@ours.network/fleet 1.2.0-nightly.53 → 1.2.0-nightly.55

package/dist/harness/codex-file-inventory.js

@@ -0,0 +1,113 @@
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const parse = (line) => { try {
+    const v = JSON.parse(line);
+    return object(v) ? v : undefined;
+}
+catch {
+    return undefined;
+} };
+export class CodexFileInventory {
+    sendToCodex;
+    emitToClient;
+    checks = new Map();
+    sequence = 0;
+    constructor(sendToCodex, emitToClient) {
+        this.sendToCodex = sendToCodex;
+        this.emitToClient = emitToClient;
+    }
+    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
+    observeClientLine(line) {
+        const message = parse(line);
+        if (message?.method !== 'turn/start')
+            return true;
+        const threadId = object(message.params) ? message.params.threadId : undefined;
+        if (typeof threadId !== 'string' || !threadId || message.id === undefined || this.checks.size >= 8) {
+            this.reject(message);
+            return false;
+        }
+        const check = { request: message, threadId, servers: [], cursors: new Set(), timer: setTimeout(() => {
+                for (const [id, c] of this.checks)
+                    if (c === check)
+                        this.checks.delete(id);
+                this.reject(message);
+            }, 30_000) };
+        this.query(check);
+        return false;
+    }
+    observeServerLine(line) {
+        const message = parse(line), id = message?.id;
+        if (typeof id !== 'string')
+            return true;
+        const check = this.checks.get(id);
+        if (!check)
+            return true;
+        this.checks.delete(id);
+        const result = message?.result;
+        if (!object(result) || !Array.isArray(result.data) || result.data.some(s => !object(s)) || check.servers.length + result.data.length > 1000) {
+            this.finish(check, false);
+            return false;
+        }
+        check.servers.push(...result.data);
+        if (result.nextCursor !== null) {
+            const cursor = result.nextCursor;
+            if (typeof cursor !== 'string' || !cursor || check.cursors.has(cursor) || check.cursors.size >= 10)
+                this.finish(check, false);
+            else {
+                check.cursors.add(cursor);
+                this.query(check, cursor);
+            }
+            return false;
+        }
+        this.finish(check, this.qualified(check.servers));
+        return false;
+    }
+    close() { for (const c of this.checks.values())
+        clearTimeout(c.timer); this.checks.clear(); }
+    query(check, cursor) {
+        const id = `ours-fleet-file-inventory-${++this.sequence}`;
+        this.checks.set(id, check);
+        this.sendToCodex(JSON.stringify({ id, method: 'mcpServerStatus/list', params: { threadId: check.threadId, detail: 'full', limit: 100, ...(cursor ? { cursor } : {}) } }));
+    }
+    qualified(servers) {
+        let managed = 0;
+        for (const server of servers) {
+            // Unknown or failed discovery cannot establish absence of another connector.
+            if (server.toolsError !== null || !object(server.tools))
+                return false;
+            if (!object(server.serverInfo) || typeof server.serverInfo.name !== 'string')
+                return false;
+            const tools = Object.values(server.tools).filter(object);
+            const names = new Set(tools.map(t => t.name));
+            if (server.name !== 'ours') {
+                if (server.serverInfo.name === 'ours')
+                    return false;
+                if (tools.some(t => t.name === 'send_file' && object(t.inputSchema) && object(t.inputSchema.properties) && 'contact' in t.inputSchema.properties))
+                    return false;
+                if (names.has('current_identity') && names.has('send_file') && names.has('get_messages'))
+                    return false;
+                continue;
+            }
+            managed++;
+            if (server.serverInfo.name !== 'ours' || server.runtimeStatus !== 'connected')
+                return false;
+            const files = tools.filter(t => t.name === 'send_file');
+            if (files.length !== 1 || !object(files[0].inputSchema))
+                return false;
+            const schema = files[0].inputSchema;
+            if (!object(schema.properties) || !object(schema.properties.contact) || schema.additionalProperties !== false
+                || (Array.isArray(schema.required) && schema.required.includes('contact')))
+                return false;
+        }
+        return managed === 1;
+    }
+    finish(check, allowed) {
+        clearTimeout(check.timer);
+        if (allowed)
+            this.sendToCodex(JSON.stringify(check.request));
+        else
+            this.reject(check.request);
+    }
+    reject(request) {
+        this.emitToClient(JSON.stringify({ id: request.id, error: { code: -32000, message: 'CURRENT_CHAT_DELIVERY_UNAVAILABLE: unqualified MCP inventory' } }));
+    }
+}

