@ouro.bot/cli 0.1.0-alpha.732 → 0.1.0-alpha.734

package/dist/heart/daemon/daemon-bootstrap-startup.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.failFastContainerCredentialBootstrapStartup = failFastContainerCredentialBootstrapStartup;
+exports.startDaemonAfterContainerCredentialBootstrap = startDaemonAfterContainerCredentialBootstrap;
+const runtime_1 = require("../../nerves/runtime");
+const daemon_tombstone_1 = require("./daemon-tombstone");
+const REDACTED_BOOTSTRAP_STARTUP_ERROR = "container credential bootstrap rejected; recoverable claim retained for reconciliation";
+function failFastContainerCredentialBootstrapStartup(input) {
+    const error = new Error(REDACTED_BOOTSTRAP_STARTUP_ERROR);
+    try {
+        (0, daemon_tombstone_1.writeDaemonTombstone)("startupFailure", error);
+    }
+    catch {
+        // Exit remains mandatory even if best-effort tombstone reporting fails.
+    }
+    try {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.entry_error",
+            message: "daemon entrypoint failed before server startup",
+            meta: { error: REDACTED_BOOTSTRAP_STARTUP_ERROR },
+        });
+    }
+    catch {
+        // Exit remains mandatory even if best-effort event reporting fails.
+    }
+    input.exit(1);
+}
+async function startDaemonAfterContainerCredentialBootstrap(input) {
+    try {
+        await input.loadBootstrap();
+    }
+    catch {
+        input.markStartupFailure();
+        failFastContainerCredentialBootstrapStartup({ exit: input.exit });
+        return false;
+    }
+    await input.startDaemon();
+    return true;
+}

package/dist/heart/daemon/daemon-entry.js

@@ -57,6 +57,8 @@ const await_scheduler_1 = require("../awaiting/await-scheduler");
 const await_expiry_1 = require("../awaiting/await-expiry");
 const os_cron_deps_1 = require("./os-cron-deps");
 const os_cron_1 = require("./os-cron");
+const container_runtime_1 = require("./container-runtime");
+const supercronic_supervisor_1 = require("./supercronic-supervisor");
 const daemon_tombstone_1 = require("./daemon-tombstone");
 const agent_config_check_1 = require("./agent-config-check");
 const pulse_1 = require("./pulse");
@@ -70,7 +72,14 @@ const context_loss_sentinel_1 = require("../context-loss-sentinel");
 const provider_credentials_1 = require("../provider-credentials");
 const runtime_credentials_1 = require("../runtime-credentials");
 const machine_identity_1 = require("../machine-identity");
+const container_credential_bootstrap_1 = require("./container-credential-bootstrap");
+const daemon_bootstrap_startup_1 = require("./daemon-bootstrap-startup");
 const auth_flow_1 = require("../auth/auth-flow");
+const sanctuary_health_runner_1 = require("../../senses/sanctuary-health-runner");
+const sanctuary_acceptance_marker_1 = require("./sanctuary-acceptance-marker");
+const sanctuary_scheduler_liveness_1 = require("./sanctuary-scheduler-liveness");
+const sanctuary_scheduler_origin_1 = require("./sanctuary-scheduler-origin");
+const telegram_1 = require("../../senses/telegram");
 function parseSocketPath(argv) {
     const socketIndex = argv.indexOf("--socket");
     if (socketIndex >= 0) {
@@ -244,6 +253,17 @@ const taskScheduler = new task_scheduler_1.TaskDrivenScheduler({
 });
 const habitSchedulers = [];
 const awaitSchedulers = [];
+const containerRuntimePolicy = (0, container_runtime_1.readContainerRuntimePolicy)();
+const supercronicSupervisor = containerRuntimePolicy?.scheduler === "supercronic"
+    ? new supercronic_supervisor_1.SupercronicSupervisor({
+        binaryPath: "/usr/local/bin/supercronic",
+        crontabPath: path.join((0, identity_1.getAgentBundlesRoot)(), "..", ".ouro-cli", "scheduler", "sanctuary.crontab"),
+        onFatal: (error) => {
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.supercronic_state", message: "Supercronic restart budget exhausted", meta: { error: error.message } });
+            process.exit(1);
+        },
+    })
+    : null;
 function habitCronLabelOwner(agent) {
     const agentPrefix = `bot.ouro.${agent}.`;
     const awaitPrefix = `${agentPrefix}await.`;
@@ -334,21 +354,25 @@ const healthMonitor = new health_monitor_1.HealthMonitor({
