@ours.network/fleet 1.2.0-nightly.80 → 1.2.0-nightly.81

package/dist/rooms-tasks/task-state.js

@@ -1,8 +1,9 @@
 import { publishFleetResourceCommit } from '../application/resource-observer.js';
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
+import { existsSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { replaceFileAtomically } from '../atomic-file.js';
+import { replaceFileAtomically, withSynchronousFileLock } from '../atomic-file.js';
+import { incarnationEnded, processIncarnation } from '../process-incarnation.js';
 import { stateRoot } from '../paths.js';
 import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
@@ -11,56 +12,125 @@ export const tasksDir = () => join(stateRoot(), 'tasks');
 function taskPath(id) { return join(tasksDir(), `${id}.json`); }
 function taskLockPath(id) { return join(tasksDir(), '.locks', id); }
 const localTaskLocks = new Set();
+/**
+ * Remove a lock atomically: rename it to a unique name first, so no other
+ * process ever observes a half-removed lock.
+ */
+function retireLock(path) {
+    const retired = `${path}.retired.${process.pid}.${randomUUID()}`;
+    try {
+        renameSync(path, retired);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    rmSync(retired, { recursive: true, force: true });
+}
+/** A legacy lock directory without an owner file younger than this may still be releasing. */
+const LEGACY_OWNERLESS_LOCK_GRACE_MS = 5_000;
+/**
+ * Hold a task's cross-process lock while `fn` runs.
+ *
+ * The lock is a file holding its owner record, published complete by hard-linking
+ * a written temporary file: link never replaces an existing lock, and there is no
+ * moment at which a live claimer has an ownerless lock that could look abandoned.
+ * A lock is reclaimed only when its owner process has provably ended; reclaimers
+ * take turns and remove only the lock they observed. Directory locks are left by
+ * earlier versions; they are honored, and an ownerless one is reclaimed once it is
+ * old enough, since this version never creates one.
+ */
 function withTaskLock(id, fn) {
     if (localTaskLocks.has(id))
         return fn();
     const path = taskLockPath(id);
-    const ownerPath = join(path, 'owner.json');
     const token = randomUUID();
     mkdirSync(join(tasksDir(), '.locks'), { recursive: true });
-    for (;;) {
-        const claimPath = `${path}.claim.${process.pid}.${randomUUID()}`;
+    const readOwner = () => {
         try {
-            mkdirSync(claimPath);
-            writeFileSync(join(claimPath, 'owner.json'), JSON.stringify({ token, pid: process.pid }));
-            renameSync(claimPath, path);
-            break;
+            return JSON.parse(readFileSync(path, 'utf8'));
         }
         catch (error) {
-            rmSync(claimPath, { recursive: true, force: true });
-            if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
-                throw error;
+            if (error.code !== 'EISDIR')
+                return undefined;
+            try {
+                return JSON.parse(readFileSync(join(path, 'owner.json'), 'utf8'));
+            }
+            catch {
+                return undefined;
+            }
+        }
+    };
+    /** Who holds the lock now, and whether it can be proved abandoned. */
+    const holder = () => {
+        let stat;
+        try {
+            stat = lstatSync(path);
+        }
+        catch {
+            return undefined;
+        }
+        const owner = readOwner();
+        if (owner && typeof owner.pid === 'number') {
             let alive = false;
             try {
-                const owner = JSON.parse(readFileSync(ownerPath, 'utf8'));
-                if (typeof owner.pid === 'number') {
-                    try {
-                        process.kill(owner.pid, 0);
-                        alive = true;
-                    }
-                    catch { /* dead */ }
-                }
+                process.kill(owner.pid, 0);
+                alive = true;
+            }
+            catch (error) {
+                alive = error.code !== 'ESRCH';
             }
-            catch { /* corrupt legacy lock */ }
-            if (!alive) {
-                rmSync(path, { recursive: true, force: true });
+            return { token: owner.token, stale: !alive || incarnationEnded(owner.pid, owner) };
+        }
+        return {
+            token: undefined,
+            stale: stat.isDirectory() && Date.now() - stat.mtimeMs > LEGACY_OWNERLESS_LOCK_GRACE_MS,
+        };
+    };
+    const claimPath = `${path}.claim.${process.pid}.${randomUUID()}`;
+    writeFileSync(claimPath, JSON.stringify({ token, pid: process.pid, ...processIncarnation(process.pid) }));
+    try {
+        for (;;) {
+            try {
+                linkSync(claimPath, path);
+                break;
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+            const observed = holder();
+            if (observed?.stale) {
+                try {
+                    withSynchronousFileLock(`${path}.reclaim`, () => {
+                        const current = holder();
+                        if (current?.stale && current.token === observed.token)
+                            retireLock(path);
+                    });
+                }
+                catch (error) {
+                    // A contender stalled inside the reclaim section: keep waiting like any other poll.
