid', 'assignment', 'daemonInstanceId'].includes(k)))
+                throw new FleetError('invalid_request', 'unsupported layout binding operation');
+            if (request.daemonInstanceId !== grant.daemonInstanceId || grant.daemonInstanceId !== this.daemonInstanceId()
+                || canonicalJson(request.instance) !== canonicalJson(grant.instance))
+                throw new FleetError('forbidden', 'layout binding does not match the granted instance');
+            try {
+                await this.supervisor.verify(grant.instance);
+                let result;
+                if (request.action === 'join') {
+                    if (!request.roomId || !request.roomCid || !request.roomRole)
+                        throw Error('room ID, CID and role required');
+                    const cowork = this.options.cowork?.() ?? createCoworkAdapter();
+                    const room = await cowork.getRoom(request.roomId);
+                    if (!room || !['provisioning', 'active'].includes(room.state) || room.identity_cid !== request.roomCid)
+                        throw Error('known mutable Cowork room required');
+                    // Never redeem a caller-supplied contact invitation. Cowork owns this receipt.
+                    const invitation = await cowork.issueInvite(request.roomId, { mode: 'one_time', role: request.roomRole, min_accepts: 1 });
+                    await this.supervisor.join(grant.instance, invitation.invite, request.roomCid);
+                }
+                else if (request.action === 'assign') {
+                    const a = request.assignment;
+                    if (!a?.room_id || !a.room_cid || !a.room_role)
+                        throw Error('assignment required');
+                    const room = await (this.options.cowork?.() ?? createCoworkAdapter()).getRoom(a.room_id);
+                    if (room?.state !== 'active' || room.identity_cid !== a.room_cid
+                        || !room.seats.some(s => s.identity_cid === grant.instance.cid && s.role === a.room_role && s.seat_state === 'active'))
+                        throw Error('active granted membership required');
+                    result = await this.supervisor.assign(grant.instance, a);
+                }
+                await this.supervisor.verify(grant.instance);
+                return { instance: grant.instance, result };
+            }
+            catch {
+                throw new FleetError('rejected', 'layout binding operation rejected or unconfirmed; inspect before retry');
+            }
+        });
+    }
+}

package/dist/rooms-tasks/layout-cli.d.ts

@@ -1,2 +1,4 @@
 import { Command } from 'commander';
+import type { LayoutInstance } from './layout.js';
+export declare function readLayoutBindings(file: string): Record<string, LayoutInstance>;
 export declare function registerLayoutCommands(parent: Command, cOpt: (cmd: Command) => Command): void;

package/dist/rooms-tasks/layout-cli.js

@@ -1,4 +1,6 @@
 import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { LayoutBindingGrants } from './layout-binding-grants.js';
 import { stringify } from 'yaml';
 import { RoomLayoutService } from './layout-service.js';
 import { layoutSupervisorId } from './layout-control.js';
@@ -16,6 +18,15 @@ function document(file) {
     assertLayoutFile(file);
     return parseFleetDocument(file, readFileSync(file, 'utf8'), 'strict').value;
 }
+export function readLayoutBindings(file) {
+    const absolute = resolve(file);
+    const bindings = document(absolute);
+    for (const instance of Object.values(bindings)) {
+        if (instance.remote)
+            instance.remote.credential_file = resolve(dirname(absolute), instance.remote.credential_file);
+    }
+    return bindings;
+}
 export function registerLayoutCommands(parent, cOpt) {
     const layout = parent.command('layout').description('YAML room composition and membership');
     const command = (signature, description) => cOpt(layout.command(signature).description(description)).option('--json', 'JSON output');
@@ -52,11 +63,26 @@ export function registerLayoutCommands(parent, cOpt) {
     command('instance <agent>', 'inspect an exact live instance for a bindings YAML file')
         .option('--temporary', 'select a temporary agent')
         .action(action(async (agent, opts) => emit({ instance: await new RoomLayoutService(opts.configuration).supervisor().inspect(agent, Boolean(opts.temporary)) })));
+    command('share <agent>', 'grant room membership access to one exact local standalone instance')
+        .option('--temporary', 'select a temporary agent')
+        .requiredOption('--server-url <origin>', 'existing owner Fleet loopback HTTP origin')
+        .requiredOption('--output <file>', 'create binding YAML and adjacent private credential file')
+        .option('--participant <key>', 'logical layout participant key (default: agent name)')
+        .action(action(async (agent, opts) => {
+        const supervisor = new RoomLayoutService(opts.configuration).supervisor();
+        const instance = await supervisor.inspect(agent, Boolean(opts.temporary));
+        emit(await new LayoutBindingGrants(supervisor).share(instance, opts.serverUrl, resolve(opts.output), opts.participant ?? agent));
+    }));
+    command('revoke-binding <grant-id>', 'revoke a room membership grant without stopping the agent')
+        .action(action(async (id, opts) => {
+        await new LayoutBindingGrants(new RoomLayoutService(opts.configuration).supervisor()).revoke(id);
+        emit({ grant_id: id, revoked: true });
+    }));
     command('create <name>', 'snapshot a layout without creating rooms or agents')
         .option('--id <id>', 'unique layout instance ID').option('--bindings <file>', 'YAML mapping participant keys to exact instance references')
         .action(action(async (name, opts) => {
         const service = new RoomLayoutService(opts.configuration);
-        const created = await service.create(name, opts.bindings ? document(opts.bindings) : {}, opts.id);
+        const created = await service.create(name, opts.bindings ? readLayoutBindings(opts.bindings) : {}, opts.id);
         emit({ id: created.id, state: created.state });
     }));
     command('status <id>', 'inspect room membership and agent instances').action(action((id, opts) => emit({ id, state: new RoomLayoutService(opts.configuration).open(id, true).snapshot() })));

