@ouro.bot/cli 0.1.0-alpha.78 → 0.1.0-alpha.781

package/dist/heart/daemon/sanctuary-bundle-migration.js

@@ -0,0 +1,398 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_BUNDLE_ROLLBACK_FILE = exports.SANCTUARY_PACKAGE_MANAGED_FILES = void 0;
+exports.inspectSanctuaryPackageManagedBundleRollback = inspectSanctuaryPackageManagedBundleRollback;
+exports.rollbackSanctuaryPackageManagedBundle = rollbackSanctuaryPackageManagedBundle;
+exports.commitSanctuaryPackageManagedBundle = commitSanctuaryPackageManagedBundle;
+exports.migrateSanctuaryPackageManagedBundle = migrateSanctuaryPackageManagedBundle;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../../nerves/runtime");
+const steward_policy_1 = require("../steward-policy");
+exports.SANCTUARY_PACKAGE_MANAGED_FILES = [
+    "provider-readiness.json",
+    "tool-profiles.json",
+    "habits/sanctuary-health.md",
+    "psyche/ASPIRATIONS.md",
+    "psyche/IDENTITY.md",
+    "psyche/LORE.md",
+    "psyche/SOUL.md",
+    "psyche/TACIT.md",
+];
+exports.SANCTUARY_BUNDLE_ROLLBACK_FILE = ".sanctuary-package-managed-rollback.json";
+const SANCTUARY_BUNDLE_COMMITTING_FILE = `${exports.SANCTUARY_BUNDLE_ROLLBACK_FILE}.committing`;
+const BUNDLE_META_VERSION_FIELDS = ["runtimeVersion", "bundleSchemaVersion", "lastUpdated"];
+function readObject(filePath) {
+    const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${path.basename(filePath)} must contain an object`);
+    return value;
+}
+function requirePlainFile(filePath, label) {
+    let stat;
+    try {
+        stat = fs.lstatSync(filePath);
+    }
+    catch {
+        throw new Error(`${label} is missing`);
+    }
+    if (stat.isSymbolicLink())
+        throw new Error(`${label} must not be a symlink`);
+    if (!stat.isFile())
+        throw new Error(`${label} must be a regular file`);
+}
+function ensureSafeParent(agentRoot, relative) {
+    let current = agentRoot;
+    for (const segment of path.dirname(relative).split(path.sep).filter((value) => value !== ".")) {
+        current = path.join(current, segment);
+        if (!fs.existsSync(current))
+            fs.mkdirSync(current, { mode: 0o700 });
+    }
+}
+function validateDestination(agentRoot, relative) {
+    let current = agentRoot;
+    for (const segment of relative.split(path.sep)) {
+        current = path.join(current, segment);
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch {
+            return;
+        }
+        if (stat.isSymbolicLink())
+            throw new Error(`package-managed destination must not be a symlink: ${relative}`);
+        if (current !== path.join(agentRoot, relative) && !stat.isDirectory())
+            throw new Error(`package-managed destination parent must be a directory: ${relative}`);
+        if (current === path.join(agentRoot, relative) && !stat.isFile())
+            throw new Error(`package-managed destination must be a regular file: ${relative}`);
+    }
+}
+function writeAtomic(filePath, content) {
+    const stagingDirectory = fs.mkdtempSync(`${filePath}.package-migration.`);
+    const temporary = path.join(stagingDirectory, "value");
+    try {
+        const fd = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(fd, content);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(temporary, filePath);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+        fs.rmdirSync(stagingDirectory);
+    }
+    fs.chmodSync(filePath, 0o600);
+    const directory = fs.openSync(path.dirname(filePath), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        fs.fsyncSync(directory);
+    }
+    finally {
+        fs.closeSync(directory);
+    }
+}
+function cleanupInterruptedWrites(filePath) {
+    const parent = path.dirname(filePath);
+    const prefix = `${path.basename(filePath)}.package-migration.`;
+    if (!fs.existsSync(parent))
+        return;
+    for (const name of fs.readdirSync(parent)) {
+        if (!name.startsWith(prefix))
+            continue;
+        const stagingDirectory = path.join(parent, name);
+        const stagingStat = fs.lstatSync(stagingDirectory);
+        if (stagingStat.isSymbolicLink() || !stagingStat.isDirectory())
