@ours.network/fleet 2.2.6 → 2.3.1

package/dist/rooms-tasks/types.d.ts

@@ -174,6 +174,15 @@ export interface TaskRecord {
     notification_manifest?: import('./notification-manifest.js').TaskNotificationManifest;
     workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
+    /**
+     * Immutable human mission key (`MSN-1`), issued once from a durable
+     * per-prefix high-water mark. Absent only before the one-time migration.
+     */
+    key?: string;
+    /** Set when the key was backfilled for a task that existed before mission keys. */
+    key_from_migration?: true;
+    /** Durable per-mission agent name allocations; absent until first allocation or migration. */
+    member_naming?: MemberNaming;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
     list_id: string;
     /** Derived presentation field; repositories must never persist it. */
@@ -211,9 +220,30 @@ export interface TaskRecord {
     terminal_intent?: TaskTerminalIntent;
     deletion?: TaskDeletionIntent;
 }
+/**
+ * Role-scoped agent names: `<KEY>-<Stem>` for the first member of a stem,
+ * `<KEY>-<Stem>-<n>` (n >= 2) after it. Counters only grow; an allocation is
+ * reused by provisioning, recovery and restart, never by a replacement.
+ */
+export interface MemberNameAllocation {
+    name: string;
+    /** Counter bucket: the case-folded truncated stem. Absent on frozen legacy names. */
+    bucket?: string;
+    ordinal?: number;
+    label_source?: 'role_override' | 'template_ref' | 'room_role' | 'participant_key' | 'slot' | 'fallback';
+    /** A historical name kept exactly as launched before mission keys existed. */
+    frozen?: true;
+}
+export interface MemberNaming {
+    version: 2;
+    counters: Record<string, number>;
+    allocations: Record<string, MemberNameAllocation>;
+}
 export interface TaskListRecord {
     list_id: string;
     name: string;
+    /** Prefix for new mission keys; absent only before the one-time key migration. */
+    prefix?: string;
     built_in: boolean;
     created_at: string;
 }
@@ -387,6 +417,8 @@ export interface TemplateSnapshotMember extends TemplateMemberSlot {
         id: string;
         hash: string;
     };
+    /** Named Role of the member's Agent Template, sealed at plan time for agent naming. */
+    role_label?: string;
 }
 export interface TemplateSnapshot extends Omit<TemplateDefinition, 'members'> {
     members: TemplateSnapshotMember[];
@@ -418,13 +450,15 @@ export interface TasksConfig {
     create_mode?: 'start' | 'backlog';
     close_room_on_done?: boolean;
     retain_completed_for?: string;
+    /** Default list prefix (default MSN); may change only before the first mission key. */
+    default_prefix?: string;
 }
 export type RoomTemplatesConfig = Record<string, TemplateDefinition>;
 export declare const ROOMS_KEYS: readonly ["cowork", "owner", "defaults"];
 export declare const ROOMS_OWNER_KEYS: readonly ["provider", "public_invite", "public_invite_file", "expected_cid", "role"];
 export declare const ROOMS_COWORK_KEYS: readonly ["config"];
 export declare const ROOMS_DEFAULTS_KEYS: readonly ["template", "attach_owner", "close_when_task_done"];
-export declare const TASKS_KEYS: readonly ["default_room_template", "create_mode", "close_room_on_done", "retain_completed_for"];
+export declare const TASKS_KEYS: readonly ["default_room_template", "create_mode", "close_room_on_done", "retain_completed_for", "default_prefix"];
 export declare const TEMPLATE_KEYS: readonly ["version", "description", "room", "contract", "members", "override_builtin"];
 export declare const TEMPLATE_ROOM_KEYS: readonly ["quiet_membership", "anonymous"];
 /** `agent` is accepted only so validation can emit its actionable migration error. */

package/dist/rooms-tasks/types.js

@@ -23,7 +23,7 @@ export const ROOMS_KEYS = ['cowork', 'owner', 'defaults'];
 export const ROOMS_OWNER_KEYS = ['provider', 'public_invite', 'public_invite_file', 'expected_cid', 'role'];
 export const ROOMS_COWORK_KEYS = ['config'];
 export const ROOMS_DEFAULTS_KEYS = ['template', 'attach_owner', 'close_when_task_done'];
-export const TASKS_KEYS = ['default_room_template', 'create_mode', 'close_room_on_done', 'retain_completed_for'];
+export const TASKS_KEYS = ['default_room_template', 'create_mode', 'close_room_on_done', 'retain_completed_for', 'default_prefix'];
 export const TEMPLATE_KEYS = ['version', 'description', 'room', 'contract', 'members', 'override_builtin'];
 export const TEMPLATE_ROOM_KEYS = ['quiet_membership', 'anonymous'];
 /** `agent` is accepted only so validation can emit its actionable migration error. */

