@ouro.bot/cli 0.1.0-alpha.742 → 0.1.0-alpha.744

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -55,15 +55,20 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_net_1 = require("node:net");
 const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../../nerves/runtime");
 const telegram_approval_runtime_1 = require("../../senses/telegram-approval-runtime");
 const telegram_client_1 = require("../../senses/telegram-client");
+const telegram_effect_adapter_1 = require("../../senses/telegram-effect-adapter");
+const telegram_admission_1 = require("../../senses/telegram-admission");
 const sanctuary_interactive_control_1 = require("../../senses/sanctuary-interactive-control");
+const shared_turn_1 = require("../../senses/shared-turn");
 const telegram_1 = require("../../senses/telegram");
 const telegram_audit_ledger_1 = require("../../senses/telegram-audit-ledger");
 const sanctuary_runtime_1 = require("../../senses/sanctuary-runtime");
 const sanctuary_grounding_1 = require("../../senses/sanctuary-grounding");
 const tools_1 = require("../../repertoire/tools");
+const relationship_authorization_1 = require("../../repertoire/relationship-authorization");
 const core_1 = require("../core");
 const identity_1 = require("../identity");
 const approval_store_1 = require("../approval-store");
@@ -104,7 +109,6 @@ const POSTBOOT_HEALTH_FILE = "/run/ouro-acceptance/postboot-health.json";
 const BOOT_ID_FILE = "/run/ouro-acceptance/boot-id";
 const TELEGRAM_POLLER_COUNT_FILE = "/run/ouro-acceptance/telegram-poller-count.json";
 const CONTRACT_FILE = "/opt/ouro/deploy/unraid/sanctuary-acceptance-contract.json";
-const SANCTUARY_TOOL_PROFILES_FILE = "/opt/ouro/deploy/unraid/sanctuary.ouro/tool-profiles.json";
 const CLOSED_INVENTORY_FILE = "/run/ouro-acceptance/closed-inventory.json";
 const HOST_BROKER_SOCKET = "/run/ouro-host-acceptance/adapter.sock";
 const MAX_BROKER_RESPONSE = 256 * 1024;
@@ -118,7 +122,7 @@ const APPROVAL_EVIDENCE_LABELS = new Set([
 const HEALTH_ACCEPTANCE_LABELS = new Set([
     "unit-16f-cron-fingerprint",
     "unit-16g-health-transition",
-    "unit-16h-daily-digest",
+    "unit-16h-acceptance-delivery-probe",
 ]);
 const PERMISSION_RESOURCES = new Set([
     "ACTIVATION_CODE", "API_KEY", "ARRAY", "CLOUD", "CONFIG", "CONNECT", "CONNECT__REMOTE_ACCESS",
@@ -505,6 +509,67 @@ function parsedJson(raw) {
         return null;
     return object(JSON.parse(raw), "scenario source");
 }
+async function projectTelegramAdmissions(agentRoot, credentials, identityKey) {
+    const admissionsRoot = path.join(agentRoot, "state", "senses", "telegram", "admissions");
+    const effectsRoot = path.join(agentRoot, "state", "telegram", "effects");
+    if (!(0, node_fs_1.existsSync)(admissionsRoot) || !(0, node_fs_1.existsSync)(effectsRoot) || !identityKey || !/^[A-Za-z0-9_-]{43}$/u.test(identityKey))
+        return [];
+    const admissionStore = new telegram_admission_1.FileTelegramAdmissionStore(admissionsRoot);
+    const effectStore = new telegram_effect_adapter_1.FileTelegramEffectJournal(effectsRoot);
+    try {
+        const effects = new Map(effectStore.list().map((artifact) => [artifact.id, artifact]));
+        const botId = (0, telegram_1.telegramBotIdFromToken)(credentials.botToken);
+        const ownerSessionKey = `telegram:${(0, telegram_1.opaqueTelegramSubject)(identityKey, botId, credentials.authorizedUserId, credentials.authorizedChatId)}`;
+        const friendsRoot = path.join(agentRoot, "friends");
+        const friendStore = (0, node_fs_1.existsSync)(friendsRoot) ? new friends_1.FileFriendStore(friendsRoot) : null;
+        const owner = friendStore ? await friendStore.findByExternalId("telegram-user", credentials.authorizedUserId, botId) : null;
+        const exactSameBotIdentity = (friend, userId) => {
+            const bindings = friend.externalIds.filter((external) => external.provider === "telegram-user" && external.tenantId === botId);
+            return bindings.length === 1 && bindings[0].externalId === userId;
+        };
+        const ownerExact = Boolean(owner && exactSameBotIdentity(owner, credentials.authorizedUserId) && owner.trustLevel === "family" && owner.admissionState === "active"
+            && owner.initiativePolicy === "proactive" && owner.capabilityProfileId === "sanctuary-owner");
+        const projections = await Promise.all(admissionStore.list().map(async (record) => {
+            const acknowledgement = record.acknowledgementArtifactId ? effects.get(record.acknowledgementArtifactId) : undefined;
+            const ownerCard = record.ownerCardArtifactId ? effects.get(record.ownerCardArtifactId) : undefined;
+            const expectedButtons = [[
+                    { text: "Allow", callbackData: `admit:${record.id}:allow` },
+                    { text: "Deny", callbackData: `admit:${record.id}:deny` },
+                    { text: "Block", callbackData: `admit:${record.id}:block` },
+                ]];
+            const admittedFriend = friendStore ? await friendStore.findByExternalId("telegram-user", record.userId, record.botId) : null;
+            const acknowledgementExact = Boolean(acknowledgement?.idempotencyKey === `ack:${record.id}`
+                && acknowledgement.authorClass === "control" && acknowledgement.target.kind === "admission_gate"
+                && acknowledgement.target.admissionId === record.id && acknowledgement.target.botId === record.botId
+                && acknowledgement.target.userId === record.userId && acknowledgement.target.chatId === record.chatId
+                && acknowledgement.effect.kind === "admission_ack" && acknowledgement.effect.text === telegram_effect_adapter_1.FIXED_ADMISSION_ACKNOWLEDGEMENT
+                && acknowledgement.parts.every((part) => part.state === "accepted" || part.state === "session_recorded"));
+            const ownerCardExact = Boolean(ownerExact && owner && ownerCard?.idempotencyKey === `owner-card:${record.id}`
+                && ownerCard.authorClass === "control" && ownerCard.target.kind === "approved_relationship"
+                && ownerCard.target.friendId === owner.id && ownerCard.target.sessionKey === ownerSessionKey && ownerCard.target.requestId === record.id
+                && ownerCard.effect.kind === "card" && ownerCard.effect.text.startsWith("Unknown Telegram contact\n")
+                && ownerCard.effect.text.includes("The message is quarantined and has not been processed.")
