@ours.network/install 1.1.0 → 1.2.0-nightly.1

package/README.md

@@ -42,10 +42,9 @@ connector from another daemon still require explicit confirmation.
   installations.
 - Configures and starts cowork as a durable shim over the shared daemon.
 - Configures and starts Telegram as a durable shim over the same daemon.
-- Runs Fleet's host initialization and, when `~/fleet.yaml` is absent, writes a
-  conservative stopped starter with `FleetCoordinator`, a `fleet-health`
-  watchdog, and a ten-minute `coordinator_health` loop. An existing
-  `~/fleet.yaml` is never overwritten.
+- Runs Fleet's native initialization through prepared settings or its interactive wizard. Fleet owns and
+  publishes its v2 configuration, including subscriptions, models, roles,
+  templates, and permissions. The installer does not start Fleet roles.
 
 The operator CLI owns daemon configuration, lifecycle, and boot persistence.
 The MCP package is only the stdio adapter spawned by agent harnesses; the
@@ -66,7 +65,7 @@ managed service and old state, then initialize the new major. The default answer
 Only Fleet is intentionally not started. Review and activate it when ready:
 
 ```sh
-# After reviewing ~/fleet.yaml:
+# After completing Fleet's wizard and reviewing ~/fleet.yaml:
 ours-fleet doctor
 ours-fleet config
 ours-fleet up
@@ -97,6 +96,16 @@ cannot store an environment value; for those harnesses the installer prints the
 exact `export OURS_CONFIG=...` line that must be added to the shell profile
 before starting the harness. There is no per-application daemon.
 
+`OURS_CONFIG` may also name a prepared private host profile containing the
+complete `endpoint`, `expectedInstanceId`, and absolute `credentialPath` tuple.
+The profile and credential must already be regular current-user files with
+private permissions. In this mode the installer verifies `/selection` before
+sending the credential to `/version`, installs only MCP, detected Claude/Codex
+plugins, and Fleet client support, and never creates, starts, stops, or services
+a host daemon. Telegram, cowork, messenger, daemon voice, and daemon state stay
+Compose-owned. If `OURS_CONFIG` is unset, the same profile is discovered at
+`~/.ours/config.json`; a legacy config there keeps the existing local behavior.
+
 ## Uninstall
 
 ```sh
@@ -108,6 +117,10 @@ The uninstaller delegates service and daemon removal to the `ours` CLI. Identity
 state is retained by default. Purging requires the existing destructive gates and
 targets only the explicit state directory.
 
+When `OURS_CONFIG` selects a host profile, uninstall removes only selected
+client attachments. The operator-owned profile and shared credential are kept
+even with `--purge`, and no Compose daemon, service, or state is touched.
+
 ## Release channel
 
