@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.8

package/README.md

@@ -1710,3 +1710,43 @@ Explicit Cowork socket, config or state-directory overrides continue to select
 local Unix management. Profiles without `serverUrl` retain legacy behavior. The
 HTTP API grants operator room authority; use the installer's supported private
 or authenticated external gateway entry, and keep its backend ports private.
+
+### Agent ours tools through the supervisor
+
+Operators can invoke the running agent's ordinary ours MCP tools without sending
+an LLM prompt or binding another session to its identity:
+
+```sh
+ours-fleet ours tools Critic1
+ours-fleet ours call Critic1 current_identity
+ours-fleet ours call Critic1 list_contacts
+ours-fleet ours call Critic1 generate_invite --args-file /private/invite-options.json
+ours-fleet ours call Critic1 add_contact --args-file /private/contact.json
+```
+
+`tools` returns the managed MCP tool names and argument schemas, plus the selected
+agent's identity name, CID, and supervisor generation. `call` returns the same
+identity metadata and the MCP result. The private JSON file contains the tool's
+arguments (for example `{"invite":"…"}` for `add_contact`); omitted arguments mean
+`{}`. Protect files containing invites and protect command output containing a
+new invite. Tool errors set a nonzero CLI exit status.
+
+The authenticated REST equivalents are `GET /api/v1/roles/:id/ours/tools` and
+`POST /api/v1/roles/:id/ours/call`, with the normal Fleet session and CSRF token.
+The POST body is `{"tool":"list_contacts","arguments":{}}`. MCP tool errors
+remain in `result.isError`; transport failures use the normal Fleet error envelope.
+Request arguments and results are excluded from the Fleet audit log.
+
+Both interfaces use the supervisor's existing fixed-identity MCP server and tool
+policy. Identity creation, removal, switching, and binding are not exposed. The
+supervisor must be running. Older descriptors are supported only when a unique
+existing runtime journal, instance record, and identity pin prove the selected
+agent and generation, and the same MCP connection confirms its identity and
+lifetime before the operation. This reads existing state without rewriting the
+descriptor or restarting the agent. Missing, ambiguous, stale, or mismatched
+proofs fail closed. Unknown identity descriptions also fail closed. Closing an operator call
+retains the supervisor's identity. An interrupted mutation can have an unknown
+outcome: inspect state before retrying, because there is no automatic retry or
+exactly-once guarantee. Contact acceptance alone does not prove peer verification
+or message delivery. File tools resolve paths in the invoking CLI process or
+Fleet web server's filesystem context, with that process's access permissions.

package/dist/agent-ours/bridge.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createHash } from 'node:crypto';
 import { connect } from 'node:net';
 import { access, mkdir, open, readFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
@@ -12,6 +13,14 @@ export async function runBridge(descriptorPath) {
         typeof descriptor.capability !== 'string' ||
         !Number.isInteger(descriptor.generation))
         throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    if (process.env.FLEET_OURS_BRIDGE_EXPECTED) {
+        const expected = JSON.parse(process.env.FLEET_OURS_BRIDGE_EXPECTED);
+        const digest = createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex');
+        if (expected.transportDigest !== digest)
+            throw Error('SUPERVISOR_TRANSPORT_CHANGED');
+        if (['role', 'identity', 'cid', 'generation'].some(key => descriptor[key] !== expected[key]))
+            throw Error('SUPERVISOR_SELECTION_CHANGED');
+    }
     const wire = new Wire(connect(descriptor.socket));
     const handles = new Map();
     const cleanup = async () => {

package/dist/agent-ours/service.js

@@ -219,7 +219,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
-        atomicPrivateWrite(descriptor, { socket, capability, generation });
+        atomicPrivateWrite(descriptor, { socket, capability, generation, role: role.name, identity: role.identity, cid: runtime.snapshot.cid });
         return {
             runtime,
             descriptor,

package/dist/application/legacy-supervisor-identity.d.ts

@@ -0,0 +1,7 @@
+/** Read-only compatibility proof for supervisors predating descriptor identity metadata. */
+export declare function legacySupervisorIdentity(role: string, name: string, temporary: boolean, generation: number): {
+    name: string;
+    cid: string;
+    generation: number;
+    proof: string;
+};