package/dist/harness/codex-session.js

@@ -32,7 +32,7 @@ export class CodexAgentSessionAdapter {
         if (role.session === 'codex-app-server')
             return this.nativeTransport({
                 name: role.name, argv: launch.argv, cwd: options.cwd, env: launch.env,
-                stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+                stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, permissions: options.permissions,
                 permissionMode: options.permissionMode,
                 model: role.model, effort: role.effort,
                 approvalPolicy: this.strategy.approvalPolicy(role),
@@ -44,7 +44,7 @@ export class CodexAgentSessionAdapter {
         return this.transport({
             name: role.name, harness: role.harness,
             argv: launch.argv, cwd: options.cwd, env: launch.env,
-            stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+            stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
             mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
             inheritEnvironment: options.managedOurs ? false : undefined,

package/dist/harness/codex.js

@@ -262,6 +262,7 @@ function codexAcpEnvironment(role, dirs) {
     if (!source)
         throw new Error('Codex app-server proxy is missing; rebuild ours-fleet');
     writeFileSync(proxyModule, readFileSync(source, 'utf8'), { mode: 0o600 });
+    writeFileSync(join(runtimeDir, 'codex-file-inventory.js'), readFileSync(join(dirname(source), 'codex-file-inventory.js'), 'utf8'), { mode: 0o600 });
     const windows = process.platform === 'win32';
     const command = join(runtimeDir, windows ? 'codex-app-server-proxy.cmd' : 'codex-app-server-proxy');
     const script = windows
@@ -482,7 +483,7 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
                     catch (error) {
                         throw new Error(`Codex ACP runtime check failed: ${error.message}; check CODEX_PATH or reinstall Fleet with optional dependencies`);
                     }
-                    const minimum = role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
+                    const minimum = role.file_delivery?.enabled ? '0.159.0' : role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
                         ? '0.153.3' : '0.145.0';
                     if (!codexVersionAtLeast(runtime.version, minimum))
                         throw new Error(`${role.model ?? 'Codex ACP'} requires a newer Codex (>=${minimum}): ACP selects ${runtime.executable} (${runtime.version}); upgrade Fleet or set CODEX_PATH to a supported executable in the agent/service environment`);

package/dist/isolation/policy.js

@@ -1,3 +1,4 @@
+import { stateRoot } from '../paths.js';
 import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { BACKENDS, ON_UNAVAILABLE, NETWORK_MODES, } from './types.js';
@@ -57,7 +58,7 @@ const SYSTEM_RO = ['/usr', '/bin', '/sbin', '/lib', '/lib64', '/etc'];
 /** Ephemeral scratch mounts. */
 const scratchTmpfs = (home) => ['/tmp', join(home, '.cache')];
 /** Home-relative sensitive paths never exposed (the blocklist's teeth). */
-const SENSITIVE_HOME = ['.ssh', '.aws', '.docker', '.gnupg', '.ours', 'fleet.yaml', 'fleet.d'];
+const SENSITIVE_HOME = ['.ssh', '.aws', '.docker', '.gnupg', '.ours', '.ours-fleet/private-ours', '.ours-fleet/private-file-delivery', 'fleet.yaml', 'fleet.d'];
 const ISOLATION_KEYS = ['backend', 'on_unavailable', 'fs', 'network', 'allow_hosts', 'resources', 'secrets'];
 const FS_KEYS = ['read', 'write'];
 const RESOURCE_KEYS = ['cpu', 'mem', 'pids'];
@@ -189,6 +190,8 @@ export function resolveIsolation(cfg, ctx) {
     const agentsRoot = dirname(stateDir);
     const blocklist = [
         ...SENSITIVE_HOME.map(p => join(home, p)),
+        join(stateRoot(), 'private-ours'),
+        join(stateRoot(), 'private-file-delivery'),
         agentsRoot, // sibling agents' state dirs (this agent's own is explicitly mounted)
     ];
     // ENFORCE the list, before anything builds a backend argv. Until now it was

