@ouro.bot/cli 0.1.0-alpha.723 → 0.1.0-alpha.724

package/dist/heart/daemon/cli-exec.js

@@ -3707,6 +3707,57 @@ function hostedMissingMailKeys(body, keys) {
         rotateSourceGrant: missingSourceGrant,
     };
 }
+/**
+ * Key ids the public registry declares for this agent, or `[]` when the
+ * registry cannot be consulted.
+ *
+ * `requiredHostedKeyIds` derives the asserted set from the ensure response
+ * alone, so anything the response omits is never asserted — and the server
+ * omits `sourceGrant` unless a source alias is in play. That is how the
+ * 2026-07-24 gap passed: the registry declared a source-grant key, the vault
+ * never received its private half, and setup reported success. The registry is
+ * the authority on what mail is currently being encrypted to, so it is
+ * consulted too.
+ *
+ * Never throws. An unreachable registry degrades to the response-only
+ * assertion, because refusing a setup that previously succeeded — on a machine
+ * whose Azure credentials happen to be unavailable — would be a worse failure
+ * than the one this guards against.
+ *
+ * The agent match is case-insensitive: the harness sends `agentId: agent`
+ * verbatim in the ensure payload while registry records can carry the
+ * lowercased form.
+ */
+async function hostedRegistryDeclaredKeyIds(input) {
+    try {
+        const publicRegistry = isPlainRecord(input.body.publicRegistry) ? input.body.publicRegistry : {};
+        const managedIdentityClientId = stringField(input.existingMailroom ?? {}, "azureManagedIdentityClientId");
+        const registry = await input.readRegistry({
+            mailboxAddress: "",
+            privateKeys: {},
+            registryAzureAccountUrl: stringField(publicRegistry, "azureAccountUrl"),
+            registryContainer: stringField(publicRegistry, "container"),
+            registryBlob: stringField(publicRegistry, "blob"),
+            ...(managedIdentityClientId ? { azureManagedIdentityClientId: managedIdentityClientId } : {}),
+        });
+        const wanted = input.agent.toLowerCase();
+        const isThisAgent = (agentId) => agentId.toLowerCase() === wanted;
+        return [
+            ...registry.mailboxes.filter((mailbox) => isThisAgent(mailbox.agentId)).map((mailbox) => mailbox.keyId),
+            ...registry.sourceGrants.filter((grant) => isThisAgent(grant.agentId) && grant.enabled).map((grant) => grant.keyId),
+        ].filter((keyId) => keyId.trim().length > 0);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "cli",
+            event: "cli.hosted_mail_registry_assertion_skipped",
+            message: "hosted mail key assertion could not consult the public registry",
+            meta: { agent: input.agent, error: error instanceof Error ? error.message : String(error) },
+        });
+        return [];
+    }
+}
 function assertHostedPrivateKeys(input) {
     for (const keyId of input.requiredKeyIds) {
         if (input.keys[keyId])
@@ -3811,10 +3862,18 @@ async function ensureAgentMailroom(agent, input, deps, progressLabel) {
                 generatedPrivateKeys = responsePrivateKeys(body.generatedPrivateKeys);
                 Object.assign(privateKeys, generatedPrivateKeys);
             }
+            const registryKeyIds = await hostedRegistryDeclaredKeyIds({
+                agent,
+                body,
+                existingMailroom,
+                readRegistry: deps.readMailroomRegistry ?? reader_1.readMailroomRegistry,
+            });
             assertHostedPrivateKeys({
                 agent,
                 keys: privateKeys,
-                requiredKeyIds: requiredHostedKeyIds(body),
+                // Union, not replacement: the response still names keys it just minted,
+                // which a registry read taken before the write would not yet show.
+                requiredKeyIds: [...new Set([...requiredHostedKeyIds(body), ...registryKeyIds])],
             });
             const publicRegistry = requiredResponseRecord(body.publicRegistry, "publicRegistry");
             const blobStore = requiredResponseRecord(body.blobStore, "blobStore");

