@ours.network/fleet 1.2.0-nightly.7 → 1.2.0-nightly.71

package/dist/docs.js

@@ -172,34 +172,29 @@ rollback; inspect host integration and private init stage/recovery evidence.
 Attachment also accepts \`/permit <permission-id> <option-id>\`, \`/interrupt\`,
 and \`/detach\`.
 
-## Local web console
+## Local HTTP service
 
-The npm package includes the web console; installed users do not clone the repo
-or run \`npm run build\`:
+Fleet runs an HTTP service for the App. It serves no pages and opens no
+browser; every screen is in the App.
 
 \`\`\`sh
 npm i -g @ours.network/fleet
-ours-fleet init
-ours-fleet doctor
-ours-fleet web                         # install/update service, start, pair browser
+ours-fleet setup-tunnel --file /private/setup.txt # connect host; prints QR and connection code
+ours-fleet link-device                 # connect another browser or device
 \`\`\`
 
-The normal command uses stable \`http://127.0.0.1:49271/\`, installs an
-owner-level systemd user service (Linux) or LaunchAgent (macOS), and opens a
-five-minute one-use pairing link in the local browser. After pairing, bookmark
-the plain URL or install the PWA. To pair a new, signed-out, or revoked browser,
-run \`ours-fleet web open\`.
+The service listens on \`http://127.0.0.1:49271/\` and is installed as an
+owner-level systemd user service (Linux) or LaunchAgent (macOS).
 
 \`\`\`sh
 ours-fleet web status
 ours-fleet web start|stop|restart
-ours-fleet web open
-ours-fleet web revoke-all              # revoke every browser and active session
+ours-fleet web revoke-all              # revoke every device and active session
 ours-fleet web uninstall
-ours-fleet web serve --port 0 --no-open # isolated foreground/testing mode
+ours-fleet web serve --port 0          # isolated foreground/testing mode
 \`\`\`
 
-The console is IPv4-loopback-only by default. Both \`localhost\` and
+The service is IPv4-loopback-only by default. Both \`localhost\` and
 \`127.0.0.1\` are accepted locally. For an nginx/TLS reverse proxy, keep the
 default bind and declare the exact browser origin:
 
@@ -271,6 +266,88 @@ the executor inside the role's existing OS sandbox, and ordinary CLI validation
 the source of truth. Hidden worker entry points remain internal; public lifecycle and
 operator commands are not restricted by the proxy.
 