package/dist/web/runtime.js

@@ -193,13 +193,16 @@ export async function startWebConsole(options) {
     const topologyPromote = new TopologyPromoteService({
         drafts: topologyDrafts, configuration, topology: readTopology,
     });
+    const taskRooms = new TaskRoomApplicationService(options.configPath, { binPath: () => options.binPath });
+    // One-time, lock-guarded mission key migration before serving; failure leaves it to the next mutation.
+    await taskRooms.prepareMissionKeys().catch(error => console.warn(`mission key migration deferred: ${error.message}`));
     let server;
     try {
         server = await buildWebServer({
             query, repository, logs, commands, creation, removal, audit, events, watchdogs, configuration, observeRole,
             resourceScope: { configPath: configuration.path, subscribeMutations: listener => events.subscribeResources(listener) },
             invalidateResourceCaches: () => { watchdogConfigProvider.invalidate(); watchdogFindings.invalidate(); },
-            taskRooms: new TaskRoomApplicationService(options.configPath, { binPath: () => options.binPath }),
+            taskRooms,
             roomLayouts: new RoomLayoutDefinitions(options.configPath),
             layoutBindings: new LayoutBindingGrants(new RoomLayoutService(options.configPath).supervisor()),
             presetProvenance: new PresetProvenance(options.configPath),

