@ours.network/fleet 1.2.0-nightly.53 → 1.2.0-nightly.55

package/dist/rooms-tasks/layout-service.js

@@ -1,22 +1,24 @@
-import { randomUUID, createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loadConfig, loadRoomsConfig, splitRootFor } from '../config.js';
 import { agentDir, stateRoot, defaultConfigPath } from '../paths.js';
 import { controlRequest } from '../session/control.js';
 import { spawnTemp } from '../spawn.js';
-import { tempSupervisorLiveness } from '../temp-lifecycle.js';
 import { layoutSupervisorId } from './layout-control.js';
 import { RoomLayout } from './layout.js';
 import { assertLayoutFile, validLayoutKey, readRoomLayout, readRoomLayouts } from './layout-config.js';
 import { createCoworkAdapter } from './cowork-adapter.js';
 import { callRemoteLayoutBinding } from './layout-binding-client.js';
 import { readClientProfile } from '../client-profile.js';
+import { tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { layoutOwnedMemberName, retireOwnedLayoutMember } from './layout-member-retirement.js';
 export class NativeLayoutSupervisor {
     configPath;
     runId;
     templates;
+    taskSupervised;
     id;
     constructor(configPath, runId, templates) {
         this.configPath = configPath;
@@ -24,6 +26,7 @@ export class NativeLayoutSupervisor {
         this.templates = templates;
         mkdirSync(stateRoot(), { recursive: true, mode: 0o700 });
         this.id = layoutSupervisorId();
+        this.taskSupervised = runId.startsWith('task-') && process.env.OURS_FLEET_SUPERVISOR !== 'none';
     }
     async request(agent, temporary, request) {
         if (!/^[A-Za-z0-9_-]+$/.test(agent))
@@ -48,8 +51,14 @@ export class NativeLayoutSupervisor {
         const definition = this.templates[template];
         if (!definition)
             throw Error(`agent template not found in run snapshot: ${template}`);
-        const name = `layout-${createHash('sha256').update(this.runId + ':' + key).digest('hex').slice(0, 16)}`;
+        const name = layoutOwnedMemberName(this.runId, key);
+        const taskId = this.runId.startsWith('task-') ? this.runId.slice(5) : undefined;
+        const task = taskId ? (await import('./task-state.js')).getTask(taskId) : undefined;
+        if (task && task.layout?.run_id !== this.runId)
+            throw Error('TASK_LAYOUT_OWNER_MISMATCH');
         await spawnTemp({ name, temp: true, configPath: this.configPath, agentDefinition: definition,
+            ...(task ? { taskOwner: { taskId: task.task_id, layout: { runId: this.runId, participant: key },
+                    creationActionId: `${this.runId}:${key}` } } : {}),
             creationActionId: `${this.runId}:${key}`, surface: 'cli' }, fileURLToPath(new URL('../cli.js', import.meta.url)));
         const deadline = Date.now() + 120_000;
         let last;
@@ -90,17 +99,26 @@ export class NativeLayoutSupervisor {
             throw Error('cannot retire a borrowed cross-Fleet instance');
         if (i.supervisor !== this.id || !i.agent || !/^[A-Za-z0-9_-]+$/.test(i.agent) || i.temporary !== true)
             throw Error('invalid local temporary layout instance');
-        const dir = agentDir(i.agent, true);
-        const stopped = async () => !existsSync(dir) || await tempSupervisorLiveness(dir) === 'stopped';
-        if (await stopped())
+        if (!this.runId.startsWith('task-')) {
+            const dir = agentDir(i.agent, true);
+            const stopped = async () => !existsSync(dir) || await tempSupervisorLiveness(dir) === 'stopped';
+            if (await stopped())
+                return;
+            try {
+                await this.call(i, { action: 'retire' });
+            }
+            catch (error) {
+                if (!await stopped())
+                    throw error;
+            }
             return;
-        try {
-            await this.call(i, { action: 'retire' });
-        }
-        catch (error) {
-            if (!await stopped())
-                throw error;
         }
+        const snapshot = JSON.parse(readFileSync(layoutRunPath(this.runId), 'utf8'));
+        const owned = Object.entries(snapshot.participants).filter(([, participant]) => participant.owned
+            && participant.instance?.agent === i.agent && JSON.stringify(participant.instance) === JSON.stringify(i));
+        if (owned.length !== 1)
+            throw Error('LAYOUT_MEMBER_NOT_OWNED');
+        await retireOwnedLayoutMember(i, this.runId, owned[0][0], {}, owned[0][1].task_supervised);
     }
 }
 export const layoutRunPath = (id) => {

