@ours.network/fleet 1.2.0-nightly.56 → 1.2.0-nightly.58

package/dist/harness/codex-app-server-proxy.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { CodexFileInventory } from './codex-file-inventory.js';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline';
@@ -447,7 +446,6 @@ export function runCodexAppServerProxy() {
             });
         }
     };
-    const inventory = process.env.FLEET_CURRENT_CHAT_FILES === '1' ? new CodexFileInventory(writeToChild, writeToClient) : undefined;
     const recovery = new CodexTerminalRecovery({
         sendToCodex: writeToChild,
         emitToClient: writeToClient,
@@ -458,7 +456,6 @@ export function runCodexAppServerProxy() {
             return;
         finished = true;
         recovery.close();
-        inventory?.close();
         input.close();
         process.stdin.destroy();
         // stdout/stderr are often pipes under Fleet and tests. Setting exitCode
@@ -491,11 +488,10 @@ export function runCodexAppServerProxy() {
             return;
         const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
-        if (!inventory || inventory.observeClientLine(rewritten))
-            writeToChild(rewritten);
+        writeToChild(rewritten);
     });
     output.on('line', line => {
-        if (!finished && (!inventory || inventory.observeServerLine(line)) && recovery.observeServerLine(line))
+        if (!finished && recovery.observeServerLine(line))
             writeToClient(line);
     });
     input.once('close', () => {

package/dist/harness/codex.js

@@ -262,7 +262,6 @@ function codexAcpEnvironment(role, dirs) {
     if (!source)
         throw new Error('Codex app-server proxy is missing; rebuild ours-fleet');
     writeFileSync(proxyModule, readFileSync(source, 'utf8'), { mode: 0o600 });
-    writeFileSync(join(runtimeDir, 'codex-file-inventory.js'), readFileSync(join(dirname(source), 'codex-file-inventory.js'), 'utf8'), { mode: 0o600 });
     const windows = process.platform === 'win32';
     const command = join(runtimeDir, windows ? 'codex-app-server-proxy.cmd' : 'codex-app-server-proxy');
     const script = windows
@@ -483,7 +482,7 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
                     catch (error) {
                         throw new Error(`Codex ACP runtime check failed: ${error.message}; check CODEX_PATH or reinstall Fleet with optional dependencies`);
                     }
-                    const minimum = role.file_delivery?.enabled ? '0.159.0' : role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
+                    const minimum = role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
                         ? '0.153.3' : '0.145.0';
                     if (!codexVersionAtLeast(runtime.version, minimum))
                         throw new Error(`${role.model ?? 'Codex ACP'} requires a newer Codex (>=${minimum}): ACP selects ${runtime.executable} (${runtime.version}); upgrade Fleet or set CODEX_PATH to a supported executable in the agent/service environment`);

package/dist/notifications/task-producer.d.ts

@@ -0,0 +1,18 @@
+import type { ProducerConfig } from './outbox.js';
+/** The Fleet manager owns this sender even when the web console is stopped.
+ * Events are already durable in their owning task commit, so no second outbox
+ * admission/crash window is needed. A failed task does not block other tasks. */
+export declare class TaskNotificationProducer {
+    private readonly config;
+    private readonly warn;
+    private readonly request;
+    private readonly timer;
+    private running?;
+    private offset;
+    private stopped;
+    private readonly shutdown;
+    constructor(config: ProducerConfig, warn?: (line: string) => void, request?: typeof fetch);
+    drain(): Promise<void>;
+    private drainOnce;
+    close(): Promise<void>;
+}

