fleet: self-reported device identity (friendly name + device type) in the roster #1368

Acceptance Criteria

Shared derivation (@amicode/schema, lands with Slice 1)

• classifyMacModel(modelName) maps a system_profiler "Model Name" string to laptop/desktop/undefined (rehomed from the extension's classifyDeviceType; existing behavior preserved).
• classifyLinuxChassis(chassis) maps laptop|notebook|portable → laptop, desktop|tower → desktop, server|rack → server, else undefined.
• normalizeDeviceName(raw) is defined by an explicit rule and proven by a table: Mac.mynetworksettings.com → Mac, host.local → host, JJ's Mac Studio → JJ's Mac Studio (unchanged), "" → "". Rule: strip from the first . onward only when the remainder is a DNS-suffix-shaped label sequence; leave dot-free and space-bearing names intact.
• isWslKernel(procVersion) returns true for a /proc/version containing a Microsoft/WSL marker, false otherwise — extracted as a pure function from the currently-inline regex in the extension's detectWSLVersion (rebuild/host_matrix.ts).
• classifyDeviceType is exported from @amicode/schema and sidebar_view.ts imports it (behavioral assertion); a lint/grep gate confirms no private classifier body remains in the extension (structural assertion). (Replaces the untestable "no duplicate logic remains".)

Impure detection (per node package, testable)

• Each node package (extension host + amico-run) exposes a single injectable command-runner seam; a test per package feeds canned command output through the real caller into the shared pure classifier — so "on macOS/Linux/WSL the row reflects X" is a failing-test-able assertion, not a claim that requires shelling out.
• Linux type source order is specified and tested: hostnamectl chassis first, /sys/class/dmi/id/chassis_type second, then abstain. hostnamectl absent (minimal container / no systemd) ⇒ prettified hostname + device_type omitted.

Slice 1 — client row producer (amico-run enroll)

• A client enroll POSTs a roster row whose name is the resolved friendly name and whose device_type is the resolved type.
• Resolution precedence, per field, is exercised by injected seams (detectDeviceType?, a setting reader): explicit setting (amicode.device.name / amicode.device.type) → OS detection → prettified hostname (name) / undefined (type). Tests cover override-wins and honest-fallback independently — not just an opaque machineName stub.
• The friendly-name seam is decoupled from the canonical-host derivation: wiring a friendly name MUST NOT change canonical.host. (Today enrollAsServer derives host from machineName; a friendly name must not leak into canonical/the join token.)
• On macOS the row reflects ComputerName + model type; on Linux PRETTY_HOSTNAME + chassis type; on WSL a name with device_type omitted.

Slice 2 — server self-registration + both views single

• enroll --as-server POSTs its own roster row to the loopback /amicode/roster only after verifying the hub is reachable (retry-or-honest-fail like the client verify-attach path); it does not treat the dev-fallback pin probe as proof of reachability.
• The server row is keyed by machine_id = canonical.host, carries the resolved friendly name, and device_type = server (or the detected/overridden type). It uses the validated parse + single-writer upsert path (no new writer).
• A client attached to that server renders exactly one server row (synthesized node collapses against the real row via the existing de-dupe — zero client-side change).
• The server, viewing its own sidebar, renders exactly one row for itself — including when enrolled with a non-default --host (so canonical.host ≠ os.hostname()). Satisfied by resolving the server's self-row identity (readLocalDevice().machineId) to canonical.host when this machine is the server, OR de-duping the self-row against the roster on canonical.host. (Guards the live-fleet case canonical.host = Mac.mynetworksettings.com.)

Testing Decisions

• Extend packages/schema's roster tests with a table-driven suite for the pure functions (Mac model strings, Linux chassis values, /proc/version WSL strings, the normalizeDeviceName table).
• Extend packages/amico-run's enroll tests (injected seams): the POSTed client row's name/device_type, override-wins, honest-fallback, the friendly-name-does-not-touch-canonical case, and the server self-registration (machine_id === canonical.host, hub-reachability-verified-before-POST).
• Add a per-package impure-detector test feeding canned command output through the real command-runner seam.
• Extend the extension's fleet sidebar/provider tests with two cases: a client renders exactly one server row; a server renders exactly one self-row when canonical.host ≠ hostname().
• Reuse-first: extend the existing suite covering readLocalDevice/classifyDeviceType; no new file for the self-row change.

