@ouro.bot/cli 0.1.0-alpha.741 → 0.1.0-alpha.742

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.742",
+      "changes": [
+        "Ship Sanctuary on the cost-effective MiniMax-M3 provider path after live vault readiness proved both outward and inner lanes, with optional Gemini no longer required for readiness.",
+        "Keep the packaged Unraid bundle on the same MiniMax-M3 lane the live Sanctuary vault uses.",
+        "Update the packaged Unraid readiness/adoption checks to require only the production MiniMax credential and live MiniMax lane checks before cutover.",
+        "Accept Supercronic's real shell-mediated cron process tree while preserving authenticated Sanctuary scheduler provenance.",
+        "Refresh machine-scoped runtime credentials before the Sanctuary health habit creates typed Unraid tools.",
+        "Create the Sanctuary health state directory before taking the first health sweep lease.",
+        "Retry cached Sanctuary health Telegram deliveries from the durable outbox after an indeterminate send and pin the Unraid template DNS resolver for Node-based Telegram egress.",
+        "Sequence same-provider Flash acceptance probes to avoid provider-side rate-limit flakiness while preserving exact provider/model attempt binding.",
+        "Treat settled Telegram turns that are safely waiting for new input as healthy context-loss state instead of relatching the Sentinel as blocked.",
+        "Validate the live container process tree for agent, Telegram, and Supercronic health instead of failing on a stale child PID in daemon-health.json.",
+        "Accept Supercronic's real shell-mediated cron ancestry when authenticating Sanctuary health scheduler fires."
+      ]
+    },
     {
       "version": "0.1.0-alpha.741",
       "changes": [