package/dist/application/legacy-supervisor-identity.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { binderKey } from '../agent-ours/state.js';
+import { FleetError } from './errors.js';
+/** Read-only compatibility proof for supervisors predating descriptor identity metadata. */
+export function legacySupervisorIdentity(role, name, temporary, generation) {
+    const root = join(stateRoot(), 'private-ours');
+    try {
+        const matches = [];
+        for (const entry of readdirSync(root, { withFileTypes: true })) {
+            if (!entry.isDirectory() || !/^[a-f0-9]{64}$/.test(entry.name))
+                continue;
+            const dir = join(root, entry.name);
+            const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+            if (instance.role !== role)
+                continue;
+            const state = JSON.parse(readFileSync(join(dir, 'state.json'), 'utf8'));
+            const pin = JSON.parse(readFileSync(join(dir, 'identity-pin.json'), 'utf8'));
+            if (!Number.isSafeInteger(generation) || generation < 1
+                || typeof state.action !== 'string' || !state.action
+                || instance.temporary !== temporary || typeof instance.instance !== 'string' || !instance.instance
+                || state.version !== 1 || state.instance !== instance.instance
+                || state.name !== name || state.lifetime !== (temporary ? 'temporary' : 'permanent')
+                || state.generation !== generation || !['READY', 'SERVING'].includes(state.phase)
+                || typeof state.daemon !== 'string' || !state.daemon || binderKey(state.daemon, name) !== entry.name
+                || !/^[a-f0-9]{64}$/i.test(state.cid ?? '')
+                || pin.daemon !== state.daemon || pin.name !== name || pin.cid !== state.cid)
+                throw new Error('mismatched legacy ownership proof');
+            matches.push({ name, cid: state.cid, generation, proof: createHash('sha256').update(JSON.stringify([
+                    instance.instance, state.action, state.daemon, name, state.cid, state.lifetime, generation,
+                ])).digest('hex') });
+        }
+        if (matches.length !== 1)
+            throw new Error('missing or ambiguous legacy ownership proof');
+        return matches[0];
+    }
+    catch {
+        // The private directory also contains ownership material: never echo parse errors.
+        throw new FleetError('capability_unavailable', 'legacy supervisor ownership proof is missing, ambiguous, or mismatched');
+    }
+}

package/dist/application/supervisor-ours-tools.d.ts

@@ -0,0 +1,159 @@
+export interface SupervisorToolRequest {
+    tool: string;
+    arguments?: Record<string, unknown>;
+}
+/** CLI and REST use the same fixed-identity MCP server as the agent harness. */
+export declare class SupervisorOursTools {
+    private withClient;
+    list(role: string): Promise<{
+        tools: {
+            inputSchema: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: Record<string, object> | undefined;
+                required?: string[] | undefined;
+            };
+            name: string;
+            description?: string | undefined;
+            outputSchema?: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: Record<string, object> | undefined;
+                required?: string[] | undefined;
+            } | undefined;
+            annotations?: {
+                title?: string | undefined;
+                readOnlyHint?: boolean | undefined;
+                destructiveHint?: boolean | undefined;
+                idempotentHint?: boolean | undefined;
+                openWorldHint?: boolean | undefined;
+            } | undefined;
+            execution?: {
+                taskSupport?: "optional" | "required" | "forbidden" | undefined;
+            } | undefined;
+            _meta?: Record<string, unknown> | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        }[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        nextCursor?: string | undefined;
+        agent: string;
+        identity: {
+            name: string;
+            cid: string;
+            generation: number;
+        };
+    }>;
+    call(role: string, request: SupervisorToolRequest): Promise<{
+        agent: string;
+        identity: {
+            name: string;
+            cid: string;
+            generation: number;
+        };
+        result: {
+            [x: string]: unknown;
+            content: ({
+                type: "text";
+                text: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "image";
+                data: string;
+                mimeType: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "audio";
+                data: string;
+                mimeType: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "resource";
+                resource: {
+                    uri: string;
+                    text: string;
+                    mimeType?: string | undefined;
+                    _meta?: Record<string, unknown> | undefined;
+                } | {
+                    uri: string;
+                    blob: string;
+                    mimeType?: string | undefined;
+                    _meta?: Record<string, unknown> | undefined;
+                };
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                uri: string;
+                name: string;
+                type: "resource_link";
+                description?: string | undefined;
+                mimeType?: string | undefined;
+                size?: number | undefined;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+                icons?: {
+                    src: string;
+                    mimeType?: string | undefined;
+                    sizes?: string[] | undefined;
+                    theme?: "light" | "dark" | undefined;
+                }[] | undefined;
+                title?: string | undefined;
+            })[];
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+            structuredContent?: Record<string, unknown> | undefined;
+            isError?: boolean | undefined;
+        } | {
+            [x: string]: unknown;
+            toolResult: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        };
+    }>;
+}

