@ouro.bot/cli 0.1.0-alpha.766 → 0.1.0-alpha.768

package/changelog.json

@@ -1,6 +1,21 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.768",
+      "changes": [
+        "Fix Sanctuary acceptance cursor snapshots for authenticated genesis and concurrent audit writes.",
+        "Cover fail-closed cursor schema, authority, and offset validation."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.767",
+      "changes": [
+        "Make Sanctuary status turns preserve completed live checks and report bounded download-queue unavailability without retries, stale guesses, or empty replies.",
+        "Move SAB queue access into the machine vault with guarded one-shot provisioning, live readiness verification, and no persistent host INI mount.",
+        "Share the owner-status completion fallback between Telegram's admitted-message replay and normal message paths, and cover its inactive, incomplete, and complete states."
+      ]
+    },
     {
       "version": "0.1.0-alpha.766",
       "changes": [

package/deploy/unraid/README.txt

@@ -793,6 +793,8 @@ Effective-spec audit helper:
       bootstrap_sanctuary_vault "$IMAGE_ID" \
         /mnt/user/appdata/ouro-butler/runtime/container-credentials.json \
         sanctuary-unraid sanctuary || return $?
+      provision_sanctuary_sab_credential "$IMAGE_ID" || return $?
+      verify_sanctuary_sab_readiness "$IMAGE_ID" || return $?
       validate_sanctuary_legacy_staging "$PREPARED_LEGACY_CONTAINER_ID" "$PREPARED_LEGACY_IMAGE_ID" || return $?
       LEGACY_STAGING_CONTAINER_ID=$PREPARED_LEGACY_CONTAINER_ID
       LEGACY_STAGING_IMAGE_ID=$PREPARED_LEGACY_IMAGE_ID
@@ -938,7 +940,6 @@ Effective-spec audit helper:
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
           --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-          --mount "type=bind,src=/mnt/user/appdata/sabnzbd/sabnzbd.ini,dst=/run/sanctuary/sabnzbd.ini,readonly" \
           "$IMAGE_ID" \
         && audit_effective ouro-butler-staging "$IMAGE_ID" "$IMAGE_ID" \
         && docker start ouro-butler-staging \
@@ -952,7 +953,6 @@ Effective-spec audit helper:
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
           --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
           --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-          --mount "type=bind,src=/mnt/user/appdata/sabnzbd/sabnzbd.ini,dst=/run/sanctuary/sabnzbd.ini,readonly" \
           "$IMAGE_ID" \
         && audit_effective ouro-butler "$IMAGE_ID" "$IMAGE_ID" \
         && docker start ouro-butler \
@@ -1187,6 +1187,75 @@ local unlock: available
       fi
       validate_sanctuary_roots "$BOOTSTRAP_RUNTIME_ROOT" "$BOOTSTRAP_AGENT_ROOT" || return $?
     }
+    provision_sanctuary_sab_credential() {
+      SAB_BOOTSTRAP_IMAGE_ID=$1
+      validate_exact_image_id "$SAB_BOOTSTRAP_IMAGE_ID" || return $?
+      SAB_BOOTSTRAP_SOURCE=/mnt/user/appdata/sabnzbd/sabnzbd.ini
+      SAB_BOOTSTRAP_RUNTIME_ROOT=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli
+      SAB_BOOTSTRAP_AGENT_ROOT=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro
+      SAB_BOOTSTRAP_ENVELOPE="$SAB_BOOTSTRAP_RUNTIME_ROOT/container-credentials.json"
+      SAB_BOOTSTRAP_CLAIM="$SAB_BOOTSTRAP_ENVELOPE.consuming"
+      test -f "$SAB_BOOTSTRAP_SOURCE" || return $?
+      test ! -L "$SAB_BOOTSTRAP_SOURCE" || return 1
+      test ! -e "$SAB_BOOTSTRAP_ENVELOPE" || return 1
+      test ! -e "$SAB_BOOTSTRAP_CLAIM" || return 1
+      ! docker container inspect ouro-butler-sab-credential-bootstrap >/dev/null 2>&1 || return 1
+      SAB_BOOTSTRAP_TMP=$(mktemp "$SAB_BOOTSTRAP_RUNTIME_ROOT/container-credentials.json.tmp.XXXXXX") || return $?
+      trap 'rm -f -- "$SAB_BOOTSTRAP_TMP"' EXIT || return $?
+      /usr/local/bin/node -e '
+        const fs = require("node:fs");
+        const [source, destination] = process.argv.slice(1);
+        const match = fs.readFileSync(source, "utf8").match(/^\s*api_key\s*=\s*(\S+)\s*$/mu);
+        if (!match || !match[1]) process.exit(1);
+        const credential = { type: "ouro.runtimeCredentialBootstrap", agentName: "sanctuary", machineId: "sanctuary", machineRuntimeConfig: { sabnzbdApiKey: match[1] } };
+        const envelope = { schemaVersion: 1, credentials: [credential] };
+        fs.writeFileSync(destination, `${JSON.stringify(envelope)}\n`, { mode: 0o600, flag: "w" });
+      ' "$SAB_BOOTSTRAP_SOURCE" "$SAB_BOOTSTRAP_TMP" || return $?
+      chown 10001:10001 "$SAB_BOOTSTRAP_TMP" || return $?
+      chmod 0600 "$SAB_BOOTSTRAP_TMP" || return $?
+      sync -f "$SAB_BOOTSTRAP_TMP" || return $?
+      mv -f -- "$SAB_BOOTSTRAP_TMP" "$SAB_BOOTSTRAP_ENVELOPE" || return $?
+      sync -f "$SAB_BOOTSTRAP_RUNTIME_ROOT" || return $?
+      trap - EXIT || return $?
+      docker run --rm --pull=never --network host --name ouro-butler-sab-credential-bootstrap --user 10001:10001 \
+        --mount "type=bind,src=$SAB_BOOTSTRAP_RUNTIME_ROOT,dst=/home/ouro/.ouro-cli" \
+        --mount "type=bind,src=$SAB_BOOTSTRAP_AGENT_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
+        --entrypoint node "$SAB_BOOTSTRAP_IMAGE_ID" -e '
+          const { loadContainerCredentialBootstrap } = require("/opt/ouro/dist/heart/daemon/container-credential-bootstrap.js");
+          loadContainerCredentialBootstrap(["sanctuary"]).then(
+            () => process.exit(0),
+            () => { process.stderr.write("SAB credential bootstrap failed\n"); process.exit(1); },
+          );
+        ' || return $?
+      ! docker container inspect ouro-butler-sab-credential-bootstrap >/dev/null 2>&1 || return 1