+### Fleet commands from a command sandbox (\`managed_cli\`)
+
+That supervisor connection is a Unix socket. A harness command sandbox (Codex
+\`workspace-write\`, Claude's OS sandbox) can refuse it with \`connect EPERM\`
+before any command, even \`--help\`, is parsed. Fleet prepares the native
+harness policy for one declared workflow; you never write Codex rules or Claude
+sandbox settings by hand.
+
+Opt an Agent (or Agent Template) in explicitly. It is never inferred from a
+role's name or persona and is not inherited by agents it spawns:
+
+\`\`\`yaml
+# fleet/agents/FleetCoordinator.yaml
+role: { ref: Coordinator }
+brain: { ref: codex-gpt-5-4-medium }
+permissions: { approval: auto, filesystem: workspace, unattended: deny }
+managed_cli: [task-workflow]
+\`\`\`
+
+\`ours-fleet managed-cli setup --enable FleetCoordinator\` adds that one key to
+an existing Agent file and changes nothing else, permissions included.
+\`ours-fleet managed-cli setup\` generates the policy for every declaring agent
+and \`ours-fleet managed-cli status\` compares without writing. Neither starts a
+session or a model. The same preparation runs at every agent start, so spawned
+and task-room agents need no separate step.
+
+\`task-workflow\` prepares: \`task create|start|finish|block|unblock|review\`,
+\`task list|show\`, \`room show|members\`, \`template list|show|validate\`,
+\`config\`, \`docs\` and \`--help\`. \`task start\` and \`task finish\`
+provision and retire rooms and agents: this is real authority. Not prepared, and
+still sandboxed: \`spawn\`, \`ours tools|call\`, \`status|peek|send\`, room
+create/delete/close, task cancel/delete and service administration.
+
+The agent invokes a prepared command through the pinned entry form shown in its
+briefing:
+
+\`\`\`sh
+/abs/node /abs/fleet/dist/cli.js --managed-configuration /abs/fleet.yaml task create --title "..." --backlog --no-room
+\`\`\`
+
+What the native policy does and does not do:
+
+- A rule fixes the Node executable, this Fleet CLI, the configuration and the
+  command. It matches an argv prefix and admits every trailing option and
+  argument. It is not argument validation, target authorization or per-agent
+  isolation.
+- A later \`-c\`/\`--configuration\` naming another file is refused by the
+  Fleet CLI itself, after the process has started outside the sandbox. That is
+  Fleet validation, not a native policy denial.
+- The supervisor audit and ordinary CLI validation are unchanged. The pinned
+  form is refused outside a managed session, where no supervisor would audit it.
+- Compound, piped, redirected, \`$(...)\` and \`VAR=value\`-prefixed command
+  lines do not match and stay sandboxed.
+- Codex: a Fleet-owned \`.codex/rules/ours-fleet-<id>.rules\` in the agent's
+  workspace. It applies to every trusted Codex session in that workspace, and
+  Codex must trust the workspace; Fleet does not change trust. Other files in
+  that directory are never touched.
+- Claude: entries in the agent's own Fleet settings overlay
+  (\`permissions.allow\` and \`sandbox.excludedCommands\`). Your Claude settings
+  are not modified and Fleet never enables or disables Claude's OS sandbox.
+- A Fleet CLI or configuration path containing spaces is spelled in single
+  quotes (Codex >= 0.160.0). The Node executable itself must be at a path that
+  needs no quoting: neither harness matches a quoted executable against a rule.
+  A path containing anything but letters, digits, spaces and \`_@%+=:,./-\`
+  (quotes, backslashes, \`*\` and other pattern characters), or located inside
+  the agent's workspace or a \`harness_options.add_dirs\` directory (also through
+  a symlink), is reported as unsupported; so is a Codex role with
+  \`harness_options.config\` or \`profile\`, whose sandbox Fleet does not inspect.
+- Prepared for: Codex native app-server and bundled ACP, Claude bundled ACP, on
+  Linux and macOS. The generated setup was qualified end to end on Linux
+  (Codex 0.160.0, Claude Code 2.1.289); the macOS run of that matrix is
+  outstanding and \`managed-cli status\` says so there. Custom session
+  commands, other harnesses, roles declaring \`isolation:\` and other
+  platforms are reported as unsupported and left exactly as sandboxed as before.
+
+\`ours-fleet doctor\` reports three separate facts per declaring agent: the
+generated setup (static), whether the last launch loaded the current policy, and
+what the supervisor audit ledger recorded since. A prepared setup is not
+evidence of supervisor access, and a successful \`--help\` proves only its own
+audited path, not the task lifecycle. See
+\`docs/validation/managed-cli-permissions.md\`.
+
 Command invocation, raw argv, read-only work, validation failures, and generic
 outcomes are never forwarded to the Owner-visible channel. Fleet announces only
 confirmed Agent, Task, and Room lifecycle changes. Local diagnostics retain
@@ -492,6 +569,17 @@ Messenger-bound results are capped at 3,500 Unicode code points and 12,000 UTF-8
 bytes with structural omission notices. \`--json\` bypasses this presentation layer
 and retains the versioned machine schema and serialization order.
 