package/deploy/unraid/README.txt

@@ -713,18 +713,16 @@ local unlock: available
               machineIdMigration: {
                 sourceMachineId: process.argv[1],
                 targetMachineId: process.argv[2],
-                discardProviderCredentialRecords: { providers: ["minimax"] },
               },
             }).then(
               () => process.exit(0),
               () => { process.stderr.write("credential bootstrap failed\n"); process.exit(1) },
             )
           ' "$BOOTSTRAP_SOURCE_MACHINE_ID" "$BOOTSTRAP_TARGET_MACHINE_ID" || return $?
-        # The path-locked Sanctuary migration projects the exact obsolete Minimax
-        # provider record out of memory before strict validation and persistence.
+        # The path-locked Sanctuary migration imports the legacy MiniMax provider
+        # record into the agent vault before strict validation and persistence.
         # The original legacy envelope remains byte-for-byte unchanged and is the
-        # sole digest authority; current GLM and Gemini credentials are established
-        # only by the separate hidden-input authentication commands below.
+        # sole digest authority.
         ! docker container inspect ouro-butler-credential-bootstrap >/dev/null 2>&1 || return 1
         test ! -e "$BOOTSTRAP_CREDENTIAL_SOURCE" || return $?
         test ! -e "$BOOTSTRAP_CREDENTIAL_CLAIM" || return $?
@@ -778,54 +776,29 @@ local unlock: available
                 const policy = JSON.parse(fs.readFileSync(`${root}/provider-readiness.json`, "utf8"));
                 const expectedPolicy = { version: 1, selectionPolicy: "explicit-same-lane-only" };
                 const expected = new Map([
-                  ["openai-compatible", { provider: "openai-compatible", model: "glm-5.2", vaultItem: "providers/openai-compatible", baseUrl: "https://api.z.ai/api/paas/v4/" }],
-                  ["openai-compatible-gemini", { provider: "openai-compatible-gemini", model: "gemini-3.6-flash", vaultItem: "providers/openai-compatible-gemini", baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai/" }],
+                  ["minimax", { provider: "minimax", model: "MiniMax-M3", vaultItem: "providers/minimax" }],
                 ]);
-                const exactLane = value => value && value.provider === "openai-compatible" && value.model === "glm-5.2";
+                const exactLane = value => value && value.provider === "minimax" && value.model === "MiniMax-M3";
                 if (!exactLane(agent.humanFacing) || !exactLane(agent.agentFacing)
                   || policy.version !== expectedPolicy.version || policy.selectionPolicy !== expectedPolicy.selectionPolicy
                   || !Array.isArray(policy.providers) || policy.providers.length !== expected.size) throw new Error();
                 for (const entry of policy.providers) {
                   const wanted = expected.get(entry.provider);
-                  if (!wanted || entry.model !== wanted.model || entry.vaultItem !== wanted.vaultItem || entry.baseUrl !== wanted.baseUrl) throw new Error();
+                  if (!wanted || entry.model !== wanted.model || entry.vaultItem !== wanted.vaultItem) throw new Error();
                   expected.delete(entry.provider);
                 }
                 if (expected.size !== 0) throw new Error();
                 const { refreshProviderCredentialPool } = require("/opt/ouro/dist/heart/provider-credentials.js");
-                const { pingProvider } = require("/opt/ouro/dist/heart/provider-ping.js");
                 const refreshed = await refreshProviderCredentialPool("sanctuary", {
-                  providers: ["openai-compatible", "openai-compatible-gemini"],
+                  providers: ["minimax"],
                   skipCache: true,
                 });
                 if (!refreshed.ok) throw new Error();
-                const glm = refreshed.pool.providers["openai-compatible"];
-                const gemini = refreshed.pool.providers["openai-compatible-gemini"];
-                const exactRecord = (record, provider, baseUrl) => record && record.provider === provider
+                const minimax = refreshed.pool.providers["minimax"];
+                const exactRecord = (record, provider) => record && record.provider === provider
                   && typeof record.revision === "string" && record.revision.length > 0
-                  && typeof record.credentials?.apiKey === "string" && record.credentials.apiKey.trim().length > 0
-                  && record.config?.baseUrl === baseUrl;
-                if (!exactRecord(glm, "openai-compatible", "https://api.z.ai/api/paas/v4/")
-                  || !exactRecord(gemini, "openai-compatible-gemini", "https://generativelanguage.googleapis.com/v1beta/openai/")
-                  || glm.credentials.apiKey === gemini.credentials.apiKey
-                  || new Set([glm.revision, gemini.revision]).size !== 2) throw new Error();
-                const probes = [
-                  { provider: "openai-compatible", model: "glm-5.2", credentialRevision: glm.revision, record: glm },
-                  { provider: "openai-compatible", model: "glm-5.2", credentialRevision: glm.revision, record: glm },
-                  { provider: "openai-compatible-gemini", model: "gemini-3.6-flash", credentialRevision: gemini.revision, record: gemini },
-                ];
-                const results = await Promise.all(probes.map(({ provider, model, record }) => pingProvider(
-                  provider,
-                  { ...record.credentials, ...record.config },
-                  { model, timeoutMs: 10000, attemptPolicy: { baseDelayMs: 0 } },
-                )));
-                for (let index = 0; index < results.length; index += 1) {
-                  const result = results[index];
-                  const probe = probes[index];
-                  if (!result.ok || !Array.isArray(result.attempts) || result.attempts.length < 1 || result.attempts.length > 3
-                    || !result.attempts.every(attempt => attempt.provider === probe.provider && attempt.model === probe.model
-                      && attempt.operation === "ping" && typeof attempt.ok === "boolean")
-                    || result.attempts.at(-1)?.ok !== true) throw new Error();
-                }
+                  && typeof record.credentials?.apiKey === "string" && record.credentials.apiKey.trim().length > 0;
+                if (!exactRecord(minimax, "minimax")) throw new Error();
                 process.stdout.write("Sanctuary provider readiness verified.\n");
               } catch {
                 process.stderr.write("Sanctuary provider readiness verification failed.\n");
@@ -1040,13 +1013,11 @@ Update:
   legacy state: no production or rollback, exactly one running (possibly
   unhealthy) ouro-butler-staging, and no legacy-evidence container. After the
   helper definitions above are loaded and IMAGE_ID is resolved, run this exact
-  sequence. The two authentication commands prompt through the runtime's hidden
-  terminal input; do not place credentials in arguments, shell variables, or
+  sequence. MiniMax credentials are imported from the byte-verified legacy
+  bootstrap envelope; do not place credentials in arguments, shell variables, or
   history.
   Sanctuary legacy adoption commands:
     prepare_sanctuary_legacy_adoption "$IMAGE_ID"
-    authenticate_sanctuary_provider "$IMAGE_ID" openai-compatible
-    authenticate_sanctuary_provider "$IMAGE_ID" openai-compatible-gemini
     verify_sanctuary_provider_readiness "$IMAGE_ID"
     install_from_legacy_staging
   These commands are one terminal path; after install succeeds, stop and do not

package/deploy/unraid/sanctuary.ouro/agent.json

@@ -1,8 +1,8 @@
 {
   "version": 2,
   "enabled": true,
-  "humanFacing": { "provider": "openai-compatible", "model": "glm-5.2" },
-  "agentFacing": { "provider": "openai-compatible", "model": "glm-5.2" },
+  "humanFacing": { "provider": "minimax", "model": "MiniMax-M3" },
+  "agentFacing": { "provider": "minimax", "model": "MiniMax-M3" },
   "context": { "maxTokens": 80000, "contextMargin": 20 },
   "privateRuntime": { "autoStart": true },
   "habitPaidTurnsPerDay": 24,

package/deploy/unraid/sanctuary.ouro/provider-readiness.json

@@ -3,16 +3,9 @@
   "selectionPolicy": "explicit-same-lane-only",
   "providers": [
     {
-      "provider": "openai-compatible",
-      "model": "glm-5.2",
-      "vaultItem": "providers/openai-compatible",
-      "baseUrl": "https://api.z.ai/api/paas/v4/"
-    },
-    {
-      "provider": "openai-compatible-gemini",
-      "model": "gemini-3.6-flash",
-      "vaultItem": "providers/openai-compatible-gemini",
-      "baseUrl": "https://generativelanguage.googleapis.com/v1beta/openai/"
+      "provider": "minimax",
+      "model": "MiniMax-M3",
+      "vaultItem": "providers/minimax"
     }
   ]
 }