package/dist/rooms-tasks/layout-config.js

@@ -31,7 +31,7 @@ export function validateRoomLayout(raw, label = 'room layout') {
                 throw Error(`${label}: invalid key ${key}`);
     }
     for (const [key, rawParticipant] of Object.entries(doc.participants)) {
-        const participant = mapping(rawParticipant, ['agent_template'], `${label}.participants.${key}`);
+        const participant = mapping(rawParticipant, ['agent_template', 'instance_scope'], `${label}.participants.${key}`);
         if (participant.agent_template !== undefined)
             text(participant.agent_template, 'agent_template');
     }

package/dist/rooms-tasks/layout-service.d.ts

@@ -12,7 +12,10 @@ export declare class NativeLayoutSupervisor implements LayoutSupervisor {
     private call;
     verify(i: LayoutInstance): Promise<void>;
     spawn(key: string, template: string): Promise<LayoutInstance>;
-    join(i: LayoutInstance, invite: string, roomCid: string): Promise<void>;
+    join(i: LayoutInstance, invite: string, roomCid: string, membership?: {
+        roomId: string;
+        role: string;
+    }): Promise<void>;
     assign(i: LayoutInstance, assignment: import('./layout.js').LayoutAssignment): Promise<void>;
     retire(i: LayoutInstance): Promise<void>;
 }

package/dist/rooms-tasks/layout-service.js

@@ -11,6 +11,8 @@ import { layoutSupervisorId } from './layout-control.js';
 import { RoomLayout } from './layout.js';
 import { assertLayoutFile, validLayoutKey, readRoomLayout, readRoomLayouts } from './layout-config.js';
 import { createCoworkAdapter } from './cowork-adapter.js';
+import { callRemoteLayoutBinding } from './layout-binding-client.js';
+import { readClientProfile } from '../client-profile.js';
 export class NativeLayoutSupervisor {
     configPath;
     runId;
@@ -35,6 +37,8 @@ export class NativeLayoutSupervisor {
         return await this.request(agent, temporary, { action: 'inspect' });
     }
     call(i, request) {
+        if (i.remote)
+            return callRemoteLayoutBinding(i, request, readClientProfile().expectedInstanceId);
         if (i.supervisor !== this.id || !i.agent || typeof i.temporary !== 'boolean')
             throw Error('invalid local layout binding');
         return this.request(i.agent, i.temporary, { ...request, instance: i });
@@ -60,7 +64,13 @@ export class NativeLayoutSupervisor {
         }
         throw Error(`layout agent startup not confirmed: ${name}: ${String(last)}`);
     }
-    async join(i, invite, roomCid) {
+    async join(i, invite, roomCid, membership) {
+        if (i.remote) {
+            if (!membership)
+                throw Error('cross-Fleet join requires room ID and role');
+            await this.call(i, { action: 'join', roomCid, roomId: membership.roomId, roomRole: membership.role });
+            return;
+        }
         await this.call(i, { action: 'join', invite, roomCid });
         const cowork = createCoworkAdapter();
         const deadline = Date.now() + 30_000;
@@ -76,6 +86,8 @@ export class NativeLayoutSupervisor {
         await this.call(i, { action: 'assign', assignment });
     }
     async retire(i) {
+        if (i.remote)
+            throw Error('cannot retire a borrowed cross-Fleet instance');
         if (i.supervisor !== this.id || !i.agent || !/^[A-Za-z0-9_-]+$/.test(i.agent) || i.temporary !== true)
             throw Error('invalid local temporary layout instance');
         const dir = agentDir(i.agent, true);

