@ours.network/fleet 1.2.0-nightly.4 → 1.2.0-nightly.6

package/README.md

@@ -1694,3 +1694,19 @@ provisioning or automatic reverse-proxy configuration. Existing local HTTP and
 SSH-tunnel profiles continue to work.
 
 See [supervisor-owned ours and migration](docs/supervisor-ours.md) for the runtime contract and review build instructions.
+
+### One-server gateway profile
+
+A private client profile may include `serverUrl`, for example
+`https://ours.example/base`, together with `endpoint` set to
+`https://ours.example/base/daemon`, the existing `expectedInstanceId`, and the
+absolute private `credentialPath`. Fleet preserves that daemon prefix for doctor
+and monitoring and derives `/cowork/management/rpc` from `serverUrl` for room
+management. Requests use the issued server credential, reject redirects, have
+bounded bodies/deadlines, and never replay mutations. This capability is declared
+as `cowork.http-management-v1` in the built artifact.
+
+Explicit Cowork socket, config or state-directory overrides continue to select
+local Unix management. Profiles without `serverUrl` retain legacy behavior. The
+HTTP API grants operator room authority; use the installer's supported private
+or authenticated external gateway entry, and keep its backend ports private.

package/dist/agent-ours/service.js

@@ -11,19 +11,31 @@ import { atomicPrivateWrite, binderKey } from './state.js';
 import { AgentOursRuntime } from './runtime.js';
 import { startMcpEndpoint } from './mcp-endpoint.js';
 export const privateRuntimeRoot = () => join(stateRoot(), 'private-ours');
+function roomSecretPath(role) {
+    const startup = role.roomMemberStartup;
+    return join(privateRuntimeRoot(), 'room-inputs', binderKey(startup.room_identity_cid, JSON.stringify([role.name, startup.invite_id])) + '.json');
+}
+function matchesRoomSecret(secret, role) {
+    const startup = role.roomMemberStartup;
+    return secret.room_id === startup.room_id && secret.room_identity_cid === startup.room_identity_cid
+        && secret.invite_id === startup.invite_id && secret.identity_name === role.identity
+        && secret.role === startup.role;
+}
 /** Only trusted launch orchestration may write this descriptor, never the child. */
 export function storeRoomSecret(role) {
     const startup = role.roomMemberStartup;
     if (!startup?.invite)
         return;
+    if (startup.identity_name !== role.identity)
+        throw Error('ROOM_SECRET_MISMATCH');
     const root = join(privateRuntimeRoot(), 'room-inputs');
     mkdirSync(root, { recursive: true, mode: 0o700 });
-    const path = join(root, binderKey(startup.room_identity_cid, role.name) + '.json');
+    // Failed attempts retain private evidence. A new invite must never overwrite
+    // or consume a previous attempt's descriptor.
+    const path = roomSecretPath(role);
     if (existsSync(path)) {
         const old = JSON.parse(readFileSync(path, 'utf8'));
-        if (old.room_id !== startup.room_id ||
-            old.invite_id !== startup.invite_id ||
-            old.identity_name !== startup.identity_name)
+        if (!matchesRoomSecret(old, role) || old.invite !== startup.invite)
             throw Error('ROOM_SECRET_COLLISION');
         return;
     }
@@ -144,7 +156,9 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         let room;
         if (role.roomMemberStartup) {
             const startup = role.roomMemberStartup;
-            const path = join(root, 'room-inputs', binderKey(startup.room_identity_cid, role.name) + '.json');
+            const legacyPath = join(root, 'room-inputs', binderKey(startup.room_identity_cid, role.name) + '.json');
+            const currentPath = roomSecretPath(role);
+            const path = existsSync(currentPath) ? currentPath : legacyPath;
             const cowork = createCoworkAdapter();
             room = {
                 id: startup.room_id,
@@ -153,9 +167,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
                 action: startup.invite_id,
                 redeem: async (attached) => {
                     const secret = JSON.parse(readFileSync(path, 'utf8'));
-                    if (secret.room_id !== startup.room_id ||
-                        secret.invite_id !== startup.invite_id ||
-                        secret.identity_name !== role.identity)
+                    if (!matchesRoomSecret(secret, role))
                         throw Error('ROOM_SECRET_MISMATCH');
                     return attached.addContact({ invite: secret.invite });
                 },