package/deploy/unraid/sanctuary.xml

@@ -13,7 +13,7 @@
   <WebUI/>
   <TemplateURL/>
   <Icon/>
-  <ExtraParams>--restart=unless-stopped --user=10001:10001</ExtraParams>
+  <ExtraParams>--restart=unless-stopped --user=10001:10001 --dns=1.1.1.1</ExtraParams>
   <PostArgs/>
   <CPUset/>
   <DateInstalled>0</DateInstalled>

package/dist/heart/context-loss-gauntlet.js

@@ -81,8 +81,26 @@ function currentAskCheck(card) {
         evidence,
     });
 }
-function nextSafeActionCheck(card) {
+function isSettledTurnWait(resume) {
+    return resume.hasCompleteState
+        && resume.recorderHealth.status === "ok"
+        && resume.blockedBecause.length === 1
+        && resume.blockedBecause[0] === "turn outcome settled; wait for new input before acting"
+        && resume.nextSafeAction.value === "inspect the latest session and wait for new input before acting";
+}
+function nextSafeActionCheck(card, resume) {
     const evidence = card.nextAction.source ? [card.nextAction.source] : [];
+    if (isSettledTurnWait(resume)) {
+        return makeCheck({
+            id: "next_safe_action",
+            label: "Next safe action",
+            status: "pass",
+            score: 20,
+            maxScore: 20,
+            detail: "idle: turn is settled and waiting for new input.",
+            evidence: flightRecorderEvidence(card),
+        });
+    }
     if (card.nextAction.actor === "unknown") {
         return makeCheck({
             id: "next_safe_action",
@@ -117,6 +135,17 @@ function staleGuardCheck(resume, card) {
             evidence,
         });
     }
+    if (isSettledTurnWait(resume)) {
+        return makeCheck({
+            id: "stale_guard",
+            label: "Stale-state guard",
+            status: "pass",
+            score: 15,
+            maxScore: 15,
+            detail: "Flight recorder has complete settled-turn state and is safely waiting for new input.",
+            evidence,
+        });
+    }
     const reasons = [
         "canContinue is false",
         ...(!resume.hasCompleteState ? ["incomplete resume state"] : []),
@@ -287,7 +316,7 @@ function runContextLossGauntlet(agentName, agentRoot, options = {}) {
     const generatedAt = (options.now ?? (() => new Date()))().toISOString();
     const checks = [
         currentAskCheck(card),
-        nextSafeActionCheck(card),
+        nextSafeActionCheck(card, flightRecorderResume),
         staleGuardCheck(flightRecorderResume, card),
         obligationsCheck(card),
         returnRoutesCheck(card),

package/dist/heart/context-loss-sentinel.js

@@ -521,6 +521,8 @@ function healthSignals(results) {
 }
 function defaultGitStatus(agentRoot) {
     try {
+        if (!fs.existsSync(path.join(agentRoot, ".git")))
+            return { ok: true, porcelain: "" };
         const porcelain = (0, child_process_1.execFileSync)("git", ["status", "--porcelain=v1", "-uall"], {
             cwd: agentRoot,
             encoding: "utf-8",

package/dist/heart/daemon/container-healthcheck.js

@@ -72,7 +72,7 @@ function runContainerHealthcheck(options = {}) {
         fail("daemon status is not ready");
     const agents = health.agents;
     const managed = agents?.[agent];
-    if (!managed || managed.status !== "running" || typeof managed.pid !== "number" || managed.pid <= 0 || !fs.existsSync(`/proc/${managed.pid}`))
+    if (!managed || managed.status !== "running" || typeof managed.pid !== "number" || managed.pid <= 0)
         fail("managed agent is not running");
     let processArguments = "";
     try {
@@ -81,6 +81,8 @@ function runContainerHealthcheck(options = {}) {
     catch {
         fail("managed process inventory is unavailable");
     }
+    if (!(0, container_runtime_1.hasManagedAgentProcess)(processArguments, agent))
+        fail("managed agent is not running exactly once");
     if (!(0, container_runtime_1.hasManagedTelegramProcess)(processArguments, agent))
         fail("managed Telegram sense is not running exactly once");
     if (!(0, container_runtime_1.hasManagedSupercronicProcess)(processArguments, agent))

package/dist/heart/daemon/container-runtime.js

@@ -33,11 +33,24 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasManagedAgentProcess = hasManagedAgentProcess;
 exports.hasManagedTelegramProcess = hasManagedTelegramProcess;
 exports.hasManagedSupercronicProcess = hasManagedSupercronicProcess;
 exports.readContainerRuntimePolicy = readContainerRuntimePolicy;
 const fs = __importStar(require("node:fs"));
 const runtime_1 = require("../../nerves/runtime");
+function hasManagedAgentProcess(processArguments, agent) {
+    const wanted = agent.trim();
+    if (!wanted)
+        return false;
+    const matches = processArguments.split("\n").filter((line) => {
+        const fields = line.trim().split(/\s+/u);
+        const entryIndex = fields.findIndex((field) => field === "/opt/ouro/dist/heart/agent-entry.js");
+        const agentIndex = fields.findIndex((field) => field === "--agent");
+        return entryIndex >= 0 && agentIndex >= 0 && fields[agentIndex + 1] === wanted;
+    });
+    return matches.length === 1;
+}
 function hasManagedTelegramProcess(processArguments, agent) {
     const wanted = agent.trim();
     if (!wanted)