+                    if (!(error instanceof Error) || !/^Timed out acquiring synchronous/.test(error.message))
+                        throw error;
+                }
                 continue;
             }
             Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
         }
     }
+    finally {
+        rmSync(claimPath, { force: true });
+    }
     localTaskLocks.add(id);
     try {
         return fn();
     }
     finally {
         localTaskLocks.delete(id);
-        try {
-            const owner = JSON.parse(readFileSync(ownerPath, 'utf8'));
-            if (owner.token === token)
-                rmSync(path, { recursive: true, force: true });
-        }
-        catch { /* ownership cannot be proved */ }
+        // Only this live owner removes its lock; reclaimers never take a live owner's lock.
+        if (readOwner()?.token === token)
+            retireLock(path);
     }
 }
 function generateTaskId() {
@@ -985,6 +1055,22 @@ export function updateTaskLayout(id, expected, next) {
         return { task: readTask(id), ...(releasedSnapshot ? { releasedSnapshot } : {}) };
     });
 }
+/**
+ * Progress and To review edits: one read-modify-write under the task lock, so
+ * concurrent writers never lose each other's changes. Lifecycle state is untouched.
+ */
+export function updateTaskContribution(id, change) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        assertNoPendingTerminalIntent(task);
+        const { value, changed } = change(task);
+        if (changed)
+            writeTask(task);
+        return value;
+    });
+}
 export function updateTaskBrief(id, brief, expectedBrief) {
     assertCanonicalTaskId(id);
     return withTaskLock(id, () => {

package/dist/rooms-tasks/task-tools.d.ts

@@ -0,0 +1,35 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { publicProgressEntry } from './task-review.js';
+import type { TaskContributionAuthor, TaskProgressEntry } from './types.js';
+/** The task this agent belongs to, from supervisor launch records; never from tool arguments. */
+export interface TaskToolBinding {
+    taskId: string;
+    role: string;
+    identityCid?: string;
+    /** Launched as a task-owned temporary member (layout participant). */
+    taskOwned: boolean;
+}
+export declare const TASK_TOOL_NAMES: readonly ["fleet_task_progress_list", "fleet_task_progress_append", "fleet_task_review_show", "fleet_task_review_set", "fleet_task_review_detach"];
+export declare const PROGRESS_PAGE_MAX = 50;
+/** One chronological page of the log; `next_after` continues after the last returned entry. */
+export declare function progressPage(entries: TaskProgressEntry[], input: {
+    after?: string;
+    limit?: number;
+}): {
+    progress: ReturnType<typeof publicProgressEntry>[];
+    total: number;
+    next_after?: string;
+};
+/**
+ * Confirm the binding against the task record: a listed member must match by
+ * name and identity; an unlisted caller must be a task-owned launch.
+ */
+export declare function verifiedTaskAuthor(binding: TaskToolBinding): TaskContributionAuthor;
+/**
+ * Task Progress and To review tools on the agent's own managed MCP endpoint.
+ * The task and author come from the caller's supervisor, so an agent can only
+ * read and write the task it was launched for. Review files are attached with
+ * `ours-fleet task review-package <id> --attach <path>`, which reads the file
+ * under the agent's own permissions.
