@ouro.bot/cli 0.1.0-alpha.772 → 0.1.0-alpha.774

package/dist/heart/daemon/daemon-entry.js

@@ -74,7 +74,6 @@ const runtime_credentials_1 = require("../runtime-credentials");
 const machine_identity_1 = require("../machine-identity");
 const container_credential_bootstrap_1 = require("./container-credential-bootstrap");
 const daemon_bootstrap_startup_1 = require("./daemon-bootstrap-startup");
-const auth_flow_1 = require("../auth/auth-flow");
 const sanctuary_health_runner_1 = require("../../senses/sanctuary-health-runner");
 const sanctuary_acceptance_marker_1 = require("./sanctuary-acceptance-marker");
 const sanctuary_scheduler_liveness_1 = require("./sanctuary-scheduler-liveness");
@@ -588,77 +587,40 @@ function writeStopCommandHealthState() {
         // Health writes are best-effort during shutdown.
     }
 }
-function providerPreloadTargets(agent) {
-    try {
-        const { config } = (0, auth_flow_1.readAgentConfigForAgent)(agent, (0, identity_1.getAgentBundlesRoot)());
-        return [...new Set([config.humanFacing.provider, config.agentFacing.provider])];
-    }
-    catch (error) {
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            component: "daemon",
-            event: "daemon.provider_preload_skipped",
-            message: "skipping provider credential preload because agent config could not be read",
-            meta: {
-                agent,
-                error: error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error config-read failures @preserve */ String(error),
-            },
-        });
-        return [];
-    }
-}
-function providerPreloadMissingTargets(result, providers) {
-    return providers.filter((provider) => !result.pool.providers[provider]);
-}
-async function preloadProviderCredentialPools() {
-    await Promise.all(managedAgents.map(async (agent) => {
-        const providers = providerPreloadTargets(agent);
-        if (providers.length === 0)
-            return;
-        const result = await (0, provider_credentials_1.refreshProviderCredentialPool)(agent, { preserveCachedOnFailure: true, providers });
-        if (result.ok) {
-            const missingProviders = providerPreloadMissingTargets(result, providers);
-            if (missingProviders.length > 0) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    component: "daemon",
-                    event: "daemon.provider_preload_unavailable",
-                    message: "provider credential preload returned an incomplete selected provider cache",
-                    meta: {
-                        agent,
-                        reason: "missing",
-                        error: `missing selected providers: ${missingProviders.join(", ")}`,
-                    },
-                });
-                return;
-            }
-            const records = Object.values(result.pool.providers).filter((record) => !!record);
-            (0, provider_credentials_1.cacheProviderCredentialRecords)(agent, records, new Date(result.pool.updatedAt));
-            return;
+async function prepareProviderRuntime() {
+    const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+    const readiness = await Promise.all(managedAgents.map(async (agent) => {
+        try {
+            const result = await (0, agent_config_check_1.checkAgentConfigWithProviderHealth)(agent, bundlesRoot);
+            if (result.ok)
+                return null;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.provider_readiness_unavailable",
+                message: "fresh provider readiness was unavailable before daemon startup",
+                meta: { agent },
+            });
+            return result.issue ?? {
+                summary: `${agent}: provider runtime unavailable`,
+                actions: [{ actor: "agent-runnable", command: "ouro doctor" }],
+            };
+        }
+        catch {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.provider_readiness_unavailable",
+                message: "fresh provider readiness check failed before daemon startup",
+                meta: { agent },
+            });
+            throw new Error("provider runtime preparation failed");
         }
-        (0, runtime_1.emitNervesEvent)({
-            level: "warn",
-            component: "daemon",
-            event: "daemon.provider_preload_unavailable",
-            message: "provider credential preload could not refresh selected provider cache",
-            meta: {
-                agent,
-                reason: result.reason,