+      test ! -e "$SAB_BOOTSTRAP_ENVELOPE" || return 1
+      test ! -e "$SAB_BOOTSTRAP_CLAIM" || return 1
+    }
+    verify_sanctuary_sab_readiness() {
+      SAB_READINESS_IMAGE_ID=$1
+      validate_exact_image_id "$SAB_READINESS_IMAGE_ID" || return $?
+      ! docker container inspect ouro-butler-sab-readiness >/dev/null 2>&1 || return 1
+      docker run --rm --pull=never --network host --name ouro-butler-sab-readiness --user 10001:10001 \
+        --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
+        --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
+        --entrypoint node "$SAB_READINESS_IMAGE_ID" -e '
+          (async () => {
+            try {
+              const { refreshMachineRuntimeCredentialConfig } = require("/opt/ouro/dist/heart/runtime-credentials.js");
+              const { createSanctuarySabClient } = require("/opt/ouro/dist/senses/sanctuary-sab.js");
+              const current = await refreshMachineRuntimeCredentialConfig("sanctuary", "sanctuary");
+              if (!current.ok || typeof current.config.sabnzbdApiKey !== "string" || !current.config.sabnzbdApiKey.trim()) throw new Error();
+              const snapshot = await createSanctuarySabClient({ loadApiKey: async () => current.config.sabnzbdApiKey }).readQueue();
+              if (typeof snapshot.paused !== "boolean" || !Number.isSafeInteger(snapshot.queuedJobs) || !snapshot.observedAt) throw new Error();
+              process.stdout.write("Sanctuary SAB queue readiness verified.\n");
+            } catch {
+              process.stderr.write("Sanctuary SAB queue readiness verification failed.\n");
+              process.exitCode = 1;
+            }
+          })();
+        ' || return $?
+      ! docker container inspect ouro-butler-sab-readiness >/dev/null 2>&1 || return 1
+    }
     authenticate_sanctuary_provider() {
       AUTH_IMAGE_ID=$1
       AUTH_PROVIDER=${2-}
@@ -1606,6 +1675,13 @@ Update:
       "$IMAGE_ID" --template /audit/sanctuary.xml --runtime-policy /audit/container-runtime.json --expected-image "$IMAGE_ID"
     cleanup_event_asset_stage
     trap - EXIT
+    if provision_sanctuary_sab_credential "$IMAGE_ID" \
+      && verify_sanctuary_sab_readiness "$IMAGE_ID"; then
+      :
+    else
+      SAB_READINESS_STATUS=$?
+      (exit "$SAB_READINESS_STATUS")
+    fi
   Guard the atomic autostart disable separately. If it fails, production has not
   been touched and the captured status is propagated:
     if disable_butler_autostart; then
@@ -1712,7 +1788,6 @@ ouro-butler-rollback
       --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
       --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
       --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-      --mount "type=bind,src=/mnt/user/appdata/sabnzbd/sabnzbd.ini,dst=/run/sanctuary/sabnzbd.ini,readonly" \
       "$IMAGE_ID" \
       && audit_effective ouro-butler-staging "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" \
       && docker start ouro-butler-staging \
@@ -1761,7 +1836,6 @@ ouro-butler-rollback
       --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
       --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
       --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-      --mount "type=bind,src=/mnt/user/appdata/sabnzbd/sabnzbd.ini,dst=/run/sanctuary/sabnzbd.ini,readonly" \
       "$IMAGE_ID" \
       && audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" \
       && docker start ouro-butler \
@@ -2065,7 +2139,6 @@ Restore:
       --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
       --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
       --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-      --mount "type=bind,src=/mnt/user/appdata/sabnzbd/sabnzbd.ini,dst=/run/sanctuary/sabnzbd.ini,readonly" \
       "$IMAGE_ID" \
       && audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" \
       && docker start ouro-butler \
@@ -2131,6 +2204,24 @@ Credential recovery:
   Never print either envelope's contents or place them in logs or command arguments.
   After successful import, both files
   are absent and the vault is the only credential source of truth.
+  `provision_sanctuary_sab_credential "$IMAGE_ID"` is the one-shot migration for
+  the existing SAB key. Root reads the fixed host INI, writes only a mode-0600
+  `ouro.runtimeCredentialBootstrap` envelope owned by 10001:10001, and a
+  same-image one-shot container merges `sabnzbdApiKey` into
+  `runtime/machines/sanctuary/config`; the key never appears in argv, the
+  environment, logs, the Unraid template, or the Butler mounts. The bootstrap
+  reconciler is idempotent for the same value and fails closed on a conflict.
+  `verify_sanctuary_sab_readiness "$IMAGE_ID"` then reloads that machine item
+  from the vault and performs a real bounded queue read before any poller
+  cutover. The runtime and agent roots are persistent binds and package-managed
+  updates do not replace the machine vault item, so the credential survives
+  template and image updates.
+  Bootstrap is not the rotation path. After SAB rotates its key, use the
+  existing hidden-prompt merge command
+  `ouro vault config set --agent sanctuary --key sabnzbdApiKey --scope machine`,
+  restart the reviewed Butler container so its machine-config cache refreshes,
+  and rerun `verify_sanctuary_sab_readiness "$IMAGE_ID"`; a conflicting
+  bootstrap is expected to stop rather than overwrite canonical vault state.
   Never print or place credential values in logs, templates, command arguments,
   backups, or this runbook.
 