package/dist/web/server.js

@@ -7,15 +7,13 @@ import { registerConversationStream } from './conversation-stream.js';
 import { conversationHasAttachment } from '../application/conversation-history.js';
 import { readDeliveredFile } from '../file-delivery/store.js';
 import { WorkspaceDeviceAuthError } from './workspace-devices.js';
-import { readFileSync } from 'node:fs';
-import { packagedPresetRoot } from '../preset-bootstrap.js';
-import { validateCatalog } from '../init-wizard.js';
+import { PURPOSE_BRAINS, PurposeBrainConflictError } from '../init-wizard.js';
+import { harnessCapabilities, validateBrainChoice } from '../application/harness-capabilities.js';
 import { getAdapter } from '../harness/registry.js';
 import { storeAgentAttachment, attachmentPrompt, MAX_ATTACHMENT_BODY, readAgentAttachment, prepareAttachmentPresentation, presentAttachmentEvent } from './agent-attachments.js';
 import { readChatIdle } from '../temp-idle.js';
 import { agentDir } from '../paths.js';
 import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
-import { join } from 'node:path';
 import Fastify from 'fastify';
 import fastifyWebsocket from '@fastify/websocket';
 import { createHmac, randomBytes } from 'node:crypto';
@@ -26,7 +24,8 @@ import { WebAuth } from './auth.js';
 import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
-import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, TaskStateError } from '../rooms-tasks/task-state.js';
+import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, resolveTaskRef, TaskStateError } from '../rooms-tasks/task-state.js';
+import { MissionKeyError } from '../rooms-tasks/mission-keys.js';
 import { appendTaskProgress, getTaskReview, taskProgressSnapshot, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
 import { isProvider } from '../subscriptions/store.js';
 const ONBOARDING_WORK = ['coordination', 'development', 'review'];
@@ -214,12 +213,12 @@ export async function buildWebServer(services, boundary, options = {}) {
                 return { harness, ok: false, checks: [{ name: 'availability', ok: false, detail: 'Harness checks unavailable' }] };
             }
         }));
-        const catalog = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8')));
-        // Codex models are offered only when the runtime itself listed them for the active account.
-        // When it could not be asked, none is offered and the reason is reported.
-        const codexModels = services.codexModels ? await services.codexModels() : undefined;
-        const offered = (model) => model.harness !== 'codex' || !codexModels || (codexModels.state === 'known' && codexModels.models.includes(model.model));
-        const payload = { harnesses, catalog: catalog.models.filter(offered), ...(codexModels ? { codexModels: codexModels.state === 'known' ? { state: 'known' } : codexModels } : {}), providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
+        // The catalog is each adapter's maintained models, narrowed to what the active Codex account offers.
+        const capabilities = await harnessCapabilities({ harnesses: ['codex', 'claude-code'], codexModels: services.codexModels, checkReadiness: false });
+        const codex = capabilities.harnesses.find(item => item.harness === 'codex');
+        const catalog = capabilities.harnesses.flatMap(item => item.models.filter(model => model.available && model.efforts !== null)
+            .map(model => ({ harness: item.harness, session: 'acp', model: model.id, label: model.label, efforts: model.efforts })));
+        const payload = { harnesses, catalog, ...(codex?.discovery ? { codexModels: codex.discovery } : {}), providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
         if (revision === services.configuration?.read().revision) {
             onboardingObserved = { owner: browser.id, revision, payload };
             events.publish('onboarding.changed', {});
@@ -244,15 +243,25 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (!services.configuration || !services.onboardingSetup)
             throw new FleetError('capability_unavailable', 'first-time Fleet setup is unavailable');
         const requested = request.body?.models;
-        const codexModels = services.codexModels ? await services.codexModels() : undefined;
-        const supported = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8'))).models
-            .filter(model => model.harness !== 'codex' || !codexModels || (codexModels.state === 'known' && codexModels.models.includes(model.model)));
+        const capabilities = await harnessCapabilities({ harnesses: ['codex', 'claude-code'], codexModels: services.codexModels, checkReadiness: false });
         const models = {};
         for (const work of ONBOARDING_WORK) {
-            const matches = supported.filter(model => model.harness === requested?.[work]?.harness && model.model === requested?.[work]?.model);
-            if (matches.length !== 1)
-                throw new FleetError('invalid_request', `choose a supported model for ${work}`);
-            models[work] = matches[0];
+            const choice = requested?.[work];
+            const label = PURPOSE_BRAINS[work].label;
+            if (!choice || typeof choice !== 'object' || !('effort' in choice))
+                throw new FleetError('invalid_request', `choose a harness, model and effort for the ${label} Brain`);
+            const { harness, model, effort } = choice;
+            if (typeof harness !== 'string' || typeof model !== 'string' || (effort !== null && typeof effort !== 'string'))
+                throw new FleetError('invalid_request', `choose a harness, model and effort for the ${label} Brain`);
+            const check = validateBrainChoice(capabilities, { harness, session: 'acp', model, effort });
+            // Setup offers the adapters' maintained models only, each with an explicit effort when it has one.
+            if (!check.ok)
+                throw new FleetError('invalid_request', `${label} Brain: ${check.message}`);
+            if (!check.model || check.model.source !== 'adapter')
+                throw new FleetError('invalid_request', `${label} Brain: choose a supported model`);
+            if (check.model.efforts?.length && effort === null)
+                throw new FleetError('invalid_request', `${label} Brain: choose an effort for ${check.model.label} (${check.model.efforts.join(', ')})`);
+            models[work] = { harness: harness, session: 'acp', model, effort: effort };
         }
         const chosen = Object.values(models);
         const subscriptions = [...new Set(chosen.map(model => model.harness === 'codex' ? 'codex' : 'claude'))];