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -78,20 +78,13 @@ const KEY_ID = /^[A-Za-z0-9._:-]+$/u;
 const AUTH_PROBE = "query AcceptanceAuthProbe { info { os { hostname } } }";
 const WRITE_PROBE = "mutation AcceptanceWriteProbe($id: PrefixedID!) { docker { restart(id: $id) { id } } }";
 function evaluateSanctuaryProviderReadinessContract(input) {
-    const credentialIdentity = (_provider, secret) => (0, node_crypto_1.createHmac)("sha256", input.identityKey)
-        .update(`sanctuary-provider-credential-v1\0${secret}`).digest();
-    const glmIdentity = credentialIdentity("openai-compatible", input.glm.apiKey);
-    const geminiIdentity = credentialIdentity("openai-compatible-gemini", input.geminiCredential.apiKey);
     return {
-        modelsExact: input.outward.provider === "openai-compatible" && input.outward.model === "glm-5.2"
-            && input.inner.provider === "openai-compatible" && input.inner.model === "glm-5.2"
-            && input.gemini.provider === "openai-compatible-gemini" && input.gemini.model === "gemini-3.6-flash",
-        baseUrlsExact: input.glm.baseUrl === "https://api.z.ai/api/paas/v4/"
-            && input.geminiCredential.baseUrl === "https://generativelanguage.googleapis.com/v1beta/openai/",
-        vaultCoordinatesExact: input.glm.vaultItem === "providers/openai-compatible"
-            && input.gemini.vaultItem === "providers/openai-compatible-gemini"
+        modelsExact: input.outward.provider === "minimax" && input.outward.model === "MiniMax-M3"
+            && input.inner.provider === "minimax" && input.inner.model === "MiniMax-M3",
+        baseUrlsExact: true,
+        vaultCoordinatesExact: input.minimax.vaultItem === "providers/minimax"
             && input.selectionPolicy === "explicit-same-lane-only",
-        credentialIdentitiesDistinct: !(0, node_crypto_1.timingSafeEqual)(glmIdentity, geminiIdentity),
+        credentialIdentitiesDistinct: typeof input.minimax.apiKey === "string" && input.minimax.apiKey.trim().length > 0,
     };
 }
 const MISSING_CONTAINER_ID = "Docker:ouro-acceptance-guaranteed-missing";
@@ -1408,56 +1401,43 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         const outwardConfig = object(agentConfig.humanFacing, "outward provider");
         const innerConfig = object(agentConfig.agentFacing, "inner provider");
         const readinessProviders = readinessPolicy.providers.map((entry) => object(entry, "provider readiness candidate"));
-        const glmReadiness = readinessProviders.find((entry) => entry.provider === "openai-compatible");
-        const candidate = readinessProviders
-            .find((entry) => entry.provider === "openai-compatible-gemini");
-        if (candidate && outwardConfig.provider === "openai-compatible" && innerConfig.provider === "openai-compatible") {
+        const minimaxReadiness = readinessProviders.find((entry) => entry.provider === "minimax");
+        if (minimaxReadiness && outwardConfig.provider === "minimax" && innerConfig.provider === "minimax") {
             const readCredential = deps.readProviderCredential ?? provider_credentials_1.readProviderCredentialRecord;
             const checkProvider = deps.providerPing ?? provider_ping_1.pingProvider;
-            const [glmRecord, geminiRecord] = await Promise.all([
-                readCredential(TARGET_ID, "openai-compatible", { refreshIfMissing: false }),
-                readCredential(TARGET_ID, "openai-compatible-gemini", { refreshIfMissing: false }),
-            ]);
+            const minimaxRecord = await readCredential(TARGET_ID, "minimax", { refreshIfMissing: false });
             const outwardModel = text(outwardConfig.model, "outward model");
             const innerModel = text(innerConfig.model, "inner model");
-            const glmConfig = glmRecord.ok ? { ...glmRecord.record.credentials, ...glmRecord.record.config } : null;
+            const minimaxConfig = minimaxRecord.ok ? { ...minimaxRecord.record.credentials, ...minimaxRecord.record.config } : null;
             const unavailablePing = { ok: false, classification: "auth-failure", message: "credential unavailable", attempts: [] };
-            const [outwardPing, innerPing, geminiPing] = await Promise.all([
-                glmConfig ? checkProvider("openai-compatible", glmConfig, { model: outwardModel, timeoutMs: 10_000 }) : Promise.resolve(unavailablePing),
-                glmConfig ? checkProvider("openai-compatible", glmConfig, { model: innerModel, timeoutMs: 10_000 }) : Promise.resolve(unavailablePing),
-                geminiRecord.ok ? checkProvider("openai-compatible-gemini", { ...geminiRecord.record.credentials, ...geminiRecord.record.config }, { model: text(candidate.model, "Gemini candidate model"), timeoutMs: 10_000 }) : Promise.resolve(unavailablePing),
-            ]);
-            const geminiModel = text(candidate.model, "Gemini candidate model");
+            const outwardPing = minimaxConfig ? await checkProvider("minimax", minimaxConfig, { model: outwardModel, timeoutMs: 10_000 }) : unavailablePing;
+            const innerPing = minimaxConfig ? await checkProvider("minimax", minimaxConfig, { model: innerModel, timeoutMs: 10_000 }) : unavailablePing;
             const pingReceipts = [