package/dist/managed-recovery.d.ts

@@ -0,0 +1,13 @@
+/** Body-free recovery cursor. Dispatching is uncertain after a crash, never
+ * permission to replay an initial task which may already have caused effects. */
+export interface ManagedRecovery {
+    version: 1;
+    session: 'pending' | 'established';
+    readiness: boolean;
+    initial: 'pending' | 'dispatching' | 'completed';
+    active: boolean;
+}
+export declare const managedRecoveryPath: (dir: string) => string;
+export declare function readManagedRecovery(dir: string): ManagedRecovery | undefined;
+export declare function writeManagedRecovery(dir: string, value: ManagedRecovery): void;
+export declare function firstManagedSessionMayStart(dir: string): boolean;

package/dist/managed-recovery.js

@@ -0,0 +1,31 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+export const managedRecoveryPath = (dir) => join(dir, '.managed-recovery.json');
+export function readManagedRecovery(dir) {
+    const path = managedRecoveryPath(dir);
+    let stat;
+    try {
+        stat = lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096)
+        throw Error('MANAGED_RECOVERY_UNSAFE_PROOF');
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    if (value.version !== 1 || !['pending', 'established'].includes(value.session)
+        || !['pending', 'dispatching', 'completed'].includes(value.initial)
+        || typeof value.readiness !== 'boolean' || typeof value.active !== 'boolean')
+        throw Error('MANAGED_RECOVERY_INVALID_PROOF');
+    return value;
+}
+export function writeManagedRecovery(dir, value) {
+    replaceFileAtomically(managedRecoveryPath(dir), JSON.stringify(value) + '\n');
+}
+export function firstManagedSessionMayStart(dir) {
+    const proof = readManagedRecovery(dir);
+    return Boolean(proof?.session === 'pending' && proof.initial === 'pending' && !proof.readiness && !proof.active);
+}

package/dist/ops.d.ts

@@ -54,5 +54,7 @@ export declare function up(cfg: FleetConfig, names: string[], deps: OpsDeps, con
 export declare function down(cfg: FleetConfig, names: string[], deps: OpsDeps): Promise<void>;
 /** Re-sync from config + bounce. mode 'keep' resumes context; 'fresh' wipes it. */
 export declare function restartRoles(cfg: FleetConfig, names: string[], deps: OpsDeps, mode: 'keep' | 'fresh', configPath?: string): Promise<void>;
+/** Read-only admission check shared by CLI removal and web preview, before any archive. */
+export declare function assertStandaloneRoleRemoval(cfg: FleetConfig, name: string): void;
 /** Stop + forget a role: unit, state dir, and its fleet.d file when spawned. */
 export declare function rmRole(cfg: FleetConfig, name: string, deps: OpsDeps): Promise<void>;