+ */
+export declare function registerTaskTools(server: McpServer, binding: () => TaskToolBinding | undefined, admit: () => Promise<() => void>): void;

package/dist/rooms-tasks/task-tools.js

@@ -0,0 +1,134 @@
+import { z } from 'zod';
+import { appendTaskProgress, detachTaskReviewArtifact, getTaskReview, listTaskProgress, publicProgressEntry, publicReview, setTaskReviewMarkdown, TaskReviewError, PROGRESS_TEXT_MAX, REVIEW_MARKDOWN_MAX, } from './task-review.js';
+import { getTask, TaskStateError } from './task-state.js';
+export const TASK_TOOL_NAMES = Object.freeze([
+    'fleet_task_progress_list', 'fleet_task_progress_append',
+    'fleet_task_review_show', 'fleet_task_review_set', 'fleet_task_review_detach',
+]);
+/** Compact JSON: a result is carried twice (text and structured) inside one bounded bridge frame. */
+function result(value) {
+    return {
+        content: [{ type: 'text', text: JSON.stringify(value) }],
+        structuredContent: value,
+        isError: false,
+    };
+}
+export const PROGRESS_PAGE_MAX = 50;
+/** Serialized entry bytes per page, well inside the bridge's frame limit even at maximal escaping. */
+const PROGRESS_PAGE_BYTES = 200_000;
+/** One chronological page of the log; `next_after` continues after the last returned entry. */
+export function progressPage(entries, input) {
+    const limit = input.limit ?? PROGRESS_PAGE_MAX;
+    if (!Number.isInteger(limit) || limit < 1 || limit > PROGRESS_PAGE_MAX)
+        throw new TaskReviewError('invalid_request', `limit must be 1..${PROGRESS_PAGE_MAX}`);
+    let start = 0;
+    if (input.after !== undefined) {
+        start = entries.findIndex(entry => entry.id === input.after) + 1;
+        if (!start)
+            throw new TaskReviewError('invalid_request', 'after must be the id of an entry in this log');
+    }
+    const page = [];
+    let bytes = 0;
+    for (const entry of entries.slice(start, start + limit)) {
+        const visible = publicProgressEntry(entry), size = Buffer.byteLength(JSON.stringify(visible));
+        if (page.length && bytes + size > PROGRESS_PAGE_BYTES)
+            break;
+        page.push(visible);
+        bytes += size;
+    }
+    const end = start + page.length;
+    return { progress: page, total: entries.length, ...(end < entries.length ? { next_after: entries[end - 1].id } : {}) };
+}
+function failure(code, message) {
+    return { content: [{ type: 'text', text: JSON.stringify({ error: code, message }) }], isError: true };
+}
+/**
+ * Confirm the binding against the task record: a listed member must match by
+ * name and identity; an unlisted caller must be a task-owned launch.
+ */
+export function verifiedTaskAuthor(binding) {
+    const task = getTask(binding.taskId);
+    const member = task.member_roles.find(item => item.name === binding.role);
+    if (member ? (binding.identityCid && member.identity_cid !== binding.identityCid) : !binding.taskOwned)
+        throw new TaskReviewError('conflict', `agent ${binding.role} is not a member of task ${binding.taskId}`);
+    return { kind: 'agent', role: binding.role, ...(binding.identityCid ? { identity_cid: binding.identityCid } : {}), surface: 'mcp' };
+}
+/**
+ * Task Progress and To review tools on the agent's own managed MCP endpoint.
+ * The task and author come from the caller's supervisor, so an agent can only
+ * read and write the task it was launched for. Review files are attached with
+ * `ours-fleet task review-package <id> --attach <path>`, which reads the file
+ * under the agent's own permissions.