-                error: result.error,
-            },
-        });
     }));
-}
-function startProviderCredentialPoolPreload() {
-    return preloadProviderCredentialPools().catch((error) => {
-        (0, runtime_1.emitNervesEvent)({
-            level: "error",
-            component: "daemon",
-            event: "daemon.provider_preload_error",
-            message: "provider credential preload failed after daemon startup",
-            meta: { error: error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error provider preload failures @preserve */ String(error) },
-        });
-    });
+    const failures = readiness.filter((entry) => entry !== null);
+    if (failures.length > 0) {
+        throw (0, daemon_bootstrap_startup_1.createProviderReadinessPreparationFailure)(failures);
+    }
 }
 function scheduleStartupSentinelAfterProviderPreload(agent, preload) {
     void preload.then(async () => {
@@ -693,6 +655,7 @@ function scheduleStartupSentinelAfterProviderPreload(agent, preload) {
 /* v8 ignore start -- habit wiring: lambdas delegate to processManager/fs; tested via HabitScheduler unit tests @preserve */
 void (0, daemon_bootstrap_startup_1.startDaemonAfterContainerCredentialBootstrap)({
     loadBootstrap: () => (0, container_credential_bootstrap_1.loadContainerCredentialBootstrap)(managedAgents),
+    prepareDaemon: prepareProviderRuntime,
     startDaemon: () => daemon.start(),
     markStartupFailure: () => { _tombstoneWritten = true; },
     exit: (code) => process.exit(code),
@@ -700,7 +663,7 @@ void (0, daemon_bootstrap_startup_1.startDaemonAfterContainerCredentialBootstrap
     if (!started)
         return;
     supercronicSupervisor?.start();
-    const providerPreload = startProviderCredentialPoolPreload();
+    const providerPreload = Promise.resolve();
     const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
     const ouroPath = supercronicSupervisor
         ? "/usr/local/bin/node /opt/ouro/dist/heart/daemon/ouro-entry.js"

package/dist/heart/daemon/daemon.js

@@ -618,6 +618,7 @@ class OuroDaemon {
     senseAutostartTimer = null;
     externalEventReconcileTimer = null;
     externalEventReconcileRunning = false;
+    constructedAtMs = Date.now();
     mailboxServerFactory;
     privateRuntimePolicyDeps;
     onStopCommandComplete;
@@ -1503,7 +1504,7 @@ class OuroDaemon {
         }
         return { type: "message", privateTurnDecision: decision, ...(externalEvent ? { externalEvent } : {}) };
     }
-    queueExternalEventForPrivateRuntime(record) {
+    queueExternalEventForPrivateRuntime(record, quiet = false) {
         const pendingDir = path.join(this.bundlesRoot, `${record.agent}.ouro`, "state", "pending", pending_1.PRIVATE_RUNTIME_PENDING.friendId, pending_1.PRIVATE_RUNTIME_PENDING.channel, pending_1.PRIVATE_RUNTIME_PENDING.key);
         const originKey = `${record.source}:${record.eventId}`;
         const parsedReceivedAt = Date.parse(record.receivedAt);
@@ -1523,18 +1524,20 @@ class OuroDaemon {
             mode: "relay",
             packetId: `external-event:${record.agent}:${record.source}:${record.eventId}:generation:${record.generation}:attempt:${record.attemptCount}`,
         });
-        (0, runtime_1.emitNervesEvent)({
-            component: "daemon",
-            event: "daemon.external_event_private_runtime_queued",
-            message: "queued external event for private-runtime attention",
-            meta: {
-                agent: record.agent,
-                source: record.source,
-                eventType: record.eventType,
-                eventId: record.eventId,
-                pendingDir,
-            },
-        });
+        if (!quiet) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "daemon",
+                event: "daemon.external_event_private_runtime_queued",
+                message: "queued external event for private-runtime attention",
+                meta: {
+                    agent: record.agent,
+                    source: record.source,
+                    eventType: record.eventType,
+                    eventId: record.eventId,
+                    pendingDir,
+                },
+            });
+        }
     }
     externalEventRootPath() {
         return this.externalEventRoot ?? (0, router_1.getExternalEventRoot)();
@@ -1575,8 +1578,19 @@ class OuroDaemon {
                 source: primary.source,
                 eventType: primary.eventType,
                 eventId: primary.eventId,
