@ours.network/fleet 1.2.0-nightly.7 → 1.2.0-nightly.8

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.7",
-  "buildId": "f5cfd3c1f10c",
-  "commit": "a5d6f736733fa419e6acf7306affb4a662261bbf",
+  "version": "1.2.0-nightly.8",
+  "buildId": "d7d0675388e4",
+  "commit": "cd6d7ee4e2a7afcb77c4a7aaba09c82c8ec162d7",
   "dirty": true,
-  "builtAt": "2026-09-23T20:14:37.547Z",
+  "builtAt": "2026-09-23T20:30:52.283Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/rooms-tasks/archived-absence.d.ts

@@ -0,0 +1,4 @@
+import type { ArchivedMemberAbsence, RoomMemberSeat } from './types.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export declare function verifyArchivedAbsence(proof: ArchivedMemberAbsence): Promise<void>;
+export declare function proveArchivedAbsence(seat: RoomMemberSeat): Promise<ArchivedMemberAbsence>;

package/dist/rooms-tasks/archived-absence.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentDir } from '../paths.js';
+import { tempArchiveForLaunch, tempArchiveForCreationAction, tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { assertMemberIdentityAbsent } from './close.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export async function verifyArchivedAbsence(proof) {
+    const absent = () => {
+        if (existsSync(agentDir(proof.name, true)))
+            throw new Error('Archived member has replacement live state');
+    };
+    absent();
+    const archive = tempArchiveForLaunch(proof.name, proof.launch_id);
+    const action = tempArchiveForCreationAction(proof.name, proof.action_id);
+    if (!archive || archive !== proof.archive_path || action?.path !== archive
+        || action.launchId !== proof.launch_id
+        || readFileSync(join(archive, '.identity'), 'utf8').trim() !== proof.name)
+        throw new Error('Archived member absence ownership proof mismatch');
+    if (await tempSupervisorLiveness(archive) !== 'stopped')
+        throw new Error('Archived member supervisor absence is not proven');
+    await assertMemberIdentityAbsent({
+        role_name: proof.name, slot: 'archived', cowork_role: 'archived', seat_state: 'removed',
+    });
+    absent();
+}
+export async function proveArchivedAbsence(seat) {
+    if (seat.identity_cid || seat.retirement?.phase !== 'identity_absent'
+        || !seat.launch?.launch_id || !seat.launch.action_id
+        || seat.launch.launch_id !== seat.retirement.launch_id || !seat.retirement.archive_path)
+        throw new Error('Missing exact archived member absence evidence');
+    const proof = {
+        name: seat.role_name, launch_id: seat.launch.launch_id, action_id: seat.launch.action_id,
+        archive_path: seat.retirement.archive_path, checked_at: new Date().toISOString(),
+    };
+    await verifyArchivedAbsence(proof);
+    return proof;
+}

package/dist/rooms-tasks/close.d.ts

@@ -20,6 +20,7 @@ export declare function waitForLivenessAbsent(role: string, launchId: string, li
 /** Report whether any daemon identity — under any name — carries this exact CID. */
 export declare function identityCidPresent(cid: string): Promise<boolean>;
 export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
+export declare function assertMemberIdentityAbsent(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;