+Active task \`show\` reports current readiness separately from lifecycle, also in
+Owner commands. Start/work preserve the fail-closed \`task_not_ready\` behavior.
+Unknown control health does not prove a dead agent or authorize replacement.
+Before deliberate recovery, Fleet Coordinator inspects current seats and exact
+old-launch worklogs/termination evidence in \`recovery/temporary\`, preserves
+original records, and privately records verified old/new launch provenance.
+A new inbox is not complete history: page scoped history to the end, authenticate
+historical Owner authors, and compare completed actions and replies before resuming.
+Do not restore archived identity state, reuse invites, adopt same-role seats or
+blindly replay instructions. Ask the Owner if authority/completion is uncertain.
+
 Every task belongs to a named list. The built-in \`default\` list always exists,
 and legacy tasks or create calls without \`--list\` resolve to it. Use \`task lists\`,
 \`task list-create <name>\`, \`task list-rename <name> <new-name>\`, and
@@ -738,6 +826,32 @@ Override an adapter only when necessary with \`session_options.acp.command\`
 ours-fleet falls back to a compatible globally installed \`codex-acp\` or
 \`claude-agent-acp\`. \`ours-fleet doctor -c FILE\` verifies the resolved adapter.
 
+## Boot-time daemon readiness
+
+Linux permanent-agent services wait for their configured daemon before launching
+Fleet's runner. This uses the role's saved manifest path and environment, including
+host profiles, gateway endpoints and expected daemon identity; no Docker container
+names or default ports are assumed. The read-only probe requires verified startup
+readiness and an available identity index. Unavailable or unauthorized daemons leave
+the service waiting, with a diagnostic code in the journal. Each wait is bounded
+and systemd retries it until the daemon is ready; stopping the service cancels it.
+This does not consume the agent crash budget or discard its session context.
+Once the runner starts, its normal crash circuit breaker still applies.
+After upgrading Fleet, run \`ours-fleet service refresh\` (\`ours-install\` does it for
+you). Service definitions start the exact release tree that wrote them, so an
+unrefreshed one starts the previous release after the next reboot.
+\`ours-fleet service check\` reports each supervisor, web and watchdog definition,
+and whether its running process uses another release, without changing anything.
+\`refresh\` only re-points the release paths in definitions Fleet generated, runs
+\`daemon-reload\`, and never creates, starts, stops or restarts a service. A running
+supervisor keeps its code until it is restarted.
+Temporary agents and macOS services retain their existing lifecycle behavior.
+
+After a supervisor restart or reboot, prompts a role had admitted but never
+started are dispatched only once its control socket is listening, so recovered
+work cannot reach the previous run's socket (\`connect ECONNREFUSED\`). Turns that
+had already started are closed as \`unknown_after_restart\` and never replayed.
+
 ## Reliable mail wake
 
 \`monitor.mode\` selects exactly one wake owner:
@@ -749,10 +863,12 @@ ours-fleet falls back to a compatible globally installed \`codex-acp\` or
 - \`native\`: ours-fleet starts no supervisor monitor; the generated briefing
   instructs Claude Code or Codex to arm its harness-native wake mechanism.
 
-Set \`monitor.interrupt: true\` in fleet mode to cancel active work before every
-configured wake. Set it to \`after_tool\` to preserve an active ACP tool (and any
-pending permission), then steer the wake at the first tool-terminal boundary
-without cancellation. A hung boundary is bounded at 120 seconds and falls back
+\`monitor.interrupt\` defaults to \`after_tool\` for every harness except Hermes,
+which defaults to \`false\`; an explicit value always wins, and temporary snapshots
+written without one keep \`false\`. Set \`monitor.interrupt: true\` in fleet mode to
+cancel active work before every configured wake. \`after_tool\` preserves an active
+ACP tool (and any pending permission), then steers the wake at the first
+tool-terminal boundary without cancellation. A hung boundary is bounded at 120 seconds and falls back
 to non-cancelling steering/queueing; adapters without authenticated tool events
 use the same conservative fallback. Explicit human/control interrupts remain
 immediate. The policy is content-blind because the supervisor cannot inspect
@@ -773,6 +889,78 @@ selection.
 Inspect \`ours-fleet status Name\`, \`peek Name\`, role logs, and
 \`~/.ours-fleet/agents/Name/.monitor-status\` when diagnosing delivery.
 