package/dist/rooms-tasks/layout.d.ts

@@ -49,6 +49,7 @@ export interface LayoutAssignment {
     contract?: string;
 }
 export interface LayoutSupervisor {
+    readonly taskSupervised?: boolean;
     id: string;
     /** Must verify current launch, CID, live session and standalone ownership. */
     verify(instance: LayoutInstance): Promise<void>;
@@ -67,6 +68,7 @@ type ParticipantState = {
     retired?: boolean;
     participant?: string;
     room?: string;
+    task_supervised?: boolean;
 };
 type RoomState = {
     spec: LayoutRoom;
@@ -74,6 +76,7 @@ type RoomState = {
     ready: string[];
     state: 'provisioning' | 'active' | 'closed';
     owner_ready?: boolean;
+    deleted?: boolean;
 };
 export interface RoomLayoutState {
     version: 1;
@@ -110,5 +113,9 @@ export declare class RoomLayout {
     private archiveRoom;
     closeRoom(actor: string, key: string): Promise<void>;
     close(actor: string): Promise<void>;
+    /** Explicit deletion retains a per-room checkpoint until the run is erased.
+     * Finish/cancel continue to use close(), preserving archived rooms.
+     */
+    delete(actor: string): Promise<void>;
 }
 export {};

package/dist/rooms-tasks/layout.js

@@ -6,6 +6,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { canonicalJson } from '../canonical-json.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
 const ownerReference = (owner) => ({ cid: owner.cid, role: owner.role, fingerprint: createHash('sha256').update(owner.invite).digest('hex') });
 const own = (o, key) => Object.hasOwn(o, key);
 function need(ok, message) { if (!ok)
@@ -133,6 +134,8 @@ export class RoomLayout {
             if (!p.instance) {
                 const template = s.definition.participants[member]?.agent_template;
                 need(template, `no factory for ${member}`);
+                if (this.supervisor.taskSupervised)
+                    p.task_supervised = true;
                 await this.mutation(s, `spawn:${resolvedKey}`, () => this.supervisor.spawn(resolvedKey, template), i => { p.instance = i; });
                 await this.verify(p.instance);
             }
@@ -247,4 +250,36 @@ export class RoomLayout {
             this.save(s);
         }, true);
     }
+    /** Explicit deletion retains a per-room checkpoint until the run is erased.
+     * Finish/cancel continue to use close(), preserving archived rooms.
+     */
+    async delete(actor) {
+        await this.close(actor);
+        await this.operation(actor, async (state) => {
+            for (const room of Object.values(state.rooms)) {
+                if (!room.native || room.deleted)
+                    continue;
+                let remote;
+                try {
+                    remote = await this.cowork.getRoom(room.native.room_id);
+                }
+                catch (error) {
+                    if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                        throw error;
+                }
+                if (remote) {
+                    need(remote.identity_cid === room.native.identity_cid, 'native room identity changed during deletion');
+                    try {
+                        await this.cowork.deleteRoom(room.native.room_id);
+                    }
+                    catch (error) {
+                        if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                            throw error;
+                    }
+                }
+                room.deleted = true;
+                this.save(state);
+            }
+        }, true);
+    }
 }