package/dist/application/task-room-service.js

@@ -136,7 +136,7 @@ export class TaskRoomApplicationService {
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
-                    persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    persistBlockTask(task.task_id, 'Cowork management is unavailable');
                 // Once the durable Room exists, provisioning errors are resumable
                 // saga state. Return that explicit state so the command can launch a
                 // continuation and report the durable in-progress outcome.
@@ -234,17 +234,23 @@ export class TaskRoomApplicationService {
         const ready = task.state === 'active' && room?.state === 'active'
             && active === expected && launched === expected;
         const blocker = task.outcome?.summary ?? task.blocked?.reason ?? room?.saga.error;
-        const nextAction = room?.provisioning_detail === 'waiting_owner_authorization'
-            ? `Ensure ours-cowork 1.3.0 or newer is running and available, then run ours-fleet task start ${task.task_id}.`
-            : room?.provisioning_detail === 'waiting_owner_invite'
-                ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
-                : room?.provisioning_detail === 'owner_cid_mismatch'
-                    ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
-                    : room?.provisioning_detail === 'waiting_cowork'
-                        ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
-                        : failed
-                            ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
-                            : undefined;
+        const nextAction = task.terminal_intent
+            ? `Complete the accepted ${task.terminal_intent.kind} operation; do not restart provisioning.`
+            : room?.state === 'closing' || room?.state === 'closed'
+                ? `Complete room cleanup; do not restart provisioning.`
+                : room?.provisioning_detail === 'member_failed'
+                    ? `Inspect the failed launch, then run ours-fleet task start ${task.task_id}.`
+                    : room?.provisioning_detail === 'waiting_owner_authorization'
+                        ? `Ensure ours-cowork 1.3.0 or newer is running and available, then run ours-fleet task start ${task.task_id}.`
+                        : room?.provisioning_detail === 'waiting_owner_invite'
+                            ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
+                            : room?.provisioning_detail === 'owner_cid_mismatch'
+                                ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
+                                : room?.provisioning_detail === 'waiting_cowork'
+                                    ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
+                                    : failed
+                                        ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
+                                        : undefined;
         return {
             kind: failed ? 'failed' : ready ? 'ready' : 'in_progress', task, room,
             launch: {
@@ -410,7 +416,9 @@ export class TaskRoomApplicationService {
         let task = readTask(input.taskId);
         let room = task.room_id ? getRoomRecord(task.room_id) : undefined;
         const issues = [];
-        if (task.state !== 'provisioning')
+        if (task.state !== 'provisioning' || task.terminal_intent
+            || room?.state === 'closing' || room?.state === 'closed'
+            || room?.provisioning_detail === 'member_failed')
             return {
                 kind: 'no_op', task, room, issues,
             };
@@ -784,7 +792,7 @@ export class TaskRoomApplicationService {
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
-                    persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    persistBlockTask(task.task_id, 'Cowork management is unavailable');
                 const current = readTask(task.task_id);
                 if (!current.room_id || !getRoomRecord(current.room_id))
                     throw error;
@@ -802,7 +810,7 @@ export class TaskRoomApplicationService {
                 }
                 catch (error) {
                     if (error instanceof CoworkUnavailableError)
-                        persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                        persistBlockTask(task.task_id, 'Cowork management is unavailable');
                     task = readTask(task.task_id);
                     return { task, status: 'in_progress' };
                 }
@@ -820,7 +828,7 @@ export class TaskRoomApplicationService {
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
-                    persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    persistBlockTask(task.task_id, 'Cowork management is unavailable');
                 task = readTask(task.task_id);
             }
         }
@@ -878,11 +886,17 @@ export class TaskRoomApplicationService {
                     if (fresh.deletion?.status === 'pending')
                         throw new TaskRoomApplicationError('task_deleting', `task ${task.task_id} is pending deletion`, { task: task.task_id });
                 }
+                const requiredRoles = new Map();
+                if (attachOwner)
+                    requiredRoles.set(rooms.owner.role, 1);
+                for (const member of launchTemplate?.members ?? [])
+                    requiredRoles.set(member.role, (requiredRoles.get(member.role) ?? 0) + member.count);
                 const created = await cowork.createRoom({
                     room_name: roomName, goal: task.goal?.trim() || task.title,
                     briefing: task.brief?.trim() || launchTemplate?.contract?.trim() || task.goal?.trim() || task.title,
                     quiet_membership: launchTemplate?.room?.quiet_membership,
                     anonymous: policy.anonymous,
+                    activation_requirements: [...requiredRoles].map(([role, count]) => ({ role, count })),
                 });
                 const record = createRoomRecord({
                     room_id: created.room_id, room_name: roomName, room_identity_cid: created.identity_cid,

package/dist/build-info.json

@@ -1,10 +1,11 @@
 {
-  "version": "1.2.0-nightly.4",
-  "buildId": "10dccae7a337",
-  "commit": "2192785d3823d7a2cae1f3b5c7060bd97175340e",
+  "version": "1.2.0-nightly.6",
+  "buildId": "2075277a291e",
+  "commit": "01660e304fff7ee37784669ec601299c92df4912",
   "dirty": true,
-  "builtAt": "2026-09-21T20:49:10.393Z",
+  "builtAt": "2026-09-23T10:49:32.469Z",
   "capabilities": [
+    "cowork.http-management-v1",
     "monitor.interrupt.after_tool"
   ]
 }

package/dist/capabilities.d.ts

@@ -14,7 +14,8 @@
  */
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export declare const CAP_MONITOR_INTERRUPT_AFTER_TOOL = "monitor.interrupt.after_tool";
-export declare const CAPABILITIES: readonly ["monitor.interrupt.after_tool"];
+export declare const CAP_HTTP_COWORK = "cowork.http-management-v1";
+export declare const CAPABILITIES: readonly ["cowork.http-management-v1", "monitor.interrupt.after_tool"];
 export type Capability = (typeof CAPABILITIES)[number];
 /** Does this build declare `token`? */
 export declare const hasCapability: (token: string) => boolean;

package/dist/capabilities.js

@@ -14,7 +14,9 @@
  */
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export const CAP_MONITOR_INTERRUPT_AFTER_TOOL = 'monitor.interrupt.after_tool';
+export const CAP_HTTP_COWORK = 'cowork.http-management-v1';
 export const CAPABILITIES = [
+    CAP_HTTP_COWORK,
     CAP_MONITOR_INTERRUPT_AFTER_TOOL,
 ];
 /** Does this build declare `token`? */

package/dist/client-profile.d.ts

@@ -3,6 +3,7 @@ export interface ExplicitClientProfile {
     readonly expectedInstanceId: string;
     readonly credentialPath: string;
     readonly configPath: string;
+    readonly serverUrl?: string;
 }
 export declare class ClientProfileError extends Error {
     constructor(message: string);