package/dist/rooms-tasks/layout.d.ts

@@ -16,9 +16,16 @@ export interface LayoutInstance {
     session: string;
     agent?: string;
     temporary?: boolean;
+    remote?: {
+        url: string;
+        grant_id: string;
+        credential_file: string;
+        daemon_instance_id: string;
+    };
 }
 export interface LayoutParticipant {
     agent_template?: string;
+    instance_scope?: 'layout' | 'room';
 }
 export interface LayoutRoom {
     goal: string;
@@ -46,7 +53,10 @@ export interface LayoutSupervisor {
     /** Must verify current launch, CID, live session and standalone ownership. */
     verify(instance: LayoutInstance): Promise<void>;
     spawn(key: string, template: string): Promise<LayoutInstance>;
-    join(instance: LayoutInstance, invite: string, roomCid: string): Promise<void>;
+    join(instance: LayoutInstance, invite: string, roomCid: string, membership?: {
+        roomId: string;
+        role: string;
+    }): Promise<void>;
     assign(instance: LayoutInstance, assignment: LayoutAssignment): Promise<void>;
     /** Retire the exact instance, or confirm it is already stopped; never stop a replacement. */
     retire(instance: LayoutInstance): Promise<void>;
@@ -55,6 +65,8 @@ type ParticipantState = {
     instance?: LayoutInstance;
     owned: boolean;
     retired?: boolean;
+    participant?: string;
+    room?: string;
 };
 type RoomState = {
     spec: LayoutRoom;

