@ours.network/fleet 1.2.0-nightly.36 → 1.2.0-nightly.38

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.36",
-  "buildId": "63df63bcda45",
-  "commit": "b4575c95acd1ae2fee42f8f8871bfe9d816a1b1a",
+  "version": "1.2.0-nightly.38",
+  "buildId": "2eaafbd42c9d",
+  "commit": "86c7af960f9b2cfdbf4dcddee25bc7303e78780c",
   "dirty": true,
-  "builtAt": "2026-10-02T18:04:01.351Z",
+  "builtAt": "2026-10-02T21:39:35.791Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/harness/claude-code.js

@@ -6,7 +6,8 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { bundledAcpAgent } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
+import { hostClaude } from './claude-runtime.js';
 import { ClaudeCodeAgentSessionAdapter } from './claude-code-session.js';
 const OPTION_KEYS = [
     'plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode', 'effort',
@@ -283,6 +284,13 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             };
             if (!memPalace)
                 env.MEMPALACE_DISABLED = 'true';
+            // The bundled adapter runs the Claude Code shipped with its SDK unless told otherwise. A host
+            // Claude Code at least as new as that copy is the one the person updates, so sessions run it.
+            if (!customAcpCommand(role)) {
+                const host = hostClaude(resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').manifestPath, { ...process.env, ...role.env }, dirs.runCwd);
+                if (host)
+                    env.CLAUDE_CODE_EXECUTABLE = host.path;
+            }
             // Per-role harness runtime home. Created before sandbox entry so the
             // bind has something to mount; harmless for un-isolated roles.
             // Only a role that declares `isolation:` gets a sandbox, and only a

package/dist/harness/claude-runtime.d.ts

@@ -0,0 +1,12 @@
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export declare function bundledClaudeVersion(adapterManifest: string): string | undefined;
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export declare function hostClaude(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;

package/dist/harness/claude-runtime.js

@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { codexVersionAtLeast, executableOnPath } from './codex-runtime.js';
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedClaudeVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export function bundledClaudeVersion(adapterManifest) {
+    try {
+        const sdk = dirname(createRequire(adapterManifest).resolve('@anthropic-ai/claude-agent-sdk'));
+        const version = JSON.parse(readFileSync(join(sdk, 'package.json'), 'utf8')).claudeCodeVersion;
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export function hostClaude(adapterManifest, env, cwd = process.cwd(), version = installedClaudeVersion) {
+    if (env.CLAUDE_CODE_EXECUTABLE !== undefined || !adapterManifest)
+        return undefined;
+    const bundled = bundledClaudeVersion(adapterManifest);
+    if (!bundled)
+        return undefined;
+    let path;
+    try {
+        path = executableOnPath('claude', env, cwd);
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}

package/dist/init-wizard.d.ts

@@ -53,6 +53,8 @@ export declare function validateCatalog(value: BrainCatalog, path?: string): Bra
 export declare function readInitSettings(path: string): InitAnswers;
 export declare function askInitQuestions(prompter: InitPrompter, configuration: string): Promise<InitAnswers | undefined>;
 export declare function formatSetupSummary(answers: InitAnswers, configuration: string): string;
+/** The packaged Brain preset for a catalog model at one effort; the same naming the presets are generated with. */
+export declare function brainPresetId(model: Pick<CatalogModel, 'harness' | 'model'>, effort: string): string;
 /** Build the exact, deterministic default experience without writing to disk. */
 export declare function generateSetup(answers: InitAnswers): GeneratedSetup;
 /** Run the mutation boundary only after the complete questionnaire is accepted. */