-            }, receipt.id, primary.generation, primary.attemptCount), () => { for (const record of claimed)
-                this.queueExternalEventForPrivateRuntime(record); }, lease);
+            }, receipt.id, primary.generation, primary.attemptCount), () => {
+                const batched = claimed.length > 1;
+                for (const record of claimed)
+                    this.queueExternalEventForPrivateRuntime(record, batched);
+                if (batched) {
+                    (0, runtime_1.emitNervesEvent)({
+                        component: "daemon",
+                        event: "daemon.external_event_private_runtime_batch_queued",
+                        message: "queued an external-event batch for private-runtime attention",
+                        meta: { agent: primary.agent, source: primary.source, eventCount: claimed.length },
+                    });
+                }
+            }, lease);
             failureClass = wake.denialCode === "managed_runtime_unavailable"
                 ? "managed_runtime_unavailable"
                 : wake.data?.decision?.denialCode === "provider_lane_unavailable"
@@ -1616,6 +1630,9 @@ class OuroDaemon {
             }
             const statuses = (0, router_1.listExternalEventStatus)(this.externalEventRootPath());
             const dueRecords = [];
+            const providerEvidenceByAgent = new Map();
+            const runtimeEvidenceByAgent = new Map();
+            const recoveredByClass = new Map();
             for (const status of statuses) {
                 if (status.corrupt)
                     continue;
@@ -1629,15 +1646,35 @@ class OuroDaemon {
                     let evidence = null;
                     try {
                         if (failure.class === "provider_lane_unavailable") {
-                            const binding = (0, provider_binding_resolver_1.resolveEffectiveProviderBinding)({
-                                agentName: record.agent,
-                                agentRoot: path.join(this.bundlesRoot, `${record.agent}.ouro`),
-                                lane: "inner",
-                            });
-                            if (binding.ok && binding.binding.credential.status === "present"
-                                && binding.binding.readiness.status === "ready" && binding.binding.readiness.checkedAt
-                                && Date.parse(binding.binding.readiness.checkedAt) > Date.parse(failure.failedAt)) {
-                                evidence = { class: failure.class, observedAt: binding.binding.readiness.checkedAt };
+                            if (!providerEvidenceByAgent.has(record.agent)) {
+                                providerEvidenceByAgent.set(record.agent, null);
+                                const binding = (0, provider_binding_resolver_1.resolveEffectiveProviderBinding)({
+                                    agentName: record.agent,
+                                    agentRoot: path.join(this.bundlesRoot, `${record.agent}.ouro`),
+                                    lane: "inner",
+                                });
+                                providerEvidenceByAgent.set(record.agent, binding.ok && binding.binding.credential.status === "present"
+                                    && binding.binding.readiness.status === "ready" && binding.binding.readiness.checkedAt
+                                    ? { observedAt: binding.binding.readiness.checkedAt }
+                                    : null);
+                            }
+                            const current = providerEvidenceByAgent.get(record.agent);
+                            const readinessIsCurrentBoot = current && Date.parse(current.observedAt) >= this.constructedAtMs;
+                            if (current && ((0, router_1.isExactLegacyProviderRecoveryFailure)(record)
+                                ? readinessIsCurrentBoot
+                                : Date.parse(current.observedAt) > Date.parse(failure.failedAt))) {
+                                evidence = { class: failure.class, observedAt: current.observedAt };
+                            }
+                        }
+                        else if (failure.class === "execution_lease_expired") {
+                            if (!runtimeEvidenceByAgent.has(record.agent)) {
+                                const snapshot = this.processManager.listAgentSnapshots().find((candidate) => candidate.name === record.agent && candidate.channel === "private-runtime"