package/deploy/unraid/sanctuary-acceptance-contract.json

@@ -102,7 +102,7 @@
       "fixed": {
         "allowedRoot": "/evidence",
         "evidencePath": "/evidence/cursor-snapshot.json",
-        "adapters": [{ "schema": "telegram-cursor-v1", "executable": "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh" }]
+        "adapters": [{ "schema": "telegram-cursor-v1", "executable": "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh", "allowGenesis": false }]
       }
     },
     "cursor-delta": {

package/deploy/unraid/sanctuary-unit16-host-broker.mjs

@@ -18,7 +18,6 @@ const RUNTIME_POLICY_FILE = "/opt/ouro/container-runtime.json"
 const PRODUCTION_RUNTIME_SOURCE = "/mnt/user/appdata/ouro-butler/runtime/.ouro-cli"
 const PRODUCTION_BUNDLE_SOURCE = "/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro"
 const PRODUCTION_EVENT_SPOOL_SOURCE = "/boot/config/custom/ouro-events/spool"
-const PRODUCTION_SAB_CONFIG_SOURCE = "/mnt/user/appdata/sabnzbd/sabnzbd.ini"
 const GRAPHQL_ENDPOINT = "http://127.0.0.1/graphql"
 const BOOT_ID = "/proc/sys/kernel/random/boot_id"
 const MDCMD = "/usr/local/sbin/mdcmd"
@@ -392,7 +391,6 @@ async function containerSnapshot(expectedImage) {
     { destination: "/home/ouro/.ouro-cli", source: PRODUCTION_RUNTIME_SOURCE, mode: "rw", propagation: "rprivate", rw: true, type: "bind" },
     { destination: "/home/ouro/AgentBundles/sanctuary.ouro", source: PRODUCTION_BUNDLE_SOURCE, mode: "rw", propagation: "rprivate", rw: true, type: "bind" },
     { destination: "/run/ouro-events", source: PRODUCTION_EVENT_SPOOL_SOURCE, mode: "ro", propagation: "rprivate", rw: false, type: "bind" },
-    { destination: "/run/sanctuary/sabnzbd.ini", source: PRODUCTION_SAB_CONFIG_SOURCE, mode: "ro", propagation: "rprivate", rw: false, type: "bind" },
   ]
   const mountsExact = mounts.length === expectedMounts.length && expectedMounts.every((expected) => mounts.some((mount) => mount.destination === expected.destination && mount.source === expected.source && mount.mode === expected.mode && mount.propagation === expected.propagation && mount.rw === expected.rw && mount.type === expected.type))
   const securityExact = value.privileged === false && (value.capAdd === null || (Array.isArray(value.capAdd) && value.capAdd.length === 0))

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.766",
+  "runtimeVersion": "0.1.0-alpha.768",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.766</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.768</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>
@@ -24,5 +24,4 @@
   <Config Name="Runtime state" Target="/home/ouro/.ouro-cli" Default="/mnt/user/appdata/ouro-butler/runtime/.ouro-cli" Mode="rw" Description="Machine-scoped runtime" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/runtime/.ouro-cli</Config>
   <Config Name="Agent bundle" Target="/home/ouro/AgentBundles/sanctuary.ouro" Default="/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro" Mode="rw" Description="Sanctuary bundle" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro</Config>
   <Config Name="Privileged event spool" Target="/run/ouro-events" Default="/boot/config/custom/ouro-events/spool" Mode="ro" Description="Root-owned detector envelopes, read-only inside the Butler" Type="Path" Display="always" Required="true" Mask="false">/boot/config/custom/ouro-events/spool</Config>
-  <Config Name="SAB queue verification" Target="/run/sanctuary/sabnzbd.ini" Default="/mnt/user/appdata/sabnzbd/sabnzbd.ini" Mode="ro" Description="Existing SAB configuration used only for an independent read after a verified protective pause" Type="Path" Display="advanced" Required="true" Mask="false">/mnt/user/appdata/sabnzbd/sabnzbd.ini</Config>
 </Container>

package/dist/heart/daemon/container-spec-auditor.js

@@ -7,13 +7,11 @@ const EXPECTED_BINDS = [
     "/mnt/user/appdata/ouro-butler/runtime/.ouro-cli:/home/ouro/.ouro-cli:rw",
     "/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro:/home/ouro/AgentBundles/sanctuary.ouro:rw",
     "/boot/config/custom/ouro-events/spool:/run/ouro-events:ro",
-    "/mnt/user/appdata/sabnzbd/sabnzbd.ini:/run/sanctuary/sabnzbd.ini:ro",
 ];
 const EXPECTED_MOUNTS = [
     ["/mnt/user/appdata/ouro-butler/runtime/.ouro-cli", "/home/ouro/.ouro-cli", true, "rprivate"],
     ["/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro", "/home/ouro/AgentBundles/sanctuary.ouro", true, "rprivate"],
     ["/boot/config/custom/ouro-events/spool", "/run/ouro-events", false, "rprivate"],
-    ["/mnt/user/appdata/sabnzbd/sabnzbd.ini", "/run/sanctuary/sabnzbd.ini", false, "rprivate"],
 ];
 const LEGACY_ALPHA742_IMAGE = "sha256:681449ad47a2621705cd339b481e6339236b31dc65e195b1cf5025d0f2191d7d";
 const LEGACY_ALPHA742_MOUNTS = EXPECTED_MOUNTS.slice(0, 2);
@@ -152,10 +150,10 @@ function auditSanctuaryStagedFiles(input) {
         const mode = match[1].match(/\bMode="([^"]+)"/u)?.[1];
         return type === "Path" && target && mode ? `${match[2]}:${target}:${mode}` : "invalid";
     });
-    if (configOpenCount !== 4
-        || configEntries.length !== 4
+    if (configOpenCount !== EXPECTED_BINDS.length
+        || configEntries.length !== EXPECTED_BINDS.length
         || JSON.stringify([...pathConfigs].sort()) !== JSON.stringify([...EXPECTED_BINDS].sort())) {
-        violations.push("template Config entries must equal the canonical four path binds");
+        violations.push("template Config entries must equal the canonical path binds");
     }
     const postArgsOpenCount = [...input.templateXml.matchAll(/<PostArgs\b/gu)].length;
     const postArgs = [...input.templateXml.matchAll(/<PostArgs(?:(?:\s*\/>)|>([^<]*)<\/PostArgs>)/gu)];

