@ours.network/fleet 1.2.0-nightly.52 → 1.2.0-nightly.54

package/dist/monitor.js

@@ -325,6 +325,7 @@ export class Monitor {
     stopped = false;
     bootDeadline = 0;
     currentAbort = null;
+    initialBacklogPending = true;
     // Refusal-wedge detector (issue #19): consecutive delivered wakes whose turn
     // ended in an API error with no completed turn in between.
     apiErrorStreak = 0;
@@ -389,6 +390,41 @@ export class Monitor {
                     this.degrade('offline', 'session offline');
                     return;
                 }
+                // The native SessionStart hook is disabled for managed sessions. Check
+                // existing unread work AFTER the ready turn, without a model inbox ritual
+                // or touching read status. Keep retrying a failed probe/delivery before
+                // committing stream cursors, including on supervisor restarts.
+                if (this.initialBacklogPending) {
+                    try {
+                        const body = await this.readInitialUnread();
+                        if (!Array.isArray(body.identities))
+                            throw new Error('unread summary is malformed');
+                        const row = body.identities.find(row => row.name === this.identity);
+                        if (row && (!Number.isSafeInteger(row.count) || Number(row.count) < 0
+                            || !Number.isSafeInteger(row.files) || Number(row.files) < 0))
+                            throw new Error('unread identity summary is malformed');
+                        const messages = this.cfg.wake_sources.includes('message_received') ? Number(row?.count ?? 0) : 0;
+                        const files = this.cfg.wake_sources.includes('file_received') ? Number(row?.files ?? 0) : 0;
+                        if ((messages || files) && !await this.deliverLine(`${PREFIX} unread backlog: ${messages} messages, ${files} files — run get_messages; drain remaining unread batches and authorize files before retrieving them`)) {
+                            await this.deps.sleep(BACKOFF_MAX_MS);
+                            continue;
+                        }
+                        this.initialBacklogPending = false;
+                        this.recover('connectivity', 'auth');
+                    }
+                    catch (e) {
+                        if (this.stopped)
+                            return;
+                        if (e instanceof AuthError)
+                            this.degrade('auth', e.message);
+                        else
+                            this.degrade('connectivity', 'initial unread check unavailable; retrying');
+                        await this.deps.sleep(BACKOFF_MAX_MS);
+                        continue;
+                    }
+                }
+                if (this.stopped)
+                    return;
                 let body;
                 try {
                     body = await this.doFetch(String(this.cursor ?? 0), LONGPOLL_STALL_MS, 'stall');
@@ -463,7 +499,9 @@ export class Monitor {
         catch { /* no stragglers / abort — deliver what we have */ }
     }
     async deliver(pid, batch) {
-        const line = formatNotificationLine(batch);
+        return this.deliverLine(formatNotificationLine(batch));
+    }
+    async deliverLine(line) {
         if (!this.deps.delivery) {
             this.degrade('delivery', 'structured agent-session delivery is unavailable');
             return false;
@@ -551,6 +589,32 @@ export class Monitor {
         }
         return this.profileClientPromise;
     }
+    async readInitialUnread() {
+        const ctrl = new AbortController();
+        this.currentAbort = ctrl;
+        const timer = this.deps.timers.set(() => ctrl.abort(), 5_000);
+        let client;
+        try {
+            const { endpoint, expectedInstanceId, credentialPath } = this.profile;
+            const options = {
+                endpoint, expectedInstanceId, credentialPath,
+                sessionMode: 'external', leaseToken: this.monitorLeaseToken, env: {},
+                requestSignal: ctrl.signal,
+            };
+            client = await (this.deps.attachClient?.(options) ?? attachOursClient(options));
+            return await client.unread();
+        }
+        catch (error) {
+            if (/(?:HTTP\s*401|unauthori[sz]ed|API token)/i.test(msg(error)))
+                throw new AuthError('daemon rejected the API token (401); initial unread check unavailable; retrying');
+            throw error;
+        }
+        finally {
+            this.deps.timers.clear(timer);
+            this.currentAbort = null;
+            await client?.close().catch(() => undefined);
+        }
+    }
     async disposeProfileClient() {
         const pending = this.profileClientPromise;
         this.profileClientPromise = undefined;