package/dist/ops.js

@@ -7,8 +7,8 @@ import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
 import { managedCliBriefing } from './managed-cli.js';
-import { resetRestartLedger } from './runner.js';
-import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
+import { resetRestartLedger, loadTempRole } from './runner.js';
+import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, readTempSupervisor, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
 import { daemonIdentityProvisioner, reconcilePermanentRoleIdentities, } from './creation.js';
 import { provesGeneratedAgentSource } from './generated-agent-source.js';
@@ -223,8 +223,21 @@ export async function restartRoles(cfg, names, deps, mode, configPath) {
             : `↻ ${role.name} — restarted (resumes; briefing re-synced)`);
     }
 }
+/** Read-only admission check shared by CLI removal and web preview, before any archive. */
+export function assertStandaloneRoleRemoval(cfg, name) {
+    if (cfg.roles.some(role => role.name === name) || !/^[A-Za-z0-9_-]+$/.test(name))
+        return;
+    const dir = agentDir(name, true);
+    if (!existsSync(dir))
+        return;
+    const taskId = readTempSupervisor(dir)?.taskOwner?.taskId
+        ?? (existsSync(join(dir, 'role.yaml')) ? loadTempRole(name).roomMemberStartup?.task_id : undefined);
+    if (taskId)
+        throw Error(`TASK_MEMBER_IS_TASK_OWNED: ${name} belongs to task ${taskId}; use the owning task lifecycle; if its record is missing or corrupt, preserve evidence and restore the original records before retrying task delete`);
+}
 /** Stop + forget a role: unit, state dir, and its fleet.d file when spawned. */
 export async function rmRole(cfg, name, deps) {
+    assertStandaloneRoleRemoval(cfg, name);
     const temporaryDir = /^[A-Za-z0-9_-]+$/.test(name) ? agentDir(name, true) : '';
     const configured = cfg.roles.find(role => role.name === name);
     if (!configured && temporaryDir && existsSync(temporaryDir)) {

package/dist/rooms-tasks/cli.js

@@ -891,6 +891,27 @@ export function registerTaskCommands(parent, cOpt) {
             dieTaskRoom(e);
         }
     });
+    cOpt(taskCmd.command('recover-members <id>'))
+        .description('resume proven stopped task members in-place; never create identities or replay invites')
+        .option('--json', 'JSON output')
+        .action(async (id, opts) => {
+        try {
+            const { recoverTaskMembers } = await import('./recovery.js');
+            const task = getTask(id), cfg = loadConfig(opts.configuration);
+            const members = await recoverTaskMembers({ taskId: id, binPath: getBinPath(),
+                cowork: task.layout ? undefined : createCoworkAdapter({ configPath: cfg.rooms?.cowork?.config }) });
+            if (opts.json)
+                console.log(JSON.stringify({ schema_version: 1, task_id: id, members }, null, 2));
+            else
+                for (const member of members)
+                    console.log(`${member.name}: ${member.status}`);
+        }
+        catch (e) {
+            if (opts.json)
+                die(e);
+            dieTaskRoom(e);
+        }
+    });
     cOpt(taskCmd.command('start <id>'))
         .description('idempotently select a plan, provision, and start a task')
         .option('--template <name>', 'room template')

package/dist/rooms-tasks/close.d.ts

@@ -1,3 +1,4 @@
+import { retireTaskMemberService } from './task-service-retirement.js';
 import { withFileLock } from '../atomic-file.js';
 import { type TempLifecycleDeps } from '../temp-lifecycle.js';
 import { type CoworkAdapter } from './cowork-adapter.js';
@@ -5,6 +6,7 @@ import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
 export declare const CLOSE_LOCK_STALE_MS: number;
 export declare function roomCloseLockPath(roomId: string): string;
 export interface RoomCloseDeps {
+    retireTaskService?: typeof retireTaskMemberService;
     inspectMember?(seat: RoomMemberSeat): Promise<{
         launchId: string;
     }>;

