docs(m227): workspace chat authoring, per-source webhooks and runner labels

api-reference/scopes.mdx

@@ -32,7 +32,7 @@ curl -s https://api.agentsfleet.net/v1/fleets -H 'Authorization: Bearer af_test_
 | Scope | Effect | Included by |
 |---|---|---|
 | `fleet:read` | Reads fleets, events, and memory. | `fleet:write`, `fleet:admin` |
-| `fleet:write` | Creates, updates, and messages fleets. | `fleet:admin` |
+| `fleet:write` | Creates, updates, and messages fleets. Also reads and writes your own private drafts. | `fleet:admin` |
 | `fleet:admin` | Deletes fleets. | None |
 | `secret:read` | Lists secret names and metadata. | `secret:write` |
 | `secret:write` | Creates, rotates, and deletes secrets. Deleting a secret named for a connector also needs `connector:write`. | None |
@@ -45,8 +45,8 @@ curl -s https://api.agentsfleet.net/v1/fleets -H 'Authorization: Bearer af_test_
 | `connector:write` | Starts a connector setup flow and disconnects a connector, including by deleting its secret. | None |
 | `billing:read` | Reads the tenant balance and charges. | None |
 | `workspace:admin` | Creates and lists workspaces. | None |
-| `library:write` | Adds an entry to a workspace library, and removes one the workspace onboarded. | None |
-| `platform-library:write` | Adds an entry to the platform library. | None |
+| `library:write` | Publishes a reviewed draft as a workspace library entry or revision, and removes an entry the workspace owns. | None |
+| `platform-library:write` | Stages a reviewed draft as a platform library entry, and edits, publishes, withdraws, or deletes platform entries. | None |
 | `approval:read` | Reads pending approvals. | `approval:resolve` |
 | `approval:resolve` | Approves or denies a request. | None |
 

billing/budgets.mdx

@@ -3,50 +3,57 @@ title: Fleet budgets
 description: Daily and monthly spending limits for one fleet.
 type: explanation
 audience: user
-verified: 2026-09-12
+verified: 2026-10-15
 executable: false
 ---
 
 # Fleet budgets
 
 ## What it is
 
-A fleet budget limits how much one fleet can spend. The fleet author sets the budget in `TRIGGER.md`.
+A fleet budget limits how much one fleet can spend. The fleet author sets the budget in `budget` under `config["x-agentsfleet"]` in the fleet's Definition.
 