package/dist/rooms-tasks/legacy-task-member.d.ts

@@ -0,0 +1,19 @@
+import { tempSupervisorLiveness } from '../temp-lifecycle.js';
+export interface LegacyTaskOwner {
+    taskId: string;
+    roomId: string;
+    roomIdentityCid: string;
+    creationActionId: string;
+}
+interface AdoptionDeps {
+    liveness?: typeof tempSupervisorLiveness;
+    verifyIdentity?(name: string, cid: string): Promise<void>;
+    /** Crash seam: the role snapshot is durable before the supervisor owner. */
+    beforeOwnerCommit?(): void;
+}
+/** Caller holds task and room operation locks. No service is started here.
+ * Running legacy supervisors remain untouched; stopped exact state receives
+ * only ownership metadata, preserving launch, identity and conversation.
+ */
+export declare function adoptLegacyTaskMember(owner: LegacyTaskOwner, name: string, deps?: AdoptionDeps): Promise<'adopted' | 'running-legacy' | 'already-durable'>;
+export {};

package/dist/rooms-tasks/legacy-task-member.js

@@ -0,0 +1,116 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { parse, stringify } from 'yaml';
+import { attachOursClient } from '@ours.network/sdk/client';
+import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { binderKey } from '../agent-ours/state.js';
+import { readClientProfile } from '../client-profile.js';
+import { readProvenance } from '../creation.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readTempSupervisor, tempSupervisorLiveness, TEMP_SUPERVISOR_FILE } from '../temp-lifecycle.js';
+import { getTask } from './task-state.js';
+import { getRoomRecord, updateMemberStartup } from './room-state.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+function bounded(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('LEGACY_TASK_MEMBER_UNSAFE_PROOF');
+    return readFileSync(path, 'utf8');
+}
+async function verifyIdentity(name, cid, env) {
+    const profile = readClientProfile(env);
+    const client = await attachOursClient({ endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+        credentialPath: profile.credentialPath, sessionMode: 'external', env: {}, leaseToken: `task-migration-${randomUUID()}` });
+    try {
+        const identities = await client.listIdentities();
+        const found = identities.find(value => value.name === name);
+        if (!found || !('cid' in found) || found.cid.toLowerCase() !== cid.toLowerCase())
+            throw Error('LEGACY_TASK_MEMBER_IDENTITY_MISMATCH');
+    }
+    finally {
+        try {
+            await client.releaseLease();
+        }
+        finally {
+            await client.close();
+        }
+    }
+}
+/** Caller holds task and room operation locks. No service is started here.
+ * Running legacy supervisors remain untouched; stopped exact state receives
+ * only ownership metadata, preserving launch, identity and conversation.
+ */
+export async function adoptLegacyTaskMember(owner, name, deps = {}) {
+    return withFileLock(join(stateRoot(), 'locks', 'temp-supervisors', encodeURIComponent(name)), async () => {
+        assertMemberNotPermanent(name);
+        const dir = agentDir(name, true), task = getTask(owner.taskId), room = getRoomRecord(owner.roomId);
+        const seat = room?.member_seats.find(value => value.role_name === name);
+        const supervisor = readTempSupervisor(dir);
+        const rolePath = join(dir, 'role.yaml'), roleBytes = bounded(rolePath);
+        const role = parse(roleBytes);
+        const startup = role?.roomMemberStartup, provenance = readProvenance(dir);
+        if (task.deletion || task.terminal_intent || !['provisioning', 'active', 'review'].includes(task.state)
+            || !room || room.close || !['provisioning', 'active'].includes(room.state) || room.task_id !== owner.taskId
+            || task.room_id !== owner.roomId || room.room_identity_cid !== owner.roomIdentityCid
+            || task.room_identity_cid !== owner.roomIdentityCid || !seat || seat.retirement
+            || !supervisor || supervisor.role !== name || seat.launch?.launch_id !== supervisor.launchId
+            || seat.launch.action_id !== owner.creationActionId || provenance?.creationActionId !== owner.creationActionId