package/dist/rooms-tasks/layout.js

@@ -10,8 +10,17 @@ const ownerReference = (owner) => ({ cid: owner.cid, role: owner.role, fingerpri
 const own = (o, key) => Object.hasOwn(o, key);
 function need(ok, message) { if (!ok)
     throw Error(message); }
+/** Room/participant keys cannot contain ':', so scoped instance keys cannot collide. */
+function instanceKey(definition, participant, room) {
+    return definition.participants[participant].instance_scope === 'room' ? `${room}:${participant}` : participant;
+}
 export function validateLayout(def) {
     need(Object.keys(def.rooms).length && Object.keys(def.participants).length, 'rooms and participants required');
+    for (const [key, participant] of Object.entries(def.participants)) {
+        need(participant.instance_scope === undefined || ['layout', 'room'].includes(participant.instance_scope), `invalid instance_scope for ${key}`);
+        if (participant.instance_scope === 'room')
+            need(typeof participant.agent_template === 'string' && participant.agent_template.trim(), `room-scoped participant ${key} requires agent_template`);
+    }
     for (const [key, room] of Object.entries(def.rooms)) {
         need(key.length && room.goal.trim() && room.members.length, 'room goal and members required');
         need(new Set(room.members).size === room.members.length, 'duplicate participant in room');
@@ -37,7 +46,7 @@ export class RoomLayout {
     snapshot() { return JSON.parse(readFileSync(this.file, 'utf8')); }
     save(s) { replaceFileAtomically(this.file, JSON.stringify(s, null, 2)); }
     async verify(i) {
-        need(i.supervisor === this.supervisor.id, 'remote binding unsupported');
+        need(i.supervisor === this.supervisor.id || i.remote, 'remote binding unsupported');
         need(i.launch && i.cid && i.session, 'incomplete instance reference');
         await this.supervisor.verify(i);
     }
@@ -47,8 +56,10 @@ export class RoomLayout {
         this.checkOwnerRoles(definition);
         await withFileLock(this.file + '.lock', async () => {
             need(!existsSync(this.file), 'layout instance already exists');
-            for (const key of Object.keys(bindings))
+            for (const key of Object.keys(bindings)) {
                 need(own(definition.participants, key), 'unknown binding');
+                need(definition.participants[key].instance_scope !== 'room', `binding unsupported for room-scoped participant ${key}`);
+            }
             // Validate every supplied binding before any external mutation.
             for (const [key, p] of Object.entries(definition.participants)) {
                 need(bindings[key] || p.agent_template, `binding required for ${key}`);
@@ -59,7 +70,18 @@ export class RoomLayout {
                 const cids = room.members.flatMap(key => bindings[key] ? [bindings[key].cid] : []);
                 need(new Set(cids).size === cids.length, 'same instance cannot occupy two seats in one room');
             }
-            this.save({ version: 1, definition, controller, ...(this.owner ? { owner: ownerReference(this.owner) } : {}), agent_templates: agentTemplates, participants: Object.fromEntries(Object.keys(definition.participants).map(key => [key, { owned: !bindings[key], ...(bindings[key] ? { instance: bindings[key] } : {}) }])), rooms: {}, order: [], closed: false });
+            const participants = {};
+            for (const [key, participant] of Object.entries(definition.participants)) {
+                if (participant.instance_scope === 'room') {
+                    for (const [room, spec] of Object.entries(definition.rooms))
+                        if (spec.members.includes(key))
+                            participants[instanceKey(definition, key, room)] = { owned: true, participant: key, room };
+                }
+                else
+                    participants[key] = { owned: !bindings[key], ...(bindings[key] ? { instance: bindings[key] } : {}) };
+            }
+            this.save({ version: 1, definition, controller, ...(this.owner ? { owner: ownerReference(this.owner) } : {}),
+                agent_templates: agentTemplates, participants, rooms: {}, order: [], closed: false });
         });
     }
     checkOwnerRoles(definition) {
@@ -94,10 +116,11 @@ export class RoomLayout {
         this.checkOwnerRoles(s.definition);
         need(s.rooms[key]?.state !== 'closed', 'room closed');
         for (const member of spec.members) {
-            const i = s.participants[member]?.instance;
+            const p = s.participants[instanceKey(s.definition, member, key)];
+            const i = p?.instance;
             if (i)
                 await this.verify(i);
-            need(!s.participants[member]?.retired, 'participant retired');
+            need(!p?.retired, 'participant retired');
         }
         if (s.rooms[key]?.state === 'active') {
             await this.assertRoomActive(s, key);
@@ -106,11 +129,11 @@ export class RoomLayout {
         const room = s.rooms[key] ??= { spec, state: 'provisioning', ready: [] };
         this.save(s);
         for (const member of spec.members) {
-            const p = s.participants[member];
+            const resolvedKey = instanceKey(s.definition, member, key), p = s.participants[resolvedKey];
             if (!p.instance) {
                 const template = s.definition.participants[member]?.agent_template;
                 need(template, `no factory for ${member}`);
-                await this.mutation(s, `spawn:${member}`, () => this.supervisor.spawn(member, template), i => { p.instance = i; });
+                await this.mutation(s, `spawn:${resolvedKey}`, () => this.supervisor.spawn(resolvedKey, template), i => { p.instance = i; });
                 await this.verify(p.instance);
             }
         }
@@ -130,13 +153,13 @@ export class RoomLayout {
         for (const member of spec.members) {
             if (room.ready.includes(member))
                 continue;
-            const i = s.participants[member].instance;
+            const i = s.participants[instanceKey(s.definition, member, key)].instance;
             await this.verify(i);
             const seats = await this.cowork.getSeats(room.native.room_id);
             if (!seats.some(seat => seat.identity_cid === i.cid && seat.role === roleFor(member) && seat.seat_state !== 'removed')) {
                 await this.mutation(s, `admit:${key}:${member}`, async () => {
-                    const invitation = await this.cowork.issueInvite(room.native.room_id, { mode: 'one_time', role: roleFor(member), min_accepts: 1 });
-                    await this.supervisor.join(i, invitation.invite, room.native.identity_cid);
+                    const invite = i.remote ? '' : (await this.cowork.issueInvite(room.native.room_id, { mode: 'one_time', role: roleFor(member), min_accepts: 1 })).invite;
+                    await this.supervisor.join(i, invite, room.native.identity_cid, { roomId: room.native.room_id, role: roleFor(member) });
                 }, () => { });
             }
         }
@@ -145,7 +168,7 @@ export class RoomLayout {
         for (const member of spec.members) {
             if (room.ready.includes(member))
                 continue;
-            const i = s.participants[member].instance;
+            const i = s.participants[instanceKey(s.definition, member, key)].instance;
             await this.verify(i);
             await this.mutation(s, `assignment:${key}:${member}`, () => this.supervisor.assign(i, {
                 id: `${key}:${member}`, room_id: room.native.room_id, room_cid: room.native.identity_cid,
@@ -165,9 +188,9 @@ export class RoomLayout {
         const room = s.rooms[key], native = await this.cowork.getRoom(room.native.room_id);
         need(native?.identity_cid === room.native.identity_cid && native.state === 'active', 'native room missing, changed or inactive');
         if (s.owner)
-            need(native.seats.some(seat => seat.identity_cid === s.owner.cid
+            need(native.seats.some(seat => seat.identity_cid.toLowerCase() === s.owner.cid.toLowerCase()
                 && seat.role === s.owner.role && seat.seat_state === 'active'), 'owner membership not active');
-        need(room.spec.members.every(member => native.seats.some(seat => seat.identity_cid === s.participants[member].instance.cid
+        need(room.spec.members.every(member => native.seats.some(seat => seat.identity_cid === s.participants[instanceKey(s.definition, member, key)].instance.cid
             && seat.role === (room.spec.roles?.[member] ?? member) && seat.seat_state === 'active')), 'membership not active');
     }
     async archiveRoom(s, key) {