 `OURS_CHANNEL=nightly` (or `OURS_INSTALL_CHANNEL`) selects the packages' nightly
@@ -120,6 +133,183 @@ both channels.
 - `OURS_ASSUME_YES=1`: accept safe defaults without prompting.
 - `OURS_INSTALL_DRY_RUN=1`: preview without mutation.
 - `OURS_NPM`: npm executable.
-- `OURS_CONFIG`: explicit daemon configuration file.
+- `OURS_CONFIG`: explicit legacy daemon config or prepared private host profile.
 - `OURS_STATE_DIR`: explicit daemon state directory.
 - `OURS_CHANNEL`: `latest` or `nightly`.
+
+## Selected network installations (2.0)
+
+The installed package carries its compatible `assets/sources.json` policy.
+`--sources` remains available as an explicit development override. Feature
+revisions in the testing delivery remain unpublished; local build evidence does
+not prove remote fetchability or compatibility of a replacement source set.
+
+```sh
+ours-install server install --mode docker --state-dir /private/ours-install
+ours-install server install --mode packages --state-dir /private/ours-install
+ours-install server status --state-dir /private/ours-install
+ours-install server stop --state-dir /private/ours-install
+ours-install server start --state-dir /private/ours-install
+ours-install server restart --state-dir /private/ours-install
+```
+
+Choose one mode for a private installation root. The private `installation.json`
+records mode, instance selection, configuration/source paths and service selection;
+it never records master bytes or an issued-token registry. The selected policy
+is resolved to an exact, role-filtered `sources.json` before acquisition.
+Repeated installation retains that concrete selection,
+settings and state and repairs credential delivery without rotating the master.
+Conflicting modes or source mappings are refused. Docker Compose is an internal
+diagnostic artifact under the root's `runtime` directory; all installer calls use
+an explicit project directory, Compose file, project name and selected environment.
+Assets resolve from the installed package, independently of the working directory.
+
+Package mode requires Node.js 22+, npm and a working systemd user manager on
+Linux/WSL or a launchd GUI user domain on macOS. Source builds also require Git,
+Python 3, a C/C++ toolchain, make, and the selected repositories' own prerequisites.
+Docker mode requires a working Docker engine and Compose 2.35+; its build image
+contains the source-build prerequisites. No bind or Docker socket mounts are used.
+Server runtime installation selects SDK/CLI, main MCP, Telegram, Cowork and
+Messenger. Main MCP is injected into the daemon, not started as a second daemon.
+The daemon starts first; consumers are checked through their owning readiness
+interfaces. Messenger uses its existing identity prerequisite and never creates an
+identity. Its failure is reported after attempting unrelated consumers. Package
+mode uses an installer-owned per-installation systemd/launchd Messenger service
+for `ours-messenger-server serve`; other services use their owning CLIs.
+Native daemon stop invokes the owning CLI's guarded `uninstall-service --yes`
+before its process/endpoint stop and verifies the selected job is unloaded or
+inactive. This removes its boot-service definition so the manager cannot respawn
+a writer during authority operations. A later selected start uses the owning
+`install-service --yes` to recreate it. Replacement/restart restore only previously
+running services; an excluded stopped daemon keeps its service removed.
+
+```sh
+ours-install server access-issue --state-dir /private/ours-install --output /private/client/credential
+ours-install server access-replace --state-dir /private/ours-install --confirm
+```
+
+Fresh Docker preparation leaves daemon state containing only its selected config.
+Only after owning `access-init` succeeds are daemon provenance and MCP profile
+files materialized, so fresh setup never needs an inferred migration.
+Initial setup calls owning CLI `access-init`, then `access-issue --replace` for
+managed credential destinations. Explicit legacy migration adds `--migrate` to
+`server install`; migration is never inferred. Global replacement stops consumers
+and the daemon, calls `access-replace` once, repairs managed credential delivery,
+and restarts only previously running services. If delivery/startup fails after
+replacement, the new master remains authoritative and setup is reported incomplete.
+Repeat ordinary `server install` to repair delivery without another rotation.
+Separately configured clients need newly issued credentials after replacement.
+Docker issuance copies only a newly issued file from an administrative container
+into private host staging, publishes to an absent protected destination and removes
+the temporary administrative container. It never transfers the master.
+
+For client-only installation, supply a private complete network profile with
+client-owned installer settings:
+
+```json
+{
+  "endpoint": "http://server:3050",
+  "expectedInstanceId": "12345678-1234-1234-1234-123456789abc",
+  "credentialPath": "/private/client/credential",
+  "installer": {
+    "integrations": ["codex", "claude-code", "fleet"],
+    "fleetSettingsPath": "fleet-settings.json"
+  }
+}
+```
+
+```sh
+ours-install client install --config /private/client/profile.json
+```
+
+Optional `sourcesPath` and `fleetSettingsPath` values are absolute or resolved
+relative to the profile file. Select any nonempty subset of integrations; Fleet is optional.
+When Fleet settings are supplied, the installer passes them to Fleet's strict
+noninteractive `init --settings`; otherwise it opens Fleet's existing wizard.
+Fleet validates and publishes its own configuration. Client setup verifies the selected