@@ -263,31 +272,49 @@ export async function buildWebServer(services, boundary, options = {}) {
             if (onboardingConfigured())
                 throw new FleetError('conflict', 'Fleet is already set up; change its models in the configuration');
             try {
-                await setup({ subscriptions, assignmentStrategy: oneModel ? 'one-model' : 'per-job', models, reasoning: 'balanced' });
+                await setup({ subscriptions, assignmentStrategy: oneModel ? 'one-model' : 'per-job', models });
             }
             catch (error) {
+                if (error instanceof PurposeBrainConflictError)
+                    throw new FleetError('conflict', error.message);
                 throw new FleetError('backend_failure', `Fleet setup did not complete: ${error.message}`);
             }
-            // Setup preserves files it finds, so confirm the published models are the ones this request chose.
-            // The prepared agents reference packaged Brain presets, so resolve what each of them now points at:
-            // a preserved file of a packaged name may hold another model, session or reasoning than its name says.
+            // Setup preserves files it finds, so confirm each prepared agent now resolves to exactly the chosen triple.
             const published = configuration.read(true).model, brains = published.brains ?? {};
             const brainOf = (holder) => brains[String(holder?.brain?.ref ?? '')];
             const assigned = { coordination: brainOf(published.agents.FleetCoordinator), development: brainOf(published.agent_templates?.Developer), review: brainOf(published.agent_templates?.Critic) };
             for (const work of ONBOARDING_WORK)
-                if (assigned[work]?.harness !== models[work].harness || assigned[work]?.model !== models[work].model || assigned[work]?.session !== models[work].session || assigned[work]?.effort !== 'medium')
+                if (assigned[work]?.harness !== models[work].harness || assigned[work]?.model !== models[work].model || assigned[work]?.session !== models[work].session || (assigned[work]?.effort ?? null) !== models[work].effort)
                     throw new FleetError('conflict', 'Fleet was set up with different models; review its configuration');
             return { configured: true };
         });
         onboardingSetupQueue = run.catch(() => { });
         return run;
     });
+    app.get('/api/v1/harness-capabilities', async (request) => {
+        auth.authenticate(request);
+        return harnessCapabilities({ codexModels: services.codexModels });
+    });
     app.get('/api/v1/creation-capabilities', async (request) => {
         auth.authenticate(request);
         return services.creation.capabilities();
     });
+    // A new agent's own harness/model/effort must be one its adapter supports; saved Brains are used as they are.
+    const checkBrainChoice = async (brain) => {
+        if (!brain || typeof brain !== 'object')
+            return;
+        const value = brain;
+        const check = validateBrainChoice(await harnessCapabilities({ codexModels: services.codexModels, checkReadiness: false }), {
+            harness: String(value.harness), session: value.session,
+            model: value.model, effort: value.effort
+        });
+        if (!check.ok)
+            throw new FleetError('invalid_request', `Brain: ${check.message}`);
+    };
+    const checkInlineBrain = (creation) => checkBrainChoice(creation?.brain?.inline);
     app.post('/api/v1/roles/preview', async (request) => {
         auth.authenticate(request, true);
+        await checkInlineBrain(request.body);
         return services.creation.preview(request.body);
     });
     app.post('/api/v1/roles', async (request, reply) => {
@@ -296,7 +323,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         const idempotencyKey = String(request.headers['idempotency-key'] ?? '');
         if (!body?.request || !body.previewHash)
             throw new FleetError('invalid_request', 'request and previewHash are required');
-        const action = await services.creation.create(body.request, body.previewHash, idempotencyKey, session.id);
+        const action = await services.creation.create(body.request, body.previewHash, idempotencyKey, session.id, checkInlineBrain);
         events.publish('creation.changed', action, action.roleId);
         reply.header('Location', `/api/v1/creation-actions/${encodeURIComponent(action.actionId)}`);
         reply.code(202);
@@ -321,6 +348,8 @@ export async function buildWebServer(services, boundary, options = {}) {
                         ? 'conflict' : 'invalid_request';
                 throw new FleetError(code, error.message);
             }
+            if (error instanceof MissionKeyError)
+                throw new FleetError(error.code === 'invalid_prefix' ? 'invalid_request' : 'conflict', error.message, { details: { reason: error.code } });
             if (error instanceof TaskStateError && 'accepted' in error && error.accepted === false)
                 return Promise.reject(Object.assign(new FleetError('invalid_request', error.message), { memberNotAccepted: true }));
             if (error instanceof TaskStateError) {
@@ -329,6 +358,20 @@ export async function buildWebServer(services, boundary, options = {}) {
             throw error;
         }
     };
+    /** Canonical task ID for a `:id` param holding an ID or a mission key; call only after authentication. */
+    const taskRef = (request, options = {}) => {
+        const ref = String(request.params.id ?? '');
+        try {
+            return resolveTaskRef(ref, options);
+        }
+        catch (error) {
+            if (error instanceof MissionKeyError)
+                throw new FleetError('resource_not_found', error.message);
+            if (error instanceof TaskStateError)
+                throw new FleetError(error.message.startsWith('task not found:') ? 'resource_not_found' : 'invalid_request', error.message);
+            throw error;
+        }
+    };
     const reviewApi = async (fn) => taskApi(async () => {
         try {
             return await fn();
@@ -345,7 +388,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     /** Browser task payloads carry Progress/To review counts; bodies have their own routes. */
     const wireTask = (task) => {
-        const { progress: _progress, review: _review, ...rest } = task;
+        const { progress: _progress, review: _review, member_naming: _naming, ...rest } = task;
         return { ...rest, ...taskContributionSummary(task) };
     };
     const wireTaskResult = (result) => {