+                && JSON.stringify(ownerCard.effect.buttons) === JSON.stringify(expectedButtons)
+                && ownerCard.parts.every((part) => part.state === "session_recorded"));
+            return {
+                admissionDigest: (0, telegram_1.sanctuaryTelegramTurnReceiptDigest)(identityKey, "sanctuary-telegram-turn-receipt-v3", "admission", `${record.id}\0${record.botId}\0${record.userId}\0${record.chatId}\0${record.updateId}\0${record.messageId}`),
+                status: record.status,
+                identityExact: record.botId === botId && record.userId === record.chatId && record.userId !== credentials.authorizedUserId,
+                acknowledgementExact,
+                ownerCardExact,
+                contentQuarantined: typeof record.quarantinedText === "string" && (0, node_crypto_1.createHash)("sha256").update(record.quarantinedText).digest("hex") === record.contentDigest,
+                relationshipAbsent: record.friendId === null && admittedFriend === null,
+                capturedAt: record.createdAt,
+                updatedAt: record.updatedAt,
+            };
+        }));
+        return projections.sort((left, right) => left.admissionDigest.localeCompare(right.admissionDigest));
+    }
+    finally {
+        admissionStore.close();
+        effectStore.close();
+    }
+}
 function canonicalIso(value) {
     return typeof value === "string" && value.length <= 30 && Number.isFinite(Date.parse(value)) && new Date(Date.parse(value)).toISOString() === value;
 }
@@ -611,10 +676,10 @@ function parseHealthProbeReceipt(raw, label, scenarioHandleDigest, identityKey)
     if (Buffer.byteLength(raw) > 128 * 1024)
         throw new Error("Sanctuary health probe receipt exceeds its bound");
     const receipt = object(JSON.parse(raw), "Sanctuary health probe receipt");
-    const exactKeys = ["beforeStateDigest", "clockMode", "cronDegradedAfter", "cronDegradedBefore", "cronFingerprintAfter", "cronFingerprintBefore", "cronRegisteredAfter", "cronRegisteredBefore", "deliveryCount", "effectiveNow", "fixtureSequenceDigest", "label", "ownerContainerDigestAfter", "ownerContainerDigestBefore", "ownerImageDigestAfter", "ownerImageDigestBefore", "phases", "privateTurnCount", "productionRestored", "providerInvocationCount", "realCheckEquivalent", "restoredStateDigest", "scenarioHandleDigest", "schedulerReceipt", "schemaVersion", "snapshotAbsent", "socketAbsent", "workspaceAbsent"].sort();
-    const supportedLabel = label === "unit-16f-cron-fingerprint" || label === "unit-16g-health-transition" || label === "unit-16h-daily-digest";
+    const exactKeys = ["acceptanceOnly", "beforeStateDigest", "clockMode", "cronDegradedAfter", "cronDegradedBefore", "cronFingerprintAfter", "cronFingerprintBefore", "cronRegisteredAfter", "cronRegisteredBefore", "deliveryCount", "effectiveNow", "fixtureSequenceDigest", "label", "ownerContainerDigestAfter", "ownerContainerDigestBefore", "ownerImageDigestAfter", "ownerImageDigestBefore", "phases", "privateTurnCount", "productionRestored", "productionScheduleChanged", "providerInvocationCount", "realCheckEquivalent", "restoredStateDigest", "scenarioHandleDigest", "schedulerReceipt", "schemaVersion", "snapshotAbsent", "socketAbsent", "workspaceAbsent"].sort();
+    const supportedLabel = label === "unit-16f-cron-fingerprint" || label === "unit-16g-health-transition" || label === "unit-16h-acceptance-delivery-probe";
     const digestFields = ["ownerImageDigestBefore", "ownerImageDigestAfter", "ownerContainerDigestBefore", "ownerContainerDigestAfter", "beforeStateDigest", "restoredStateDigest", "cronFingerprintBefore", "cronFingerprintAfter", "fixtureSequenceDigest"];
-    const booleanFields = ["cronRegisteredBefore", "cronRegisteredAfter", "cronDegradedBefore", "cronDegradedAfter", "workspaceAbsent", "socketAbsent", "snapshotAbsent", "realCheckEquivalent", "productionRestored"];
+    const booleanFields = ["acceptanceOnly", "productionScheduleChanged", "cronRegisteredBefore", "cronRegisteredAfter", "cronDegradedBefore", "cronDegradedAfter", "workspaceAbsent", "socketAbsent", "snapshotAbsent", "realCheckEquivalent", "productionRestored"];
     if (!supportedLabel || JSON.stringify(Object.keys(receipt).sort()) !== JSON.stringify(exactKeys) || receipt.schemaVersion !== "sanctuary-health-probe-receipt-v1"
         || receipt.label !== label || receipt.scenarioHandleDigest !== scenarioHandleDigest || !SHA256.test(scenarioHandleDigest)
         || !digestFields.every((field) => typeof receipt[field] === "string" && SHA256.test(receipt[field]))
@@ -689,10 +754,10 @@ function parseHealthProbeReceipt(raw, label, scenarioHandleDigest, identityKey)
     if (receipt.ownerImageDigestBefore !== receipt.ownerImageDigestAfter || receipt.ownerContainerDigestBefore !== receipt.ownerContainerDigestAfter
         || (label !== "unit-16f-cron-fingerprint" && receipt.beforeStateDigest !== receipt.restoredStateDigest) || receipt.cronFingerprintBefore !== receipt.cronFingerprintAfter
         || receipt.cronRegisteredBefore !== true || receipt.cronRegisteredAfter !== true || receipt.cronDegradedBefore !== false || receipt.cronDegradedAfter !== false