package/dist/rooms-tasks/close.js

@@ -1,11 +1,15 @@
 import { detachDeletedRoom } from './task-state.js';
 import { binderKey } from '../agent-ours/state.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+import { retireTaskMemberService } from './task-service-retirement.js';
 import { eraseMemberArtifacts } from './erasure.js';
 import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
 import { collectWorkspaceArchives } from './workspace-artifacts.js';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { parse } from 'yaml';
+import { privateRuntimeRoot, releaseManagedAgent } from '../agent-ours/service.js';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
@@ -48,6 +52,7 @@ function exactMemberIdentity(seat) {
     }
 }
 export async function inspectMember(seat) {
+    assertMemberNotPermanent(seat.role_name);
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
     if (!supervisor || supervisor.role !== seat.role_name
@@ -105,7 +110,46 @@ export async function identityCidPresent(cid) {
         return rows.some(row => 'cid' in row && row.cid.toLowerCase() === cid.toLowerCase());
     });
 }
+/** A managed temporary identity belongs to its durable external lease even
+ * after worker exit. Retire that exact logical owner before generic removal. */
+async function releaseRetainedMemberRuntime(seat) {
+    const live = agentDir(seat.role_name, true);
+    const source = existsSync(live) ? live
+        : (seat.launch?.launch_id ? tempArchiveForLaunch(seat.role_name, seat.launch.launch_id) : undefined);
+    if (!source) {
+        if (seat.launch?.task_supervised)
+            throw Error('MEMBER_RUNTIME_RETIREMENT_SOURCE_MISSING');
+        return;
+    }
+    const path = join(source, 'role.yaml');
+    if (!existsSync(path))
+        return; // pre-managed compatibility evidence has no runtime
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('MEMBER_RUNTIME_UNSAFE_PROOF');
+    const role = parse(readFileSync(path, 'utf8'));
+    const profile = readClientProfile({ ...process.env, ...role.env });
+    const runtime = join(privateRuntimeRoot(), binderKey(profile.expectedInstanceId, seat.role_name));
+    const metadata = readTempSupervisor(source);
+    if (!existsSync(join(runtime, 'instance.json'))) {
+        if (metadata?.kind === 'fleet-managed')
+            throw Error('MEMBER_RUNTIME_RETIREMENT_MISSING');
+        return;
+    }
+    const creationPath = join(source, 'creation.json'), creationStat = lstatSync(creationPath);
+    if (!creationStat.isFile() || creationStat.isSymbolicLink() || creationStat.size > 256 * 1024)
+        throw Error('MEMBER_RUNTIME_UNSAFE_PROOF');
+    const creation = JSON.parse(readFileSync(creationPath, 'utf8'));
+    if (role.name !== seat.role_name || role.identity !== seat.role_name || !seat.identity_cid
+        || !seat.launch?.action_id || !seat.launch.launch_id || creation.role !== seat.role_name
+        || creation.creationActionId !== seat.launch.action_id || metadata?.role !== seat.role_name
+        || metadata.launchId !== seat.launch.launch_id
+        || (metadata.taskOwner && metadata.taskOwner.creationActionId !== seat.launch.action_id))
+        throw Error('MEMBER_RUNTIME_RETIREMENT_MISMATCH');
+    await releaseManagedAgent(role, { cid: seat.identity_cid, action: seat.launch.action_id });
+}
 export async function removeExactMemberIdentity(seat) {
+    assertMemberNotPermanent(seat.role_name);
     await withIdentityClient(async (client) => {
         const rows = await client.listIdentities();
         const before = listedIdentity(rows, seat.role_name);
@@ -113,6 +157,11 @@ export async function removeExactMemberIdentity(seat) {
             if (rows.some(row => row.name === seat.role_name || (seat.identity_cid && 'cid' in row
                 && row.cid.toLowerCase() === seat.identity_cid.toLowerCase())))
                 throw new Error(`room member '${seat.role_name}' identity absence is not proven`);
+            // A terminal release can remove the SDK identity before its response is
+            // recorded. Finish the exact retained launch's release journal on retry.
+            if (existsSync(agentDir(seat.role_name, true)) || (seat.launch?.launch_id
+                && tempArchiveForLaunch(seat.role_name, seat.launch.launch_id)))
+                await releaseRetainedMemberRuntime(seat);
             return;
         }
         if (!seat.identity_cid) {
@@ -121,7 +170,9 @@ export async function removeExactMemberIdentity(seat) {
         if (before.cid?.toLowerCase() !== seat.identity_cid.toLowerCase()) {
             throw new Error(`room member '${seat.role_name}' identity absence is not proven: CID mismatch: recorded ${seat.identity_cid}, found ${before.cid ?? 'none'}`);
         }
+        await releaseRetainedMemberRuntime(seat);
         try {
+            assertMemberNotPermanent(seat.role_name);
             await client.removeIdentity({ name: seat.role_name });
         }
         catch (error) {
@@ -150,9 +201,19 @@ export async function assertMemberIdentityAbsent(seat) {
         }
     });
 }
+async function retireMemberRegistration(room, current, deps) {
+    if (room.task_id)
+        await (deps.retireTaskService ?? retireTaskMemberService)(current.role_name, {
+            taskId: room.task_id, creationActionId: current.launch?.action_id,
+            taskSupervised: current.launch?.task_supervised,
+            ...(current.launch?.launch_id ? { launchId: current.launch.launch_id } : {}),
+        });
+}
 async function retireMember(roomId, seat, deps) {
+    assertMemberNotPermanent(seat.role_name);
     let room = getRoomRecord(roomId);
     let current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
+    await retireMemberRegistration(room, current, deps);
     let retirement = current.retirement;
     if (retirement?.phase === 'identity_absent') {
         if (!deps.inspectMember) {
@@ -250,6 +311,10 @@ export async function closeManagedRoom(input) {
     return lock(roomCloseLockPath(input.roomId), async () => {
         let room = beginRoomClose(input.roomId);
         if (room.state === 'closed') {
+            for (const seat of room.member_seats) {
+                assertMemberNotPermanent(seat.role_name);
+                await retireMemberRegistration(room, seat, deps);
+            }
             if (!deps.inspectMember)
                 for (const seat of room.member_seats) {
                     if (existsSync(agentDir(seat.role_name, true)))