package/dist/web/prefix-gateway.d.ts

@@ -6,6 +6,8 @@ export interface ServiceTarget {
     origin: string;
     /** Server-side service credentials; never taken from browser headers. */
     headers?: Record<string, string>;
+    /** Dedicated credential-authenticated services reject direct browser context. */
+    stripBrowserContext?: boolean;
 }
 export interface GatewayOptions {
     /** Backend mode is for a separate loopback machine-client listener; browsers are rejected. */

package/dist/web/prefix-gateway.js

@@ -45,6 +45,10 @@ export function createPrefixGateway(options) {
                 for (const name of ['cookie', 'authorization', 'x-csrf-token', 'x-ours-api-token'])
                     delete headers[name];
             Object.assign(headers, route.service.headers);
+            if (route.service.stripBrowserContext) {
+                for (const name of ['origin', 'sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest', 'sec-fetch-user'])
+                    delete headers[name];
+            }
             headers.host = new URL(route.origin).host;
         }
         if (upgrade) {

package/dist/web/runtime.js

@@ -1,4 +1,8 @@
+import { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
+import { RoomLayoutService } from '../rooms-tasks/layout-service.js';
 import { spawn } from 'node:child_process';
+import { FleetNotificationProducer } from '../notifications/fleet-producer.js';
+import { producerConfig } from '../notifications/outbox.js';
 import { SubscriptionService } from '../subscriptions/service.js';
 import { existsSync, realpathSync } from 'node:fs';
 import { resolve } from 'node:path';
@@ -14,7 +18,7 @@ import { FleetError } from '../application/errors.js';
 import { controlRequest, controlSocketPath } from '../session/control.js';
 import { pickBackend } from '../supervisor/index.js';
 import { realExec } from '../exec.js';
-import { home, stateRoot } from '../paths.js';
+import { home, stateRoot, agentsRoot, tmpRoot } from '../paths.js';
 import { AuditSink } from './audit.js';
 import { FleetEventBus } from './events.js';
 import { buildWebServer } from './server.js';
@@ -50,6 +54,7 @@ function cachedConfigProvider(configPath) {
     };
 }
 export async function startWebConsole(options) {
+    const notificationConfig = producerConfig();
     const requestedPort = options.port ?? 49_271;
     if (!Number.isInteger(requestedPort) || requestedPort < 0 || requestedPort > 65_535)
         throw new FleetError('invalid_request', 'port must be between 0 and 65535');
@@ -164,6 +169,7 @@ export async function startWebConsole(options) {
             query, repository, logs, commands, creation, removal, audit, events, watchdogs, configuration,
             taskRooms: new TaskRoomApplicationService(options.configPath, { binPath: () => options.binPath }),
             roomLayouts: new RoomLayoutDefinitions(options.configPath),
+            layoutBindings: new LayoutBindingGrants(new RoomLayoutService(options.configPath).supervisor()),
             presetProvenance: new PresetProvenance(options.configPath),
             topology: readTopology, topologyDrafts, topologyPromote,
             subscriptions: new SubscriptionService({
@@ -233,10 +239,12 @@ export async function startWebConsole(options) {
     if (options.open !== false)
         openBrowser(access.mode === 'pairing'
             ? `${browserOrigin}/#bootstrap=${server.auth.bootstrapSecret}` : `${browserOrigin}/`);
+    const notifications = notificationConfig ? new FleetNotificationProducer([agentsRoot(), tmpRoot()], resolve(webDir, 'notification-outboxes'), notificationConfig, options.log) : undefined;
     return {
         ...server, address: browserOrigin,
         async close() {
             try {
+                await notifications?.close();
                 await control?.close();
                 await server.close();
             }