package/dist/client-profile.js

@@ -1,3 +1,4 @@
+import { normalizeDaemonEndpoint } from '@ours.network/sdk/client';
 import { lstatSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { isAbsolute, join } from 'node:path';
@@ -97,17 +98,31 @@ export function readClientProfile(env) {
     catch {
         throw invalid(configPath, 'has an invalid endpoint');
     }
-    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password || url.pathname !== '/'
+    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password
         || url.search || url.hash)
-        throw invalid(configPath, 'endpoint must be an HTTP or HTTPS origin');
+        throw invalid(configPath, 'endpoint must be an HTTP or HTTPS base URL');
     const expectedInstanceId = row.expectedInstanceId.trim();
     if (!LOWERCASE_UUID.test(expectedInstanceId))
         throw invalid(configPath, 'expectedInstanceId must be a lowercase UUID');
     const credentialPath = row.credentialPath.trim();
     if (!isAbsolute(credentialPath))
         throw invalid(configPath, 'credentialPath must be absolute');
+    let serverUrl;
+    if (Object.hasOwn(row, 'serverUrl')) {
+        if (typeof row.serverUrl !== 'string' || /[\s\\?#]/.test(row.serverUrl))
+            throw invalid(configPath, 'serverUrl must be a safe HTTP or HTTPS base URL');
+        try {
+            serverUrl = normalizeDaemonEndpoint(row.serverUrl);
+        }
+        catch {
+            throw invalid(configPath, 'serverUrl must be a safe HTTP or HTTPS base URL');
+        }
+        if (normalizeDaemonEndpoint(endpoint) !== serverUrl + '/daemon')
+            throw invalid(configPath, 'endpoint must select serverUrl/daemon');
+    }
     return Object.freeze({
-        endpoint: url.origin, expectedInstanceId, credentialPath, configPath,
+        ...(serverUrl === undefined ? {} : { serverUrl }),
+        endpoint: normalizeDaemonEndpoint(endpoint), expectedInstanceId, credentialPath, configPath,
     });
 }
 export function clientProfileKey(profile) {

package/dist/docs.d.ts

@@ -17,8 +17,8 @@ export declare const AI_DOCS = "# ours-fleet reference\n\nours-fleet runs persis
  * \`forbidden\` is the more important half. The old skills prescribed
  * \`--approval ask --filesystem workspace --unattended deny\` as a blanket
  * default while also telling the agent to stop at a failed doctor check — and
- * that combination is exactly what \`doctor\` FAILS, because \`ask\` grants an
- * unattended role nothing but \`read-state\` and \`deny\` makes the shortfall
+ * that combination is exactly what \`doctor\` FAILS, because \`ask\` cannot
+ * guarantee unattended capabilities and \`deny\` makes the shortfall
  * fatal. Following the skill produced a role the CLI then refused.
  */
 export declare const SPAWN_SKILL_CONTRACT: {

package/dist/docs.js

@@ -1032,8 +1032,8 @@ reconcile explicitly; no chain preserves detection-only behavior.
  * \`forbidden\` is the more important half. The old skills prescribed
  * \`--approval ask --filesystem workspace --unattended deny\` as a blanket
  * default while also telling the agent to stop at a failed doctor check — and
- * that combination is exactly what \`doctor\` FAILS, because \`ask\` grants an
- * unattended role nothing but \`read-state\` and \`deny\` makes the shortfall
+ * that combination is exactly what \`doctor\` FAILS, because \`ask\` cannot
+ * guarantee unattended capabilities and \`deny\` makes the shortfall
  * fatal. Following the skill produced a role the CLI then refused.
  */
 export const SPAWN_SKILL_CONTRACT = {
@@ -1062,7 +1062,7 @@ export const SPAWN_SKILL_CONTRACT = {
      */
     forbidden: [
         // The contradictory blanket default both variants used to prescribe.
-        // `ask` grants an unattended role only `read-state`, and `deny` makes the
+        // `ask` cannot guarantee unattended capabilities, and `deny` makes the
         // shortfall a doctor FAILURE — so the skill told you to build a role the
         // CLI then refused, in the same breath as telling you to trust doctor.
         '--approval ask --filesystem workspace --unattended deny',

package/dist/doctor.d.ts

@@ -3,7 +3,7 @@ import { type Exec } from './exec.js';
 import type { YamlMode } from './config-yaml.js';
 import { type FetchLike } from './monitor.js';
 import type { PrereqReport } from './harness/types.js';
-type DoctorDaemonClient = Pick<OursClient, 'version'>;
+type DoctorDaemonClient = Pick<OursClient, 'version' | 'close'>;
 type AttachDoctorDaemon = (options: AttachOursClientOptions) => Promise<DoctorDaemonClient>;
 /** Host-level + per-harness prerequisite report with actionable messages. */
 export declare function doctor(opts?: {