+                                    && candidate.status === "running" && candidate.pid !== null && candidate.startedAt !== null);
+                                runtimeEvidenceByAgent.set(record.agent, snapshot?.startedAt ? { observedAt: snapshot.startedAt } : null);
+                            }
+                            const current = runtimeEvidenceByAgent.get(record.agent);
+                            if (current && Date.parse(current.observedAt) > Date.parse(failure.failedAt)) {
+                                evidence = { class: failure.class, observedAt: current.observedAt };
                             }
                         }
                         else if (this.hasManagedPrivateRuntime(record.agent) && Date.parse(now) > Date.parse(failure.failedAt)) {
@@ -1645,8 +1682,9 @@ class OuroDaemon {
                         }
                         if (!evidence)
                             continue;
-                        const revival = (0, router_1.reviveExternalEventAfterRecovery)(record.recordPath, { expectedVersion: record.version, expectedGeneration: record.generation, evidence, now: () => now });
+                        const revival = (0, router_1.reviveExternalEventAfterRecovery)(record.recordPath, { expectedVersion: record.version, expectedGeneration: record.generation, evidence, now: () => now, quiet: true });
                         record = revival.record;
+                        recoveredByClass.set(failure.class, (recoveredByClass.get(failure.class) ?? 0) + 1);
                     }
                     catch (error) {
                         (0, runtime_1.emitNervesEvent)({
@@ -1668,6 +1706,14 @@ class OuroDaemon {
                 if (due)
                     dueRecords.push(record);
             }
+            if (recoveredByClass.size > 0) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "daemon",
+                    event: "daemon.external_event_recovery_batch",
+                    message: "requeued external events after cached infrastructure recovery evidence",
+                    meta: { recovered: Object.fromEntries(recoveredByClass) },
+                });
+            }
             const batches = new Map();
             for (const record of dueRecords) {
                 const key = `${record.agent}\0${record.source}`;
@@ -1968,6 +2014,26 @@ class OuroDaemon {
                     data: dispatched,
                 };
             }
+            case "external.event.repair": {
+                if (this.externalEventReconcileRunning)
+                    return { ok: false, error: "external event reconciliation is already active; repair made no changes" };
+                this.externalEventReconcileRunning = true;
+                try {
+                    try {
+                        const result = (0, router_1.repairExternalEventsFromManifest)(command.manifestPath, { root: this.externalEventRootPath() });
+                        return { ok: result.failed.length === 0, message: `external event repair applied=${result.applied.length} alreadyApplied=${result.alreadyApplied.length} failed=${result.failed.length} pending=${result.pending.length}`, data: result };
+                    }
+                    catch (error) {
+                        const message = (error instanceof Error ? error.message : /* v8 ignore next -- defensive: repair parser and filesystem dependencies throw Error instances @preserve */ String(error)).slice(0, 1_000);
+                        const result = { applied: [], alreadyApplied: [], failed: [{ identity: "<manifest>", error: message }], pending: [] };
+                        (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.external_event_repair", message: "rejected external event repair manifest", meta: { applied: 0, alreadyApplied: 0, failed: 1, pending: 0 } });
+                        return { ok: false, error: `external event repair rejected: ${message}`, data: result };
+                    }
+                }
+                finally {
+                    this.externalEventReconcileRunning = false;
+                }
+            }
             case "private.decisions": {
                 const requestedLimit = Number.isInteger(command.limit) && command.limit && command.limit > 0 ? command.limit : 20;
                 const limit = Math.min(requestedLimit, 1000);

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -255,6 +255,7 @@ function createSanctuaryAcceptanceAdapterDependencies(secretFd = 3, options = {}
