@ouro.bot/cli 0.1.0-alpha.741 → 0.1.0-alpha.743

package/dist/heart/daemon/sanctuary-acceptance-scenarios.js

@@ -106,7 +106,7 @@ function verifySanctuaryPostbootIntegrity(before, after, scenarioHandleDigest, o
 const HEALTH_SCENARIO_LABELS = new Set([
     "unit-16f-cron-fingerprint",
     "unit-16g-health-transition",
-    "unit-16h-daily-digest",
+    "unit-16h-acceptance-delivery-probe",
 ]);
 const INTERACTIVE_DRIVER_LABELS = new Set([
     "unit-16l-duplicate-callback",
@@ -121,27 +121,19 @@ function hash(value) {
 }
 const CONTAINMENT_READ_SCOPE = ["ARRAY", "DASHBOARD", "DISK", "DOCKER", "INFO", "LOGS", "NOTIFICATIONS", "SHARE", "VARS"]
     .map((resource) => `${resource}:READ_ANY`).sort();
-const CONTAINMENT_TELEGRAM_PROFILE = ["unraid_list_containers", "unraid_get_container_logs", "unraid_get_storage", "unraid_get_disks", "unraid_get_notifications", "unraid_get_system", "unraid_restart_container", "ponder", "settle", "speak"];
-const CONTAINMENT_PRIVATE_PROFILE = ["send_message", "rest"];
 const CONTAINMENT_EXCLUDED_TOOLS = ["shell", "read_file", "edit_file", "vault_get", "mcp_call", "exec", "credential_get"];
 const CONTAINMENT_AUDIT_PATH = "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-audit-chain.ndjson";
-const CONTAINMENT_WRITE_POLICY = { kind: "required", policyId: "sanctuary.unraid.restart.v1", actionClass: "unraid.container.restart", requiresSoleCall: true };
-const CONTAINMENT_TELEGRAM_SCHEMA_DIGEST = "3c66299a5f70ec82f8795cae47659284e6dbc691ef49002c2fb22edba76c59b6";
-const CONTAINMENT_PRIVATE_SCHEMA_DIGEST = "61b137b2467acbcf22ca7443ee01e71ed970a62728c42aabffbdcb562f4a6a70";
 function exactContainmentAudit(evidence) {
-    const digestFields = [evidence.keyInventoryDigest, evidence.telegramSchemaDigest, evidence.privateSchemaDigest, evidence.auditLedgerDigest];
+    const digestFields = [evidence.keyInventoryDigest, evidence.telegramProfileDigest, evidence.telegramSchemaDigest, evidence.privateProfileDigest, evidence.privateSchemaDigest, evidence.auditLedgerDigest, evidence.writeApprovalPolicyDigest];
     return evidence.schemaVersion === "sanctuary-containment-audit-v1"
         && evidence.keyCount === 2
         && evidence.readScopeDigest === hash(CONTAINMENT_READ_SCOPE)
         && evidence.writeScopeDigest === hash([...CONTAINMENT_READ_SCOPE, "DOCKER:UPDATE_ANY"].sort())
         && evidence.keyRoleAssignmentCount === 0
-        && evidence.telegramToolCount === CONTAINMENT_TELEGRAM_PROFILE.length
-        && evidence.telegramProfileDigest === hash(CONTAINMENT_TELEGRAM_PROFILE)
-        && evidence.telegramSchemaDigest === CONTAINMENT_TELEGRAM_SCHEMA_DIGEST
-        && evidence.privateToolCount === CONTAINMENT_PRIVATE_PROFILE.length
-        && evidence.privateProfileDigest === hash(CONTAINMENT_PRIVATE_PROFILE)
-        && evidence.privateSchemaDigest === CONTAINMENT_PRIVATE_SCHEMA_DIGEST
-        && evidence.resolvedHandlerCount === CONTAINMENT_TELEGRAM_PROFILE.length + CONTAINMENT_PRIVATE_PROFILE.length
+        && Number.isSafeInteger(evidence.telegramToolCount) && evidence.telegramToolCount > 0
+        && Number.isSafeInteger(evidence.privateToolCount) && evidence.privateToolCount > 0
+        && evidence.relationshipProfilesExact && evidence.handlersExact
+        && evidence.resolvedHandlerCount === evidence.telegramToolCount + evidence.privateToolCount
         && evidence.excludedToolCount === CONTAINMENT_EXCLUDED_TOOLS.length
         && evidence.excludedSchemaIntersectionCount === 0
         && evidence.fabricatedHandlerInvocationCount === 0
@@ -151,10 +143,10 @@ function exactContainmentAudit(evidence) {
         && evidence.globallyResolvableExcludedToolCount >= 1
         && evidence.auditPathDigest === (0, node_crypto_1.createHash)("sha256").update(CONTAINMENT_AUDIT_PATH).digest("hex")
         && evidence.auditRecordCount >= 2 && evidence.auditLifecyclePairCount >= 1
-        && evidence.containerUser === "10001:10001" && evidence.liveProcessUser === "10001:10001" && evidence.mountCount === 2 && evidence.publishedPortCount === 0
+        && evidence.containerUser === "10001:10001" && evidence.liveProcessUser === "10001:10001" && evidence.mountCount === 4 && evidence.publishedPortCount === 0
         && evidence.networkMode === "host" && evidence.readOnlyRoot && evidence.mountsExact && evidence.securityExact && evidence.updaterDisabled
         && !evidence.writableKeyExposure && evidence.rawWriteMaterialFieldCount === 0 && evidence.typedWriteExecutorCount === 1
-        && evidence.writeApprovalPolicyDigest === hash(CONTAINMENT_WRITE_POLICY) && !evidence.sensitiveMaterialObserved
+        && evidence.writeApprovalPolicyExact && !evidence.sensitiveMaterialObserved
         && digestFields.every((value) => SHA256.test(value));
 }
 function atomicPrivateJson(filePath, value) {
@@ -444,12 +436,12 @@ function deriveSanctuaryScenarioAssertions(label, before, after, _now, scenarioH
         case "unit-16b-runtime-vault-containment":