+ */
+export function registerTaskTools(server, binding, admit) {
+    const run = async (operation) => {
+        let release;
+        try {
+            release = await admit();
+        }
+        catch {
+            return failure('runtime_not_ready', 'the managed runtime is not admitting tool calls right now; nothing was read or changed');
+        }
+        try {
+            const bound = binding();
+            if (!bound)
+                return failure('task_unavailable', 'this agent was not launched for a Fleet task');
+            try {
+                return result(operation(bound, verifiedTaskAuthor(bound)));
+            }
+            catch (error) {
+                if (error instanceof TaskReviewError)
+                    return failure(error.code, error.message);
+                if (error instanceof TaskStateError)
+                    return failure('task_unavailable', error.message);
+                return failure('task_store_failed', 'the task could not be read or updated; nothing was changed');
+            }
+        }
+        finally {
+            release();
+        }
+    };
+    server.registerTool('fleet_task_progress_list', {
+        description: 'Read the Progress milestone log of the task you were launched for, oldest first, one page at a time. '
+            + 'When next_after is present, call again with after set to it for the following entries.',
+        inputSchema: {
+            after: z.string().optional().describe('Entry id from the previous page\'s next_after; omit for the first page.'),
+            limit: z.number().int().optional().describe(`Maximum entries per page (1..${PROGRESS_PAGE_MAX}, default ${PROGRESS_PAGE_MAX}). Pages are also bounded in size.`),
+        },
+    }, async (args) => run(bound => ({ task_id: bound.taskId, ...progressPage(listTaskProgress(bound.taskId), args) })));
+    server.registerTool('fleet_task_progress_append', {
+        description: 'Append ONE significant, verified milestone to your task\'s Progress log (e.g. root cause found, PR opened with link, '
+            + 'measured result with its scope, final deliverable ready). Not for routine status, handoffs or review chatter. '
+            + 'Entries are permanent and shown to the Owner as written. Repeating a call with the same request_key and text returns the original entry.',
+        inputSchema: {
+            text: z.string().describe(`Free-form milestone text, kept exactly as written (max ${PROGRESS_TEXT_MAX} characters).`),
+            request_key: z.string().optional().describe('Stable key for this milestone so a retried call cannot add it twice (e.g. "pr-opened-123").'),
+        },
+    }, async (args) => run((bound, author) => {
+        const appended = appendTaskProgress(bound.taskId, { text: args.text, requestKey: args.request_key, author });
+        return { task_id: bound.taskId, entry: publicProgressEntry(appended.entry), replayed: appended.replayed };
+    }));
+    server.registerTool('fleet_task_review_show', {
+        description: 'Read your task\'s To review package: its Markdown and the retained files attached to it.',
+        inputSchema: {},
+    }, async () => run(bound => {
+        const review = getTaskReview(bound.taskId);
+        return { task_id: bound.taskId, review: review ? publicReview(review) : null };
+    }));
+    server.registerTool('fleet_task_review_set', {
+        description: 'Replace the Markdown of your task\'s To review package: the self-contained material the Owner reviews without reading the room or task description '
+            + '(outcome, clickable PR/spec links, validation and CI, independent verdict, limits, decisions needed). '
+            + 'Pass the Markdown you last read as expected_markdown ("" when empty); a concurrent change is refused instead of overwritten.',
+        inputSchema: {
+            markdown: z.string().describe(`Review Markdown (max ${REVIEW_MARKDOWN_MAX} characters). Links use the same safe rules as task descriptions.`),
+            expected_markdown: z.string().describe('The current Markdown as you last read it, or "" if there is none.'),
+        },
+    }, async (args) => run((bound, author) => ({
+        task_id: bound.taskId,
+        review: publicReview(setTaskReviewMarkdown(bound.taskId, { markdown: args.markdown, expectedMarkdown: args.expected_markdown, author })),
+    })));
+    server.registerTool('fleet_task_review_detach', {
+        description: 'Remove one file from your task\'s To review package by artifact_id (from fleet_task_review_show).',