package/dist/web/server.d.ts

@@ -19,7 +19,9 @@ import type { TaskRoomApplicationService } from '../application/task-room-servic
 import type { RoomLayoutDefinitions } from '../application/room-layout-definitions.js';
 import type { PresetProvenance } from '../application/preset-provenance.js';
 import type { SubscriptionService } from '../subscriptions/service.js';
+import type { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
 export interface WebServices {
+    layoutBindings?: Pick<LayoutBindingGrants, 'control'>;
     query: FleetQueryService;
     repository: RoleRepository;
     session(roleId: string): Promise<RoleSessionControl>;

package/dist/web/server.js

@@ -55,8 +55,20 @@ export async function buildWebServer(services, boundary, options = {}) {
             return reply.code(421).type('text/html').send(`<!doctype html><html><head><title>Fleet console address</title></head><body><main><h1>This fleet-console address is not configured</h1><p>${escapeHtml(message)}</p><p>For nginx or VPS access, configure an explicit public origin. The console does not guess proxy hosts.</p></main></body></html>`);
         }
     });
+    app.post('/api/v1/layout-bindings/:id/control', async (request) => {
+        // Initial support is direct same-host Fleet-to-Fleet transport.
+        const forwarded = Object.keys(request.headers).some(name => name === 'forwarded' || name.startsWith('x-forwarded-') || name === 'x-real-ip' || name === 'via');
+        if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(request.ip) || forwarded)
+            throw new FleetError('forbidden', 'layout bindings require direct loopback access');
+        // Machine credentials cannot authenticate browser or lifecycle routes.
+        if (request.headers.origin)
+            auth.validateBoundary(request, true);
+        if (!services.layoutBindings)
+            throw new FleetError('capability_unavailable', 'layout bindings unavailable');
+        return services.layoutBindings.control(request.params.id, request.headers.authorization, request.body);
+    });
     app.setErrorHandler(async (error, request, reply) => {
-        const privateToolParseError = request.routeOptions.url === '/api/v1/roles/:id/ours/call'
+        const privateToolParseError = ['/api/v1/roles/:id/ours/call', '/api/v1/layout-bindings/:id/control'].includes(request.routeOptions.url ?? '')
             && error instanceof Error && 'code' in error
             && typeof error.code === 'string' && error.code.startsWith('FST_ERR_CTP_');
         const fleetError = normalizeError(privateToolParseError
@@ -925,7 +937,11 @@ export async function buildWebServer(services, boundary, options = {}) {
         app.setNotFoundHandler((request, reply) => {
             if (request.url.startsWith('/api/'))
                 return reply.code(404).send({ error: 'not found' });
-            return reply.sendFile('index.html');
+            const path = request.url.split('?')[0];
+            if ((path === '/chats' || path.startsWith('/chats/')) && existsSync(join(staticRoot, 'fleet-index.html')))
+                return reply.redirect((request.url.includes('?') ? '/fleet/chats' : '/fleet') + (request.url.includes('?') ? request.url.slice(request.url.indexOf('?')) : ''));
+            const fleetEntry = (path === '/fleet' || path.startsWith('/fleet/')) && existsSync(join(staticRoot, 'fleet-index.html'));
+            return reply.sendFile(fleetEntry ? 'fleet-index.html' : 'index.html');
         });
     }
     return {