package/dist/doctor.js

@@ -1,4 +1,5 @@
-import { userInfo } from 'node:os';
+import { join } from 'node:path';
+import { userInfo, homedir } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { realExec } from './exec.js';
@@ -272,21 +273,39 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
+    let managedSelection = false;
     try {
-        const client = await attachDaemon({
-            env: process.env,
+        // Mark explicit selection before validation so a damaged managed profile does
+        // not produce advice to start an unrelated local daemon.
+        managedSelection = process.env.OURS_CONFIG !== undefined
+            || existsSync(join(process.env.HOME || homedir(), '.ours-client', 'profile.json'));
+        const selected = readClientProfile(process.env);
+        managedSelection = selected !== undefined;
+        const client = await attachDaemon(selected ? {
+            endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
+            credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-            clientPid: process.pid,
+        } : {
+            env: process.env, leaseToken: `ours-fleet-doctor-${process.pid}`, clientPid: process.pid,
         });
-        const info = await client.version();
-        if (info.name !== 'ours' || typeof info.version !== 'string')
-            throw new Error('the selected endpoint did not return a valid ours daemon identity');
-        checks.push({ name: 'ours daemon', ok: true, detail: `running (${info.version})` });
+        let daemonVersion;
+        try {
+            const info = await client.version();
+            if (info.name !== 'ours' || typeof info.version !== 'string')
+                throw new Error('the selected endpoint did not return a valid ours daemon identity');
+            daemonVersion = info.version;
+        }
+        finally {
+            await client.close();
+        }
+        checks.push({ name: 'ours daemon', ok: true, detail: `running (${daemonVersion})` });
     }
     catch (error) {
         checks.push({
             name: 'ours daemon', ok: false,
-            detail: `not reachable through the SDK — start it with: ours-daemon start `
+            detail: (managedSelection
+                ? 'selected client profile failed — check its endpoint, instance and issued credential '
+                : 'not reachable through the SDK — start it with: ours-daemon start ')
                 + `[${error?.message ?? String(error)}]`,
         });
     }

package/dist/harness/codex.d.ts

@@ -6,8 +6,9 @@ import type { AcpSessionTransport } from './acp-session-transport.js';
 import type { CodexAppServerSessionTransport } from './codex-session.js';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export declare function codexCapabilities(approval: string, sandbox: string): UnattendedCapability[];
 /** Defense in depth for callers which launch a role after validation was bypassed. */

package/dist/harness/codex.js

@@ -25,12 +25,13 @@ const CODEX_PROXY_REAL_PATH_ENV = 'OURS_FLEET_REAL_CODEX_PATH';
 const CODEX_PROXY_MANIFEST_ENV = 'OURS_FLEET_CODEX_ACP_MANIFEST';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export function codexCapabilities(approval, sandbox) {
     if (approval !== 'never')
-        return ['read-state'];
+        return [];
     const caps = ['read-state', 'messaging', 'monitor', 'status-commands'];
     if (sandbox !== 'read-only')
         caps.push('write-state', 'workspace-edit');

package/dist/owner-channel/channel.d.ts

@@ -14,6 +14,8 @@ export interface OwnerChannelOptions {
     harness: string;
     config: OwnerChannelConfig;
     session: AgentSession;
+    /** Ordinary owner input must not cancel the initial briefing turn. */
+    startupPending?: () => boolean;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;
@@ -269,6 +271,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
+    private ownerPromptPolicy;
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the

package/dist/owner-channel/channel.js

@@ -1123,6 +1123,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');
@@ -1136,8 +1143,7 @@ export class OwnerChannel {
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
             const queued = await queueSessionPrompt(this.options.session, this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
@@ -1263,8 +1269,7 @@ export class OwnerChannel {
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
             queued = await queueSessionPrompt(this.options.session, this.ownerPrompt(sender, text, wireId), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId, displayText: text },
             });
         }
@@ -1309,6 +1314,14 @@ export class OwnerChannel {
         this.completionTasks.add(task);
         return true;
     }
+    ownerPromptPolicy() {
+        if (this.options.startupPending?.())
+            return { interrupt: false, steer: true };
+        return {
+            interrupt: this.options.config.interrupt,
+            ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+        };
+    }
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the
@@ -1762,6 +1775,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');

package/dist/rooms-tasks/cli.js

@@ -1152,7 +1152,7 @@ export function registerTaskCommands(parent, cOpt) {
                 const app = taskRoomService(opts.configuration);
                 for (;;) {
                     const before = app.taskProvisioningOutcome(id);
-                    if (before.kind !== 'in_progress') {
+                    if (before.kind !== 'in_progress' || before.next_action) {
                         await presentDetachedProvisioningOutcome(before);
                         return;
                     }

package/dist/rooms-tasks/close.d.ts

@@ -2,6 +2,7 @@ import { withFileLock } from '../atomic-file.js';
 import { type TempLifecycleDeps } from '../temp-lifecycle.js';
 import { type CoworkAdapter } from './cowork-adapter.js';
 import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
+export declare function roomCloseLockPath(roomId: string): string;
 export interface RoomCloseDeps {
     inspectMember?(seat: RoomMemberSeat): Promise<{
         launchId: string;