package/dist/application/supervisor-ours-tools.js

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { agentDir } from '../paths.js';
+import { ROLE_NAME_RE } from '../config.js';
+import { legacySupervisorIdentity } from './legacy-supervisor-identity.js';
+import { FleetError } from './errors.js';
+/** CLI and REST use the same fixed-identity MCP server as the agent harness. */
+export class SupervisorOursTools {
+    async withClient(role, work) {
+        if (!ROLE_NAME_RE.test(role))
+            throw new FleetError('invalid_request', 'invalid agent name');
+        const findCandidates = () => [false, true].map(temporary => ({ temporary, dir: agentDir(role, temporary) }))
+            .map(row => ({ ...row, path: join(row.dir, '.ours-bridge', 'descriptor.json') }))
+            .filter(row => existsSync(row.path));
+        const candidates = findCandidates();
+        if (candidates.length !== 1)
+            throw new FleetError('capability_unavailable', 'agent supervisor endpoint is missing or ambiguous');
+        const selected = candidates[0];
+        let descriptor;
+        let identityName;
+        try {
+            descriptor = JSON.parse(readFileSync(selected.path, 'utf8'));
+            identityName = readFileSync(join(selected.dir, '.identity'), 'utf8').trim();
+            if (!descriptor || typeof descriptor !== 'object')
+                throw new Error();
+        }
+        catch {
+            throw new FleetError('capability_unavailable', 'supervisor identity metadata cannot be read');
+        }
+        const legacy = ['role', 'identity', 'cid'].every(key => descriptor[key] === undefined);
+        const identity = legacy
+            ? legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation)
+            : { name: identityName, cid: descriptor.cid, generation: descriptor.generation };
+        if (legacy && descriptor.socket !== join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`))
+            throw new FleetError('capability_unavailable', 'legacy supervisor socket does not match the selected agent');
+        if ((!legacy && (descriptor.role !== role || descriptor.identity !== identityName))
+            || !/^[a-f0-9]{64}$/i.test(identity.cid ?? '') || !Number.isSafeInteger(descriptor.generation) || descriptor.generation < 1)
+            throw new FleetError('capability_unavailable', 'supervisor identity metadata is unavailable or mismatched');
+        const verifySelection = () => {
+            try {
+                const current = findCandidates();
+                const freshDescriptor = JSON.parse(readFileSync(selected.path, 'utf8'));
+                if (current.length !== 1 || current[0].path !== selected.path
+                    || readFileSync(join(selected.dir, '.identity'), 'utf8').trim() !== identityName
+                    || ['role', 'identity', 'cid', 'socket', 'capability', 'generation']
+                        .some(key => freshDescriptor[key] !== descriptor[key]))
+                    throw new Error();
+            }
+            catch {
+                throw new FleetError('capability_unavailable', 'selected supervisor assignment changed');
+            }
+        };
+        const client = new Client({ name: 'ours-fleet-supervisor-tools', version: '1' });
+        const transport = new StdioClientTransport({
+            command: process.execPath,
+            args: [fileURLToPath(new URL('../agent-ours/bridge.js', import.meta.url))],
+            env: { ...Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined)),
+                FLEET_OURS_BRIDGE_DESCRIPTOR: selected.path,
+                FLEET_OURS_BRIDGE_EXPECTED: JSON.stringify({ role: descriptor.role, identity: descriptor.identity, cid: descriptor.cid, generation: descriptor.generation,
+                    transportDigest: createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex') }) },
+            stderr: 'pipe',
+        });
+        try {
+            await client.connect(transport);
+            const verify = async () => {
+                if (!legacy) {
+                    verifySelection();
+                    return;
+                }
+                const actual = await client.callTool({ name: 'current_identity', arguments: {} });
+                const blocks = actual.content;
+                const lines = blocks?.length === 1 && blocks[0].type === 'text' ? blocks[0].text?.split('\n') : undefined;
+                const prefix = `Bound to "${identity.name}" (${identity.cid})`;
+                const suffix = lines?.[0].startsWith(prefix) ? lines[0].slice(prefix.length) : undefined;
+                const roleSuffix = typeof suffix === 'string' && /^ — role "[^"\r\n]+" under root "[^"\r\n]+"\.$/.test(suffix);
+                const temporaryLine = 'TEMPORARY identity owned by the Fleet supervisor for this logical agent instance. Bridge or harness disconnect retains it; terminal supervisor release deletes local state with best-effort peer notices.';
+                if (actual.isError || !(roleSuffix || (selected.temporary && suffix === '.'))
+                    || (selected.temporary ? lines?.[1] !== temporaryLine : lines?.[1]?.startsWith('TEMPORARY')))
+                    throw new FleetError('capability_unavailable', 'connected supervisor identity does not match legacy ownership proof');
+                const fresh = legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation);
+                if (!('proof' in identity) || fresh.proof !== identity.proof)
+                    throw new FleetError('capability_unavailable', 'legacy supervisor identity changed');
+                verifySelection();
+            };
+            await verify();
+            return await work(client, { name: identity.name, cid: identity.cid, generation: identity.generation }, verify);
+        }
+        catch (error) {
+            if (error instanceof FleetError)
+                throw error;
+            // Do not leak arguments, invites, capabilities, or raw transport errors.
+            throw new FleetError('control_unavailable', 'supervisor tool request failed; its outcome may be unknown, do not retry a mutation automatically', { retryable: false });
+        }
+        finally {
+            await client.close().catch(() => { });
+            await transport.close().catch(() => { });
+        }
+    }
+    list(role) {
+        return this.withClient(role, async (client, identity) => ({
+            agent: role, identity, ...(await client.listTools()),
+        }));
+    }
+    call(role, request) {
+        if (!request || typeof request.tool !== 'string'
+            || (request.arguments !== undefined && (!request.arguments || typeof request.arguments !== 'object' || Array.isArray(request.arguments))))
+            throw new FleetError('invalid_request', 'tool and object arguments are required');
+        return this.withClient(role, async (client, identity, verify) => {
+            const { tools } = await client.listTools();
+            if (!tools.some(tool => tool.name === request.tool))
+                throw new FleetError('forbidden', 'tool is not exposed by the fixed-identity supervisor');
+            await verify();
+            const result = await client.callTool({ name: request.tool, arguments: request.arguments ?? {} });
+            return { agent: role, identity, result };
+        });
+    }
+}

