Fleet capability model + host-owned roster #1318

Acceptance Criteria

• A roster row round-trips { machine_id, name, server_mode, capabilities[], sshAlias, transport, last_report, health } through the schema without loss, with health ∈ {reachable, degraded, down}.
• compute and roaming are recognized as known tags; an arbitrary descriptive tag is accepted and preserved verbatim.
• A POST /amicode/roster self-report updates only the reporting machine's row (a second machine's report does not mutate the first's row).
• GET /amicode/roster on the host returns the fleet-wide roster; a client reaching it through the /amicode/*→host proxy receives the byte-identical roster (asserted against the stub host).
• The reachability status job (ops/fleet-status.sh) derives its device list from the roster rows, not the hardcoded DEVICES array.
• An unauthenticated (no data-plane credential) POST /amicode/roster is refused; the write path calls the bind_host loopback check like the other mutation routes.

Testing Decisions

• Roster schema: a round-trip + reject-malformed test (incl. the health enum) alongside the schema suites (reuse-first).
• Proxy surfacing: add a GET /amicode/roster route to the shared stub host (test/support/stub_hub.ts), then assert it proxies byte-identically in client mode (the /amicode/* proxy relay test is the pattern).
• Single-writer + auth: a test that a self-report touches only its own row, and that a credential-less write is refused (mirrors the loopback-mutation-guard route tests, e.g. solver_mode.ts/connections.ts).
• Status job: ops/fleet-status.sh is a shell script — assert via a dry-run/shellcheck-level test that it reads roster rows (lighter than a unit test; the hardcoded array is removed).

Key Decisions

• Two axes: Server mode unchanged; capabilities are a separate open set.
• The roster is amicode-owned on the Canonical Server; fleet.json is untouched (one-parser invariant, ADR 0023).
• Roster surfaced at /amicode/roster (proxied), NOT /amicode/fleet/roster (the reserved local honesty surface that 404s on clients).
• Each machine owns its row; the authoritative per-machine role stays its own fleet.json, the row is the reconciled self-report. server_mode is a read-only mirror here (UI label "role"); last_report renders as "last-seen".

Data Contracts

• Roster row: { machine_id, name, server_mode, capabilities[], sshAlias, transport, last_report, health }; health ∈ {reachable, degraded, down}; single-writer per row; schema-versioned.
• Roster routes: GET /amicode/roster (read) + POST /amicode/roster (self-report the caller's own row). Both ride the authenticated /amicode/ data plane (accept-both service/engine mint, App-shelf: extension service serves the app bundle + proxies the engine (fork-cutover static and proxy slice) #822) to the loopback-bound host — NOT the ADR-0005 Fleet token.

Constraints & Invariants

• One topology reader (ADR 0023): the roster is not a second fleet.json parser; the guard-assert gate stays green.
• Loopback bind + mutation refusal (ADR 0002/0005): the self-report write rides the authed data plane to a loopback host and calls the bind_host check.
• Server mode remains the only serve-stance authority; a capability never changes guard/tunnel/hub behavior.

Prior Art

• The /amicode/*→host proxy + shouldProxyAmicodeToHost (server.ts:242-251, reserves /amicode/fleet/* local) and its relay test; the shared stub host (test/support/stub_hub.ts); the loopback mutation-guard routes (solver_mode.ts, connections.ts, bind_host.ts); the fleet projection schema + reader; the base-tier projection producer; ops/fleet-status.sh (the hardcoded device array it replaces); the accept-both data-plane mint (App-shelf: extension service serves the app bundle + proxies the engine (fork-cutover static and proxy slice) #822).

Source

• Part of Fleet setup, generalizable machine roles & the Fleet Manager #1316.
• Durable record: ADR 0026 (docs/adr/0026-generalizable-machine-capabilities-and-host-owned-roster.md on feature/free-tier-fleet).