Key Decisions

• One derivation, two node consumers. Pure classification lives in @amicode/schema beside KNOWN_DEVICE_TYPES; the producer (amico-run) and the extension host self-row both call it. (The browser sidebar module is a third, re-declaring site and cannot import schema — schema pulls node builtins.)
• Impure shell behind one command-runner seam per package. The execSync/file-read platform branch is duplicated per package by necessity, but each hides behind a single injectable runner so both copies are test-covered against canned output — closing the drift hole below the pure seam.
• Server keyed by canonical host, and its own self-row too. machine_id = canonical.host for the server's row collapses the client's synthesized node; the server's self-row identity is reconciled to the same key so the server does not double-render itself under --host / FQDN drift.
• One override namespace, read by both. Canonical keys are amicode.device.name (already read by the self-row at sidebar_view.ts) + a new amicode.device.type. The amicode.device.name setting description is updated to reflect it also names the fleet device (today it documents only the dormant Device Inspector). An AC asserts the self-row and the POSTed row resolve the same override string.
• WSL abstains on type. Honest undefined rather than an unreliable in-VM chassis guess; the override covers intentional labelling.
• canonical.host is invariant after first server enroll. A re-enroll that changes --host would orphan clients' synthesized node (stale pointer, ghost row); we document canonical as immutable post-enroll and note that changing it requires re-enrolling clients, not just the server.
• Re-enroll is the refresh. Existing machines re-enroll once (idempotent upsert) to pick up identity; a periodic heartbeat is a deferred follow-up.

Data Contracts

• No change to the roster JSON schema: RosterRow.name and RosterRow.device_type? already exist and validate. This work only changes which values the producer writes.
• Settings: amicode.device.name (existing; description updated to cover the fleet device name) and a new amicode.device.type (string; suggested server|desktop|laptop, open). Both read by the extension self-row AND the enroll verb (which already reads settings.json for amicode.fleetTransport).
• New @amicode/schema exports: classifyMacModel, classifyLinuxChassis, normalizeDeviceName, isWslKernel — all pure.
• New amico-run/extension seams: a deviceType detector seam and a single command-runner seam (injectable); the friendly-name seam kept separate from the canonical.host derivation.

Constraints & Invariants

• fleet.json untouched by the roster work (one-parser invariant, ADR 0023); canonical treated as immutable post-enroll.
• Single-writer self-report (ADR 0026): a machine writes only its own row; the server's self-registration is its own row keyed by its canonical host.
• @amicode/schema stays side-effect-free; only pure functions are added.
• No silent fallback (ADR 0024/0025): undetected type → server_mode fallback; no friendly-name source → prettified hostname; hub-not-reachable at server self-register → honest fail, never a false success. Nothing fabricated.
• Never-fork (ADR 0005): no engine-spawn path is added.
• The friendly name never feeds canonical.host or the minted join token.

Prior Art

• The roster contract + vocabulary (RosterRow, KNOWN_DEVICE_TYPES, parseRosterRow, upsertRosterRow) in the schema package.
• The enroll producer (client + server paths, the injectable seams, the loopback pin probe and its dev fallback) in amico-run.
• The existing name/type derivation (scutil ComputerName, system_profiler classifier, readLocalDevice reading amicode.device.name) and the roster consumer (typeLabel = device_type ?? server_mode, the canonical-server synthesis + de-dupe, the self-row synthesis guard) in the extension.
• The proven WSL detector (/proc/version regex) in the extension's rebuild host-matrix code.

Source

• Design of record; paired with ADR 0028 (self-reported device identity in the roster) and a CONTEXT.md glossary entry ("Device identity").
• Follows fleet: sidebar shows only self on a client — client-side roster read + server-node synthesis (#1321 follow-up) #1363 (client peer visibility) and fleet: orphaned opencode engines survive VS Code reload and squat on the configured port #1359 (device_type field + type pill).
• To be decomposed into two vertical slices (client-row producer; server self-registration + both-views-single).
• Deferred follow-ups: a periodic self-report heartbeat (auto-refresh without re-enroll); a stale-row prune path.
• Reviewed by two independent /deliberate critics (code-grounding + architecture/testability); their blocking findings (server self-double-render; override-key split) and advisories are folded into the ACs above.

Notes

• One-time operator action after merge: re-enroll the existing fleet machines once so their rows pick up the friendly name + device type.
• --host <ip> makes machine_id an IP; DHCP churn would mint a new row and orphan the old one. Prefer a stable --host string; stale-row pruning is a deferred follow-up.