+            throw new Error(`interrupted package migration stage is invalid: ${name}`);
+        const entries = fs.readdirSync(stagingDirectory);
+        if (entries.some((entry) => entry !== "value"))
+            throw new Error(`interrupted package migration stage contains unexpected entries: ${name}`);
+        const temporary = path.join(stagingDirectory, "value");
+        if (fs.existsSync(temporary)) {
+            const temporaryStat = fs.lstatSync(temporary);
+            if (temporaryStat.isSymbolicLink() || !temporaryStat.isFile())
+                throw new Error(`interrupted package migration value is invalid: ${name}`);
+            fs.unlinkSync(temporary);
+        }
+        fs.rmdirSync(stagingDirectory);
+    }
+}
+const SNAPSHOT_RELATIVES = [...exports.SANCTUARY_PACKAGE_MANAGED_FILES, "bundle-meta.json"];
+function snapshotDirectoryRelatives() {
+    const directories = new Set();
+    for (const relative of SNAPSHOT_RELATIVES) {
+        let directory = path.dirname(relative);
+        while (directory !== ".") {
+            directories.add(directory);
+            directory = path.dirname(directory);
+        }
+    }
+    return [...directories].sort((left, right) => left.length - right.length);
+}
+function captureMigrationSnapshot(agentRoot) {
+    const files = SNAPSHOT_RELATIVES.map((relative) => {
+        const filePath = path.join(agentRoot, relative);
+        if (!fs.existsSync(filePath))
+            return { path: filePath, content: null, mode: null };
+        const stat = fs.lstatSync(filePath);
+        return { path: filePath, content: fs.readFileSync(filePath), mode: stat.mode & 0o777 };
+    });
+    const directories = snapshotDirectoryRelatives().map((relative) => {
+        const directory = path.join(agentRoot, relative);
+        if (!fs.existsSync(directory))
+            return { path: directory, mode: null };
+        const stat = fs.lstatSync(directory);
+        return { path: directory, mode: stat.mode & 0o777 };
+    });
+    return { files, directories };
+}
+function rollbackPath(agentRoot) {
+    return path.join(agentRoot, exports.SANCTUARY_BUNDLE_ROLLBACK_FILE);
+}
+function durableSnapshot(agentRoot, snapshot, rollbackImageId, targetImageId) {
+    const payload = {
+        schemaVersion: 1,
+        rollbackImageId,
+        targetImageId,
+        files: snapshot.files.map((file) => ({ relative: path.relative(agentRoot, file.path), contentBase64: file.content?.toString("base64") ?? null, mode: file.mode })),
+        directories: snapshot.directories.map((directory) => ({ relative: path.relative(agentRoot, directory.path), mode: directory.mode })),
+    };
+    return { ...payload, snapshotDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(payload)).digest("hex") };
+}
+function readDurableRecord(agentRoot) {
+    const candidates = [rollbackPath(agentRoot), path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE)].filter((candidate) => fs.existsSync(candidate));
+    if (candidates.length === 0)
+        return null;
+    if (candidates.length !== 1)
+        throw new Error("Sanctuary bundle rollback record state is ambiguous");
+    const [filePath] = candidates;
+    const stat = fs.lstatSync(filePath);
+    if (stat.isSymbolicLink())
+        throw new Error("Sanctuary bundle rollback record must not be a symlink");
+    if (!stat.isFile() || (stat.mode & 0o777) !== 0o600)
+        throw new Error("Sanctuary bundle rollback record must be a mode-0600 regular file");
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    }
+    catch {
+        throw new Error("Sanctuary bundle rollback record is invalid JSON");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Sanctuary bundle rollback record is invalid");
+    const record = value;
+    if (record.schemaVersion !== 1 || typeof record.rollbackImageId !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(record.rollbackImageId) || typeof record.targetImageId !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(record.targetImageId) || record.targetImageId === record.rollbackImageId || typeof record.snapshotDigest !== "string" || !/^[0-9a-f]{64}$/u.test(record.snapshotDigest) || !Array.isArray(record.files) || !Array.isArray(record.directories))