             if (!after.container)
                 return null;
-            if (!after.container.autostartExact || !after.container.exactImage || after.container.manualAuthRequired
-                || after.container.mountCount !== 2 || Number(after.container.user.split(":")[0]) !== 10001
+            if (!after.container.autostartExact || !after.container.exactImage || !after.container.mountsExact || after.container.manualAuthRequired
+                || after.container.mountCount !== 4 || Number(after.container.user.split(":")[0]) !== 10001
                 || after.container.publishedPortCount !== 0 || !after.container.readOnlyRoot
                 || !after.container.updaterDisabled || !after.container.vaultUnlocked)
                 return null;
-            return { autostartExact: after.container.autostartExact, exactImage: after.container.exactImage, manualAuthRequired: after.container.manualAuthRequired, mountCount: after.container.mountCount, nonRootUid: Number(after.container.user.split(":")[0]), publishedPortCount: after.container.publishedPortCount, readOnlyRoot: after.container.readOnlyRoot, updaterDisabled: after.container.updaterDisabled, vaultUnlocked: after.container.vaultUnlocked };
+            return { autostartExact: after.container.autostartExact, exactImage: after.container.exactImage, manualAuthRequired: after.container.manualAuthRequired, mountCount: after.container.mountCount, mountsExact: after.container.mountsExact, nonRootUid: Number(after.container.user.split(":")[0]), publishedPortCount: after.container.publishedPortCount, readOnlyRoot: after.container.readOnlyRoot, updaterDisabled: after.container.updaterDisabled, vaultUnlocked: after.container.vaultUnlocked };
         case "unit-16c-provider-readiness":
             return after.provider && after.provider.outwardReady && after.provider.innerReady && after.provider.geminiCandidateReady && after.provider.providersDistinct && !after.provider.silentFallback
                 && after.provider.credentialRevisionsPresent === true && after.provider.requestSemanticsExact === true && after.provider.fallbackAttemptCount === 0
@@ -463,45 +455,41 @@ function deriveSanctuaryScenarioAssertions(label, before, after, _now, scenarioH
             if (telegramResponses !== 1 || newTurns.length !== 1 || !exactFreshTelegramLifecycle(before, after, newTurns[0].updateDigest) || deliveredTurns[0].toolInvocationCount !== 1 || deliveredTurns[0].toolResultDigests.length !== 1 || !turnHasGroundedRead(after, deliveredTurns[0], "unraid_get_storage") || !exactGroundedResponse(after, deliveredTurns[0], "unraid_get_storage"))
                 return null;
             return { accurate: true, authorized: true, grounded: true, liveFactsMatched: true, mutationCount: scenarioMutationCount, responseCount: telegramResponses, responseWithinLimit: true, telegramDelivered: true };
-        case "unit-16d-2-unauthorized": {
-            if (before.events.length > after.events.length || before.events.some((entry, index) => hash(entry) !== hash(after.events[index])))
-                return null;
+        case "unit-16d-2-unknown-admission": {
             const freshEvents = recordsAdded(before.events, after.events, (entry) => hash(entry));
-            const freshDrops = freshEvents.filter((entry) => entry.event === "telegram.update_dropped");
-            if (freshDrops.length !== 1)
-                return null;
-            const drop = freshDrops[0];
-            const distinctAccount = drop.meta.distinctAccount === true
-                && typeof drop.meta.scenarioHandleDigest === "string" && SHA256.test(drop.meta.scenarioHandleDigest)
-                && typeof drop.meta.updateDigest === "string" && SHA256.test(drop.meta.updateDigest)
-                && typeof drop.meta.senderIdentityDigest === "string" && SHA256.test(drop.meta.senderIdentityDigest)
-                && typeof drop.meta.authorizedIdentityDigest === "string" && SHA256.test(drop.meta.authorizedIdentityDigest)
-                && drop.meta.senderIdentityDigest !== drop.meta.authorizedIdentityDigest
-                && drop.meta.senderDistinct === true
-                && typeof drop.meta.nextOffsetDigest === "string" && SHA256.test(drop.meta.nextOffsetDigest)
-                && typeof drop.meta.dropMac === "string" && SHA256.test(drop.meta.dropMac);
+            const beforeAdmissions = before.telegramAdmissions ?? [];
+            const afterAdmissions = after.telegramAdmissions ?? [];
+            const newAdmissions = recordsAdded(beforeAdmissions, afterAdmissions, (entry) => entry.admissionDigest);
+            const admission = newAdmissions.length === 1 ? newAdmissions[0] : null;
             const providerInvocationCount = newTurns.reduce((sum, turn) => sum + turn.providerTurnCount, 0);
             const toolInvocationCount = newTurns.reduce((sum, turn) => sum + turn.toolInvocationCount, 0);