+daemon and packaged OURS MCP before registering native integrations. It acquires
+only selected integration packages and their actual client dependencies. It does
+not install main MCP, administer daemon state or invoke Docker. Exact npm client
+installation needs no Python; Git source builds use the supplied source recipes
+and their build prerequisites. Normal native clients need neither Docker nor
+server maintenance tools.
+
+Installer imports the profile, issued token, source manifest and optional Fleet
+settings into `~/.ours-client/` (directory 0700, files 0600). The saved profile is
+`profile.json`, referencing the imported `credential`. Original input files are
+left untouched and may be moved or removed after setup. Ordinary new Codex,
+Claude and Fleet invocations discover the saved server without an environment
+export. Explicit `OURS_CONFIG` still overrides new invocations; installer reports
+an existing override and does not edit shell configuration or running sessions.
+
+Repeat with `ours-install client install` to reuse imported inputs and installed
+package records. Existing settings and Fleet-generated files are preserved. A
+prepared profile for the same endpoint/instance may supply a valid replacement
+issued token; another server is refused without changing the default. Invalid
+server access is rejected before import. An acquisition or component failure
+reports incomplete setup and keeps the saved configuration for retry. Selected
+native integrations whose executable is unavailable are incomplete, not installed.
+Source repositories or registry access remain prerequisites when packages still
+need to be acquired; they are not runtime configuration dependencies.
+
+Interactive no-argument installation asks for package/Docker server mode, a
+prepared client profile, or `client`. Client setup offers the saved server when
+present. On first setup it asks for the server HTTP endpoint, issued-token file,
+source manifest and integration choices, obtains the instance UUID from
+`/selection`, displays it, then checks authenticated daemon and MCP access before
+saving anything. No UUID must be entered manually. The 2.0 HTTP flow assumes the
+approved trusted same-host deployment; selection metadata is not cryptographic
+server authentication. Fleet collects missing setup answers through its own wizard.
+This network flow never
+creates a Human identity. Legacy explicitly selected local flows are retained.
+
+For a managed server, maintenance runs on the server machine through the installer:
+
+```sh
+ours-install server backup server snapshot --state-dir /path/to/installation
+ours-install server restore server snapshot --state-dir /path/to/installation
+ours-install server rebuild --state-dir /path/to/installation
+ours-install server update --state-dir /path/to/installation --compatible
+```
+
+Backup and restore support the full server or an individual `daemon`, `telegram`,
+`cowork`, or `messenger` domain. Reset requires an individual domain and `--confirm`.
+The installer stops affected writers and preserves a validated pre-operation
+backup before restore, reset, or update. Restore retains current access authority.
+
+Rebuild uses the saved exact source selection. Update resolves the packaged policy,
+or an explicitly supplied development override, into a retained replacement.
+Preparation does not replace the active runtime. Rebuild requires the same selected sources and equivalent verified dependency records.
+Different JSON ordering is harmless; different package bytes or dependency edges refuse
+rebuild. Fresh builds record the verified vendor archive bindings so staging paths
+can differ without ignoring package integrity.
+Changed sources require reviewed storage compatibility through explicit update with `--compatible`; this flag
+attests to external evidence and does not establish compatibility by itself.
+Services stop before state/runtime publication, and only previously running services
+resume. Credentials and identities are not regenerated.
+
+If activation fails, repeat the same update/rebuild command and retain its input
+manifest. The installer resumes its saved candidate rather than fetching another
+build. `server status` reports the pending phase; `server stop` remains available.
+Other mutations refuse until activation completes. There is no automatic rollback
+of application state after publication.
+
+
+New builds retain `build-context.json` alongside their original lockfile and dependency
+tree. The context binds the original record bytes to verified vendor tar names,
+versions and integrity. Only proven top-level vendor staging paths are normalized;
+lockfile integrity and other dependency references remain unchanged. An invalid or
+unknown context is an error, including with `--compatible`.
+
+Older records without a context retain their conservative comparison. If a rebuild
+is refused because historical staging evidence is unavailable, use a reviewed
+`server update --compatible` to establish a newly verified context; this operation
+preserves the original record set in the pre-update backup. The flag is an explicit
+storage-compatibility attestation, not proof of compatibility or a way to reconstruct
+missing historic evidence. Startup never adds a context to existing legacy markers.
+
+Backups with a context use archive format2; legacy backups remain format1. Updated
+maintenance reads both formats. Format2 is not readable by older maintenance tools,
+so this change does not promise executable downgrade support. Restore validates the
+original archive records unchanged, then writes markers for the active target runtime.
+Mixed/incomplete context and component record sets are refused before activation.