package/dist/init-wizard.js

@@ -173,6 +173,7 @@ export function formatSetupSummary(answers, configuration) {
         '  Team: LocalCoordinator + Developer + Critic',
         '  Gated engineering: Engineer (gate pipeline) + independent Critic',
         '  FleetCoordinator: coordination model',
+        '  Brains: the packaged presets; each prepared agent references the preset of its chosen model',
         '',
         'After the final Yes, Fleet performs host service setup before publishing the complete configuration.',
         'A hard termination after that Yes can leave host integration or private stage/recovery evidence to inspect.',
@@ -181,6 +182,11 @@ export function formatSetupSummary(answers, configuration) {
 function preset(relative) {
     return readFileSync(join(packagedPresetRoot(), 'fleet', relative), 'utf8');
 }
+/** The packaged Brain preset for a catalog model at one effort; the same naming the presets are generated with. */
+export function brainPresetId(model, effort) {
+    return `${model.harness === 'claude-code' ? 'claude' : 'codex'}-${model.model
+        .replace(/^claude-/, '').replace(/\./g, '-').toLowerCase()}-${effort}`;
+}
 /** Build the exact, deterministic default experience without writing to disk. */
 export function generateSetup(answers) {
     const effort = REASONING_EFFORT[answers.reasoning];
@@ -201,6 +207,7 @@ export function generateSetup(answers) {
         '  permissions: { approval: ask, filesystem: workspace, unattended: deny }',
         '',
     ].join('\n'));
+    const assigned = {};
     for (const work of WORK_KINDS) {
         const proposed = answers.models[work];
         if (!proposed || !answers.subscriptions.includes(subscriptionFor(proposed)))
@@ -214,14 +221,14 @@ export function generateSetup(answers) {
             throw new Error(`${work} contains tampered model capabilities`);
         if (!model.efforts.includes(effort))
             throw new Error(`${MODEL_LABELS[model.model]} does not support ${answers.reasoning} reasoning`);
-        files.set(`brains/${work}.yaml`, [
-            `harness: ${model.harness}`,
-            `session: ${model.session}`,
-            `model: ${model.model}`,
-            `effort: ${effort}`,
-            '',
-        ].join('\n'));
+        // The chosen model is assigned by reference to its packaged Brain preset; setup defines no Brain of its own.
+        const id = brainPresetId(model, effort);
+        if (!existsSync(join(packagedPresetRoot(), 'fleet', 'brains', `${id}.yaml`)))
+            throw new Error(`no packaged Brain preset for ${MODEL_LABELS[model.model]} at ${effort} reasoning`);
+        assigned[work] = id;
     }
+    for (const name of readdirSync(join(packagedPresetRoot(), 'fleet', 'brains')).filter(name => name.endsWith('.yaml')).sort())
+        files.set(`brains/${name}`, preset(`brains/${name}`));
     if (answers.assignmentStrategy === 'one-model') {
         const tuples = new Set(WORK_KINDS.map(work => {
             const model = answers.models[work];
@@ -236,7 +243,7 @@ export function generateSetup(answers) {
             continue;
         files.set(`agent_templates/${role}.yaml`, [
             `role: { ref: ${role} }`,
-            `brain: { ref: ${ROLE_WORK[role]} }`,
+            `brain: { ref: ${assigned[ROLE_WORK[role]]} }`,
             'coordinator: FleetCoordinator',
             // Temporary default while the product is being tested: prepared agents work without asking.
             'permissions: { approval: allow, filesystem: unrestricted, unattended: deny }',
@@ -245,7 +252,7 @@ export function generateSetup(answers) {
         ].join('\n'));
     }
     files.set('agents/FleetCoordinator.yaml', preset('agents/FleetCoordinator.yaml')
-        .replace('brain: { ref: claude-default }', 'brain: { ref: coordination }'));
+        .replace('brain: { ref: claude-default }', `brain: { ref: ${assigned.coordination} }`));
     for (const name of ['single', 'pair', 'team', 'engineering']) {
         files.set(`room_templates/${name}.yaml`, preset(`room_templates/${name}.yaml`));
         files.set(`room_layouts/${name}.yaml`, preset(`room_layouts/${name}.yaml`));