+## Self-reminders
+
+Every managed agent (\`session: acp\` or \`codex-app-server\`, Claude or Codex,
+persistent, temporary or task-owned) can schedule one-time wakes for ITSELF.
+The tools are on the agent's own fixed-identity ours MCP server, so there is no
+agent, identity or recipient argument and no setup, worker, service, chat or key:
+
+- \`fleet_reminder_create\` — \`request_key\` (stable per decision; a repeat with
+  the same input returns the same reminder, different input is refused),
+  \`title\`, optional \`note\`, \`local_time\` (date and time WITHOUT an offset, e.g.
+  \`2027-01-20T16:00\`), \`time_zone\` (IANA, e.g. \`Europe/London\`, \`UTC\`), optional
+  \`fold\` (0/1, required only for a time that occurs twice when clocks go back;
+  times skipped by a spring-forward gap are refused), \`late_window_seconds\`
+  (60..604800, default 3600) and \`interrupt\` (default false; see below).
+- \`fleet_reminder_list\` — \`state\` \`open\` (default) | \`closed\` | \`all\`, \`limit\`, \`after\`.
+- \`fleet_reminder_update\` / \`fleet_reminder_cancel\` — \`id\` + \`expected_revision\`;
+  every change bumps the revision and voids any wake issued for the old one.
+- \`fleet_reminder_inspect\` — \`event_id\` from a wake: the note, whether the
+  wake is still current and eligible, and for an urgent one \`interrupt.state\`.
+- \`fleet_reminder_ack\` — \`event_id\` + \`expected_revision\`: records that the
+  wake was handled. Idempotent; sends nothing and claims no external action.
+
+When a reminder is due the supervisor starts one turn beginning \`[fleet-reminder]\`
+with the event id. It is the agent's own stored reminder, not an owner
+instruction or ours mail, and grants no authority. Fleet never sends anything
+on the agent's behalf; whether to message anyone is the agent's own decision
+under its existing tools and authorization.
+
+Delivery: the supervisor process that runs the agent owns the timer — an idle
+agent with no open reminders costs nothing, and only a due reminder creates a
+model turn. By default a wake never interrupts or queues behind work: it is
+admitted at the next idle turn boundary after its due time and after the agent's
+startup turn.
+
+Urgent (\`interrupt: true\`), only for a return genuinely bound to a time: when
+due and the agent is busy with an interruptible turn (mail wake, scheduled loop,
+local console), the supervisor durably records the request, asks that exact turn
+to stop once per revision, keeps the session and context, and releases the wake
+through the same fence. It never stops owner-channel or owner-console work,
+startup, stall recovery, another reminder, a pending permission, queued work or a
+turn it cannot identify; then it waits like an ordinary reminder and \`inspect\`
+shows \`interrupt_deferred\`. Due, interruption requested, its terminal
+(\`cancelled\` only when correlated; else \`ended\`/\`forced\`/\`failed\`/\`unknown\`),
+release, ack and any external action are separate facts. A forced or failed stop
+never queues the wake. It is not a hard real-time alarm and does nothing while
+the host or agent is down.
+If the host, Fleet or the agent is down, paused or busy, a reminder is still
+delivered when it comes back within its late window, and otherwise expires
+without a turn. Reminders survive supervisor, Fleet and host restarts and
+ordinary stop/start. They do not survive the agent: removing or retiring an
+agent or its task cancels them and deletes their state, and a replaced identity
+or same-named successor never inherits them.
+
+Guarantees are at most once per reminder revision. Queue acceptance, release to
+the model, the agent's ack, and any external action are distinct facts. A wake
+is marked dispatched durably at the moment it is handed to the model; if the
+supervisor stops before that, the same event is retried. If it stops after, the
+event is held \`uncertain\` (shown by \`list\`/\`inspect\`, never re-sent): check your
+own records, then ack it or schedule something new.
+
+Waiting on a peer (Developer/Critic/Engineer): before waiting on a specific
+review, answer or artifact, schedule ONE idle-only reminder about 20 minutes out
+naming the task/room and the expectation; cancel or reschedule it (with its
+revision) when the state changes; on the wake re-check, ack if resolved, else one
+follow-up in the same room and at most one more reminder, then report the
+nonresponse once. No polling, recurring chains, repeated follow-ups or automatic
+done.
+
+Operators can read an agent's reminders with
+\`ours-fleet ours call Name fleet_reminder_list\`. Full guide, examples and the
+migration from the standalone \`self-reminders\` worker skill: \`docs/self-reminders.md\`.
+
 ## Trusted owner channel
 