package/docs/room-layouts.md

@@ -25,17 +25,43 @@ rooms:
     roles: {product: product, developer: developer, qa: qa}
 ```
 
-Repeating a participant key reuses its exact running instance and session.
-Different keys using the same Agent Template create independent instances.
+Participant `instance_scope` controls instance reuse:
+
+- `layout` (default): repeating a participant key reuses its exact running instance
+  and session within this layout run.
+- `room`: each room using the key gets its own identity and session, lazily created
+  when that room opens. Repeated opens of the same active room reuse that instance.
+
+For example, one shared process doctor and one independent critic per room:
+
+```yaml
+version: 1
+participants:
+  doctor: {agent_template: ProcessDoctor, instance_scope: layout}
+  critic: {agent_template: Critic, instance_scope: room}
+rooms:
+  discovery:
+    goal: Agree on the problem
+    members: [doctor, critic]
+  design:
+    goal: Review the design
+    members: [doctor, critic]
+```
+
+Different keys using the same Agent Template still create independent instances.
 See the [shared](../examples/room-layouts/shared.yaml) and
-[fresh](../examples/room-layouts/fresh.yaml) examples. Both choices can coexist.
+[fresh](../examples/room-layouts/fresh.yaml) examples, and the mixed
+[scoped](../examples/room-layouts/scoped.yaml) example. All choices can coexist.
 Fresh agents receive their room context. Supply relevant evidence through ordinary
 room messages or existing project documents when needed.
 
 A participant without `agent_template` requires a binding. `layout instance`
 returns a local exact reference (supervisor, agent, launch, CID and session).
-Pass participant-to-reference YAML to `create --bindings`. A stopped, replaced
-or remote instance is rejected.
+Pass participant-to-reference YAML to `create --bindings`. A stopped or replaced instance is rejected. Cross-Fleet bindings require
+an explicit owner grant, as described below.
+Room-scoped participants require `agent_template`; an explicit binding for them
+is rejected before creating resources. Bindings for layout-scoped participants
+keep their existing behavior.
 
 ```sh
 ours-fleet layout validate work
@@ -57,15 +83,28 @@ an agent contributes. Each room opens through an explicit command.
 archives opened rooms and stops only temporary participants created by this layout
 instance. Explicitly bound participants survive. Cleanup processes existing resources. A 3-Amigos room is an ordinary room with
 complementary members.
+Room-scoped instances follow the same cleanup rules: closing a room does not
+retire them, and a closed room cannot reopen. A new layout run creates new instances.
+
+Private state keeps the authorable definition unchanged. Its `participants` map
+uses the original key for shared instances and `<room>:<participant>` for
+room-scoped instances, with `participant` and `room` metadata. Declared but unopened
+rooms have no running instance. Status and task read models distinguish these
+entries and resolve their original Agent Template. Existing snapshots without
+`instance_scope` retain their original keys and require no migration. Snapshots
+using `room` require a Fleet version that supports this field; they are not a
+downgrade format for older Fleet versions.
 
 Supported room fields: `goal`, `members`, optional `roles`, `contract`,
 `quiet_membership`, `anonymous`. `contract` is briefing text.
 Top-level fields: `version: 1`, optional `description`, `participants`, `rooms`.
+Participant fields: optional `agent_template`, `instance_scope: layout|room`.
 Unknown fields, ambiguous YAML and invalid member references are rejected.
 Existing templates and tasks keep their behavior.
 