package/dist/rooms-tasks/cli.js

@@ -247,6 +247,8 @@ const taskListMarkdown = (tasks, title = 'Tasks') => renderMarkdownList({
     icon: '📋', title, empty: 'No tasks found.',
     records: tasks.map(t => `${taskStatus(t.state)} ${markdownCode(t.task_id)} — ${markdownProse(t.title)}`
         + ` — List ${markdownCode(t.list_name ?? 'default')}`
+        + (t.deletion?.status === 'pending' ? ' — Deletion pending'
+            + (t.deletion.error ? `: ${markdownProse(t.deletion.error)}` : '') : '')
         + (t.blocked ? ` — 🚧 Blocked: ${markdownProse(t.blocked.reason)}` : '')),
 });
 const taskActionMarkdown = (title, task, fields = []) => {
@@ -714,6 +716,7 @@ export function registerTaskCommands(parent, cOpt) {
         .option('--state <state>', 'filter by state (backlog|active|provisioning|review|done|cancelled|failed|all)')
         .option('--list <name>', 'filter by task list')
         .option('--group-by-list', 'group deterministic results by list (JSON)')
+        .option('--include-deleting', 'include tasks whose accepted deletion is still pending')
         .option('--json', 'JSON output')
         .action(async (opts) => {
         try {
@@ -722,7 +725,8 @@ export function registerTaskCommands(parent, cOpt) {
                 stateFilter = opts.state;
             }
             const service = taskRoomService(opts.configuration);
-            const filter = { ...(stateFilter ? { state: stateFilter } : {}), ...(opts.list ? { list: opts.list } : {}) };
+            const filter = { ...(stateFilter ? { state: stateFilter } : {}), ...(opts.list ? { list: opts.list } : {}),
+                ...(opts.includeDeleting ? { includeDeleting: true } : {}) };
             const tasks = service.listTasks(filter);
             if (opts.json) {
                 console.log(JSON.stringify(opts.groupByList
@@ -839,7 +843,8 @@ export function registerTaskCommands(parent, cOpt) {
         try {
             const service = taskRoomService(opts.configuration);
             const { task: t, orchestration: room } = service.getTask(id);
-            const readiness = t.state === 'active' ? await service.observeTaskReadiness(id) : undefined;
+            const readiness = t.state === 'active' && t.deletion?.status !== 'pending'
+                ? await service.observeTaskReadiness(id) : undefined;
             if (opts.json) {
                 console.log(JSON.stringify({
                     schema_version: 1, task: t, orchestration: room ?? null,
@@ -853,6 +858,11 @@ export function registerTaskCommands(parent, cOpt) {
                     { label: 'ID', value: t.task_id, kind: 'code' },
                     { label: 'Title', value: t.title },
                     { label: 'Status', value: taskStatus(t.state), kind: 'markdown' },
+                    ...(t.deletion?.status === 'pending' ? [
+                        { label: 'Deletion', value: 'Pending — cleanup is not complete' },
+                        ...(t.deletion.error ? [{ label: 'Cleanup error', value: t.deletion.error }] : []),
+                        { label: 'Retry', value: `ours-fleet task delete ${t.task_id} ${t.task_id}`, kind: 'code' },
+                    ] : []),
                     ...(readiness ? [{ label: 'Readiness', value: readiness.state },
                         ...('reason' in readiness ? [{ label: 'Reason', value: readiness.reason }] : [])] : []),
                     ...(t.blocked ? [{ label: 'Blocked', value: t.blocked.reason }] : []),