package/assets/Dockerfile

@@ -0,0 +1,41 @@
+# syntax=docker/dockerfile:1
+FROM node:24 AS toolchain
+RUN apt-get update && apt-get install -y --no-install-recommends build-essential python3 ca-certificates git && rm -rf /var/lib/apt/lists/*
+FROM toolchain AS build
+WORKDIR /opt/ours
+COPY sources.json /opt/ours/sources.json
+COPY scripts/build/*.mjs /build-scripts/
+COPY scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs /maintenance/
+RUN --mount=type=secret,id=github_token --mount=type=cache,id=ours-dist-2-npm,target=/root/.npm,sharing=locked node /build-scripts/build.mjs
+# Testing delivery: npm resolves transitive versions afresh; repeat builds may differ.
+# build.mjs creates package.json once from the sources.json selections.
+# Keep npm's generated lock and resolved tree in the image for this build's provenance.
+RUN --mount=type=cache,id=ours-dist-2-npm,target=/root/.npm,sharing=locked npm install --omit=dev --no-audit --no-fund
+RUN node /build-scripts/record-build.mjs
+# Build provenance is non-secret, root-owned image content; arbitrary runtime UIDs
+# must be able to read it. Protected state/host copies retain private ownership.
+RUN chmod 755 /opt/ours /opt/ours/docker /opt/ours/docker/vendor && chmod 644 package.json package-lock.json dependency-tree.json build-context.json docker/vendor/*.tgz
+LABEL network.ours.build-context="1"
+COPY scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs /opt/ours/maintenance/
+COPY scripts/runtime/runtime-common.mjs /opt/ours/docker/runtime-common.mjs
+COPY scripts/runtime/check-client.mjs /opt/ours/docker/check-client.mjs
+COPY scripts/runtime/check-start.mjs /opt/ours/docker/check-start.mjs
+COPY scripts/runtime/client-setup.mjs /opt/ours/docker/client-setup.mjs
+COPY scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
+COPY scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs
+COPY scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs /opt/ours/docker/
+FROM node:24 AS maintenance
+LABEL network.ours.build-context="1"
+WORKDIR /opt/ours
+COPY --from=build /opt/ours /opt/ours
+COPY scripts/maintenance/*.mjs /opt/ours/docker/
+COPY --chmod=644 scripts/maintenance/package.json /opt/ours/docker/package.json
+RUN --mount=type=cache,id=ours-dist-2-npm,target=/root/.npm,sharing=locked npm install --prefix /opt/ours/docker --omit=dev --ignore-scripts --no-audit --no-fund
+USER 1000:1000
+ENTRYPOINT ["node", "/opt/ours/docker/state-operation.mjs"]
+FROM node:24 AS runtime
+LABEL network.ours.build-context="1"
+WORKDIR /opt/ours
+COPY --from=build /opt/ours /opt/ours
+USER 1000:1000
+ENTRYPOINT ["/bin/sh", "/opt/ours/docker/entrypoint.sh"]