package/dist/rooms-tasks/close.js

@@ -4,13 +4,14 @@ import { randomUUID } from 'node:crypto';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
+import { readClientProfile } from '../client-profile.js';
 import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
 import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
 const CLOSE_LOCK_STALE_MS = 5 * 60_000;
 const STOP_POLLS = 50;
 const STOP_POLL_MS = 100;
-function roomCloseLockPath(roomId) {
+export function roomCloseLockPath(roomId) {
     return join(stateRoot(), 'locks', 'room-close', encodeURIComponent(roomId));
 }
 function errorText(error) {
@@ -54,16 +55,28 @@ export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {})
     throw new Error(`temporary role '${role}' did not reach proven stopped liveness`);
 }
 async function withIdentityClient(work) {
-    const client = await attachOursClient({
+    const profile = readClientProfile(process.env);
+    const leaseToken = `ours-fleet-room-close-${process.pid}-${randomUUID()}`;
+    const client = await attachOursClient(profile ? {
+        endpoint: profile.endpoint,
+        expectedInstanceId: profile.expectedInstanceId,
+        credentialPath: profile.credentialPath,
+        sessionMode: 'external', env: {}, leaseToken,
+    } : {
         env: process.env,
-        leaseToken: `ours-fleet-room-close-${process.pid}-${randomUUID()}`,
+        leaseToken,
         clientPid: process.pid,
     });
     try {
         return await work(client);
     }
     finally {
-        await client.releaseLease().catch(() => { });
+        try {
+            await client.releaseLease().catch(() => { });
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 function listedIdentity(rows, name) {
@@ -106,11 +119,36 @@ export async function removeExactMemberIdentity(seat) {
         }
     });
 }
+async function assertMemberIdentityAbsent(seat) {
+    await withIdentityClient(async (client) => {
+        const rows = await client.listIdentities();
+        if (rows.some(row => row.name === seat.role_name ||
+            (seat.identity_cid && 'cid' in row && row.cid.toLowerCase() === seat.identity_cid.toLowerCase()))) {
+            throw new Error(`room member '${seat.role_name}' identity absence is not proven; refusing retirement`);
+        }
+    });
+}
 async function retireMember(roomId, seat, deps) {
     let room = getRoomRecord(roomId);
     let current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
     let retirement = current.retirement;
+    if (retirement?.phase === 'identity_absent') {
+        if (current.launch?.launch_id && current.launch.launch_id !== retirement.launch_id) {
+            if (existsSync(agentDir(current.role_name, true)))
+                throw new Error(`room member '${current.role_name}' has a replacement launch after retirement; retire that exact temporary role before retrying`);
+            await assertMemberIdentityAbsent(current);
+        }
+        return;
+    }
     if (!retirement) {
+        if (current.launch?.state === 'failed' && !existsSync(agentDir(current.role_name, true))) {
+            // A failure before applyRole (for example invite-secret validation) has
+            // no supervisor to stop or archive. Settle only proven absence; this
+            // path never removes an identity based on missing local evidence.
+            await assertMemberIdentityAbsent(current);
+            advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'failed-launch-absent');
+            return;
+        }
         if (current.launch?.state === 'pending' && current.launch.attempt === 0) {
             if (existsSync(agentDir(current.role_name, true))) {
                 throw new Error(`never-launched room member '${current.role_name}' unexpectedly has Fleet temp state`);
@@ -159,8 +197,6 @@ export async function closeManagedRoom(input) {
         try {
             if (room.close?.phase === 'retire_members') {
                 for (const seat of room.member_seats) {
-                    if (seat.retirement?.phase === 'identity_absent')
-                        continue;
                     await retireMember(input.roomId, seat, deps);
                 }
                 room = advanceRoomClose(input.roomId, 'close_cowork');

package/dist/rooms-tasks/cowork-adapter.d.ts

@@ -58,6 +58,10 @@ export interface CoworkAdapter {
         briefing: string;
         quiet_membership?: boolean;
         anonymous?: boolean;
+        activation_requirements?: Array<{
+            role: string;
+            count: number;
+        }>;
     }): Promise<CoworkRoomCreateResult>;
     acceptInvite(roomId: string, invite: string, opts: {
         role: string;

package/dist/rooms-tasks/cowork-adapter.js

@@ -8,6 +8,8 @@ import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { createConnection } from 'node:net';
+import { readClientProfile } from '../client-profile.js';
+import { coworkHttpCall } from './cowork-http.js';
 const RPC_VERSION = 1;
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
@@ -275,10 +277,15 @@ function rpcCall(socketPath, method, params, timeoutMs, connect) {
     });
 }
 export function createCoworkAdapter(options = {}) {
-    const socketPath = resolveCoworkSocketPath(options);
+    const env = options.env ?? process.env;
+    const explicitLocal = options.socketPath !== undefined || options.configPath !== undefined
+        || env.OURS_COWORK_CONFIG !== undefined || !!env.OURS_COWORK_STATE_DIR;
+    const profile = explicitLocal ? undefined : readClientProfile({ ...env, HOME: options.home ?? env.HOME });
+    const remote = profile?.serverUrl ? profile : undefined;
+    const socketPath = remote ? undefined : resolveCoworkSocketPath(options);
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const connect = options.connect ?? ((path) => createConnection(path));
-    const call = (method, params) => rpcCall(socketPath, method, params, timeoutMs, connect);
+    const call = (method, params) => remote ? coworkHttpCall(remote, method, params, timeoutMs) : rpcCall(socketPath, method, params, timeoutMs, connect);
     return {
         async available() {
             try {
@@ -296,6 +303,7 @@ export function createCoworkAdapter(options = {}) {
                 briefing: opts.briefing,
                 ...(opts.quiet_membership === undefined ? {} : { quiet_membership: opts.quiet_membership }),
                 ...(opts.anonymous === undefined ? {} : { anonymous: opts.anonymous }),
+                ...(opts.activation_requirements === undefined ? {} : { activation_requirements: opts.activation_requirements }),
             }), 'room.create');
             if (!result.identity_cid)
                 throw new CoworkProtocolError('room.create', 'created room did not establish an identity CID');

package/dist/rooms-tasks/cowork-http.d.ts

@@ -0,0 +1,3 @@
+import type { ExplicitClientProfile } from '../client-profile.js';
+/** Same RPC protocol as the local socket; never replay a possibly delivered mutation. */
+export declare function coworkHttpCall(profile: ExplicitClientProfile, method: string, params: Record<string, unknown>, timeoutMs: number): Promise<unknown>;