-```yaml
-budget:
-  daily_dollars: 5.0
-  monthly_dollars: 29.0
+```json
+{
+  "budget": {
+    "daily_nanos": "5000000000",
+    "monthly_nanos": "29000000000"
+  }
+}
 ```
 
-`daily_dollars` is required. `monthly_dollars` is optional.
+Each limit is a decimal string of whole nanodollars. One dollar is `"1000000000"`, so the example allows 5 dollars a day and 29 dollars a month.
+
+`daily_nanos` is required. `monthly_nanos` is optional; leave it out for no monthly limit.
 
 ## Why it exists
 
 Every workspace under one tenant shares the same credit balance. A fleet budget stops one fleet from draining that shared balance.
 
 The dashboard header shows what is left of that balance on every page, as a **Credits** chip beside the workspace switcher. It appears on screens at least 640px wide. Select the chip to open **Settings → Billing**, which holds the live figure and the charge history.
 
-The fleet owns its budget. Updating the fleet replaces the limits, and deleting the fleet removes them.
+The fleet owns its budget. Applying a reviewed setup change replaces the limits, and deleting the fleet removes them.
 
 ## How it behaves
 
 The daily limit covers a rolling 24-hour window. The monthly limit covers one Coordinated Universal Time (UTC) calendar month.
 
 `agentsfleet` checks the limits before a run and while the run continues. A reached limit blocks new work and stops an active run at its next billing check.
 
-A blocked event does not retry. Raise the limit, update the fleet, and send a new event.
+A blocked event does not retry. Raise the limit in an improvement chat, apply the change, and send a new event.
 
 The fleet, memory, and activity stream survive a budget stop. A stopped run has no final result.
 
 ## Limits
 
 | Field | Default | Unit | Valid range |
 |---|---|---|---|
-| `daily_dollars` | None; required | Dollars per rolling 24 hours | More than `$0` and at most `$1,000` |
-| `monthly_dollars` | None | Dollars per UTC month | More than `$0` and at most `$10,000` |
+| `daily_nanos` | None; required | Nanodollars per rolling 24 hours | `"1"` through `"1000000000000"`, which is `$1,000` |
+| `monthly_nanos` | None | Nanodollars per UTC month | `"1"` through `"10000000000000"`, which is `$10,000` |
+
+Zero, signs, decimal points, exponents, and numbers outside the range are refused. A JSON number in place of the string is refused too.
 
-An invalid budget blocks fleet installation. A stored budget that cannot be read blocks the next run.
+An invalid budget blocks review and Save with `UZ-REQ-001`. A stored budget that cannot be read blocks the next run.
 
 `UZ-RUN-015` marks a budget stop during a run. `UZ-EXEC-015` records the final failure class.
 

changelog.mdx

@@ -7,6 +7,54 @@ description: "Stay up to date with the latest agentsfleet product updates, new f
   agentsfleet is in **stealth-mode testing** and pre-production. APIs and agent behavior may change between releases without long deprecation windows. Email [agentsfleet@agentmail.to](mailto:agentsfleet@agentmail.to) if you want a hand calibrating an agent or to join as a design partner.
 </Tip>
 
+<Update label="Oct 15, 2026" tags={["Upgrading", "What's new", "API reference", "CLI"]}>
+  ## Fleets are written in a private chat, reviewed, and saved
+
+  A fleet now starts as a private draft in the dashboard or in `agentsfleet chat`. You review its exact setup, then choose Save; publishing to the Fleet library is a separate choice. `SKILL.md` and `TRIGGER.md` bundles are removed, with every command and route that imported or exported them. Run `agentsfleet-runner` 0.61.0 or later; an earlier runner is refused. [Author a fleet](/fleets/authoring) covers the new flow.
+
+  ## Upgrading
+
+  - **Bundle storage is dropped** — migration `950_drop_fleet_bundle_storage.sql` drops `core.fleet_library`, `core.tenant_fleet_library`, and the `core.fleets` columns `source_markdown`, `trigger_markdown`, `bundle_content_hash`, and `bundle_snapshot_key`. Run `agentsfleetd migrate` in the rollout that replaces the binary.
+  - **Runners upgrade with the daemon** — `POST /v1/runners/me/leases` now requires `accepted_kinds`, so a runner from an earlier build is refused.
+  - **Budgets are whole nanodollars** — `daily_nanos` and `monthly_nanos` replace `daily_dollars` and `monthly_dollars`, as decimal strings. `"1000000000"` is one dollar; the caps are `"1000000000000"` a day and `"10000000000000"` a month.
+  - **Platform entries start over** — repository-imported entries leave with `core.fleet_library`. An operator stages a reviewed draft, then publishes it from **Fleet library** under Platform.
+  - **Webhook URLs name their source** — `POST /v1/webhooks/{fleet_id}` is removed. Each webhook trigger receives deliveries at `POST /v1/webhooks/{fleet_id}/{source}`, so register the `url` from the fleet's `webhook_urls` with the provider again.
+  - **Every webhook source must be verifiable** — a webhook `source` must be `github`, `linear`, or `slack`, or its trigger must declare `signature.secret_ref` for a Svix-signed provider. A Definition with any other source is refused, and so is one that sets `signature.header`, `signature.prefix`, or `signature.ts_header`.
+  - **The `api` trigger is removed** — `triggers` may be empty or absent, and such a fleet runs only when it is sent a message. A Definition that names `{"type": "api"}` is refused.
+
+  ## What's new
+
+  - **Private drafts** — only the person who starts a draft can read it. Each chat message is charged to the workspace owner's balance, and a short balance fails the message with `UZ-AUTHOR-007`.