package/dist/heart/daemon/doctor.js

@@ -99,6 +99,10 @@ function textField(record, key) {
     const value = record?.[key];
     return typeof value === "string" ? value.trim() : "";
 }
+function stringArrayField(record, key) {
+    const value = record?.[key];
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
 function numberField(record, key, fallback) {
     const value = record?.[key];
     return typeof value === "number" && Number.isFinite(value) ? value : fallback;
@@ -271,6 +275,59 @@ function checkAgents(deps) {
     }
     return { name: "Agents", checks };
 }
+/**
+ * Mail key coverage, as recorded by the mail sense.
+ *
+ * Doctor reads the sense's own per-cycle verdict rather than re-deriving it:
+ * a health check must need neither network access nor Azure credentials, and
+ * the registry that declares the key ids lives in a Blob container in hosted
+ * mode. The mail sense already fetches it every cycle, so its record is both
+ * the cheapest and the only honest source here.
+ *
+ * Absent is a `fail` because mail encrypted to a key with no private half is
+ * permanently unreadable — unlike an API key, ciphertext cannot be reissued.
+ * Anything the sense could not verify is a `warn`, never a `fail`: a locked or
+ * unavailable vault must not read as key loss.
+ */
+function mailKeyCoverageCheck(deps, agentDir) {
+    const id = "mail.key_coverage";
+    const label = `${agentDir} mail key coverage`;
+    const statePath = `${deps.bundlesRoot}/${agentDir}/state/senses/mail/runtime.json`;
+    const unverified = (detail) => ({ id, label, status: "warn", detail });
+    if (!deps.existsSync(statePath)) {
+        return unverified(`no mail sense runtime state at ${statePath} — coverage is unverified until the mail sense runs a scan`);
+    }
+    let coverage;
+    try {
+        coverage = asRecord(JSON.parse(deps.readFileSync(statePath)).keyCoverage) ?? {};
+    }
+    catch {
+        return unverified(`mail sense runtime state at ${statePath} could not be read`);
+    }
+    const declaredKeyIds = stringArrayField(coverage, "declaredKeyIds");
+    const absentKeyIds = stringArrayField(coverage, "absentKeyIds");
+    const checkedAt = textField(coverage, "checkedAt");
+    const provenance = checkedAt ? ` (recorded ${checkedAt})` : "";
+    if (coverage.status === "covered") {
+        return {
+            id,
+            label,
+            status: "pass",
+            detail: declaredKeyIds.length === 1
+                ? `the 1 registry-declared mail key has a private half in the vault${provenance}`
+                : `all ${declaredKeyIds.length} registry-declared mail keys have a private half in the vault${provenance}`,
+        };
+    }
+    if (coverage.status === "absent") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: `the mailroom registry declares mail key${absentKeyIds.length === 1 ? "" : "s"} with no private half in this agent's vault — mail encrypted to ${absentKeyIds.join(", ")} cannot be decrypted and cannot be recovered${provenance}; run \`ouro connect mail --agent ${agentDir.replace(/\.ouro$/, "")}\` and, if Mail Control no longer holds the one-time key, rerun it with --rotate-missing-mail-keys to mint a replacement for future mail`,
+        };
+    }
+    return unverified(`mail sense could not verify key coverage${provenance}: ${textField(coverage, "reason") || "no reason recorded"}`);
+}
 async function checkSenses(deps) {
     const checks = [];
     const agents = discoverAgents(deps);
@@ -422,6 +479,10 @@ async function checkSenses(deps) {
                         mailAutonomyDetail(mailroom),
                     ].join("; "),
                 });
+                // Config being well-formed says nothing about whether the vault can
+                // still decrypt what the registry points mail at — the 2026-07-24 gap
+                // sat behind a passing mail config check for 23 hours.
+                checks.push(mailKeyCoverageCheck(deps, agentDir));
             }
         }
     }