-        || receipt.workspaceAbsent !== true || receipt.socketAbsent !== true || receipt.snapshotAbsent !== true || receipt.realCheckEquivalent !== true || receipt.productionRestored !== true) {
+        || receipt.acceptanceOnly !== true || receipt.productionScheduleChanged !== false || receipt.workspaceAbsent !== true || receipt.socketAbsent !== true || receipt.snapshotAbsent !== true || receipt.realCheckEquivalent !== true || receipt.productionRestored !== true) {
         throw new Error("Sanctuary health probe did not restore its exact production owner and state");
     }
-    if (label === "unit-16h-daily-digest") {
+    if (label === "unit-16h-acceptance-delivery-probe") {
         const effective = new Date(receipt.effectiveNow);
         const parts = new Intl.DateTimeFormat("en-US", { timeZone: "America/Los_Angeles", hour: "2-digit", minute: "2-digit", second: "2-digit", hourCycle: "h23" }).formatToParts(effective);
         const part = (type) => Number(parts.find((entry) => entry.type === type).value);
@@ -1170,9 +1235,6 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         identityKey: identityRaw.trim(),
     });
     const auditEntries = auditLedgerEntries.filter((entry) => entry.meta.scenarioHandleDigest === scenarioHandleDigest);
-    const toolProfiles = parsedJson(optionalFixedFile(deps, SANCTUARY_TOOL_PROFILES_FILE));
-    const profiles = toolProfiles ? object(toolProfiles.profiles, "Sanctuary tool profiles") : null;
-    const telegramProfile = profiles?.["sanctuary-telegram"];
     let approvalRecords = [];
     const approvalDatabasePath = pathFor(agentRoot, "state/approvals/approvals.sqlite");
     if ((0, node_fs_1.existsSync)(approvalDatabasePath))
@@ -1254,30 +1316,6 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
                 throw new Error("Telegram audit lifecycle MAC is invalid");
             }
         }
-        if (label === "unit-16d-2-unauthorized") {
-            const expectedAuthorizedIdentityDigest = (0, telegram_1.sanctuaryTelegramTurnReceiptDigest)(identityKey, auditSchema, "sender-identity", credentials.authorizedUserId);
-            for (const entry of auditEntries.filter((candidate) => candidate.event === "telegram.update_dropped")) {
-                const binding = {
-                    scenarioHandleDigest: entry.meta.scenarioHandleDigest,
-                    updateDigest: entry.meta.updateDigest,
-                    senderIdentityDigest: entry.meta.senderIdentityDigest,
-                    authorizedIdentityDigest: entry.meta.authorizedIdentityDigest,
-                    senderDistinct: entry.meta.senderDistinct,
-                    nextOffsetDigest: entry.meta.nextOffsetDigest,
-                };
-                if (typeof binding.updateDigest !== "string" || !SHA256.test(binding.updateDigest)
-                    || typeof binding.senderIdentityDigest !== "string" || !SHA256.test(binding.senderIdentityDigest)
-                    || typeof binding.authorizedIdentityDigest !== "string" || !SHA256.test(binding.authorizedIdentityDigest)
-                    || typeof binding.nextOffsetDigest !== "string" || !SHA256.test(binding.nextOffsetDigest)
-                    || binding.nextOffsetDigest !== (0, telegram_1.sanctuaryTelegramTurnReceiptDigest)(identityKey, auditSchema, "next-update-id", String(telegramNextUpdateId))
-                    || binding.authorizedIdentityDigest !== expectedAuthorizedIdentityDigest
-                    || binding.senderIdentityDigest === binding.authorizedIdentityDigest
-                    || binding.senderDistinct !== true || entry.meta.distinctAccount !== true
-                    || typeof entry.meta.dropMac !== "string" || !SHA256.test(entry.meta.dropMac)
-                    || entry.meta.dropMac !== (0, telegram_1.sanctuaryTelegramUnauthorizedDropMac)(identityKey, auditSchema, binding))
-                    throw new Error("Telegram unauthorized sender binding MAC is invalid");
-            }
-        }
         const approvalEvidenceKeys = {
             "senses.telegram_approval_prompt_bound": [["actionDigest", "approvalId", "boundAt", "checkpointDigest", "evidenceMac", "messageIdDigest", "scenarioHandleDigest", "suspendedSessionRevisionDigest", "targetDigest"]],
             "telegram.callback_settled": [["accepted", "acknowledged", "acknowledgementState", "actionDigest", "approvalId", "boundAt", "callbackAt", "checkpointDigest", "decisionAttemptDigest", "evidenceMac", "messageIdDigest", "reason", "scenarioHandleDigest", "suspendedSessionRevisionDigest", "targetDigest"]],
@@ -1446,7 +1484,7 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         }
     }
     let containment;
-    if (label === "unit-16e-containment-audit" || label === "unit-16d-2-unauthorized") {
+    if (label === "unit-16e-containment-audit" || label === "unit-16d-2-unknown-admission") {
         const inventoryEnvelope = object(await dependency(deps.hostRequest, "Sanctuary host broker")({ operation: "inventory_keys", targetServerId: TARGET_SERVER_ID }), "containment key inventory");