+            || provenance.role !== name || role.name !== name || role.identity !== name
+            || startup?.identity_name !== name || startup.room_id !== owner.roomId
+            || startup.room_identity_cid !== owner.roomIdentityCid || startup.invite_id !== seat.invite_id
+            || startup.role !== seat.cowork_role || startup.invite !== ''
+            || (startup.task_id !== undefined && startup.task_id !== owner.taskId)
+            || (room.workspace && (role.cwd !== room.workspace.path || JSON.stringify(startup.workspace) !== JSON.stringify(room.workspace)))
+            || bounded(join(dir, '.identity')).trim() !== name)
+            throw Error('LEGACY_TASK_MEMBER_OWNERSHIP_MISMATCH');
+        if (supervisor.taskOwner) {
+            if (Object.entries(owner).some(([key, value]) => supervisor.taskOwner[key] !== value)
+                || startup.task_id !== owner.taskId)
+                throw Error('LEGACY_TASK_MEMBER_OWNER_MISMATCH');
+            if (supervisor.kind !== 'detached' && process.env.OURS_FLEET_SUPERVISOR !== 'none')
+                updateMemberStartup(owner.roomId, name, { launch: { ...seat.launch, task_supervised: true } });
+            return 'already-durable';
+        }
+        const live = await (deps.liveness ?? tempSupervisorLiveness)(dir);
+        if (live === 'running')
+            return 'running-legacy';
+        if (live !== 'stopped')
+            throw Error('LEGACY_TASK_MEMBER_LIVENESS_UNKNOWN');
+        const env = { ...process.env, ...role.env };
+        const profile = readClientProfile(env);
+        const privateDir = join(stateRoot(), 'private-ours', binderKey(profile.expectedInstanceId, name));
+        const state = JSON.parse(bounded(join(privateDir, 'state.json')));
+        const instance = JSON.parse(bounded(join(privateDir, 'instance.json')));
+        const externalOwner = JSON.parse(bounded(join(privateDir, 'owner.json')));
+        const launch = JSON.parse(bounded(join(stateRoot(), 'private-ours', 'launches', binderKey('temporary', name) + '.json')));
+        if (!seat.identity_cid || state.name !== name || state.daemon !== profile.expectedInstanceId
+            || state.lifetime !== 'temporary' || state.action !== owner.creationActionId
+            || state.cid?.toLowerCase() !== seat.identity_cid.toLowerCase()
+            || !['READY', 'SERVING', 'RECOVERING'].includes(state.phase)
+            || instance.role !== name || instance.temporary !== true || instance.instance !== state.instance
+            || externalOwner.instance !== state.instance || typeof externalOwner.token !== 'string' || !externalOwner.token
+            || state.room?.id !== owner.roomId || state.room.cid !== owner.roomIdentityCid
+            || state.room.agentCid.toLowerCase() !== seat.identity_cid.toLowerCase() || state.room.action !== seat.invite_id
+            || launch.role !== name || launch.identity !== name || launch.action !== owner.creationActionId)
+            throw Error('LEGACY_TASK_MEMBER_RUNTIME_NOT_RESUMABLE');
+        const sessionPath = join(dir, role.session === 'codex-app-server' ? '.session-id' : '.acp-session-id');
+        if (!bounded(sessionPath).trim())
+            throw Error('LEGACY_TASK_MEMBER_CONVERSATION_MISSING');
+        if (deps.verifyIdentity)
+            await deps.verifyIdentity(name, seat.identity_cid);
+        else
+            await verifyIdentity(name, seat.identity_cid, env);
+        assertMemberNotPermanent(name);
+        if (bounded(rolePath) !== roleBytes || JSON.stringify(readTempSupervisor(dir)) !== JSON.stringify(supervisor))
+            throw Error('LEGACY_TASK_MEMBER_STATE_CHANGED');
+        // Crash after this write is healed by retrying the same stopped adoption.
+        startup.task_id = owner.taskId;
+        replaceFileAtomically(rolePath, stringify(role));
+        if (supervisor.kind !== 'detached' && process.env.OURS_FLEET_SUPERVISOR !== 'none')
+            updateMemberStartup(owner.roomId, name, { launch: { ...seat.launch, task_supervised: true } });
+        deps.beforeOwnerCommit?.();
+        replaceFileAtomically(join(dir, TEMP_SUPERVISOR_FILE), JSON.stringify({ ...supervisor, taskOwner: owner }, null, 2) + '\n');
+        return 'adopted';
+    });
+}