+        throw new Error("Sanctuary bundle rollback record is invalid");
+    const fileRelatives = record.files.map((file) => file?.relative);
+    const directoryRelatives = record.directories.map((directory) => directory?.relative);
+    const expectedDirectories = snapshotDirectoryRelatives();
+    if (JSON.stringify(fileRelatives) !== JSON.stringify(SNAPSHOT_RELATIVES) || JSON.stringify(directoryRelatives) !== JSON.stringify(expectedDirectories))
+        throw new Error("Sanctuary bundle rollback record paths are invalid");
+    for (const relative of SNAPSHOT_RELATIVES)
+        validateDestination(agentRoot, relative);
+    const validMode = (mode) => mode === null || (Number.isInteger(mode) && mode >= 0 && mode <= 0o777);
+    const files = record.files.map((file) => {
+        if (!file || typeof file.relative !== "string" || !validMode(file.mode) || (file.contentBase64 !== null && typeof file.contentBase64 !== "string") || (file.contentBase64 === null) !== (file.mode === null))
+            throw new Error("Sanctuary bundle rollback record file is invalid");
+        const content = file.contentBase64 === null ? null : Buffer.from(file.contentBase64, "base64");
+        if (file.contentBase64 !== null && (!content || content.toString("base64") !== file.contentBase64))
+            throw new Error("Sanctuary bundle rollback record content is invalid");
+        return { path: path.join(agentRoot, file.relative), content, mode: file.mode };
+    });
+    const directories = record.directories.map((directory) => {
+        if (!directory || typeof directory.relative !== "string" || !validMode(directory.mode))
+            throw new Error("Sanctuary bundle rollback record directory is invalid");
+        return { path: path.join(agentRoot, directory.relative), mode: directory.mode };
+    });
+    const payload = { schemaVersion: record.schemaVersion, rollbackImageId: record.rollbackImageId, targetImageId: record.targetImageId, files: record.files, directories: record.directories };
+    if ((0, node_crypto_1.createHash)("sha256").update(JSON.stringify(payload)).digest("hex") !== record.snapshotDigest)
+        throw new Error("Sanctuary bundle rollback record digest is invalid");
+    return { snapshot: { files, directories }, rollbackImageId: record.rollbackImageId, targetImageId: record.targetImageId, filePath, state: filePath === rollbackPath(agentRoot) ? "rollback" : "committing" };
+}
+function removeRollbackRecord(agentRoot, filePath) {
+    fs.unlinkSync(filePath);
+    const root = fs.openSync(agentRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        fs.fsyncSync(root);
+    }
+    finally {
+        fs.closeSync(root);
+    }
+}
+function validateAgentRoot(agentRoot) {
+    if (!path.isAbsolute(agentRoot))
+        throw new Error("agent root must be an absolute path");
+    const stat = fs.lstatSync(agentRoot);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error("agent root must be a real directory");
+}
+function inspectSanctuaryPackageManagedBundleRollback(agentRoot) {
+    validateAgentRoot(agentRoot);
+    const record = readDurableRecord(agentRoot);
+    return record ? { rollbackImageId: record.rollbackImageId, targetImageId: record.targetImageId, state: record.state } : null;
+}
+function rollbackSanctuaryPackageManagedBundle(agentRoot, options = {}) {
+    validateAgentRoot(agentRoot);
+    const record = readDurableRecord(agentRoot);
+    if (!record)
+        return false;
+    if (record.state === "committing")
+        throw new Error("Sanctuary bundle commit is pending and cannot be rolled back");
+    restoreMigrationSnapshot(record.snapshot);
+    if (!options.retainRecord)
+        removeRollbackRecord(agentRoot, record.filePath);
+    return true;
+}
+function commitSanctuaryPackageManagedBundle(agentRoot) {
+    validateAgentRoot(agentRoot);
+    const record = readDurableRecord(agentRoot);
+    if (!record)
+        return false;
+    const committingPath = path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE);
+    if (record.filePath !== committingPath) {