package/dist/rooms-tasks/cowork-http.js

@@ -2,6 +2,26 @@ import { randomUUID } from 'node:crypto';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { readPrivateFile } from '@ours.network/sdk/connector';
 import { CoworkProtocolError, CoworkUnavailableError } from './cowork-adapter.js';
+const TRANSPORT_CODES = new Set(['EACCES', 'ENOENT', 'ECONNREFUSED', 'ECONNRESET',
+    'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_SOCKET',
+    'CERT_HAS_EXPIRED', 'ERR_TLS_CERT_ALTNAME_INVALID']);
+function safeFailureKind(error, signal) {
+    if (signal.aborted)
+        return 'timeout';
+    for (const value of [error, error instanceof Error ? error.cause : undefined]) {
+        if (!value || typeof value !== 'object')
+            continue;
+        const code = value.code;
+        if (typeof code === 'string' && TRANSPORT_CODES.has(code))
+            return code;
+        const name = value.name;
+        if (name === 'TimeoutError')
+            return 'timeout';
+        if (name === 'AbortError')
+            return 'aborted';
+    }
+    return 'transport_error';
+}
 /** Same RPC protocol as the local socket; never replay a possibly delivered mutation. */
 export async function coworkHttpCall(profile, method, params, timeoutMs) {
     const id = randomUUID();
@@ -9,11 +29,15 @@ export async function coworkHttpCall(profile, method, params, timeoutMs) {
     const body = JSON.stringify({ version: 1, id, method, params });
     if (Buffer.byteLength(body) > 1024 * 1024)
         throw new CoworkProtocolError(method, 'request exceeded 1 MiB');
+    let stage = 'server verification';
     try {
         const client = await attachOursClient({ endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken: `fleet-cowork-check-${id}`, env: {}, requestSignal: signal });
+        stage = 'verification cleanup';
         await client.close();
+        stage = 'credential read';
         const token = readPrivateFile(profile.credentialPath, 4096).toString('utf8').trim();
+        stage = 'management request';
         const response = await fetch(profile.serverUrl + '/cowork/management/rpc', {
             method: 'POST', redirect: 'error', signal,
             headers: { 'content-type': 'application/json', 'x-ours-api-token': token },
@@ -26,6 +50,7 @@ export async function coworkHttpCall(profile, method, params, timeoutMs) {
         const reader = response.body?.getReader();
         if (!reader)
             throw new CoworkProtocolError(method, 'empty HTTP response');
+        stage = 'management response';
         const chunks = [];
         let size = 0;
         try {
@@ -65,6 +90,9 @@ export async function coworkHttpCall(profile, method, params, timeoutMs) {
     catch (error) {
         if (error instanceof CoworkProtocolError)
             throw error;
-        throw new CoworkUnavailableError('Cowork HTTP management failed; check the selected server and credential', { cause: error });
+        // Durable cleanup records retain only .message. Keep the RPC step and a
+        // bounded allowlisted category there, never raw URLs, credentials or cause text.
+        const operation = /^[a-z][a-z0-9_.-]{0,79}$/.test(method) ? method : 'management';
+        throw new CoworkUnavailableError(`Cowork HTTP ${operation} failed during ${stage} (${safeFailureKind(error, signal)})`, { cause: error });
     }
 }

package/dist/rooms-tasks/erasure.js

@@ -6,7 +6,7 @@ import { parse } from 'yaml';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
 import { readTempSupervisor, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
-import { assertSafeAncestors, auditWorkspaceGit } from './workspace.js';
+import { assertSafeAncestors, auditWorkspaceGit, prepareOwnedDeletionTree } from './workspace.js';
 function entries(path) {
     try {
         return readdirSync(path);
@@ -98,7 +98,7 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
                 throw new Error('Archive writer is not stopped');
             if (creation?.role === supervisor.role && typeof creation.creationActionId === 'string')
                 actions.get(supervisor.role).add(creation.creationActionId);
-            auditWorkspaceGit(path);
+            auditWorkspaceGit(path, { forDeletion: true });
             launches.push({ role: supervisor.role, launchId: supervisor.launchId });
             paths.push(path);
         }
@@ -127,7 +127,7 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
             const state = json(join(path, 'state.json')), instance = json(join(path, 'instance.json'));
             if (state?.lifetime === 'temporary' && actions.get(state.name)?.has(state.action)
                 && instance?.role === state.name && instance?.temporary === true && instance?.instance === state.instance) {
-                auditWorkspaceGit(path);
+                auditWorkspaceGit(path, { forDeletion: true });
                 paths.push(path);
             }
         }
@@ -158,6 +158,8 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
         }
         manifest.phases[path] = 'renamed';
         replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+        if (existsSync(tombstone) && lstatSync(tombstone).isDirectory())
+            prepareOwnedDeletionTree(tombstone);
         rmSync(tombstone, { recursive: true, force: true });
         manifest.phases[path] = 'removed';
         replaceFileAtomically(manifestPath, JSON.stringify(manifest));