         catch { /* recovery is best-effort */ }
     },
 });
-let entryRuntimeStopping = false;
+let entryRuntimeStopPromise = null;
 let stopCommandExitScheduled = false;
 function stopEntryRuntime() {
-    if (entryRuntimeStopping)
-        return;
-    entryRuntimeStopping = true;
-    for (const s of habitSchedulers) {
-        s.stopWatching();
-        s.stop();
-    }
-    for (const s of awaitSchedulers) {
-        s.stopWatching();
-        s.stop();
-    }
-    healthMonitor.stopPeriodicChecks();
+    if (entryRuntimeStopPromise)
+        return entryRuntimeStopPromise;
+    entryRuntimeStopPromise = (async () => {
+        stopHealthHeartbeat();
+        for (const s of habitSchedulers) {
+            s.stopWatching();
+            s.stop();
+        }
+        for (const s of awaitSchedulers) {
+            s.stopWatching();
+            s.stop();
+        }
+        await supercronicSupervisor?.stop();
+        healthMonitor.stopPeriodicChecks();
+    })();
+    return entryRuntimeStopPromise;
 }
 function scheduleCleanProcessExitAfterStopCommand() {
     if (stopCommandExitScheduled)
@@ -367,9 +391,56 @@ const daemon = new daemon_1.OuroDaemon({
     scheduler,
     healthMonitor,
     router,
+    schedulerFireVerifier: (command) => {
+        if (!supercronicSupervisor)
+            throw new Error("Supercronic scheduler is unavailable");
+        const marker = (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)("sanctuary");
+        return (0, sanctuary_scheduler_origin_1.verifySanctuarySchedulerFireCommand)(command, {
+            childPid: supercronicSupervisor.authenticatedSnapshot("habit:sanctuary").childPid,
+            identityKey: (0, telegram_1.readOrCreateTelegramIdentityKey)(path.join((0, identity_1.getAgentBundlesRoot)(), "sanctuary.ouro")),
+            scenarioHandleDigest: marker?.label === "unit-16f-cron-fingerprint" ? marker.scenarioHandleDigest : null, now: () => new Date(),
+            readFile: (target) => fs.readFileSync(target, "utf8"), readLink: (target) => fs.readlinkSync(target),
+        });
+    },
+    schedulerFireConsumer: (origin) => (0, sanctuary_scheduler_liveness_1.consumeSanctuarySchedulerFire)(path.join((0, identity_1.getAgentBundlesRoot)(), "sanctuary.ouro"), origin),
+    nativeHabitRunner: async ({ agent, habitName, trigger, occurrenceId, runnerId, schedulerOrigin }) => {
+        if (agent !== "sanctuary" || habitName !== "sanctuary-health")
+            return null;
+        const marker = (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)(agent);
+        const schedulerScenario = marker?.label === "unit-16f-cron-fingerprint" ? marker : null;
+        const agentRoot = path.join((0, identity_1.getAgentBundlesRoot)(), `${agent}.ouro`);
+        const before = schedulerScenario ? (0, sanctuary_scheduler_liveness_1.readSanctuaryHealthCursor)(agentRoot) : null;
+        let providerInvocationCount = 0;
+        let privateTurnCount = 0;
+        const result = await (0, sanctuary_health_runner_1.runSanctuaryHealthHabit)(agent, schedulerScenario ? {
+            acceptanceMetrics: {
+                onPrivateTurnStart: () => { privateTurnCount += 1; },
+                onProviderInvocation: () => { providerInvocationCount += 1; },
+            },
+        } : {});
+        if (schedulerScenario) {
+            if (!supercronicSupervisor || !before || !occurrenceId || !schedulerOrigin)
+                throw new Error("Sanctuary scheduler liveness supervisor provenance is unavailable");
+            (0, sanctuary_scheduler_liveness_1.recordSanctuarySchedulerLivenessReceipt)({
+                agentRoot,
+                trigger,
+                occurrenceId,
+                runnerId,
+                scenario: schedulerScenario,
+                supervisor: supercronicSupervisor.authenticatedSnapshot("habit:sanctuary"),
+                before,
+                providerInvocationCount,
+                privateTurnCount,
+                schedulerOrigin,
+                identityKey: (0, telegram_1.readOrCreateTelegramIdentityKey)(agentRoot),
+            });
+        }
+        return result;
+    },