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.6",
-  "buildId": "2075277a291e",
-  "commit": "01660e304fff7ee37784669ec601299c92df4912",
+  "version": "1.2.0-nightly.8",
+  "buildId": "d7d0675388e4",
+  "commit": "cd6d7ee4e2a7afcb77c4a7aaba09c82c8ec162d7",
   "dirty": true,
-  "builtAt": "2026-09-23T10:49:32.469Z",
+  "builtAt": "2026-09-23T20:30:52.283Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
@@ -496,6 +497,40 @@ program.command('peek <name> [lines]').description('pane snapshot without attach
         die(controlFailure(name, 'peek', e));
     }
 });
+const oursToolsCommand = program.command('ours').description('invoke tools through a named agent supervisor and its fixed identity');
+oursToolsCommand.command('tools <agent>').description('list the same tools and schemas exposed to the agent MCP')
+    .action(async (agent) => {
+    try {
+        console.log(JSON.stringify(await new SupervisorOursTools().list(agent), null, 2));
+    }
+    catch (error) {
+        die(error);
+    }
+});
+oursToolsCommand.command('call <agent> <tool>').description('call a supervisor MCP tool without prompting the agent')
+    .option('--args-file <path>', 'JSON object arguments from a private file; omitted means {}')
+    .action(async (agent, tool, options) => {
+    try {
+        let args = {};
+        if (options.argsFile) {
+            try {
+                args = JSON.parse(readFileSync(options.argsFile, 'utf8'));
+            }
+            catch {
+                throw new Error('cannot read tool arguments: expected a readable JSON object file');
+            }
+        }
+        const response = await new SupervisorOursTools().call(agent, { tool, arguments: args });
+        console.log(JSON.stringify(response, null, 2));
+        if ('isError' in response.result && response.result.isError)
+            throw new FleetCliExit(1, 'runtime', 'unknown');
+    }
+    catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
+        die(error);
+    }
+});
 program.command('send <name> [text...]').description("type into the agent's console")
     .action(async (name, text, opts) => {
     const stateDir = acpStateDir(name);
@@ -1612,6 +1647,8 @@ async function parseFleetCli() {
         await program.parseAsync(process.argv);
     }
     catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
         const commander = error;
         if (commander.exitCode === 0)
             return;