+        inputSchema: { artifact_id: z.string() },
+    }, async (args) => run((bound, author) => ({ task_id: bound.taskId, detached: detachTaskReviewArtifact(bound.taskId, args.artifact_id, { author }) })));
+}

package/dist/rooms-tasks/types.d.ts

@@ -116,7 +116,50 @@ export interface TaskNotificationEvent {
     };
     taskId: string;
 }
+/** Who wrote a progress entry or review change, as established by the Fleet surface. */
+export type TaskContributionAuthor = {
+    kind: 'agent';
+    role: string;
+    identity_cid?: string;
+    surface: 'mcp' | 'cli';
+} | {
+    kind: 'local_control';
+    surface: 'cli' | 'web';
+};
+/** One append-only milestone; text is stored exactly as authored. */
+export interface TaskProgressEntry {
+    id: string;
+    at: string;
+    author: TaskContributionAuthor;
+    text: string;
+    /** Caller retry key, scoped to the author. */
+    request_key?: string;
+}
+/** Metadata of a retained review file; bytes live in Fleet's private task review store. */
+export interface TaskReviewArtifact {
+    id: string;
+    name: string;
+    mime: string;
+    size: number;
+    sha256: string;
+    added_at: string;
+    added_by: TaskContributionAuthor;
+    request_key?: string;
+}
+/** Self-contained material the Owner reviews: Markdown plus retained files. */
+export interface TaskReview {
+    /** Increases with every change to the Markdown or the files; absent on packages written before it. */
+    revision?: number;
+    markdown: string;
+    updated_at: string;
+    updated_by: TaskContributionAuthor;
+    artifacts: TaskReviewArtifact[];
+}
 export interface TaskRecord {
+    /** Optional milestone log; absent on tasks that never recorded one. */
+    progress?: TaskProgressEntry[];
+    /** Optional To review package; absent until an agent prepares it. */
+    review?: TaskReview;
     /** Pending lifecycle events, committed atomically with their task change. */
     notification_events?: TaskNotificationEvent[];
     workspace?: import('./workspace.js').OwnedWorkspace;

package/dist/web/resource-views.js

@@ -291,9 +291,10 @@ export class FleetResourceViews {
         void initial.catch(() => { });
         const controller = new AbortController();
         const source = connection.observer.cursor(path => this.affects(descriptor, path), controller.signal);
-        // Independent agents contribute ordered, last-observed statuses. Their
-        // ledger commits wake the view but do not revoke its structural capture.
-        const captureSource = descriptor.resource === 'directory' || descriptor.resource === 'roles'
+        // Independent agents contribute ordered, last-observed statuses and completed
+        // preview records. Activity wakes follow-up reads without revoking structural
+        // capture; the read still certifies only its starting source watermark.
+        const captureSource = descriptor.resource === 'directory' || descriptor.resource === 'roles' || descriptor.resource === 'previews'
             ? connection.observer.cursor(path => this.affects(descriptor, path, true), controller.signal)
             : source;
         const view = { source, captureSource, scheduledPosition: -1, descriptor, epoch, baselineId: randomUUID(), controller, revision: 0, sequence: 0, dirty: false, running: false, failed: false, initial, resolveInitial, rejectInitial };
@@ -406,8 +407,15 @@ export class FleetResourceViews {
                 continue;
             if (structural && (descriptor.resource === 'directory' || descriptor.resource === 'roles'))
                 return false;
-            if (descriptor.resource === 'previews')
+            if (descriptor.resource === 'previews') {
+                // conversationPreview reads bounded completed records, independently per
+                // role. These known writer paths still wake ordered follow-up captures.
+                // Unknown children, parent replacement and explicit config paths retain
+                // their capture fence; do not waive the whole conversation subtree.
+                if (structural && parts.length === 3 && /^(?:events-\d{6}\.jsonl|manifest\.json)$/.test(parts[2]))
+                    return false;
                 return (descriptor.ids ?? []).includes(parts[0]);
+            }
             // Directory and roles intentionally remain conservative: live status
             // includes activity. Configuration was classified by its inputs above.