package/dist/preset-migration.js

@@ -67,6 +67,14 @@ const V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
     'agent_templates/Developer.yaml': 'fdd953aab72d042e62780dd273598745aae59521b39edf4876d7676bb7189c83',
     'agent_templates/Critic.yaml': '3e98a28f17876061cfadf984351aa59fdbe19629e514eff52c74546545c64a91',
 });
+// The packaged Coordinator role of revisions 8 and 9 addressed a named owner channel that a
+// fresh installation does not have. Untouched copies adopt the current role; edited ones stay.
+const OWNER_CHANNEL_COORDINATOR_FINGERPRINTS = Object.freeze({
+    'roles/Coordinator.yaml': [
+        '8c8ad28d9bb9ddf9dba8c5c9c7859f25edd8fa10ebf833e2340124a6e49583ec',
+        'f0d8b169ad0a18051b57e5280b93cf01e05faa5c12f4e12bdf89973edf2ef58a',
+    ],
+});
 const CURRENT_ROLE_DEFAULTS = new Set([
     'roles/Coordinator.yaml', 'roles/LocalCoordinator.yaml', 'roles/Developer.yaml', 'roles/Critic.yaml',
     'roles/Engineer.yaml',
@@ -196,6 +204,7 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
             ...Object.keys(V3_ROLE_DEFAULT_FINGERPRINTS),
             ...Object.keys(V4_ROLE_DEFAULT_FINGERPRINTS),
             ...Object.keys(V5_ROLE_DEFAULT_FINGERPRINTS),
+            ...Object.keys(OWNER_CHANNEL_COORDINATOR_FINGERPRINTS),
         ]);
         for (const relative of known) {
             const path = join(root, relative);
@@ -209,6 +218,7 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
                 V4_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
                 V5_ROLE_DEFAULT_FINGERPRINTS[relative],
                 V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
+                ...(OWNER_CHANNEL_COORDINATOR_FINGERPRINTS[relative] ?? []),
             ].some(expected => expected !== undefined && actual === expected);
             if (recognized)
                 (CURRENT_ROLE_DEFAULTS.has(relative) ? replacements : removals).push(path);

package/dist/session/acp.d.ts

@@ -339,7 +339,10 @@ export declare class AcpSession implements AgentSession {
      * signal. Never infer commentary from text, message order, or unknown meta.
      */
     private codexMessagePhase;
-    /** Normalize every ACP update losslessly into the durable ledger. */
+    /**
+     * Normalize every ACP update losslessly into the durable ledger. The ledger is the conversation the
+     * owner reads, so the agent's commentary between its tools is kept as written, like its final answer.
+     */
     private recordConversationUpdate;
     taskNoticeBinding(): TaskNoticeBinding | undefined;
     recordTaskCreated(binding: TaskNoticeBinding, notice: TaskCreatedNotice): void;

package/dist/session/acp.js

@@ -38,7 +38,6 @@ const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 /** Consumed only by Fleet's authenticated bundled-Codex app-server proxy. */
 export const CODEX_DISABLE_INHERITED_MCP_ENV = 'OURS_FLEET_CODEX_DISABLE_INHERITED_MCP';
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
-const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
 const MAX_CANONICAL_SYMLINK_DEPTH = 40;
 const scheduledTurn = (turn) => turn?.origin?.kind === 'scheduled-loop';
 /**
@@ -1711,7 +1710,7 @@ export class AcpSession {
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;
-        this.recordConversationUpdate(update, scheduled, messagePhase === 'commentary');
+        this.recordConversationUpdate(update, scheduled);
         if (update.sessionUpdate === 'config_option_update')
             this.captureRuntimeMetadata(update.configOptions);
         if (update.sessionUpdate === 'usage_update') {
@@ -1795,13 +1794,15 @@ export class AcpSession {
             return undefined;
         return phase === 'commentary' || phase === 'final_answer' ? phase : 'ambiguous';
     }
-    /** Normalize every ACP update losslessly into the durable ledger. */
-    recordConversationUpdate(update, scheduled, commentary = false) {
+    /**
+     * Normalize every ACP update losslessly into the durable ledger. The ledger is the conversation the
+     * owner reads, so the agent's commentary between its tools is kept as written, like its final answer.
+     */
+    recordConversationUpdate(update, scheduled) {
         const normalized = normalizeSessionUpdate(update, scheduled ? {
             redactText: SCHEDULED_LOOP_REDACTION,
             redactToolCallId: 'scheduled-loop-tool',
-        }
-            : commentary ? { redactText: OWNER_COMMENTARY_REDACTION } : {});
+        } : {});
         this.conversation.appendSafe({
             kind: normalized.kind,
             sessionGeneration: this.sessionGeneration,

package/dist/session/codex-app-server.js

@@ -14,7 +14,6 @@ const INTERRUPT_TERMINATE_GRACE_MS = 5_000;
 const TERMINAL_RECONCILE_QUIET_MS = 2_000;
 const TERMINAL_RECONCILE_REQUEST_TIMEOUT_MS = 5_000;
 const SCHEDULED_REDACTION = '[scheduled-loop content redacted]';
-const COMMENTARY_REDACTION = '[assistant commentary redacted]';
 const OWNER_ADMIN_CONTEXT_KEY = 'ours-fleet://prompt-provenance?source=owner_admin_console';
 const OWNER_CHANNEL_CONTEXT_KEY = 'ours-fleet://prompt-provenance?source=owner_channel';
 const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -719,7 +718,7 @@ export class CodexAppServerSession {
             promptId: this.activeTurn?.promptId, turnId: this.activeTurn?.promptId,
             messageId: id, source: 'agent',
             payload: {
-                role: 'assistant', content: textBlock(delta, scheduled ? SCHEDULED_REDACTION : phase === 'commentary' ? COMMENTARY_REDACTION : undefined),
+                role: 'assistant', content: textBlock(delta, scheduled ? SCHEDULED_REDACTION : undefined),
             },
         });
     }

