@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.60

package/dist/rooms-tasks/task-state.js

@@ -1,8 +1,9 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
 import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
@@ -88,8 +89,77 @@ function writeTask(record) {
     mkdirSync(tasksDir(), { recursive: true });
     const persisted = { ...record };
     delete persisted.list_name;
+    const path = taskPath(record.task_id);
+    const previous = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : undefined;
+    const status = (task) => task.deletion?.status === 'pending' ? 'deleting' : task.blocked ? `${task.state} (blocked)` : task.state;
+    // Read pending events under the same task lock as every mutation. Metadata edits
+    // and retries preserve the queue; acknowledgement cannot be resurrected by stale input.
+    const pending = [...(previous?.notification_events ?? [])];
+    if (!previous || status(previous) !== status(record)) {
+        const next = status(record), before = previous ? status(previous) : undefined;
+        pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
+            title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
+            body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
+            url: `/fleet/tasks/${record.task_id}` });
+    }
+    if (pending.length)
+        persisted.notification_events = pending;
+    else
+        delete persisted.notification_events;
     replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
 }
+const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
+/** Atomic snapshots contain the events, including intermediate states between polls. */
+export function pendingTaskNotifications(warn = () => { }) {
+    const result = [];
+    for (const dir of [tasksDir(), retiredNotificationsDir()]) {
+        if (!existsSync(dir))
+            continue;
+        for (const file of readdirSync(dir).filter(file => TASK_ID_PATTERN.test(file.slice(0, -5)) && file.endsWith('.json'))) {
+            try {
+                const path = join(dir, file), stat = lstatSync(path);
+                if (!stat.isFile() || stat.isSymbolicLink())
+                    throw new Error('invalid notification source');
+                const value = JSON.parse(readFileSync(path, 'utf8'));
+                const id = file.slice(0, -5);
+                // A prepared deletion copy has no authority while the original still exists.
+                if (dir === retiredNotificationsDir() && existsSync(taskPath(id)))
+                    continue;
+                if (value.notification_events === undefined)
+                    continue;
+                if (!Array.isArray(value.notification_events) || value.notification_events.some(e => !e
+                    || typeof e.eventId !== 'string' || !e.eventId.startsWith(`task:${id}:`) || e.eventId.length > 512
+                    || e.taskId !== id || (e.url !== `/fleet/tasks/${id}` && !(e.eventId === `task:${id}:deleted` && e.url === `/fleet/tasks?deletedTask=${id}`)) || typeof e.title !== 'string' || !e.title.trim() || e.title.length > 160
+                    || typeof e.body !== 'string' || !e.body.trim() || e.body.length > 512))
+                    throw new Error('invalid notification events');
+                if (value.notification_events.length)
+                    result.push({ taskId: id, events: value.notification_events });
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    warn('Task notification record unavailable; other task deliveries continue');
+            }
+        }
+    }
+    return result;
+}
+/** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
+export function acknowledgeTaskNotification(id, eventId) {
+    assertCanonicalTaskId(id);
+    withTaskLock(id, () => {
+        for (const path of [taskPath(id), join(retiredNotificationsDir(), `${id}.json`)]) {
+            if (!existsSync(path))
+                continue;
+            const value = JSON.parse(readFileSync(path, 'utf8'));
+            if (!value.notification_events?.some(event => event.eventId === eventId))
+                continue;
+            value.notification_events = value.notification_events.filter(event => event.eventId !== eventId);
+            replaceFileAtomically(path, JSON.stringify(value, null, 2) + '\n');
+            if (path.startsWith(retiredNotificationsDir() + '/') && !value.notification_events.length)
+                unlinkSync(path);
+        }
+    });
+}
 function presentTask(record) {
     const listId = record.list_id ?? DEFAULT_TASK_LIST_ID;
     const list = readTaskLists().find(item => item.list_id === listId);
@@ -125,21 +195,32 @@ export function assertNoPendingDeletion(task) {
         throw new TaskStateError(`task ${task.task_id} is pending deletion; run 'ours-fleet task delete ${task.task_id} ${task.task_id}' to retry cleanup`);
     }
 }
+function creationPlan(plan, layout) {
+    return JSON.stringify([plan?.plan_hash ?? null, storedRoomLaunchPolicy(plan?.room_policy) ?? null,
+        layout ? `${layout.name}@${layout.definition_hash}` : null]);
+}
 export function createTask(input) {
     const key = input.idempotency_key ?? randomUUID();
-    const existing = findByIdempotencyKey(key);
+    const existing = listTasks({ includeDeleting: true }).find(task => task.idempotency_key === key);
+    const requestedPlan = creationPlan(input.execution_plan, input.layout);
     if (existing) {
-        const existingPlan = existing.execution_plan?.plan_hash;
-        const requestedPlan = input.execution_plan?.plan_hash;
-        const existingPolicy = storedRoomLaunchPolicy(existing.execution_plan?.room_policy);
-        const requestedPolicy = storedRoomLaunchPolicy(input.execution_plan?.room_policy);
-        if (existingPlan !== requestedPlan || JSON.stringify(existingPolicy) !== JSON.stringify(requestedPolicy))
+        // After a Backlog plan edit the current plan differs from the one created; retries compare the original request.