         if (!Array.isArray(inventoryEnvelope.keys))
             throw new Error("containment key inventory is invalid");
@@ -1460,9 +1498,12 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         })).sort((left, right) => left.name.localeCompare(right.name));
         const readRecord = inventory.find((record) => record.name === "Butler RO");
         const writeRecord = inventory.find((record) => record.name === "Butler RW");
-        const telegramNames = Array.isArray(telegramProfile) ? telegramProfile.filter((name) => typeof name === "string") : [];
-        const privateRaw = profiles?.["sanctuary-health-private"];
-        const privateNames = Array.isArray(privateRaw) ? privateRaw.filter((name) => typeof name === "string") : [];
+        const relationshipRegistry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot);
+        const telegramProfile = relationshipRegistry.profiles["sanctuary-owner"];
+        const privateProfile = relationshipRegistry.profiles["sanctuary-event"];
+        const telegramNames = telegramProfile?.toolNames ?? [];
+        const privateNames = privateProfile?.toolNames ?? [];
+        const relationshipProfilesExact = telegramNames.length > 0 && privateNames.length > 0;
         const flowSchemas = new Map([tools_1.ponderTool, tools_1.settleTool, tools_1.speakTool, tools_1.restTool].map((tool) => [tool.function.name, tool]));
         const schemasFor = (names) => names.flatMap((name) => {
             const schema = (0, tools_1.resolveToolDefinition)(name)?.tool ?? flowSchemas.get(name);
@@ -1471,12 +1512,18 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         const telegramSchemas = schemasFor(telegramNames);
         const privateSchemas = schemasFor(privateNames);
         const handlerResolves = (name) => typeof (0, tools_1.resolveToolDefinition)(name)?.handler === "function" || flowSchemas.has(name);
+        const resolvedHandlerCount = [...telegramNames, ...privateNames].filter(handlerResolves).length;
+        const handlersExact = resolvedHandlerCount === telegramNames.length + privateNames.length;
         const excludedNames = ["shell", "read_file", "edit_file", "vault_get", "mcp_call", "exec", "credential_get"];
         const excludedSchemaIntersection = excludedNames.filter((name) => telegramNames.includes(name) || privateNames.includes(name));
         const productionBoundaryReceipts = await dependency(deps.runProductionBoundaryProbe, "production tool boundary probe")(telegramSchemas);
         const excludedAttempts = productionBoundaryReceipts.filter((receipt) => excludedNames.includes(receipt.name));
         const restartDefinition = (0, tools_1.resolveToolDefinition)("unraid_restart_container");
         const writeApprovalPolicy = restartDefinition.approvalPolicy({ container: "calibre-web" });
+        const writeApprovalPolicyExact = writeApprovalPolicy.kind === "required"
+            && writeApprovalPolicy.policyId === "sanctuary.unraid.restart.v1"
+            && writeApprovalPolicy.actionClass === "unraid.container.restart"
+            && writeApprovalPolicy.requiresSoleCall === true;
         let lifecycleBalance = 0;
         let lifecyclePairs = 0;
         for (const entry of auditLedgerEntries) {
@@ -1502,7 +1549,9 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
             privateToolCount: privateNames.length,
             privateProfileDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(privateNames)).digest("hex"),
             privateSchemaDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(privateSchemas)).digest("hex"),
-            resolvedHandlerCount: [...telegramNames, ...privateNames].filter(handlerResolves).length,
+            resolvedHandlerCount,
+            relationshipProfilesExact,
+            handlersExact,
             excludedToolCount: excludedNames.length,
             excludedSchemaIntersectionCount: excludedSchemaIntersection.length,
             fabricatedHandlerInvocationCount: excludedSchemaIntersection.filter(handlerResolves).length,
@@ -1528,10 +1577,14 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
             rawWriteMaterialFieldCount,
             typedWriteExecutorCount: telegramNames.filter((name) => name === "unraid_restart_container" && writeApprovalPolicy.kind === "required").length,
             writeApprovalPolicyDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(writeApprovalPolicy)).digest("hex"),
+            writeApprovalPolicyExact,
             sensitiveMaterialObserved: auditContainsSensitiveMaterial(auditRaw ?? "", deps.telegramCredentials?.()) || rawWriteMaterialFieldCount > 0 || container?.writableKeyExposure === true,
             stopDenied, restartDenied, denialAuditCount, denialStateUnchanged, denialProbeCompleted,
         };
     }
+    const telegramAdmissions = label === "unit-16d-2-unknown-admission"
+        ? await projectTelegramAdmissions(agentRoot, dependency(deps.telegramCredentials, "Telegram credentials")(), identityRaw?.trim() ?? null)
+        : [];
     const sourceValues = {