package/dist/rooms-tasks/close.js

@@ -5,7 +5,7 @@ import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
 import { readClientProfile } from '../client-profile.js';
-import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, tempArchiveForLaunch, tempArchiveForCreationAction, } from '../temp-lifecycle.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
 import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
 const CLOSE_LOCK_STALE_MS = 5 * 60_000;
@@ -119,7 +119,7 @@ export async function removeExactMemberIdentity(seat) {
         }
     });
 }
-async function assertMemberIdentityAbsent(seat) {
+export async function assertMemberIdentityAbsent(seat) {
     await withIdentityClient(async (client) => {
         const rows = await client.listIdentities();
         if (rows.some(row => row.name === seat.role_name ||
@@ -141,6 +141,27 @@ async function retireMember(roomId, seat, deps) {
         return;
     }
     if (!retirement) {
+        if (!existsSync(agentDir(current.role_name, true)) && current.launch?.launch_id && current.launch.action_id) {
+            const archived = tempArchiveForLaunch(current.role_name, current.launch.launch_id);
+            const created = tempArchiveForCreationAction(current.role_name, current.launch.action_id);
+            if (archived && created?.path === archived && created.launchId === current.launch.launch_id) {
+                if (readFileSync(join(archived, '.identity'), 'utf8').trim() !== current.role_name)
+                    throw new Error(`room member '${current.role_name}' archive identity mismatch`);
+                if (await tempSupervisorLiveness(archived) !== 'stopped')
+                    throw new Error(`room member '${current.role_name}' archived supervisor is not proven stopped`);
+                // A terminated launch can archive itself before room retirement begins.
+                // Accept its exact durable provenance only when no identity needs removal.
+                await assertMemberIdentityAbsent(current);
+                const latest = getRoomRecord(roomId)?.member_seats.find(seat => seat.role_name === current.role_name);
+                if (existsSync(agentDir(current.role_name, true))
+                    || latest?.launch?.launch_id !== current.launch.launch_id
+                    || latest?.launch?.action_id !== current.launch.action_id
+                    || latest?.identity_cid !== current.identity_cid)
+                    throw new Error(`room member '${current.role_name}' changed during archived retirement proof`);
+                advanceMemberRetirement(roomId, current.role_name, 'identity_absent', current.launch.launch_id, archived);
+                return;
+            }
+        }
         if (current.launch?.state === 'failed' && !existsSync(agentDir(current.role_name, true))) {
             // A failure before applyRole (for example invite-secret validation) has
             // no supervisor to stop or archive. Settle only proven absence; this

package/dist/rooms-tasks/deletion.js

@@ -1,3 +1,4 @@
+import { proveArchivedAbsence, verifyArchivedAbsence } from './archived-absence.js';
 import { existsSync } from 'node:fs';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir } from '../paths.js';
@@ -145,10 +146,30 @@ export async function settleTaskDeletion(input) {
                 upsertTaskDeletionMembersFromSeats(taskId, record.member_seats);
                 await closeManagedRoom({ roomId: record.room_id, cowork: cowork, deps: deps.roomClose });
                 const closed = getRoomRecord(record.room_id);
-                importTaskDeletionRetirementEvidence(taskId, closed?.member_seats ?? record.member_seats);
+                const seats = closed?.member_seats ?? record.member_seats;
+                const proofs = [];
+                for (const seat of seats) {
+                    if (!seat.identity_cid && seat.retirement?.launch_id !== 'never-launched')
+                        proofs.push(await proveArchivedAbsence(seat));
+                }
+                // No await between the last live-state fence and durable checkpoint.
+                for (const proof of proofs) {
+                    const latest = getRoomRecord(record.room_id)?.member_seats.find(seat => seat.role_name === proof.name);
+                    if (existsSync(agentDir(proof.name, true)) || latest?.identity_cid
+                        || latest?.launch?.launch_id !== proof.launch_id || latest.launch.action_id !== proof.action_id)
+                        throw new Error('Archived absence seat changed before checkpoint');
+                }
+                importTaskDeletionRetirementEvidence(taskId, seats, proofs);
                 await cowork.deleteRoom(record.room_id);
+                for (const proof of proofs)
+                    await verifyArchivedAbsence(proof);
+                for (const proof of proofs)
+                    if (existsSync(agentDir(proof.name, true)))
+                        throw new Error('Archived member replacement before room unlink');
                 deleteRoomRecord(record.room_id);
             }
+            for (const proof of getDeletingTask(taskId).deletion.archived_absences ?? [])
+                await verifyArchivedAbsence(proof);
             // Members whose room record is gone (crash after record deletion, or
             // legacy state): resume from the durable cursors.
             for (const cursor of getDeletingTask(taskId).deletion.members) {
@@ -176,7 +197,7 @@ export async function settleTaskDeletion(input) {
         completeTaskDeletionReceipt(taskId);
         return { task_id: taskId, deleted: false };
     }
-    const finalize = () => withFileLock(taskOperationLockPath(taskId), () => {
+    const finalize = () => withFileLock(taskOperationLockPath(taskId), async () => {
         try {
             const task = getDeletingTask(taskId);
             if (task.deletion?.status !== 'pending')
@@ -185,6 +206,11 @@ export async function settleTaskDeletion(input) {
                 throw new TaskStateError(`task ${taskId} room records reappeared during deletion finalization`);
             if (task.deletion.members.some(member => member.phase !== 'identity_absent'))
                 throw new TaskStateError(`task ${taskId} has unretired members at deletion finalization`);
+            for (const proof of task.deletion.archived_absences ?? [])
+                await verifyArchivedAbsence(proof);
+            for (const proof of task.deletion.archived_absences ?? [])
+                if (existsSync(agentDir(proof.name, true)))
+                    throw new Error('Archived member replacement before task unlink');
             if (cleanup.snapshotHash)
                 releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
             unlinkDeletedTask(taskId);

