@ours.network/fleet 1.2.0-nightly.54 → 1.2.0-nightly.55

package/dist/rooms-tasks/close.js

@@ -1,11 +1,15 @@
 import { detachDeletedRoom } from './task-state.js';
 import { binderKey } from '../agent-ours/state.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+import { retireTaskMemberService } from './task-service-retirement.js';
 import { eraseMemberArtifacts } from './erasure.js';
 import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
 import { collectWorkspaceArchives } from './workspace-artifacts.js';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { parse } from 'yaml';
+import { privateRuntimeRoot, releaseManagedAgent } from '../agent-ours/service.js';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
@@ -48,6 +52,7 @@ function exactMemberIdentity(seat) {
     }
 }
 export async function inspectMember(seat) {
+    assertMemberNotPermanent(seat.role_name);
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
     if (!supervisor || supervisor.role !== seat.role_name
@@ -105,7 +110,46 @@ export async function identityCidPresent(cid) {
         return rows.some(row => 'cid' in row && row.cid.toLowerCase() === cid.toLowerCase());
     });
 }
+/** A managed temporary identity belongs to its durable external lease even
+ * after worker exit. Retire that exact logical owner before generic removal. */
+async function releaseRetainedMemberRuntime(seat) {
+    const live = agentDir(seat.role_name, true);
+    const source = existsSync(live) ? live
+        : (seat.launch?.launch_id ? tempArchiveForLaunch(seat.role_name, seat.launch.launch_id) : undefined);
+    if (!source) {
+        if (seat.launch?.task_supervised)
+            throw Error('MEMBER_RUNTIME_RETIREMENT_SOURCE_MISSING');
+        return;
+    }
+    const path = join(source, 'role.yaml');
+    if (!existsSync(path))
+        return; // pre-managed compatibility evidence has no runtime
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('MEMBER_RUNTIME_UNSAFE_PROOF');
+    const role = parse(readFileSync(path, 'utf8'));
+    const profile = readClientProfile({ ...process.env, ...role.env });
+    const runtime = join(privateRuntimeRoot(), binderKey(profile.expectedInstanceId, seat.role_name));
+    const metadata = readTempSupervisor(source);
+    if (!existsSync(join(runtime, 'instance.json'))) {
+        if (metadata?.kind === 'fleet-managed')
+            throw Error('MEMBER_RUNTIME_RETIREMENT_MISSING');
+        return;
+    }
+    const creationPath = join(source, 'creation.json'), creationStat = lstatSync(creationPath);
+    if (!creationStat.isFile() || creationStat.isSymbolicLink() || creationStat.size > 256 * 1024)
+        throw Error('MEMBER_RUNTIME_UNSAFE_PROOF');
+    const creation = JSON.parse(readFileSync(creationPath, 'utf8'));
+    if (role.name !== seat.role_name || role.identity !== seat.role_name || !seat.identity_cid
+        || !seat.launch?.action_id || !seat.launch.launch_id || creation.role !== seat.role_name
+        || creation.creationActionId !== seat.launch.action_id || metadata?.role !== seat.role_name
+        || metadata.launchId !== seat.launch.launch_id
+        || (metadata.taskOwner && metadata.taskOwner.creationActionId !== seat.launch.action_id))
+        throw Error('MEMBER_RUNTIME_RETIREMENT_MISMATCH');
+    await releaseManagedAgent(role, { cid: seat.identity_cid, action: seat.launch.action_id });
+}
 export async function removeExactMemberIdentity(seat) {
+    assertMemberNotPermanent(seat.role_name);
     await withIdentityClient(async (client) => {
         const rows = await client.listIdentities();
         const before = listedIdentity(rows, seat.role_name);
@@ -113,6 +157,11 @@ export async function removeExactMemberIdentity(seat) {
             if (rows.some(row => row.name === seat.role_name || (seat.identity_cid && 'cid' in row
                 && row.cid.toLowerCase() === seat.identity_cid.toLowerCase())))
                 throw new Error(`room member '${seat.role_name}' identity absence is not proven`);
+            // A terminal release can remove the SDK identity before its response is
+            // recorded. Finish the exact retained launch's release journal on retry.
+            if (existsSync(agentDir(seat.role_name, true)) || (seat.launch?.launch_id
+                && tempArchiveForLaunch(seat.role_name, seat.launch.launch_id)))
+                await releaseRetainedMemberRuntime(seat);
             return;
         }
         if (!seat.identity_cid) {
@@ -121,7 +170,9 @@ export async function removeExactMemberIdentity(seat) {
         if (before.cid?.toLowerCase() !== seat.identity_cid.toLowerCase()) {
             throw new Error(`room member '${seat.role_name}' identity absence is not proven: CID mismatch: recorded ${seat.identity_cid}, found ${before.cid ?? 'none'}`);
         }
+        await releaseRetainedMemberRuntime(seat);
         try {
+            assertMemberNotPermanent(seat.role_name);
             await client.removeIdentity({ name: seat.role_name });
         }
         catch (error) {
@@ -150,9 +201,19 @@ export async function assertMemberIdentityAbsent(seat) {
         }
     });
 }
+async function retireMemberRegistration(room, current, deps) {
+    if (room.task_id)
+        await (deps.retireTaskService ?? retireTaskMemberService)(current.role_name, {
+            taskId: room.task_id, creationActionId: current.launch?.action_id,
+            taskSupervised: current.launch?.task_supervised,
+            ...(current.launch?.launch_id ? { launchId: current.launch.launch_id } : {}),
+        });
+}
 async function retireMember(roomId, seat, deps) {
+    assertMemberNotPermanent(seat.role_name);
     let room = getRoomRecord(roomId);
     let current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
+    await retireMemberRegistration(room, current, deps);
     let retirement = current.retirement;
     if (retirement?.phase === 'identity_absent') {
         if (!deps.inspectMember) {
@@ -250,6 +311,10 @@ export async function closeManagedRoom(input) {
     return lock(roomCloseLockPath(input.roomId), async () => {
         let room = beginRoomClose(input.roomId);
         if (room.state === 'closed') {
+            for (const seat of room.member_seats) {
+                assertMemberNotPermanent(seat.role_name);
+                await retireMemberRegistration(room, seat, deps);
+            }
             if (!deps.inspectMember)
                 for (const seat of room.member_seats) {
                     if (existsSync(agentDir(seat.role_name, true)))