 Any managed role may declare a separate ours identity which fleet — never the agent —

package/dist/doctor.d.ts

@@ -1,9 +1,10 @@
+import { type RefreshOptions } from './supervisor/registration-refresh.js';
 import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
 import { type Exec } from './exec.js';
 import type { YamlMode } from './config-yaml.js';
 import { type FetchLike } from './monitor.js';
 import type { PrereqReport } from './harness/types.js';
-type DoctorDaemonClient = Pick<OursClient, 'version' | 'close'>;
+type DoctorDaemonClient = Pick<OursClient, 'version' | 'close'> & Partial<Pick<OursClient, 'identities'>>;
 type AttachDoctorDaemon = (options: AttachOursClientOptions) => Promise<DoctorDaemonClient>;
 /** Host-level + per-harness prerequisite report with actionable messages. */
 export declare function doctor(opts?: {
@@ -17,5 +18,7 @@ export declare function doctor(opts?: {
     };
     /** Override the local Codex model cache path (tests). */
     codexCatalogPath?: string;
+    /** Compare installed service definitions with this release (read-only). */
+    serviceRegistration?: Pick<RefreshOptions, 'binPath' | 'homeDir' | 'exists' | 'processArgv'>;
 }, exec?: Exec, platform?: NodeJS.Platform, fetchImpl?: FetchLike, attachDaemon?: AttachDoctorDaemon): Promise<PrereqReport>;
 export {};