@@ -517,15 +560,29 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.post('/api/v1/task-lists', async (request, reply) => {
         auth.authenticate(request, true);
-        const name = String(request.body?.name ?? '');
-        const list = await taskApi(() => requireTaskRooms().createTaskList({ actor: { kind: 'local_control', surface: 'web' }, name }));
+        const body = request.body;
+        const name = String(body?.name ?? '');
+        if (body?.prefix !== undefined && typeof body.prefix !== 'string')
+            throw new FleetError('invalid_request', 'prefix must be a string');
+        const list = await taskApi(() => requireTaskRooms().createTaskList({ actor: { kind: 'local_control', surface: 'web' }, name,
+            prefix: body?.prefix }));
         reply.code(201);
         return { list };
     });
+    app.get('/api/v1/task-lists/prefix-suggestion', async (request) => {
+        auth.authenticate(request);
+        const name = String(request.query.name ?? '');
+        return { prefix: await taskApi(() => requireTaskRooms().suggestTaskListPrefix(name)) };
+    });
     app.patch('/api/v1/task-lists/:name', async (request) => {
         auth.authenticate(request, true);
         const name = request.params.name;
-        const newName = String(request.body?.name ?? '');
+        const body = request.body;
+        if (body?.prefix !== undefined && typeof body.prefix !== 'string')
+            throw new FleetError('invalid_request', 'prefix must be a string');
+        if (body?.name === undefined && typeof body?.prefix === 'string')
+            return { list: await taskApi(() => requireTaskRooms().setTaskListPrefix({ actor: { kind: 'local_control', surface: 'web' }, name, prefix: body.prefix })) };
+        const newName = String(body?.name ?? '');
         return { list: await taskApi(() => requireTaskRooms().renameTaskList({ actor: { kind: 'local_control', surface: 'web' }, name, newName })) };
     });
     app.delete('/api/v1/task-lists/:name', async (request) => {
@@ -540,11 +597,13 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.delete('/api/v1/tasks/:id', async (request, reply) => {
         auth.authenticate(request, true);
-        const taskId = request.params.id;
+        const submitted = request.params.id;
         const confirm = request.query.confirm;
-        // Exact-ID-twice confirmation is validated before existence or idempotency.
-        if (confirm !== taskId)
-            throw new FleetError('invalid_request', 'confirm must exactly repeat the task id');
+        // Exact raw ref-twice confirmation is validated before existence or idempotency.
+        if (confirm !== submitted)
+            throw new FleetError('invalid_request', 'confirm must exactly repeat the task id or key');
+        // A deleted key still maps to its canonical ID, so a repeated DELETE stays idempotent.
+        const taskId = taskRef(request, { allowDeleted: true });
         const accepted = await taskApi(() => requireTaskRooms().requestTaskDeletion({
             actor: { kind: 'local_control', surface: 'web' }, taskId,
         }));
@@ -559,7 +618,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         return {
             task_id: taskId, accepted: true, deletion: 'pending',
             ...(outcome.error ? { error: outcome.error } : {}),
-            recovery: `Repeat DELETE /api/v1/tasks/${taskId}?confirm=${taskId}.`,
+            recovery: `Repeat DELETE /api/v1/tasks/${submitted}?confirm=${submitted}.`,
         };
     });
     app.post('/api/v1/tasks', async (request, reply) => {
@@ -588,7 +647,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.patch('/api/v1/tasks/:id/list', async (request) => {
         auth.authenticate(request, true);
-        const taskId = request.params.id;
+        const taskId = taskRef(request);
         const list = String(request.body?.list ?? '');
         return { task: wireTask(await taskApi(() => requireTaskRooms().moveTask({ actor: { kind: 'local_control', surface: 'web' }, taskId, list }))) };
     });
@@ -598,17 +657,17 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (typeof body?.brief !== 'string' || typeof body.expectedBrief !== 'string' || body.brief.length > 100_000)
             throw new FleetError('invalid_request', 'brief and expectedBrief must be strings; brief maximum is 100000 characters');
         return { task: wireTask(await taskApi(() => requireTaskRooms().editTaskDescription({
-                actor: { kind: 'local_control', surface: 'web' }, taskId: request.params.id,
+                actor: { kind: 'local_control', surface: 'web' }, taskId: taskRef(request),
                 brief: body.brief, expectedBrief: body.expectedBrief,
             }))) };
     });
     app.get('/api/v1/tasks/:id', async (request) => {
         auth.authenticate(request);
-        return wireTaskResult(await taskApi(() => requireTaskRooms().getTask(request.params.id)));
+        return wireTaskResult(await taskApi(() => requireTaskRooms().getTask(taskRef(request))));
     });
     app.get('/api/v1/tasks/:id/progress', async (request) => {
         auth.authenticate(request);
-        return { progress: await reviewApi(() => taskProgressSnapshot(request.params.id)) };
+        return { progress: await reviewApi(() => taskProgressSnapshot(taskRef(request))) };
     });
     app.post('/api/v1/tasks/:id/progress', async (request, reply) => {
         auth.authenticate(request, true);
@@ -617,7 +676,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         const requestKey = typeof body?.requestKey === 'string' ? body.requestKey : typeof header === 'string' ? header : undefined;
         if (typeof body?.text !== 'string' || (body.requestKey !== undefined && typeof body.requestKey !== 'string'))
             throw new FleetError('invalid_request', 'text must be a string; requestKey, when given, a string');
-        const result = await reviewApi(() => appendTaskProgress(request.params.id, {
+        const result = await reviewApi(() => appendTaskProgress(taskRef(request), {
             text: body.text, requestKey, author: { kind: 'local_control', surface: 'web' },
         }));
         if (!result.replayed)
@@ -630,7 +689,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         const ids = request.body?.ids;
         if (!Array.isArray(ids) || ids.length > 200 || ids.some(id => typeof id !== 'string' || id.length > 64))
             throw new FleetError('invalid_request', 'ids must be at most 200 progress entry IDs');
-        return { unread: await reviewApi(() => acknowledgeTaskProgress(request.params.id, ids)) };
+        return { unread: await reviewApi(() => acknowledgeTaskProgress(taskRef(request), ids)) };
