@ouro.bot/cli 0.1.0-alpha.745 → 0.1.0-alpha.746

package/changelog.json

@@ -1,6 +1,13 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.746",
+      "changes": [
+        "Run packaged Sanctuary auditors with constrained root privileges so root-private inspection and staged policy inputs remain readable without widening file permissions.",
+        "Audit immutable container image identity from Docker's resolved top-level Image and validate the portable effective root Mounts contract, including private bind propagation, across real Docker inspect output."
+      ]
+    },
     {
       "version": "0.1.0-alpha.745",
       "changes": [

package/deploy/unraid/README.txt

@@ -42,6 +42,7 @@ Effective-spec audit helper:
       docker image inspect "$AUDIT_EXPECTED_IMAGE" >"$INSPECT_DIR/image.json" || return $?
       chmod 0600 "$INSPECT_DIR/container.json" "$INSPECT_DIR/image.json" || return $?
       docker run --rm --pull=never --network=none \
+        --user 0:0 --read-only --cap-drop=ALL --security-opt=no-new-privileges \
         --entrypoint /opt/ouro/deploy/unraid/audit-container-spec.sh \
         --mount "type=bind,src=$INSPECT_DIR/container.json,dst=/audit/container.json,readonly" \
         --mount "type=bind,src=$INSPECT_DIR/image.json,dst=/audit/image.json,readonly" \
@@ -1444,6 +1445,7 @@ Update:
   audit the staged template and runtime policy with the packaged auditor, then
   remove the private stage before any Butler mutation:
     docker run --rm --pull=never --network=none \
+      --user 0:0 --read-only --cap-drop=ALL --security-opt=no-new-privileges \
       --entrypoint /opt/ouro/deploy/unraid/audit-container-spec.sh \
       --mount "type=bind,src=$STAGED_TEMPLATE,dst=/audit/sanctuary.xml,readonly" \
       --mount "type=bind,src=$STAGED_RUNTIME_POLICY,dst=/audit/container-runtime.json,readonly" \

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.745",
+  "runtimeVersion": "0.1.0-alpha.746",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.745</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.746</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/container-spec-auditor.js

@@ -10,13 +10,12 @@ const EXPECTED_BINDS = [
     "/mnt/user/appdata/sabnzbd/sabnzbd.ini:/run/sanctuary/sabnzbd.ini:ro",
 ];
 const EXPECTED_MOUNTS = [
-    ["/mnt/user/appdata/ouro-butler/runtime/.ouro-cli", "/home/ouro/.ouro-cli", true],
-    ["/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro", "/home/ouro/AgentBundles/sanctuary.ouro", true],
-    ["/boot/config/custom/ouro-events/spool", "/run/ouro-events", false],
-    ["/mnt/user/appdata/sabnzbd/sabnzbd.ini", "/run/sanctuary/sabnzbd.ini", false],
+    ["/mnt/user/appdata/ouro-butler/runtime/.ouro-cli", "/home/ouro/.ouro-cli", true, "rprivate"],
+    ["/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro", "/home/ouro/AgentBundles/sanctuary.ouro", true, "rprivate"],
+    ["/boot/config/custom/ouro-events/spool", "/run/ouro-events", false, "rprivate"],
+    ["/mnt/user/appdata/sabnzbd/sabnzbd.ini", "/run/sanctuary/sabnzbd.ini", false, "rprivate"],
 ];
 const LEGACY_ALPHA742_IMAGE = "sha256:681449ad47a2621705cd339b481e6339236b31dc65e195b1cf5025d0f2191d7d";
-const LEGACY_ALPHA742_BINDS = EXPECTED_BINDS.slice(0, 2);
 const LEGACY_ALPHA742_MOUNTS = EXPECTED_MOUNTS.slice(0, 2);
 const EXPECTED_EXTRA_PARAMS = "--restart=unless-stopped --user=10001:10001";
 function record(value) {
@@ -46,9 +45,8 @@ function auditSanctuaryContainerSpec(value, options) {
         const mountContract = options.mountContract ?? "canonical";
         if (mountContract === "legacy-alpha742" && options.expectedImage !== LEGACY_ALPHA742_IMAGE)
             violations.push("legacy mount exception requires the pinned alpha.742 image ID");
-        const expectedBinds = mountContract === "legacy-alpha742" ? LEGACY_ALPHA742_BINDS : EXPECTED_BINDS;
         const expectedMounts = mountContract === "legacy-alpha742" ? LEGACY_ALPHA742_MOUNTS : EXPECTED_MOUNTS;
-        if (config.Image !== options.expectedImage)
+        if (root.Image !== options.expectedImage)
             violations.push("image does not match the reviewed exact local Docker image ID");
         if (root.Path !== "node")
             violations.push("effective container path must be node");
@@ -92,14 +90,11 @@ function auditSanctuaryContainerSpec(value, options) {
             violations.push("container must not publish all exposed ports");
         if (!isEmptyRecord(network?.Ports))
             violations.push("effective network ports must be empty");
-        const binds = stringArray(host.Binds);
-        if (!binds || JSON.stringify([...binds].sort()) !== JSON.stringify([...expectedBinds].sort()))
-            violations.push("bind set does not match the selected Sanctuary mount contract");
         const mounts = Array.isArray(root.Mounts) ? root.Mounts : [];
         const normalizedMounts = mounts.map((mount) => {
             const item = record(mount);
-            return item && item.Type === "bind" && typeof item.RW === "boolean" && typeof item.Source === "string" && typeof item.Destination === "string"
-                ? [item.Source, item.Destination, item.RW]
+            return item && item.Type === "bind" && typeof item.RW === "boolean" && typeof item.Source === "string" && typeof item.Destination === "string" && item.Propagation === "rprivate"
+                ? [item.Source, item.Destination, item.RW, item.Propagation]
                 : null;
         });
         if (normalizedMounts.some((mount) => mount === null)

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.745",
+  "version": "0.1.0-alpha.746",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.745",
+      "version": "0.1.0-alpha.746",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.745",
+  "version": "0.1.0-alpha.746",
   "engines": {
     "node": ">=22"
   },