             const durableToolRecordCount = delta(after, before, "senses.sanctuary_read_receipt");
             const workItemCount = newApprovals.length;
-            const sessionStateUnchanged = Boolean(before.identity && after.identity
-                && typeof before.identity.sessionSurfaceDigest === "string" && SHA256.test(before.identity.sessionSurfaceDigest)
-                && before.identity.sessionSurfaceDigest === after.identity.sessionSurfaceDigest
-                && typeof before.identity.friendSurfaceDigest === "string" && SHA256.test(before.identity.friendSurfaceDigest)
-                && before.identity.friendSurfaceDigest === after.identity.friendSurfaceDigest);
-            const forbiddenWorkEvent = freshEvents.some((entry) => entry.event === "senses.telegram_turn_start" || entry.event === "senses.telegram_turn_end"
-                || entry.event === "senses.telegram_turn_error" || entry.event === "senses.sanctuary_read_receipt"
+            const forbiddenWorkEvent = freshEvents.some((entry) => entry.event.startsWith("senses.telegram_turn_") || entry.event === "senses.sanctuary_read_receipt"
                 || entry.event.startsWith("senses.telegram_approved_restart_") || entry.event === "senses.sanctuary_health_delivered");
             const offsetAdvanced = Number.isSafeInteger(before.telegramNextUpdateId) && Number.isSafeInteger(after.telegramNextUpdateId)
                 && Number(after.telegramNextUpdateId) === Number(before.telegramNextUpdateId) + 1;
-            const zeroWorkUnchanged = Boolean(before.zeroWork && after.zeroWork
+            const exactQuarantine = admission?.status === "pending" && admission.identityExact && admission.acknowledgementExact && admission.ownerCardExact
+                && admission.contentQuarantined && admission.relationshipAbsent && admission.capturedAt <= admission.updatedAt;
+            const zeroAgentWork = Boolean(before.zeroWork && after.zeroWork
                 && before.zeroWork.providerToolDigest === after.zeroWork.providerToolDigest
-                && before.zeroWork.outwardDigest === after.zeroWork.outwardDigest
                 && before.zeroWork.approvalMutationDigest === after.zeroWork.approvalMutationDigest
                 && before.zeroWork.sessionFriendDigest === after.zeroWork.sessionFriendDigest);
-            if (!after.containment || !exactContainmentAudit(after.containment) || !distinctAccount || !offsetAdvanced || !zeroWorkUnchanged || !sessionStateUnchanged || newTurns.length !== 0 || providerInvocationCount !== 0 || toolInvocationCount !== 0 || telegramResponses !== 0 || workItemCount !== 0 || approvalTransitions !== 0 || newAttempts.length !== 0 || scenarioMutationCount !== 0 || durableToolRecordCount !== 0 || forbiddenWorkEvent)
+            if (!exactQuarantine || !offsetAdvanced || !zeroAgentWork || newTurns.length !== 0 || telegramResponses !== 0
+                || providerInvocationCount !== 0 || toolInvocationCount !== 0 || workItemCount !== 0 || approvalTransitions !== 0 || newAttempts.length !== 0
+                || scenarioMutationCount !== 0 || durableToolRecordCount !== 0 || forbiddenWorkEvent)
                 return null;
-            return { auditRejected: true, distinctAccount, mutationCount: 0, providerInvocationCount: 0, responseCount: 0, workItemCount: 0 };
+            return {
+                acknowledgementSent: true,
+                agentTurnCount: 0,
+                distinctAccount: true,
+                mutationCount: 0,
+                ownerCardSent: true,
+                providerInvocationCount: 0,
+                quarantined: true,
+                responseCount: 0,
+                workItemCount: 0,
+            };
         }
         case "unit-16e-containment-audit":
             if (!after.containment || !exactContainmentAudit(after.containment) || scenarioMutationCount !== 0)
@@ -515,6 +503,7 @@ function deriveSanctuaryScenarioAssertions(label, before, after, _now, scenarioH
                 telegramSchemaDigest: after.containment.telegramSchemaDigest,
                 privateToolCount: after.containment.privateToolCount, privateProfileDigest: after.containment.privateProfileDigest,
                 privateSchemaDigest: after.containment.privateSchemaDigest, resolvedHandlerCount: after.containment.resolvedHandlerCount,
+                relationshipProfilesExact: after.containment.relationshipProfilesExact, handlersExact: after.containment.handlersExact,
                 excludedToolCount: after.containment.excludedToolCount, excludedSchemaIntersectionCount: after.containment.excludedSchemaIntersectionCount,
                 fabricatedHandlerInvocationCount: after.containment.fabricatedHandlerInvocationCount,
                 excludedToolAttemptCount: after.containment.excludedToolAttemptCount, excludedToolRejectedCount: after.containment.excludedToolRejectedCount,
@@ -530,6 +519,7 @@ function deriveSanctuaryScenarioAssertions(label, before, after, _now, scenarioH