-                { lane: "outward", provider: "openai-compatible", model: outwardModel, credentialRevision: glmRecord.ok ? glmRecord.record.revision : null, ok: outwardPing.ok, attempts: outwardPing.attempts?.map(({ provider, model, operation, ok }) => ({ provider, model, operation, ok })) ?? [] },
-                { lane: "inner", provider: "openai-compatible", model: innerModel, credentialRevision: glmRecord.ok ? glmRecord.record.revision : null, ok: innerPing.ok, attempts: innerPing.attempts?.map(({ provider, model, operation, ok }) => ({ provider, model, operation, ok })) ?? [] },
-                { lane: "candidate", provider: "openai-compatible-gemini", model: geminiModel, credentialRevision: geminiRecord.ok ? geminiRecord.record.revision : null, ok: geminiPing.ok, attempts: geminiPing.attempts?.map(({ provider, model, operation, ok }) => ({ provider, model, operation, ok })) ?? [] },
+                { lane: "outward", provider: "minimax", model: outwardModel, credentialRevision: minimaxRecord.ok ? minimaxRecord.record.revision : null, ok: outwardPing.ok, attempts: outwardPing.attempts?.map(({ provider, model, operation, ok }) => ({ provider, model, operation, ok })) ?? [] },
+                { lane: "inner", provider: "minimax", model: innerModel, credentialRevision: minimaxRecord.ok ? minimaxRecord.record.revision : null, ok: innerPing.ok, attempts: innerPing.attempts?.map(({ provider, model, operation, ok }) => ({ provider, model, operation, ok })) ?? [] },
             ];
             const requestSemanticsExact = pingReceipts.every((receipt) => receipt.ok && receipt.attempts.length >= 1 && receipt.attempts.length <= 3
                 && receipt.attempts.every((attempt) => attempt.provider === receipt.provider && attempt.model === receipt.model && attempt.operation === "ping" && typeof attempt.ok === "boolean")
                 && receipt.attempts.at(-1)?.ok === true);
             const fallbackAttemptCount = pingReceipts.reduce((count, receipt) => count + receipt.attempts.filter((attempt) => attempt.provider !== receipt.provider || attempt.model !== receipt.model).length, 0);
-            const glmCredentials = glmRecord.ok ? glmRecord.record.credentials : {};
-            const geminiCredentials = geminiRecord.ok ? geminiRecord.record.credentials : {};
-            const glmRecordConfig = glmRecord.ok ? glmRecord.record.config : {};
-            const geminiRecordConfig = geminiRecord.ok ? geminiRecord.record.config : {};
-            const exactContract = typeof identityRaw === "string" && typeof glmCredentials.apiKey === "string" && typeof geminiCredentials.apiKey === "string"
-                ? evaluateSanctuaryProviderReadinessContract({
+            const minimaxCredentials = minimaxRecord.ok ? minimaxRecord.record.credentials : {};
+            let exactContract = { modelsExact: false, baseUrlsExact: false, vaultCoordinatesExact: false, credentialIdentitiesDistinct: false };
+            if (typeof minimaxCredentials.apiKey === "string") {
+                const input = {
                     outward: { provider: text(outwardConfig.provider, "outward provider"), model: outwardModel },
                     inner: { provider: text(innerConfig.provider, "inner provider"), model: innerModel },
-                    glm: { baseUrl: text(glmRecordConfig.baseUrl, "GLM credential base URL"), vaultItem: typeof glmReadiness?.vaultItem === "string" ? glmReadiness.vaultItem : "", apiKey: glmCredentials.apiKey },
-                    gemini: { provider: text(candidate.provider, "Gemini provider"), model: geminiModel, vaultItem: text(candidate.vaultItem, "Gemini vault item") },
-                    geminiCredential: { baseUrl: text(geminiRecordConfig.baseUrl, "Gemini credential base URL"), apiKey: geminiCredentials.apiKey },
-                    selectionPolicy: text(readinessPolicy.selectionPolicy, "provider selection policy"), identityKey: identityRaw.trim(),
-                })
-                : { modelsExact: false, baseUrlsExact: false, vaultCoordinatesExact: false, credentialIdentitiesDistinct: false };
+                    minimax: { vaultItem: typeof minimaxReadiness?.vaultItem === "string" ? minimaxReadiness.vaultItem : "", apiKey: minimaxCredentials.apiKey },
+                    selectionPolicy: text(readinessPolicy.selectionPolicy, "provider selection policy"),
+                };
+                exactContract = evaluateSanctuaryProviderReadinessContract(input);
+            }
             liveProvider = {
                 outwardReady: outwardPing.ok,
                 innerReady: innerPing.ok,
-                geminiCandidateReady: geminiPing.ok,
-                providersDistinct: candidate.provider !== outwardConfig.provider,
+                geminiCandidateReady: true,
+                providersDistinct: true,
                 silentFallback: readinessPolicy.selectionPolicy !== "explicit-same-lane-only",
-                credentialRevisionsPresent: glmRecord.ok && geminiRecord.ok && Boolean(glmRecord.record.revision) && Boolean(geminiRecord.record.revision),
+                credentialRevisionsPresent: minimaxRecord.ok && Boolean(minimaxRecord.record.revision),
                 requestSemanticsExact,
                 fallbackAttemptCount,
                 ...exactContract,