         "identity-key": identityRaw, "telegram-audit": auditEntries, "telegram-offset": offsetRaw,
         "approval-journal": approvals, "approval-checkpoints": checkpointsRaw, "container-inspect": container,
@@ -1539,6 +1592,7 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         "digest-runtime": health, "reboot-checkpoint": rebootCheckpoint, "telegram-turn-receipts": telegramTurns, "read-only-denial-receipt": denialReceipt ?? null,
         "identity-surface-audit": identity ? { inspectedRecordCount: identity.inspectedRecordCount, opaqueSubjectCount: identity.opaqueSubjectCount, mismatchCount: identity.mismatchCount, rawLeakCount: identity.rawLeakCount, canonicalSessionCount: identity.canonicalSessionCount, canonicalFriendCount: identity.canonicalFriendCount, sessionSurfaceDigest: identity.sessionSurfaceDigest, friendSurfaceDigest: identity.friendSurfaceDigest, surfaceDigest: identity.surfaceDigest } : null,
         "containment-audit": containment ?? null,
+        "telegram-admission-evidence": telegramAdmissions,
         "health-probe-receipt": healthProbe ?? null,
         "scheduler-liveness-receipt": healthProbe?.schedulerReceipt ?? null,
         "interactive-driver-receipt": parsedJson(interactiveDriverRaw),
@@ -1570,6 +1624,7 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         approvals,
         restartAttempts,
         telegramTurns,
+        telegramAdmissions,
         telegramNextUpdateId,
         zeroWork,
         liveGrounding,
@@ -1578,7 +1633,7 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
             exactImage: typeof expectedImageId === "string" && SHA256.test(expectedImageId) && container.imageId === `sha256:${expectedImageId}`, running: container.running === true,
             healthy: container.health === "healthy", user: text(container.user, "container user"), readOnlyRoot: container.readOnlyRoot === true,
             mountCount: Number(container.mountCount), publishedPortCount: Number(container.publishedPortCount), restartPolicy: text(container.restartPolicy, "restart policy"), restartCount: Number(container.restartCount),
-            autostartExact: container.autostartExact === true, updaterDisabled: container.updaterDisabled === true,
+            autostartExact: container.autostartExact === true, mountsExact: container.mountsExact === true, updaterDisabled: container.updaterDisabled === true,
             vaultUnlocked: container.vaultUnlocked === true, manualAuthRequired: container.manualAuthRequired === true,
         } : undefined,
         provider: liveProvider,
@@ -1591,10 +1646,10 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         reboot,
         containment: containment ?? {
             schemaVersion: "sanctuary-containment-audit-v1", keyCount: 0, keyInventoryDigest: "", readScopeDigest: "", writeScopeDigest: "", keyRoleAssignmentCount: 0,
-            telegramToolCount: 0, telegramProfileDigest: "", telegramSchemaDigest: "", privateToolCount: 0, privateProfileDigest: "", privateSchemaDigest: "", resolvedHandlerCount: 0,
+            telegramToolCount: 0, telegramProfileDigest: "", telegramSchemaDigest: "", privateToolCount: 0, privateProfileDigest: "", privateSchemaDigest: "", resolvedHandlerCount: 0, relationshipProfilesExact: false, handlersExact: false,
             excludedToolCount: 0, excludedSchemaIntersectionCount: 0, fabricatedHandlerInvocationCount: 0, excludedToolAttemptCount: 0, excludedToolRejectedCount: 0, excludedToolInvokedCount: 0, excludedToolSideEffectCount: 0, globallyResolvableExcludedToolCount: 0, auditPathDigest: "", auditLedgerDigest: "", auditRecordCount: 0, auditLifecyclePairCount: 0,
             containerUser: "", liveProcessUser: "", mountCount: 0, publishedPortCount: 0, networkMode: "", readOnlyRoot: false, mountsExact: false, securityExact: false, updaterDisabled: false,
-            writableKeyExposure: container?.writableKeyExposure === true, rawWriteMaterialFieldCount: 0, typedWriteExecutorCount: 0, writeApprovalPolicyDigest: "",
+            writableKeyExposure: container?.writableKeyExposure === true, rawWriteMaterialFieldCount: 0, typedWriteExecutorCount: 0, writeApprovalPolicyDigest: "", writeApprovalPolicyExact: false,
             sensitiveMaterialObserved: auditContainsSensitiveMaterial(auditRaw ?? "") || container?.writableKeyExposure === true,
             stopDenied, restartDenied, denialAuditCount, denialStateUnchanged, denialProbeCompleted,
         },
@@ -2288,6 +2343,25 @@ async function executeSanctuaryAcceptanceRevokedProbe(keyIdValue, endpointValue,
         fetch: deps.fetch,
     });
 }
+function createAcceptanceProbeEffects(input) {
+    const store = new telegram_effect_adapter_1.FileTelegramEffectJournal(path.join(input.agentRoot, "state", "telegram", "effects"));
+    const target = { kind: "approved_relationship", friendId: `telegram-user:${input.subject}`, sessionKey: `telegram:${input.subject}` };
+    const execute = (0, telegram_effect_adapter_1.createTelegramAuthorizedEffectExecutor)({
+        store,
+        api: input.api,