package/dist/rooms-tasks/deletion.js

@@ -1,4 +1,7 @@
 import { eraseMemberArtifacts } from './erasure.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+import { retireTaskMemberService } from './task-service-retirement.js';
+import { assertTaskRegistrationsAbsent } from '../supervisor/catalog.js';
 import { proveArchivedAbsence, verifyArchivedAbsence, verifyArchivedMemberStillAbsent } from './archived-absence.js';
 import { existsSync } from 'node:fs';
 import { withFileLock } from '../atomic-file.js';
@@ -64,6 +67,12 @@ function cursorSeat(cursor) {
  * the recorded CID surviving under any name blocks settlement.
  */
 async function retireCursorMember(taskId, cursor, deps) {
+    assertMemberNotPermanent(cursor.name);
+    await (deps.roomClose?.retireTaskService ?? retireTaskMemberService)(cursor.name, { taskId,
+        creationActionId: cursor.action_id,
+        taskSupervised: cursor.task_supervised,
+        ...((cursor.launch_id && !['never-launched', 'absent-verified'].includes(cursor.launch_id)) ? { launchId: cursor.launch_id } : {}),
+    });
     let phase = cursor.phase;
     let launchId = cursor.launch_id;
     if (phase === 'identity_absent') {
@@ -249,6 +258,7 @@ export async function settleTaskDeletion(input) {
             }
             if (cleanup.snapshotHash)
                 releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            assertTaskRegistrationsAbsent(taskId);
             await eraseMemberArtifacts('task', taskId, task.deletion.members.map(cursorSeat), task.deletion.room_id ? [task.deletion.room_id] : []);
             if (task.workspace) {
                 assertWorkspaceDeletable(task.workspace, 'task', taskId);