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -99,6 +99,7 @@ const NETWORK_TIMEOUT_MS = 10_000;
 const KEY_DIRECTORY = "/boot/config/plugins/dynamix.my.servers/keys";
 const SELECTED_KEY_RECORD = "/run/ouro-acceptance/unraid-key.json";
 const TELEGRAM_OFFSET = "/home/ouro/AgentBundles/sanctuary.ouro/state/senses/telegram/offset.json";
+const TELEGRAM_IDENTITY_KEY = "/home/ouro/AgentBundles/sanctuary.ouro/state/senses/telegram/identity.key";
 const TELEGRAM_AUDIT = `/home/ouro/AgentBundles/sanctuary.ouro/${telegram_audit_ledger_1.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH}`;
 const TELEGRAM_AUDIT_HEAD = `/home/ouro/AgentBundles/sanctuary.ouro/${telegram_audit_ledger_1.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH}`;
 const IMAGE_DIGEST_FILE = "/run/ouro-acceptance/image-digest";
@@ -1848,16 +1849,52 @@ async function storeTelegramBootstrap(payload, deps) {
     }
     return { stored: true };
 }
-function cursorSnapshot(deps) {
+function cursorSnapshot(payload, deps) {
+    exactKeys(payload, ["allowGenesis", "operation", "schema"], "Telegram cursor snapshot request");
+    if (payload.schema !== "telegram-cursor-v1" || typeof payload.allowGenesis !== "boolean")
+        throw new Error("Telegram cursor snapshot request is invalid");
     const offsetRaw = fixedFile(deps, TELEGRAM_OFFSET);
-    const auditRaw = fixedFile(deps, TELEGRAM_AUDIT);
-    const auditHeadRaw = fixedFile(deps, TELEGRAM_AUDIT_HEAD);
+    const identityKey = fixedFile(deps, TELEGRAM_IDENTITY_KEY).trim();
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(identityKey) || Buffer.from(identityKey, "base64url").length !== 32) {
+        throw new Error("Telegram identity key is invalid");
+    }
     const offset = object(JSON.parse(offsetRaw), "Telegram offset");
     if (!Number.isSafeInteger(offset.nextUpdateId) || offset.nextUpdateId < 0)
         throw new Error("Telegram offset is invalid");
+    let auditCursorDigest;
+    let verificationFailure;
+    let observedAuditState = false;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const headBefore = optionalFixedFile(deps, TELEGRAM_AUDIT_HEAD);
+        const auditRaw = optionalFixedFile(deps, TELEGRAM_AUDIT);
+        const headAfter = optionalFixedFile(deps, TELEGRAM_AUDIT_HEAD);
+        if (headBefore === null && auditRaw === null && headAfter === null) {
+            if (payload.allowGenesis !== true)
+                throw new Error("Telegram audit genesis is not authorized for this snapshot");
+            if (!observedAuditState) {
+                auditCursorDigest = sha256("ouroboros.telegram.acceptance.cursor.v1\0genesis");
+                break;
+            }
+            continue;
+        }
+        observedAuditState = true;
+        if (headBefore !== null && auditRaw !== null && headAfter !== null && headBefore === headAfter) {
+            try {
+                (0, telegram_audit_ledger_1.verifyTelegramAuditLedger)({ ledgerRaw: auditRaw, headRaw: headAfter, identityKey });
+                auditCursorDigest = sha256(`ouroboros.telegram.acceptance.cursor.v1\0present\0${auditRaw}\0${headAfter}`);
+                break;
+            }
+            catch (error) {
+                verificationFailure = error;
+            }
+        }
+    }
+    if (auditCursorDigest === undefined) {
+        throw new Error(`Telegram acceptance audit state could not be captured consistently${verificationFailure ? `: ${verificationFailure.message}` : ""}`, verificationFailure ? { cause: verificationFailure } : undefined);
+    }
     return {
         offsetDigest: sha256(JSON.stringify({ nextUpdateId: offset.nextUpdateId })),
-        auditCursorDigest: sha256(`${auditRaw}\0${auditHeadRaw}`),
+        auditCursorDigest,
     };
 }
 function telegramPollerQuiescence(payload, deps) {
@@ -2065,7 +2102,7 @@ function provenance(payload, deps) {
     const containerDigest = fixedFile(deps, CONTAINER_DIGEST_FILE).trim();
     if (!SHA256.test(imageDigest) || !SHA256.test(containerDigest))
         throw new Error("live provenance digest is invalid");
-    const cursor = cursorSnapshot(deps);
+    const cursor = cursorSnapshot({ operation: "snapshot", schema: "telegram-cursor-v1", allowGenesis: false }, deps);
     return { imageDigest, containerDigest, cursorDigest: sha256(`${cursor.offsetDigest}\0${cursor.auditCursorDigest}`) };
 }
 function evidenceSnapshot(payload, deps) {
@@ -2078,7 +2115,11 @@ function evidenceSnapshot(payload, deps) {
     const imageDigest = fixedFile(deps, IMAGE_DIGEST_FILE).trim();
     if (!SHA256.test(imageDigest))
         throw new Error("container image digest is invalid");
-    return { healthy: health.healthy, containerImageDigest: imageDigest, telegramOffsetDigest: cursorSnapshot(deps).offsetDigest };
+    return {
+        healthy: health.healthy,
+        containerImageDigest: imageDigest,
+        telegramOffsetDigest: cursorSnapshot({ operation: "snapshot", schema: "telegram-cursor-v1", allowGenesis: false }, deps).offsetDigest,
+    };
 }
 function bootId(deps) {
     const value = fixedFile(deps, BOOT_ID_FILE).trim();
@@ -2147,6 +2188,7 @@ function materializeConfig(payload, deps) {
         if (phase !== "before" && phase !== "after")
             throw new Error("cursor snapshot phase is invalid");
         config.evidencePath = `/evidence/cursor-${phase}.json`;
+        config.adapters = config.adapters.map((adapter) => ({ ...adapter, allowGenesis: phase === "before" }));
     }
     else if (command === "unraid-key-rotate") {
         const closed = object(JSON.parse(fixedFile(deps, CLOSED_INVENTORY_FILE)), "closed Unraid inventory");
@@ -2188,7 +2230,7 @@ async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctu
                 result = telegramPollerQuiescence(payload, deps);
                 break;
             case "snapshot":
-                result = cursorSnapshot(deps);
+                result = cursorSnapshot(payload, deps);
                 break;
             case "inject_callbacks_concurrently":
                 result = await concurrentCallbackProbe(payload, deps);