+        authorize: ({ target: candidate }) => JSON.stringify(candidate) === JSON.stringify(target)
+            ? { allowed: true, receiptId: `configured-owner:${input.subject}`, expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(), transport: { chatId: input.chatId } }
+            : { allowed: false, reason: "effect target is not the configured owner relationship" },
+    });
+    const sessionPath = (0, shared_turn_1.getSenseSessionPath)(TARGET_ID, target.friendId, "telegram", target.sessionKey, input.agentRoot);
+    const port = (0, telegram_effect_adapter_1.createTelegramApprovalEffectPort)({
+        target,
+        chatId: input.chatId,
+        execute,
+        record: async (artifact) => { await (0, telegram_effect_adapter_1.recordTelegramEffectsInSession)({ store, sessionPath, artifacts: [artifact] }); },
+    });
+    return { port, close: () => store.close() };
+}
 exports.proveAttemptedRecoveryWithoutRetry = sanctuary_interactive_control_1.proveSanctuaryAttemptedRecoveryWithoutRetry;
 async function executeSanctuaryInteractiveRuntimeOperation(rawPayload, supplied) {
     exactKeys(rawPayload, ["operation", "label", "scenarioHandleDigest"], "interactive runtime payload");
@@ -2312,6 +2386,7 @@ async function executeSanctuaryAcceptanceCallbackProbe(rawUpdate, _replay, deps
     createApi: telegram_client_1.createTelegramBotApi,
     createRuntime: telegram_approval_runtime_1.createTelegramApprovalRuntime,
     toolContext: sanctuary_runtime_1.createSanctuaryToolContext,
+    effects: createAcceptanceProbeEffects,
 }) {
     const update = callbackUpdate(rawUpdate);
     const refreshed = await deps.refresh(TARGET_ID);
@@ -2321,6 +2396,13 @@ async function executeSanctuaryAcceptanceCallbackProbe(rawUpdate, _replay, deps
     const identityKey = deps.identityKey((0, identity_1.getAgentRoot)(TARGET_ID));
     const subject = (0, telegram_1.opaqueTelegramSubject)(identityKey, credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId);
     const api = deps.createApi({ token: credentials.botToken });
+    const effectBoundary = deps.effects?.({ agentRoot: (0, identity_1.getAgentRoot)(TARGET_ID), api, subject, chatId: credentials.authorizedChatId });
+    const unavailableEffects = {
+        sendText: async () => { throw new Error("Telegram acceptance probe effect boundary is unavailable"); },
+        sendCard: async () => { throw new Error("Telegram acceptance probe effect boundary is unavailable"); },
+        edit: async () => { throw new Error("Telegram acceptance probe effect boundary is unavailable"); },
+        acknowledge: async () => { throw new Error("Telegram acceptance probe effect boundary is unavailable"); },
+    };
     const runtime = deps.createRuntime({
         agentName: TARGET_ID,
         api,
@@ -2329,6 +2411,7 @@ async function executeSanctuaryAcceptanceCallbackProbe(rawUpdate, _replay, deps
         subject,
         identityKey,
         toolContext: deps.toolContext(TARGET_ID),
+        effects: effectBoundary?.port ?? unavailableEffects,
     });
     try {
         const result = await runtime.transport.handleUpdate(update);
@@ -2340,6 +2423,7 @@ async function executeSanctuaryAcceptanceCallbackProbe(rawUpdate, _replay, deps
     }
     finally {
         runtime.close();
+        effectBoundary?.close();
         api.stop();
     }
 }

package/dist/heart/daemon/sanctuary-acceptance-harness.js

@@ -333,13 +333,13 @@ exports.SANCTUARY_UNIT_16_EVIDENCE_LABELS = [
     "unit-16c-provider-readiness",
     "unit-16d-whats-up",
     "unit-16d-1-space",
-    "unit-16d-2-unauthorized",
+    "unit-16d-2-unknown-admission",
     "unit-16e-containment-audit",
     "unit-16e-1-stop-denial",
     "unit-16e-2-restart-denial",
     "unit-16f-cron-fingerprint",
     "unit-16g-health-transition",
-    "unit-16h-daily-digest",
+    "unit-16h-acceptance-delivery-probe",
     "unit-16i-delayed-approval",
     "unit-16j-denial",
     "unit-16k-timeout-stale",
@@ -370,7 +370,7 @@ function sanctuaryScenarioTimeoutBudget(label) {
         return 125_000;
     if (label === "unit-15c-1-no-callback-terminalization")
         return 365_000;
-    if (label === "unit-16h-daily-digest")
+    if (label === "unit-16h-acceptance-delivery-probe")
         return 1_025_000;
     if (label === "unit-16f-cron-fingerprint")
         return 1_025_000;
@@ -435,10 +435,10 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
             opaqueDigest(value.processBindingDigest, `${label} processBindingDigest`);
             break;
         case "unit-16b-runtime-vault-containment":
-            exact(["autostartExact", "exactImage", "manualAuthRequired", "mountCount", "nonRootUid", "publishedPortCount", "readOnlyRoot", "updaterDisabled", "vaultUnlocked"]);
-            allTrue(["autostartExact", "exactImage", "readOnlyRoot", "updaterDisabled", "vaultUnlocked"]);
+            exact(["autostartExact", "exactImage", "manualAuthRequired", "mountCount", "mountsExact", "nonRootUid", "publishedPortCount", "readOnlyRoot", "updaterDisabled", "vaultUnlocked"]);