package/dist/rooms-tasks/erasure.js

@@ -1,11 +1,12 @@
 import { eraseResourcePresentations } from '../erased-resources.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, join, relative } from 'node:path';
 import { parse } from 'yaml';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
-import { readTempSupervisor, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
+import { readTempSupervisorForScan, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
 import { assertSafeAncestors, auditWorkspaceGit, prepareOwnedDeletionTree } from './workspace.js';
 function entries(path) {
     try {
@@ -58,6 +59,7 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
     for (const name of names) {
         if (!/^[a-zA-Z0-9_-]{1,120}$/.test(name))
             throw new Error('Invalid erasure member');
+        assertMemberNotPermanent(name);
         if (existsSync(agentDir(name, true)))
             throw new Error(`Member '${name}' still has live state during erasure`);
     }
@@ -75,7 +77,7 @@ export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
             const stat = lstatSync(path);
             if (!stat.isDirectory() || stat.isSymbolicLink())
                 continue;
-            const supervisor = readTempSupervisor(path);
+            const supervisor = readTempSupervisorForScan(path);
             if (!supervisor || !names.has(supervisor.role))
                 continue;
             const seat = seats.find(s => s.role_name === supervisor.role);

package/dist/rooms-tasks/layout-member-retirement.d.ts

@@ -0,0 +1,10 @@
+import { type TempLifecycleDeps } from '../temp-lifecycle.js';
+import type { LayoutInstance, RoomLayoutState } from './layout.js';
+import type { RoomMemberSeat } from './types.js';
+export declare function layoutOwnedMemberName(runId: string, key: string): string;
+/** Retire a local layout factory result, never a borrowed binding. The runtime
+ * instance and CID fence replacement supervisors even when already stopped.
+ */
+export declare function retireOwnedLayoutMember(instance: LayoutInstance, runId: string, key: string, lifecycle?: TempLifecycleDeps, taskSupervised?: boolean): Promise<void>;
+/** Exact archived launches used by the existing artifact erasure saga. */
+export declare function ownedLayoutRetirementSeats(state: RoomLayoutState, runId: string): RoomMemberSeat[];