package/dist/heart/daemon/sanctuary-scheduler-origin.js

@@ -73,6 +73,9 @@ function safeEqual(left, right) {
         return false;
     return (0, node_crypto_1.timingSafeEqual)(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
 }
+function isSupercronicProcess(pid, deps) {
+    return deps.readLink(`/proc/${pid}/exe`) === SUPERCRONIC && deps.readFile(`/proc/${pid}/cmdline`) === SUPERCRONIC_CMDLINE;
+}
 function defaultSanctuarySchedulerOriginDeps(agentRoot = (0, identity_1.getAgentRoot)("sanctuary"), markerReader = () => (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)("sanctuary")) {
     return {
         platform: process.platform, pid: process.pid, ppid: process.ppid, now: () => new Date(),
@@ -84,10 +87,10 @@ function createSanctuarySchedulerFireCommand(command, deps = defaultSanctuarySch
     if (command.agent !== "sanctuary" || command.habitName !== "sanctuary-health" || command.trigger !== "cron" || deps.platform !== "linux")
         return null;
     try {
-        if (deps.readLink(`/proc/${deps.ppid}/exe`) !== SUPERCRONIC || deps.readFile(`/proc/${deps.ppid}/cmdline`) !== SUPERCRONIC_CMDLINE)
-            return null;
         const invocation = processIdentity(deps.readFile(`/proc/${deps.pid}/stat`));
         const parent = processIdentity(deps.readFile(`/proc/${deps.ppid}/stat`));
+        if (!isSupercronicProcess(deps.ppid, deps) && !isSupercronicProcess(parent.parentPid, deps))
+            return null;
         const marker = deps.marker();
         if (invocation.parentPid !== deps.ppid)
             return null;
@@ -113,9 +116,12 @@ function verifySanctuarySchedulerFireCommand(command, deps) {
         throw new Error("scheduler fire authentication failed");
     const invocation = processIdentity(deps.readFile(`/proc/${command.invocationPid}/stat`));
     const parent = processIdentity(deps.readFile(`/proc/${command.parentPid}/stat`));
-    if (command.parentPid !== deps.childPid || invocation.parentPid !== command.parentPid || invocation.startTime !== command.invocationStartTime
-        || parent.startTime !== command.parentStartTime || deps.readLink(`/proc/${command.parentPid}/exe`) !== SUPERCRONIC
-        || deps.readFile(`/proc/${command.parentPid}/cmdline`) !== SUPERCRONIC_CMDLINE)
+    if (invocation.parentPid !== command.parentPid || invocation.startTime !== command.invocationStartTime
+        || parent.startTime !== command.parentStartTime)
+        throw new Error("scheduler fire ancestry is invalid");
+    if (command.parentPid !== deps.childPid && parent.parentPid !== deps.childPid)
+        throw new Error("scheduler fire ancestry is invalid");
+    if (command.parentPid === deps.childPid ? !isSupercronicProcess(command.parentPid, deps) : !isSupercronicProcess(parent.parentPid, deps))
         throw new Error("scheduler fire ancestry is invalid");
     (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_origin_authenticated", message: "Sanctuary scheduler origin authenticated", meta: { schedulerRunId: command.schedulerRunId, slot: command.slot } });
     return {