package/dist/fleet-command-audit.js

@@ -117,6 +117,7 @@ export function consumeFleetAuditCollection() {
 const SAFE_READ = new Set(['docs', 'version', 'config', 'ls', 'peek', 'logs', 'status', 'doctor']);
 const AGENT_SURFACES = {
     spawn: new Set(['<none>']),
+    ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
         'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
@@ -189,7 +190,7 @@ const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
     '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
-    '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
+    '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
 ]);
 function redactUrl(value) {

package/dist/rooms-tasks/archived-absence.d.ts

@@ -0,0 +1,4 @@
+import type { ArchivedMemberAbsence, RoomMemberSeat } from './types.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export declare function verifyArchivedAbsence(proof: ArchivedMemberAbsence): Promise<void>;
+export declare function proveArchivedAbsence(seat: RoomMemberSeat): Promise<ArchivedMemberAbsence>;

package/dist/rooms-tasks/archived-absence.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentDir } from '../paths.js';
+import { tempArchiveForLaunch, tempArchiveForCreationAction, tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { assertMemberIdentityAbsent } from './close.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export async function verifyArchivedAbsence(proof) {
+    const absent = () => {
+        if (existsSync(agentDir(proof.name, true)))
+            throw new Error('Archived member has replacement live state');
+    };
+    absent();
+    const archive = tempArchiveForLaunch(proof.name, proof.launch_id);
+    const action = tempArchiveForCreationAction(proof.name, proof.action_id);
+    if (!archive || archive !== proof.archive_path || action?.path !== archive
+        || action.launchId !== proof.launch_id
+        || readFileSync(join(archive, '.identity'), 'utf8').trim() !== proof.name)
+        throw new Error('Archived member absence ownership proof mismatch');
+    if (await tempSupervisorLiveness(archive) !== 'stopped')
+        throw new Error('Archived member supervisor absence is not proven');
+    await assertMemberIdentityAbsent({
+        role_name: proof.name, slot: 'archived', cowork_role: 'archived', seat_state: 'removed',
+    });
+    absent();
+}
+export async function proveArchivedAbsence(seat) {
+    if (seat.identity_cid || seat.retirement?.phase !== 'identity_absent'
+        || !seat.launch?.launch_id || !seat.launch.action_id
+        || seat.launch.launch_id !== seat.retirement.launch_id || !seat.retirement.archive_path)
+        throw new Error('Missing exact archived member absence evidence');
+    const proof = {
+        name: seat.role_name, launch_id: seat.launch.launch_id, action_id: seat.launch.action_id,
+        archive_path: seat.retirement.archive_path, checked_at: new Date().toISOString(),
+    };
+    await verifyArchivedAbsence(proof);
+    return proof;
+}

package/dist/rooms-tasks/close.d.ts

@@ -20,6 +20,7 @@ export declare function waitForLivenessAbsent(role: string, launchId: string, li
 /** Report whether any daemon identity — under any name — carries this exact CID. */
 export declare function identityCidPresent(cid: string): Promise<boolean>;
 export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
+export declare function assertMemberIdentityAbsent(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;