                 rawWriteMaterialFieldCount: after.containment.rawWriteMaterialFieldCount,
                 typedWriteExecutorCount: after.containment.typedWriteExecutorCount,
                 writeApprovalPolicyDigest: after.containment.writeApprovalPolicyDigest,
+                writeApprovalPolicyExact: after.containment.writeApprovalPolicyExact,
                 sensitiveMaterialObserved: after.containment.sensitiveMaterialObserved,
                 mutationCount: scenarioMutationCount,
             };
@@ -570,16 +560,17 @@ function deriveSanctuaryScenarioAssertions(label, before, after, _now, scenarioH
                 return null;
             return { alertCount: 3, productionRestored: true, transitionObserved: true };
         }
-        case "unit-16h-daily-digest": {
+        case "unit-16h-acceptance-delivery-probe": {
             const probe = after.healthProbe;
-            if (!after.container?.running || !after.container.healthy || !probe || !healthProbeRestored(probe, after.cron) || probe.clockMode !== "local-daily-boundary" || probe.privateTurnCount !== 1
+            if (!after.container?.running || !after.container.healthy || !probe || !healthProbeRestored(probe, after.cron) || probe.acceptanceOnly !== true
+                || probe.productionScheduleChanged !== false || probe.clockMode !== "local-daily-boundary" || probe.privateTurnCount !== 1
                 || probe.providerInvocationCount < probe.privateTurnCount || probe.providerInvocationCount > 1_000 || probe.deliveryCount !== 1 || probe.phases.length !== 2
-                || probe.phases[0]?.ordinal !== 1 || probe.phases[0].name !== "digest-first" || probe.phases[0].trigger !== "acceptance" || probe.phases[0].fixtureStatus !== 503
+                || probe.phases[0]?.ordinal !== 1 || probe.phases[0].name !== "delivery-probe-first" || probe.phases[0].trigger !== "acceptance" || probe.phases[0].fixtureStatus !== 503
                 || !probe.phases[0].digestDue || probe.phases[0].deliveryKind !== "digest" || probe.phases[0].deliveryReceiptDigest === null
-                || probe.phases[1]?.ordinal !== 2 || probe.phases[1].name !== "digest-repeat" || probe.phases[1].trigger !== "acceptance" || probe.phases[1].fixtureStatus !== 503
+                || probe.phases[1]?.ordinal !== 2 || probe.phases[1].name !== "delivery-probe-repeat" || probe.phases[1].trigger !== "acceptance" || probe.phases[1].fixtureStatus !== 503
                 || probe.phases[1].digestDue || probe.phases[1].deliveryKind !== null || probe.phases[1].deliveryReceiptDigest !== null)
                 return null;
-            return { firedWithinMs: 0, messageCount: 1, productionRestored: true, scheduleObserved: true };
+            return { acceptanceOnly: true, deliveryPathObserved: true, firedWithinMs: 0, messageCount: 1, productionRestored: true, productionScheduleChanged: false };
         }
         case "unit-16i-delayed-approval":
             if (!exactFreshTelegramLifecycle(before, after) || !intendedRestartApproval(approval) || !completeAttemptLedgerLinked || approval.state !== "succeeded" || mutationCount !== 1 || scenarioMutationCount !== 1 || !restartSucceeded || approval.replayMutationCount !== 0 || !approval.continuationCompleted)

package/dist/heart/daemon/sanctuary-bundle-migration.js

@@ -0,0 +1,398 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_BUNDLE_ROLLBACK_FILE = exports.SANCTUARY_PACKAGE_MANAGED_FILES = void 0;
+exports.inspectSanctuaryPackageManagedBundleRollback = inspectSanctuaryPackageManagedBundleRollback;
+exports.rollbackSanctuaryPackageManagedBundle = rollbackSanctuaryPackageManagedBundle;
+exports.commitSanctuaryPackageManagedBundle = commitSanctuaryPackageManagedBundle;
+exports.migrateSanctuaryPackageManagedBundle = migrateSanctuaryPackageManagedBundle;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../../nerves/runtime");
+const steward_policy_1 = require("../steward-policy");
+exports.SANCTUARY_PACKAGE_MANAGED_FILES = [
+    "provider-readiness.json",
+    "tool-profiles.json",
+    "habits/sanctuary-health.md",
+    "psyche/ASPIRATIONS.md",
+    "psyche/IDENTITY.md",
+    "psyche/LORE.md",
+    "psyche/SOUL.md",
+    "psyche/TACIT.md",
+];
+exports.SANCTUARY_BUNDLE_ROLLBACK_FILE = ".sanctuary-package-managed-rollback.json";
+const SANCTUARY_BUNDLE_COMMITTING_FILE = `${exports.SANCTUARY_BUNDLE_ROLLBACK_FILE}.committing`;
+const BUNDLE_META_VERSION_FIELDS = ["runtimeVersion", "bundleSchemaVersion", "lastUpdated"];
+function readObject(filePath) {
+    const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${path.basename(filePath)} must contain an object`);
+    return value;
+}
+function requirePlainFile(filePath, label) {
+    let stat;
+    try {
+        stat = fs.lstatSync(filePath);
+    }
+    catch {
+        throw new Error(`${label} is missing`);
+    }
+    if (stat.isSymbolicLink())
+        throw new Error(`${label} must not be a symlink`);
+    if (!stat.isFile())