+        if ((existing.creation_plan ?? creationPlan(existing.execution_plan, existing.layout)) !== requestedPlan)
             throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
-        return existing;
+        return withTaskLock(existing.task_id, () => {
+            const fresh = readTask(existing.task_id);
+            assertNoPendingDeletion(fresh);
+            if (fresh.workspace)
+                ensureWorkspace(fresh.workspace);
+            return fresh;
+        });
     }
+    if (input.layout && (input.execution_plan || input.no_room || input.room_id))
+        throw new TaskStateError('a layout task cannot also use a room template, no-room mode or a room');
     const state = input.start === false ? 'backlog' : 'provisioning';
+    const taskId = generateTaskId();
     const record = {
-        task_id: generateTaskId(),
+        task_id: taskId,
         list_id: input.listId ?? DEFAULT_TASK_LIST_ID,
         title: input.title,
         brief: input.brief,
@@ -148,14 +229,18 @@ export function createTask(input) {
         template: input.template,
         execution_plan: input.execution_plan,
         no_room: input.no_room || undefined,
+        ...(input.layout ? { layout: { name: input.layout.name, run_id: `task-${taskId}`, definition_hash: input.layout.definition_hash } } : {}),
         room_id: input.room_id,
         member_roles: [],
         origin: input.origin,
         idempotency_key: key,
+        creation_plan: requestedPlan,
         created_at: new Date().toISOString(),
         started_at: state === 'provisioning' ? new Date().toISOString() : undefined,
     };
+    record.workspace = planWorkspace('task', record.task_id);
     writeTask(record);
+    ensureWorkspace(record.workspace);
     return readTask(record.task_id);
 }
 export function getTask(id) { return withTaskLock(id, () => readTask(id)); }
@@ -505,7 +590,8 @@ function writeDeletionReceiptForIntent(stored) {
         actor: deletion.actor,
         original_state: stored.state,
         room_id: deletion.room_id,
-        member_count: deletion.members.length,
+        member_count: deletion.members.length + (deletion.archived_absences?.length ?? 0),
+        ...(deletion.archived_absences?.length ? { archived_absences: deletion.archived_absences } : {}),
     };
     replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
 }
@@ -525,14 +611,10 @@ export function ensureTaskDeletionReceipt(id) {
             writeDeletionReceiptForIntent(stored);
     });
 }
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export function completeTaskDeletionReceipt(id) {
-    const receipt = readTaskDeletionReceipt(id);
-    if (!receipt || receipt.settled_at)
-        return;
-    receipt.settled_at = new Date().toISOString();
-    receipt.result = 'deleted';
-    replaceFileAtomically(deletionReceiptPath(id), JSON.stringify(receipt, null, 2) + '\n');
+    assertCanonicalTaskId(id);
+    rmSync(deletionReceiptPath(id), { force: true });
 }
 /**
  * Persist the first-wins durable deletion intent. Accepts every lifecycle
@@ -551,8 +633,10 @@ export function beginTaskDeletionIntent(id, actor) {
             stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
         }
         catch (error) {
-            if (isNotFoundError(error))
+            if (isNotFoundError(error)) {
+                completeTaskDeletionReceipt(id);
                 return { status: 'already_absent' };
+            }
             throw error;
         }
         if (stored.deletion?.status === 'pending') {
@@ -649,6 +733,8 @@ function findCursorForSeat(id, stored, seat) {
     if (cursor && seat.identity_cid
         && cursor.identity_cid.toLowerCase() !== seat.identity_cid.toLowerCase())
         throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' identity CID mismatch between cursor and room seat`);
+    if (cursor?.action_id && seat.launch?.action_id && cursor.action_id !== seat.launch.action_id)
+        throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' creation ownership proof changed`);
     return cursor;
 }
 /**
@@ -669,11 +755,20 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
         for (const seat of seats) {
             if (!seat.identity_cid)
                 continue;
-            if (!findCursorForSeat(id, stored, seat)) {
+            const cursor = findCursorForSeat(id, stored, seat);