package/dist/senses/mail.js

@@ -50,6 +50,125 @@ const smtp_ingress_1 = require("../mailroom/smtp-ingress");
 function readRegistry(registryPath) {
     return JSON.parse(fs.readFileSync(registryPath, "utf-8"));
 }
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function unverifiableCoverage(checkedAt, reason) {
+    return { status: "could-not-verify", declaredKeyIds: [], absentKeyIds: [], reason, checkedAt };
+}
+/**
+ * Key ids the registry says mail can currently be encrypted to for this agent.
+ *
+ * Filtered to this agent because the hosted registry is domain-wide: counting
+ * every agent's records would report another agent's keys as absent on every
+ * cycle, and a check that always fails is a check operators learn to ignore.
+ *
+ * The match is case-insensitive. The harness sends `agentId: agent` verbatim to
+ * hosted Mail Control while this repo's own hosted ensure-response fixture
+ * returns the lowercased form for that same request, so a registry record's
+ * agent id can differ from the sense's agent name by case alone. Case-sensitive
+ * matching would then declare nothing and report `could-not-verify` forever —
+ * the same silence this probe exists to end. Widening the match cannot produce
+ * a false `absent` unless two agents differ only by case, which the store and
+ * address resolvers could not tell apart either.
+ *
+ * Disabled source grants are excluded because `resolveMailAddress`
+ * (`mailroom/core.ts`) refuses their alias outright, so no new mail can be
+ * encrypted to their key and a missing private half is not a live gap.
+ */
+function registryDeclaredKeyIds(registry, agentName) {
+    const wanted = agentName.toLowerCase();
+    const isThisAgent = (agentId) => agentId.toLowerCase() === wanted;
+    const declared = [
+        ...registry.mailboxes.filter((mailbox) => isThisAgent(mailbox.agentId)).map((mailbox) => mailbox.keyId),
+        ...registry.sourceGrants.filter((grant) => isThisAgent(grant.agentId) && grant.enabled).map((grant) => grant.keyId),
+    ];
+    return [...new Set(declared.filter((keyId) => keyId.trim().length > 0))];
+}
+/**
+ * Mail key ids the vault can actually decrypt with, read fresh rather than
+ * taken from the reader resolution captured at sense startup — a sense that has
+ * been up for days would otherwise measure a key set the vault has since
+ * changed, and report a rotation as a loss.
+ *
+ * Throws rather than returning empty when the read is untrustworthy, so the
+ * caller classifies it `could-not-verify` instead of `absent`. An empty-but-
+ * present `privateKeys` record is a real observation and is not a throw.
+ */
+function vaultMailKeyIds(agentName) {
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName);
+    if (!runtime.ok)
+        throw new Error(`vault ${runtime.itemPath} read is ${runtime.reason}`);
+    const mailroom = runtime.config.mailroom;
+    const privateKeys = isRecord(mailroom) ? mailroom.privateKeys : undefined;
+    if (!isRecord(privateKeys))
+        throw new Error(`vault ${runtime.itemPath} has no mailroom.privateKeys record`);
+    return Object.entries(privateKeys)
+        .filter((entry) => typeof entry[1] === "string" && entry[1].trim().length > 0)
+        .map((entry) => entry[0]);
+}
+/**
+ * Never throws: every failure degrades to `could-not-verify`. `scan()` is
+ * awaited during sense startup, so a throw here would stop the mail sense from
+ * starting — an integrity probe must not be able to take mail down.
+ */
+async function computeMailKeyCoverage(input) {
+    try {
+        const registry = await input.readRegistry(input.config);
+        const declaredKeyIds = registryDeclaredKeyIds(registry, input.agentName);
+        if (declaredKeyIds.length === 0) {
+            // Nothing to check against is not the same as nothing wrong: reporting
+            // `covered` for an empty declaration would turn an unprovisioned or
+            // wrong registry into a green light.
+            return unverifiableCoverage(input.checkedAt, `mailroom registry declares no mail keys for ${input.agentName}`);
+        }
+        const present = new Set(vaultMailKeyIds(input.agentName));
+        const absentKeyIds = declaredKeyIds.filter((keyId) => !present.has(keyId));
+        return {
+            status: absentKeyIds.length === 0 ? "covered" : "absent",
+            declaredKeyIds,
+            absentKeyIds,
+            reason: null,
+            checkedAt: input.checkedAt,
+        };
+    }
+    catch (error) {
+        return unverifiableCoverage(input.checkedAt, error instanceof Error ? error.message : String(error));
+    }
+}
+/**
+ * Coverage has to push, not wait to be asked. `ouro doctor` is on-demand — it
+ * has no scheduled invocation — so a doctor line alone leaves a gap invisible
+ * until someone happens to run it, which is how `mail_slugger-hey_6e7b4bfa34c0b826`
+ * stayed unnoticed for 23 hours while mail encrypted to it piled up unreadable.
+ */
+function emitMailKeyCoverageEvents(agentName, coverage) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_key_coverage_recorded",
+        message: "mail key coverage recorded",
+        meta: {
+            agentName,
+            status: coverage.status,
+            declaredCount: coverage.declaredKeyIds.length,
+            absentCount: coverage.absentKeyIds.length,
+            reason: coverage.reason,
+        },
+    });
+    if (coverage.status !== "absent")
+        return;
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.mail_key_coverage_absent",
+        message: `mailroom registry declares mail keys with no private half in ${agentName}'s vault: ${coverage.absentKeyIds.join(", ")}`,
+        meta: {
+            agentName,
+            absentKeyIds: coverage.absentKeyIds,
+            declaredKeyIds: coverage.declaredKeyIds,
+        },
+    });
+}
 function validPort(value) {
     return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 65535 ? value : 0;
 }
@@ -280,6 +399,7 @@ async function startMailSenseApp(options) {
     const importDiscoveryPath = importDiscoveryStatePath(options.agentName);
     let lastScanAt = null;
     let lastQueuedCount = 0;
+    let lastKeyCoverage = unverifiableCoverage(new Date(now()).toISOString(), "mail key coverage not probed yet");
     const scan = async () => {
         const scanStartedAt = new Date(now()).toISOString();
         let queuedCount = 0;
@@ -322,6 +442,13 @@ async function startMailSenseApp(options) {
                 meta: { agentName: options.agentName, error: error instanceof Error ? error.message : String(error) },
             });
         }
+        lastKeyCoverage = await computeMailKeyCoverage({
+            agentName: options.agentName,
+            config: resolved.config,
+            readRegistry: options.readRegistry ?? reader_1.readMailroomRegistry,
+            checkedAt: scanStartedAt,
+        });
+        emitMailKeyCoverageEvents(options.agentName, lastKeyCoverage);
         lastScanAt = scanStartedAt;
         lastQueuedCount = queuedCount;
         writeRuntimeState(runtimePath, {
@@ -336,6 +463,7 @@ async function startMailSenseApp(options) {
             storeLabel: resolved.storeLabel,
             lastScanAt,
             lastQueuedCount,
+            keyCoverage: lastKeyCoverage,
             updatedAt: new Date(now()).toISOString(),
         });
     };
@@ -382,6 +510,7 @@ async function startMailSenseApp(options) {
                 storeLabel: resolved.storeLabel,
                 lastScanAt,
                 lastQueuedCount,
+                keyCoverage: lastKeyCoverage,
                 updatedAt: new Date(now()).toISOString(),
             });
             (0, runtime_1.emitNervesEvent)({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.723",
+  "version": "0.1.0-alpha.724",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",