package/dist/rooms-tasks/workspace-artifacts.js

@@ -66,7 +66,7 @@ export function collectWorkspaceArchives(workspace) {
         });
         if (!terminated || entry.name.endsWith('.retiring'))
             throw new WorkspaceError('workspace archive retirement is incomplete');
-        auditWorkspaceGit(path);
+        auditWorkspaceGit(path, { forDeletion: true });
         owned.push(path);
     }
     // Preflight the entire set before mutation; task/room record remains until all succeed.

package/dist/rooms-tasks/workspace.d.ts

@@ -11,13 +11,20 @@ export declare class WorkspaceError extends Error {
 export declare function assertSafeAncestors(path: string): void;
 export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
 export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Caller must first prove the exact workspace marker or retired archive
+ * provenance, and hold its lifecycle lock with all managed writers retired.
+ * Directories need owner rwx for recursive removal; ordinary files do not.
+ */
+export declare function prepareOwnedDeletionTree(path: string): void;
 /** Atomic directory publication; retry uses the durable token, never adopts another folder. */
 export declare function ensureWorkspace(w: OwnedWorkspace): string;
 /** Audit both directions of Git worktree registration, without executing repository config/hooks.
  * All registrations and common dirs must be inside this workspace. Removing the complete
  * workspace then removes their registries atomically with the owned repositories; never prune.
  */
-export declare function auditWorkspaceGit(path: string): void;
+export declare function auditWorkspaceGit(path: string, options?: {
+    forDeletion?: boolean;
+}): void;
 /** Called only after all managed writers retire, under the owner's lifecycle lock.
  * The tombstone is derived from the durable unguessable token. A crash during rm
  * resumes that exact tombstone even if rm already removed its marker.