+            if (!cursor) {
                 stored.deletion.members.push({
                     name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now,
+                    ...(seat.launch?.action_id ? { action_id: seat.launch.action_id } : {}),
+                    ...(seat.launch?.task_supervised ? { task_supervised: true } : {}),
                 });
             }
+            else {
+                if (seat.launch?.action_id)
+                    cursor.action_id ??= seat.launch.action_id;
+                if (seat.launch?.task_supervised)
+                    cursor.task_supervised = true;
+            }
         }
         writeTask(stored);
         return presentTaskLenient(stored);
@@ -688,10 +783,10 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export function importTaskDeletionRetirementEvidence(id, seats) {
+export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
         const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
@@ -702,12 +797,29 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             const evidence = seat.retirement;
             if (evidence?.phase !== 'identity_absent')
                 throw new TaskStateError(`task ${id} deletion cannot checkpoint member '${seat.role_name}' before completed retirement`);
-            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED;
+            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED
+                || evidence.launch_id === DELETION_MEMBER_ABSENT_VERIFIED || evidence.absence_verified === true;
             if (!neverLaunched && evidence.archive_path === undefined)
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' retirement evidence lacks its archive`);
             if (!seat.identity_cid) {
-                if (neverLaunched)
-                    continue; // provably never held a managed identity
+                if (neverLaunched) {
+                    stored.deletion.absent_members ??= [];
+                    if (!stored.deletion.absent_members.includes(seat.role_name))
+                        stored.deletion.absent_members.push(seat.role_name);
+                    continue;
+                }
+                const proof = proofs.find(value => value.name === seat.role_name);
+                if (proof && proof.launch_id === evidence.launch_id && proof.archive_path === evidence.archive_path
+                    && proof.launch_id === seat.launch?.launch_id && proof.action_id === seat.launch?.action_id) {
+                    const existing = stored.deletion.archived_absences?.find(value => value.name === proof.name);
+                    if (existing && (existing.launch_id !== proof.launch_id || existing.action_id !== proof.action_id
+                        || existing.archive_path !== proof.archive_path))
+                        throw new TaskStateError('Archived absence checkpoint ownership is immutable');
+                    stored.deletion.archived_absences ??= [];
+                    if (!existing)
+                        stored.deletion.archived_absences.push({ ...proof });
+                    continue;
+                }
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
             }
             let cursor = findCursorForSeat(id, stored, seat);
@@ -715,6 +827,10 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
                 cursor = { name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now };
                 stored.deletion.members.push(cursor);
             }
+            if (seat.launch?.action_id)
+                cursor.action_id ??= seat.launch.action_id;
+            if (seat.launch?.task_supervised)
+                cursor.task_supervised = true;
             if (DELETION_MEMBER_PHASE_ORDER[evidence.phase] < DELETION_MEMBER_PHASE_ORDER[cursor.phase])
                 continue;
             if (cursor.launch_id !== undefined && cursor.launch_id !== evidence.launch_id)
@@ -729,9 +845,23 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             cursor.updated_at = now;
         }
         writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
         return presentTaskLenient(stored);
     });
 }
+/** Settlement-only checkpoint, under the task-operation lock after fresh archive verification.
+ * From here retries still verify live absence, but owned archives may be consumed.