package/dist/rooms-tasks/close.js

@@ -5,7 +5,7 @@ import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
 import { readClientProfile } from '../client-profile.js';
-import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, tempArchiveForLaunch, tempArchiveForCreationAction, } from '../temp-lifecycle.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
 import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
 const CLOSE_LOCK_STALE_MS = 5 * 60_000;
@@ -119,7 +119,7 @@ export async function removeExactMemberIdentity(seat) {
         }
     });
 }
-async function assertMemberIdentityAbsent(seat) {
+export async function assertMemberIdentityAbsent(seat) {
     await withIdentityClient(async (client) => {
         const rows = await client.listIdentities();
         if (rows.some(row => row.name === seat.role_name ||
@@ -141,6 +141,27 @@ async function retireMember(roomId, seat, deps) {
         return;
     }
     if (!retirement) {
+        if (!existsSync(agentDir(current.role_name, true)) && current.launch?.launch_id && current.launch.action_id) {
+            const archived = tempArchiveForLaunch(current.role_name, current.launch.launch_id);
+            const created = tempArchiveForCreationAction(current.role_name, current.launch.action_id);
+            if (archived && created?.path === archived && created.launchId === current.launch.launch_id) {
+                if (readFileSync(join(archived, '.identity'), 'utf8').trim() !== current.role_name)
+                    throw new Error(`room member '${current.role_name}' archive identity mismatch`);
+                if (await tempSupervisorLiveness(archived) !== 'stopped')
+                    throw new Error(`room member '${current.role_name}' archived supervisor is not proven stopped`);
+                // A terminated launch can archive itself before room retirement begins.
+                // Accept its exact durable provenance only when no identity needs removal.
+                await assertMemberIdentityAbsent(current);
+                const latest = getRoomRecord(roomId)?.member_seats.find(seat => seat.role_name === current.role_name);
+                if (existsSync(agentDir(current.role_name, true))
+                    || latest?.launch?.launch_id !== current.launch.launch_id
+                    || latest?.launch?.action_id !== current.launch.action_id
+                    || latest?.identity_cid !== current.identity_cid)
+                    throw new Error(`room member '${current.role_name}' changed during archived retirement proof`);
+                advanceMemberRetirement(roomId, current.role_name, 'identity_absent', current.launch.launch_id, archived);
+                return;
+            }
+        }
         if (current.launch?.state === 'failed' && !existsSync(agentDir(current.role_name, true))) {
             // A failure before applyRole (for example invite-secret validation) has
             // no supervisor to stop or archive. Settle only proven absence; this

package/dist/rooms-tasks/deletion.js

@@ -1,3 +1,4 @@
+import { proveArchivedAbsence, verifyArchivedAbsence } from './archived-absence.js';
 import { existsSync } from 'node:fs';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir } from '../paths.js';
@@ -145,10 +146,30 @@ export async function settleTaskDeletion(input) {
                 upsertTaskDeletionMembersFromSeats(taskId, record.member_seats);
                 await closeManagedRoom({ roomId: record.room_id, cowork: cowork, deps: deps.roomClose });
                 const closed = getRoomRecord(record.room_id);
-                importTaskDeletionRetirementEvidence(taskId, closed?.member_seats ?? record.member_seats);
+                const seats = closed?.member_seats ?? record.member_seats;
+                const proofs = [];
+                for (const seat of seats) {
+                    if (!seat.identity_cid && seat.retirement?.launch_id !== 'never-launched')
+                        proofs.push(await proveArchivedAbsence(seat));
+                }
+                // No await between the last live-state fence and durable checkpoint.
+                for (const proof of proofs) {
+                    const latest = getRoomRecord(record.room_id)?.member_seats.find(seat => seat.role_name === proof.name);
+                    if (existsSync(agentDir(proof.name, true)) || latest?.identity_cid
+                        || latest?.launch?.launch_id !== proof.launch_id || latest.launch.action_id !== proof.action_id)
+                        throw new Error('Archived absence seat changed before checkpoint');
+                }
+                importTaskDeletionRetirementEvidence(taskId, seats, proofs);
                 await cowork.deleteRoom(record.room_id);
+                for (const proof of proofs)
+                    await verifyArchivedAbsence(proof);
+                for (const proof of proofs)
+                    if (existsSync(agentDir(proof.name, true)))
+                        throw new Error('Archived member replacement before room unlink');
                 deleteRoomRecord(record.room_id);
             }
+            for (const proof of getDeletingTask(taskId).deletion.archived_absences ?? [])
+                await verifyArchivedAbsence(proof);
             // Members whose room record is gone (crash after record deletion, or
             // legacy state): resume from the durable cursors.
             for (const cursor of getDeletingTask(taskId).deletion.members) {
@@ -176,7 +197,7 @@ export async function settleTaskDeletion(input) {
         completeTaskDeletionReceipt(taskId);
         return { task_id: taskId, deleted: false };
     }
-    const finalize = () => withFileLock(taskOperationLockPath(taskId), () => {
+    const finalize = () => withFileLock(taskOperationLockPath(taskId), async () => {
         try {
             const task = getDeletingTask(taskId);
             if (task.deletion?.status !== 'pending')
@@ -185,6 +206,11 @@ export async function settleTaskDeletion(input) {
                 throw new TaskStateError(`task ${taskId} room records reappeared during deletion finalization`);
             if (task.deletion.members.some(member => member.phase !== 'identity_absent'))
                 throw new TaskStateError(`task ${taskId} has unretired members at deletion finalization`);
+            for (const proof of task.deletion.archived_absences ?? [])
+                await verifyArchivedAbsence(proof);
+            for (const proof of task.deletion.archived_absences ?? [])
+                if (existsSync(agentDir(proof.name, true)))
+                    throw new Error('Archived member replacement before task unlink');
             if (cleanup.snapshotHash)
                 releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
             unlinkDeletedTask(taskId);