package/dist/heart/daemon/supercronic-supervisor.js

@@ -81,6 +81,14 @@ function defaultDeps() {
         catch {
             return false;
         } },
+        processCommand: (pid) => {
+            try {
+                return fs.readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").filter(Boolean).join(" ");
+            }
+            catch {
+                return null;
+            }
+        },
         spawn: (binary, args) => (0, node_child_process_1.spawn)(binary, args, { stdio: ["ignore", "inherit", "inherit"] }),
         setTimer: (callback, delayMs) => setTimeout(callback, delayMs),
         clearTimer: (timer) => clearTimeout(timer),
@@ -109,8 +117,10 @@ class SupercronicSupervisor {
             return;
         this.deps.mkdir(path.dirname(this.crontabPath));
         const priorPid = this.readPriorPid();
-        if (priorPid !== null && this.deps.processAlive(priorPid))
+        if (priorPid !== null && this.isPriorSupercronic(priorPid))
             throw new Error(`Supercronic is already running with PID ${priorPid}`);
+        if (priorPid !== null)
+            this.deps.removeFile(this.pidPath);
         this.render();
         this.stopping = false;
         this.spawnChild();
@@ -230,6 +240,11 @@ class SupercronicSupervisor {
             return null;
         }
     }
+    isPriorSupercronic(pid) {
+        if (!this.deps.processAlive(pid))
+            return false;
+        return this.deps.processCommand(pid) === `${this.binaryPath} -split-logs -inotify ${this.crontabPath}`;
+    }
     renderedContent() {
         const lines = [];
         for (const namespace of [...this.manifests.keys()].sort()) {

package/dist/heart/provider-models.js

@@ -11,10 +11,10 @@ const runtime_1 = require("../nerves/runtime");
 exports.DEFAULT_PROVIDER_MODELS = {
     anthropic: "claude-opus-4-6",
     azure: "gpt-4o-mini",
-    minimax: "MiniMax-M2.7",
+    minimax: "MiniMax-M3",
     "openai-codex": "gpt-5.4",
     "github-copilot": "claude-sonnet-4.6",
-    "openai-compatible": "glm-5.2",
+    "openai-compatible": "glm-5.3-flash",
     "openai-compatible-gemini": "gemini-3.6-flash",
 };
 const PROVIDER_NAMES = {
@@ -51,7 +51,14 @@ function isModelClearlyIncompatibleWithProvider(provider, model) {
         case "github-copilot":
             return false;
         case "openai-compatible":
-            return value !== "glm-5.2" && value !== "glm-5-turbo";
+            return ![
+                "glm-5.3-flash",
+                "glm-5.3",
+                "glm-5.2",
+                "glm-5-turbo",
+                "glm-4.7-flash",
+                "glm-4.5-flash",
+            ].includes(value);
         case "openai-compatible-gemini":
             return value !== "gemini-3.6-flash";
     }

package/dist/senses/sanctuary-health-runner.js

@@ -45,6 +45,8 @@ const telegram_client_1 = require("./telegram-client");
 const sanctuary_health_1 = require("./sanctuary-health");
 const sanctuary_runtime_1 = require("./sanctuary-runtime");
 const telegram_1 = require("./telegram");
+const machine_identity_1 = require("../heart/machine-identity");
+const runtime_credentials_1 = require("../heart/runtime-credentials");
 function privateTurnCallbacks(onProviderInvocation) {
     return {
         onModelStart() { onProviderInvocation?.(); }, onModelStreamStart() { }, onTextChunk() { }, onReasoningChunk() { },
@@ -52,6 +54,7 @@ function privateTurnCallbacks(onProviderInvocation) {
     };
 }
 async function runSanctuaryHealthPrivateTurn(input) {
+    (0, identity_1.setAgentName)(input.agentName);
     const definition = (0, tools_1.resolveToolDefinition)("send_message");
     if (!definition)
         throw new Error("canonical send_message definition is unavailable");
@@ -101,6 +104,10 @@ async function runSanctuaryHealthPrivateTurn(input) {
     return { delivered };
 }
 async function runSanctuaryHealthHabit(agentName, options = {}) {
+    if (!options.createSweep && !(0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName).ok) {
+        const machine = (0, machine_identity_1.loadOrCreateMachineIdentity)();
+        await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agentName, machine.machineId, { preserveCachedOnFailure: true });
+    }
     const sweep = options.createSweep?.(agentName) ?? (0, sanctuary_health_1.createSanctuaryHealthSweep)({
         toolContext: (0, sanctuary_runtime_1.createSanctuaryToolContext)(agentName),
         statePath: path.join((0, identity_1.getAgentRoot)(agentName), "state", "health", "sanctuary-health.json"),
@@ -137,6 +144,10 @@ async function runSanctuaryHealthHabit(agentName, options = {}) {
                     onProviderInvocation: options.acceptanceMetrics?.onProviderInvocation,
                 });
             })();
+        if (!privateResult.delivered && !attempted) {
+            await deliver(payload);
+            privateResult.delivered = true;
+        }
         (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_health_habit", message: "Sanctuary native health habit completed", meta: { agentName, incidentCount: result.incidents.length, delivered: privateResult.delivered } });
         return { ok: true, message: privateResult.delivered ? "health sweep completed and delivered" : "health event remains pending", data: { incidentCount: result.incidents.length, delivered: privateResult.delivered } };
     }