package/dist/rooms-tasks/cowork-http.js

@@ -0,0 +1,70 @@
+import { randomUUID } from 'node:crypto';
+import { attachOursClient } from '@ours.network/sdk/client';
+import { readPrivateFile } from '@ours.network/sdk/connector';
+import { CoworkProtocolError, CoworkUnavailableError } from './cowork-adapter.js';
+/** Same RPC protocol as the local socket; never replay a possibly delivered mutation. */
+export async function coworkHttpCall(profile, method, params, timeoutMs) {
+    const id = randomUUID();
+    const signal = AbortSignal.timeout(timeoutMs);
+    const body = JSON.stringify({ version: 1, id, method, params });
+    if (Buffer.byteLength(body) > 1024 * 1024)
+        throw new CoworkProtocolError(method, 'request exceeded 1 MiB');
+    try {
+        const client = await attachOursClient({ endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+            credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken: `fleet-cowork-check-${id}`, env: {}, requestSignal: signal });
+        await client.close();
+        const token = readPrivateFile(profile.credentialPath, 4096).toString('utf8').trim();
+        const response = await fetch(profile.serverUrl + '/cowork/management/rpc', {
+            method: 'POST', redirect: 'error', signal,
+            headers: { 'content-type': 'application/json', 'x-ours-api-token': token },
+            body,
+        });
+        if (response.status === 401 || response.status === 403) {
+            await response.body?.cancel();
+            throw new CoworkProtocolError(method, 'server credential was rejected', 'unauthorized');
+        }
+        const reader = response.body?.getReader();
+        if (!reader)
+            throw new CoworkProtocolError(method, 'empty HTTP response');
+        const chunks = [];
+        let size = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                size += value.length;
+                if (size > 4 * 1024 * 1024)
+                    throw new CoworkProtocolError(method, 'response exceeded 4 MiB');
+                chunks.push(value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        let rpc;
+        try {
+            rpc = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        }
+        catch {
+            throw new CoworkProtocolError(method, 'server returned malformed JSON');
+        }
+        if (!rpc || Array.isArray(rpc) || rpc.version !== 1 || rpc.id !== id
+            || Object.hasOwn(rpc, 'result') === Object.hasOwn(rpc, 'error'))
+            throw new CoworkProtocolError(method, 'server returned an invalid RPC response');
+        if (Object.hasOwn(rpc, 'error')) {
+            const error = rpc.error;
+            if (!error || typeof error.code !== 'string' || typeof error.message !== 'string')
+                throw new CoworkProtocolError(method, 'server returned an invalid RPC error');
+            throw new CoworkProtocolError(method, error.message, error.code);
+        }
+        if (!response.ok)
+            throw new CoworkProtocolError(method, `management answered HTTP ${response.status}`);
+        return rpc.result;
+    }
+    catch (error) {
+        if (error instanceof CoworkProtocolError)
+            throw error;
+        throw new CoworkUnavailableError('Cowork HTTP management failed; check the selected server and credential', { cause: error });
+    }
+}

package/dist/rooms-tasks/provision.d.ts

@@ -21,6 +21,17 @@ export interface StartupWaitPolicy {
     sleep(ms: number): Promise<void>;
 }
 export declare function provisionMembers(input: ProvisionMembersInput): Promise<RoomOrchestrationRecord>;
+/** Reconcile proven, admitted launches without any spawn, archive, invite or recovery path. */
+export declare function reconcileExistingTaskMembers(input: {
+    taskId: string;
+    checkOnly?: boolean;
+    cowork: Pick<CoworkAdapter, 'getRoom'>;
+    expectedLaunches: ReadonlyArray<{
+        role_name: string;
+        launch_id: string;
+        identity_cid: string;
+    }>;
+}): Promise<RoomOrchestrationRecord>;
 export declare function cleanupMembers(input: {
     roomId: string;
     taskId?: string;