+            allTrue(["autostartExact", "exactImage", "mountsExact", "readOnlyRoot", "updaterDisabled", "vaultUnlocked"]);
             requiredFalse(value, "manualAuthRequired", label);
-            requiredInteger(value, "mountCount", 2, label);
+            requiredInteger(value, "mountCount", 4, label);
             requiredInteger(value, "nonRootUid", 10001, label);
             requiredInteger(value, "publishedPortCount", 0, label);
             break;
@@ -458,19 +458,19 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
             requiredInteger(value, "responseCount", 1, label);
             requiredInteger(value, "mutationCount", 0, label);
             break;
-        case "unit-16d-2-unauthorized":
-            exact(["auditRejected", "distinctAccount", "mutationCount", "providerInvocationCount", "responseCount", "workItemCount"]);
-            allTrue(["auditRejected", "distinctAccount"]);
-            allZero(["mutationCount", "providerInvocationCount", "responseCount", "workItemCount"]);
+        case "unit-16d-2-unknown-admission":
+            exact(["acknowledgementSent", "agentTurnCount", "distinctAccount", "mutationCount", "ownerCardSent", "providerInvocationCount", "quarantined", "responseCount", "workItemCount"]);
+            allTrue(["acknowledgementSent", "distinctAccount", "ownerCardSent", "quarantined"]);
+            allZero(["agentTurnCount", "mutationCount", "providerInvocationCount", "responseCount", "workItemCount"]);
             break;
         case "unit-16e-containment-audit":
             exact([
                 "schemaVersion", "keyCount", "keyInventoryDigest", "readScopeDigest", "writeScopeDigest", "keyRoleAssignmentCount",
-                "telegramToolCount", "telegramProfileDigest", "telegramSchemaDigest", "privateToolCount", "privateProfileDigest", "privateSchemaDigest", "resolvedHandlerCount",
+                "telegramToolCount", "telegramProfileDigest", "telegramSchemaDigest", "privateToolCount", "privateProfileDigest", "privateSchemaDigest", "resolvedHandlerCount", "relationshipProfilesExact", "handlersExact",
                 "excludedToolCount", "excludedSchemaIntersectionCount", "fabricatedHandlerInvocationCount", "excludedToolAttemptCount", "excludedToolRejectedCount", "excludedToolInvokedCount", "excludedToolSideEffectCount", "globallyResolvableExcludedToolCount",
                 "auditPathDigest", "auditLedgerDigest", "auditRecordCount", "auditLifecyclePairCount",
                 "containerUser", "liveProcessUser", "mountCount", "publishedPortCount", "networkMode", "readOnlyRoot", "mountsExact", "securityExact", "updaterDisabled", "writableKeyExposure",
-                "rawWriteMaterialFieldCount", "typedWriteExecutorCount", "writeApprovalPolicyDigest", "sensitiveMaterialObserved", "mutationCount",
+                "rawWriteMaterialFieldCount", "typedWriteExecutorCount", "writeApprovalPolicyDigest", "writeApprovalPolicyExact", "sensitiveMaterialObserved", "mutationCount",
             ]);
             if (text(value.schemaVersion, `${label} schemaVersion`) !== "sanctuary-containment-audit-v1")
                 throw new Error(`${label} schemaVersion is invalid`);
@@ -479,20 +479,16 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
             for (const [key, expected] of Object.entries({
                 readScopeDigest: "9914469afdcb574937d1020a03faa82e3c02d767169d3eccae4b81863dafa06e",
                 writeScopeDigest: "1de873b2bc3c7769010c32c69fcc8ea55343a5647cfdb0294769e831142945ec",
-                telegramProfileDigest: "a7f26934c5e60737582b9d13c78944b8bcbb941366899d82d58c01ca296e14e2",
-                telegramSchemaDigest: "3c66299a5f70ec82f8795cae47659284e6dbc691ef49002c2fb22edba76c59b6",
-                privateProfileDigest: "a100ffcaf436842bf9fceaf3d2fd1a1b766c04238300487474d6e9fcb7946369",
-                privateSchemaDigest: "61b137b2467acbcf22ca7443ee01e71ed970a62728c42aabffbdcb562f4a6a70",
                 auditPathDigest: "1cb8f1a00c544a5d10b0577090dbf070a07a5b6a99de13ccd27c11a257f84b75",
-                writeApprovalPolicyDigest: "24b1726edf1a2bbd524e9be63d3f0f726d996a8a009425462e01a5c4916ef42b",
             }))
                 if (value[key] !== expected)
                     throw new Error(`${label} ${key} does not match the canonical contract`);
             requiredInteger(value, "keyCount", 2, label);
             requiredInteger(value, "keyRoleAssignmentCount", 0, label);
-            requiredInteger(value, "telegramToolCount", 10, label);
-            requiredInteger(value, "privateToolCount", 2, label);
-            requiredInteger(value, "resolvedHandlerCount", 12, label);
+            const telegramToolCount = integer(value.telegramToolCount, `${label} telegramToolCount`, 1);
+            const privateToolCount = integer(value.privateToolCount, `${label} privateToolCount`, 1);
+            if (integer(value.resolvedHandlerCount, `${label} resolvedHandlerCount`, 1) !== telegramToolCount + privateToolCount)
+                throw new Error(`${label} handler count does not match the live relationship profiles`);
             requiredInteger(value, "excludedToolCount", 7, label);
