@ouro.bot/cli 0.1.0-alpha.746 → 0.1.0-alpha.748

package/changelog.json

@@ -1,6 +1,20 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.748",
+      "changes": [
+        "Reject any unexpected running Ouro image or writable Sanctuary-root overlap, including legacy and package-managed layouts, across zero-poller and active-poller deployment handoffs.",
+        "Remove the exact legacy Unraid boot hook that rewrites the managed Usenet cron entry after reboot."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.747",
+      "changes": [
+        "Create every nested host-backup directory as root-private before provenance verification.",
+        "Accept a missing OCI source label only on Sanctuary's exact historical alpha.742 image while retaining strict source provenance for every other image."
+      ]
+    },
     {
       "version": "0.1.0-alpha.746",
       "changes": [

package/deploy/unraid/README.txt

@@ -141,7 +141,8 @@ Effective-spec audit helper:
       return 1
     }
   Define these fail-closed image and topology helpers in the same shell. They use
-  exact Docker image IDs and exact container names; no mutation is performed:
+  exact Docker image IDs and container identity, image provenance, and writable
+  root overlap; no mutation is performed:
     validate_exact_image_id() {
       VALIDATE_IMAGE_ID=$1
       case "$VALIDATE_IMAGE_ID" in
@@ -155,18 +156,43 @@ Effective-spec audit helper:
       docker image inspect "$VALIDATE_IMAGE_ID" >/dev/null || return $?
     }
     assert_only_running_butler() {
+      (
       EXPECTED_RUNNING_BUTLER=$1
-      RUNNING_BUTLER_NAMES=$(docker container ls --format '{{.Names}}') || return $?
-      RUNNING_BUTLER_COUNTS=$(printf '%s\n' "$RUNNING_BUTLER_NAMES" | awk -v expected="$EXPECTED_RUNNING_BUTLER" '
-        {
-          if ($0 == "ouro-butler" || $0 == "ouro-butler-staging" || $0 == "ouro-butler-rollback" || $0 == "ouro-butler-legacy-evidence") {
-            butlers++
-            if ($0 == expected) matching++
+      case "$EXPECTED_RUNNING_BUTLER" in
+        -) EXPECTED_RUNNING_BUTLER_COUNT=0 ;;
+        ouro-butler|ouro-butler-staging) EXPECTED_RUNNING_BUTLER_COUNT=1 ;;
+        *) return 1 ;;
+      esac
+      RUNNING_CONTAINER_IDS=$(docker container ls -q) || return $?
+      MATCHING_RUNNING_BUTLERS=0
+      for RUNNING_CONTAINER_ID in $RUNNING_CONTAINER_IDS; do
+        RUNNING_CONTAINER_NAME=$(docker container inspect --format '{{.Name}}' "$RUNNING_CONTAINER_ID") || return $?
+        RUNNING_CONTAINER_NAME=${RUNNING_CONTAINER_NAME#/}
+        if test "$RUNNING_CONTAINER_NAME" = "$EXPECTED_RUNNING_BUTLER"; then
+          MATCHING_RUNNING_BUTLERS=$(( MATCHING_RUNNING_BUTLERS + 1 ))
+          continue
+        fi
+        RUNNING_CONTAINER_IMAGE_ID=$(docker container inspect --format '{{.Image}}' "$RUNNING_CONTAINER_ID") || return $?
+        RUNNING_CONTAINER_IMAGE_REF=$(docker container inspect --format '{{.Config.Image}}' "$RUNNING_CONTAINER_ID") || return $?
+        RUNNING_CONTAINER_IMAGE_SOURCE=$(docker image inspect --format '{{with .Config.Labels}}{{index . "org.opencontainers.image.source"}}{{end}}' "$RUNNING_CONTAINER_IMAGE_ID") || return $?
+        test "$RUNNING_CONTAINER_IMAGE_SOURCE" != https://github.com/ourostack/ouroboros || return 1
+        test "$RUNNING_CONTAINER_IMAGE_ID" != sha256:681449ad47a2621705cd339b481e6339236b31dc65e195b1cf5025d0f2191d7d || return 1
+        case "$RUNNING_CONTAINER_IMAGE_REF" in
+          ouro-butler|ouro-butler:*|ouro-butler@sha256:*|ouroboros-butler|ouroboros-butler:*|ouroboros-butler@sha256:*|ghcr.io/ourostack/ouroboros-butler|ghcr.io/ourostack/ouroboros-butler:*|ghcr.io/ourostack/ouroboros-butler@sha256:*) return 1 ;;
+        esac
+        RUNNING_WRITABLE_MOUNT_SOURCES=$(docker container inspect --format '{{range .Mounts}}{{if .RW}}{{println .Source}}{{end}}{{end}}' "$RUNNING_CONTAINER_ID") || return $?
+        if printf '%s\n' "$RUNNING_WRITABLE_MOUNT_SOURCES" | awk '
+          function overlaps(path, root) {
+            return length(path) > 0 && (path == root || index(path, root "/") == 1 || index(root, path "/") == 1)
           }
-        }
-        END { printf "%d %d", butlers + 0, matching + 0 }
-      ') || return $?
-      test "$RUNNING_BUTLER_COUNTS" = "1 1" || return $?
+          overlaps($0, "/mnt/user/appdata/ouro-butler/runtime") || overlaps($0, "/mnt/user/appdata/ouro-butler/runtime/.ouro-cli") || overlaps($0, "/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro") || overlaps($0, "/mnt/user/appdata/ouro-butler/AgentBundles") { found = 1 }
+          END { exit found ? 0 : 1 }
+        '; then
+          return 1
+        fi
+      done
+      test "$MATCHING_RUNNING_BUTLERS" -eq "$EXPECTED_RUNNING_BUTLER_COUNT" || return $?
+      )
     }