package/assets/docker-compose.yaml

@@ -0,0 +1,222 @@
+# OURS 2.0 source delivery. Build input: Dockerfile, sources.json and scripts/ in this delivery directory.
+# Pinned feature commits must be available in their upstream repositories before building.
+# Docker Compose 2.35+ with BuildKit; current upstream MUFL compiler: linux/amd64.
+# Set OURS_DAEMON_ID to one retained lowercase UUID before the first start.
+# Private SDK source access: export OURS_BUILD_GITHUB_TOKEN with read access to
+# adapt-toolkit/ours-sdk. Passed only as a BuildKit secret, never an image ARG.
+# Supported setup/start entrypoint: ours-install server install --mode docker ...
+# The installer calls prepare, then owning HMAC access-init/access-issue, then
+# starts daemon and consumers in dependency order. Compose is diagnostic only.
+# Protected optional Telegram JSON can use the prepare service telegram-input.
+# No bot settings are required to start the connector without a configured bot.
+# Fleet and the Codex/Claude integrations stay on the host; main MCP executes in Docker.
+# Host clients use the same pinned feature revisions documented in README.md.
+
+x-build: &source-build
+  context: .
+  target: runtime
+  secrets: [github_token]
+  dockerfile: Dockerfile
+
+x-runtime: &runtime
+  build: *source-build
+  platform: linux/amd64
+  image: "${OURS_IMAGE:-ours-compose-2-runtime:local}"
+  user: "${OURS_UID:-1000}:${OURS_GID:-1000}"
+  init: true
+  read_only: true
+  cap_drop: [ALL]
+  security_opt: [no-new-privileges:true]
+  tmpfs: ["/tmp:rw,nosuid,nodev,noexec,size=64m,mode=1777"]
+  networks: [ours]
+  stop_grace_period: 30s
+
+x-owner-environment: &owner-environment
+  HOME: /tmp
+  OURS_CONFIG: /var/lib/ours/config.json
+  OURS_STATE_DIR: /var/lib/ours
+  OURS_PORT: "3050"
+  OURS_LISTEN_HOST: 0.0.0.0
+  OURS_API_VISIBILITY: owner
+  OURS_DAEMON_ID: "${OURS_DAEMON_ID:?Set a stable daemon UUID}"
+  OURS_ACCESS_MIGRATE: "${OURS_ACCESS_MIGRATE:-0}"
+  OURS_MESSENGER_IDENTITY: "${OURS_MESSENGER_IDENTITY:-}"
+
+x-owner-volumes: &owner-volumes
+  - {type: volume, source: server-storage, target: /var/lib/ours, volume: {nocopy: true, subpath: state/daemon}}
+  - {type: volume, source: server-storage, target: /var/lib/ours-mcp, volume: {nocopy: true, subpath: state/mcp}}
+  - {type: volume, source: server-storage, target: /credentials/telegram, volume: {nocopy: true, subpath: state/credentials/telegram}}
+  - {type: volume, source: server-storage, target: /credentials/cowork, volume: {nocopy: true, subpath: state/credentials/cowork}}
+  - {type: volume, source: server-storage, target: /credentials/messenger, volume: {nocopy: true, subpath: state/credentials/messenger}}
+  - type: volume
+    source: owner-locks
+    target: "/tmp/ours-${OURS_UID:-1000}"
+    volume: {nocopy: true}
+
+x-client-order: &client-order
+  daemon: {condition: service_healthy}
+
+services:
+  prepare:
+    profiles: [administration]
+    build: *source-build
+    platform: linux/amd64
+    image: "${OURS_IMAGE:-ours-compose-2-runtime:local}"
+    user: "0:0"
+    read_only: true
+    network_mode: none
+    cap_drop: [ALL]
+    cap_add: [CHOWN, DAC_OVERRIDE, SETUID, SETGID]
+    security_opt: [no-new-privileges:true]
+    entrypoint: [node, /opt/ours/docker/client-setup.mjs]
+    command: [prepare]
+    environment:
+      OURS_UID: "${OURS_UID:-1000}"
+      OURS_GID: "${OURS_GID:-1000}"
+      OURS_DAEMON_ID: "${OURS_DAEMON_ID:?Set a stable daemon UUID}"
+      OURS_COWORK_REST_PORT: "${OURS_COWORK_PORT:-3052}"
+      OURS_MESSENGER_IDENTITY: "${OURS_MESSENGER_IDENTITY:-}"
+      OURS_BROKER_URL: "${OURS_BROKER_URL:-}"
+    volumes:
+      - {type: volume, source: server-storage, target: /storage, volume: {nocopy: true}}
+      - {type: volume, source: owner-locks, target: /owner-locks, volume: {nocopy: true}}
+
+  daemon:
+    <<: *runtime
+    environment: *owner-environment
+    volumes:
+      - {type: volume, source: server-storage, target: /var/lib/ours, volume: {nocopy: true, subpath: state/daemon}}
+      - {type: volume, source: server-storage, target: /var/lib/ours-mcp, volume: {nocopy: true, subpath: state/mcp}}
+      - {type: volume, source: owner-locks, target: "/tmp/ours-${OURS_UID:-1000}", volume: {nocopy: true}}
+    ports:
+      - {target: 3050, published: "${OURS_HOST_PORT:-3050}", host_ip: 127.0.0.1}
+    healthcheck:
+      test: [CMD, node, /opt/ours/docker/healthcheck.mjs]
+      interval: 5s
+      timeout: 4s
+      start_period: 30s
+      retries: 12
+
+  access:
+    <<: *runtime
+    environment: *owner-environment
+    volumes: *owner-volumes
+    entrypoint: [node, /opt/ours/docker/client-setup.mjs]
+    command: [access-init]
+    profiles: [administration]
+
+  telegram:
+    <<: *runtime
+    entrypoint: [/bin/sh, -e, /opt/ours/docker/start-telegram.sh]
