@ouro.bot/cli 0.1.0-alpha.753 → 0.1.0-alpha.755

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.755",
+      "changes": [
+        "Preserve canonical Telegram owner identity across restarts.",
+        "Validate and accept SAB array or object server stats without failing open on malformed or unsafe counts."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.754",
+      "changes": [
+        "Write autonomy budget receipts privately and preserve exact legacy receipt compatibility during strict Sanctuary backup and restore validation."
+      ]
+    },
     {
       "version": "0.1.0-alpha.753",
       "changes": [

package/deploy/unraid/README.txt

@@ -399,13 +399,28 @@ Effective-spec audit helper:
           -path "$VALIDATE_RUNTIME_ROOT/daemon-health.json" \
         \) \) -print -quit) || return $?
       test -z "$VALIDATE_WRONG_RUNTIME_FILE_MODE" || return $?
+      # Alpha.753 and earlier wrote content-free autonomy receipts as 0644 below a 0700 tree.
+      # Preserve those audit records; current writers create and normalize this exact format to 0600.
       VALIDATE_WRONG_AGENT_FILE_MODE=$(find "$VALIDATE_AGENT_ROOT" -xdev -type f ! -perm 0600 \
         ! \( -perm 0644 \( \
           -path "$VALIDATE_AGENT_ROOT/arc/flight-recorder/*" -o \
           -path "$VALIDATE_AGENT_ROOT/state/health/*" -o \
           -path "$VALIDATE_AGENT_ROOT/state/logs/*" -o \
           -path "$VALIDATE_AGENT_ROOT/state/habits/*" -o \
-          -path "$VALIDATE_AGENT_ROOT/state/arc/context-loss-sentinel-watermark.json" \
+          -path "$VALIDATE_AGENT_ROOT/state/arc/context-loss-sentinel-watermark.json" -o \
+          -exec /bin/sh -c '
+            VALIDATE_AUTONOMY_RECEIPT=$1
+            VALIDATE_AUTONOMY_RECEIPTS_ROOT=$2
+            test "${VALIDATE_AUTONOMY_RECEIPT%/*}" = "$VALIDATE_AUTONOMY_RECEIPTS_ROOT" || exit 1
+            VALIDATE_AUTONOMY_RECEIPT_NAME=${VALIDATE_AUTONOMY_RECEIPT##*/}
+            case "$VALIDATE_AUTONOMY_RECEIPT_NAME" in
+              autr_????????????????????????????????.json) ;;
+              *) exit 1 ;;
+            esac
+            VALIDATE_AUTONOMY_RECEIPT_ID=${VALIDATE_AUTONOMY_RECEIPT_NAME#autr_}
+            VALIDATE_AUTONOMY_RECEIPT_ID=${VALIDATE_AUTONOMY_RECEIPT_ID%.json}
+            case "$VALIDATE_AUTONOMY_RECEIPT_ID" in *[!0-9a-f]*) exit 1 ;; esac
+          ' sanctuary-autonomy-receipt-validator {} "$VALIDATE_AGENT_ROOT/state/autonomy/receipts" \; \
         \) \) -print -quit) || return $?
       test -z "$VALIDATE_WRONG_AGENT_FILE_MODE" || return $?
       )