             requiredInteger(value, "excludedToolAttemptCount", 7, label);
             requiredInteger(value, "excludedToolRejectedCount", 7, label);
@@ -504,9 +500,9 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
             integer(value.auditLifecyclePairCount, `${label} auditLifecyclePairCount`, 1);
             if (text(value.containerUser, `${label} containerUser`) !== "10001:10001" || text(value.liveProcessUser, `${label} liveProcessUser`) !== "10001:10001" || text(value.networkMode, `${label} networkMode`) !== "host")
                 throw new Error(`${label} container identity or network is invalid`);
-            requiredInteger(value, "mountCount", 2, label);
+            requiredInteger(value, "mountCount", 4, label);
             requiredInteger(value, "typedWriteExecutorCount", 1, label);
-            allTrue(["readOnlyRoot", "mountsExact", "securityExact", "updaterDisabled"]);
+            allTrue(["relationshipProfilesExact", "handlersExact", "writeApprovalPolicyExact", "readOnlyRoot", "mountsExact", "securityExact", "updaterDisabled"]);
             break;
         case "unit-16e-1-stop-denial":
         case "unit-16e-2-restart-denial":
@@ -526,9 +522,10 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
             allTrue(["productionRestored", "transitionObserved"]);
             requiredInteger(value, "alertCount", 3, label);
             break;
-        case "unit-16h-daily-digest":
-            exact(["firedWithinMs", "messageCount", "productionRestored", "scheduleObserved"]);
-            allTrue(["productionRestored", "scheduleObserved"]);
+        case "unit-16h-acceptance-delivery-probe":
+            exact(["acceptanceOnly", "deliveryPathObserved", "firedWithinMs", "messageCount", "productionRestored", "productionScheduleChanged"]);
+            allTrue(["acceptanceOnly", "deliveryPathObserved", "productionRestored"]);
+            requiredFalse(value, "productionScheduleChanged", label);
             requiredInteger(value, "messageCount", 1, label);
             if (integer(value.firedWithinMs, `${label} firedWithinMs`, 0) > 960_000)
                 throw new Error(`${label} fired outside the 16-minute bound`);
@@ -644,13 +641,13 @@ exports.SANCTUARY_SCENARIO_GATES = {
     "unit-16c-provider-readiness": "none",
     "unit-16d-whats-up": "authorized-telegram-message",
     "unit-16d-1-space": "authorized-telegram-message",
-    "unit-16d-2-unauthorized": "distinct-telegram-account-message",
+    "unit-16d-2-unknown-admission": "unknown-telegram-admission",
     "unit-16e-containment-audit": "none",
     "unit-16e-1-stop-denial": "none",
     "unit-16e-2-restart-denial": "none",
     "unit-16f-cron-fingerprint": "none",
     "unit-16g-health-transition": "none",
-    "unit-16h-daily-digest": "none",
+    "unit-16h-acceptance-delivery-probe": "none",
     "unit-16i-delayed-approval": "telegram-delayed-approve",
     "unit-16j-denial": "telegram-deny",
     "unit-16k-timeout-stale": "telegram-stale-callback",
@@ -668,13 +665,13 @@ exports.SANCTUARY_SCENARIO_SOURCES = {
     "unit-16c-provider-readiness": ["provider-live-check"],
     "unit-16d-whats-up": ["telegram-audit", "telegram-offset", "telegram-turn-receipts", "live-grounding-read"],
     "unit-16d-1-space": ["telegram-audit", "telegram-offset", "telegram-turn-receipts", "restart-attempt-ledger", "container-inspect", "live-grounding-read"],
-    "unit-16d-2-unauthorized": ["telegram-audit", "telegram-offset", "telegram-turn-receipts", "approval-journal", "restart-attempt-ledger", "container-inspect", "containment-audit"],
+    "unit-16d-2-unknown-admission": ["identity-key", "telegram-audit", "telegram-offset", "telegram-turn-receipts", "telegram-admission-evidence", "approval-journal", "restart-attempt-ledger", "container-inspect", "containment-audit"],
     "unit-16e-containment-audit": ["telegram-audit", "container-inspect", "containment-audit"],
     "unit-16e-1-stop-denial": ["read-only-denial-receipt", "container-inspect"],
     "unit-16e-2-restart-denial": ["read-only-denial-receipt", "container-inspect"],
     "unit-16f-cron-fingerprint": ["health-probe-receipt", "scheduler-liveness-receipt", "cron-runtime", "telegram-audit", "container-inspect"],
     "unit-16g-health-transition": ["health-probe-receipt", "telegram-audit", "container-inspect"],
-    "unit-16h-daily-digest": ["health-probe-receipt", "cron-runtime", "telegram-audit", "container-inspect"],
+    "unit-16h-acceptance-delivery-probe": ["health-probe-receipt", "cron-runtime", "telegram-audit", "container-inspect"],
     "unit-16i-delayed-approval": ["identity-key", "telegram-audit", "approval-journal", "approval-checkpoints", "restart-attempt-ledger", "container-inspect"],
     "unit-16j-denial": ["identity-key", "telegram-audit", "approval-journal", "approval-checkpoints", "restart-attempt-ledger", "container-inspect"],
     "unit-16k-timeout-stale": ["identity-key", "telegram-audit", "approval-journal", "approval-checkpoints", "restart-attempt-ledger", "container-inspect", "interactive-driver-receipt"],