+    environment:
+      HOME: /tmp
+      OURS_TG_CONFIG: /var/lib/ours-telegram/config.json
+      OURS_TG_STATE_DIR: /var/lib/ours-telegram
+      OURS_TG_CONTROL_PORT: "3051"
+      OURS_TG_DAEMON_URL: http://daemon:3050
+      OURS_TG_DAEMON_ID: "${OURS_DAEMON_ID:?Set a stable daemon UUID}"
+      OURS_TG_DAEMON_CREDENTIAL_PATH: /credentials/telegram/daemon-token
+    volumes:
+      - {type: volume, source: server-storage, target: /var/lib/ours-telegram, volume: {nocopy: true, subpath: state/telegram}}
+      - {type: volume, source: server-storage, target: /credentials/telegram, read_only: true, volume: {nocopy: true, subpath: state/credentials/telegram}}
+    depends_on: *client-order
+    healthcheck:
+      test: [CMD, /bin/sh, /opt/ours/docker/health-telegram.sh]
+      interval: 5s
+      timeout: 4s
+      start_period: 30s
+      retries: 12
+
+  cowork:
+    <<: *runtime
+    entrypoint: [/bin/sh, -e, /opt/ours/docker/start-cowork.sh]
+    environment:
+      HOME: /tmp
+      OURS_COWORK_CONFIG: /var/lib/ours-cowork/config.json
+      OURS_COWORK_STATE_DIR: /var/lib/ours-cowork
+      OURS_COWORK_REST_PORT: "${OURS_COWORK_PORT:-3052}"
+      OURS_DAEMON_URL: http://daemon:3050
+      OURS_DAEMON_ID: "${OURS_DAEMON_ID:?Set a stable daemon UUID}"
+      OURS_DAEMON_CREDENTIAL_PATH: /credentials/cowork/daemon-token
+    volumes:
+      - {type: volume, source: server-storage, target: /var/lib/ours-cowork, volume: {nocopy: true, subpath: state/cowork}}
+      - {type: volume, source: server-storage, target: /credentials/cowork, read_only: true, volume: {nocopy: true, subpath: state/credentials/cowork}}
+    ports:
+      - {target: "${OURS_COWORK_PORT:-3052}", published: "${OURS_COWORK_PORT:-3052}", host_ip: 127.0.0.1}
+    depends_on: *client-order
+    healthcheck:
+      test: [CMD, /bin/sh, /opt/ours/docker/health-cowork.sh]
+      interval: 5s
+      timeout: 15s
+      start_period: 30s
+      retries: 12
+
+  messenger:
+    <<: *runtime
+    entrypoint: [/bin/sh, -e, /opt/ours/docker/start-messenger.sh]
+    environment:
+      HOME: /tmp
+      OURS_DAEMON_URL: http://daemon:3050
+      OURS_DAEMON_ID: "${OURS_DAEMON_ID:?Set a stable daemon UUID}"
+      OURS_DAEMON_CREDENTIAL_PATH: /credentials/messenger/daemon-token
+      OURS_MESSENGER_IDENTITY: "${OURS_MESSENGER_IDENTITY:-}"
+      OURS_MESSENGER_HOST: 0.0.0.0
+      OURS_MESSENGER_PORT: "8420"
+      OURS_MESSENGER_PUBLIC_ORIGIN: "http://127.0.0.1:${OURS_MESSENGER_PORT:-8420}"
+      OURS_MESSENGER_STATE_DIR: /var/lib/ours-messenger
+    volumes:
+      - {type: volume, source: server-storage, target: /var/lib/ours-messenger, volume: {nocopy: true, subpath: state/messenger}}
+      - {type: volume, source: server-storage, target: /credentials/messenger, read_only: true, volume: {nocopy: true, subpath: state/credentials/messenger}}
+    ports:
+      - {target: 8420, published: "${OURS_MESSENGER_PORT:-8420}", host_ip: 127.0.0.1}
+    depends_on: *client-order
+    healthcheck:
+      test: [CMD, node, /opt/ours/docker/health-messenger.mjs]
+      interval: 5s
+      timeout: 4s
+      start_period: 30s
+      retries: 12
+
+  state-operation:
+    profiles: [maintenance]
+    build:
+      <<: *source-build
+      target: maintenance
+    platform: linux/amd64
+    image: "${OURS_MAINTENANCE_IMAGE:-ours-compose-2-maintenance:local}"
+    user: "${OURS_UID:-1000}:${OURS_GID:-1000}"
+    network_mode: none
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    command: [--help]
+    environment:
+      OURS_STATE_DOMAIN: "${OURS_STATE_DOMAIN:-daemon}"
+      OURS_STATE_ROOT: /storage
+      OURS_LIVE_ROOT: "${OURS_LIVE_ROOT:-/storage/state}"
+      OURS_BUILD_ROOT: /opt/ours
+      OURS_CLI_PATH: /opt/ours/node_modules/.bin/ours
+      OURS_DAEMON_CONFIG: /var/lib/ours/config.json
+      OURS_COWORK_CLI_PATH: /opt/ours/node_modules/.bin/ours-cowork
+      OURS_COWORK_CONFIG: /var/lib/ours-cowork/config.json
+      OURS_COWORK_STATE_DIR: /var/lib/ours-cowork
+      OURS_DAEMON_ID: "${OURS_DAEMON_ID:?Set a stable daemon UUID}"
+      OURS_COWORK_REST_PORT: "${OURS_COWORK_PORT:-3052}"
+      OURS_BROKER_URL: "${OURS_BROKER_URL:-}"
+    volumes:
+      - {type: volume, source: server-storage, target: /storage, volume: {nocopy: true}}
+      - {type: volume, source: server-storage, target: /var/lib/ours, volume: {nocopy: true, subpath: state/daemon}}
+      - {type: volume, source: server-storage, target: /var/lib/ours-mcp, volume: {nocopy: true, subpath: state/mcp}}
+      - {type: volume, source: server-storage, target: /var/lib/ours-cowork, volume: {nocopy: true, subpath: state/cowork}}
+
+volumes:
+  server-storage:
+  owner-locks:
+
+networks:
+  ours:
+    driver: bridge
+
+secrets:
+  github_token:
+    environment: OURS_BUILD_GITHUB_TOKEN