package/dist/rooms-tasks/workspace.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, closeSync, constants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { stateRoot } from '../paths.js';
 const MARKER = '.fleet-workspace.json';
@@ -57,6 +57,104 @@ function marked(path, w) {
 function staging(w, phase) {
     return join(dirname(w.path), `.${w.id}.${w.token}.${phase}`);
 }
+/** Recover only owner access on a pinned, real entry. Never chmod a symlink
+ * target or a hardlinked file through an alias outside the deletion tree.
+ * Linux O_PATH can pin an entry even when a same-owner fixture removed every
+ * permission; /proc/self/fd then addresses that inode rather than its old name.
+ */
+function withOwnerPermissions(path, before, bits, work, rollback = false) {
+    if (before.isSymbolicLink() || (!before.isDirectory() && !before.isFile()))
+        fail(`unsafe permission repair ${path}`);
+    const changed = (before.mode & bits) !== bits;
+    const uid = process.geteuid?.();
+    if (changed && (uid === undefined || before.uid !== uid))
+        fail(`cannot restore owner access to ${path}: owned by uid ${before.uid}`);
+    if (changed && before.isFile() && before.nlink !== 1)
+        fail(`cannot restore owner access to hardlinked Git metadata ${path}`);
+    let descriptor, pathDescriptor = false;
+    try {
+        descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (process.platform !== 'linux' || error.code !== 'EACCES')
+            throw error;
+        // O_PATH is Linux-specific and is not exposed in Node's fs.constants.
+        descriptor = openSync(path, 0x200000 | constants.O_NOFOLLOW);
+        pathDescriptor = true;
+    }
+    const setMode = (mode) => pathDescriptor
+        ? chmodSync(`/proc/self/fd/${descriptor}`, mode)
+        : fchmodSync(descriptor, mode);
+    try {
+        const pinned = fstatSync(descriptor);
+        if (pinned.dev !== before.dev || pinned.ino !== before.ino || pinned.uid !== before.uid
+            || pinned.mode !== before.mode || pinned.nlink !== before.nlink)
+            fail(`entry changed before permission repair ${path}`);
+        if (changed)
+            setMode((before.mode & 0o7777) | bits);
+        try {
+            const assertNamedEntry = () => {
+                const named = lstatSync(path);
+                if (named.dev !== before.dev || named.ino !== before.ino || named.uid !== before.uid
+                    || named.isSymbolicLink() || named.isDirectory() !== before.isDirectory())
+                    fail(`entry changed during permission repair ${path}`);
+            };
+            assertNamedEntry();
+            const result = work(process.platform === 'linux' ? `/proc/self/fd/${descriptor}` : path);
+            assertNamedEntry();
+            return result;
+        }
+        catch (error) {
+            if (rollback && changed)
+                setMode(before.mode & 0o7777);
+            throw error;
+        }
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+/** Caller must first prove the exact workspace marker or retired archive
+ * provenance, and hold its lifecycle lock with all managed writers retired.
+ * Directories need owner rwx for recursive removal; ordinary files do not.
+ */
+export function prepareOwnedDeletionTree(path) {
+    assertSafeAncestors(path);
+    const uid = process.geteuid?.();
+    if (uid === undefined || lstatSync(path).uid !== uid)
+        fail(`deletion root is not owned by the current uid: ${path}`);
+    const device = lstatSync(dirname(path)).dev;
+    const visit = (dir) => {
+        const entry = lstatSync(dir);
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            fail(`unsafe deletion directory ${dir}`);
+        if (entry.dev !== device)
+            fail(`foreign mounted directory ${dir}`);
+        withOwnerPermissions(dir, entry, 0o700, accessDir => {
+            for (const child of readdirSync(accessDir, { withFileTypes: true })) {
+                if (process.platform !== 'linux') {
+                    const named = lstatSync(dir);
+                    if (named.dev !== entry.dev || named.ino !== entry.ino || named.isSymbolicLink())