package/dist/rooms-tasks/layout-member-retirement.js

@@ -0,0 +1,90 @@
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { binderKey } from '../agent-ours/state.js';
+import { readClientProfile } from '../client-profile.js';
+import { readProvenance } from '../creation.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempArchiveForCreationAction } from '../temp-lifecycle.js';
+import { assertMemberIdentityAbsent, removeExactMemberIdentity, waitForLivenessAbsent } from './close.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+import { retireTaskMemberService } from './task-service-retirement.js';
+function proof(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('LAYOUT_MEMBER_UNSAFE_PROOF');
+    return readFileSync(path, 'utf8');
+}
+export function layoutOwnedMemberName(runId, key) {
+    return `layout-${createHash('sha256').update(runId + ':' + key).digest('hex').slice(0, 16)}`;
+}
+function assertOwned(instance, runId, key) {
+    if (instance.remote || !instance.agent || instance.temporary !== true
+        || instance.agent !== layoutOwnedMemberName(runId, key) || instance.supervisor !== stateRoot())
+        throw Error('LAYOUT_MEMBER_NOT_OWNED');
+    assertMemberNotPermanent(instance.agent);
+}
+function seatFor(instance, key, action, launchId) {
+    return { role_name: instance.agent, identity_cid: instance.cid, slot: key, cowork_role: key, seat_state: 'removed',
+        launch: { state: 'stopped', action_id: action, launch_id: launchId, attempt: 1, updated_at: '' } };
+}
+/** Retire a local layout factory result, never a borrowed binding. The runtime
+ * instance and CID fence replacement supervisors even when already stopped.
+ */
+export async function retireOwnedLayoutMember(instance, runId, key, lifecycle = {}, taskSupervised = false) {
+    assertOwned(instance, runId, key);
+    const action = `${runId}:${key}`, dir = agentDir(instance.agent, true);
+    const archived = tempArchiveForCreationAction(instance.agent, action);
+    if (!existsSync(dir) && !archived) {
+        if (runId.startsWith('task-'))
+            await retireTaskMemberService(instance.agent, { taskId: runId.slice(5), creationActionId: action, taskSupervised }, lifecycle.exec);
+        // A prior erasure may already have consumed its archive. No live state plus
+        // authoritative identity absence is required before accepting completion.
+        await assertMemberIdentityAbsent({ role_name: instance.agent, identity_cid: instance.cid,
+            slot: key, cowork_role: key, seat_state: 'removed' });
+        return;
+    }
+    const source = existsSync(dir) ? dir : archived.path;
+    const supervisor = readTempSupervisor(source), provenance = readProvenance(source);
+    if (!supervisor || supervisor.role !== instance.agent || provenance?.role !== instance.agent
+        || provenance.creationActionId !== action || proof(join(source, '.identity')).trim() !== instance.agent)
+        throw Error('LAYOUT_MEMBER_LAUNCH_MISMATCH');
+    {
+        const role = parse(proof(join(source, 'role.yaml')));
+        if (role?.name !== instance.agent || role.identity !== instance.agent)
+            throw Error('LAYOUT_MEMBER_ROLE_MISMATCH');
+        const profile = readClientProfile({ ...process.env, ...role.env });
+        const privateDir = join(stateRoot(), 'private-ours', binderKey(profile.expectedInstanceId, instance.agent));
+        const runtime = JSON.parse(proof(join(privateDir, 'state.json')));
+        const runtimeInstance = JSON.parse(proof(join(privateDir, 'instance.json')));
+        if (runtime.instance !== instance.launch || runtimeInstance.instance !== instance.launch
+            || runtimeInstance.role !== instance.agent || runtimeInstance.temporary !== true
+            || runtime.name !== instance.agent || runtime.daemon !== profile.expectedInstanceId
+            || runtime.lifetime !== 'temporary' || runtime.action !== action
+            || runtime.cid?.toLowerCase() !== instance.cid.toLowerCase())
+            throw Error('LAYOUT_MEMBER_INSTANCE_MISMATCH');
+        if (runId.startsWith('task-'))
+            await retireTaskMemberService(instance.agent, { taskId: runId.slice(5), creationActionId: action, launchId: supervisor.launchId, taskSupervised }, lifecycle.exec);
+        if (existsSync(dir)) {
+            await stopTempSupervisor(instance.agent, lifecycle);
+            await waitForLivenessAbsent(instance.agent, supervisor.launchId, lifecycle);
+        }
+    }
+    await secureStoppedTempArchive(instance.agent, supervisor.launchId, lifecycle);
+    await removeExactMemberIdentity(seatFor(instance, key, action, supervisor.launchId));
+    await assertMemberIdentityAbsent(seatFor(instance, key, action, supervisor.launchId));
+}
+/** Exact archived launches used by the existing artifact erasure saga. */
+export function ownedLayoutRetirementSeats(state, runId) {
+    return Object.entries(state.participants).flatMap(([key, participant]) => {
+        if (!participant.owned || !participant.instance)
+            return [];
+        const instance = participant.instance;
+        assertOwned(instance, runId, key);
+        if (!participant.retired)
+            throw Error('LAYOUT_MEMBER_NOT_RETIRED');
+        const action = `${runId}:${key}`, archive = tempArchiveForCreationAction(instance.agent, action);
+        return [seatFor(instance, key, action, archive?.launchId ?? 'absent-verified')];
+    });
+}

package/dist/rooms-tasks/layout-service.d.ts

@@ -5,6 +5,7 @@ export declare class NativeLayoutSupervisor implements LayoutSupervisor {
     private configPath;
     private runId;
     private templates;
+    readonly taskSupervised: boolean;
     readonly id: string;
     constructor(configPath: string | undefined, runId: string, templates: Record<string, AgentTemplateDefinition>);
     private request;