+        throw new Error(`${label} must be a regular file`);
+}
+function ensureSafeParent(agentRoot, relative) {
+    let current = agentRoot;
+    for (const segment of path.dirname(relative).split(path.sep).filter((value) => value !== ".")) {
+        current = path.join(current, segment);
+        if (!fs.existsSync(current))
+            fs.mkdirSync(current, { mode: 0o700 });
+    }
+}
+function validateDestination(agentRoot, relative) {
+    let current = agentRoot;
+    for (const segment of relative.split(path.sep)) {
+        current = path.join(current, segment);
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch {
+            return;
+        }
+        if (stat.isSymbolicLink())
+            throw new Error(`package-managed destination must not be a symlink: ${relative}`);
+        if (current !== path.join(agentRoot, relative) && !stat.isDirectory())
+            throw new Error(`package-managed destination parent must be a directory: ${relative}`);
+        if (current === path.join(agentRoot, relative) && !stat.isFile())
+            throw new Error(`package-managed destination must be a regular file: ${relative}`);
+    }
+}
+function writeAtomic(filePath, content) {
+    const stagingDirectory = fs.mkdtempSync(`${filePath}.package-migration.`);
+    const temporary = path.join(stagingDirectory, "value");
+    try {
+        const fd = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(fd, content);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(temporary, filePath);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+        fs.rmdirSync(stagingDirectory);
+    }
+    fs.chmodSync(filePath, 0o600);
+    const directory = fs.openSync(path.dirname(filePath), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        fs.fsyncSync(directory);
+    }
+    finally {
+        fs.closeSync(directory);
+    }
+}
+function cleanupInterruptedWrites(filePath) {
+    const parent = path.dirname(filePath);
+    const prefix = `${path.basename(filePath)}.package-migration.`;
+    if (!fs.existsSync(parent))
+        return;
+    for (const name of fs.readdirSync(parent)) {
+        if (!name.startsWith(prefix))
+            continue;
+        const stagingDirectory = path.join(parent, name);
+        const stagingStat = fs.lstatSync(stagingDirectory);
+        if (stagingStat.isSymbolicLink() || !stagingStat.isDirectory())
+            throw new Error(`interrupted package migration stage is invalid: ${name}`);
+        const entries = fs.readdirSync(stagingDirectory);
+        if (entries.some((entry) => entry !== "value"))
+            throw new Error(`interrupted package migration stage contains unexpected entries: ${name}`);
+        const temporary = path.join(stagingDirectory, "value");
+        if (fs.existsSync(temporary)) {
+            const temporaryStat = fs.lstatSync(temporary);
+            if (temporaryStat.isSymbolicLink() || !temporaryStat.isFile())
+                throw new Error(`interrupted package migration value is invalid: ${name}`);
+            fs.unlinkSync(temporary);
+        }
+        fs.rmdirSync(stagingDirectory);
+    }
+}
+const SNAPSHOT_RELATIVES = [...exports.SANCTUARY_PACKAGE_MANAGED_FILES, "bundle-meta.json"];
+function snapshotDirectoryRelatives() {
+    const directories = new Set();
+    for (const relative of SNAPSHOT_RELATIVES) {
+        let directory = path.dirname(relative);
+        while (directory !== ".") {
+            directories.add(directory);
+            directory = path.dirname(directory);
+        }
+    }
+    return [...directories].sort((left, right) => left.length - right.length);
+}
+function captureMigrationSnapshot(agentRoot) {
+    const files = SNAPSHOT_RELATIVES.map((relative) => {
+        const filePath = path.join(agentRoot, relative);
+        if (!fs.existsSync(filePath))
+            return { path: filePath, content: null, mode: null };
+        const stat = fs.lstatSync(filePath);
+        return { path: filePath, content: fs.readFileSync(filePath), mode: stat.mode & 0o777 };
+    });
+    const directories = snapshotDirectoryRelatives().map((relative) => {
+        const directory = path.join(agentRoot, relative);
+        if (!fs.existsSync(directory))
+            return { path: directory, mode: null };
+        const stat = fs.lstatSync(directory);
+        return { path: directory, mode: stat.mode & 0o777 };
+    });
+    return { files, directories };
+}
+function rollbackPath(agentRoot) {
+    return path.join(agentRoot, exports.SANCTUARY_BUNDLE_ROLLBACK_FILE);
+}
+function durableSnapshot(agentRoot, snapshot, rollbackImageId, targetImageId) {
+    const payload = {
+        schemaVersion: 1,
+        rollbackImageId,
+        targetImageId,
+        files: snapshot.files.map((file) => ({ relative: path.relative(agentRoot, file.path), contentBase64: file.content?.toString("base64") ?? null, mode: file.mode })),