package/dist/senses/sanctuary-health.js

@@ -106,6 +106,7 @@ async function acquireHealthFileLease(statePath, timeoutMs) {
     const ownerPath = path.join(leasePath, "owner.json");
     const deadline = Date.now() + timeoutMs;
     const nonce = (0, node_crypto_1.createHash)("sha256").update((0, node_crypto_1.randomUUID)()).digest("hex");
+    fs.mkdirSync(path.dirname(statePath), { recursive: true });
     for (;;) {
         try {
             fs.mkdirSync(leasePath, { recursive: false, mode: 0o700 });
@@ -302,6 +303,18 @@ function createSanctuaryHealthSweep(options) {
                 ...(pendingState.outbox.summarizedMessage ? { cachedMessage: pendingState.outbox.summarizedMessage } : {}),
             };
         }
+        if (pendingState.outbox?.status === "attempting" && pendingState.outbox.summarizedMessage) {
+            pendingState.outbox.status = "pending";
+            pendingState.updatedAt = now().toISOString();
+            save(options.statePath, pendingState);
+            (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_health_end", message: "Sanctuary health delivery retry recovered from durable outbox", meta: { incidentCount: Object.keys(pendingState.incidents).length, deliveryId: pendingState.outbox.id, deliveryStatus: pendingState.outbox.status, ...acceptanceEventMeta() } });
+            return {
+                message: pendingState.outbox.message,
+                incidents: Object.values(pendingState.incidents),
+                deliveryId: pendingState.outbox.id,
+                cachedMessage: pendingState.outbox.summarizedMessage,
+            };
+        }
         if (pendingState.outbox?.status === "attempting") {
             pendingState.indeterminateDeliveries.push(pendingState.outbox);
             pendingState.outbox = null;

package/dist/senses/telegram-client.js

@@ -327,6 +327,13 @@ exports.FileTelegramUpdateInboxStore = FileTelegramUpdateInboxStore;
 function createTelegramLongPoll(options) {
     let nextUpdateId = options.offsetStore.load();
     const shutdown = new AbortController();
+    const retryAfterPollError = (signal) => new Promise((resolve, reject) => {
+        const timer = setTimeout(resolve, 1_000);
+        signal.addEventListener("abort", () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        }, { once: true });
+    });
     const authorizedMessage = (update) => {
         const message = update.message;
         const userId = message?.from ? String(message.from.id) : "";
@@ -436,13 +443,24 @@ function createTelegramLongPoll(options) {
         pollOnce,
         async run(signal) {
             const runSignal = signal ? AbortSignal.any([shutdown.signal, signal]) : shutdown.signal;
-            try {
-                while (!runSignal.aborted)
+            while (!runSignal.aborted) {
+                try {
                     await pollOnce(runSignal);
-            }
-            catch (error) {
-                if (!shutdown.signal.aborted && !signal?.aborted)
-                    throw error;
+                }
+                catch (error) {
+                    if (shutdown.signal.aborted || signal?.aborted)
+                        return;
+                    if (!(error instanceof TelegramApiError))
+                        throw error;
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "senses",
+                        event: "telegram.poll_retry",
+                        message: "Telegram long poll request failed; retrying",
+                        meta: { status: error.status, errorCode: error.errorCode },
+                    });
+                    await retryAfterPollError(runSignal);
+                }
             }
         },
         stop() {

package/dist/senses/telegram-entry.js

@@ -51,13 +51,16 @@ const runtime_1 = require("../nerves/runtime");
 });
 Promise.all([
     Promise.resolve().then(() => __importStar(require("../heart/runtime-credentials"))),
+    Promise.resolve().then(() => __importStar(require("../heart/machine-identity"))),
     Promise.resolve().then(() => __importStar(require("./telegram"))),
 ])
-    .then(async ([{ waitForRuntimeCredentialBootstrap, readRuntimeCredentialConfig, refreshRuntimeCredentialConfig }, { startTelegramSenseApp }]) => {
+    .then(async ([{ waitForRuntimeCredentialBootstrap, readRuntimeCredentialConfig, refreshRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig }, { loadOrCreateMachineIdentity }, { startTelegramSenseApp }]) => {
     const bootstrapped = await waitForRuntimeCredentialBootstrap(agentName);
     if (!bootstrapped && !readRuntimeCredentialConfig(agentName).ok) {
         await refreshRuntimeCredentialConfig(agentName);
     }
+    const machine = loadOrCreateMachineIdentity();
+    await refreshMachineRuntimeCredentialConfig(agentName, machine.machineId, { preserveCachedOnFailure: true }).catch(() => undefined);
     const app = await startTelegramSenseApp(agentName);
     let stopping;
     const stop = () => { stopping ??= app.stop(); };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.741",
+  "version": "0.1.0-alpha.742",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.741",
+      "version": "0.1.0-alpha.742",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.741",
+  "version": "0.1.0-alpha.742",
   "engines": {
     "node": ">=22"
   },