package/assets/scripts/README.md

@@ -0,0 +1,20 @@
+# Installer assets
+
+| Directory | Purpose | Caller |
+|---|---|---|
+| [build](build/README.md) | Fetch selected sources, build and package npm packages | Dockerfile or installer |
+| [runtime](runtime/README.md) | Prepare selected storage and settings, start services and check readiness | Installer and Compose |
+| [maintenance](maintenance/README.md) | Back up and restore stopped state using owning package interfaces | Installer |
+
+These are internal assets of `ours-install`; users do not invoke the scripts
+manually. Installer materializes Docker assets into the selected installation's
+runtime directory. Package mode uses the same build coordinator and the installed
+maintenance implementation.
+
+Build scripts run under Node.js. Source builds may additionally need native build
+tools, including Python for third-party dependencies. Archive and state maintenance
+do not require Python.
+
+The Dockerfile copies build scripts to `/build-scripts/` and runtime/maintenance
+scripts to `/opt/ours/docker/`. Runtime services receive only their selected state
+subdirectories; maintenance operates on the installation's shared state tree.

package/assets/scripts/build/README.md

@@ -0,0 +1,39 @@
+# Build
+
+Inputs: [sources.json](../../sources.json), access to selected Git/npm sources and,
+when needed, the BuildKit secret `github_token`. Docker builds run these scripts
+inside the image build; package installations run them in installer-selected
+staging on the host. Outputs: npm archives and one package.json under
+`OURS_BUILD_ROOT` (default `/opt/ours`) for the final installation.
+
+| File | Responsibility |
+|---|---|
+| `build.mjs` | Fetch sources, run required recipes in order and generate the final manifest |
+| `build-sdk.mjs` | Build SDK and CLI from one repository, including MUFL |
+| `build-mcp.mjs` | Build selected packages from the MCP monorepo |
+| `build-telegram.mjs`, `build-cowork.mjs`, `build-messenger.mjs`, `build-fleet.mjs` | Build the corresponding repository with the selected SDK/CLI |
+| `record-build.mjs` | Finalize a fresh npm installation: record the resolved tree, protect owned inputs and verify/publish vendor context |
+| `build-common.mjs` | Shared archive naming and dispatch to consumer-owned build recipes |
+
+The Dockerfile invokes `node /build-scripts/build.mjs`; no manual script calls are
+needed. Each Git repository is built once. Selected published npm packages are
+retrieved without rebuilding them. Archives are created inside the image; prebuilt
+dependencies are not included in the delivery directory.
+
+Telegram, Cowork, Messenger and Fleet own `scripts/build-selected.mjs`. The
+assembler passes the actual selected SDK and CLI archives with `--sdk PATH --cli
+PATH --out-dir PATH`, reads the JSON `filename`, verifies the packed package name,
+and collects it using the existing archive naming convention. The owning recipe
+handles disposable dependency preparation, build and portable packing. Consumer
+source manifests and locks are not rewritten by the assembler. Missing owner
+recipes or selected SDK/CLI archives fail explicitly; there is no fallback build.
+SDK and MCP retain their existing repository build owners.
+
+After the final npm install, the owning installer/Dockerfile runs `record-build.mjs`.
+It requires a fresh output with no retained dependency tree/context, verifies actual
+archive bytes and lock/tree bindings, and writes context privately. An existing
+context is never regenerated as historical evidence. Image export makes non-secret
+provenance root-owned and readable for configured runtime UIDs; host/state copies
+remain private. Docker images carrying context are labelled
+`network.ours.build-context=1`; a missing/copy-failed context on such an image aborts
+preparation instead of treating it as legacy.