package/dist/heart/daemon/sanctuary-acceptance-harness.js

@@ -1011,7 +1011,10 @@ async function cursorSnapshot(config, deps) {
             throw new Error("snapshot adapter schemas must be unique");
         schemas.add(schema);
         const executable = adapter(spec.executable, "snapshot adapter executable");
-        const payload = await deps.runAdapter(executable, { operation: "snapshot", schema });
+        const allowGenesis = spec.allowGenesis === undefined ? false : boolean(spec.allowGenesis, "snapshot adapter allowGenesis");
+        if (allowGenesis && evidencePath !== path.join(root, "cursor-before.json"))
+            throw new Error("snapshot adapter genesis authority is only valid for cursor-before evidence");
+        const payload = await deps.runAdapter(executable, { operation: "snapshot", schema, allowGenesis });
         const selected = fixedEvidenceValues(schema, payload);
         for (const [name, value] of Object.entries(selected))
             values[`${schema}.${name}`] = value;

package/dist/senses/sanctuary-full-visibility-contract.js

@@ -1,10 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanctuaryFullVisibilityEmptyResponse = sanctuaryFullVisibilityEmptyResponse;
 exports.sanctuaryFullVisibilityRequiredToolCalls = sanctuaryFullVisibilityRequiredToolCalls;
 const runtime_1 = require("../nerves/runtime");
 const REQUIRED_TOOL_NAMES = ["query_active_work", "query_cares", "unraid_get_system", "unraid_list_containers", "unraid_get_storage", "sanctuary_get_download_queue"];
 const WHOLE_STATUS_REQUESTS = new Set(["what are you working on", "what's going on with sanctuary"]);
-function unsupportedCurrentClaim(answer) {
+function unsupportedCurrentClaim(answer, queueUnavailable) {
+    if (queueUnavailable && answer.trim().length === 0)
+        return "Give Ari the current results that did complete and say plainly that the download queue is currently unavailable; do not return an empty answer.";
+    if (queueUnavailable) {
+        const unsupportedQueueClaim = answer.split(/[,;!?\n]|(?<!\d)\.(?!\d)/u).some((clause) => {
+            if (!/\b(?:download(?:s| queue)?|queue|SABnzbd)\b/iu.test(clause))
+                return false;
+            const explicitlyUnverified = /\b(?:(?:cannot|can't|could not|couldn't|unable to) (?:currently )?(?:be )?(?:verif(?:y|ied)|read|check(?:ed)?|confirm(?:ed)?)|(?:do not|don't) know(?: whether)?|unknown|unavailable|unverified|stale|historical|previous|prior|failed)\b|\bneeds? (?:a )?(?:fresh |authoritative )*(?:check|read|verification)\b/iu.test(clause);
+            return !explicitlyUnverified;
+        });
+        if (unsupportedQueueClaim)
+            return "The current download-queue read is unavailable. Preserve the other current results, but do not claim a queue state; say plainly that downloads could not be verified.";
+    }
     const unsupported = answer.replace(/docker\.img/giu, "docker image").split(/[,;!?\n]|(?<!\d)\.(?!\d)/u).some((sentence) => {
         if (!/docker image(?: disk)?/iu.test(sentence))
             return false;
@@ -24,43 +37,76 @@ function unsupportedCurrentClaim(answer) {
     });
     return unsupportedProviderClaim ? "The current queue read does not prove provider credit or authentication status. Do not report Astraweb, block-credit, or authentication failure as current; say that the provider needs a fresh authoritative check." : undefined;
 }
+function exactQueueUnavailableResult(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const result = value;
+    if (JSON.stringify(Object.keys(result).sort()) !== JSON.stringify(["error", "observedAt", "ok"]))
+        return false;
+    if (result.ok !== false || typeof result.observedAt !== "string" || !Number.isFinite(Date.parse(result.observedAt)) || new Date(result.observedAt).toISOString() !== result.observedAt)
+        return false;
+    const error = result.error;
+    return !!error && typeof error === "object" && !Array.isArray(error)
+        && JSON.stringify(Object.keys(error).sort()) === JSON.stringify(["code"])
+        && ["credential_unavailable", "request_unavailable", "malformed_response"].includes(String(error.code));
+}
 function successfulCurrentResult(name, result) {
     if (Buffer.byteLength(result, "utf8") > 1_000_000)
-        return false;
+        return { valid: false, queueUnavailable: false };
     if (name === "query_active_work")
-        return result.trimStart().startsWith("this is my current top-level live world-state.");
+        return { valid: result.trimStart().startsWith("this is my current top-level live world-state."), queueUnavailable: false };
     try {
         const parsed = JSON.parse(result);
         if (name === "query_cares")
-            return Array.isArray(parsed);
+            return { valid: Array.isArray(parsed), queueUnavailable: false };
         if (name === "sanctuary_get_download_queue") {
+            if (exactQueueUnavailableResult(parsed))
+                return { valid: true, queueUnavailable: true };
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-                return false;
+                return { valid: false, queueUnavailable: false };
             const queue = parsed;
             const exactKeys = ["observedAt", "paused", "queuedJobs", "stateDigest", "status"];
-            return JSON.stringify(Object.keys(queue).sort()) === JSON.stringify(exactKeys)
-                && typeof queue.paused === "boolean"
-                && typeof queue.status === "string" && Buffer.byteLength(queue.status, "utf8") <= 64
-                && Number.isSafeInteger(queue.queuedJobs) && Number(queue.queuedJobs) >= 0 && Number(queue.queuedJobs) <= 1_000_000
-                && typeof queue.observedAt === "string" && Number.isFinite(Date.parse(queue.observedAt)) && new Date(queue.observedAt).toISOString() === queue.observedAt
-                && typeof queue.stateDigest === "string" && /^[a-f0-9]{64}$/u.test(queue.stateDigest);
+            return { valid: JSON.stringify(Object.keys(queue).sort()) === JSON.stringify(exactKeys)
+                    && typeof queue.paused === "boolean"
+                    && typeof queue.status === "string" && Buffer.byteLength(queue.status, "utf8") <= 64
+                    && Number.isSafeInteger(queue.queuedJobs) && Number(queue.queuedJobs) >= 0 && Number(queue.queuedJobs) <= 1_000_000
+                    && typeof queue.observedAt === "string" && Number.isFinite(Date.parse(queue.observedAt)) && new Date(queue.observedAt).toISOString() === queue.observedAt
+                    && typeof queue.stateDigest === "string" && /^[a-f0-9]{64}$/u.test(queue.stateDigest), queueUnavailable: false };
         }
-        return !!parsed && typeof parsed === "object" && !Array.isArray(parsed) && parsed.ok === true;
+        return { valid: !!parsed && typeof parsed === "object" && !Array.isArray(parsed) && parsed.ok === true, queueUnavailable: false };
     }
     catch {
-        return false;
+        return { valid: false, queueUnavailable: false };
     }
 }
+function normalizedRequest(request) {
+    return request.normalize("NFKC").trim().toLocaleLowerCase("en-US").replaceAll("’", "'").replace(/[?!.\s]+$/gu, "");
+}
+function sanctuaryFullVisibilityEmptyResponse(request) {
+    return WHOLE_STATUS_REQUESTS.has(normalizedRequest(request))
+        ? "I couldn't finish a trustworthy Sanctuary status check because a current check was unavailable. I won't guess or reuse old alerts; please try again shortly."
+        : undefined;
+}
 function sanctuaryFullVisibilityRequiredToolCalls(request, advertisedToolNames) {
-    const normalized = request.normalize("NFKC").trim().toLocaleLowerCase("en-US").replaceAll("’", "'").replace(/[?!.\s]+$/gu, "");
+    const normalized = normalizedRequest(request);
     if (!WHOLE_STATUS_REQUESTS.has(normalized) || !REQUIRED_TOOL_NAMES.every((name) => advertisedToolNames.includes(name)))
         return undefined;
     (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.sanctuary_full_visibility_reads_required", message: "required current Sanctuary visibility reads", meta: { toolCount: REQUIRED_TOOL_NAMES.length } });
+    let queueUnavailable = false;
+    const completed = new Set();
     return {
         names: REQUIRED_TOOL_NAMES,
         retryMessage: "Before answering, read current active work, cares, system health, service state, storage, and the download queue. Current tool facts outrank care history; a stale care is a recheck item, not a present-tense fact. Then give Ari one compact household summary; do not ask him to choose a status slice.",
         requireSuccessfulResults: true,
-        validateRequiredToolResult: successfulCurrentResult,
-        validateTerminalAnswer: unsupportedCurrentClaim,
+        validateRequiredToolResult: (name, result) => {
+            const validation = successfulCurrentResult(name, result);
+            if (name === "sanctuary_get_download_queue" && validation.valid)
+                queueUnavailable = validation.queueUnavailable;
+            if (validation.valid)
+                completed.add(name);
+            return validation.valid;
+        },
+        validateTerminalAnswer: (answer) => unsupportedCurrentClaim(answer, queueUnavailable),
+        emptyResponseFallback: () => REQUIRED_TOOL_NAMES.every((name) => completed.has(name)) ? sanctuaryFullVisibilityEmptyResponse(request) : undefined,
     };
 }