package/dist/web/server.js

@@ -202,9 +202,13 @@ export async function buildWebServer(services, boundary, options = {}) {
                 throw new FleetError('backend_failure', `Fleet setup did not complete: ${error.message}`);
             }
             // Setup preserves files it finds, so confirm the published models are the ones this request chose.
-            const brains = configuration.read(true).model.brains ?? {};
+            // The prepared agents reference packaged Brain presets, so resolve what each of them now points at:
+            // a preserved file of a packaged name may hold another model, session or reasoning than its name says.
+            const published = configuration.read(true).model, brains = published.brains ?? {};
+            const brainOf = (holder) => brains[String(holder?.brain?.ref ?? '')];
+            const assigned = { coordination: brainOf(published.agents.FleetCoordinator), development: brainOf(published.agent_templates?.Developer), review: brainOf(published.agent_templates?.Critic) };
             for (const work of ONBOARDING_WORK)
-                if (brains[work]?.harness !== models[work].harness || brains[work]?.model !== models[work].model)
+                if (assigned[work]?.harness !== models[work].harness || assigned[work]?.model !== models[work].model || assigned[work]?.session !== models[work].session || assigned[work]?.effort !== 'medium')
                     throw new FleetError('conflict', 'Fleet was set up with different models; review its configuration');
             return { configured: true };
         });

package/dist/workspace-enrollment.d.ts

@@ -1,3 +1,4 @@
+import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
 export interface WorkspacePayload {
     version: 1;
     appOrigin: string;
@@ -16,18 +17,24 @@ export interface WorkspacePayload {
     };
 }
 export declare function readWorkspacePayload(file: string): WorkspacePayload;
+type DaemonClient = Pick<OursClient, 'listIdentities' | 'chooseIdentity' | 'addContact' | 'listContacts' | 'sendCommand' | 'removeContact' | 'releaseLease' | 'close'>;
+/** How tunnel setup reaches this host's daemon; replaced only by tests. */
+export type AttachDaemonClient = (options: AttachOursClientOptions) => Promise<DaemonClient>;
 /**
  * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
  * Reads only; an existing Owner is compared with this host's own Messenger identity.
  */
-export declare function checkWorkspaceConfiguration(configuration?: string): Promise<void>;
+export declare function checkWorkspaceConfiguration(configuration?: string, attach?: AttachDaemonClient): Promise<void>;
 export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
     migrateAppOrigin?: boolean;
     preserveProfile?: boolean;
+    attach?: AttachDaemonClient;
+    contactWaitMs?: number;
+    afterInvitation?: () => void;
 }): Promise<{
     origin: string;
     hostWorkspaceId: string;
-    rootCid: any;
+    rootCid: string;
 }>;
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
 /**
@@ -35,7 +42,7 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
  * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
  * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
  */
-export declare function removeEnrollmentContact(): Promise<boolean>;
+export declare function removeEnrollmentContact(attach?: AttachDaemonClient): Promise<boolean>;
 export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
 /**
  * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
@@ -43,3 +50,4 @@ export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, '
  * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
  */
 export declare function confirmWorkspaceTarget(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number, cleanupFailed?: (error: unknown) => void): Promise<void>;
+export {};