package/dist/notifications/task-producer.js

@@ -0,0 +1,67 @@
+import { acknowledgeTaskNotification, pendingTaskNotifications } from '../rooms-tasks/task-state.js';
+/** The Fleet manager owns this sender even when the web console is stopped.
+ * Events are already durable in their owning task commit, so no second outbox
+ * admission/crash window is needed. A failed task does not block other tasks. */
+export class TaskNotificationProducer {
+    config;
+    warn;
+    request;
+    timer;
+    running;
+    offset = 0;
+    stopped = false;
+    shutdown = new AbortController();
+    constructor(config, warn = () => { }, request = fetch) {
+        this.config = config;
+        this.warn = warn;
+        this.request = request;
+        this.timer = setInterval(() => { void this.drain(); }, 3000);
+        this.timer.unref();
+        void this.drain();
+    }
+    drain() {
+        return this.running ??= this.drainOnce().catch(() => {
+            this.warn('Task notification snapshot unavailable; committed events retained');
+        }).finally(() => { this.running = undefined; });
+    }
+    async drainOnce() {
+        if (this.stopped)
+            return;
+        const pending = pendingTaskNotifications(this.warn);
+        if (!pending.length)
+            return;
+        const start = this.offset % pending.length;
+        const batch = [...pending.slice(start), ...pending.slice(0, start)].slice(0, 32);
+        this.offset = start + batch.length;
+        for (let index = 0; index < batch.length; index += 4) {
+            if (this.stopped)
+                break;
+            await Promise.all(batch.slice(index, index + 4).map(async (task) => {
+                for (const event of task.events.slice(0, 32)) {
+                    if (this.stopped)
+                        break;
+                    try {
+                        const response = await this.request(this.config.origin + '/api/v1/send', {
+                            method: 'POST', redirect: 'error', signal: AbortSignal.any([this.shutdown.signal, AbortSignal.timeout(10_000)]),
+                            headers: { ...(this.config.gatewayCredential
+                                    ? { 'X-Ours-Api-Token': this.config.gatewayCredential, 'X-Ours-Notifications-Producer': this.config.token }
+                                    : { Authorization: `Bearer ${this.config.token}` }), 'Content-Type': 'application/json' },
+                            body: JSON.stringify(event),
+                        });
+                        await response.body?.cancel();
+                        if (!response.ok) {
+                            this.warn(`Task notification delivery pending (HTTP ${response.status}); committed event retained`);
+                            break;
+                        }
+                        acknowledgeTaskNotification(task.taskId, event.eventId);
+                    }
+                    catch {
+                        this.warn('Task notification delivery pending; committed event retained');
+                        break;
+                    }
+                }
+            }));
+        }
+    }
+    async close() { this.stopped = true; clearInterval(this.timer); this.shutdown.abort(); await this.running; }
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -1,8 +1,15 @@
 import type { ArchivedMemberAbsence } from './types.js';
-import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
+import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase, TaskNotificationEvent } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
 }
+/** Atomic snapshots contain the events, including intermediate states between polls. */
+export declare function pendingTaskNotifications(warn?: (line: string) => void): Array<{
+    taskId: string;
+    events: TaskNotificationEvent[];
+}>;
+/** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
+export declare function acknowledgeTaskNotification(id: string, eventId: string): void;
 /**
  * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
  * mutation, terminal settlement, and room publication must fail boundedly.