package/dist/senses/sanctuary-runtime.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runWithSanctuaryToolReceiptCollection = runWithSanctuaryToolReceiptCollection;
+exports.loadSanctuarySabApiKey = loadSanctuarySabApiKey;
 exports.createSanctuaryToolContext = createSanctuaryToolContext;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -92,6 +93,9 @@ function required(config, field) {
         throw new Error(`Sanctuary ${field} is missing`);
     return value.trim();
 }
+async function loadSanctuarySabApiKey(agentName) {
+    return required(machineConfig(agentName), "sabnzbdApiKey");
+}
 function requiredObject(config, field) {
     const value = config[field];
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -192,7 +196,7 @@ function createSanctuaryToolContext(agentName) {
     const endpoint = required(initial, "unraidGraphqlUrl");
     const readClient = new unraid_client_1.UnraidClient({ endpoint, apiKey: required(initial, "unraidReadApiKey") });
     const reads = (0, tools_unraid_1.createUnraidReadTools)(readClient);
-    const sab = (0, sanctuary_sab_1.createSanctuarySabClient)();
+    const sab = (0, sanctuary_sab_1.createSanctuarySabClient)({ loadApiKey: () => loadSanctuarySabApiKey(agentName) });
     const mediaOptimization = (0, sanctuary_media_optimization_1.createSanctuaryMediaOptimizationClient)(optionalJellyfin(initial));
     const acceptanceRead = (toolName, read) => async (...args) => {
         try {
@@ -238,7 +242,17 @@ function createSanctuaryToolContext(agentName) {
                 const services = await Promise.all(sanctuary_health_1.SANCTUARY_PUBLIC_ENDPOINTS.map(async (url) => ({ name: new URL(url).hostname.split(".")[0], ...await (0, sanctuary_health_1.probeSanctuaryEndpoint)(url) })));
                 return { ok: true, data: { observedAt: new Date().toISOString(), services, degraded: services.some((service) => !service.ok) } };
             }),
-            getDownloadQueue: acceptanceRead("sanctuary_get_download_queue", sab.readQueue),
+            getDownloadQueue: acceptanceRead("sanctuary_get_download_queue", async () => {
+                try {
+                    return await sab.readQueue();
+                }
+                catch (error) {
+                    const code = (0, sanctuary_sab_1.sanctuarySabReadUnavailableCode)(error);
+                    if (code)
+                        return { ok: false, error: { code }, observedAt: new Date().toISOString() };
+                    throw error;
+                }
+            }),
             getMediaOptimization: acceptanceRead("sanctuary_get_media_optimization", mediaOptimization.read),
             resumeDownloadQueue: async () => {
                 try {