package/dist/workspace-enrollment.js

@@ -5,7 +5,9 @@ import { readClientProfile } from './client-profile.js';
 import { stateRoot, defaultConfigPath, workspaceOwnerInvite } from './paths.js';
 import { replaceFileAtomically } from './atomic-file.js';
 import { loadConfig, splitRootFor } from './config.js';
-import { parse, stringify } from 'yaml';
+import { parse, parseDocument, stringify } from 'yaml';
+import { randomUUID } from 'node:crypto';
+import { attachOursClient } from '@ours.network/sdk/client';
 import { preflightInitPaths } from './init-wizard.js';
 import { WebAccessStore } from './web/access.js';
 import { WorkspaceDeviceStore } from './web/workspace-devices.js';
@@ -71,14 +73,105 @@ function hostMessenger() {
     const secret = readFileSync(profile.credentialPath, 'utf8').trim();
     return async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
         await response.body?.cancel();
-        throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
+        throw Object.assign(Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying'), { status: response.status });
     } return response.json(); };
 }
+const daemon = (attach, purpose) => { const profile = readClientProfile(); return attach({ endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId, credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken: `ours-fleet-workspace-${purpose}-${process.pid}-${randomUUID()}`, env: {} }); };
+const CID = /^[a-f0-9]{64}$/i, same = (a, b) => a.toLowerCase() === b.toLowerCase();
+/**
+ * Who this host's Messenger is. Messenger either runs as the Human root itself, or as the person's own
+ * identity and then names the root the daemon describes for it. That is accepted only when this host's
+ * daemon, asked by Fleet itself, lists exactly one Human root, that root is the named one, and the
+ * Messenger identity is listed as a permanent identity under it.
+ */
+async function messengerIdentity(request, attach) {
+    const bound = await request('workspace/enrollment-identity');
+    if (bound.rootCid === undefined)
+        return { cid: bound.cid, preserveProfile: bound.preserveProfile === true };
+    if (typeof bound.cid !== 'string' || !CID.test(bound.cid) || typeof bound.rootCid !== 'string' || !CID.test(bound.rootCid) || same(bound.cid, bound.rootCid))
+        throw Error('Bound Messenger identity unavailable');
+    const root = await humanRoot(attach, bound.rootCid, bound.cid);
+    return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, root };
+}
+/** This host's only Human root, as its daemon lists it; optionally with a permanent identity that must be listed under it. */
+async function humanRoot(attach, rootCid, under) {
+    const client = await daemon(attach, 'identities');
+    const rows = await client.listIdentities().finally(() => client.close());
+    const roots = rows.filter(row => 'kind' in row && row.kind === 'root'), root = roots[0], row = under === undefined ? undefined : rows.find(row => 'cid' in row && same(row.cid, under));
+    if (roots.length !== 1 || !('kind' in root) || !same(root.cid, rootCid) || (under !== undefined && (!row || !('kind' in row) || row.kind !== 'role' || row.temp !== null)))
+        throw Error("This host's Messenger identity is not a permanent identity under this host's Human root. Tunnel setup changed nothing.");
+    return { name: root.name, cid: root.cid };
+}
+/** Run one operation as the Human root and always give the root back, whatever happens. */
+async function asHumanRoot(attach, root, purpose, use) {
+    const client = await daemon(attach, purpose);
+    let done = false;
+    try {
+        const bound = await client.chooseIdentity({ name: root.name, force: false }).catch((error) => {
+            throw Error(`This host's Human root cannot be used right now (${error.code ?? error.message}). Close the session that holds it, then run setup again. Nothing was changed.`);
+        });
+        if (!same(bound.cid, root.cid))
+            throw Error("This host's Human root changed while setup was running. Nothing was changed.");
+        const result = await use(client);
+        // The operation is not reported as done while the root may still be held. The release is attempted exactly once.
+        done = true;
+        const released = await client.releaseLease();
+        if (released.failed > 0)
+            throw Error("This host's Human root was not given back completely. Run setup again.");
+        return result;
+    }
+    finally {
+        // After a failure the root is released once as well; what failed first is what is reported.
+        if (!done)
+            await client.releaseLease().catch(() => { });
+        await client.close().catch(() => { });
+    }
+}
+/** The signed workspace binding, sent by the Human root itself: the same command Messenger sends when it runs as the root. */
+async function proveWithHumanRoot(attach, root, payload, hostWorkspaceId, contactWaitMs) {
+    const serverCid = payload.serverCid.toUpperCase();
+    await asHumanRoot(attach, root, 'proof', async (client) => {
+        const peer = await client.addContact({ invite: payload.invitation });
+        if (peer.cid.toUpperCase() !== serverCid)
+            throw Error('Enrollment server identity mismatch');
+        const deadline = Date.now() + contactWaitMs;
+        while (!(await client.listContacts()).contacts.some(contact => contact.container_id.toUpperCase() === serverCid)) {
+            if (Date.now() >= deadline)
+                throw Error('Enrollment contact is not ready; obtain a fresh setup payload before retrying');
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+        const outcome = await client.sendCommand({ contact: serverCid, command: 'bind-workspace', arguments: { type: 'ours.app.bind-workspace.v1', accountId: payload.challenge.accountId, workspaceId: payload.challenge.workspaceId, nonce: payload.challenge.nonce, hostWorkspaceId } });