package/deploy/unraid/ouro-events/usenet-health.sh

@@ -88,13 +88,11 @@ if [ "$Q_STATUS" = "Idle" ] && [ "${Q_SLOTS:-0}" -gt 0 ]; then STALLED=1; fi
 MIN_ARTICLES=50000
 MIN_RATE=30
 TODAY=$(date +%Y-%m-%d)
-fetch_sab_json STATS 20 "http://localhost:8090/api?mode=server_stats&output=json" '(.servers | type) == "array"' "server-stats" || exit 1
-TRIED=$(echo "$STATS" | jq -r --arg d "$TODAY" '[.servers[].articles_tried[$d] // 0] | add // 0' 2>/dev/null)
-OKAY=$(echo "$STATS" | jq -r --arg d "$TODAY" '[.servers[].articles_success[$d] // 0] | add // 0' 2>/dev/null)
-BYTES=$(echo "$STATS" | jq -r --arg d "$TODAY" '[.servers[].daily[$d] // 0] | add // 0' 2>/dev/null)
-case "$TRIED" in ''|*[!0-9]*) TRIED=0 ;; esac
-case "$OKAY" in ''|*[!0-9]*) OKAY=0 ;; esac
-case "$BYTES" in ''|*[!0-9]*) BYTES=0 ;; esac
+fetch_sab_json STATS 20 "http://localhost:8090/api?mode=server_stats&output=json" 'def valid_count: ((type == "number" and . >= 0 and . <= 9007199254740991 and floor == .) or (type == "string" and test("^[0-9]+$") and (tonumber <= 9007199254740991))); ((.servers | type) == "array" or (.servers | type) == "object") and (.servers | length) > 0 and all(.servers[]; (type == "object") and (.articles_tried | type) == "object" and (.articles_success | type) == "object" and (.daily | type) == "object" and all(.articles_tried[]; valid_count) and all(.articles_success[]; valid_count) and all(.daily[]; valid_count))' "server-stats" || exit 1
+if ! IFS=$'\t' read -r TRIED OKAY BYTES < <(printf '%s' "$STATS" | jq -er --arg d "$TODAY" 'def count: if type == "number" and . >= 0 and . <= 9007199254740991 and floor == . then . elif type == "string" and test("^[0-9]+$") and (tonumber <= 9007199254740991) then tonumber else error("invalid server count") end; def total($field): ([.servers[] | (.[$field][$d] // 0) | count] | add) as $total | if $total >= 0 and $total <= 9007199254740991 and ($total | floor) == $total then $total else error("invalid aggregate server count") end; [total("articles_tried"), total("articles_success"), total("daily")] | @tsv' 2>/dev/null); then
+    emit_blind_observation "server-stats-response"
+    exit 1
+fi
 GB=$(( ${BYTES:-0} / 1000000000 ))
 
 BASE_DAY=""

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.753",
+  "runtimeVersion": "0.1.0-alpha.755",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.753</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.755</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/autonomy-budget.js

@@ -204,7 +204,8 @@ function writeReceipt(agentRoot, decision) {
     };
     const filePath = path.join(autonomyReceiptsDir(agentRoot), `${receiptId}.json`);
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, `${JSON.stringify(receipt, null, 2)}\n`, "utf-8");
+    fs.writeFileSync(filePath, `${JSON.stringify(receipt, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+    fs.chmodSync(filePath, 0o600);
     return receipt;
 }
 function duplicateTtlMs(triggerType, policy) {

package/dist/senses/telegram.js

@@ -924,12 +924,14 @@ function createTelegramSenseApp(options) {
             acceptanceAuditBarrier();
             migrateTelegramSessionIdentity(agentRoot, legacySubject, legacySubject, subject);
             acceptanceAuditBarrier();
-            await migrateTelegramFriendIdentity(agentRoot, legacySubject, subject);
+            if (!options.admission)
+                await migrateTelegramFriendIdentity(agentRoot, legacySubject, subject);
         }
         acceptanceAuditBarrier();
         migrateTelegramSessionIdentity(agentRoot, authorizedUserId, authorizedChatId, subject);
         acceptanceAuditBarrier();
-        await migrateTelegramFriendIdentity(agentRoot, authorizedUserId, subject);
+        if (!options.admission)
+            await migrateTelegramFriendIdentity(agentRoot, authorizedUserId, subject);
         acceptanceAuditBarrier();
         approvalRuntime?.migrateIdentity?.(migrationSubjects);
         acceptanceAuditBarrier();

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.753",
+  "version": "0.1.0-alpha.755",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.753",
+      "version": "0.1.0-alpha.755",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.753",
+  "version": "0.1.0-alpha.755",
   "engines": {
     "node": ">=22"
   },