package/dist/rooms-tasks/member-ownership.d.ts

@@ -0,0 +1,5 @@
+/** A room seat is never authority to retire a standalone persistent agent.
+ * Check both role-name collisions and a permanent role using the seat's
+ * identity name. Missing legacy task state must not bypass this fence.
+ */
+export declare function assertMemberNotPermanent(name: string): void;

package/dist/rooms-tasks/member-ownership.js

@@ -0,0 +1,40 @@
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentDir, agentsRoot } from '../paths.js';
+/** A room seat is never authority to retire a standalone persistent agent.
+ * Check both role-name collisions and a permanent role using the seat's
+ * identity name. Missing legacy task state must not bypass this fence.
+ */
+export function assertMemberNotPermanent(name) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(name))
+        throw new Error('Invalid retirement member name');
+    if (existsSync(agentDir(name)))
+        throw new Error(`room member '${name}' conflicts with permanent agent state; refusing retirement`);
+    let entries;
+    try {
+        entries = readdirSync(agentsRoot(), { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const path = join(agentsRoot(), entry.name, '.identity');
+        let stat;
+        try {
+            stat = lstatSync(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024)
+            throw new Error('Permanent identity ownership proof is unsafe; refusing member retirement');
+        if (readFileSync(path, 'utf8').trim() === name)
+            throw new Error(`room member '${name}' identity belongs to permanent agent '${entry.name}'; refusing retirement`);
+    }
+}