package/dist/doctor.js

@@ -1,17 +1,17 @@
-import { join } from 'node:path';
-import { userInfo, homedir } from 'node:os';
+import { describeRegistration, refreshServiceRegistrations, registrationDrift } from './supervisor/registration-refresh.js';
+import { userInfo } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { realExec } from './exec.js';
 import { isolationContextFor, loadConfig } from './config.js';
 import { getAdapter, productionAdapters } from './harness/registry.js';
 import { analyzeFleetPermissions, formatNative } from './permissions.js';
+import { managedCliReport } from './managed-cli.js';
 import { resolveBundledAcpAgent } from './harness/acp-agent.js';
 import { agentDir, deriveXdgRuntimeDir } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
-import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
@@ -37,25 +37,21 @@ function resolveMonitorProfiles(roles) {
     const profiles = [];
     for (const role of roles.filter(r => r.monitor?.mode === 'fleet')) {
         const env = { ...process.env, ...(role.env ?? {}) };
-        const client = readClientProfile(env);
-        if (client) {
-            const existing = profiles.find(p => p.client?.endpoint === client.endpoint
-                && p.client.expectedInstanceId === client.expectedInstanceId
-                && p.client.credentialPath === client.credentialPath);
-            if (existing)
-                existing.roles.push(role.name);
-            else
-                profiles.push({ client, roles: [role.name] });
+        let client;
+        try {
+            client = readClientProfile(env);
+        }
+        catch (error) {
+            profiles.push({ roles: [role.name], error: error instanceof Error ? error.message : 'Invalid gateway profile' });
             continue;
         }
-        const endpoint = resolveEndpoint(env);
-        const token = endpoint.headers['x-ours-api-token'];
-        const existing = profiles.find(p => p.endpoint?.origin === endpoint.origin
-            && p.endpoint.headers['x-ours-api-token'] === token);
+        const existing = profiles.find(p => p.client?.endpoint === client.endpoint
+            && p.client.expectedInstanceId === client.expectedInstanceId
+            && p.client.credentialPath === client.credentialPath);
         if (existing)
             existing.roles.push(role.name);
         else
-            profiles.push({ endpoint, roles: [role.name] });
+            profiles.push({ client, roles: [role.name] });
     }
     return profiles;
 }
@@ -101,6 +97,25 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // trustworthy as the answer, and a second install with the same semver and
     // different behaviour is invisible to `--version`.
     checks.push(...installChecks(opts.installScan));
+    if (opts.serviceRegistration) {
+        try {
+            const reports = await refreshServiceRegistrations({
+                ...opts.serviceRegistration, write: false, exec, platform,
+            });
+            for (const report of reports.filter(report => report.state !== 'absent'))
+                checks.push({
+                    name: `service: ${report.service}`,
+                    // Same predicate as `service check`, so a pending reload is drift here too.
+                    ok: registrationDrift([report]).length === 0,
+                    detail: describeRegistration(report).replace(/^\S+\s+/, '')
+                        + (report.state === 'stale' ? '; run: ours-fleet service refresh' : ''),
+                });
+        }
+        catch (error) {
+            checks.push({ name: 'service definitions', ok: false,
+                detail: `could not inspect: ${error?.message ?? String(error)}` });
+        }
+    }
     const major = Number(process.versions.node.split('.')[0]);
     checks.push({
         name: 'node', ok: major >= 20,
@@ -156,7 +171,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
-        // Cowork socket reachability
+        // Cowork gateway reachability
         const coworkConfig = rooms.cowork?.config;
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -165,14 +180,14 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
             checks.push({
                 name: 'cowork', ok: reachable,
                 detail: reachable
-                    ? 'management socket reachable'
-                    : `management socket unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
+                    ? 'gateway management reachable'
+                    : `gateway management unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
             });
         }
         catch (e) {
             checks.push({
                 name: 'cowork', ok: false,
-                detail: `management socket error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
+                detail: `gateway management error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
             });
         }
         // Owner CID shape
@@ -219,17 +234,6 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     : `template '${defaultTemplate}' not found`,
             });
         }
-        // Shared-daemon selection coherence
-        if (rooms.cowork?.config) {
-            const { existsSync: exists } = await import('node:fs');
-            const configOk = exists(rooms.cowork.config);
-            checks.push({
-                name: 'rooms: cowork config', ok: configOk,
-                detail: configOk
-                    ? `cowork config at ${rooms.cowork.config}`
-                    : `cowork config not found: ${rooms.cowork.config}`,
-            });
-        }
         // Hard room-management capability check
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -273,20 +277,17 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
-    let managedSelection = false;
+    let managedSelection = true;
     try {
         // Mark explicit selection before validation so a damaged managed profile does