+        directories: snapshot.directories.map((directory) => ({ relative: path.relative(agentRoot, directory.path), mode: directory.mode })),
+    };
+    return { ...payload, snapshotDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(payload)).digest("hex") };
+}
+function readDurableRecord(agentRoot) {
+    const candidates = [rollbackPath(agentRoot), path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE)].filter((candidate) => fs.existsSync(candidate));
+    if (candidates.length === 0)
+        return null;
+    if (candidates.length !== 1)
+        throw new Error("Sanctuary bundle rollback record state is ambiguous");
+    const [filePath] = candidates;
+    const stat = fs.lstatSync(filePath);
+    if (stat.isSymbolicLink())
+        throw new Error("Sanctuary bundle rollback record must not be a symlink");
+    if (!stat.isFile() || (stat.mode & 0o777) !== 0o600)
+        throw new Error("Sanctuary bundle rollback record must be a mode-0600 regular file");
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    }
+    catch {
+        throw new Error("Sanctuary bundle rollback record is invalid JSON");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Sanctuary bundle rollback record is invalid");
+    const record = value;
+    if (record.schemaVersion !== 1 || typeof record.rollbackImageId !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(record.rollbackImageId) || typeof record.targetImageId !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(record.targetImageId) || record.targetImageId === record.rollbackImageId || typeof record.snapshotDigest !== "string" || !/^[0-9a-f]{64}$/u.test(record.snapshotDigest) || !Array.isArray(record.files) || !Array.isArray(record.directories))
+        throw new Error("Sanctuary bundle rollback record is invalid");
+    const fileRelatives = record.files.map((file) => file?.relative);
+    const directoryRelatives = record.directories.map((directory) => directory?.relative);
+    const expectedDirectories = snapshotDirectoryRelatives();
+    if (JSON.stringify(fileRelatives) !== JSON.stringify(SNAPSHOT_RELATIVES) || JSON.stringify(directoryRelatives) !== JSON.stringify(expectedDirectories))
+        throw new Error("Sanctuary bundle rollback record paths are invalid");
+    for (const relative of SNAPSHOT_RELATIVES)
+        validateDestination(agentRoot, relative);
+    const validMode = (mode) => mode === null || (Number.isInteger(mode) && mode >= 0 && mode <= 0o777);
+    const files = record.files.map((file) => {
+        if (!file || typeof file.relative !== "string" || !validMode(file.mode) || (file.contentBase64 !== null && typeof file.contentBase64 !== "string") || (file.contentBase64 === null) !== (file.mode === null))
+            throw new Error("Sanctuary bundle rollback record file is invalid");
+        const content = file.contentBase64 === null ? null : Buffer.from(file.contentBase64, "base64");
+        if (file.contentBase64 !== null && (!content || content.toString("base64") !== file.contentBase64))
+            throw new Error("Sanctuary bundle rollback record content is invalid");
+        return { path: path.join(agentRoot, file.relative), content, mode: file.mode };
+    });
+    const directories = record.directories.map((directory) => {
+        if (!directory || typeof directory.relative !== "string" || !validMode(directory.mode))
+            throw new Error("Sanctuary bundle rollback record directory is invalid");
+        return { path: path.join(agentRoot, directory.relative), mode: directory.mode };
+    });
+    const payload = { schemaVersion: record.schemaVersion, rollbackImageId: record.rollbackImageId, targetImageId: record.targetImageId, files: record.files, directories: record.directories };
+    if ((0, node_crypto_1.createHash)("sha256").update(JSON.stringify(payload)).digest("hex") !== record.snapshotDigest)
+        throw new Error("Sanctuary bundle rollback record digest is invalid");
+    return { snapshot: { files, directories }, rollbackImageId: record.rollbackImageId, targetImageId: record.targetImageId, filePath, state: filePath === rollbackPath(agentRoot) ? "rollback" : "committing" };
+}
+function removeRollbackRecord(agentRoot, filePath) {
+    fs.unlinkSync(filePath);
+    const root = fs.openSync(agentRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        fs.fsyncSync(root);
+    }
+    finally {
+        fs.closeSync(root);
+    }
+}
+function validateAgentRoot(agentRoot) {
+    if (!path.isAbsolute(agentRoot))
+        throw new Error("agent root must be an absolute path");
+    const stat = fs.lstatSync(agentRoot);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error("agent root must be a real directory");
+}
+function inspectSanctuaryPackageManagedBundleRollback(agentRoot) {
+    validateAgentRoot(agentRoot);
+    const record = readDurableRecord(agentRoot);
+    return record ? { rollbackImageId: record.rollbackImageId, targetImageId: record.targetImageId, state: record.state } : null;
+}