     });
     /** Acknowledge the To review revision the browser fetched and rendered. */
     app.post('/api/v1/tasks/:id/review/read', async (request) => {
@@ -638,11 +697,11 @@ export async function buildWebServer(services, boundary, options = {}) {
         const revision = request.body?.revision;
         if (!Number.isSafeInteger(revision) || revision < 0)
             throw new FleetError('invalid_request', 'revision must be a non-negative integer');
-        return { unread: await reviewApi(() => acknowledgeTaskReview(request.params.id, revision)) };
+        return { unread: await reviewApi(() => acknowledgeTaskReview(taskRef(request), revision)) };
     });
     app.get('/api/v1/tasks/:id/review', async (request) => {
         auth.authenticate(request);
-        const review = await reviewApi(() => getTaskReview(request.params.id));
+        const review = await reviewApi(() => getTaskReview(taskRef(request)));
         return { review: review ? publicReview(review) : null };
     });
     app.put('/api/v1/tasks/:id/review', async (request) => {
@@ -650,7 +709,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         const body = request.body;
         if (typeof body?.markdown !== 'string' || typeof body.expectedMarkdown !== 'string')
             throw new FleetError('invalid_request', 'markdown and expectedMarkdown must be strings');
-        const review = await reviewApi(() => setTaskReviewMarkdown(request.params.id, {
+        const review = await reviewApi(() => setTaskReviewMarkdown(taskRef(request), {
             markdown: body.markdown, expectedMarkdown: body.expectedMarkdown,
             author: { kind: 'local_control', surface: 'web' },
         }));
@@ -658,7 +717,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.get('/api/v1/tasks/:id/review/artifacts/:artifactId', async (request, reply) => {
         auth.authenticate(request);
-        const { artifact, bytes } = await reviewApi(() => readTaskReviewArtifact(request.params.id, request.params.artifactId));
+        const { artifact, bytes } = await reviewApi(() => readTaskReviewArtifact(taskRef(request), request.params.artifactId));
         reply.header('Cache-Control', 'private, no-store');
         reply.header('X-Content-Type-Options', 'nosniff');
         reply.header('Content-Security-Policy', "default-src 'none'; sandbox");
@@ -669,7 +728,12 @@ export async function buildWebServer(services, boundary, options = {}) {
         auth.authenticate(request, true);
         const body = request.body;
         try {
-            const result = await taskApi(() => requireTaskRooms().addMember(request.params.id, body));
+            // A new manual harness/model/effort must be one the adapter supports; nothing is substituted.
+            // A retry of an accepted request returns its receipt even if the account's models changed since.
+            const result = await taskApi(() => requireTaskRooms().addMember(taskRef(request), body, async (member) => {
+                if (typeof member.brain === 'object')
+                    await checkBrainChoice(member.brain.inline);
+            }));
             reply.code(result.state === 'running' ? 202 : 200);
             return result;
         }
@@ -681,7 +745,8 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.get('/api/v1/tasks/:id/member-additions/:requestId', async (request) => {
         auth.authenticate(request);
-        const { id, requestId } = request.params;
+        const { requestId } = request.params;
+        const id = taskRef(request);
         return taskApi(() => requireTaskRooms().memberAddition(id, requestId));
     });
     app.patch('/api/v1/tasks/:id/layout', async (request) => {
@@ -691,18 +756,19 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (!name(body?.layout) || !(body.expectedLayout === null || name(body.expectedLayout)))
             throw new FleetError('invalid_request', 'layout must be a layout name; expectedLayout a layout name or null');
         const task = await taskApi(() => requireTaskRooms().setTaskLayout({ actor: { kind: 'local_control', surface: 'web' },
-            taskId: request.params.id, layout: body.layout, expectedLayout: body.expectedLayout }));
+            taskId: taskRef(request), layout: body.layout, expectedLayout: body.expectedLayout }));
         await audit.record({ requestId: request.id, browser: session.id, action: 'task.layout.set', result: 'succeeded' });
         return { task: wireTask(requireTaskRooms().withLayoutRooms(task)) };
     });
     app.get('/api/v1/tasks/:id/layout', async (request) => {
         auth.authenticate(request);
-        return { layout: await taskApi(async () => requireTaskRooms().taskLayout(request.params.id)) };
+        return { layout: await taskApi(async () => requireTaskRooms().taskLayout(taskRef(request))) };
     });
     for (const operation of ['open', 'close']) {
         app.post(`/api/v1/tasks/:id/layout/rooms/:room/${operation}`, async (request, reply) => {
             const session = auth.authenticate(request, true);
-            const { id, room } = request.params;
+            const { room } = request.params;
+            const id = taskRef(request);
             const accepted = await taskApi(() => requireTaskRooms().launchTaskLayoutOperation({
                 actor: { kind: 'local_control', surface: 'web' }, taskId: id, room,
                 operation: operation === 'open' ? 'open' : 'close-room',
@@ -715,7 +781,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     app.post('/api/v1/tasks/:id/layout/cleanup', async (request, reply) => {
         auth.authenticate(request, true);
         const accepted = await taskApi(() => requireTaskRooms().retryTaskLayoutCleanup({
-            actor: { kind: 'local_control', surface: 'web' }, taskId: request.params.id,
+            actor: { kind: 'local_control', surface: 'web' }, taskId: taskRef(request),
         }));
         reply.code(202);
         return { operation: accepted };
@@ -761,7 +827,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     for (const action of ['start', 'block', 'unblock', 'review', 'finish', 'cancel']) {
         app.post(`/api/v1/tasks/:id/${action}`, async (request, reply) => {
             auth.authenticate(request, true);
-            const taskId = request.params.id;
+            const taskId = taskRef(request);
             const body = (request.body ?? {});
             const input = { actor: { kind: 'local_control', surface: 'web' }, taskId };
             const api = requireTaskRooms();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.2.6",
+  "version": "2.3.1",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/presets/README.md