+    nativeHabitMatch: (agent, habitName) => agent === "sanctuary" && habitName === "sanctuary-health",
     mode,
-    onStopCommandComplete: () => {
-        stopEntryRuntime();
+    onStopCommandComplete: async () => {
+        await stopEntryRuntime();
         scheduleCleanProcessExitAfterStopCommand();
     },
 });
@@ -495,6 +566,7 @@ function emitAwaitSetupError(agent, error) {
 const healthWriter = new daemon_health_1.DaemonHealthWriter((0, daemon_health_1.getDefaultHealthPath)());
 const healthSink = (0, daemon_health_1.createHealthNervesSink)(healthWriter, buildDaemonHealthState);
 (0, index_1.registerGlobalLogSink)(healthSink);
+const stopHealthHeartbeat = (0, daemon_health_1.startDaemonHealthHeartbeat)(healthWriter, buildDaemonHealthState);
 /* v8 ignore stop */
 function writeStopCommandHealthState() {
     try {
@@ -611,10 +683,20 @@ function scheduleStartupSentinelAfterProviderPreload(agent, preload) {
     /* v8 ignore stop */
 }
 /* v8 ignore start -- habit wiring: lambdas delegate to processManager/fs; tested via HabitScheduler unit tests @preserve */
-void daemon.start().then(async () => {
+void (0, daemon_bootstrap_startup_1.startDaemonAfterContainerCredentialBootstrap)({
+    loadBootstrap: () => (0, container_credential_bootstrap_1.loadContainerCredentialBootstrap)(managedAgents),
+    startDaemon: () => daemon.start(),
+    markStartupFailure: () => { _tombstoneWritten = true; },
+    exit: (code) => process.exit(code),
+}).then(async (started) => {
+    if (!started)
+        return;
+    supercronicSupervisor?.start();
     const providerPreload = startProviderCredentialPoolPreload();
     const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
-    const ouroPath = (0, os_cron_deps_1.resolveOuroBinaryPath)();
+    const ouroPath = supercronicSupervisor
+        ? "/usr/local/bin/node /opt/ouro/dist/heart/daemon/ouro-entry.js"
+        : (0, os_cron_deps_1.resolveOuroBinaryPath)();
     const osCronDeps = (0, os_cron_deps_1.createRealOsCronDeps)();
     for (const agent of managedAgents) {
         scheduleStartupSentinelAfterProviderPreload(agent, providerPreload);
@@ -624,13 +706,15 @@ void daemon.start().then(async () => {
         try {
             // Migrate old tasks/habits/ to habits/ at bundle root
             (0, habit_migration_1.migrateHabitsFromTaskSystem)(bundleRoot);
-            const osCronManager = new os_cron_1.LaunchdCronManager(osCronDeps, { ownsLabel: habitCronLabelOwner(agent) });
+            const osCronManager = supercronicSupervisor
+                ? supercronicSupervisor.namespace(`habit:${agent}`)
+                : new os_cron_1.LaunchdCronManager(osCronDeps, { ownsLabel: habitCronLabelOwner(agent) });
             const scheduler = new habit_scheduler_1.HabitScheduler({
                 agent,
                 habitsDir,
                 osCronManager,
                 onHabitFire: (habitName, trigger, context) => {
-                    if ((0, habit_policy_1.isRsvpHabitName)(habitName)) {
+                    if ((0, habit_policy_1.isRsvpHabitName)(habitName) || (agent === "sanctuary" && habitName === "sanctuary-health")) {
                         (0, socket_client_1.sendDaemonCommand)(socketPath, {
                             kind: "habit.poke",
                             agent,
@@ -676,7 +760,9 @@ void daemon.start().then(async () => {
                     ouroPath,
                     watch: (dir, cb) => fs.watch(dir, cb),
                 },
-                execForVerify: verifyOsCron,
+                execForVerify: supercronicSupervisor ? () => supercronicSupervisor.verificationOutput() : verifyOsCron,
+                verifyJobs: supercronicSupervisor ? (jobs) => supercronicSupervisor.verifyNamespace(`habit:${agent}`, jobs) : undefined,
+                platform: supercronicSupervisor ? "linux" : undefined,
             });
             try {
                 scheduler.start();
@@ -719,7 +805,9 @@ void daemon.start().then(async () => {
         const awaitsDir = path.join(bundleRoot, "awaiting");
         const awaitDegradedComponent = `awaits:${agent}`;
         try {