package/dist/rooms-tasks/provision.js

@@ -7,7 +7,8 @@ import { parse } from 'yaml';
 import { advanceSaga, setSagaError, updateMemberSeats, updateMemberStartup, activateRoom, getRoomRecord, } from './room-state.js';
 import { activateTask, updateTaskMembers, blockTask, unblockTask, getTask, } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
-import { spawnTemp } from '../spawn.js';
+import { spawnTemp, resumeTaskSupervisor } from '../spawn.js';
+import { adoptLegacyTaskMember } from './legacy-task-member.js';
 import { effectivePermissionMode } from '../permissions.js';
 import { selectionOrigin, summarizeResolvedLaunch, } from '../lifecycle-summary.js';
 import { canonicalJson } from '../canonical-json.js';
@@ -207,6 +208,22 @@ async function retainRunningLaunch(input) {
                 } });
             return true;
         }
+        if (supervisor.taskOwner) {
+            await resumeTaskSupervisor(member.name, provision.binPath);
+            updateMemberStartup(provision.roomId, member.name, { launch: {
+                    ...retainedLaunch, state: 'launched', launch_id: supervisor.launchId,
+                    presentation: retainedLaunch.presentation ?? presentationFromStatePath(dir, settings, member.coworkRole),
+                    updated_at: new Date().toISOString(),
+                } });
+            return true;
+        }
+        if (provision.taskId) {
+            const adopted = await adoptLegacyTaskMember({ taskId: provision.taskId, roomId: provision.roomId,
+                roomIdentityCid, creationActionId: retainedLaunch.action_id }, member.name);
+            if (adopted !== 'running-legacy')
+                await resumeTaskSupervisor(member.name, provision.binPath);
+            return true;
+        }
         await secureStoppedTempArchive(member.name, supervisor.launchId);
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 ...retainedLaunch, state: 'stopped', launch_id: supervisor.launchId,
@@ -215,6 +232,8 @@ async function retainRunningLaunch(input) {
         return false;
     }
     if (seat.launch?.state === 'launched' && !existsSync(dir)) {
+        if (provision.taskId)
+            throw Error(`retained task member ${member.name} is missing; explicit reconciliation required`);
         if (!seat.launch.launch_id || !seat.launch.action_id)
             throw new Error(`missing durable launch identity for disappeared ${member.name}`);
         const archive = await secureStoppedTempArchive(member.name, seat.launch.launch_id);
@@ -249,6 +268,7 @@ async function launchMember(input) {
     const actionId = randomUUID();
     let effectiveActionId = actionId;
     const attempt = (seat.launch?.attempt ?? 0) + 1;
+    const taskSupervised = Boolean(provision.taskId) && process.env.OURS_FLEET_SUPERVISOR !== 'none';
     const taskSha = sha256Text(startup.task);
     const effectiveAgentDefinition = structuredClone(settings.definition);
     const { projection: agentDefinition, fingerprint: agentFingerprint } = launchDefinition(effectiveAgentDefinition);
@@ -256,6 +276,7 @@ async function launchMember(input) {
         ? process.env[FLEET_PROXY_CALLER_ENV] : undefined;
     updateMemberStartup(provision.roomId, member.name, { launch: {
             state: 'intent', attempt, action_id: actionId, mission_sha256: taskSha,
+            ...(taskSupervised ? { task_supervised: true } : {}),
             agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
             agent_template: settings.template, agent_template_hash: settings.templateHash,
             ...(proxyCaller ? { caller_role: proxyCaller } : {}),
@@ -280,6 +301,7 @@ async function launchMember(input) {
         if (launched.creationActionId !== actionId) {
             updateMemberStartup(provision.roomId, member.name, { launch: {
                     state: 'intent', attempt, action_id: launched.creationActionId,
+                    ...(taskSupervised ? { task_supervised: true } : {}),
                     mission_sha256: taskSha, agent_definition: agentDefinition,
                     agent_fingerprint: agentFingerprint,
                     agent_template: settings.template, agent_template_hash: settings.templateHash,
@@ -297,6 +319,7 @@ async function launchMember(input) {
             : presentationFromStatePath(launchedDir, settings, member.coworkRole);
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'launched', attempt, action_id: launched.creationActionId, mission_sha256: taskSha,
+                ...(taskSupervised ? { task_supervised: true } : {}),
                 agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
                 agent_template: settings.template, agent_template_hash: settings.templateHash,
                 presentation,
@@ -307,6 +330,7 @@ async function launchMember(input) {
     catch (error) {
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'failed', attempt, action_id: effectiveActionId, mission_sha256: taskSha,
+                ...(taskSupervised ? { task_supervised: true } : {}),
                 agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
                 agent_template: settings.template, agent_template_hash: settings.templateHash,
                 ...(proxyCaller ? { caller_role: proxyCaller } : {}),
@@ -503,6 +527,7 @@ async function provisionMembersUnlocked(input) {
                     member,
                     settings: settings.get(member.name),
                     startup: {
+                        ...(taskId ? { task_id: taskId } : {}),
                         workspace: existing.workspace,
                         room_id: roomId,
                         room_identity_cid: roomIdentityCid,

package/dist/rooms-tasks/recovery.d.ts

@@ -0,0 +1,19 @@
+import { tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { resumeTaskSupervisor } from '../spawn.js';
+import type { CoworkAdapter } from './cowork-adapter.js';
+export type MemberRecovery = {
+    name: string;
+    status: 'running' | 'resumed' | 'migration_pending' | 'recovery_reset';
+};
+export interface TaskMemberRecoveryDeps {
+    liveness?: typeof tempSupervisorLiveness;
+    resume?: typeof resumeTaskSupervisor;
+    adopt?(taskId: string, roomId: string, name: string): Promise<void>;
+}
+/** Explicit supported recovery; never creates an identity, seat, invite, or session ID. */
+export declare function recoverTaskMembers(input: {
+    taskId: string;
+    binPath: string;
+    cowork?: Pick<CoworkAdapter, 'getRoom'>;
+    deps?: TaskMemberRecoveryDeps;
+}): Promise<MemberRecovery[]>;