+        fs.renameSync(record.filePath, committingPath);
+        const root = fs.openSync(agentRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+        try {
+            fs.fsyncSync(root);
+        }
+        finally {
+            fs.closeSync(root);
+        }
+    }
+    removeRollbackRecord(agentRoot, committingPath);
+    return true;
+}
+function restoreMigrationSnapshot(snapshot) {
+    for (const file of snapshot.files) {
+        cleanupInterruptedWrites(file.path);
+        if (file.content === null) {
+            fs.rmSync(file.path, { force: true });
+        }
+        else {
+            writeAtomic(file.path, file.content);
+            fs.chmodSync(file.path, file.mode);
+        }
+    }
+    for (const directory of [...snapshot.directories].reverse()) {
+        if (directory.mode === null) {
+            if (!fs.existsSync(directory.path))
+                continue;
+            if (fs.readdirSync(directory.path).length === 0)
+                fs.rmdirSync(directory.path);
+        }
+        else {
+            fs.chmodSync(directory.path, directory.mode);
+        }
+    }
+}
+function migrateSanctuaryPackageManagedBundle(input) {
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_start", message: "starting Sanctuary package-managed bundle migration", meta: { agentRoot: input.agentRoot } });
+    let snapshot = null;
+    try {
+        if (!path.isAbsolute(input.packageRoot) || !path.isAbsolute(input.agentRoot) || input.packageRoot === input.agentRoot)
+            throw new Error("package and agent roots must be distinct absolute paths");
+        const packageStat = fs.lstatSync(input.packageRoot);
+        const agentStat = fs.lstatSync(input.agentRoot);
+        if (packageStat.isSymbolicLink() || !packageStat.isDirectory())
+            throw new Error("package root must be a real directory");
+        if (agentStat.isSymbolicLink() || !agentStat.isDirectory())
+            throw new Error("agent root must be a real directory");
+        if (input.retainRollback && (!input.rollbackImageId || !/^sha256:[0-9a-f]{64}$/u.test(input.rollbackImageId) || !input.targetImageId || !/^sha256:[0-9a-f]{64}$/u.test(input.targetImageId) || input.targetImageId === input.rollbackImageId))
+            throw new Error("retained rollback requires distinct exact rollback and target image IDs");
+        const existingRollback = rollbackPath(input.agentRoot);
+        if (readDurableRecord(input.agentRoot))
+            throw new Error("Sanctuary bundle rollback is pending; rollback or commit it before another migration");
+        for (const relative of exports.SANCTUARY_PACKAGE_MANAGED_FILES) {
+            requirePlainFile(path.join(input.packageRoot, relative), `package-managed source ${relative}`);
+            validateDestination(input.agentRoot, relative);
+        }
+        requirePlainFile(path.join(input.packageRoot, "bundle-meta.json"), "packaged bundle-meta.json");
+        validateDestination(input.agentRoot, "bundle-meta.json");
+        const packagedMeta = readObject(path.join(input.packageRoot, "bundle-meta.json"));
+        for (const field of BUNDLE_META_VERSION_FIELDS)
+            if (!(field in packagedMeta))
+                throw new Error(`packaged bundle-meta.json is missing ${field}`);
+        const packagedPolicy = (0, steward_policy_1.readStewardPolicy)(input.packageRoot);
+        if (Object.keys(packagedPolicy.routineActionGrants).length > 0) {
+            throw new Error("packaged steward policy must not carry routine action grants; authorize them through an authenticated owner session");
+        }
+        snapshot = captureMigrationSnapshot(input.agentRoot);
+        if (input.retainRollback) {
+            cleanupInterruptedWrites(existingRollback);
+            writeAtomic(existingRollback, `${JSON.stringify(durableSnapshot(input.agentRoot, snapshot, input.rollbackImageId, input.targetImageId))}\n`);
+        }
+        let managedFilesUpdated = 0;
+        for (const relative of exports.SANCTUARY_PACKAGE_MANAGED_FILES) {
+            const source = fs.readFileSync(path.join(input.packageRoot, relative), "utf8");