@@ -1,26 +1,48 @@
-# Predefined Brains
+# Models, efforts and Brains
 
-`brain-catalog.json` is the source for generated `fleet/brains/*.yaml` files.
-Run `node scripts/generate-brain-presets.mjs` after changing it, and run the same
-command with `--check` to verify generated files. An empty `efforts` array generates
-one `-default` preset with no `effort` field. Bootstrap adds missing presets and
-preserves existing user files. Existing model presets remain available.
+`brain-catalog.json` is the model catalog maintained with the Claude Code and
+Codex harness adapters: each exact model ID, its label, and the efforts it
+supports (an empty `efforts` list means the model has no effort setting). The
+adapters expose it through `modelCapabilities()`, and Fleet serves it, narrowed
+to the models the active Codex account offers, at `GET /api/v1/harness-capabilities`.
+Onboarding, Settings and agent launch flows use that one source. Hermes models
+come from the provider configured in the role home, so Hermes lists none and
+sets no effort.
+
+Setup no longer installs a Brain per model and effort. It creates three
+editable purpose Brains from the choices made during setup:
+
+| Brain | Used by |
+| --- | --- |
+| `development` | Developer, Engineer |
+| `critic` | Critic |
+| `coordination` | LocalCoordinator, FleetCoordinator |
+
+Users change these or add more in Settings > Brains. An agent can also be
+launched with a one-off harness, model and effort; that choice is kept with the
+agent and saves no Brain.
+
+Existing installations keep every Brain file and reference. The values of the
+Brain presets earlier releases generated per model and effort are frozen in
+`legacy/generated-brains-rev4.json`; configuration provenance reports an
+untouched one as `legacy` and an edited one as `changed`. Nothing deletes them.
+`fleet/brains/claude-default.yaml` (the Claude Code default model) still ships
+for packaged templates and existing references; setup does not install it.
 