         interactiveRuntime: executeSanctuaryInteractiveRuntimeOperation,
         hostRequest: options.hostRequest ?? ((payload) => defaultHostRequest(payload, hostBrokerSocket, adapterTimeoutMs)),
         telegramCredentials: () => (0, telegram_1.loadTelegramSenseCredentials)(TARGET_ID),
+        createTelegramApi: telegram_client_1.createTelegramBotApi,
         readLiveGrounding: readIndependentSanctuaryGrounding,
         runProductionBoundaryProbe: runSanctuaryProductionBoundaryProbe,
     };
@@ -1827,12 +1828,6 @@ function exactKeys(value, keys, label) {
     if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify([...keys].sort()))
         throw new Error(`${label} shape is invalid`);
 }
-function positiveDecimal(value, label) {
-    const result = text(value, label);
-    if (!/^[1-9][0-9]*$/u.test(result))
-        throw new Error(`${label} is invalid`);
-    return result;
-}
 function sha256(value) {
     return (0, node_crypto_1.createHash)("sha256").update(value, "utf8").digest("hex");
 }
@@ -1845,18 +1840,6 @@ async function runtimeConfig(reader, label, ...args) {
         throw new Error(`${label} is unavailable`);
     return result.config;
 }
-async function storeTelegramBootstrap(payload, deps) {
-    const patch = {
-        telegramBotToken: text(payload.botToken, "Telegram bot credential"),
-        telegramAuthorizedUserId: positiveDecimal(payload.authorizedUserId, "Telegram authorized user"),
-        telegramAuthorizedChatId: positiveDecimal(payload.authorizedChatId, "Telegram authorized chat"),
-    };
-    const stored = await dependency(deps.mergeRuntime, "runtime vault writer")(TARGET_ID, patch);
-    if (!stored.ok || Object.entries(patch).some(([key, value]) => stored.config[key] !== value)) {
-        throw new Error("Telegram bootstrap vault readback failed");
-    }
-    return { stored: true };
-}
 function cursorSnapshot(payload, deps) {
     exactKeys(payload, ["allowGenesis", "operation", "schema"], "Telegram cursor snapshot request");
     if (payload.schema !== "telegram-cursor-v1" || typeof payload.allowGenesis !== "boolean")
@@ -2306,6 +2289,54 @@ function materializeConfig(payload, deps) {
     }
     return config;
 }
+async function telegramReadiness(payload, deps) {
+    exactKeys(payload, ["operation"], "Telegram readiness payload");
+    let refreshed;
+    try {
+        refreshed = await dependency(deps.refreshRuntime, "runtime credential refresher")(TARGET_ID);
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    }
+    if (!refreshed.ok)
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    let credentials;
+    try {
+        credentials = dependency(deps.telegramCredentials, "Telegram credentials")();
+        (0, telegram_1.telegramBotIdFromToken)(credentials.botToken);
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are invalid; actor: human-required; repair vault runtime/config");
+    }
+    let api;
+    try {
+        api = dependency(deps.createTelegramApi, "Telegram API factory")({ token: credentials.botToken });
+    }
+    catch {
+        throw new Error("Telegram client initialization failed; actor: agent-runnable; retry Telegram readiness");
+    }
+    let bot;
+    try {
+        bot = await api.request("getMe", {}, AbortSignal.timeout(30_000));
+    }
+    catch {
+        throw new Error("Telegram getMe failed; actor: agent-runnable; retry Telegram readiness");
+    }
+    finally {
+        try {
+            api.stop();
+        }
+        catch {
+            throw new Error("Telegram client cleanup failed; actor: agent-runnable; retry Telegram readiness");
+        }
+    }
+    if (!bot || typeof bot !== "object" || Array.isArray(bot)
+        || String(bot.id) !== "8541786263"
+        || bot.username !== "MendelowCloudButlerBot") {
+        throw new Error("Telegram bot identity mismatch; actor: human-required; repair vault runtime/config");
+    }
+    return { ready: true, identityMatches: true };
+}
 async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctuaryAcceptanceAdapterDependencies()) {
     const payload = object(rawPayload, "acceptance adapter payload");
     const operation = text(payload.operation, "operation");
@@ -2325,9 +2356,6 @@ async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctu
             case "revoked-key-auth-rejection":
                 result = await revokedKeyAuthRejection(payload, deps);
                 break;
-            case "store_telegram_bootstrap":
-                result = await storeTelegramBootstrap(payload, deps);