     assert_update_topology() {
       EXPECTED_ROLLBACK_IMAGE_ID=$1
@@ -311,7 +337,9 @@ Effective-spec audit helper:
         const image = JSON.parse(fs.readFileSync(imagePath, "utf8"));
         if (!Array.isArray(container) || container.length !== 1 || !container[0] || container[0].Image !== imageId) process.exit(1);
         if (!Array.isArray(image) || image.length !== 1 || !image[0] || image[0].Id !== imageId) process.exit(1);
-        if (image[0].Config?.Labels?.["org.opencontainers.image.source"] !== "https://github.com/ourostack/ouroboros") process.exit(1);
+        const source = image[0].Config?.Labels?.["org.opencontainers.image.source"];
+        const legacyAlpha742 = "sha256:681449ad47a2621705cd339b481e6339236b31dc65e195b1cf5025d0f2191d7d";
+        if (source !== "https://github.com/ourostack/ouroboros" && !(source === undefined && imageId === legacyAlpha742)) process.exit(1);
         const expected = ["custom/usenet_health.sh", "custom/ouro-events/bootstrap-spool.sh", "custom/ouro-events/emit-event.mjs", "custom/ouro-events/emit-usenet-event.sh", "custom/ouro-events/install-usenet-guard.sh", "go.butler-lines", "crontab.butler-lines", "global-state"];
         const expectedUid = 0;
         const expectedGid = 0;
@@ -784,6 +812,7 @@ Effective-spec audit helper:
         && CURRENT_LEGACY_EVIDENCE_IMAGE_ID=$(docker inspect --format '{{.Image}}' ouro-butler-legacy-evidence) \
         && test "$CURRENT_LEGACY_EVIDENCE_IMAGE_ID" = "$LEGACY_STAGING_IMAGE_ID" \
         && test "$(docker inspect --format '{{.State.Running}}' ouro-butler-legacy-evidence)" = false \
+        && assert_only_running_butler - \
         && docker create --name ouro-butler-staging --network host --restart unless-stopped --user 10001:10001 \
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
@@ -797,6 +826,7 @@ Effective-spec audit helper:
         && docker stop ouro-butler-staging \
         && test "$(docker inspect --format '{{.Image}}' ouro-butler-staging)" = "$IMAGE_ID" \
         && docker rm ouro-butler-staging \
+        && assert_only_running_butler - \
         && docker create --name ouro-butler --network host --restart unless-stopped --user 10001:10001 \
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
@@ -1360,6 +1390,7 @@ Update:
       cmp -s "$EVENT_SCRIPT_STAGE/install-usenet-guard.sh" /boot/config/custom/ouro-events/install-usenet-guard.sh
       test "$(grep -Fxc '/bin/bash /boot/config/custom/ouro-events/install-usenet-guard.sh --boot --install-root /boot/config/custom' /boot/config/go)" = 1
       test "$(grep -Fxc '/boot/config/custom/ouro-events/bootstrap-spool.sh --mount' /boot/config/go || true)" = 0
+      test "$(grep -Fxc '(crontab -l 2>/dev/null | grep -v usenet_health; echo "*/15 * * * * /bin/bash /boot/config/custom/usenet_health.sh") | crontab -' /boot/config/go || true)" = 0
       INSTALLED_GUARD_CRON=$(crontab -l)
       test "$(printf '%s\n' "$INSTALLED_GUARD_CRON" | grep -Fxc '*/15 * * * * /bin/bash /boot/config/custom/usenet_health.sh # ouro:usenet-health')" = 1
       INSTALLED_LEGACY_GUARD_COUNT=$(printf '%s\n' "$INSTALLED_GUARD_CRON" | grep -Fxc '*/15 * * * * /bin/bash /boot/config/custom/usenet_health.sh' || true)
@@ -1509,6 +1540,7 @@ ouro-butler-rollback
       && remove_stopped_rollback_if_present "$ROLLBACK_IMAGE_ID" \
       && docker rename ouro-butler ouro-butler-rollback \
       && test "$(docker inspect --format '{{.State.Running}}' ouro-butler-rollback)" = false \
+      && assert_only_running_butler - \
       && migrate_sanctuary_package_managed_bundle "$IMAGE_ID" migrate "$ROLLBACK_IMAGE_ID"; then
       :
     else
@@ -1564,7 +1596,8 @@ ouro-butler-rollback
       && assert_only_running_butler ouro-butler-staging \
       && wait_butler_ready ouro-butler-staging \
       && docker stop ouro-butler-staging \
-      && docker rm ouro-butler-staging; then
+      && docker rm ouro-butler-staging \
+      && assert_only_running_butler -; then
       :
     else
       STAGING_ACTIVATION_STATUS=$?
@@ -1786,7 +1819,7 @@ Backup:
     if docker stop ouro-butler \
       && test "$(docker inspect --format '{{.State.Running}}' ouro-butler)" = false \
       && install -d -m 0700 -o 0 -g 0 "$BACKUP_TMP" "$BACKUP_TMP/runtime" "$BACKUP_TMP/agent" "$BACKUP_TMP/host" "$BACKUP_TMP/provenance" \
-      && install -d -m 0700 -o 0 -g 0 "$BACKUP_TMP/host/custom/ouro-events" \
+      && install -d -m 0700 -o 0 -g 0 "$BACKUP_TMP/host/custom" "$BACKUP_TMP/host/custom/ouro-events" \
       && install -m 0600 -o 0 -g 0 /dev/null "$BACKUP_TMP/host/inventory" \
       && backup_host_file /boot/config/custom/usenet_health.sh custom/usenet_health.sh \
       && backup_host_file /boot/config/custom/ouro-events/bootstrap-spool.sh custom/ouro-events/bootstrap-spool.sh \