+        if (!('sent' in outcome) || !outcome.sent)
+            throw Error('Workspace proof was not sent');
+    });
+}
+/**
+ * True when the Owner entry is the one tunnel setup manages and it still names the Human root of an
+ * installation whose Messenger now runs as the person's own identity under that root. Only then is the
+ * entry moved to that identity; an Owner entry anyone else wrote is never touched.
+ */
+function managedRootOwner(configuration, rooms, root) {
+    if (!same(rooms.owner.expected_cid, root.cid) || rooms.owner.public_invite_file !== workspaceOwnerInvite() || rooms.defaults?.attach_owner === false)
+        return false;
+    if (!existsSync(join(stateRoot(), 'workspace', 'binding.json')))
+        return false;
+    let written;
+    try {
+        written = parseDocument(readFileSync(configuration, 'utf8')).toJS()?.rooms;
+    }
+    catch {
+        return false;
+    }
+    const entry = written?.owner, defaults = written?.defaults, keys = (value) => Object.keys(value).sort().join();
+    // Exactly the Owner entry and defaults tunnel setup writes; anything added or changed beside them is someone's own configuration.
+    return !!written && keys(written) === 'defaults,owner' && !!entry && keys(entry) === 'expected_cid,provider,public_invite_file,role' && entry.provider === 'messenger-server' && entry.role === 'Owner' && typeof entry.expected_cid === 'string' && same(entry.expected_cid, root.cid)
+        && !!defaults && keys(defaults) === 'attach_owner,close_when_task_done' && defaults.attach_owner === true && defaults.close_when_task_done === true;
+}
 /**
  * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
  * Reads only; an existing Owner is compared with this host's own Messenger identity.
  */
-export async function checkWorkspaceConfiguration(configuration = defaultConfigPath()) {
+export async function checkWorkspaceConfiguration(configuration = defaultConfigPath(), attach = attachOursClient) {
     const paths = preflightInitPaths(configuration);
     if (!paths.manifestExisted) {
         if (paths.rootExisted)
@@ -92,19 +185,20 @@ export async function checkWorkspaceConfiguration(configuration = defaultConfigP
         throw Error(`${paths.configPath}: rooms.defaults.attach_owner is disabled; enable it before tunnel setup.`);
     if (!loaded.rooms.owner.public_invite_file)
         throw Error(`${paths.configPath}: rooms.owner must use public_invite_file before tunnel setup.`);
-    let cid;
+    let cid, root;
     try {
-        cid = (await hostMessenger()('workspace/enrollment-identity')).cid;
+        ({ cid, root } = await messengerIdentity(hostMessenger(), attach));
     }
     catch {
         cid = undefined;
     }
     if (typeof cid !== 'string' || !/^[a-f0-9]{64}$/i.test(cid))
         throw Error(`${paths.configPath} names a room Owner, and this host's Messenger identity cannot be read to compare with it. Start Messenger on this host first.`);
-    if (loaded.rooms.owner.expected_cid.toLowerCase() !== cid.toLowerCase() && !recordsLostEnrollment(paths.configPath))
+    if (loaded.rooms.owner.expected_cid.toLowerCase() !== cid.toLowerCase() && !recordsLostEnrollment(paths.configPath) && !(root && managedRootOwner(paths.configPath, loaded.rooms, root)))
         throw Error(`${paths.configPath}: rooms.owner.expected_cid names a different Owner than this host's Messenger identity. Tunnel setup does not replace an existing Owner.`);
 }
 export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+    const attach = options.attach ?? attachOursClient;
     const request = hostMessenger();
     if (new WebAccessStore().read().mode === 'none')
         throw Error('Workspace enrollment requires protected web access; enable pairing or password before setup');
@@ -131,12 +225,15 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         throw Error('Existing rooms.defaults.attach_owner is disabled; enable automatic Human Owner admission before workspace setup');
     if (loaded.rooms && !loaded.rooms.owner.public_invite_file)
         throw Error('Existing room owner configuration must be reviewed before workspace enrollment');
-    const identity = await request('workspace/enrollment-identity');
+    const identity = await messengerIdentity(request, attach);
     if (!/^[a-f0-9]{64}$/i.test(identity.cid))
         throw Error('Bound Messenger identity unavailable');
+    // An installation that ran Messenger as the Human root and now runs it as the person's own identity keeps its managed Owner entry, moved to that identity.
+    const moved = Boolean(loaded.rooms) && !lost && !!identity.root && !same(loaded.rooms.owner.expected_cid, identity.cid) && managedRootOwner(resolve(configuration), loaded.rooms, identity.root)
+        && JSON.parse(readFileSync(previousFile, 'utf8')).serverCid?.toUpperCase() === payload.serverCid.toUpperCase();
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
-    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
+    if (loaded.rooms && !lost && !moved && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
     if (existsSync(inviteFile)) {
@@ -148,14 +245,30 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const hostWorkspaceId = devices.workspaceId;
     devices.close();
     const { name, surname, ...proofPayload } = payload;
-    const result = await request('workspace/enroll', options.preserveProfile ? { ...proofPayload, hostWorkspaceId, preserveProfile: true } : { ...payload, hostWorkspaceId });
-    if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
-        throw Error('Malformed workspace enrollment response');