-            const awaitOsCronManager = new os_cron_1.LaunchdCronManager(osCronDeps, { ownsLabel: awaitCronLabelOwner(agent) });
+            const awaitOsCronManager = supercronicSupervisor
+                ? supercronicSupervisor.namespace(`await:${agent}`)
+                : new os_cron_1.LaunchdCronManager(osCronDeps, { ownsLabel: awaitCronLabelOwner(agent) });
             const awaitScheduler = new await_scheduler_1.AwaitScheduler({
                 agent,
                 awaitsDir,
@@ -782,7 +870,9 @@ void daemon.start().then(async () => {
                     ouroPath,
                     watch: (dir, cb) => fs.watch(dir, cb),
                 },
-                execForVerify: verifyOsCron,
+                execForVerify: supercronicSupervisor ? () => supercronicSupervisor.verificationOutput() : verifyOsCron,
+                verifyJobs: supercronicSupervisor ? (jobs) => supercronicSupervisor.verifyNamespace(`await:${agent}`, jobs) : undefined,
+                platform: supercronicSupervisor ? "linux" : undefined,
             });
             try {
                 awaitScheduler.start();
@@ -853,10 +943,9 @@ process.on("SIGINT", () => {
     // tombstone is strictly better than silence.
     _tombstoneWritten = true;
     (0, daemon_tombstone_1.writeDaemonTombstone)("sigint", new Error("daemon received SIGINT"));
-    stopEntryRuntime();
-    const forcedExit = setTimeout(() => process.exit(1), 5_000);
+    const forcedExit = setTimeout(() => process.exit(1), 12_000);
     forcedExit.unref();
-    void daemon.stop().then(() => {
+    void stopEntryRuntime().then(() => daemon.stop()).then(() => {
         clearTimeout(forcedExit);
         process.exit(0);
     }, () => {
@@ -867,10 +956,9 @@ process.on("SIGINT", () => {
 process.on("SIGTERM", () => {
     _tombstoneWritten = true;
     (0, daemon_tombstone_1.writeDaemonTombstone)("sigterm", new Error("daemon received SIGTERM"));
-    stopEntryRuntime();
-    const forcedExit = setTimeout(() => process.exit(1), 5_000);
+    const forcedExit = setTimeout(() => process.exit(1), 12_000);
     forcedExit.unref();
-    void daemon.stop().then(() => {
+    void stopEntryRuntime().then(() => daemon.stop()).then(() => {
         clearTimeout(forcedExit);
         process.exit(0);
     }, () => {

package/dist/heart/daemon/daemon-health.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HEALTH_TRACKED_EVENTS = exports.DaemonHealthWriter = void 0;
 exports.isRollupStatus = isRollupStatus;
 exports.isDaemonStatus = isDaemonStatus;
+exports.startDaemonHealthHeartbeat = startDaemonHealthHeartbeat;
 exports.getDefaultHealthPath = getDefaultHealthPath;
 exports.createHealthNervesSink = createHealthNervesSink;
 exports.readHealth = readHealth;
@@ -100,6 +101,15 @@ class DaemonHealthWriter {
     }
 }
 exports.DaemonHealthWriter = DaemonHealthWriter;
+function startDaemonHealthHeartbeat(writer, getState, intervalMs = 30_000) {
+    if (!Number.isFinite(intervalMs) || intervalMs <= 0)
+        throw new Error("health heartbeat interval must be positive");
+    const write = () => writer.writeHealth(getState());
+    write();
+    const timer = setInterval(write, intervalMs);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
 function getDefaultHealthPath() {
     return path.join(os.homedir(), ".ouro-cli", "daemon-health.json");
 }

package/dist/heart/daemon/daemon.js

@@ -49,6 +49,7 @@ const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const node_crypto_1 = require("node:crypto");
 const identity_1 = require("../identity");
 const agent_discovery_1 = require("./agent-discovery");
 const runtime_1 = require("../../nerves/runtime");
@@ -78,6 +79,8 @@ const habit_parser_1 = require("../habits/habit-parser");
 const habit_runtime_state_1 = require("../habits/habit-runtime-state");
 const router_1 = require("../external-events/router");
 const habit_policy_1 = require("../../rsvp/habit-policy");
+const container_runtime_1 = require("./container-runtime");
+const habit_session_1 = require("../habits/habit-session");
 const PIDFILE_PATH = path.join(os.homedir(), ".ouro-cli", "daemon.pids");
 /**
  * Defense-in-depth: detect if we're running under vitest. The pidfile lives