package/dist/rooms-tasks/layout-service.js

@@ -1,22 +1,24 @@
-import { randomUUID, createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loadConfig, loadRoomsConfig, splitRootFor } from '../config.js';
 import { agentDir, stateRoot, defaultConfigPath } from '../paths.js';
 import { controlRequest } from '../session/control.js';
 import { spawnTemp } from '../spawn.js';
-import { tempSupervisorLiveness } from '../temp-lifecycle.js';
 import { layoutSupervisorId } from './layout-control.js';
 import { RoomLayout } from './layout.js';
 import { assertLayoutFile, validLayoutKey, readRoomLayout, readRoomLayouts } from './layout-config.js';
 import { createCoworkAdapter } from './cowork-adapter.js';
 import { callRemoteLayoutBinding } from './layout-binding-client.js';
 import { readClientProfile } from '../client-profile.js';
+import { tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { layoutOwnedMemberName, retireOwnedLayoutMember } from './layout-member-retirement.js';
 export class NativeLayoutSupervisor {
     configPath;
     runId;
     templates;
+    taskSupervised;
     id;
     constructor(configPath, runId, templates) {
         this.configPath = configPath;
@@ -24,6 +26,7 @@ export class NativeLayoutSupervisor {
         this.templates = templates;
         mkdirSync(stateRoot(), { recursive: true, mode: 0o700 });
         this.id = layoutSupervisorId();
+        this.taskSupervised = runId.startsWith('task-') && process.env.OURS_FLEET_SUPERVISOR !== 'none';
     }
     async request(agent, temporary, request) {
         if (!/^[A-Za-z0-9_-]+$/.test(agent))
@@ -48,8 +51,14 @@ export class NativeLayoutSupervisor {
         const definition = this.templates[template];
         if (!definition)
             throw Error(`agent template not found in run snapshot: ${template}`);
-        const name = `layout-${createHash('sha256').update(this.runId + ':' + key).digest('hex').slice(0, 16)}`;
+        const name = layoutOwnedMemberName(this.runId, key);
+        const taskId = this.runId.startsWith('task-') ? this.runId.slice(5) : undefined;
+        const task = taskId ? (await import('./task-state.js')).getTask(taskId) : undefined;
+        if (task && task.layout?.run_id !== this.runId)
+            throw Error('TASK_LAYOUT_OWNER_MISMATCH');
         await spawnTemp({ name, temp: true, configPath: this.configPath, agentDefinition: definition,
+            ...(task ? { taskOwner: { taskId: task.task_id, layout: { runId: this.runId, participant: key },
+                    creationActionId: `${this.runId}:${key}` } } : {}),
             creationActionId: `${this.runId}:${key}`, surface: 'cli' }, fileURLToPath(new URL('../cli.js', import.meta.url)));
         const deadline = Date.now() + 120_000;
         let last;
@@ -90,17 +99,26 @@ export class NativeLayoutSupervisor {
             throw Error('cannot retire a borrowed cross-Fleet instance');
         if (i.supervisor !== this.id || !i.agent || !/^[A-Za-z0-9_-]+$/.test(i.agent) || i.temporary !== true)
             throw Error('invalid local temporary layout instance');
-        const dir = agentDir(i.agent, true);
-        const stopped = async () => !existsSync(dir) || await tempSupervisorLiveness(dir) === 'stopped';
-        if (await stopped())
+        if (!this.runId.startsWith('task-')) {
+            const dir = agentDir(i.agent, true);
+            const stopped = async () => !existsSync(dir) || await tempSupervisorLiveness(dir) === 'stopped';
+            if (await stopped())
+                return;
+            try {
+                await this.call(i, { action: 'retire' });
+            }
+            catch (error) {
+                if (!await stopped())
+                    throw error;
+            }
             return;
-        try {
-            await this.call(i, { action: 'retire' });
-        }
-        catch (error) {
-            if (!await stopped())
-                throw error;
         }
+        const snapshot = JSON.parse(readFileSync(layoutRunPath(this.runId), 'utf8'));
+        const owned = Object.entries(snapshot.participants).filter(([, participant]) => participant.owned
+            && participant.instance?.agent === i.agent && JSON.stringify(participant.instance) === JSON.stringify(i));
+        if (owned.length !== 1)
+            throw Error('LAYOUT_MEMBER_NOT_OWNED');
+        await retireOwnedLayoutMember(i, this.runId, owned[0][0], {}, owned[0][1].task_supervised);
     }
 }
 export const layoutRunPath = (id) => {