package/deploy/unraid/ouro-events/install-usenet-guard.sh

@@ -49,6 +49,7 @@ LEGACY_BOOT_HOOK="/boot/config/custom/ouro-events/bootstrap-spool.sh --mount"
 LEGACY_BASH_BOOT_HOOK="/bin/bash /boot/config/custom/ouro-events/bootstrap-spool.sh --mount"
 CANONICAL_PREVIOUS_BOOT_HOOK="/bin/bash /boot/config/custom/ouro-events/install-usenet-guard.sh --boot"
 CANONICAL_BOOT_HOOK="$CANONICAL_PREVIOUS_BOOT_HOOK --install-root /boot/config/custom"
+LEGACY_CRON_BOOT_HOOK='(crontab -l 2>/dev/null | grep -v usenet_health; echo "*/15 * * * * /bin/bash /boot/config/custom/usenet_health.sh") | crontab -'
 printf -v HEALTH_SCRIPT_Q '%q' "$INSTALL_ROOT/usenet_health.sh"
 CRON_LINE="*/15 * * * * /bin/bash $HEALTH_SCRIPT_Q # ouro:usenet-health"
 LEGACY_CRON_LINE="*/15 * * * * /bin/bash $HEALTH_SCRIPT_Q"
@@ -125,7 +126,7 @@ render_inactive_cron() {
 
 is_canonical_butler_go_hook() {
   case "$1" in
-    "$LEGACY_BOOT_HOOK"|"$LEGACY_BASH_BOOT_HOOK"|"$CANONICAL_PREVIOUS_BOOT_HOOK"|"$CANONICAL_BOOT_HOOK") return 0 ;;
+    "$LEGACY_BOOT_HOOK"|"$LEGACY_BASH_BOOT_HOOK"|"$CANONICAL_PREVIOUS_BOOT_HOOK"|"$CANONICAL_BOOT_HOOK"|"$PREVIOUS_INSTALLER_BOOT_HOOK"|"$BOOT_HOOK"|"$LEGACY_CRON_BOOT_HOOK") return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -232,7 +233,7 @@ install_transaction() {
     printf '#!/bin/bash\n' > "$stage/go.base"
   fi
   go_candidate="$stage/go.candidate"
-  grep -Fvx -e "$LEGACY_BOOT_HOOK" -e "$LEGACY_BASH_BOOT_HOOK" -e "$PREVIOUS_INSTALLER_BOOT_HOOK" -e "$BOOT_HOOK" "$stage/go.base" > "$stage/go.filtered" || true
+  render_go_without_owned "$stage/go.base" "$stage/go.filtered"
   if [ -s "$stage/go.filtered" ]; then
     awk -v hook="$BOOT_HOOK" 'NR == 1 && /^#!/ { print; print hook; next } NR == 1 { print hook } { print }' "$stage/go.filtered" > "$go_candidate"
   else

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.746",
+  "runtimeVersion": "0.1.0-alpha.748",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.746</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.748</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.746",
+  "version": "0.1.0-alpha.748",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.746",
+      "version": "0.1.0-alpha.748",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.746",
+  "version": "0.1.0-alpha.748",
   "engines": {
     "node": ">=22"
   },