package/dist/rooms-tasks/task-state.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically } from '../atomic-file.js';
@@ -89,8 +89,77 @@ function writeTask(record) {
     mkdirSync(tasksDir(), { recursive: true });
     const persisted = { ...record };
     delete persisted.list_name;
+    const path = taskPath(record.task_id);
+    const previous = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : undefined;
+    const status = (task) => task.deletion?.status === 'pending' ? 'deleting' : task.blocked ? `${task.state} (blocked)` : task.state;
+    // Read pending events under the same task lock as every mutation. Metadata edits
+    // and retries preserve the queue; acknowledgement cannot be resurrected by stale input.
+    const pending = [...(previous?.notification_events ?? [])];
+    if (!previous || status(previous) !== status(record)) {
+        const next = status(record), before = previous ? status(previous) : undefined;
+        pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
+            title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
+            body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
+            url: `/fleet/tasks/${record.task_id}` });
+    }
+    if (pending.length)
+        persisted.notification_events = pending;
+    else
+        delete persisted.notification_events;
     replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
 }
+const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
+/** Atomic snapshots contain the events, including intermediate states between polls. */
+export function pendingTaskNotifications(warn = () => { }) {
+    const result = [];
+    for (const dir of [tasksDir(), retiredNotificationsDir()]) {
+        if (!existsSync(dir))
+            continue;
+        for (const file of readdirSync(dir).filter(file => TASK_ID_PATTERN.test(file.slice(0, -5)) && file.endsWith('.json'))) {
+            try {
+                const path = join(dir, file), stat = lstatSync(path);
+                if (!stat.isFile() || stat.isSymbolicLink())
+                    throw new Error('invalid notification source');
+                const value = JSON.parse(readFileSync(path, 'utf8'));
+                const id = file.slice(0, -5);
+                // A prepared deletion copy has no authority while the original still exists.
+                if (dir === retiredNotificationsDir() && existsSync(taskPath(id)))
+                    continue;
+                if (value.notification_events === undefined)
+                    continue;
+                if (!Array.isArray(value.notification_events) || value.notification_events.some(e => !e
+                    || typeof e.eventId !== 'string' || !e.eventId.startsWith(`task:${id}:`) || e.eventId.length > 512
+                    || e.taskId !== id || (e.url !== `/fleet/tasks/${id}` && !(e.eventId === `task:${id}:deleted` && e.url === `/fleet/tasks?deletedTask=${id}`)) || typeof e.title !== 'string' || !e.title.trim() || e.title.length > 160
+                    || typeof e.body !== 'string' || !e.body.trim() || e.body.length > 512))
+                    throw new Error('invalid notification events');
+                if (value.notification_events.length)
+                    result.push({ taskId: id, events: value.notification_events });
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    warn('Task notification record unavailable; other task deliveries continue');
+            }
+        }
+    }
+    return result;
+}
+/** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
+export function acknowledgeTaskNotification(id, eventId) {
+    assertCanonicalTaskId(id);
+    withTaskLock(id, () => {
+        for (const path of [taskPath(id), join(retiredNotificationsDir(), `${id}.json`)]) {
+            if (!existsSync(path))
+                continue;
+            const value = JSON.parse(readFileSync(path, 'utf8'));
+            if (!value.notification_events?.some(event => event.eventId === eventId))
+                continue;
+            value.notification_events = value.notification_events.filter(event => event.eventId !== eventId);
+            replaceFileAtomically(path, JSON.stringify(value, null, 2) + '\n');
+            if (path.startsWith(retiredNotificationsDir() + '/') && !value.notification_events.length)
+                unlinkSync(path);
+        }
+    });
+}
 function presentTask(record) {
     const listId = record.list_id ?? DEFAULT_TASK_LIST_ID;
     const list = readTaskLists().find(item => item.list_id === listId);
@@ -812,6 +881,12 @@ export function unlinkDeletedTask(id) {
         }
         if (stored.deletion?.status !== 'pending')
             throw new TaskStateError(`task ${id} has no pending deletion`);
+        // Preserve committed deliveries outside the record before deletion. A crash
+        // before unlink may replay two copies; both carry identical service dedupe IDs.
+        const removed = { eventId: `task:${id}:deleted`, taskId: id,
+            title: `Task deleted: ${stored.title}`.slice(0, 160), body: `Task ${id}: deleting → deleted.`,
+            url: `/fleet/tasks?deletedTask=${id}` };
+        replaceFileAtomically(join(retiredNotificationsDir(), `${id}.json`), JSON.stringify({ notification_events: [...(stored.notification_events ?? []), removed] }) + '\n');
         try {
             unlinkSync(taskPath(id));
         }

package/dist/rooms-tasks/types.d.ts

@@ -106,7 +106,16 @@ export interface TaskLayoutLink {
     /** sha256 of the canonical source layout definition the run must snapshot. */
     definition_hash: string;
 }
+export interface TaskNotificationEvent {
+    eventId: string;
+    title: string;
+    body: string;
+    url: string;
+    taskId: string;
+}
 export interface TaskRecord {
+    /** Pending lifecycle events, committed atomically with their task change. */
+    notification_events?: TaskNotificationEvent[];
     workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */

package/dist/supervisor/manager.js

@@ -2,6 +2,8 @@ import { spawn } from 'node:child_process';
 import { closeSync, existsSync, openSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { producerConfig } from '../notifications/outbox.js';
+import { TaskNotificationProducer } from '../notifications/task-producer.js';
 import { acquireOwnerBinderLease } from '../owner-channel/binder.js';
 import { stateRoot } from '../paths.js';
 import { readRestartLedger, writeRestartLedger, backoffFor, RESTART_FAIL_THRESHOLD } from '../runner.js';
@@ -34,6 +36,7 @@ export async function runFleetManager(entrypoint, deps = {}) {
             closeSync(fd);
         }
     });
+    let notifications;
     async function reconcile(key) {
         await withMemberLock(key, async () => {
             const member = readMember(key);
@@ -155,6 +158,14 @@ export async function runFleetManager(entrypoint, deps = {}) {
         });
     }
     try {
+        try {
+            const config = producerConfig(process.env, undefined, log);
+            if (config)
+                notifications = new TaskNotificationProducer(config, log);
+        }
+        catch {
+            log('[fleet] task notifications unavailable; committed events retained');
+        }
         try {
             const { resumeFleetTransfers } = await import('./adoption.js');
             await resumeFleetTransfers(entrypoint, exec);
@@ -178,6 +189,7 @@ export async function runFleetManager(entrypoint, deps = {}) {
     }
     finally {
         stopping = true;
+        await notifications?.close();
         // Shutdown preserves desired intent; the successor resumes the same catalog.
         const deadline = Date.now() + 17_000;
         while (children.size && Date.now() < deadline) {