package/dist/rooms-tasks/layout.d.ts

@@ -49,6 +49,7 @@ export interface LayoutAssignment {
     contract?: string;
 }
 export interface LayoutSupervisor {
+    readonly taskSupervised?: boolean;
     id: string;
     /** Must verify current launch, CID, live session and standalone ownership. */
     verify(instance: LayoutInstance): Promise<void>;
@@ -67,6 +68,7 @@ type ParticipantState = {
     retired?: boolean;
     participant?: string;
     room?: string;
+    task_supervised?: boolean;
 };
 type RoomState = {
     spec: LayoutRoom;
@@ -74,6 +76,7 @@ type RoomState = {
     ready: string[];
     state: 'provisioning' | 'active' | 'closed';
     owner_ready?: boolean;
+    deleted?: boolean;
 };
 export interface RoomLayoutState {
     version: 1;
@@ -110,5 +113,9 @@ export declare class RoomLayout {
     private archiveRoom;
     closeRoom(actor: string, key: string): Promise<void>;
     close(actor: string): Promise<void>;
+    /** Explicit deletion retains a per-room checkpoint until the run is erased.
+     * Finish/cancel continue to use close(), preserving archived rooms.
+     */
+    delete(actor: string): Promise<void>;
 }
 export {};

package/dist/rooms-tasks/layout.js

@@ -6,6 +6,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { canonicalJson } from '../canonical-json.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
 const ownerReference = (owner) => ({ cid: owner.cid, role: owner.role, fingerprint: createHash('sha256').update(owner.invite).digest('hex') });
 const own = (o, key) => Object.hasOwn(o, key);
 function need(ok, message) { if (!ok)
@@ -133,6 +134,8 @@ export class RoomLayout {
             if (!p.instance) {
                 const template = s.definition.participants[member]?.agent_template;
                 need(template, `no factory for ${member}`);
+                if (this.supervisor.taskSupervised)
+                    p.task_supervised = true;
                 await this.mutation(s, `spawn:${resolvedKey}`, () => this.supervisor.spawn(resolvedKey, template), i => { p.instance = i; });
                 await this.verify(p.instance);
             }
@@ -247,4 +250,36 @@ export class RoomLayout {
             this.save(s);
         }, true);
     }
+    /** Explicit deletion retains a per-room checkpoint until the run is erased.
+     * Finish/cancel continue to use close(), preserving archived rooms.
+     */
+    async delete(actor) {
+        await this.close(actor);
+        await this.operation(actor, async (state) => {
+            for (const room of Object.values(state.rooms)) {
+                if (!room.native || room.deleted)
+                    continue;
+                let remote;
+                try {
+                    remote = await this.cowork.getRoom(room.native.room_id);
+                }
+                catch (error) {
+                    if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                        throw error;
+                }
+                if (remote) {
+                    need(remote.identity_cid === room.native.identity_cid, 'native room identity changed during deletion');
+                    try {
+                        await this.cowork.deleteRoom(room.native.room_id);
+                    }
+                    catch (error) {
+                        if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                            throw error;
+                    }
+                }
+                room.deleted = true;
+                this.save(state);
+            }
+        }, true);
+    }
 }

package/dist/rooms-tasks/legacy-task-member.d.ts

@@ -0,0 +1,19 @@
+import { tempSupervisorLiveness } from '../temp-lifecycle.js';
+export interface LegacyTaskOwner {
+    taskId: string;
+    roomId: string;
+    roomIdentityCid: string;
+    creationActionId: string;
+}
+interface AdoptionDeps {
+    liveness?: typeof tempSupervisorLiveness;
+    verifyIdentity?(name: string, cid: string): Promise<void>;
+    /** Crash seam: the role snapshot is durable before the supervisor owner. */
+    beforeOwnerCommit?(): void;
+}
+/** Caller holds task and room operation locks. No service is started here.
+ * Running legacy supervisors remain untouched; stopped exact state receives
+ * only ownership metadata, preserving launch, identity and conversation.
+ */
+export declare function adoptLegacyTaskMember(owner: LegacyTaskOwner, name: string, deps?: AdoptionDeps): Promise<'adopted' | 'running-legacy' | 'already-durable'>;
+export {};