+            const destination = path.join(input.agentRoot, relative);
+            ensureSafeParent(input.agentRoot, relative);
+            if (fs.existsSync(destination) && fs.readFileSync(destination, "utf8") === source && (fs.statSync(destination).mode & 0o777) === 0o600)
+                continue;
+            writeAtomic(destination, source);
+            managedFilesUpdated += 1;
+        }
+        const metaPath = path.join(input.agentRoot, "bundle-meta.json");
+        const currentMeta = fs.existsSync(metaPath) ? readObject(metaPath) : {};
+        const nextMeta = { ...currentMeta };
+        for (const field of BUNDLE_META_VERSION_FIELDS)
+            nextMeta[field] = packagedMeta[field];
+        const nextMetaText = `${JSON.stringify(nextMeta, null, 2)}\n`;
+        if (!fs.existsSync(metaPath) || fs.readFileSync(metaPath, "utf8") !== nextMetaText)
+            writeAtomic(metaPath, nextMetaText);
+        const result = { managedFilesUpdated };
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_end", message: "completed Sanctuary package-managed bundle migration", meta: result });
+        return result;
+    }
+    catch (error) {
+        let failure = error;
+        if (snapshot) {
+            try {
+                restoreMigrationSnapshot(snapshot);
+                if (fs.existsSync(rollbackPath(input.agentRoot)))
+                    removeRollbackRecord(input.agentRoot, rollbackPath(input.agentRoot));
+            }
+            catch (restoreError) {
+                failure = new AggregateError([error, restoreError], "Sanctuary bundle migration and rollback both failed");
+            }
+        }
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_error", level: "error", message: "Sanctuary package-managed bundle migration failed", meta: { error: String(failure), agentRoot: input.agentRoot } });
+        throw failure;
+    }
+}

package/dist/heart/daemon/sanctuary-scheduler-liveness.js

@@ -0,0 +1,227 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSanctuaryHealthCursor = readSanctuaryHealthCursor;
+exports.durableExclusiveJson = durableExclusiveJson;
+exports.consumeSanctuarySchedulerFire = consumeSanctuarySchedulerFire;
+exports.publishSanctuarySchedulerReceipt = publishSanctuarySchedulerReceipt;
+exports.sanctuarySchedulerLivenessReceiptMac = sanctuarySchedulerLivenessReceiptMac;
+exports.verifySanctuarySchedulerLivenessReceiptMac = verifySanctuarySchedulerLivenessReceiptMac;
+exports.recordSanctuarySchedulerLivenessReceipt = recordSanctuarySchedulerLivenessReceipt;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const SHA256 = /^[0-9a-f]{64}$/u;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const CRONTAB_PATH = "/home/ouro/.ouro-cli/scheduler/sanctuary.crontab";
+const COMMAND = "/usr/local/bin/node /opt/ouro/dist/heart/daemon/ouro-entry.js poke sanctuary --habit sanctuary-health --trigger cron";
+function readSanctuaryHealthCursor(agentRoot) {
+    const state = JSON.parse(fs.readFileSync(path.join(agentRoot, "state", "health", "sanctuary-health.json"), "utf8"));
+    if (!Array.isArray(state.sweepReceipts) || !Array.isArray(state.deliveredReceipts))
+        throw new Error("Sanctuary health cursor state is invalid");
+    return { sweepCount: state.sweepReceipts.length, deliveryCount: state.deliveredReceipts.length };
+}
+function fsyncDirectory(directory, deps) {
+    const descriptor = deps.openSync(directory, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        deps.fsyncSync(descriptor);
+    }
+    finally {
+        deps.closeSync(descriptor);
+    }
+}
+function ensureDurableDirectory(directory, deps) {
+    try {
+        deps.mkdirSync(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "EEXIST") {
+            fsyncDirectory(directory, deps);
+            fsyncDirectory(path.dirname(directory), deps);
+            return;
+        }
+        if (code !== "ENOENT")
+            throw error;
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            throw error;
+        ensureDurableDirectory(parent, deps);
+        try {
+            deps.mkdirSync(directory, { mode: 0o700 });
+        }
+        catch (retryError) {