package/dist/rooms-tasks/task-state.d.ts

@@ -1,3 +1,4 @@
+import type { ArchivedMemberAbsence } from './types.js';
 import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
@@ -74,6 +75,7 @@ export interface TaskDeletionReceipt {
     original_state: TaskState;
     room_id?: string;
     member_count: number;
+    archived_absences?: ArchivedMemberAbsence[];
     settled_at?: string;
     result?: 'deleted';
 }
@@ -122,6 +124,10 @@ export declare function advanceTaskDeletionMember(id: string, name: string, phas
 interface SeatEvidence {
     role_name: string;
     identity_cid?: string;
+    launch?: {
+        launch_id?: string;
+        action_id?: string;
+    };
     retirement?: {
         phase: TaskDeletionMemberPhase;
         launch_id: string;
@@ -146,10 +152,10 @@ export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: Re
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>, proofs?: ReadonlyArray<ArchivedMemberAbsence>): TaskRecord;
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing

package/dist/rooms-tasks/task-state.js

@@ -505,7 +505,8 @@ function writeDeletionReceiptForIntent(stored) {
         actor: deletion.actor,
         original_state: stored.state,
         room_id: deletion.room_id,
-        member_count: deletion.members.length,
+        member_count: deletion.members.length + (deletion.archived_absences?.length ?? 0),
+        ...(deletion.archived_absences?.length ? { archived_absences: deletion.archived_absences } : {}),
     };
     replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
 }
@@ -688,10 +689,10 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export function importTaskDeletionRetirementEvidence(id, seats) {
+export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
         const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
@@ -708,6 +709,18 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             if (!seat.identity_cid) {
                 if (neverLaunched)
                     continue; // provably never held a managed identity
+                const proof = proofs.find(value => value.name === seat.role_name);
+                if (proof && proof.launch_id === evidence.launch_id && proof.archive_path === evidence.archive_path
+                    && proof.launch_id === seat.launch?.launch_id && proof.action_id === seat.launch?.action_id) {
+                    const existing = stored.deletion.archived_absences?.find(value => value.name === proof.name);
+                    if (existing && (existing.launch_id !== proof.launch_id || existing.action_id !== proof.action_id
+                        || existing.archive_path !== proof.archive_path))
+                        throw new TaskStateError('Archived absence checkpoint ownership is immutable');
+                    stored.deletion.archived_absences ??= [];
+                    if (!existing)
+                        stored.deletion.archived_absences.push({ ...proof });
+                    continue;
+                }
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
             }
             let cursor = findCursorForSeat(id, stored, seat);
@@ -729,6 +742,7 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             cursor.updated_at = now;
         }
         writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
         return presentTaskLenient(stored);
     });
 }

package/dist/rooms-tasks/types.d.ts

@@ -73,6 +73,13 @@ export interface TaskDeletionMemberCursor {
  * evidence. While pending, the task is hidden from normal operation and every
  * lifecycle mutation or room publication is rejected.
  */
+export interface ArchivedMemberAbsence {
+    name: string;
+    launch_id: string;
+    action_id: string;
+    archive_path: string;
+    checked_at: string;
+}
 export interface TaskDeletionIntent {
     status: 'pending';
     accepted_at: string;
@@ -80,6 +87,7 @@ export interface TaskDeletionIntent {
     room_id?: string;
     /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
     members: TaskDeletionMemberCursor[];
+    archived_absences?: ArchivedMemberAbsence[];
     error?: string;
     error_at?: string;
     recovery_hint?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.7",
+  "version": "1.2.0-nightly.8",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",