package/dist/rooms-tasks/legacy-task-member.js

@@ -0,0 +1,116 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { parse, stringify } from 'yaml';
+import { attachOursClient } from '@ours.network/sdk/client';
+import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { binderKey } from '../agent-ours/state.js';
+import { readClientProfile } from '../client-profile.js';
+import { readProvenance } from '../creation.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readTempSupervisor, tempSupervisorLiveness, TEMP_SUPERVISOR_FILE } from '../temp-lifecycle.js';
+import { getTask } from './task-state.js';
+import { getRoomRecord, updateMemberStartup } from './room-state.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+function bounded(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('LEGACY_TASK_MEMBER_UNSAFE_PROOF');
+    return readFileSync(path, 'utf8');
+}
+async function verifyIdentity(name, cid, env) {
+    const profile = readClientProfile(env);
+    const client = await attachOursClient({ endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+        credentialPath: profile.credentialPath, sessionMode: 'external', env: {}, leaseToken: `task-migration-${randomUUID()}` });
+    try {
+        const identities = await client.listIdentities();
+        const found = identities.find(value => value.name === name);
+        if (!found || !('cid' in found) || found.cid.toLowerCase() !== cid.toLowerCase())
+            throw Error('LEGACY_TASK_MEMBER_IDENTITY_MISMATCH');
+    }
+    finally {
+        try {
+            await client.releaseLease();
+        }
+        finally {
+            await client.close();
+        }
+    }
+}
+/** Caller holds task and room operation locks. No service is started here.
+ * Running legacy supervisors remain untouched; stopped exact state receives
+ * only ownership metadata, preserving launch, identity and conversation.
+ */
+export async function adoptLegacyTaskMember(owner, name, deps = {}) {
+    return withFileLock(join(stateRoot(), 'locks', 'temp-supervisors', encodeURIComponent(name)), async () => {
+        assertMemberNotPermanent(name);
+        const dir = agentDir(name, true), task = getTask(owner.taskId), room = getRoomRecord(owner.roomId);
+        const seat = room?.member_seats.find(value => value.role_name === name);
+        const supervisor = readTempSupervisor(dir);
+        const rolePath = join(dir, 'role.yaml'), roleBytes = bounded(rolePath);
+        const role = parse(roleBytes);
+        const startup = role?.roomMemberStartup, provenance = readProvenance(dir);
+        if (task.deletion || task.terminal_intent || !['provisioning', 'active', 'review'].includes(task.state)
+            || !room || room.close || !['provisioning', 'active'].includes(room.state) || room.task_id !== owner.taskId
+            || task.room_id !== owner.roomId || room.room_identity_cid !== owner.roomIdentityCid
+            || task.room_identity_cid !== owner.roomIdentityCid || !seat || seat.retirement
+            || !supervisor || supervisor.role !== name || seat.launch?.launch_id !== supervisor.launchId
+            || seat.launch.action_id !== owner.creationActionId || provenance?.creationActionId !== owner.creationActionId
+            || provenance.role !== name || role.name !== name || role.identity !== name
+            || startup?.identity_name !== name || startup.room_id !== owner.roomId
+            || startup.room_identity_cid !== owner.roomIdentityCid || startup.invite_id !== seat.invite_id
+            || startup.role !== seat.cowork_role || startup.invite !== ''
+            || (startup.task_id !== undefined && startup.task_id !== owner.taskId)
+            || (room.workspace && (role.cwd !== room.workspace.path || JSON.stringify(startup.workspace) !== JSON.stringify(room.workspace)))
+            || bounded(join(dir, '.identity')).trim() !== name)
+            throw Error('LEGACY_TASK_MEMBER_OWNERSHIP_MISMATCH');