         }

package/dist/web/server.js

@@ -26,6 +26,7 @@ import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { TaskStateError } from '../rooms-tasks/task-state.js';
+import { appendTaskProgress, getTaskReview, listTaskProgress, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
 import { isProvider } from '../subscriptions/store.js';
 const ONBOARDING_WORK = ['coordination', 'development', 'review'];
 const statusFor = (code) => ({
@@ -189,7 +190,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     app.get('/api/v1/meta', async (request) => {
         auth.authenticate(request);
         return {
-            version: VERSION, api: { major: 1, minor: 0 },
+            version: VERSION, api: { major: 1, minor: 1 },
             websocketProtocols: [
                 'ours-fleet-events.v1', 'ours-fleet-conversation.v1',
             ],
@@ -327,6 +328,31 @@ export async function buildWebServer(services, boundary, options = {}) {
             throw error;
         }
     };
+    const reviewApi = async (fn) => taskApi(async () => {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            if (error instanceof TaskReviewError) {
+                const code = error.code === 'not_found' ? 'resource_not_found' : error.code === 'limit_exceeded' ? 'conflict' : error.code;
+                throw new FleetError(code, error.message);
+            }
+            if (error instanceof TaskStateError && error.message.startsWith('invalid task ID'))
+                throw new FleetError('resource_not_found', 'task not found');
+            throw error;
+        }
+    });
+    /** Browser task payloads carry Progress/To review counts; bodies have their own routes. */
+    const wireTask = (task) => {
+        const { progress: _progress, review: _review, ...rest } = task;
+        return { ...rest, ...taskContributionSummary(task) };
+    };
+    const wireTaskResult = (result) => {
+        const value = result;
+        if (value && typeof value === 'object' && value.task && typeof value.task === 'object')
+            return { ...value, task: wireTask(value.task) };
+        return result;
+    };
     const requireTaskRooms = () => {
         if (!services.taskRooms)
             throw new FleetError('capability_unavailable', 'task operations are unavailable');
@@ -345,8 +371,8 @@ export async function buildWebServer(services, boundary, options = {}) {
             ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) };
         const api = requireTaskRooms();
         return taskApi(() => query.groupByList === 'true'
-            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => api.withLayoutRooms(task)) })) }
-            : { tasks: api.listTasks(filter).map(task => api.withLayoutRooms(task)) });
+            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => wireTask(api.withLayoutRooms(task))) })) }
+            : { tasks: api.listTasks(filter).map(task => wireTask(api.withLayoutRooms(task))) });
     };
     const project = async (descriptor, signal, owner = '') => {
         signal.throwIfAborted();
@@ -551,27 +577,70 @@ export async function buildWebServer(services, boundary, options = {}) {
             origin: { type: 'web' },
         }));
         reply.code(201);
-        return { task };
+        return { task: wireTask(task) };
     });
     app.patch('/api/v1/tasks/:id/list', async (request) => {
         auth.authenticate(request, true);
         const taskId = request.params.id;
         const list = String(request.body?.list ?? '');
-        return { task: await taskApi(() => requireTaskRooms().moveTask({ actor: { kind: 'local_control', surface: 'web' }, taskId, list })) };
+        return { task: wireTask(await taskApi(() => requireTaskRooms().moveTask({ actor: { kind: 'local_control', surface: 'web' }, taskId, list }))) };
     });
     app.patch('/api/v1/tasks/:id/description', async (request) => {
         auth.authenticate(request, true);
         const body = request.body;
         if (typeof body?.brief !== 'string' || typeof body.expectedBrief !== 'string' || body.brief.length > 100_000)
             throw new FleetError('invalid_request', 'brief and expectedBrief must be strings; brief maximum is 100000 characters');
-        return { task: await taskApi(() => requireTaskRooms().editTaskDescription({
+        return { task: wireTask(await taskApi(() => requireTaskRooms().editTaskDescription({
                 actor: { kind: 'local_control', surface: 'web' }, taskId: request.params.id,
                 brief: body.brief, expectedBrief: body.expectedBrief,
-            })) };
+            }))) };
     });