-                break;
             case "quiesce_telegram_poller":
                 result = telegramPollerQuiescence(payload, deps);
                 break;
@@ -2410,6 +2438,9 @@ async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctu
             case "materialize_config":
                 result = materializeConfig(payload, deps);
                 break;
+            case "telegram_readiness":
+                result = await telegramReadiness(payload, deps);
+                break;
             default: throw new Error("unknown Sanctuary acceptance adapter operation");
         }
         (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_adapter_end", message: "Sanctuary acceptance adapter completed", meta: { operation } });

package/dist/heart/daemon/sanctuary-acceptance-harness.js

@@ -45,6 +45,8 @@ const node_fs_1 = require("node:fs");
 const node_fs_2 = require("node:fs");
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../../nerves/runtime");
+const telegram_1 = require("../../senses/telegram");
+const runtime_credentials_1 = require("../runtime-credentials");
 const MAX_ADAPTER_OUTPUT = 1_048_576;
 const DEFAULT_ADAPTER_TIMEOUT_MS = 240_000;
 const DEFAULT_TELEGRAM_TIMEOUT_MS = 10_000;
@@ -59,6 +61,9 @@ function createSanctuaryAcceptanceHarnessDependencies(secretFd = 3, options = {}
     const telegramTimeoutMs = options.telegramTimeoutMs ?? DEFAULT_TELEGRAM_TIMEOUT_MS;
     return {
         readSecret: () => (0, node_fs_1.readFileSync)(secretFd, "utf8"),
+        refreshRuntime: runtime_credentials_1.refreshRuntimeCredentialConfig,
+        mergeRuntime: runtime_credentials_1.mergeRuntimeCredentialConfig,
+        telegramCredentials: telegram_1.loadTelegramSenseCredentials,
         runAdapter: async (executable, payload, remainingMs) => {
             requireAbsoluteExecutable(executable);
             const result = (0, node_child_process_1.spawnSync)(executable, [], {
@@ -92,6 +97,25 @@ function createSanctuaryAcceptanceHarnessDependencies(secretFd = 3, options = {}
         telegramTimeoutMs,
     };
 }
+async function canonicalTelegramBootstrapToken(deps) {
+    let refreshed;
+    try {
+        refreshed = await deps.refreshRuntime("sanctuary");
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    }
+    if (!refreshed.ok)
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    try {
+        const token = deps.telegramCredentials("sanctuary").botToken.trim();
+        (0, telegram_1.telegramBotIdFromToken)(token);
+        return token;
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are invalid; actor: human-required; repair vault runtime/config");
+    }
+}
 function object(value, label) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error(`${label} must be an object`);
@@ -322,6 +346,10 @@ async function telegramRequest(deps, token, method, body, requestTimeoutMs = dep
         throw new Error("Telegram request failed");
     return envelope.result;
 }
+function telegramBootstrapRequestError(method, error) {
+    const outcome = error instanceof Error && /timed out/iu.test(error.message) ? "timed out" : "failed";
+    return new Error(`Telegram ${method} ${outcome}; actor: agent-runnable; retry Telegram bootstrap`);
+}
 exports.SANCTUARY_UNIT_16_EVIDENCE_LABELS = [
     "unit-12c-1-opaque-identity",
     "unit-14b-3-opaque-identity-live",
@@ -871,10 +899,8 @@ async function telegramBootstrap(config, deps) {
     const noncePath = confinedPath(root, config.noncePath, "noncePath");
     refuseExistingCheckpoint(root, noncePath);
     const pollerAdapter = adapter(config.pollerAdapter, "pollerAdapter");
-    const vaultAdapter = adapter(config.vaultAdapter, "vaultAdapter");
-    if (pollerAdapter !== PACKAGED_PROVENANCE_ADAPTER || vaultAdapter !== PACKAGED_PROVENANCE_ADAPTER) {
+    if (pollerAdapter !== PACKAGED_PROVENANCE_ADAPTER)
         throw new Error("Telegram bootstrap requires the fixed packaged acceptance adapter");
-    }
     const deadlineMs = integer(config.deadlineMs, "deadlineMs", 300_000);
     if (deadlineMs > 900_000)
         throw new Error("Telegram bootstrap deadline exceeds 15 minutes");
@@ -882,11 +908,17 @@ async function telegramBootstrap(config, deps) {
     if (pollTimeoutSeconds > 50)
         throw new Error("Telegram poll timeout exceeds 50 seconds");
     const token = deps.readSecret().trim();
-    if (!token)
-        throw new Error("Telegram token descriptor is empty");