+function rollbackSanctuaryPackageManagedBundle(agentRoot, options = {}) {
+    validateAgentRoot(agentRoot);
+    const record = readDurableRecord(agentRoot);
+    if (!record)
+        return false;
+    if (record.state === "committing")
+        throw new Error("Sanctuary bundle commit is pending and cannot be rolled back");
+    restoreMigrationSnapshot(record.snapshot);
+    if (!options.retainRecord)
+        removeRollbackRecord(agentRoot, record.filePath);
+    return true;
+}
+function commitSanctuaryPackageManagedBundle(agentRoot) {
+    validateAgentRoot(agentRoot);
+    const record = readDurableRecord(agentRoot);
+    if (!record)
+        return false;
+    const committingPath = path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE);
+    if (record.filePath !== committingPath) {
+        fs.renameSync(record.filePath, committingPath);
+        const root = fs.openSync(agentRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+        try {
+            fs.fsyncSync(root);
+        }
+        finally {
+            fs.closeSync(root);
+        }
+    }
+    removeRollbackRecord(agentRoot, committingPath);
+    return true;
+}
+function restoreMigrationSnapshot(snapshot) {
+    for (const file of snapshot.files) {
+        cleanupInterruptedWrites(file.path);
+        if (file.content === null) {
+            fs.rmSync(file.path, { force: true });
+        }
+        else {
+            writeAtomic(file.path, file.content);
+            fs.chmodSync(file.path, file.mode);
+        }
+    }
+    for (const directory of [...snapshot.directories].reverse()) {
+        if (directory.mode === null) {
+            if (!fs.existsSync(directory.path))
+                continue;
+            if (fs.readdirSync(directory.path).length === 0)
+                fs.rmdirSync(directory.path);
+        }
+        else {
+            fs.chmodSync(directory.path, directory.mode);
+        }
+    }
+}
+function migrateSanctuaryPackageManagedBundle(input) {
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_start", message: "starting Sanctuary package-managed bundle migration", meta: { agentRoot: input.agentRoot } });
+    let snapshot = null;
+    try {
+        if (!path.isAbsolute(input.packageRoot) || !path.isAbsolute(input.agentRoot) || input.packageRoot === input.agentRoot)
+            throw new Error("package and agent roots must be distinct absolute paths");
+        const packageStat = fs.lstatSync(input.packageRoot);
+        const agentStat = fs.lstatSync(input.agentRoot);
+        if (packageStat.isSymbolicLink() || !packageStat.isDirectory())
+            throw new Error("package root must be a real directory");
+        if (agentStat.isSymbolicLink() || !agentStat.isDirectory())
+            throw new Error("agent root must be a real directory");
+        if (input.retainRollback && (!input.rollbackImageId || !/^sha256:[0-9a-f]{64}$/u.test(input.rollbackImageId) || !input.targetImageId || !/^sha256:[0-9a-f]{64}$/u.test(input.targetImageId) || input.targetImageId === input.rollbackImageId))
+            throw new Error("retained rollback requires distinct exact rollback and target image IDs");
+        const existingRollback = rollbackPath(input.agentRoot);
+        if (readDurableRecord(input.agentRoot))
+            throw new Error("Sanctuary bundle rollback is pending; rollback or commit it before another migration");
+        for (const relative of exports.SANCTUARY_PACKAGE_MANAGED_FILES) {
+            requirePlainFile(path.join(input.packageRoot, relative), `package-managed source ${relative}`);
+            validateDestination(input.agentRoot, relative);
+        }
+        requirePlainFile(path.join(input.packageRoot, "bundle-meta.json"), "packaged bundle-meta.json");
+        validateDestination(input.agentRoot, "bundle-meta.json");
+        const packagedMeta = readObject(path.join(input.packageRoot, "bundle-meta.json"));
+        for (const field of BUNDLE_META_VERSION_FIELDS)
+            if (!(field in packagedMeta))
+                throw new Error(`packaged bundle-meta.json is missing ${field}`);
+        const packagedPolicy = (0, steward_policy_1.readStewardPolicy)(input.packageRoot);
+        if (Object.keys(packagedPolicy.routineActionGrants).length > 0) {
+            throw new Error("packaged steward policy must not carry routine action grants; authorize them through an authenticated owner session");
+        }
+        snapshot = captureMigrationSnapshot(input.agentRoot);
+        if (input.retainRollback) {
+            cleanupInterruptedWrites(existingRollback);
+            writeAtomic(existingRollback, `${JSON.stringify(durableSnapshot(input.agentRoot, snapshot, input.rollbackImageId, input.targetImageId))}\n`);
+        }
+        let managedFilesUpdated = 0;
+        for (const relative of exports.SANCTUARY_PACKAGE_MANAGED_FILES) {
+            const source = fs.readFileSync(path.join(input.packageRoot, relative), "utf8");