         // not produce advice to start an unrelated local daemon.
-        managedSelection = process.env.OURS_CONFIG !== undefined
-            || existsSync(join(process.env.HOME || homedir(), '.ours-client', 'profile.json'));
+        managedSelection = true;
         const selected = readClientProfile(process.env);
         managedSelection = selected !== undefined;
-        const client = await attachDaemon(selected ? {
+        const client = await attachDaemon({
             endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
             credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-        } : {
-            env: process.env, leaseToken: `ours-fleet-doctor-${process.pid}`, clientPid: process.pid,
         });
         let daemonVersion;
         try {
@@ -368,6 +369,32 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     + `grants only ${analysis.capabilities.join(', ') || '(nothing)'}`,
         });
     }
+    // Managed CLI policy. Three separate rows on purpose: what Fleet generated
+    // (static), what the running session loaded, and what the supervisor audit
+    // ledger actually recorded. The first two never stand in for the third.
+    if (roles.some(role => role.managed_cli?.length)) {
+        const report = managedCliReport({ roles }, opts.configPath, { write: false, platform });
+        for (const role of report.roles.filter(item => item.setup.state !== 'not-declared')) {
+            checks.push({
+                name: `managed CLI setup: ${role.role}`,
+                ok: ['prepared', 'generated-at-launch', 'not-required'].includes(role.setup.state),
+                detail: `static: ${role.setup.state} — ${role.setup.detail}`
+                    + (['missing', 'stale'].includes(role.setup.state) ? '; run: ours-fleet managed-cli setup' : '')
+                    + (role.warnings.length ? `; ${role.warnings.join('; ')}` : ''),
+            });
+            if (role.session_policy !== 'not-applicable')
+                checks.push({
+                    name: `managed CLI session: ${role.role}`, ok: true,
+                    detail: role.session_policy === 'restart-required'
+                        ? 'the last launch loaded a different policy — restart this agent to load the current one'
+                        : role.session_policy === 'never-launched' ? 'not launched since setup; the policy loads at its next start'
+                            : 'the last launch loaded the current policy',
+                });
+            checks.push({
+                name: `managed CLI observed: ${role.role}`, ok: true, detail: role.observed.summary,
+            });
+        }
+    }
     for (const role of roles.filter(candidate => candidate.auth_proxy !== undefined)) {
         const proxy = role.auth_proxy;
         const credentialKeys = Object.keys(role.env ?? {}).filter(key => /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|AUTHORIZATION)$/i.test(key)
@@ -448,14 +475,18 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // shared-mode misconfig (401) surfaces here rather than as a silent deaf monitor.
     const monitorProfiles = resolveMonitorProfiles(roles);
     for (const profile of monitorProfiles) {
-        const { endpoint, client: selected } = profile;
+        const selected = profile.client;
         const checkName = monitorProfiles.length === 1
             ? 'monitor: daemon API'
             : `monitor: daemon API (${profile.roles.join(', ')})`;
-        let ok = false, detail;
+        let ok = false, detail = 'gateway profile unavailable';
+        if (profile.error) {
+            checks.push({ name: checkName, ok: false, detail: profile.error });
+            continue;
+        }
         try {
             if (selected) {
-                const daemon = await attachOursClient({
+                const daemon = await attachDaemon({
                     endpoint: selected.endpoint,
                     expectedInstanceId: selected.expectedInstanceId,
                     credentialPath: selected.credentialPath,
@@ -464,7 +495,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 });
                 try {
                     const [info, identities] = await Promise.all([
-                        daemon.version(), daemon.identities(),
+                        daemon.version(), daemon.identities?.(),
                     ]);
                     if (info.name !== 'ours' || !Array.isArray(identities))
                         throw new Error('selected daemon metadata is invalid');
@@ -477,27 +508,11 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 checks.push({ name: checkName, ok, detail });
                 continue;
             }
-            const live = await fetchImpl(`${endpoint.origin}/state-dir`, {});
-            if (!live.ok) {
-                detail = `daemon on :${endpoint.port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
-            }
-            else {
-                const auth = await fetchImpl(`${endpoint.origin}/identities`, { headers: endpoint.headers });
-                if (auth.status === 401)
-                    detail = `reachable on :${endpoint.port} but the API token was rejected (401) — ` +
-                        authResolutionHint(endpoint);
-                else if (!auth.ok)
-                    detail = `reachable on :${endpoint.port} but /identities returned HTTP ${auth.status}`;
-                else {
-                    ok = true;
-                    detail = `reachable on :${endpoint.port}, authorized — supervisor wake stream available`;
-                }
-            }
         }
         catch (e) {
-            const target = selected?.endpoint ?? `:${endpoint.port}`;
+            const target = selected.endpoint;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours-daemon start) [${e?.message ?? e}]`;
+                `(check the configured gateway and issued credential) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/erased-resources.d.ts