@@ -127,6 +130,7 @@ function parseOrphanPidsFromPs(psOutput, selfPid) {
             && !line.includes("mail-entry.js")
             && !line.includes("teams-entry.js")
             && !line.includes("a2a-entry.js")
+            && !line.includes("telegram-entry.js")
             && !line.includes("voice-entry.js"))
             continue;
         // Parse `<pid> <ppid> <command...>`. ps pads these with leading spaces.
@@ -616,6 +620,12 @@ class OuroDaemon {
     onStopCommandComplete;
     externalEventRoot;
     rsvpHabitRunner;
+    nativeHabitRunner;
+    nativeHabitMatch;
+    nativeHabitClaims = new Set();
+    authenticatedSchedulerPokes = new WeakMap();
+    schedulerFireVerifier;
+    schedulerFireConsumer;
     orphanStartupDrain;
     constructor(options) {
         this.socketPath = options.socketPath;
@@ -631,6 +641,10 @@ class OuroDaemon {
         this.onStopCommandComplete = options.onStopCommandComplete ?? null;
         this.externalEventRoot = options.externalEventRoot ?? null;
         this.rsvpHabitRunner = options.rsvpHabitRunner;
+        this.nativeHabitRunner = options.nativeHabitRunner;
+        this.nativeHabitMatch = options.nativeHabitMatch;
+        this.schedulerFireVerifier = options.schedulerFireVerifier;
+        this.schedulerFireConsumer = options.schedulerFireConsumer;
         this.orphanStartupDrain = options.orphanStartupDrain ?? drainOrphanProcessesBeforeStartup;
     }
     /* v8 ignore start -- default mailbox server wiring: production-only path, tests inject mailboxServerFactory stub instead. startMailboxHttpServer itself has full coverage in mailbox-http.test.ts @preserve */
@@ -752,19 +766,21 @@ class OuroDaemon {
         }
     }
     async startInner() {
+        const containerPolicy = (0, container_runtime_1.readContainerRuntimePolicy)();
         // Register update hooks and apply pending updates before starting agents
         (0, update_hooks_1.registerUpdateHook)(bundle_meta_1.bundleMetaHook);
         (0, update_hooks_1.registerUpdateHook)(agent_config_v2_1.agentConfigV2Hook);
         const currentVersion = (0, bundle_manifest_1.getPackageVersion)();
-        await (0, update_hooks_1.applyPendingUpdates)(this.bundlesRoot, currentVersion);
+        if (containerPolicy?.updates !== "disabled")
+            await (0, update_hooks_1.applyPendingUpdates)(this.bundlesRoot, currentVersion);
         // Start periodic update checker (polls npm registry every 30 minutes)
         // Skip in dev mode — dev builds should not auto-update from npm
-        if (this.mode === "dev") {
+        if (this.mode === "dev" || containerPolicy?.updates === "disabled") {
             (0, runtime_1.emitNervesEvent)({
                 component: "daemon",
                 event: "daemon.update_checker_skip",
                 message: "skipping update checker in dev mode",
-                meta: { reason: "dev mode" },
+                meta: { reason: this.mode === "dev" ? "dev mode" : "container policy" },
             });
         }
         else {
@@ -1538,7 +1554,7 @@ class OuroDaemon {
                     await this.stop();
                 }
                 finally {
-                    this.onStopCommandComplete?.();
+                    await this.onStopCommandComplete?.();
                 }
                 return { ok: true, message: "daemon stopped" };
             case "daemon.restart": {
@@ -1559,7 +1575,7 @@ class OuroDaemon {
                     await this.stop();
                 }
                 finally {
-                    this.onStopCommandComplete?.();
+                    await this.onStopCommandComplete?.();
                 }
                 return {
                     ok: true,
@@ -1872,6 +1888,26 @@ class OuroDaemon {
                     data: receipt,
                 };
             }
+            case "habit.scheduler-fire": {
+                if (!this.schedulerFireVerifier || !this.schedulerFireConsumer)
+                    return { ok: false, error: "authenticated scheduler fire is unavailable" };
+                let origin;
+                try {
+                    origin = this.schedulerFireVerifier(command);