     app.get('/api/v1/tasks/:id', async (request) => {
         auth.authenticate(request);
-        return taskApi(() => requireTaskRooms().getTask(request.params.id));
+        return wireTaskResult(await taskApi(() => requireTaskRooms().getTask(request.params.id)));
+    });
+    app.get('/api/v1/tasks/:id/progress', async (request) => {
+        auth.authenticate(request);
+        return { progress: (await reviewApi(() => listTaskProgress(request.params.id))).map(publicProgressEntry) };
+    });
+    app.post('/api/v1/tasks/:id/progress', async (request, reply) => {
+        auth.authenticate(request, true);
+        const body = request.body;
+        const header = request.headers['idempotency-key'];
+        const requestKey = typeof body?.requestKey === 'string' ? body.requestKey : typeof header === 'string' ? header : undefined;
+        if (typeof body?.text !== 'string' || (body.requestKey !== undefined && typeof body.requestKey !== 'string'))
+            throw new FleetError('invalid_request', 'text must be a string; requestKey, when given, a string');
+        const result = await reviewApi(() => appendTaskProgress(request.params.id, {
+            text: body.text, requestKey, author: { kind: 'local_control', surface: 'web' },
+        }));
+        if (!result.replayed)
+            reply.code(201);
+        return { entry: publicProgressEntry(result.entry), replayed: result.replayed };
+    });
+    app.get('/api/v1/tasks/:id/review', async (request) => {
+        auth.authenticate(request);
+        const review = await reviewApi(() => getTaskReview(request.params.id));
+        return { review: review ? publicReview(review) : null };
+    });
+    app.put('/api/v1/tasks/:id/review', async (request) => {
+        auth.authenticate(request, true);
+        const body = request.body;
+        if (typeof body?.markdown !== 'string' || typeof body.expectedMarkdown !== 'string')
+            throw new FleetError('invalid_request', 'markdown and expectedMarkdown must be strings');
+        const review = await reviewApi(() => setTaskReviewMarkdown(request.params.id, {
+            markdown: body.markdown, expectedMarkdown: body.expectedMarkdown,
+            author: { kind: 'local_control', surface: 'web' },
+        }));
+        return { review: publicReview(review) };
+    });
+    app.get('/api/v1/tasks/:id/review/artifacts/:artifactId', async (request, reply) => {
+        auth.authenticate(request);
+        const { artifact, bytes } = await reviewApi(() => readTaskReviewArtifact(request.params.id, request.params.artifactId));
+        reply.header('Cache-Control', 'private, no-store');
+        reply.header('X-Content-Type-Options', 'nosniff');
+        reply.header('Content-Security-Policy', "default-src 'none'; sandbox");
+        reply.header('Content-Disposition', `attachment; filename*=UTF-8''${encodeURIComponent(artifact.name).replace(/'/g, '%27')}`);
+        return reply.type('application/octet-stream').send(bytes);
     });
     app.post('/api/v1/tasks/:id/members', async (request, reply) => {
         auth.authenticate(request, true);
@@ -601,7 +670,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         const task = await taskApi(() => requireTaskRooms().setTaskLayout({ actor: { kind: 'local_control', surface: 'web' },
             taskId: request.params.id, layout: body.layout, expectedLayout: body.expectedLayout }));
         await audit.record({ requestId: request.id, browser: session.id, action: 'task.layout.set', result: 'succeeded' });
-        return { task: requireTaskRooms().withLayoutRooms(task) };
+        return { task: wireTask(requireTaskRooms().withLayoutRooms(task)) };
     });
     app.get('/api/v1/tasks/:id/layout', async (request) => {
         auth.authenticate(request);
@@ -673,7 +742,7 @@ export async function buildWebServer(services, boundary, options = {}) {
             const body = (request.body ?? {});
             const input = { actor: { kind: 'local_control', surface: 'web' }, taskId };
             const api = requireTaskRooms();
-            return taskApi(async () => {
+            return wireTaskResult(await taskApi(async () => {
                 switch (action) {
                     case 'start': {
                         // A task's layout can be chosen or changed but never removed, so this check cannot go stale.
@@ -701,7 +770,7 @@ export async function buildWebServer(services, boundary, options = {}) {
                         return { task, pending };
                     }
                 }
-            });
+            }));
         });
     }
     app.get('/api/v1/configuration/provenance', async (request) => {