@ouro.bot/cli 0.1.0-alpha.752 → 0.1.0-alpha.754

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.754",
+      "changes": [
+        "Write autonomy budget receipts privately and preserve exact legacy receipt compatibility during strict Sanctuary backup and restore validation."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.753",
+      "changes": [
+        "Align strict Sanctuary backup and restore validation with canonical external-event and sentinel writer modes without permitting live sockets."
+      ]
+    },
     {
       "version": "0.1.0-alpha.752",
       "changes": [

package/deploy/unraid/README.txt

@@ -377,7 +377,8 @@ Effective-spec audit helper:
       VALIDATE_WRONG_RUNTIME_DIR_MODE=$(find "$VALIDATE_RUNTIME_ROOT" -xdev -type d ! -perm 0700 \
         ! \( -perm 0755 \( \
           -path "$VALIDATE_RUNTIME_ROOT/scheduler" -o -path "$VALIDATE_RUNTIME_ROOT/scheduler/*" -o \
-          -path "$VALIDATE_RUNTIME_ROOT/daemon/logs" -o -path "$VALIDATE_RUNTIME_ROOT/daemon/logs/*" \
+          -path "$VALIDATE_RUNTIME_ROOT/daemon/logs" -o -path "$VALIDATE_RUNTIME_ROOT/daemon/logs/*" -o \
+          -path "$VALIDATE_RUNTIME_ROOT/daemon/external-events" -o -path "$VALIDATE_RUNTIME_ROOT/daemon/external-events/*" \
         \) \) -print -quit) || return $?
       test -z "$VALIDATE_WRONG_RUNTIME_DIR_MODE" || return $?
       VALIDATE_WRONG_AGENT_DIR_MODE=$(find "$VALIDATE_AGENT_ROOT" -xdev -type d ! -perm 0700 \
@@ -398,12 +399,28 @@ Effective-spec audit helper:
           -path "$VALIDATE_RUNTIME_ROOT/daemon-health.json" \
         \) \) -print -quit) || return $?
       test -z "$VALIDATE_WRONG_RUNTIME_FILE_MODE" || return $?
+      # Alpha.753 and earlier wrote content-free autonomy receipts as 0644 below a 0700 tree.
+      # Preserve those audit records; current writers create and normalize this exact format to 0600.
       VALIDATE_WRONG_AGENT_FILE_MODE=$(find "$VALIDATE_AGENT_ROOT" -xdev -type f ! -perm 0600 \
         ! \( -perm 0644 \( \
           -path "$VALIDATE_AGENT_ROOT/arc/flight-recorder/*" -o \
           -path "$VALIDATE_AGENT_ROOT/state/health/*" -o \
           -path "$VALIDATE_AGENT_ROOT/state/logs/*" -o \
-          -path "$VALIDATE_AGENT_ROOT/state/habits/*" \
+          -path "$VALIDATE_AGENT_ROOT/state/habits/*" -o \
+          -path "$VALIDATE_AGENT_ROOT/state/arc/context-loss-sentinel-watermark.json" -o \
+          -exec /bin/sh -c '
+            VALIDATE_AUTONOMY_RECEIPT=$1
+            VALIDATE_AUTONOMY_RECEIPTS_ROOT=$2
+            test "${VALIDATE_AUTONOMY_RECEIPT%/*}" = "$VALIDATE_AUTONOMY_RECEIPTS_ROOT" || exit 1
+            VALIDATE_AUTONOMY_RECEIPT_NAME=${VALIDATE_AUTONOMY_RECEIPT##*/}
+            case "$VALIDATE_AUTONOMY_RECEIPT_NAME" in
+              autr_????????????????????????????????.json) ;;
+              *) exit 1 ;;
+            esac
+            VALIDATE_AUTONOMY_RECEIPT_ID=${VALIDATE_AUTONOMY_RECEIPT_NAME#autr_}
+            VALIDATE_AUTONOMY_RECEIPT_ID=${VALIDATE_AUTONOMY_RECEIPT_ID%.json}
+            case "$VALIDATE_AUTONOMY_RECEIPT_ID" in *[!0-9a-f]*) exit 1 ;; esac
+          ' sanctuary-autonomy-receipt-validator {} "$VALIDATE_AGENT_ROOT/state/autonomy/receipts" \; \
         \) \) -print -quit) || return $?
       test -z "$VALIDATE_WRONG_AGENT_FILE_MODE" || return $?
       )
@@ -1530,6 +1547,8 @@ Update:
   sequence. MiniMax credentials are imported from the byte-verified legacy
   bootstrap envelope; do not place credentials in arguments, shell variables, or
   history.
+  These provider-readiness commands are adoption-only; do not use them as a
+  normal-update precheck against an active canonical production daemon.
   Sanctuary legacy adoption commands:
     prepare_sanctuary_legacy_adoption "$IMAGE_ID"
     verify_sanctuary_provider_readiness "$IMAGE_ID"

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.752",
+  "runtimeVersion": "0.1.0-alpha.754",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.752</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.754</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/autonomy-budget.js

@@ -204,7 +204,8 @@ function writeReceipt(agentRoot, decision) {
     };
     const filePath = path.join(autonomyReceiptsDir(agentRoot), `${receiptId}.json`);
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, `${JSON.stringify(receipt, null, 2)}\n`, "utf-8");
+    fs.writeFileSync(filePath, `${JSON.stringify(receipt, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+    fs.chmodSync(filePath, 0o600);
     return receipt;
 }
 function duplicateTtlMs(triggerType, policy) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.752",
+  "version": "0.1.0-alpha.754",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.752",
+      "version": "0.1.0-alpha.754",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.752",
+  "version": "0.1.0-alpha.754",
   "engines": {
     "node": ">=22"
   },