package/assets/scripts/build/build-common.mjs

@@ -0,0 +1,37 @@
+/** Shared npm operations for the six fixed repository recipes. */
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { join, basename, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+export const ROOT = resolve(process.env.OURS_BUILD_ROOT || '/opt/ours');
+export const SOURCE_ROOT = resolve(process.env.OURS_SOURCE_ROOT || '/src');
+export const OUT = join(ROOT, 'docker/vendor');
+export const CONFIG = JSON.parse(readFileSync(join(ROOT, 'sources.json'), 'utf8'));
+export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || 'sdk,cli,mcp,tg-connector,cowork,messenger-server').split(',').map(name => '@ours.network/' + name));
+export const inheritedLock = process.env.OURS_INSTALLER_LOCK_FD === '3' ? [3] : [];
+export const run = (args, cwd) => execFileSync(args[0], args.slice(1), { cwd, stdio: ['inherit', 'inherit', 'inherit', ...inheritedLock] });
+export const capture = (args, cwd, env = process.env) => execFileSync(args[0], args.slice(1), { cwd, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit', ...inheritedLock] });
+export const archive = packageName => join(OUT, `ours.network-${packageName.replace(/^@ours\.network\//, '')}.tgz`);
+// npm already owns package archive interpretation; no second tar parser here.
+export const manifest = path => JSON.parse(capture(['npm', 'pack', '--dry-run', '--ignore-scripts', '--json', path], ROOT))[0];
+export function pack(cwd, packageName, source) {
+  if (!SELECTED.has(packageName) || CONFIG.packages[packageName]?.source !== source) return;
+  const result = JSON.parse(capture(['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', OUT], cwd))[0];
+  renameSync(join(OUT, result.filename), archive(packageName));
+}
+export function buildConsumer(source, packageName) {
+  if (!SELECTED.has(packageName) || CONFIG.packages[packageName]?.source !== source) return;
+  const directory = join(SOURCE_ROOT, source);
+  const recipe = join(directory, 'scripts/build-selected.mjs');
+  const sdk = archive('@ours.network/sdk'), cli = archive('@ours.network/cli');
+  for (const input of [recipe, sdk, cli]) if (!existsSync(input)) throw Error(`${packageName}: required build input missing: ${input}`);
+  mkdirSync(OUT, { recursive: true });
+  const output = mkdtempSync(join(OUT, source + '-'));
+  try {
+    const result = JSON.parse(capture([process.execPath, recipe, '--sdk', sdk, '--cli', cli, '--out-dir', output], directory));
+    if (typeof result.filename !== 'string' || basename(result.filename) !== result.filename) throw Error(`${packageName}: recipe must return an archive filename`);
+    const packed = join(output, result.filename);
+    if (manifest(packed).name !== packageName) throw Error(`Packed output does not match selection: ${packageName}`);
+    renameSync(packed, archive(packageName));
+  } finally { rmSync(output, { recursive: true, force: true }); }
+}

package/assets/scripts/build/build-cowork.mjs

@@ -0,0 +1,2 @@
+import { buildConsumer } from './build-common.mjs';
+buildConsumer('cowork', '@ours.network/cowork');

package/assets/scripts/build/build-fleet.mjs

@@ -0,0 +1,2 @@
+import { buildConsumer } from './build-common.mjs';
+buildConsumer('fleet', '@ours.network/fleet');

package/assets/scripts/build/build-mcp.mjs

@@ -0,0 +1,9 @@
+import { join } from 'node:path';
+import { SOURCE_ROOT, SELECTED, pack, run } from './build-common.mjs';
+const source = join(SOURCE_ROOT, 'mcp');
+run(['npm', 'ci', '--ignore-scripts', '--no-audit', '--no-fund'], source);
+for (const [directory, name] of [['core', 'mcp'], ['codex', 'codex'], ['claude-code', 'claude-code'], ['installer', 'install']]) {
+  if (!SELECTED.has('@ours.network/' + name)) continue;
+  if (name !== 'install') run(['npm', 'run', 'build', '--workspace', '@ours.network/' + name], source);
+  pack(join(source, 'packages', directory), '@ours.network/' + name, 'mcp');
+}

package/assets/scripts/build/build-messenger.mjs

@@ -0,0 +1,2 @@
+import { buildConsumer } from './build-common.mjs';
+buildConsumer('messenger', '@ours.network/messenger-server');

package/assets/scripts/build/build-sdk.mjs

@@ -0,0 +1,9 @@
+import { join } from 'node:path';
+import { SOURCE_ROOT, SELECTED, pack, run } from './build-common.mjs';
+const source = join(SOURCE_ROOT, 'sdk');
+run(['npm', 'ci', '--no-audit', '--no-fund'], source);
+run(['bash', 'scripts/compile-mufl.sh'], source);
+run(['npm', 'run', 'build'], source);
+if (SELECTED.has('@ours.network/cli')) run(['npm', 'run', 'build:cli'], source);
+pack(source, '@ours.network/sdk', 'sdk');
+pack(join(source, 'packages/cli'), '@ours.network/cli', 'sdk');

package/assets/scripts/build/build-telegram.mjs

@@ -0,0 +1,2 @@
+import { buildConsumer } from './build-common.mjs';
+buildConsumer('telegram', '@ours.network/tg-connector');