package/dist/rooms-tasks/provision.js

@@ -14,7 +14,7 @@ import { readLaunchSnapshot, redactLaunchDefinition } from './launch-snapshot.js
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from '../fleet-proxy.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
-import { closeManagedRoom } from './close.js';
+import { closeManagedRoom, roomCloseLockPath } from './close.js';
 import { withFileLock } from '../atomic-file.js';
 import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
 import { TaskStateError, taskDeletionState } from './task-state.js';
@@ -244,12 +244,16 @@ async function retainRunningLaunch(input) {
  */
 async function launchMember(input) {
     const taskId = input.provision.taskId;
-    if (!taskId)
+    const launch = () => withFileLock(roomCloseLockPath(input.provision.roomId), () => {
+        assertProvisioningOpen(input.provision);
         return launchMemberUnlocked(input);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (!taskId)
+        return launch();
     return withFileLock(taskOperationLockPath(taskId), () => {
         if (taskDeletionState(taskId) !== 'none')
             throw new Error(`task ${taskId} is pending deletion; aborting member launch for ${input.member.name}`);
-        return launchMemberUnlocked(input);
+        return launch();
     }, {}, TASK_OPERATION_LOCK_STALE_MS);
 }
 async function launchMemberUnlocked(input) {
@@ -371,8 +375,16 @@ function assertCoworkRoomPolicy(room, expectedAnonymous) {
     if ((room.anonymous ?? false) !== expectedAnonymous)
         throw new Error(`Cowork anonymity (${String(room.anonymous ?? false)}) does not match Fleet's durable Room policy (${String(expectedAnonymous)})`);
 }
+function assertProvisioningOpen(input) {
+    if (input.taskId && getTask(input.taskId).terminal_intent)
+        throw new Error(`task ${input.taskId} has an accepted terminal intent; refusing to provision members`);
+    const room = getRoomRecord(input.roomId);
+    if (room?.state === 'closing' || room?.state === 'closed')
+        throw new Error(`room ${input.roomId} is ${room.state}; refusing to provision members`);
+}
 export async function provisionMembers(input) {
     const { cfg, cowork, roomId, taskId, template } = input;
+    assertProvisioningOpen(input);
     // Deletion-epoch pre-check; each member launch re-checks under the lock.
     if (taskId && taskDeletionState(taskId) !== 'none')
         throw new Error(`task ${taskId} is pending deletion; refusing to provision members`);
@@ -446,12 +458,25 @@ export async function provisionMembers(input) {
                 provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
             }))
                 continue;
+            // A previous failed launch keeps its invite pointer durably. Never
+            // overwrite that requirement until the supported revoke has succeeded;
+            // a transport failure must fence subsequent invite issuance too.
+            if (currentSeat.invite_id) {
+                const observed = await cowork.getRoom(roomId);
+                if (!observed || observed.identity_cid !== roomIdentityCid)
+                    throw new Error('cannot verify room before failed-attempt invite cleanup');
+                if (observed.seats.some(seat => seat.invite_id === currentSeat.invite_id
+                    && seat.seat_state !== 'removed'))
+                    throw new Error('failed-attempt invite has an admitted seat; reconcile before replacing the member');
+                await cowork.revokeInvite(roomId, currentSeat.invite_id);
+            }
             const issued = await cowork.issueInvite(roomId, {
                 mode: 'one_time', role: member.coworkRole, min_accepts: 1,
             });
-            const seats = getRoomRecord(roomId).member_seats.map(seat => seat.role_name === member.name ? { ...seat, invite_id: issued.invite_id } : seat);
-            updateMemberSeats(roomId, seats);
             try {
+                assertProvisioningOpen(input);
+                const seats = getRoomRecord(roomId).member_seats.map(seat => seat.role_name === member.name ? { ...seat, invite_id: issued.invite_id } : seat);
+                updateMemberSeats(roomId, seats);
                 await launchMember({
                     provision: input,
                     member,
@@ -470,7 +495,12 @@ export async function provisionMembers(input) {
                 });
             }
             catch (error) {
-                await cowork.revokeInvite(roomId, issued.invite_id).catch(() => { });
+                try {
+                    await cowork.revokeInvite(roomId, issued.invite_id);
+                }
+                catch (cleanupError) {
+                    throw new AggregateError([error, cleanupError], 'member launch failed and invite cleanup is unresolved; retry must revoke the retained requirement first');
+                }
                 throw error;
             }
         }
@@ -498,7 +528,7 @@ export async function provisionMembers(input) {
         const remote = await cowork.recoverRoom(roomId);
         assertCoworkRoomPolicy(remote, roomPolicy.anonymous);
         const reconciled = reconcileMemberSeats(roomId, members, remote.seats, ownerSeatCid ?? undefined);
-        if (reconciled.complete)
+        if (reconciled.complete && remote.state === 'active')
             break;
         if (policy.now() >= deadline) {
             advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
@@ -538,6 +568,76 @@ export async function provisionMembers(input) {
         activateTask(taskId);
     return record;
 }
+/** Reconcile proven, admitted launches without any spawn, archive, invite or recovery path. */
+export async function reconcileExistingTaskMembers(input) {
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active'].includes(task.state) || task.terminal_intent || taskDeletionState(input.taskId) !== 'none'
+            || !task.room_id)
+            throw new Error('task is not open for existing-member reconciliation');
+        const roomId = task.room_id;
+        return withFileLock(roomCloseLockPath(roomId), async () => {
+            const current = getRoomRecord(roomId);
+            if (!current || !['provisioning', 'active'].includes(current.state) || current.close
+                || current.task_id !== input.taskId || !current.room_identity_cid
+                || task.room_identity_cid !== current.room_identity_cid)
+                throw new Error('room is not open for existing-member reconciliation');
+            const names = new Set(input.expectedLaunches.map(seat => seat.role_name));
+            if (!names.size || names.size !== input.expectedLaunches.length
+                || current.member_seats.length !== names.size
+                || current.member_seats.some(seat => !names.has(seat.role_name)))
+                throw new Error('expected launch roster does not match the persisted room');
+            const remote = await input.cowork.getRoom(roomId);
+            if (!remote || remote.room_id !== roomId || remote.identity_cid !== current.room_identity_cid
+                || remote.state !== 'active')
+                throw new Error('Cowork room is not the exact active room');
+            assertCoworkRoomPolicy(remote, storedRoomLaunchPolicy(current.room_policy).anonymous);
+            if (current.owner_seat_cid && !remote.seats.some(seat => seat.identity_cid === current.owner_seat_cid && seat.seat_state === 'active'))
+                throw new Error('expected Owner seat is not active');
+            const seats = [];
+            for (const seat of current.member_seats) {
+                const expected = input.expectedLaunches.find(item => item.role_name === seat.role_name);
+                const launch = seat.launch;
+                if (seat.seat_state === 'removed' || !seat.invite_id || launch?.state !== 'launched'
+                    || launch.launch_id !== expected.launch_id || !launch.action_id || !launch.mission_sha256
+                    || (seat.identity_cid && seat.identity_cid !== expected.identity_cid))
+                    throw new Error('persisted member launch does not match reconciliation evidence');
+                const dir = agentDir(seat.role_name, true);
+                if (!launchMatches(dir, { name: seat.role_name, coworkRole: seat.cowork_role }, launch.action_id, launch.mission_sha256, roomId, current.room_identity_cid, seat.invite_id, storedRoomLaunchPolicy(current.room_policy).anonymous))
+                    throw new Error('member startup provenance mismatch');
+                const supervisor = readTempSupervisor(dir);
+                if (!supervisor || supervisor.role !== seat.role_name || supervisor.launchId !== expected.launch_id
+                    || await tempSupervisorLiveness(dir) !== 'running')
+                    throw new Error('expected member supervisor is not running');
+                const ready = readRoomReadiness(current.room_identity_cid, seat.role_name);
+                const matches = remote.seats.filter(item => item.display_name === seat.role_name
+                    && item.seat_state !== 'removed');
+                const found = matches[0];
+                if (!ready || ready.room !== roomId || ready.invite !== seat.invite_id
+                    || ready.cid !== expected.identity_cid || matches.length !== 1 || !found
+                    || found.identity_cid !== expected.identity_cid || found.role !== seat.cowork_role
+                    || found.seat_state !== 'active' || found.invite_id !== seat.invite_id)
+                    throw new Error('member readiness or authenticated Cowork seat mismatch');
+                seats.push({ ...seat, identity_cid: expected.identity_cid, seat_state: 'active' });
+            }
+            if (input.checkOnly)
+                return current;
+            // No mutation until the complete roster has passed; these writes are replayable
+            // under the same task/room lifecycle locks if interrupted between files.
+            updateMemberSeats(roomId, seats);
+            updateTaskMembers(input.taskId, seats.map(seat => ({ name: seat.role_name,
+                identity_cid: seat.identity_cid, slot: seat.slot, cowork_role: seat.cowork_role })));
+            if (getTask(input.taskId).blocked)
+                unblockTask(input.taskId);
+            if (current.state !== 'active')
+                advanceSaga(roomId, 'activate', 6);
+            const activated = current.state === 'active' ? getRoomRecord(roomId) : activateRoom(roomId);
+            if (task.state !== 'active')
+                activateTask(input.taskId);
+            return activated;
+        }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
 export async function cleanupMembers(input) {
     const room = getRoomRecord(input.roomId);
     if (!room)