+                    this.schedulerFireConsumer(origin);
+                }
+                catch (error) {
+                    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+                }
+                const poke = { kind: "habit.poke", agent: command.agent, habitName: command.habitName, trigger: "cron", occurrenceId: origin.occurrenceId };
+                this.authenticatedSchedulerPokes.set(poke, origin);
+                try {
+                    return await this.handleCommand(poke);
+                }
+                finally {
+                    this.authenticatedSchedulerPokes.delete(poke);
+                }
+            }
             case "habit.poke": {
                 if (!isValidHabitPokeCommand(command)) {
                     return {
@@ -1883,6 +1919,10 @@ class OuroDaemon {
                 if (!(0, flight_recorder_1.isHabitRunTrigger)(trigger)) {
                     return { ok: false, error: `invalid habit trigger: ${String(trigger)}` };
                 }
+                const schedulerOrigin = this.authenticatedSchedulerPokes.get(command);
+                if (command.agent === "sanctuary" && command.habitName === "sanctuary-health" && trigger === "cron" && !schedulerOrigin) {
+                    return { ok: false, error: "Sanctuary cron habit requires authenticated Supercronic provenance" };
+                }
                 if (!(0, habit_policy_1.isRsvpHabitName)(command.habitName) && !this.hasManagedPrivateRuntime(command.agent)) {
                     return {
                         ok: false,
@@ -1915,6 +1955,53 @@ class OuroDaemon {
                     trigger,
                     resolution,
                 });
+                if (this.nativeHabitRunner && this.nativeHabitMatch?.(command.agent, command.habitName)) {
+                    const occurrenceId = resolution.occurrenceId ?? `${trigger}:${command.agent}:${command.habitName}`;
+                    const claimKey = `${command.agent}:${command.habitName}`;
+                    if (this.nativeHabitClaims.has(claimKey)) {
+                        return { ok: true, message: `skipped overlapping native habit occurrence ${occurrenceId}` };
+                    }
+                    this.nativeHabitClaims.add(claimKey);
+                    const startedAt = new Date().toISOString();
+                    const runnerId = (0, node_crypto_1.randomUUID)();
+                    let nativeResult;
+                    try {
+                        nativeResult = await this.nativeHabitRunner({
+                            agent: command.agent,
+                            habitName: command.habitName,
+                            trigger,
+                            occurrenceId,
+                            runnerId,
+                            ...(schedulerOrigin ? { schedulerOrigin } : {}),
+                        }) ?? { ok: false, error: "native habit runner declined a matched habit" };
+                    }
+                    catch (error) {
+                        nativeResult = { ok: false, error: error instanceof Error ? error.message : String(error) };
+                    }
+                    const endedAt = new Date().toISOString();
+                    let completion;
+                    try {
+                        completion = (0, habit_session_1.completeHabitRun)({
+                            agentRoot: path.join(this.bundlesRoot, `${command.agent}.ouro`),
+                            habit: resolution.habit,
+                            runId: runnerId,
+                            trigger,
+                            startedAt,
+                            endedAt,
+                            operationId: occurrenceId,
+                            permissionEnvelope: { schemaVersion: 1, canMessageOutward: true, returnRoutes: [], deniedTools: [], warnings: [] },
+                            toolPolicy: { requestedTools: null, grantedTools: [], deniedTools: [], outwardMessagingAllowed: true },
+                            ...(nativeResult.ok ? {} : { errors: [nativeResult.error ?? nativeResult.message ?? "native habit failed"] }),
+                        });
+                    }