+        if (supervisor.taskOwner) {
+            if (Object.entries(owner).some(([key, value]) => supervisor.taskOwner[key] !== value)
+                || startup.task_id !== owner.taskId)
+                throw Error('LEGACY_TASK_MEMBER_OWNER_MISMATCH');
+            if (supervisor.kind !== 'detached' && process.env.OURS_FLEET_SUPERVISOR !== 'none')
+                updateMemberStartup(owner.roomId, name, { launch: { ...seat.launch, task_supervised: true } });
+            return 'already-durable';
+        }
+        const live = await (deps.liveness ?? tempSupervisorLiveness)(dir);
+        if (live === 'running')
+            return 'running-legacy';
+        if (live !== 'stopped')
+            throw Error('LEGACY_TASK_MEMBER_LIVENESS_UNKNOWN');
+        const env = { ...process.env, ...role.env };
+        const profile = readClientProfile(env);
+        const privateDir = join(stateRoot(), 'private-ours', binderKey(profile.expectedInstanceId, name));
+        const state = JSON.parse(bounded(join(privateDir, 'state.json')));
+        const instance = JSON.parse(bounded(join(privateDir, 'instance.json')));
+        const externalOwner = JSON.parse(bounded(join(privateDir, 'owner.json')));
+        const launch = JSON.parse(bounded(join(stateRoot(), 'private-ours', 'launches', binderKey('temporary', name) + '.json')));
+        if (!seat.identity_cid || state.name !== name || state.daemon !== profile.expectedInstanceId
+            || state.lifetime !== 'temporary' || state.action !== owner.creationActionId
+            || state.cid?.toLowerCase() !== seat.identity_cid.toLowerCase()
+            || !['READY', 'SERVING', 'RECOVERING'].includes(state.phase)
+            || instance.role !== name || instance.temporary !== true || instance.instance !== state.instance
+            || externalOwner.instance !== state.instance || typeof externalOwner.token !== 'string' || !externalOwner.token
+            || state.room?.id !== owner.roomId || state.room.cid !== owner.roomIdentityCid
+            || state.room.agentCid.toLowerCase() !== seat.identity_cid.toLowerCase() || state.room.action !== seat.invite_id
+            || launch.role !== name || launch.identity !== name || launch.action !== owner.creationActionId)
+            throw Error('LEGACY_TASK_MEMBER_RUNTIME_NOT_RESUMABLE');
+        const sessionPath = join(dir, role.session === 'codex-app-server' ? '.session-id' : '.acp-session-id');
+        if (!bounded(sessionPath).trim())
+            throw Error('LEGACY_TASK_MEMBER_CONVERSATION_MISSING');
+        if (deps.verifyIdentity)
+            await deps.verifyIdentity(name, seat.identity_cid);
+        else
+            await verifyIdentity(name, seat.identity_cid, env);
+        assertMemberNotPermanent(name);
+        if (bounded(rolePath) !== roleBytes || JSON.stringify(readTempSupervisor(dir)) !== JSON.stringify(supervisor))
+            throw Error('LEGACY_TASK_MEMBER_STATE_CHANGED');
+        // Crash after this write is healed by retrying the same stopped adoption.
+        startup.task_id = owner.taskId;
+        replaceFileAtomically(rolePath, stringify(role));
+        if (supervisor.kind !== 'detached' && process.env.OURS_FLEET_SUPERVISOR !== 'none')
+            updateMemberStartup(owner.roomId, name, { launch: { ...seat.launch, task_supervised: true } });
+        deps.beforeOwnerCommit?.();
+        replaceFileAtomically(join(dir, TEMP_SUPERVISOR_FILE), JSON.stringify({ ...supervisor, taskOwner: owner }, null, 2) + '\n');
+        return 'adopted';
+    });
+}

package/dist/rooms-tasks/member-ownership.d.ts

@@ -0,0 +1,5 @@
+/** A room seat is never authority to retire a standalone persistent agent.
+ * Check both role-name collisions and a permanent role using the seat's
+ * identity name. Missing legacy task state must not bypass this fence.
+ */
+export declare function assertMemberNotPermanent(name: string): void;