package/docs/acp-files.md

@@ -1,22 +1,24 @@
 # Sending files in an ACP chat
 
-An opted-in managed Agent uses the existing Ours `send_file` tool:
+Every managed Agent can attach a file to its current ACP chat with the existing
+Ours `send_file` tool. No Agent setting turns this on and no export directory is
+configured or created:
 
 ```json
-{"path":"deliverables/report.pdf"}
+{"path":"/home/me/project/build/report.pdf"}
 ```
 
 Omitting `contact` sends to the current ACP chat. Supplying a non-empty contact
 keeps ordinary Ours delivery:
 
 ```json
-{"contact":"Alice","path":"deliverables/report.pdf"}
+{"contact":"Alice","path":"build/report.pdf"}
 ```
 
 Only an absent contact chooses the chat. Null, empty or whitespace-only contacts,
-unknown fields and unknown recipients fail without falling back to chat. Outside
-opt-in, contact remains required. Current-chat sending accepts `path`, optional
-`filename` and `mime`; inline base64 and Ours reply fields are unsupported.
+unknown fields and unknown recipients fail without falling back to chat.
+Current-chat sending accepts `path`, optional `filename` and `mime`; inline
+base64 and Ours reply fields are unsupported.
 
 Each call makes one attempt. Failures are returned to the agent. There is no
 request ID, deduplication, automatic retry or recovery of failed sends. If a user
@@ -24,52 +26,84 @@ asks to resend, another tool call makes a new attempt and can produce another
 attachment. UUIDs identify stored attachments; the stored SHA-256 checks integrity.
 Neither is a retry key.
 
-Set this on the Agent definition, not manifest defaults or a Brain:
+## Paths
+
+The Agent passes the path of the file it wants to send. Relative paths resolve
+from the Agent's working directory; `..`, absolute paths, hidden directories and
+symlinked parent directories are all accepted. The file does not have to be
+inside the working directory or any particular subtree. It is opened by the
+Fleet bridge inside the Agent's own OS sandbox, so the Agent can send exactly
+what it can already read.
+
+The file itself must pass ordinary integrity checks, each with its own result:
+
+| Result | Meaning |
+| --- | --- |
+| `CHAT_FILE_NOT_FOUND` | nothing exists at the path |
+| `CHAT_FILE_NOT_READABLE` | the Agent's OS user or sandbox cannot read it |
+| `CHAT_FILE_IS_SYMLINK` | the named file is itself a symlink; pass its target |
+| `CHAT_FILE_HARDLINKED` | the file has more than one hard link |
+| `CHAT_FILE_NOT_REGULAR` | a directory, FIFO, socket or device |
+| `FILE_EXCEEDS_20_MIB` | larger than the 20 MiB limit |
+| `CHAT_FILE_CHANGED` / `SOURCE_SIZE_CHANGED` | modified while it was being read; finish writing first |
+| `CHAT_FILE_REQUIRES_LINUX` | the Agent's bridge is not running on Linux |
+| `PRIVATE_STATE_CANNOT_BE_SENT` | Fleet's own credentials, connector profile or stored attachments |
+
+`PRIVATE_STATE_CANNOT_BE_SENT` covers only Fleet's private Ours runtime
+directory, its attachment store and the connector profile and credential files,
+checked on the provided path before approval and on the opened file's real path
+afterwards. It is not configurable and is not a general path policy.
+
+## Supported sessions
+
+Current-chat delivery needs Linux, the managed Ours connector and a Codex or
+Claude ACP session with a tracked active turn. Those Agents need no special
+`harness_options`, MCP restriction or clean configuration home: inherited and
+additional MCP connectors stay as they are, and Fleet's bound bridge is the
+`ours` connector as it already is for every managed Agent.
+
+Any other backend still sees the optional `contact`, and omitting it returns a
+precise result rather than a missing tool:
 