+                    finally {
+                        this.nativeHabitClaims.delete(claimKey);
+                    }
+                    if (!completion.receiptWritten || !completion.runtimeStateRecorded) {
+                        return { ok: false, error: "native habit completed but its durable receipt or cursor could not be recorded", data: nativeResult };
+                    }
+                    return nativeResult;
+                }
                 if ((0, habit_policy_1.isRsvpHabitName)(command.habitName)) {
                     return this.runNativeRsvpHabit(command, trigger, resolution.occurrenceId);
                 }

package/dist/heart/daemon/doctor.js

@@ -35,6 +35,7 @@ const nerves_1 = require("../../nerves");
 const config_1 = require("../../rsvp/config");
 const cutover_1 = require("../../rsvp/cutover");
 const diagnostics_1 = require("../../rsvp/diagnostics");
+const blob_store_1 = require("../../mailroom/blob-store");
 const hosted_cache_sync_1 = require("../../mailroom/hosted-cache-sync");
 const search_cache_1 = require("../../mailroom/search-cache");
 const prunable_bundle_1 = require("./prunable-bundle");
@@ -1137,27 +1138,73 @@ async function hostedMailCacheAuthorityCheck(deps, agentDir, store) {
     const documentsById = new Map();
     let malformedOrNoncanonical = 0;
     for (const fileName of fileNames) {
-        const document = parseCacheDocument(deps, `${cacheDir}/${fileName}`);
+        const filePath = `${cacheDir}/${fileName}`;
+        let regularFile = false;
+        try {
+            const fileStat = deps.lstatSync?.(filePath);
+            regularFile = fileStat?.isFile?.() === true && !fileStat.isSymbolicLink();
+        }
+        catch {
+            // A disappearing or unreadable entry is not usable cache evidence.
+        }
+        if (!regularFile) {
+            malformedOrNoncanonical += 1;
+            continue;
+        }
+        const document = parseCacheDocument(deps, filePath);
         if (!document || document.agentId !== agentName || fileName !== `${document.messageId}.json` || !recordsById.has(document.messageId)) {
             malformedOrNoncanonical += 1;
             continue;
         }
         documentsById.set(document.messageId, document);
     }
+    const receiptsById = new Map();
+    let invalidReceipts = 0;
+    try {
+        for (const inspected of (0, search_cache_1.inspectMailSearchSkipReceipts)(agentName, { cacheDirForAgent: () => cacheDir })) {
+            const receipt = inspected.receipt;
+            const record = receipt ? recordsById.get(receipt.messageId) : undefined;
+            const currentFingerprint = record
+                ? (0, blob_store_1.canonicalMailIndexRecordSnapshot)([record]).messageIndexFingerprint
+                : null;
+            if (!receipt ||
+                !inspected.canonical ||
+                !record ||
+                documentsById.has(receipt.messageId) ||
+                receipt.recordFingerprint !== currentFingerprint ||
+                store.privateKeyIds.has(receipt.missingKeyId)) {
+                invalidReceipts += 1;
+                continue;
+            }
+            receiptsById.set(receipt.messageId, receipt.missingKeyId);
+        }
+    }
+    catch (error) {
+        return {
+            ...base,
+            status: "warn",
+            detail: `hosted authority is sound but local skip receipts are unreadable: ${String(error)}; run \`ouro mail sync-cache --agent ${agentName}\``,
+        };
+    }
     let missing = 0;
+    let receiptedMissing = 0;
     let stale = 0;
     let invalidKeyProvenance = 0;
     for (const record of observation.records) {
         const document = documentsById.get(record.id);
         if (!document) {
-            missing += 1;
+            if (receiptsById.has(record.id))
+                receiptedMissing += 1;
+            else
+                missing += 1;
             continue;
         }
         if (!(0, hosted_cache_sync_1.mailSearchCacheDocumentMatchesRecord)(document, record, true)) {
             stale += 1;
             continue;
         }