+ */
+export function beginTaskWorkspaceCleanup(id) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending'
+            || stored.deletion.members.some(member => member.phase !== 'identity_absent'))
+            throw new TaskStateError('Task is not ready for workspace cleanup');
+        stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
+        writeTask(stored);
+    });
+}
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing
@@ -751,6 +881,12 @@ export function unlinkDeletedTask(id) {
         }
         if (stored.deletion?.status !== 'pending')
             throw new TaskStateError(`task ${id} has no pending deletion`);
+        // Preserve committed deliveries outside the record before deletion. A crash
+        // before unlink may replay two copies; both carry identical service dedupe IDs.
+        const removed = { eventId: `task:${id}:deleted`, taskId: id,
+            title: `Task deleted: ${stored.title}`.slice(0, 160), body: `Task ${id}: deleting → deleted.`,
+            url: `/fleet/tasks?deletedTask=${id}` };
+        replaceFileAtomically(join(retiredNotificationsDir(), `${id}.json`), JSON.stringify({ notification_events: [...(stored.notification_events ?? []), removed] }) + '\n');
         try {
             unlinkSync(taskPath(id));
         }
@@ -762,3 +898,87 @@ export function unlinkDeletedTask(id) {
         return true;
     });
 }
+/** Called only after current temp and exact identity absence have been checked. */
+export function settleAbsentTaskDeletionMember(id, name) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError('Task is not deleting');
+        const member = stored.deletion.members.find(value => value.name === name);
+        if (!member)
+            throw new TaskStateError('Unknown deletion member');
+        member.phase = 'identity_absent';
+        member.launch_id ??= DELETION_MEMBER_ABSENT_VERIFIED;
+        member.updated_at = new Date().toISOString();
+        writeTask(stored);
+    });
+}
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export function detachDeletedRoom(taskId, roomId) {
+    withTaskLock(taskId, () => {
+        if (!existsSync(taskPath(taskId)))
+            return;
+        const stored = JSON.parse(readFileSync(taskPath(taskId), 'utf8'));
+        if (stored.room_id !== roomId || stored.deletion?.status === 'pending')
+            return;
+        delete stored.room_id;
+        delete stored.room_identity_cid;
+        stored.member_roles = [];
+        writeTask(stored);
+    });
+}
+/** A completed room may consume its archives while other task members still retire. */
+export function beginTaskArchiveCleanup(id) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError('Task is not deleting');
+        stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
+        writeTask(stored);
+    });
+}
+/** Metadata-only edit; compare under the task lock to prevent lost updates. */
+/**
+ * Choose, change or clear a Backlog task's Room Layout before it starts.
+ * `expected` is the layout name the caller saw (null = none); a different
+ * current choice is a stale edit. Choosing a layout drops the sealed room
+ * template plan; the caller releases the returned launch snapshot hash.
+ */
+export function updateTaskLayout(id, expected, next) {
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        assertNoPendingTerminalIntent(task);
+        if (task.state !== 'backlog' || task.room_id)
+            throw new TaskStateError(`task ${id} has started; its room layout is fixed (state '${task.state}')`);
+        const current = task.layout?.name ?? null;
+        // A replay of the same choice is idempotent (and refreshes the pinned source hash).
+        if (current !== expected && current !== (next?.name ?? null))
+            throw new TaskStateError(`task ${id} room layout changed to '${current ?? 'one room'}'; reload before changing it`);
+        const releasedSnapshot = next ? task.execution_plan?.snapshot.launch_snapshot_hash : undefined;
+        if (next) {
+            task.layout = { name: next.name, run_id: `task-${task.task_id}`, definition_hash: next.definition_hash };
+            delete task.execution_plan;
+            delete task.template;
+            delete task.no_room;
+        }
+        else
+            delete task.layout;
+        task.room_plan_changed_at = new Date().toISOString();
+        writeTask(task);
+        return { task: readTask(id), ...(releasedSnapshot ? { releasedSnapshot } : {}) };
+    });
+}
+export function updateTaskBrief(id, brief, expectedBrief) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        assertNoPendingTerminalIntent(task);
+        if ((task.brief ?? '') !== expectedBrief && task.brief !== brief)
+            throw new TaskStateError('Description changed elsewhere. Reload the task before saving.');
+        task.brief = brief;
+        writeTask(task);
+        return task;
+    });
+}

package/dist/rooms-tasks/types.d.ts

@@ -62,6 +62,8 @@ export type TaskDeletionMemberPhase = 'pending' | 'stop_requested' | 'liveness_a
 export interface TaskDeletionMemberCursor {
     name: string;
     identity_cid: string;
+    action_id?: string;
+    task_supervised?: boolean;
     phase: TaskDeletionMemberPhase;
     launch_id?: string;
     archive_path?: string;
@@ -73,6 +75,13 @@ export interface TaskDeletionMemberCursor {
  * evidence. While pending, the task is hidden from normal operation and every
  * lifecycle mutation or room publication is rejected.