+                        fail(`deletion directory changed during traversal ${dir}`);
+                }
+                if (child.isDirectory() && !child.isSymbolicLink())
+                    visit(join(accessDir, child.name));
+            }
+        });
+    };
+    visit(path);
+}
+function markedForDeletion(w) {
+    assertSafeAncestors(w.path);
+    const before = lstatSync(w.path);
+    if (process.geteuid?.() !== before.uid)
+        fail(`workspace root is not owned by the current uid: ${w.path}`);
+    if (before.dev !== lstatSync(dirname(w.path)).dev)
+        fail(`foreign mounted directory ${w.path}`);
+    // The durable exact path plus current-UID real root permit temporary owner
+    // access to read the marker, but never substitute for the marker itself.
+    withOwnerPermissions(w.path, before, 0o700, () => marked(w.path, w), true);
+}
 /** Atomic directory publication; retry uses the durable token, never adopts another folder. */
 export function ensureWorkspace(w) {
     validateWorkspace(w);
@@ -105,45 +203,70 @@ function ownedPointer(base, from, value) {
  * All registrations and common dirs must be inside this workspace. Removing the complete
  * workspace then removes their registries atomically with the owned repositories; never prune.
  */
-export function auditWorkspaceGit(path) {
+export function auditWorkspaceGit(path, options = {}) {
+    const rootEntry = lstatSync(path);
+    if (options.forDeletion)
+        prepareOwnedDeletionTree(path);
     const device = lstatSync(path).dev;
-    const visit = (dir, admin = false) => {
-        admin ||= Boolean(stat(join(dir, 'HEAD')) && (stat(join(dir, 'objects')) || stat(join(dir, 'commondir'))));
-        for (const entry of readdirSync(dir, { withFileTypes: true })) {
-            const p = join(dir, entry.name);
-            if (entry.isSymbolicLink()) {
-                if (admin || entry.name === '.git' || entry.name === 'commondir' || entry.name === 'gitdir')
-                    fail(`symlink git metadata ${p}`);
-                continue; // rm unlinks ordinary artifact symlinks, never follows them.
-            }
-            if (entry.isDirectory()) {
-                if (lstatSync(p).dev !== device)
-                    fail(`foreign mounted directory ${p}`);
-                visit(p, admin || entry.name === '.git');
-                continue;
-            }
-            if (!entry.isFile())
-                continue; // sockets/FIFOs in retired runtime state are unlinked, never opened
-            if (entry.name === '.git') {
-                const value = readFileSync(p, 'utf8').trim();
-                if (!value.startsWith('gitdir: '))
-                    fail(`invalid git file ${p}`);
-                const gitdir = ownedPointer(path, dir, value.slice(8));
-                if (!stat(gitdir)?.isDirectory())
-                    fail(`missing git directory ${gitdir}`);
-            }
-            // Git admin files, including bare repositories and submodules.
-            if (entry.name === 'commondir' && (admin || stat(join(dir, 'HEAD')))) {
-                const common = ownedPointer(path, dir, readFileSync(p, 'utf8'));
-                if (!stat(common)?.isDirectory())
-                    fail(`invalid git common directory ${common}`);
-            }
-            if (entry.name === 'gitdir' && (admin || stat(join(dir, 'commondir')))) {
-                const target = ownedPointer(path, dir, readFileSync(p, 'utf8'));
-                if (stat(target) && !stat(target)?.isFile())
-                    fail(`invalid worktree backlink ${target}`);
+    if (options.forDeletion && (lstatSync(path).ino !== rootEntry.ino || device !== rootEntry.dev || lstatSync(path).isSymbolicLink()))
+        fail(`workspace changed before Git audit ${path}`);
+    const readPointer = (file) => {
+        if (!options.forDeletion)
+            return readFileSync(file, 'utf8');
+        const before = lstatSync(file);
+        if (before.dev !== device)
+            fail(`foreign mounted Git metadata ${file}`);
+        return withOwnerPermissions(file, before, 0o400, accessFile => readFileSync(accessFile, 'utf8'));
+    };