+            const destination = path.join(input.agentRoot, relative);
+            ensureSafeParent(input.agentRoot, relative);
+            if (fs.existsSync(destination) && fs.readFileSync(destination, "utf8") === source && (fs.statSync(destination).mode & 0o777) === 0o600)
+                continue;
+            writeAtomic(destination, source);
+            managedFilesUpdated += 1;
+        }
+        const metaPath = path.join(input.agentRoot, "bundle-meta.json");
+        const currentMeta = fs.existsSync(metaPath) ? readObject(metaPath) : {};
+        const nextMeta = { ...currentMeta };
+        for (const field of BUNDLE_META_VERSION_FIELDS)
+            nextMeta[field] = packagedMeta[field];
+        const nextMetaText = `${JSON.stringify(nextMeta, null, 2)}\n`;
+        if (!fs.existsSync(metaPath) || fs.readFileSync(metaPath, "utf8") !== nextMetaText)
+            writeAtomic(metaPath, nextMetaText);
+        const result = { managedFilesUpdated };
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_end", message: "completed Sanctuary package-managed bundle migration", meta: result });
+        return result;
+    }
+    catch (error) {
+        let failure = error;
+        if (snapshot) {
+            try {
+                restoreMigrationSnapshot(snapshot);
+                if (fs.existsSync(rollbackPath(input.agentRoot)))
+                    removeRollbackRecord(input.agentRoot, rollbackPath(input.agentRoot));
+            }
+            catch (restoreError) {
+                failure = new AggregateError([error, restoreError], "Sanctuary bundle migration and rollback both failed");
+            }
+        }
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_error", level: "error", message: "Sanctuary package-managed bundle migration failed", meta: { error: String(failure), agentRoot: input.agentRoot } });
+        throw failure;
+    }
+}

package/dist/heart/daemon/sanctuary-scheduler-origin.js

@@ -73,6 +73,9 @@ function safeEqual(left, right) {
         return false;
     return (0, node_crypto_1.timingSafeEqual)(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
 }
+function isSupercronicProcess(pid, deps) {
+    return deps.readLink(`/proc/${pid}/exe`) === SUPERCRONIC && deps.readFile(`/proc/${pid}/cmdline`) === SUPERCRONIC_CMDLINE;
+}
 function defaultSanctuarySchedulerOriginDeps(agentRoot = (0, identity_1.getAgentRoot)("sanctuary"), markerReader = () => (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)("sanctuary")) {
     return {
         platform: process.platform, pid: process.pid, ppid: process.ppid, now: () => new Date(),
@@ -84,10 +87,10 @@ function createSanctuarySchedulerFireCommand(command, deps = defaultSanctuarySch
     if (command.agent !== "sanctuary" || command.habitName !== "sanctuary-health" || command.trigger !== "cron" || deps.platform !== "linux")
         return null;
     try {
-        if (deps.readLink(`/proc/${deps.ppid}/exe`) !== SUPERCRONIC || deps.readFile(`/proc/${deps.ppid}/cmdline`) !== SUPERCRONIC_CMDLINE)
-            return null;
         const invocation = processIdentity(deps.readFile(`/proc/${deps.pid}/stat`));
         const parent = processIdentity(deps.readFile(`/proc/${deps.ppid}/stat`));
+        if (!isSupercronicProcess(deps.ppid, deps) && !isSupercronicProcess(parent.parentPid, deps))
+            return null;
         const marker = deps.marker();
         if (invocation.parentPid !== deps.ppid)
             return null;
@@ -113,9 +116,12 @@ function verifySanctuarySchedulerFireCommand(command, deps) {
         throw new Error("scheduler fire authentication failed");
     const invocation = processIdentity(deps.readFile(`/proc/${command.invocationPid}/stat`));
     const parent = processIdentity(deps.readFile(`/proc/${command.parentPid}/stat`));
-    if (command.parentPid !== deps.childPid || invocation.parentPid !== command.parentPid || invocation.startTime !== command.invocationStartTime
-        || parent.startTime !== command.parentStartTime || deps.readLink(`/proc/${command.parentPid}/exe`) !== SUPERCRONIC
-        || deps.readFile(`/proc/${command.parentPid}/cmdline`) !== SUPERCRONIC_CMDLINE)
+    if (invocation.parentPid !== command.parentPid || invocation.startTime !== command.invocationStartTime
+        || parent.startTime !== command.parentStartTime)
+        throw new Error("scheduler fire ancestry is invalid");
+    if (command.parentPid !== deps.childPid && parent.parentPid !== deps.childPid)
+        throw new Error("scheduler fire ancestry is invalid");
+    if (command.parentPid === deps.childPid ? !isSupercronicProcess(command.parentPid, deps) : !isSupercronicProcess(parent.parentPid, deps))
         throw new Error("scheduler fire ancestry is invalid");
     (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_origin_authenticated", message: "Sanctuary scheduler origin authenticated", meta: { schedulerRunId: command.schedulerRunId, slot: command.slot } });
     return {