-    const bot = object(await telegramRequest(deps, token, "getMe"), "Telegram getMe result");
-    if (String(bot.id) !== expectedBotId || bot.username !== expectedUsername)
-        throw new Error("Telegram bot identity mismatch");
+    let getMe;
+    try {
+        getMe = await telegramRequest(deps, token, "getMe");
+    }
+    catch (error) {
+        throw telegramBootstrapRequestError("getMe", error);
+    }
+    const bot = object(getMe, "Telegram getMe result");
+    if (String(bot.id) !== expectedBotId || bot.username !== expectedUsername) {
+        throw new Error("Telegram bot identity mismatch; actor: human-required; repair vault runtime/config");
+    }
     const nonce = deps.randomBytes(16).toString("hex");
     const base = {
         schemaVersion: 1,
@@ -909,11 +941,17 @@ async function telegramBootstrap(config, deps) {
         let nextOffset = currentOffset;
         let match;
         while (deps.now() < deadline && !match) {
-            const updates = await telegramRequest(deps, token, "getUpdates", {
-                offset: nextOffset,
-                timeout: pollTimeoutSeconds,
-                allowed_updates: ["message"],
-            }, (pollTimeoutSeconds + 5) * 1_000);
+            let updates;
+            try {
+                updates = await telegramRequest(deps, token, "getUpdates", {
+                    offset: nextOffset,
+                    timeout: pollTimeoutSeconds,
+                    allowed_updates: ["message"],
+                }, (pollTimeoutSeconds + 5) * 1_000);
+            }
+            catch (error) {
+                throw telegramBootstrapRequestError("getUpdates", error);
+            }
             if (!Array.isArray(updates))
                 throw new Error("Telegram getUpdates result must be an array");
             const parsed = updates.map((entry) => object(entry, "Telegram update"));
@@ -952,14 +990,20 @@ async function telegramBootstrap(config, deps) {
             offsetDigest: digest(nextUpdateId),
         };
         replaceCheckpoint(root, evidencePath, confirmed);
-        const stored = object(await deps.runAdapter(vaultAdapter, {
-            operation: "store_telegram_bootstrap",
-            botToken: token,
-            authorizedUserId: userId,
-            authorizedChatId: chatId,
-        }), "vault adapter result");
-        if (stored.stored !== true)
-            throw new Error("Telegram vault adapter did not attest storage");
+        let stored;
+        try {
+            stored = await deps.mergeRuntime("sanctuary", {
+                telegramAuthorizedUserId: userId,
+                telegramAuthorizedChatId: chatId,
+            });
+        }
+        catch {
+            throw new Error("Telegram bootstrap vault update failed; actor: agent-runnable; retry Telegram bootstrap");
+        }
+        if (!stored.ok || stored.config.telegramBotToken !== token
+            || stored.config.telegramAuthorizedUserId !== userId || stored.config.telegramAuthorizedChatId !== chatId) {
+            throw new Error("Telegram bootstrap vault readback failed; actor: agent-runnable; retry Telegram bootstrap");
+        }
         replaceCheckpoint(root, evidencePath, { ...confirmed, phase: "vault_committed" });
         atomicPrivateJson(root, offsetPath, { nextUpdateId });
         replaceCheckpoint(root, evidencePath, { ...confirmed, phase: "complete", completedAt: deps.now() });
@@ -1779,9 +1823,11 @@ async function executeSanctuaryAcceptanceHarness(command, rawConfig, deps = crea
     try {
         const config = object(rawConfig, "acceptance config");
         switch (command) {
-            case "telegram-bootstrap":
-                await telegramBootstrap(config, deps);
+            case "telegram-bootstrap": {
+                const token = await canonicalTelegramBootstrapToken(deps);
+                await telegramBootstrap(config, { ...deps, readSecret: () => token });
                 break;
+            }
             case "cursor-snapshot":
                 await cursorSnapshot(config, deps);
                 break;

package/dist/heart/daemon/startup-tui.js

@@ -15,6 +15,7 @@ exports.assessStability = assessStability;
 exports.renderStartupProgress = renderStartupProgress;
 exports.renderWaitingForDaemon = renderWaitingForDaemon;
 exports.pollDaemonStartup = pollDaemonStartup;
+exports.defaultIsProcessAlive = defaultIsProcessAlive;
 const cli_render_1 = require("./cli-render");
 const runtime_1 = require("../../nerves/runtime");
 const terminal_ui_1 = require("./terminal-ui");