package/dist/rooms-tasks/recovery.js

@@ -0,0 +1,110 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readProvenance } from '../creation.js';
+import { readTempSupervisor, tempSupervisorLiveness, requestedTempStopReason } from '../temp-lifecycle.js';
+import { taskSupervisorMayRun } from '../task-supervision.js';
+import { resumeTaskSupervisor } from '../spawn.js';
+import { resetRestartLedger, readRestartLedger } from '../runner.js';
+import { readRoomReadiness } from '../agent-ours/service.js';
+import { getTask } from './task-state.js';
+import { getRoomRecord } from './room-state.js';
+import { roomCloseLockPath, CLOSE_LOCK_STALE_MS } from './close.js';
+import { taskOperationLockPath, TASK_OPERATION_LOCK_STALE_MS } from './terminal.js';
+import { adoptLegacyTaskMember } from './legacy-task-member.js';
+/** Explicit supported recovery; never creates an identity, seat, invite, or session ID. */
+export async function recoverTaskMembers(input) {
+    const deps = input.deps ?? {};
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active', 'review'].includes(task.state) || task.deletion || task.terminal_intent)
+            throw Error('Task is not open for member recovery');
+        const recover = async (name, roomId) => {
+            const dir = agentDir(name, true), metadata = readTempSupervisor(dir);
+            if (!metadata || metadata.role !== name)
+                throw Error('Exact supervisor state missing; explicit reconciliation required');
+            if (requestedTempStopReason(dir))
+                throw Error('Task member has an explicit retirement request');
+            const live = await (deps.liveness ?? tempSupervisorLiveness)(dir);
+            if (live === 'unknown')
+                throw Error('Supervisor liveness unknown; refusing recovery');
+            if (!metadata.taskOwner) {
+                if (live === 'running')
+                    return { name, status: 'migration_pending' };
+                if (!roomId)
+                    throw Error('Legacy layout member requires explicit reconciliation');
+                if (deps.adopt)
+                    await deps.adopt(input.taskId, roomId, name);
+                else {
+                    const room = getRoomRecord(roomId);
+                    const seat = room.member_seats.find(member => member.role_name === name);
+                    const adopted = await adoptLegacyTaskMember({ taskId: input.taskId, roomId,
+                        roomIdentityCid: room.room_identity_cid, creationActionId: seat.launch.action_id }, name);
+                    if (adopted === 'running-legacy')
+                        return { name, status: 'migration_pending' };
+                }
+            }
+            if (!taskSupervisorMayRun(name))
+                throw Error('Task member is retired');
+            const reset = readRestartLedger(dir).circuit === 'open';
+            if (reset)
+                resetRestartLedger(dir);
+            if (live === 'running') {
+                return { name, status: reset ? 'recovery_reset' : 'running' };
+            }
+            await (deps.resume ?? resumeTaskSupervisor)(name, input.binPath);
+            return { name, status: 'resumed' };
+        };
+        if (task.layout) {
+            const path = join(stateRoot(), 'layouts', `${task.layout.run_id}.json`);
+            return withFileLock(path + '.lock', async () => {
+                const state = JSON.parse(readFileSync(path, 'utf8'));
+                if (state.closed || state.closing || state.uncertain)
+                    throw Error('Layout requires reconciliation before recovery');
+                const result = [];
+                for (const member of Object.values(state.participants)) {
+                    if (!member.owned || member.retired)
+                        continue;
+                    if (!member.instance?.agent || member.instance.remote)
+                        throw Error('Layout owned instance evidence missing');
+                    result.push(await recover(member.instance.agent));
+                }
+                return result;
+            });
+        }
+        if (!task.room_id || !input.cowork)
+            throw Error('Task room required for member recovery');
+        return withFileLock(roomCloseLockPath(task.room_id), async () => {
+            const room = getRoomRecord(task.room_id);
+            if (!room || room.task_id !== task.task_id || room.close || !['active', 'provisioning'].includes(room.state)
+                || !room.room_identity_cid || room.room_identity_cid !== task.room_identity_cid)
+                throw Error('Exact open task room required');
+            const remote = await input.cowork.getRoom(room.room_id);
+            if (!remote || remote.identity_cid !== room.room_identity_cid || remote.state !== 'active')
+                throw Error('Exact active Cowork room required');
+            // Validate the complete admitted roster before any member is resumed.
+            for (const seat of room.member_seats) {
+                const dir = agentDir(seat.role_name, true), metadata = readTempSupervisor(dir), provenance = readProvenance(dir);
+                const role = parse(readFileSync(join(dir, 'role.yaml'), 'utf8')), startup = role.roomMemberStartup;
+                const found = remote.seats.filter(item => item.display_name === seat.role_name && item.seat_state !== 'removed');
+                const ready = readRoomReadiness(room.room_identity_cid, seat.role_name);
+                if (seat.retirement || !seat.identity_cid || !seat.invite_id || !seat.launch?.action_id || !seat.launch.launch_id
+                    || metadata?.role !== seat.role_name || metadata.launchId !== seat.launch.launch_id
+                    || provenance?.role !== seat.role_name || provenance.creationActionId !== seat.launch.action_id
+                    || role.identity !== seat.role_name || startup?.identity_name !== seat.role_name
+                    || startup.room_id !== room.room_id || startup.room_identity_cid !== room.room_identity_cid
+                    || startup.invite_id !== seat.invite_id || startup.role !== seat.cowork_role
+                    || !ready || ready.cid !== seat.identity_cid || ready.room !== room.room_id || ready.invite !== seat.invite_id
+                    || found.length !== 1 || found[0].identity_cid !== seat.identity_cid || found[0].invite_id !== seat.invite_id
+                    || found[0].role !== seat.cowork_role || found[0].seat_state !== 'active')
+                    throw Error(`Exact admitted member proof missing: ${seat.role_name}`);
+            }
+            const result = [];
+            for (const seat of room.member_seats)
+                result.push(await recover(seat.role_name, room.room_id));
+            return result;
+        }, {}, CLOSE_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}