@@ -0,0 +1,9 @@
+export declare const erasedArg: (value: string) => string;
+export declare function redactErasedContent<T>(value: T): T;
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export declare function writePrivacyFilteredLedger(path: string, value: unknown): void;
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export declare function eraseResourcePresentations(resources: ReadonlyArray<{
+    kind: 'task' | 'room' | 'agent';
+    id: string;
+}>): void;

package/dist/erased-resources.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot } from './paths.js';
+const registryPath = () => join(stateRoot(), 'erased-resources.json');
+const lockPath = () => join(stateRoot(), 'locks', 'audit-erasure');
+const ledgerNames = ['.fleet-command-audit.json', '.owner-channel-command-audit.json', '.owner-channel-lifecycle-outbox.json'];
+export const erasedArg = (value) => `[erased:${createHash('sha256').update(value).digest('hex')}]`;
+function registry() {
+    if (!existsSync(registryPath()))
+        return new Set();
+    const value = JSON.parse(readFileSync(registryPath(), 'utf8'));
+    if (!Array.isArray(value) || value.some(v => typeof v !== 'string'))
+        throw new Error('Invalid erasure registry');
+    return new Set(value);
+}
+/** Preserve delivery/deduplication metadata while removing owned presentation content. */
+function redact(value, erased) {
+    if (Array.isArray(value))
+        return value.map(item => redact(item, erased));
+    if (!value || typeof value !== 'object')
+        return value;
+    const next = { ...value };
+    const kind = value.kind === 'lifecycle_failure' ? value.resource?.toLowerCase() : value.kind === 'agent_started' ? 'agent' : value.kind;
+    if (typeof value.id === 'string' && erased.has(`${kind}:${value.id}`)) {
+        for (const key of ['title', 'reason', 'roomName', 'label', 'template', 'configuration', 'model', 'permissions'])
+            delete next[key];
+        if (kind === 'task')
+            next.agents = [];
+        if (kind === 'room') {
+            delete next.name;
+            next.participants = [];
+        }
+        if (kind === 'agent') {
+            next.name = 'erased';
+            next.brain = '[erased]';
+            next.role = '[erased]';
+            next.inherited = [];
+        }
+    }
+    if (typeof value.roomId === 'string' && erased.has(`room:${value.roomId}`)) {
+        delete next.roomName;
+        if (kind === 'task')
+            next.agents = [];
+    }
+    const resources = value.outcome?.resourceIds;
+    const ownsAttempt = resources && Object.entries(resources).some(([key, id]) => erased.has(`${key}:${id}`));
+    const ownsPresentation = value.outcome?.presentations?.some((p) => erased.has(`${p.kind === 'agent_started' ? 'agent' : p.kind}:${p.id}`));
+    if ((ownsAttempt || ownsPresentation) && Array.isArray(value.argv) && !value.erased) {
+        next.argv = value.argv.map(erasedArg);
+        next.erased = true;
+    }
+    for (const key of Object.keys(next))
+        if (typeof next[key] === 'object')
+            next[key] = redact(next[key], erased);
+    return next;
+}
+export function redactErasedContent(value) { return redact(value, registry()); }
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export function writePrivacyFilteredLedger(path, value) {
+    withSynchronousFileLock(lockPath(), () => replaceFileAtomically(path, JSON.stringify(redact(value, registry())) + '\n'));
+}
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export function eraseResourcePresentations(resources) {
+    withSynchronousFileLock(lockPath(), () => {
+        const erased = registry();
+        for (const resource of resources)
+            erased.add(`${resource.kind}:${resource.id}`);
+        replaceFileAtomically(registryPath(), JSON.stringify([...erased]));
+        for (const root of [join(stateRoot(), 'agents'), join(stateRoot(), 'tmp'), join(stateRoot(), 'recovery', 'temporary')]) {
+            if (!existsSync(root))
+                continue;
+            for (const entry of readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+                for (const name of ledgerNames) {
+                    const path = join(root, entry.name, name);
+                    if (!existsSync(path) || !lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+                        continue;
+                    const old = JSON.parse(readFileSync(path, 'utf8'));
+                    replaceFileAtomically(path, JSON.stringify(redact(old, erased)) + '\n');
+                }
+            }
+        }
+    });
+}