package/dist/rooms-tasks/task-state.d.ts

@@ -1,3 +1,4 @@
+import type { ArchivedMemberAbsence } from './types.js';
 import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
@@ -74,6 +75,7 @@ export interface TaskDeletionReceipt {
     original_state: TaskState;
     room_id?: string;
     member_count: number;
+    archived_absences?: ArchivedMemberAbsence[];
     settled_at?: string;
     result?: 'deleted';
 }
@@ -122,6 +124,10 @@ export declare function advanceTaskDeletionMember(id: string, name: string, phas
 interface SeatEvidence {
     role_name: string;
     identity_cid?: string;
+    launch?: {
+        launch_id?: string;
+        action_id?: string;
+    };
     retirement?: {
         phase: TaskDeletionMemberPhase;
         launch_id: string;
@@ -146,10 +152,10 @@ export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: Re
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>, proofs?: ReadonlyArray<ArchivedMemberAbsence>): TaskRecord;
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing

package/dist/rooms-tasks/task-state.js

@@ -505,7 +505,8 @@ function writeDeletionReceiptForIntent(stored) {
         actor: deletion.actor,
         original_state: stored.state,
         room_id: deletion.room_id,
-        member_count: deletion.members.length,
+        member_count: deletion.members.length + (deletion.archived_absences?.length ?? 0),
+        ...(deletion.archived_absences?.length ? { archived_absences: deletion.archived_absences } : {}),
     };
     replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
 }
@@ -688,10 +689,10 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export function importTaskDeletionRetirementEvidence(id, seats) {
+export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
         const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
@@ -708,6 +709,18 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             if (!seat.identity_cid) {
                 if (neverLaunched)
                     continue; // provably never held a managed identity
+                const proof = proofs.find(value => value.name === seat.role_name);
+                if (proof && proof.launch_id === evidence.launch_id && proof.archive_path === evidence.archive_path
+                    && proof.launch_id === seat.launch?.launch_id && proof.action_id === seat.launch?.action_id) {
+                    const existing = stored.deletion.archived_absences?.find(value => value.name === proof.name);
+                    if (existing && (existing.launch_id !== proof.launch_id || existing.action_id !== proof.action_id
+                        || existing.archive_path !== proof.archive_path))
+                        throw new TaskStateError('Archived absence checkpoint ownership is immutable');
+                    stored.deletion.archived_absences ??= [];
+                    if (!existing)
+                        stored.deletion.archived_absences.push({ ...proof });
+                    continue;
+                }
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
             }
             let cursor = findCursorForSeat(id, stored, seat);
@@ -729,6 +742,7 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             cursor.updated_at = now;
         }
         writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
         return presentTaskLenient(stored);
     });
 }

package/dist/rooms-tasks/types.d.ts

@@ -73,6 +73,13 @@ export interface TaskDeletionMemberCursor {
  * evidence. While pending, the task is hidden from normal operation and every
  * lifecycle mutation or room publication is rejected.
  */
+export interface ArchivedMemberAbsence {
+    name: string;
+    launch_id: string;
+    action_id: string;
+    archive_path: string;
+    checked_at: string;
+}
 export interface TaskDeletionIntent {
     status: 'pending';
     accepted_at: string;
@@ -80,6 +87,7 @@ export interface TaskDeletionIntent {
     room_id?: string;
     /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
     members: TaskDeletionMemberCursor[];
+    archived_absences?: ArchivedMemberAbsence[];
     error?: string;
     error_at?: string;
     recovery_hint?: string;