  */
+export interface ArchivedMemberAbsence {
+    name: string;
+    launch_id: string;
+    action_id: string;
+    archive_path: string;
+    checked_at: string;
+}
 export interface TaskDeletionIntent {
     status: 'pending';
     accepted_at: string;
@@ -80,13 +89,34 @@ export interface TaskDeletionIntent {
     room_id?: string;
     /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
     members: TaskDeletionMemberCursor[];
+    archived_absences?: ArchivedMemberAbsence[];
+    absent_members?: string[];
+    /** Archive proofs were verified before owned workspace cleanup may consume them. */
+    workspace_cleanup_started_at?: string;
     error?: string;
     error_at?: string;
     recovery_hint?: string;
     first_failure?: string;
     first_recovery_hint?: string;
 }
+export interface TaskLayoutLink {
+    name: string;
+    /** Deterministic `task-<task_id>` Room Layout run ID. */
+    run_id: string;
+    /** sha256 of the canonical source layout definition the run must snapshot. */
+    definition_hash: string;
+}
+export interface TaskNotificationEvent {
+    eventId: string;
+    title: string;
+    body: string;
+    url: string;
+    taskId: string;
+}
 export interface TaskRecord {
+    /** Pending lifecycle events, committed atomically with their task change. */
+    notification_events?: TaskNotificationEvent[];
+    workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
     list_id: string;
@@ -107,6 +137,12 @@ export interface TaskRecord {
         plan_hash: string;
     };
     no_room?: boolean;
+    /** Multi-room task: rooms and participants come from a Room Layout run. */
+    layout?: TaskLayoutLink;
+    /** Set when the room plan (layout or one-room template) was changed after creation, before start. */
+    room_plan_changed_at?: string;
+    /** Fingerprint of the room plan requested at creation; idempotent retries compare against it after later plan edits. */
+    creation_plan?: string;
     room_id?: string;
     room_identity_cid?: string;
     member_roles: TaskMemberRole[];
@@ -145,6 +181,7 @@ export interface RoomRoleBriefingDefinition {
     last_error?: string;
 }
 export interface RoomMemberLaunchState {
+    task_supervised?: boolean;
     state: 'pending' | 'intent' | 'launched' | 'stopped' | 'failed';
     attempt: number;
     action_id?: string;
@@ -201,6 +238,7 @@ export type RoomHistoryEvidence = {
 };
 export type MemberRetirementPhase = 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
 export interface MemberRetirement {
+    absence_verified?: boolean;
     phase: MemberRetirementPhase;
     launch_id: string;
     updated_at: string;
@@ -227,12 +265,14 @@ export interface RoomMemberSeat {
     retirement?: MemberRetirement;
 }
 export interface RoomOrchestrationRecord {
+    workspace?: import('./workspace.js').OwnedWorkspace;
     room_id: string;
     room_identity_cid?: string;
     room_name: string;
     goal?: string;
     task_id?: string;
     template_snapshot?: TemplateSnapshot;
+    additional_member_templates?: TemplateSnapshot[];
     /** Resolved once at launch; legacy absence means non-anonymous. */
     room_policy?: RoomLaunchPolicy;
     saga: SagaCursor;

package/dist/rooms-tasks/workspace-artifacts.d.ts

@@ -0,0 +1,6 @@
+import { type OwnedWorkspace } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export declare function collectWorkspaceArchives(workspace: OwnedWorkspace): void;

package/dist/rooms-tasks/workspace-artifacts.js

@@ -0,0 +1,93 @@
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { parse } from 'yaml';
+import { stateRoot } from '../paths.js';
+import { assertSafeAncestors, auditWorkspaceGit, validateWorkspace, ensureWorkspace, WorkspaceError } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export function collectWorkspaceArchives(workspace) {
+    validateWorkspace(workspace);
+    const root = join(stateRoot(), 'recovery', 'temporary');
+    assertSafeAncestors(root);
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return;
+        throw e;
+    }
+    const owned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const path = join(root, entry.name);
+        const roleFile = join(path, 'role.yaml');
+        let role;
+        try {
+            const s = lstatSync(roleFile);
+            if (!s.isFile() || s.isSymbolicLink())