package/dist/rooms-tasks/task-service-retirement.d.ts

@@ -0,0 +1,11 @@
+import type { Exec } from '../exec.js';
+/** Registration retirement precedes every identity-absence shortcut. A proven
+ * legacy transient/detached launch never owned a retained registration.
+ * Missing state still requires exact catalog ownership before unregistering.
+ */
+export declare function retireTaskMemberService(name: string, expected: {
+    taskId: string;
+    creationActionId?: string;
+    launchId?: string;
+    taskSupervised?: boolean;
+}, exec?: Exec): Promise<void>;

package/dist/rooms-tasks/task-service-retirement.js

@@ -0,0 +1,21 @@
+import { existsSync } from 'node:fs';
+import { agentDir } from '../paths.js';
+import { readTempSupervisor, tempArchiveForCreationAction, tempArchiveForLaunch } from '../temp-lifecycle.js';
+import { unregisterTaskMember, hasTaskMemberRegistration } from '../supervisor/catalog.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+/** Registration retirement precedes every identity-absence shortcut. A proven
+ * legacy transient/detached launch never owned a retained registration.
+ * Missing state still requires exact catalog ownership before unregistering.
+ */
+export async function retireTaskMemberService(name, expected, exec) {
+    assertMemberNotPermanent(name);
+    const archive = expected.creationActionId ? tempArchiveForCreationAction(name, expected.creationActionId)
+        : expected.launchId ? { path: tempArchiveForLaunch(name, expected.launchId) } : undefined;
+    const source = existsSync(agentDir(name, true)) ? agentDir(name, true) : archive?.path;
+    const metadata = source ? readTempSupervisor(source) : undefined;
+    const hasServiceEvidence = hasTaskMemberRegistration(name);
+    const durableMetadata = metadata?.taskOwner && metadata.kind === 'fleet-managed';
+    if (!hasServiceEvidence && !expected.taskSupervised && !durableMetadata)
+        return;
+    await unregisterTaskMember(name, expected, { exec });
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -130,6 +130,7 @@ interface SeatEvidence {
     launch?: {
         launch_id?: string;
         action_id?: string;
+        task_supervised?: boolean;
     };
     retirement?: {
         absence_verified?: boolean;