package/dist/rooms-tasks/deletion.js

@@ -1,4 +1,7 @@
 import { eraseMemberArtifacts } from './erasure.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+import { retireTaskMemberService } from './task-service-retirement.js';
+import { assertTaskRegistrationsAbsent } from '../supervisor/catalog.js';
 import { proveArchivedAbsence, verifyArchivedAbsence, verifyArchivedMemberStillAbsent } from './archived-absence.js';
 import { existsSync } from 'node:fs';
 import { withFileLock } from '../atomic-file.js';
@@ -64,6 +67,12 @@ function cursorSeat(cursor) {
  * the recorded CID surviving under any name blocks settlement.
  */
 async function retireCursorMember(taskId, cursor, deps) {
+    assertMemberNotPermanent(cursor.name);
+    await (deps.roomClose?.retireTaskService ?? retireTaskMemberService)(cursor.name, { taskId,
+        creationActionId: cursor.action_id,
+        taskSupervised: cursor.task_supervised,
+        ...((cursor.launch_id && !['never-launched', 'absent-verified'].includes(cursor.launch_id)) ? { launchId: cursor.launch_id } : {}),
+    });
     let phase = cursor.phase;
     let launchId = cursor.launch_id;
     if (phase === 'identity_absent') {
@@ -249,6 +258,7 @@ export async function settleTaskDeletion(input) {
             }
             if (cleanup.snapshotHash)
                 releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            assertTaskRegistrationsAbsent(taskId);
             await eraseMemberArtifacts('task', taskId, task.deletion.members.map(cursorSeat), task.deletion.room_id ? [task.deletion.room_id] : []);
             if (task.workspace) {
                 assertWorkspaceDeletable(task.workspace, 'task', taskId);