-Only local Fleet control is supported. The existing authenticated control socket,
-agent runtime, `spawnTemp` and session queue perform operations. Private state
+Local Fleet control uses the existing authenticated control socket,
+agent runtime, `spawnTemp` and session queue. Cross-Fleet bindings delegate
+membership operations to their owning Fleet as described below. Private state
 snapshots template definitions; public status hides their environment values.
 Existing owner settings apply; owner CID/invite fingerprint are pinned. Unknown
 mutation outcomes stop new work for inspection rather than blindly replaying a
@@ -90,3 +129,99 @@ Definitions are loaded for authoring commands. Retained instances use their save
 layout and Agent Templates. Status and cleanup operate on saved resources even
 when the source YAML is broken or removed. New agent launches continue to use
 Fleet's normal configuration and launch checks.
+
+## Borrowing an instance from another Fleet on the same host
+
+Fleet A can open rooms using standalone temporary or persistent agents supervised
+by Fleet B under another OS user. Both must select the same daemon instance and
+Cowork gateway. An agent's original Fleet keeps its session, identity and lifecycle
+control. This extends layout bindings; it does not add bindings to legacy
+`room create` / RoomTemplate provisioning.
+
+On the agent owner's Fleet B, use its existing web server and grant access to an
+exact live standalone instance:
+
+```sh
+ours-fleet web serve --port 49272 --no-open
+# In another terminal belonging to Fleet B's owner:
+ours-fleet layout share Architect --temporary --participant architect \
+  --server-url http://127.0.0.1:49272 --output ./architect.binding.yaml
+```
+
+The command prints the grant ID and output path. It creates a binding YAML and
+an adjacent `.token` file, both owner-only. The private owner record stores a
+SHA-256 token digest, not the token. `share` never overwrites an existing export.
+Transfer both files explicitly to Fleet A's user through your existing secure
+file-transfer method, keeping the receiving credential file owned by that user
+with mode `0600`. Do not share Fleet B's console session, client profile, daemon
+credential, private state directory or supervisor socket. This feature creates
+no additional server; Fleet B's existing web server must remain available.
+
+Export each specialist under its logical layout participant key, then merge the
+YAML mappings into one bindings document. Keep every adjacent token filename
+unique. Relative credential paths resolve against the bindings file's directory.
+The reusable layout contains participant factories or empty participant mappings,
+never concrete credentials or running-instance references:
+
+```yaml
+version: 1
+participants:
+  architect: {}
+  developer: {}
+  doctor: {}
+rooms:
+  product: {goal: Scope, members: [architect, doctor]}
+  design: {goal: Design, members: [architect, developer, doctor]}
+  delivery: {goal: Delivery, members: [developer, doctor]}
+```
+
+On Fleet A:
+
+```sh
+ours-fleet layout create project --id project-run --bindings ./bindings.yaml
+ours-fleet layout open project-run product
+ours-fleet layout open project-run design
+ours-fleet layout open project-run delivery
+ours-fleet layout close-room project-run product
+ours-fleet layout close project-run
+```
+
+The exact CID, launch and harness session are reused. Reopening an active room
+checks existing membership without delivering duplicate context. Closing rooms
+archives Cowork history and never stops borrowed instances. After acceptance,
+the original Fleet B owner explicitly retires its standalone temporary specialists
+using the existing lifecycle commands. Persistent specialists keep their ordinary
+lifecycle. Mixed local-created and borrowed participants are supported.
+
+An exported reference adds `remote` to the existing instance reference:
+
+```yaml
+remote:
+  url: http://127.0.0.1:49272
+  grant_id: 11111111-1111-4111-8111-111111111111
+  credential_file: architect.binding.yaml.token
+  daemon_instance_id: 22222222-2222-4222-8222-222222222222
+```
+
+The grant authorizes only `verify`, `join`, and `assign` for that exact instance.
+Room admission validates the requested room ID and CID against shared Cowork and
+uses an invite issued by Cowork on the owner side; caller-supplied contact invites
+are rejected before contact mutation. Context delivery also requires its active seat, expected room CID and role in
+Cowork. It cannot inspect inventory, spawn, stop, reconfigure, export identities,
+or authenticate browser console routes. It grants the holder room admission and
+room-context delivery, so transfer it only to the intended room creator.
+
+Owner-side revocation does not stop the agent or remove existing memberships:
+
+```sh
+ours-fleet layout revoke-binding <grant-id>
+```
+
+Stopped/replaced sessions, a different daemon, revoked grants or unavailable
+owner transport produce errors; no replacement is spawned. A lost response to a
+membership/context mutation retains the existing layout `uncertain` marker.
+Inspect the native room and owning Fleet before retrying; no mutation is blindly
+replayed. Only direct loopback HTTP origins (`127.0.0.1`) are supported;
+redirects, external hosts and forwarded requests are rejected. No cross-host
+support, discovery protocol, mission service, or room conversation limits are
+introduced.

package/examples/room-layouts/scoped.yaml

@@ -0,0 +1,21 @@
+version: 1
+description: Shared specialists and one independent reviewer per room
+participants:
+  architect:
+    agent_template: Architect
+    instance_scope: layout
+  developer:
+    agent_template: Developer
+  reviewer:
+    agent_template: Reviewer
+    instance_scope: room
+rooms:
+  product:
+    goal: Agree on the problem and acceptance criteria
+    members: [architect, reviewer]
+  design:
+    goal: Design the accepted solution
+    members: [architect, developer, reviewer]
+  delivery:
+    goal: Implement and verify the accepted design
+    members: [developer, reviewer]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.23",
+  "version": "1.2.0-nightly.25",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",