-    // Whatever the configuration said before, what is recorded from here on is this host's own root.
-    if (result.rootCid.toLowerCase() !== identity.cid.toLowerCase())
-        throw Error('Workspace enrollment answered for a different root than this host identity; local configuration is unchanged');
-    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
-        throw Error('Retained room owner CID conflicts with the Human root');
+    let result, ownerCid;
+    if (identity.root) {
+        // The Human root signs the binding; the person's own Messenger identity is the room Owner and issues the Owner invitation.
+        await proveWithHumanRoot(attach, identity.root, payload, hostWorkspaceId, options.contactWaitMs ?? 10000);
+        const invite = await request('invites', { mode: 'public' });
+        if (typeof invite.blob !== 'string' || !invite.blob)
+            throw Error('Malformed workspace enrollment response');
+        const after = await request('workspace/enrollment-identity');
+        if (typeof after.cid !== 'string' || !same(after.cid, identity.cid) || typeof after.rootCid !== 'string' || !same(after.rootCid, identity.root.cid))
+            throw Error("This host's Messenger identity changed while setup was running; local configuration is unchanged");
+        result = { submitted: true, rootCid: identity.root.cid, ownerInvite: invite.blob };
+        ownerCid = identity.cid;
+    }
+    else {
+        result = await request('workspace/enroll', options.preserveProfile ? { ...proofPayload, hostWorkspaceId, preserveProfile: true } : { ...payload, hostWorkspaceId });
+        if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
+            throw Error('Malformed workspace enrollment response');
+        // Whatever the configuration said before, what is recorded from here on is this host's own root.
+        if (result.rootCid.toLowerCase() !== identity.cid.toLowerCase())
+            throw Error('Workspace enrollment answered for a different root than this host identity; local configuration is unchanged');
+        if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+            throw Error('Retained room owner CID conflicts with the Human root');
+        ownerCid = result.rootCid;
+    }
     if (migrating) {
         const deadline = Date.now() + 15000;
         while (true) {
@@ -173,16 +286,24 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         }
     }
     replaceFileAtomically(inviteFile, result.ownerInvite + '\n', 0o600);
+    options.afterInvitation?.();
     const split = splitRootFor(configuration);
     mkdirSync(split, { recursive: true, mode: 0o700 });
     if (!loaded.rooms)
-        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
-    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
-        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
+        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
+    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== ownerCid.toLowerCase())
+        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
+    else if (moved) {
+        // The invitation above and this entry are two files. A setup interrupted between them leaves the entry naming the root,
+        // which is this same case again: running setup once more writes both.
+        const document = parseDocument(readFileSync(configuration, 'utf8'));
+        document.setIn(['rooms', 'owner', 'expected_cid'], ownerCid);
+        replaceFileAtomically(configuration, document.toString(), 0o600);
+    }
     replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
     const origin = `https://${payload.hostname}`;
     replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
-    replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase() }) + '\n', 0o600);
+    replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase(), ...(identity.root ? { proofRootCid: identity.root.cid } : {}) }) + '\n', 0o600);
     loadConfig(configuration);
     return { origin, hostWorkspaceId, rootCid: result.rootCid };
 }
@@ -192,18 +313,30 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
  * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
  * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
  */
-export async function removeEnrollmentContact() {
-    let serverCid;
+export async function removeEnrollmentContact(attach = attachOursClient) {
+    let serverCid, proofRootCid;
     try {
-        serverCid = JSON.parse(readFileSync(join(stateRoot(), 'workspace', 'binding.json'), 'utf8')).serverCid;
+        ({ serverCid, proofRootCid } = JSON.parse(readFileSync(join(stateRoot(), 'workspace', 'binding.json'), 'utf8')));
     }
     catch {
         return false;
     }
     if (typeof serverCid !== 'string' || !/^[A-F0-9]{64}$/i.test(serverCid))
         return false;
+    const contact = serverCid.toUpperCase();
+    // The contact belongs to whoever sent the binding. When that was the Human root itself, the binding records it.
+    if (typeof proofRootCid === 'string' && CID.test(proofRootCid)) {
+        try {
+            const root = await humanRoot(attach, proofRootCid);
+            await asHumanRoot(attach, root, 'cleanup', client => client.removeContact({ contact }));
+        }
+        catch {
+            throw Error('the Human root did not remove it');
+        }
+        return true;
+    }
     try {
-        await hostMessenger()('contacts/remove', { contact: serverCid.toUpperCase() });
+        await hostMessenger()('contacts/remove', { contact });
     }
     catch {
         throw Error('Messenger did not remove it');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.36",
+  "version": "1.2.0-nightly.38",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/presets/fleet/roles/Coordinator.yaml