package/dist/rooms-tasks/erasure.js

@@ -1,11 +1,12 @@
 import { eraseResourcePresentations } from '../erased-resources.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, join, relative } from 'node:path';
 import { parse } from 'yaml';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
-import { readTempSupervisor, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
+import { readTempSupervisorForScan, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
 import { assertSafeAncestors, auditWorkspaceGit, prepareOwnedDeletionTree } from './workspace.js';
 function entries(path) {
     try {
@@ -58,6 +59,7 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
     for (const name of names) {
         if (!/^[a-zA-Z0-9_-]{1,120}$/.test(name))
             throw new Error('Invalid erasure member');
+        assertMemberNotPermanent(name);
         if (existsSync(agentDir(name, true)))
             throw new Error(`Member '${name}' still has live state during erasure`);
     }
@@ -75,7 +77,7 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
             const stat = lstatSync(path);
             if (!stat.isDirectory() || stat.isSymbolicLink())
                 continue;
-            const supervisor = readTempSupervisor(path);
+            const supervisor = readTempSupervisorForScan(path);
             if (!supervisor || !names.has(supervisor.role))
                 continue;
             const seat = seats.find(s => s.role_name === supervisor.role);

package/dist/rooms-tasks/layout-member-retirement.d.ts

@@ -0,0 +1,10 @@
+import { type TempLifecycleDeps } from '../temp-lifecycle.js';
+import type { LayoutInstance, RoomLayoutState } from './layout.js';
+import type { RoomMemberSeat } from './types.js';
+export declare function layoutOwnedMemberName(runId: string, key: string): string;
+/** Retire a local layout factory result, never a borrowed binding. The runtime
+ * instance and CID fence replacement supervisors even when already stopped.
+ */
+export declare function retireOwnedLayoutMember(instance: LayoutInstance, runId: string, key: string, lifecycle?: TempLifecycleDeps, taskSupervised?: boolean): Promise<void>;
+/** Exact archived launches used by the existing artifact erasure saga. */
+export declare function ownedLayoutRetirementSeats(state: RoomLayoutState, runId: string): RoomMemberSeat[];