+    const visit = (dir, accessDir = dir, admin = false) => {
+        const before = lstatSync(accessDir);
+        const inspect = (pinnedDir) => {
+            admin ||= Boolean(stat(join(pinnedDir, 'HEAD')) && (stat(join(pinnedDir, 'objects')) || stat(join(pinnedDir, 'commondir'))));
+            for (const entry of readdirSync(pinnedDir, { withFileTypes: true })) {
+                if (options.forDeletion && process.platform !== 'linux') {
+                    const named = lstatSync(accessDir);
+                    if (named.dev !== before.dev || named.ino !== before.ino || named.isSymbolicLink())
+                        fail(`directory changed during Git audit ${dir}`);
+                }
+                const p = join(pinnedDir, entry.name);
+                if (entry.isSymbolicLink()) {
+                    if (admin || entry.name === '.git' || entry.name === 'commondir' || entry.name === 'gitdir')
+                        fail(`symlink git metadata ${p}`);
+                    continue; // rm unlinks ordinary artifact symlinks, never follows them.
+                }
+                if (entry.isDirectory()) {
+                    if (lstatSync(p).dev !== device)
+                        fail(`foreign mounted directory ${p}`);
+                    visit(join(dir, entry.name), p, admin || entry.name === '.git');
+                    continue;
+                }
+                if (!entry.isFile())
+                    continue; // sockets/FIFOs in retired runtime state are unlinked, never opened
+                if (entry.name === '.git') {
+                    const value = readPointer(p).trim();
+                    if (!value.startsWith('gitdir: '))
+                        fail(`invalid git file ${p}`);
+                    const gitdir = ownedPointer(path, dir, value.slice(8));
+                    if (!stat(gitdir)?.isDirectory())
+                        fail(`missing git directory ${gitdir}`);
+                }
+                // Git admin files, including bare repositories and submodules.
+                if (entry.name === 'commondir' && (admin || stat(join(pinnedDir, 'HEAD')))) {
+                    const common = ownedPointer(path, dir, readPointer(p));
+                    if (!stat(common)?.isDirectory())
+                        fail(`invalid git common directory ${common}`);
+                }
+                if (entry.name === 'gitdir' && (admin || stat(join(pinnedDir, 'commondir')))) {
+                    const target = ownedPointer(path, dir, readPointer(p));
+                    if (stat(target) && !stat(target)?.isFile())
+                        fail(`invalid worktree backlink ${target}`);
+                }
             }
-        }
+        };
+        if (options.forDeletion)
+            withOwnerPermissions(accessDir, before, 0o700, inspect);
+        else
+            inspect(accessDir);
     };
     visit(path);
 }
@@ -156,8 +279,8 @@ export function assertWorkspaceDeletable(w, owner, id) {
     if (stat(w.path)) {
         if (stat(staging(w, 'deleting')))
             fail('both live and deleting workspace exist');
-        marked(w.path, w);
-        auditWorkspaceGit(w.path);
+        markedForDeletion(w);
+        auditWorkspaceGit(w.path, { forDeletion: true });
     }
     const pending = staging(w, 'provisioning');
     if (stat(pending)) {
@@ -177,8 +300,8 @@ export function deleteWorkspace(w, owner, id) {
     if (stat(w.path)) {
         if (stat(tomb))
             fail('both live and deleting workspace exist');
-        marked(w.path, w);
-        auditWorkspaceGit(w.path);
+        markedForDeletion(w);
+        auditWorkspaceGit(w.path, { forDeletion: true });
         renameSync(w.path, tomb);
     }
     if (stat(pending)) {
@@ -189,7 +312,9 @@ export function deleteWorkspace(w, owner, id) {
         rmSync(pending, { recursive: true });
     }
     if (stat(tomb)) {
-        assertSafeAncestors(tomb);
+        // This exact token-derived tombstone has already passed the marker and
+        // Git audit; partial removal may have consumed those proofs on disk.
+        prepareOwnedDeletionTree(tomb);
         rmSync(tomb, { recursive: true });
     }
 }