@@ -2,16 +2,12 @@ mission: Keep fleet development moving by managing the task backlog, rooms, and
 persona: |
   You are the fleet Coordinator. Own progress and workflow, not execution quality or results.
 
-  Each time your session starts, before anything else, use ours `send_message` to tell
-  `Coordinator Owner Channel` in two or three plain sentences that you are the Fleet Coordinator,
-  that you have started and are ready, and that the owner can ask you anything about the fleet:
-  how the app works, and how to set up new agents, tasks and rooms. Send this introduction once
-  per start; it is not a permission request and needs no reply.
-
-  Immediately before each meaningful action, proactively use ours `send_message` to contact
-  `Coordinator Owner Channel` with a short, plain one-sentence statement of what you are about to do.
-  This is an informational intent notice, never a permission request; proceed without waiting unless
-  a separate safety or authority rule genuinely requires approval.
+  Each time your session starts, before anything else, introduce yourself in your first reply in
+  this conversation, in two or three plain sentences: you are the Fleet Coordinator, you have
+  started and are ready, and the owner can ask you anything about the fleet: how the app works, and
+  how to set up new agents, tasks and rooms. Do this once per start; it is not a permission request
+  and needs no reply. The owner reads this conversation: do not send the introduction, or any other
+  notice, to a separate contact or channel, and never report a missing contact or channel as a blocker.
 
   Out of scope: do not personally implement, inspect, analyze, research, review, test, validate,
   or otherwise execute task work. Delegate all execution to temporary agents in managed rooms.
@@ -43,13 +39,12 @@ persona: |
   For every new task:
   1. Record it first with `ours-fleet task create --title "<title>" --brief "<brief>" --backlog --no-room`.
   2. Ask the owner which room template to use: `single`, `pair`, or `team`.
-  3. Resolve the exact launch plan without creating the room. Immediately before room creation, send
-     one proactive message to `Coordinator Owner Channel` stating that you are about to create the
-     room and listing the task, selected template, every member role and count, and each member's
-     Agent Template, Brain, harness, session, model, reasoning effort, permissions, and working
-     directory. Wait for `send_message` to confirm delivery. This detailed message replaces the
-     generic meaningful-action notice for room creation. If delivery fails, do not create the room.
-  4. Only after confirmed delivery, start it with
+  3. Resolve the exact launch plan without creating the room. Immediately before room creation,
+     state in this conversation that you are about to create the room, listing the task, selected
+     template, every member role and count, and each member's Agent Template,
+     Brain, harness, session, model, reasoning effort, permissions, and working directory.
+     This is a notice, not a permission request; do not wait for a reply.
+  4. Then start it with
      `ours-fleet task start <task-id> --template <template>`.
 
   Keep the backlog current with `ours-fleet task list --state all` and use `task show`, `task block`,

package/presets/manifest.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "preset_revision": 9,
+  "preset_revision": 10,
   "brain_catalog_revision": 4,
   "description": "ours-fleet standard configuration presets"
 }