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
 import type { FleetQueryService } from '../application/fleet-query-service.js';
 import type { RoleRepository } from '../application/role-repository.js';
@@ -31,6 +32,7 @@ export interface WebServices {
     topologyPromote?: TopologyPromoteService;
     removal?: RoleRemovalService;
     taskRooms?: TaskRoomApplicationService;
+    oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
 }
 export interface WebServer {
     app: FastifyInstance;

package/dist/web/server.js

@@ -1,3 +1,4 @@
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -51,7 +52,11 @@ export async function buildWebServer(services, boundary, options = {}) {
         }
     });
     app.setErrorHandler(async (error, request, reply) => {
-        const fleetError = normalizeError(error, request.id);
+        const privateToolParseError = request.routeOptions.url === '/api/v1/roles/:id/ours/call'
+            && error instanceof Error && 'code' in error
+            && typeof error.code === 'string' && error.code.startsWith('FST_ERR_CTP_');
+        const fleetError = normalizeError(privateToolParseError
+            ? new FleetError('invalid_request', 'expected a valid JSON tool request') : error, request.id);
         await audit.record({
             requestId: request.id, action: `${request.method} ${request.routeOptions.url ?? request.url}`,
             result: 'rejected', errorCode: fleetError.code,
@@ -311,6 +316,18 @@ export async function buildWebServer(services, boundary, options = {}) {
         });
         return result;
     });
+    const oursTools = services.oursTools ?? new SupervisorOursTools();
+    app.get('/api/v1/roles/:id/ours/tools', async (request) => {
+        auth.authenticate(request);
+        return oursTools.list(request.params.id);
+    });
+    app.post('/api/v1/roles/:id/ours/call', async (request) => {
+        const session = auth.authenticate(request, true);
+        const result = await oursTools.call(request.params.id, request.body);
+        await audit.record({ requestId: request.id, browser: session.id,
+            action: 'ours.call', result: result.result.isError === true ? 'tool_error' : 'succeeded' });
+        return result;
+    });
     app.get('/api/v1/roles/:id', async (request) => {
         auth.authenticate(request);
         return services.query.detail(request.params.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.6",
+  "version": "1.2.0-nightly.8",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/presets/fleet/roles/Coordinator.yaml

@@ -12,6 +12,28 @@ persona: |
   Only execute task work yourself when the owner explicitly orders you to override this boundary
   for that specific task.
 
+  Agent identity and contact management requested by the owner is Fleet management work.
+  For requests such as "generate an invite for this agent", "accept this invite for that agent",
+  "list its contacts", or "send this message as that agent", select the named agent and call the
+  corresponding deterministic supervisor operation through the Fleet CLI or REST API. The
+  supervisor owns and binds that agent's identity; verify that the selected agent and returned
+  identity match the owner's request. Use the shared supervisor tool interface for these
+  operations, including generate_invite, add_contact, list_contacts, and send_message.
+  Discover schemas with `ours-fleet ours tools <agent>`; invoke with
+  `ours-fleet ours call <agent> <tool> --args-file <private-json-file>` (omit the file for {}).
+  REST equivalents are GET `/api/v1/roles/<agent>/ours/tools` and POST
+  `/api/v1/roles/<agent>/ours/call` with body {"tool":"<tool>","arguments":{...}}.
+  Use the normal authenticated Fleet session and CSRF token for REST calls.
+  Do not ask the agent in its conversation to perform these operations, send the invite to its
+  LLM session, or use session steering as an identity-management API. Do not create a separate
+  identity, choose or rebind an identity, force a binding, or restart a supervisor to perform a
+  contact operation. If the supported supervisor operation is unavailable or identity matching
+  fails, report that exact blocker and retain the request without attempting a substitute path.
+  Keep invite inputs in the supported private-file or request-body channel, out of logs and
+  unrelated rooms. Report the operation's actual result: accepting an invite may leave contact
+  verification pending, so do not claim that contact establishment or message delivery is complete
+  until the corresponding result confirms it.
+
   For every new task:
   1. Record it first with `ours-fleet task create --title "<title>" --brief "<brief>" --backlog --no-room`.
   2. Ask the owner which room template to use: `single`, `pair`, or `team`.