package/dist/senses/sanctuary-sab.js

@@ -1,23 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE = void 0;
+exports.sanctuarySabReadUnavailableCode = sanctuarySabReadUnavailableCode;
 exports.createSanctuarySabClient = createSanctuarySabClient;
 const node_crypto_1 = require("node:crypto");
-const node_fs_1 = require("node:fs");
 const runtime_1 = require("../nerves/runtime");
-const DEFAULT_INI_PATH = "/run/sanctuary/sabnzbd.ini";
 const BASE_URL = "http://127.0.0.1:8090/api";
-function apiKey(iniPath) {
-    let contents = "";
-    try {
-        contents = (0, node_fs_1.readFileSync)(iniPath, "utf8");
-    }
-    catch {
-        throw new Error("SAB queue verification credential is unavailable");
-    }
-    const value = contents.match(/^\s*api_key\s*=\s*(\S+)\s*$/mu)?.[1];
-    if (!value)
-        throw new Error("SAB queue verification credential is unavailable");
-    return value;
+exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE = "SAB queue verification credential is unavailable";
+function sanctuarySabReadUnavailableCode(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    if (error.message === exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE)
+        return "credential_unavailable";
+    if (error.message === "SAB queue request failed")
+        return "request_unavailable";
+    if (error.message === "SAB queue response is malformed")
+        return "malformed_response";
+    return undefined;
 }
 function queuedJobs(value) {
     const parsed = typeof value === "string" && /^\d{1,7}$/u.test(value) ? Number(value) : value;
@@ -25,15 +24,21 @@ function queuedJobs(value) {
         throw new Error("SAB queue response is malformed");
     return Number(parsed);
 }
-function createSanctuarySabClient(options = {}) {
-    const iniPath = options.iniPath ?? DEFAULT_INI_PATH;
+function createSanctuarySabClient(options) {
     const fetchImpl = options.fetch ?? fetch;
-    let cachedApiKey = null;
     const request = async (mode) => {
-        cachedApiKey ??= apiKey(iniPath);
+        let apiKey;
+        try {
+            apiKey = (await options.loadApiKey()).trim();
+        }
+        catch {
+            throw new Error(exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE);
+        }
+        if (!apiKey)
+            throw new Error(exports.SANCTUARY_SAB_CREDENTIAL_UNAVAILABLE);
         let response;
         try {
-            response = await fetchImpl(`${BASE_URL}?mode=${mode}${mode === "queue" ? "&output=json" : ""}&apikey=${encodeURIComponent(cachedApiKey)}`, { signal: AbortSignal.timeout(15_000) });
+            response = await fetchImpl(`${BASE_URL}?mode=${mode}${mode === "queue" ? "&output=json" : ""}&apikey=${encodeURIComponent(apiKey)}`, { signal: AbortSignal.timeout(15_000) });
         }
         catch {
             throw new Error("SAB queue request failed");

package/dist/senses/shared-turn.js

@@ -430,14 +430,15 @@ async function runSenseTurn(options) {
             if (persistPromise)
                 await persistPromise;
             const postTurnSession = (0, context_1.loadSession)(sessPath);
+            const emptyFallback = options.emptyResponseFallback?.();
             if (postTurnSession?.messages) {
                 const recovered = extractOutwardSenseDeliveryText(postTurnSession.messages);
-                finalResponse = recovered ?? "(agent responded but response was empty)";
+                finalResponse = recovered ?? emptyFallback ?? "(agent responded but response was empty)";
                 if (recovered)
                     responseCausalSessionEventId = newOutwardCoordinates(persistedEvents, existingEventIds).at(-1)?.eventId;
             }
             else {
-                finalResponse = "(agent responded but response was empty)";
+                finalResponse = emptyFallback ?? "(agent responded but response was empty)";
             }
         }
         else {