+                continue;
+            role = parse(readFileSync(roleFile, 'utf8'));
+        }
+        catch {
+            continue;
+        } // no ownership proof: never adopt a foreign archive
+        const recorded = role?.roomMemberStartup?.workspace;
+        if (recorded?.owner !== workspace.owner || recorded.id !== workspace.id)
+            continue;
+        if (JSON.stringify(recorded) !== JSON.stringify(workspace))
+            throw new WorkspaceError('workspace archive ownership mismatch');
+        assertSafeAncestors(path);
+        const termination = join(path, 'termination.jsonl');
+        if (!lstatSync(termination).isFile() || lstatSync(termination).isSymbolicLink())
+            throw new WorkspaceError('unsafe workspace archive termination evidence');
+        const supervisorPath = join(path, '.temp-supervisor.json');
+        let supervisor;
+        try {
+            if (!lstatSync(supervisorPath).isFile() || lstatSync(supervisorPath).isSymbolicLink())
+                throw new WorkspaceError('unsafe workspace archive supervisor evidence');
+            supervisor = JSON.parse(readFileSync(supervisorPath, 'utf8'));
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (supervisor && (supervisor.role !== role.name || !supervisor.launchId))
+            throw new WorkspaceError('workspace archive launch ownership mismatch');
+        const terminated = readFileSync(termination, 'utf8').trim().split('\n').some(line => {
+            const value = JSON.parse(line);
+            return value.version === 1 && value.role === role.name
+                && value.launchId === supervisor?.launchId
+                && ['retired', 'reclaimed', 'failed'].includes(value.outcome);
+        });
+        if (!terminated || entry.name.endsWith('.retiring'))
+            throw new WorkspaceError('workspace archive retirement is incomplete');
+        auditWorkspaceGit(path, { forDeletion: true });
+        owned.push(path);
+    }
+    // Preflight the entire set before mutation; task/room record remains until all succeed.
+    if (!owned.length)
+        return;
+    ensureWorkspace(workspace);
+    const destination = join(workspace.path, '.fleet-retired-agents');
+    assertSafeAncestors(destination);
+    mkdirSync(destination, { recursive: true, mode: 0o700 });
+    for (const path of owned) {
+        const target = join(destination, basename(path));
+        try {
+            lstatSync(target);
+            throw new WorkspaceError('archive collection destination exists');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        // Atomic transfer before workspace deletion: a crash never loses ownership
+        // evidence halfway through recursively removing a global recovery archive.
+        renameSync(path, target);
+    }
+}

package/dist/rooms-tasks/workspace.d.ts

@@ -0,0 +1,35 @@
+/** Persisted before allocation. Never infer ownership from an Agent's cwd. */
+export interface OwnedWorkspace {
+    version: 1;
+    owner: 'task' | 'room';
+    id: string;
+    path: string;
+    token: string;
+}
+export declare class WorkspaceError extends Error {
+}
+export declare function assertSafeAncestors(path: string): void;
+export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
+export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Read-only recovery proof; never allocate a replacement for a missing workspace. */
+export declare function assertWorkspacePresent(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
+/** Caller must first prove the exact workspace marker or retired archive
+ * provenance, and hold its lifecycle lock with all managed writers retired.
+ * Directories need owner rwx for recursive removal; ordinary files do not.
+ */
+export declare function prepareOwnedDeletionTree(path: string): void;
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export declare function ensureWorkspace(w: OwnedWorkspace): string;
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export declare function auditWorkspaceGit(path: string, options?: {
+    forDeletion?: boolean;
+}): void;
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export declare function assertWorkspaceDeletable(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
+export declare function deleteWorkspace(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;