+            if (retryError.code !== "EEXIST")
+                throw retryError;
+        }
+    }
+    fsyncDirectory(directory, deps);
+    fsyncDirectory(path.dirname(directory), deps);
+}
+function durableExclusiveJson(filePath, value, deps = fs) {
+    const directory = path.dirname(filePath);
+    ensureDurableDirectory(directory, deps);
+    const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+    let handle = null;
+    try {
+        handle = deps.openSync(temporary, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+        deps.writeFileSync(handle, `${JSON.stringify(value)}\n`, "utf8");
+        deps.fsyncSync(handle);
+        deps.closeSync(handle);
+        handle = null;
+        deps.linkSync(temporary, filePath);
+        fsyncDirectory(directory, deps);
+    }
+    finally {
+        if (handle !== null)
+            deps.closeSync(handle);
+        try {
+            deps.unlinkSync(temporary);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        finally {
+            fsyncDirectory(directory, deps);
+        }
+    }
+}
+function consumeSanctuarySchedulerFire(agentRoot, origin) {
+    if (!UUID.test(origin.schedulerRunId) || origin.occurrenceId !== `cron:${origin.slot}`)
+        throw new Error("Sanctuary scheduler fire claim is invalid");
+    const claimId = (0, node_crypto_1.createHash)("sha256").update(`sanctuary\0sanctuary-health\0${origin.slot}\0${origin.occurrenceId}`).digest("hex");
+    const claimPath = path.join(agentRoot, "state", "scheduler", "sanctuary-fire-claims", `${claimId}.json`);
+    try {
+        durableExclusiveJson(claimPath, { schemaVersion: "sanctuary-scheduler-fire-claim-v1", ...origin });
+    }
+    catch (error) {
+        if (error.code === "EEXIST") {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "daemon", event: "daemon.sanctuary_scheduler_fire_rejected", message: "Rejected replayed Sanctuary scheduler fire", meta: { occurrenceId: origin.occurrenceId, schedulerRunId: origin.schedulerRunId } });
+            throw new Error("Sanctuary scheduler fire replay rejected");
+        }
+        throw error;
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_fire_consumed", message: "Consumed Sanctuary scheduler fire before execution", meta: { occurrenceId: origin.occurrenceId, schedulerRunId: origin.schedulerRunId } });
+}
+function publishSanctuarySchedulerReceipt(filePath, value, deps = fs) {
+    try {
+        durableExclusiveJson(filePath, value, deps);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error("Sanctuary scheduler liveness receipt already exists");
+        throw error;
+    }
+}
+function unsignedReceipt(value) {
+    return Object.fromEntries(Object.entries(value).filter(([key]) => key !== "receiptMac"));
+}
+function sanctuarySchedulerLivenessReceiptMac(identityKey, value) {
+    return (0, node_crypto_1.createHmac)("sha256", identityKey).update(`sanctuary-scheduler-liveness-receipt-v2\0${JSON.stringify(unsignedReceipt(value))}`).digest("hex");
+}
+function verifySanctuarySchedulerLivenessReceiptMac(identityKey, value) {
+    const observed = value.receiptMac;
+    if (typeof observed !== "string" || !SHA256.test(observed))
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(Buffer.from(observed, "hex"), Buffer.from(sanctuarySchedulerLivenessReceiptMac(identityKey, value), "hex"));
+}
+function validateSupervisor(snapshot) {
+    const manifest = snapshot.manifest;
+    if (snapshot.schemaVersion !== "supercronic-supervisor-snapshot-v1" || snapshot.daemonPid !== process.pid
+        || snapshot.childCount !== 1 || snapshot.healthy !== true || !Number.isSafeInteger(snapshot.childPid) || snapshot.childPid <= 1
+        || snapshot.binaryPath !== "/usr/local/bin/supercronic" || snapshot.crontabPath !== CRONTAB_PATH
+        || JSON.stringify(snapshot.args) !== JSON.stringify(["-split-logs", "-inotify", CRONTAB_PATH])
+        || snapshot.namespace !== "habit:sanctuary" || manifest.length !== 1
+        || manifest[0]?.id !== "sanctuary:sanctuary-health" || manifest[0].agent !== "sanctuary"
+        || manifest[0].taskId !== "sanctuary-health" || manifest[0].schedule !== "*/15 * * * *"