-```yaml
-file_delivery:
-  enabled: true
-  directory: deliverables
 ```
+CURRENT_CHAT_DELIVERY_UNAVAILABLE: sending a file to this chat requires a Codex or Claude ACP session; this Agent runs <harness>/<session>. Pass contact to send through Ours instead
+```
+
+Idle, scheduled, steered, cancelled and replaced turns return
+`CURRENT_CHAT_DELIVERY_UNAVAILABLE`; a second send while one is in progress
+returns `FILE_DELIVERY_BUSY`.
+
+A file is published only for a call that arrives over the Agent's
+capability-authenticated bridge and binds to the turn that is live in that
+Agent's own session. Connector inventory is not consulted, so unrelated or
+similarly named connectors neither enable nor block delivery.
 
-The tool description advertises this directory and the 20 MiB limit to the Agent.
-The directory is a non-hidden subtree of the Agent's working directory. Both
-routes interpret relative paths from that working directory; absolute paths keep
-their usual meaning. Chat sending additionally enforces the export directory.
-The Agent should finish writing the file before calling `send_file`. Symlinks,
-hardlinks, hidden/credential paths, changed files and files over 20 MiB fail.
-
-Initial support requires Linux, the managed Ours connector, a stock Codex or
-Claude ACP adapter, and a tracked active turn. Idle, scheduled, steered, cancelled,
-replaced and unsupported sessions cannot export. Existing native tool approval
-and the neutral role permission policy both apply before bytes are read. An
-`ask` decision needs an attached controller; `deny` refuses. A native policy that
-refuses MCP execution (including Codex `never` without a native tool allowance)
-can still refuse before Fleet receives the call.
-
-Codex requires native runtime 0.159.0 or newer and Fleet's managed App Server
-proxy. Before each turn, its public exact-thread, paginated MCP inventory must
-show a connected managed `ours` with the expected optional-contact schema.
-Ours aliases, filtered aliases, ambiguous identity, failed discovery and an
-incompatible schema make the turn unavailable. Unrelated identified tools are
-preserved. Explicitly disabled Ours is rejected before replacement. Inherited
-TOML MCP settings, including project/profile sources, are conservatively
-unsupported until their disabling semantics can be qualified before replacement.
-Use a clean Codex configuration home for this initial opt-in.
-
-Claude ACP 0.63.0's installed wrapper has no public same-session inventory RPC. Initial
-support therefore requires an operator's explicit restricted MCP configuration:
+## Permissions
+
+Existing native tool approval and the neutral role permission policy both apply
+before bytes are read. With `approval: allow`, a path inside the role's
+`filesystem` boundary is allowed automatically; a path outside it is put to the
+attached controller like any other out-of-boundary request, and is denied when
+nobody is attached and `unattended: deny`. An `ask` decision needs an attached
+controller; `deny` refuses with `CURRENT_CHAT_DELIVERY_UNAVAILABLE`, and a
+declined request returns `FILE_SEND_DENIED`. A native policy that refuses MCP
+execution (including Codex `never` without a native tool allowance) can still
+refuse before Fleet receives the call.
+
+## Retired configuration
+
+`file_delivery` is retired. An existing block still loads so manifests need no
+edit, and has no effect:
 