 ## GPT-6.1 Sol (added 2026-09-29)
 
-The Codex presets `codex-gpt-6-1-sol-{low,medium,high,xhigh,max,ultra}`
-use the exact model ID `gpt-6.1-sol` with ACP sessions. The init wizard offers
+The Codex catalog entry uses the exact model ID `gpt-6.1-sol` with ACP sessions. The init wizard offers
 GPT-6.1 Sol for development, review, and coordination.
 
 [Official OpenAI documentation](https://developers.openai.com/api/docs/models/gpt-6.1-sol)
 supports low, medium, high, xhigh, and max API reasoning efforts. The local
 Codex `models_cache.json` inspected on 2026-09-29 additionally advertises
-`ultra`, a Codex harness mode. These presets reflect that six-effort Codex
+`ultra`, a Codex harness mode. The catalog reflects that six-effort Codex
 catalog; no inference or ACP launch was performed for this addition.
 
 ## Current model additions (verified 2026-09-24)
 
-| Harness | Exact model ID | Preset efforts |
+| Harness | Exact model ID | Efforts |
 | --- | --- | --- |
 | Codex | `gpt-6-sol` | low, medium, high, xhigh, max, ultra |
 | Codex | `gpt-6-luna` | low, medium, high, xhigh, max |
@@ -29,23 +51,21 @@ catalog; no inference or ACP launch was performed for this addition.
 | Claude Code (retained) | `claude-sonnet-5` | low, medium, high, xhigh, max |
 | Claude Code | `claude-haiku-4-5-20251001` | default, with no effort setting |
 
-For example, select `codex-gpt-6-sol-ultra`, `claude-opus-5-5-max`, or
-`claude-haiku-4-5-20251001-default` as a Brain reference. The init wizard offers
-models supporting its Quick/Balanced/Thorough (low/medium/high) choices; use the
-named Brain directly for Haiku, which does not support effort.
+Setup asks for an effort only among the efforts a model supports; Haiku gets
+none.
 
 ### Runtime requirements and evidence
 
 Codex CLI **0.155.0** freshly queried through `app-server` `initialize` then
 `model/list` advertised the GPT rows above. A previously populated
 `~/.codex/models_cache.json` did not contain these models; refresh runtime discovery
-before concluding a model is unavailable. `ours-fleet doctor` compares presets to
+before concluding a model is unavailable. `ours-fleet doctor` compares configured Codex Brains to
 the local cache. The catalog is not an account entitlement guarantee.
 
 The [Sol](https://developers.openai.com/api/docs/models/gpt-6-sol) and
 [Luna](https://developers.openai.com/api/docs/models/gpt-6-luna) API model pages
 also support `none`, but the verified Codex runtime does not advertise it.
-Consequently there are no `none` presets. Sol's `ultra` is an advertised Codex
+Consequently the catalog lists no `none` effort. Sol's `ultra` is an advertised Codex
 harness mode, not an additional API reasoning level; Luna does not advertise it.
 
 Claude Code **2.1.281** was verified using the Agent SDK `supportedModels()`
@@ -56,13 +76,13 @@ not asserted minimum versions. Provider references:
 [model IDs](https://platform.claude.com/docs/en/models/overview) and
 [Claude Code effort support](https://code.claude.com/docs/en/model-config#adjust-effort-level).
 
-**Check the executable used by ACP before selecting the new Claude presets.**
+**Check the executable used by ACP before selecting the new Claude models.**
 The inspected `claude-agent-acp` **0.63.0** installation bundles Agent SDK
 **0.3.220**, whose default executable reports older models. To use the verified
 installed Claude CLI, set `CLAUDE_CODE_EXECUTABLE` to its absolute path in the
 launch environment (for example `/usr/bin/claude` on the verification host).
 Otherwise use a bundled SDK whose runtime advertises these models and efforts.
-The presets do not change your executable or restart agents. An older bundled
+The catalog does not change your executable or restart agents. An older bundled
 runtime alone is not evidence of support for the new models.
 
 No-prompt ACP startup and `session/set_config_option` probes also verified all