+  - **Review before Save** — a review shows the full Definition, its required access, its readiness checks, and a `review_digest`. Save, Apply, and publish refuse a stale digest with `UZ-AUTHOR-006`.
+  - **Setup can wait** — a Save with an unmet check leaves the fleet `installing` and names each check. Saving raises the fleet's integration grant; `agentsfleet resume` finishes setup once it is approved, and `agentsfleet kill` cancels it.
+  - **Improve, then Apply** — **Setup → Improve in private chat** opens a draft pinned to the fleet's setup revision. **Apply reviewed setup** makes it the next revision; running work keeps the one it started with.
+  - **Library publication is explicit** — Save never publishes. Publishing creates an entry or appends an immutable revision, and fleets keep the revision they were saved from.
+  - **Slack channels live in the Definition** — a `mention` trigger with `"source": "slack"` and one ID in `channels` attaches a fleet to a channel. [Answer mentions in Slack](/fleets/slack) shows the entry.
+
+  ## API reference
+
+  - **Drafts** — `GET` and `POST /v1/workspaces/{workspace_id}/drafts`; `GET`, `PATCH`, and `DELETE /v1/workspaces/{workspace_id}/drafts/{draft_id}`; `GET` and `POST .../drafts/{draft_id}/messages`; `POST .../drafts/{draft_id}/cancellations`; `GET .../drafts/{draft_id}/events/stream`.
+  - **Library revisions** — `GET /v1/workspaces/{workspace_id}/fleet-libraries/owned`; `GET` and `DELETE .../fleet-libraries/{library_id}`; `GET` and `POST .../fleet-libraries/{library_id}/revisions`; `GET .../revisions/{revision_id}`.
+  - **Models and fleet revisions** — `GET /v1/workspaces/{workspace_id}/models?purpose=authoring` lists the owner's eligible models. `POST /v1/workspaces/{workspace_id}/fleets/{fleet_id}/revisions` applies a reviewed improvement under `If-Match` and `Idempotency-Key`.
+  - **Runner authoring routes** — `POST /v1/runners/me/authoring-leases/{lease_id}/renew`, `/activity`, `/reports`, and `/model-calls`. A `lease_id` that is not a version 7 Universally Unique Identifier (UUIDv7) answers `400` with `UZ-REQ-001`.
+  - **Save takes a reviewed source** — `POST /v1/workspaces/{workspace_id}/fleets` requires an `Idempotency-Key` header and `{source, name, review_digest, start}`. `source` is a draft candidate or a Library revision; `platform_library_id`, `tenant_library_id`, and `slack_channel_id` are gone.
+  - **Save and run now reports its first run** — with `start` set to `{"kind": "run_now", "message": "<TEXT>"}`, Save answers `201` even when the first run's queue receipt is not saved yet. The reply's `start.state` reads `pending` until then and `accepted` after, and a retry with the same `Idempotency-Key` confirms the same run.
+  - **Runner `PATCH` edits labels** — `PATCH /v1/fleets/runners/{runner_id}` takes `labels` alone or with `assigned_policy`, and replaces the runner's whole label set. A runner holds at most 32 labels of at most 64 bytes each.
+  - **Fleet `PATCH` sets status and name only** — `If-Match` is required, and a missing tag answers `428` with `UZ-AUTHOR-004`. `source_markdown`, `trigger_markdown`, and `config_json` are gone from the body.
+  - **Publication bodies** — `POST /v1/workspaces/{workspace_id}/fleet-libraries` takes `{draft_candidate_id, label}` with an `Idempotency-Key` header. `POST /v1/admin/fleet-libraries` stages `{workspace_id, draft_candidate_id, label}`, and `PATCH` with `published` publishes or withdraws.
+  - **Removed routes** — `GET /v1/workspaces/{workspace_id}/library-entries` (use `.../fleet-libraries/owned`), `DELETE .../library-entries/{entry_id}` (use `DELETE .../fleet-libraries/{library_id}`), `GET /v1/fleets/bundles`, `GET /v1/runners/me/bundles/{content_hash}`, `GET /v1/workspaces/{workspace_id}/preferences`, `DELETE /v1/auth/sessions/{session_id}` (use `DELETE /v1/auth/sessions`), `GET /v1/connectors/{provider}/callback`, and `POST /v1/webhooks/{fleet_id}`. No alias remains.
+  - **Typed Definition schemas** — `FleetDefinition` and the `Definition*` schemas describe the setup document `{schema_version, description, instructions_md, config}`, and fleet reads return `definition` in place of Markdown. `description` is required; it and `instructions_md` each allow 32,768 characters.
+  - **Error codes** — `UZ-AUTHOR-001` through `UZ-AUTHOR-016` are new. `UZ-BUNDLE-001` through `UZ-BUNDLE-006`, `UZ-CATALOG-001` through `UZ-CATALOG-005`, and `UZ-AGT-011` are retired.
+
+  ## CLI
+
+  - **`agentsfleet chat`** — starts or resumes a private draft. `--definition <PATH>`, `--library <LIBRARY_ID> --revision <REVISION_ID>`, and `--fleet <FLEET_ID> --setup-revision <N>` start one without a message.
+  - **Scripted setup** — with `--no-input`, `--review` prints `Review digest: <DIGEST>`. `--save`, `--apply`, and `--publish <LABEL>` then need `--review-digest <DIGEST>`, and `--publish-to <LIBRARY_ID> --library-etag <ETAG>` appends a revision.
+  - **A waiting Save exits `1`** — the client prints each unmet check and the `--operation-id` and `--candidate-id` values that resume the same Save.
+  - **Removed commands** — `agentsfleet install`, `agentsfleet library create` with `--github`, `--from`, and `--template`, `agentsfleet fleet update`, and `--slack-channel`. `agentsfleet chat` replaces them.
+  - **Library verbs** — `agentsfleet library list` lists the entries this workspace owns, and `agentsfleet library delete <LIBRARY_ID>` removes one with its revision history.
+</Update>
+
 <Update label="Oct 14, 2026" tags={["Bug fixes", "API", "CLI"]}>
   ## Logout ends its own unfinished sign-ins, and the daemon refuses an unsafe identity base