 ```yaml
-harness_options:
-  mcp_servers_only: true
-  mcp_servers:
-    ours: { command: ours-mcp, args: [proxy] }
+file_delivery:
+  enabled: false        # ignored: delivery stays available
+  directory: deliverables   # ignored: not created, not enforced
 ```
 
-Fleet replaces that connector with its bound bridge. Additional explicit MCP
-servers and custom ACP commands are unsupported for this feature. Default-off
-Agents retain their existing configuration.
+Remove it at your convenience. Unknown keys inside it are still rejected.
+
+## Storage and download
 
 Successful sends copy complete bytes into private immutable storage and append a
 server-origin `file.attached` event containing the actual session generation,
@@ -90,13 +124,23 @@ saving after a workspace change.
 
 This source requires the companion MCP implementation's
 `MANAGED_FILE_DELIVERY_VERSION = 1`. Fleet pins published
-`@ours.network/mcp@1.2.0-nightly.13`, which includes it. Older MCP packages without
-this capability fail closed when file delivery is enabled. Changes to the MCP
-pin require clean installed-package qualification without a built MCP overlay.
-
-The deterministic native fixture uses real ACP adapters, the real managed
-connector and an isolated daemon. A local scripted provider supplies only tool
-intents; approval, read, copy, publication and bytes come from the implementation.
-It does not qualify external-model inference, deployment or arbitrary native
-MCP request-to-ACP tool-call ID mapping. Correlation is the authenticated bridge
-and the actual active Fleet turn, which is revoked by cancellation/steering.
+`@ours.network/mcp@1.2.0-nightly.13`, which includes it and already treats the
+export-directory hint as optional, so default delivery needs no MCP change. An
+installed MCP package without the capability fails Agent startup with
+`INCOMPATIBLE_MANAGED_FILE_DELIVERY` instead of quietly requiring a contact.
+Changes to the MCP pin require clean installed-package qualification without a
+built MCP overlay.
+
+The deterministic native fixture (`test/file-delivery-native.integration.mjs`)
+uses real ACP adapters, the real managed connector and an isolated daemon. Its
+Agent has no `file_delivery` block and no MCP restriction, and it sends a file
+from a hidden directory outside the working directory. It then downloads the
+generated attachment over the authenticated HTTP route and compares bytes and
+SHA-256, after checking that an anonymous and a forged-cookie request are
+refused. `FLEET_FILE_NATIVE_VARIANT=connectors` adds unrelated MCP connectors
+and requires them to stay usable. A local scripted provider supplies only tool
+intents; approval, read, copy, publication and bytes come from the
+implementation. It does not qualify external-model inference, deployment or
+arbitrary native MCP request-to-ACP tool-call ID mapping. Correlation is the
+authenticated bridge and the actual active Fleet turn, which is revoked by
+cancellation/steering.

package/docs/task-workspaces.md

@@ -185,3 +185,41 @@ before erasing task/room/workspace resources. Permanent siblings remain intact.
 Standalone CLI/web removal refuses `TASK_MEMBER_IS_TASK_OWNED`; use the owning
 task lifecycle. Lost/corrupt task or launch records require restoring original
 backup evidence or explicit ownership reconciliation before deletion can finish.
+
+## Owner lifecycle notifications
+
+A task mutation commits its notification event in the same atomic task record as
+its effective status. Creation, backlog, provisioning, active, review, done,
+cancelled and failed are covered; block/unblock and deletion are effective changes
+as well. Editing a description, list, block reason or saga checkpoint is not a
+status transition. Each event freezes the task identity, title, old/new status and
+navigation route at commit time, so several transitions between delivery polls
+remain separate. Legacy records begin emitting on their next actual change and
+are not retroactively announced as newly created.
+
+The Fleet manager drains committed task events without requiring the web console
+or restarting agents. Its notification producer uses the installation's existing
+owner-scoped credential; it grants no agent arbitrary-send capability. Missing
+configuration or service failure retains the events. Delivery acknowledgement
+runs under the task lock and removes only the accepted event, preserving newer
+changes. A corrupt/unreadable task record is isolated with a safe warning, so
+other tasks continue. Bounded rotating batches prevent one rejected task from
+blocking the entire sender. The built-in `default` task list is unchanged.
+
+Deleting is announced only after its intent commits. Before unlink, settlement
+prepares retained pending events plus a stable deleted event outside the task-owned
+workspace. The sender admits that retained copy only when the original task record
+is absent; an interrupted or failed unlink cannot announce deletion. The final
+event opens the task list and includes the removed task's identity. Earlier events
+keep their immutable detail routes, which may be absent after explicit deletion.
+
+A service restart or producer crash after acceptance may replay an event; the
+Notifications service must retain its acceptance receipts across read/delete to
+make that replay harmless. Upgrade Notifications alongside Fleet to obtain this
+stronger guarantee. The service's authenticated delivery diagnostics distinguish
+provider acceptance, retry, expired subscription and foreground suppression.
+Provider acceptance is not evidence of actual phone receipt. iPhone Web Push
+requires a supported Home Screen installation and granted device/browser permission;
+reopen the workspace to reconcile an expired subscription and explicitly re-enable
+permission if it was revoked. Every received push must display a notification to
+honor Safari's user-visible push requirement.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.56",
+  "version": "1.2.0-nightly.58",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/dist/harness/codex-file-inventory.d.ts

@@ -1,15 +0,0 @@
-export declare class CodexFileInventory {
-    private readonly sendToCodex;
-    private readonly emitToClient;
-    private checks;
-    private sequence;
-    constructor(sendToCodex: (line: string) => void, emitToClient: (line: string) => void);
-    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
-    observeClientLine(line: string): boolean;
-    observeServerLine(line: string): boolean;
-    close(): void;
-    private query;
-    private qualified;
-    private finish;
-    private reject;
-}