package/dist/rooms-tasks/layout-member-retirement.js

@@ -0,0 +1,90 @@
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { binderKey } from '../agent-ours/state.js';
+import { readClientProfile } from '../client-profile.js';
+import { readProvenance } from '../creation.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempArchiveForCreationAction } from '../temp-lifecycle.js';
+import { assertMemberIdentityAbsent, removeExactMemberIdentity, waitForLivenessAbsent } from './close.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+import { retireTaskMemberService } from './task-service-retirement.js';
+function proof(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('LAYOUT_MEMBER_UNSAFE_PROOF');
+    return readFileSync(path, 'utf8');
+}
+export function layoutOwnedMemberName(runId, key) {
+    return `layout-${createHash('sha256').update(runId + ':' + key).digest('hex').slice(0, 16)}`;
+}
+function assertOwned(instance, runId, key) {
+    if (instance.remote || !instance.agent || instance.temporary !== true
+        || instance.agent !== layoutOwnedMemberName(runId, key) || instance.supervisor !== stateRoot())
+        throw Error('LAYOUT_MEMBER_NOT_OWNED');
+    assertMemberNotPermanent(instance.agent);
+}
+function seatFor(instance, key, action, launchId) {
+    return { role_name: instance.agent, identity_cid: instance.cid, slot: key, cowork_role: key, seat_state: 'removed',
+        launch: { state: 'stopped', action_id: action, launch_id: launchId, attempt: 1, updated_at: '' } };
+}
+/** Retire a local layout factory result, never a borrowed binding. The runtime
+ * instance and CID fence replacement supervisors even when already stopped.
+ */
+export async function retireOwnedLayoutMember(instance, runId, key, lifecycle = {}, taskSupervised = false) {
+    assertOwned(instance, runId, key);
+    const action = `${runId}:${key}`, dir = agentDir(instance.agent, true);
+    const archived = tempArchiveForCreationAction(instance.agent, action);
+    if (!existsSync(dir) && !archived) {
+        if (runId.startsWith('task-'))
+            await retireTaskMemberService(instance.agent, { taskId: runId.slice(5), creationActionId: action, taskSupervised }, lifecycle.exec);
+        // A prior erasure may already have consumed its archive. No live state plus
+        // authoritative identity absence is required before accepting completion.
+        await assertMemberIdentityAbsent({ role_name: instance.agent, identity_cid: instance.cid,
+            slot: key, cowork_role: key, seat_state: 'removed' });
+        return;
+    }
+    const source = existsSync(dir) ? dir : archived.path;
+    const supervisor = readTempSupervisor(source), provenance = readProvenance(source);
+    if (!supervisor || supervisor.role !== instance.agent || provenance?.role !== instance.agent
+        || provenance.creationActionId !== action || proof(join(source, '.identity')).trim() !== instance.agent)
+        throw Error('LAYOUT_MEMBER_LAUNCH_MISMATCH');
+    {
+        const role = parse(proof(join(source, 'role.yaml')));
+        if (role?.name !== instance.agent || role.identity !== instance.agent)
+            throw Error('LAYOUT_MEMBER_ROLE_MISMATCH');
+        const profile = readClientProfile({ ...process.env, ...role.env });
+        const privateDir = join(stateRoot(), 'private-ours', binderKey(profile.expectedInstanceId, instance.agent));
+        const runtime = JSON.parse(proof(join(privateDir, 'state.json')));
+        const runtimeInstance = JSON.parse(proof(join(privateDir, 'instance.json')));
+        if (runtime.instance !== instance.launch || runtimeInstance.instance !== instance.launch
+            || runtimeInstance.role !== instance.agent || runtimeInstance.temporary !== true
+            || runtime.name !== instance.agent || runtime.daemon !== profile.expectedInstanceId
+            || runtime.lifetime !== 'temporary' || runtime.action !== action
+            || runtime.cid?.toLowerCase() !== instance.cid.toLowerCase())
+            throw Error('LAYOUT_MEMBER_INSTANCE_MISMATCH');
+        if (runId.startsWith('task-'))
+            await retireTaskMemberService(instance.agent, { taskId: runId.slice(5), creationActionId: action, launchId: supervisor.launchId, taskSupervised }, lifecycle.exec);
+        if (existsSync(dir)) {
+            await stopTempSupervisor(instance.agent, lifecycle);
+            await waitForLivenessAbsent(instance.agent, supervisor.launchId, lifecycle);
+        }
+    }
+    await secureStoppedTempArchive(instance.agent, supervisor.launchId, lifecycle);
+    await removeExactMemberIdentity(seatFor(instance, key, action, supervisor.launchId));
+    await assertMemberIdentityAbsent(seatFor(instance, key, action, supervisor.launchId));
+}
+/** Exact archived launches used by the existing artifact erasure saga. */
+export function ownedLayoutRetirementSeats(state, runId) {
+    return Object.entries(state.participants).flatMap(([key, participant]) => {
+        if (!participant.owned || !participant.instance)
+            return [];
+        const instance = participant.instance;
+        assertOwned(instance, runId, key);
+        if (!participant.retired)
+            throw Error('LAYOUT_MEMBER_NOT_RETIRED');
+        const action = `${runId}:${key}`, archive = tempArchiveForCreationAction(instance.agent, action);
+        return [seatFor(instance, key, action, archive?.launchId ?? 'absent-verified')];
+    });
+}

package/dist/rooms-tasks/layout-service.d.ts

@@ -5,6 +5,7 @@ export declare class NativeLayoutSupervisor implements LayoutSupervisor {
     private configPath;
     private runId;
     private templates;
+    readonly taskSupervised: boolean;
     readonly id: string;
     constructor(configPath: string | undefined, runId: string, templates: Record<string, AgentTemplateDefinition>);
     private request;