package/dist/runner.js

@@ -1,3 +1,5 @@
+import { StartupTelemetry } from './startup-telemetry.js';
+import { managedStartupPrompt, managedTaskPrompt } from './startup-prompt.js';
 import { createLayoutControl } from './rooms-tasks/layout-control.js';
 import { TemporaryChatIdle } from './temp-idle.js';
 import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
@@ -469,6 +471,8 @@ export function isRecoverableTempStartupCancellation(temp, result) {
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export async function runOnce(name, opts = {}, partialDeps = {}) {
     const deps = { ...defaultDeps(), ...partialDeps };
+    const startupTelemetry = new StartupTelemetry(deps.now, line => deps.log(`[${name}] ${line}`));
+    startupTelemetry.mark('supervisor_started');
     const temp = opts.temp === true;
     const dir = agentDir(name, temp);
     const configPath = temp ? opts.configPath : resolveConfigPath(dir, opts.configPath);
@@ -572,7 +576,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (rprefix.length)
             wrappedArgv = [...rprefix, ...wrappedArgv];
     }
+    startupTelemetry.mark('identity_prepare_started');
     const managedService = await deps.prepareAgentOurs(role, dir, opts.identityLifetime ? opts.identityLifetime === 'temporary' : temp);
+    startupTelemetry.mark('identity_ready');
     let layoutRetiring = false;
     try {
         const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, { ...harnessChildEnv(role, launch.env, dir), ...subscription?.env });
@@ -591,10 +597,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
         }
         // Prime the supervisor mail monitor's notification cursor at the
-        // stream tip BEFORE the session launches so no arrival is missed during boot
-        // (backlog before the tip is the SessionStart hook's job). Native-mode roles
-        // leave wake ownership to the harness. Temp snapshots predating `monitor:` are
-        // treated as native (monitor may be undefined on an old role.yaml).
+        // stream tip BEFORE the session launches so no arrival is missed during boot.
+        // Monitor.run checks the body-free initial unread summary after readiness;
+        // managed native hooks do not own backlog delivery.
         let sessionHandle;
         let modelRecovery;
         const resolvedMonitorDeps = monitorDeps(deps, role.env);
@@ -662,6 +667,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             if (perms.unattended === 'deny')
                 deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
                     `permission requests are automatically denied once each (reject_once) and the turn continues`);
+            startupTelemetry.mark('harness_starting');
             agentSession = await managedService.runtime.startHarness(() => deps.startAgentSession(adapter.agentSession, {
                 managedOurs: managedHarness.ours,
                 role, prep,
@@ -669,6 +675,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 cwd: runCwd, stateDir: dir, mode, permissions: perms,
                 permissionMode: effectivePermissionMode(role), log: deps.log,
             }));
+            managedService.setFileDelivery?.(agentSession.sendFileToChat?.bind(agentSession));
+            startupTelemetry.mark('harness_ready');
             pid = agentSession.pid;
             arbiter = new RoleTurnArbiter(agentSession);
             sessionHandle = arbiter;
@@ -679,6 +687,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 if (evidence)
                     resolvedMonitorDeps.onFailureEvidence?.(evidence);
             });
+            const unsubscribeTelemetry = agentSession.subscribeConversation?.(event => startupTelemetry.observe(event));
             const unsubscribeStartup = agentSession.subscribeConversation?.(event => {
                 if (event.kind !== 'turn.completed' || !('outcome' in event.payload) || event.payload.outcome !== 'completed')
                     return;
@@ -688,7 +697,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     startMonitorAfterStartup();
                 }
             });
-            unsubscribeRecovery = () => { unsubscribeFailure(); unsubscribeStartup?.(); };
+            unsubscribeRecovery = () => { unsubscribeFailure(); unsubscribeStartup?.(); unsubscribeTelemetry?.(); };
             if (role.owner_channel) {
                 try {
                     ownerBinder = await deps.acquireOwnerBinder(dir, name, role.owner_channel.identity);
@@ -805,12 +814,11 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     };
                 },
             };
-            const firstPrompt = mode === 'fresh'
-                ? `Read and follow ${join(dir, 'briefing.md')} now.`
-                : `Your supervisor has verified your assigned identity and room readiness. Read ${join(dir, 'WORKLOG.md')} and ${join(dir, 'briefing.md')}, then continue using the available ours tools.`;
+            const firstPrompt = managedStartupPrompt(dir, mode, booted);
             // Wait for the first turn's TERMINAL result. An agent that accepts the
             // startup prompt and then refuses it has not started; logging the role as
-            // up would hide a role that never read its briefing.
+            // up would hide a role that never completed its readiness turn.
+            startupTelemetry.mark('startup_submitted');
             const starting = arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
             // Keep the early cursor baseline; do not deliver wakes into the protected
             // first turn. Steering can pre-empt startup just like cancellation.
@@ -835,6 +843,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 }
             }
             const started = await starting;
+            startupTelemetry.finish();
             // A temporary role's first turn can be the active turn when an ours wake
             // needs immediate attention. A typed console/monitor cancellation ends
             // only that turn: the already-live agent session and any queued wake remain
@@ -875,6 +884,20 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + 'keeping temporary supervisor alive');
             startupRecoveryAllowed = interruptedForWake;
             sessionStartupComplete = started.succeeded || (interruptedForWake && successfulTurnObserved);
+            if (started.succeeded)
+                startupTelemetry.mark('readiness_turn_completed');
+            // Readiness is now complete. Configured work (or retained continuity) is
+            // admitted as a distinct turn; its terminal result must not block console
+            // readiness, mail delivery, or supervisor liveness. Empty fresh agents wait
+            // for authenticated console input or the monitor's unread/arrival wake.
+            if (started.succeeded && !deps.shouldStop?.() && (role.mission?.trim() || role.roomMemberStartup?.task?.trim() || role.briefing_file?.trim() || booted)) {
+                const queued = await arbiter.queuePrompt(managedTaskPrompt(dir, mode, booted), {
+                    origin: { kind: 'startup' },
+                });
+                void queued.completion.then(result => {
+                    deps.log(`[${name}] configured task turn ${result.outcome}`);
+                }, () => deps.log(`[${name}] configured task turn failed`));
+            }
             reloadLoopConfig = async () => {
                 const nextRole = findRole(loadConfig(configPath), name);
                 const definitions = nextRole.loops ?? [];