package/dist/rooms-tasks/room-state.js

@@ -112,6 +112,8 @@ export function setOwnerSeat(id, ownerSeatCid, inviteFingerprint) {
 }
 export function updateMemberSeats(id, seats) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     r.member_seats = seats;
     writeRoom(r);
     return r;
@@ -135,6 +137,8 @@ const LAUNCH_ORDER = [
 ];
 export function updateMemberStartup(id, roleName, update) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     const seat = r.member_seats.find(candidate => candidate.role_name === roleName);
     if (!seat)
         throw new RoomStateError(`room ${id} has no recorded member ${roleName}`);
@@ -151,6 +155,8 @@ export function updateMemberStartup(id, roleName, update) {
 }
 export function activateRoom(id) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; activation is fenced`);
     r.state = 'active';
     r.saga = { phase: 'completed', step_index: 0 };
     delete r.provisioning_detail;

package/dist/runner.js

@@ -662,6 +662,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                         harness: role.harness,
                         config: role.owner_channel,
                         session: arbiter,
+                        startupPending: () => !sessionStartupComplete,
                         stateDir: dir,
                         env: role.env,
                         log: deps.log,
@@ -756,6 +757,26 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             // interruption to steering until this startup turn reaches a terminal
             // success, so there is neither a deaf gap nor a boot-cancellation loop.
             monitorLoop = monitor?.run(pid);
+            // Owner traffic and agent replies must be observed during a long first
+            // turn. Ordinary owner input steers until startup has proved successful.
+            if (ownerChannel) {
+                try {
+                    await ownerChannel.start();
+                    control.setOwnerChannel(ownerChannel);
+                }
+                catch (error) {
+                    monitor?.stop();
+                    if (monitorLoop)
+                        await monitorLoop;
+                    await control.close();
+                    await ownerChannel.close().catch(() => undefined);
+                    ownerBinder?.release();
+                    await agentSession.close();
+                    unsubscribeRecovery?.();
+                    throw new Error(`[${name}] owner channel failed to start: `
+                        + `${error?.message ?? String(error)}`);
+                }
+            }
             const started = await starting;
             // A temporary role's first turn can be the active turn when an ours wake
             // needs immediate attention. A typed console/monitor cancellation ends
@@ -768,6 +789,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             if (!started.succeeded && !interruptedForWake) {
                 monitor?.stop();
                 await control.close();
+                await ownerChannel?.close().catch(() => undefined);
                 ownerBinder?.release();
                 await agentSession.close();
                 unsubscribeRecovery?.();
@@ -795,26 +817,6 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
                     + 'keeping temporary supervisor alive');
             sessionStartupComplete = true;
-            if (ownerChannel) {
-                try {
-                    await ownerChannel.start();
-                }
-                catch (error) {
-                    monitor?.stop();
-                    if (monitorLoop)
-                        await monitorLoop;
-                    await ownerChannel.close().catch(() => undefined);
-                    await control.close();
-                    ownerBinder?.release();
-                    await agentSession.close();
-                    unsubscribeRecovery?.();
-                    throw new Error(`[${name}] owner channel failed to start: `
-                        + `${error?.message ?? String(error)}`);
-                }
-            }
-            if (ownerChannel) {
-                control.setOwnerChannel(ownerChannel);
-            }
             reloadLoopConfig = async () => {
                 const nextRole = findRole(loadConfig(configPath), name);
                 const definitions = nextRole.loops ?? [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.4",
+  "version": "1.2.0-nightly.6",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -41,9 +41,9 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "2.8.1-nightly.8",
-    "@ours.network/mcp": "1.2.0-nightly.6",
-    "@ours.network/sdk": "3.8.1-nightly.10",
+    "@ours.network/cli": "2.8.1-nightly.9",
+    "@ours.network/mcp": "1.2.0-nightly.7",
+    "@ours.network/sdk": "3.8.1-nightly.11",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "react": "^19.1.1",
@@ -57,7 +57,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "3.8.1-nightly.2",
+    "@ours.network/daemon": "3.8.1-nightly.3",
     "@playwright/test": "^1.54.1",
     "@types/node": "^20.14.0",
     "@types/react": "^19.1.9",