-        if (!document.decryptionKeyId || !store.privateKeyIds.has(document.decryptionKeyId)) {
+        if (document.bodyForm === "encrypted" &&
+            (!document.decryptionKeyId || !store.privateKeyIds.has(document.decryptionKeyId))) {
             invalidKeyProvenance += 1;
         }
     }
@@ -1175,21 +1222,23 @@ async function hostedMailCacheAuthorityCheck(deps, agentDir, store) {
         && coverage.skippedMessageCount === observation.snapshot.visibleMessageCount - expectedCachedCount;
     if (coverageMatches
         && coverage.skippedMessageCount > 0
-        && missing === coverage.skippedMessageCount
+        && receiptedMissing === coverage.skippedMessageCount
+        && missing === 0
         && stale === 0
         && malformedOrNoncanonical === 0
+        && invalidReceipts === 0
         && invalidKeyProvenance === 0) {
         return {
             ...base,
             status: "warn",
-            detail: `hosted authority is sound; the last completed sync skipped ${missing} hosted message(s), so local search remains incomplete; retry only if conditions have changed since that sync`,
+            detail: `hosted authority is sound; the last completed sync skipped ${receiptedMissing} hosted message(s) with current per-message missing-key receipts, so local search remains incomplete; retry only if conditions have changed since that sync`,
         };
     }
-    if (malformedOrNoncanonical > 0 || missing > 0 || stale > 0 || invalidKeyProvenance > 0 || !coverageMatches) {
+    if (malformedOrNoncanonical > 0 || missing > 0 || stale > 0 || invalidReceipts > 0 || invalidKeyProvenance > 0 || !coverageMatches) {
         return {
             ...base,
             status: "warn",
-            detail: `hosted authority is sound but cache diverges: ${missing + stale} missing/stale canonical document(s), ${malformedOrNoncanonical} malformed/orphan/noncanonical/duplicate file(s), ${invalidKeyProvenance} invalid key provenance document(s), all-scope coverage ${coverageMatches ? "matches" : "missing/malformed/stale"}; run \`ouro mail sync-cache --agent ${agentName}\``,
+            detail: `hosted authority is sound but cache diverges: ${missing + stale} unreceipted-missing/stale canonical document(s), ${malformedOrNoncanonical} malformed/orphan/noncanonical/duplicate cache file(s), ${invalidReceipts} malformed/orphan/stale/recoverable skip receipt(s), ${invalidKeyProvenance} invalid key provenance document(s), all-scope coverage ${coverageMatches ? "matches" : "missing/malformed/stale"}; run \`ouro mail sync-cache --agent ${agentName}\``,
         };
     }
     const count = observation.records.length;

package/dist/heart/daemon/runtime-logging.js

@@ -52,6 +52,12 @@ function defaultLoggingForProcess(processName) {
             sinks: ["ndjson"],
         };
     }
+    if (processName === "telegram") {
+        return {
+            level: "info",
+            sinks: ["terminal", "ndjson"],
+        };
+    }
     if (processName === "bluebubbles" || processName === "mail" || processName === "voice" || processName === "a2a") {
         return {
             level: "warn",

package/dist/heart/daemon/runtime-mode.js

@@ -50,11 +50,22 @@ function detectRuntimeMode(rootPath, deps = {}) {
         });
         return "production";
     }
+    const isWorktree = rootPath.includes(".claude/worktrees/");
+    const isGitRepo = checkExists(path.join(rootPath, ".git"));
+    if (!isWorktree && !isGitRepo && checkExists(path.join(rootPath, "container-runtime.json"))) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.runtime_mode_detected",
+            message: "detected runtime mode",
+            meta: { rootPath, mode: "production", reason: "container-runtime" },
+        });
+        return "production";
+    }
     // 2-4. Everything else is dev: worktrees, git repos, unknown paths
     // (conservative default: assume dev unless proven production)
-    const reason = rootPath.includes(".claude/worktrees/")
+    const reason = isWorktree
         ? "worktree"
-        : checkExists(path.join(rootPath, ".git"))
+        : isGitRepo
             ? "git-repo"
             : "unknown";
     (0, runtime_1.emitNervesEvent)({