package/dist/senses/telegram.js

@@ -63,11 +63,12 @@ const runtime_credentials_1 = require("../heart/runtime-credentials");
 const runtime_1 = require("../nerves/runtime");
 const nerves_1 = require("../nerves");
 const sanctuary_interactive_control_1 = require("./sanctuary-interactive-control");
+const sanctuary_runtime_1 = require("./sanctuary-runtime");
 const sanctuary_sab_1 = require("./sanctuary-sab");
 const sanctuary_download_credit_presentation_1 = require("./sanctuary-download-credit-presentation");
 const shared_turn_1 = require("./shared-turn");
 const telegram_client_1 = require("./telegram-client");
-const sanctuary_runtime_1 = require("./sanctuary-runtime");
+const sanctuary_runtime_2 = require("./sanctuary-runtime");
 const sanctuary_full_visibility_contract_1 = require("./sanctuary-full-visibility-contract");
 const sanctuary_storage_optimization_contract_1 = require("./sanctuary-storage-optimization-contract");
 const sanctuary_grounding_1 = require("./sanctuary-grounding");
@@ -87,11 +88,14 @@ const pending_1 = require("../mind/pending");
 const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const telegram_admission_1 = require("./telegram-admission");
 const telegram_effect_adapter_1 = require("./telegram-effect-adapter");
-const SANCTUARY_SAB_CONFIG_PATH = "/run/sanctuary/sabnzbd.ini";
+function createFullVisibilityProgress() {
+    const progress = {};
+    return { progress, emptyResponseFallback: () => progress.fallback?.() };
+}
 function createSabQueueProtectiveStateVerifier(options = {}) {
     let client = null;
     return async (action) => {
-        client ??= (0, sanctuary_sab_1.createSanctuarySabClient)({ iniPath: options.iniPath ?? SANCTUARY_SAB_CONFIG_PATH, fetch: options.fetch, now: options.now });
+        client ??= (0, sanctuary_sab_1.createSanctuarySabClient)({ loadApiKey: options.loadApiKey ?? (() => (0, sanctuary_runtime_1.loadSanctuarySabApiKey)("sanctuary")), fetch: options.fetch, now: options.now });
         const snapshot = await client.readQueue();
         const paused = snapshot.paused;
         const digest = (0, node_crypto_1.createHash)("sha256").update(`sabnzbd.queue.paused=${String(paused)}`).digest("hex");
@@ -685,7 +689,7 @@ function createTelegramSenseApp(options) {
         ? new telegram_admission_1.FileTelegramAdmissionStore(path.join(agentRoot, "state", "senses", "telegram", "admissions"))
         : undefined;
     const runTurn = options.runTurn ?? options._runTurn ?? shared_turn_1.runSenseTurn;
-    const collectToolReceipts = options._runWithToolReceiptCollection ?? sanctuary_runtime_1.runWithSanctuaryToolReceiptCollection;
+    const collectToolReceipts = options._runWithToolReceiptCollection ?? sanctuary_runtime_2.runWithSanctuaryToolReceiptCollection;
     const useSanctuaryRuntime = options.agentName === "sanctuary" && !options.runTurn;
     const readScenarioHandleDigest = () => (options.acceptanceMarker
         ? options.acceptanceMarker()
@@ -878,7 +882,7 @@ function createTelegramSenseApp(options) {
     let approvalTransport;
     let interactiveControl;
     try {
-        toolContext = useSanctuaryRuntime ? (options._toolContext ?? (0, sanctuary_runtime_1.createSanctuaryToolContext)(options.agentName)) : undefined;
+        toolContext = useSanctuaryRuntime ? (options._toolContext ?? (0, sanctuary_runtime_2.createSanctuaryToolContext)(options.agentName)) : undefined;
         if (toolContext && options.telegramContactManager)
             toolContext.telegramContactManager = options.telegramContactManager;
         approvalRuntime = options.approvalRuntime ?? (useSanctuaryRuntime ? (options._createApprovalRuntime ?? telegram_approval_runtime_1.createTelegramApprovalRuntime)({
@@ -1076,10 +1080,21 @@ function createTelegramSenseApp(options) {
         };
         return async ({ runAgentOptions }) => {
             const relationshipAuthorization = await resolveLiveRelationshipAuthorization();
-            const requiredToolCalls = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner"
+            const storageOptimization = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner"
                 ? (0, sanctuary_storage_optimization_contract_1.sanctuaryStorageOptimizationRequiredToolCalls)(input.userMessage, relationshipAuthorization.advertisedToolNames)
-                    ?? (0, sanctuary_full_visibility_contract_1.sanctuaryFullVisibilityRequiredToolCalls)(input.userMessage, relationshipAuthorization.advertisedToolNames)
                 : undefined;
+            const fullVisibility = options.agentName === "sanctuary" && relationshipAuthorization.profileId === "sanctuary-owner" && !storageOptimization
+                ? (0, sanctuary_full_visibility_contract_1.sanctuaryFullVisibilityRequiredToolCalls)(input.userMessage, relationshipAuthorization.advertisedToolNames)
+                : undefined;
+            if (input.fullVisibilityProgress && fullVisibility)
+                input.fullVisibilityProgress.fallback = fullVisibility.emptyResponseFallback;
+            const requiredToolCalls = storageOptimization ?? (fullVisibility ? {
+                names: fullVisibility.names,
+                retryMessage: fullVisibility.retryMessage,
+                requireSuccessfulResults: fullVisibility.requireSuccessfulResults,
+                validateRequiredToolResult: fullVisibility.validateRequiredToolResult,
+                validateTerminalAnswer: fullVisibility.validateTerminalAnswer,
+            } : undefined);
             return {
                 ...runAgentOptions,
                 ...(requiredToolCalls ? { requiredToolCalls } : {}),
@@ -1118,6 +1133,7 @@ function createTelegramSenseApp(options) {
                 },
             }
             : undefined;
+        const fullVisibility = createFullVisibilityProgress();
         const result = await runTurn({
             agentName: options.agentName,
             channel: "telegram",
@@ -1130,7 +1146,8 @@ function createTelegramSenseApp(options) {
             ...(orientationFrame ? { orientationFrame } : {}),
             toolContext: { ...(toolContext ?? {}), attachmentIds: input.attachmentIds ?? [] },
             prepareRunAgentOptions: prepareRelationshipRunAgentOptions({ friendId: input.friendId, requestId: input.requestId,
-                sessionEventId: input.eventId, userId: input.userId, chatId: input.chatId, sessionKey: input.sessionKey, userMessage: input.text }),
+                sessionEventId: input.eventId, userId: input.userId, chatId: input.chatId, sessionKey: input.sessionKey, userMessage: input.text, fullVisibilityProgress: fullVisibility.progress }),
+            emptyResponseFallback: fullVisibility.emptyResponseFallback,
             deliverySink: { onDelivery: (delivery) => deliver(delivery.text, delivery.kind === "settle") },
         });
         if (effects.length === 0 && result.response.trim())
@@ -1309,6 +1326,7 @@ function createTelegramSenseApp(options) {
                     inbound: { text: message.text, reference: inboundReference, attachmentIds: hydrated.attachmentIds, relations: ingressRelations },
                 })
                 : null;
+            const fullVisibility = createFullVisibilityProgress();
             const collected = await collectToolReceipts(() => runTurn({
                 agentName: options.agentName,
                 channel: "telegram",
@@ -1324,6 +1342,7 @@ function createTelegramSenseApp(options) {
                 ingressRelations,
                 ...(ingressReceipt ? { precommittedIngress: ingressReceipt } : {}),
                 turnMetricsObserver,
+                emptyResponseFallback: fullVisibility.emptyResponseFallback,
                 deliverySink: {
                     onDelivery: async (delivery) => {
                         if (groundingIntentTool) {
@@ -1347,6 +1366,7 @@ function createTelegramSenseApp(options) {
                         chatId: message.chatId,
                         sessionKey: currentSessionKey,
                         userMessage: message.text,
+                        fullVisibilityProgress: fullVisibility.progress,
                     }),
                 } : {}),
                 ...(approvalRuntime ? { approvalCoordinatorFactory: approvalRuntime.coordinator } : {}),

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.766",
+  "version": "0.1.0-alpha.768",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.766",
+      "version": "0.1.0-alpha.768",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.766",
+  "version": "0.1.0-alpha.768",
   "engines": {
     "node": ">=22"
   },