+        || manifest[0].taskPath !== "/home/ouro/AgentBundles/sanctuary.ouro/habits/sanctuary-health.md"
+        || manifest[0].command !== COMMAND || !snapshot.renderedCrontab.includes(`# ouro:habit:sanctuary:sanctuary:sanctuary-health\n*/15 * * * * ${COMMAND}\n`)) {
+        throw new Error("Sanctuary scheduler supervisor attestation is invalid");
+    }
+}
+function recordSanctuarySchedulerLivenessReceipt(input) {
+    if (input.trigger !== "cron")
+        throw new Error("Sanctuary scheduler liveness requires cron provenance");
+    if (input.scenario.label !== "unit-16f-cron-fingerprint" || !SHA256.test(input.scenario.scenarioHandleDigest))
+        throw new Error("Sanctuary scheduler liveness scenario is invalid");
+    if (input.occurrenceId.length === 0 || !UUID.test(input.runnerId))
+        throw new Error("Sanctuary scheduler liveness runner provenance is invalid");
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(input.identityKey) || input.schedulerOrigin.parentPid !== input.supervisor.childPid
+        || input.schedulerOrigin.scenarioHandleDigest !== input.scenario.scenarioHandleDigest || input.occurrenceId !== input.schedulerOrigin.occurrenceId
+        || input.occurrenceId !== `cron:${input.schedulerOrigin.slot}`
+        || !UUID.test(input.schedulerOrigin.schedulerRunId)
+        || input.schedulerOrigin.slot.length === 0 || !SHA256.test(input.schedulerOrigin.proofMac))
+        throw new Error("Sanctuary scheduler liveness authenticated origin is invalid");
+    if (input.providerInvocationCount !== 0 || input.privateTurnCount !== 0)
+        throw new Error("Sanctuary scheduler liveness performed paid work");
+    validateSupervisor(input.supervisor);
+    const statePath = path.join(input.agentRoot, "state", "health", "sanctuary-health.json");
+    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+    if (!Array.isArray(state.sweepReceipts) || !Array.isArray(state.deliveredReceipts))
+        throw new Error("Sanctuary scheduler liveness state is invalid");
+    const after = { sweepCount: state.sweepReceipts.length, deliveryCount: state.deliveredReceipts.length };
+    const matching = state.sweepReceipts.slice(input.before.sweepCount).filter((row) => row.scenarioHandleDigest === input.scenario.scenarioHandleDigest);
+    const sweep = matching[0];
+    if (after.sweepCount - input.before.sweepCount !== 1 || matching.length !== 1 || !sweep
+        || after.deliveryCount - input.before.deliveryCount !== 0 || sweep.opened !== 0 || sweep.recovered !== 0 || sweep.digestDue !== false || sweep.deliveryId !== undefined) {
+        throw new Error("Sanctuary scheduler liveness requires exactly one unchanged sweep");
+    }
+    const unsigned = {
+        schemaVersion: "sanctuary-scheduler-liveness-receipt-v1",
+        label: "unit-16f-cron-fingerprint",
+        scenarioHandleDigest: input.scenario.scenarioHandleDigest,
+        trigger: "cron",
+        occurrenceId: input.occurrenceId,
+        runnerId: input.runnerId,
+        recordedAt: (input.now ?? (() => new Date()))().toISOString(),
+        before: input.before,
+        after,
+        sweepDelta: 1,
+        deliveryDelta: 0,
+        providerInvocationCount: 0,
+        privateTurnCount: 0,
+        sweep: { recordDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(sweep)).digest("hex"), opened: 0, recovered: 0, digestDue: false, deliveryId: null },
+        supervisor: input.supervisor,
+        schedulerOrigin: input.schedulerOrigin,
+        nonReplay: true,
+    };
+    const receipt = { ...unsigned, receiptMac: sanctuarySchedulerLivenessReceiptMac(input.identityKey, unsigned) };
+    const receiptPath = path.join(input.agentRoot, "state", "acceptance", "scheduler-liveness-receipts", `${input.scenario.scenarioHandleDigest}.json`);
+    publishSanctuarySchedulerReceipt(receiptPath, receipt);
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_scheduler_liveness", message: "Scheduler-origin Sanctuary health sweep attested", meta: { scenarioHandleDigest: input.scenario.scenarioHandleDigest, occurrenceId: input.occurrenceId, runnerId: input.runnerId } });
+    return receipt;
+}