@ouro.bot/cli 0.1.0-alpha.796 → 0.1.0-alpha.799

package/dist/heart/daemon/sanctuary-bundle-migration.js

@@ -34,6 +34,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SANCTUARY_BUNDLE_ROLLBACK_FILE = exports.SANCTUARY_PACKAGE_MANAGED_FILES = void 0;
+exports.inspectSanctuaryDirectoryFromBase = inspectSanctuaryDirectoryFromBase;
+exports.sanctuaryDirectoriesShareIdentity = sanctuaryDirectoriesShareIdentity;
+exports.inspectSanctuaryPackageManagedBundle = inspectSanctuaryPackageManagedBundle;
+exports.ensureSanctuaryPackageManagedBundle = ensureSanctuaryPackageManagedBundle;
 exports.inspectSanctuaryPackageManagedBundleRollback = inspectSanctuaryPackageManagedBundleRollback;
 exports.rollbackSanctuaryPackageManagedBundle = rollbackSanctuaryPackageManagedBundle;
 exports.commitSanctuaryPackageManagedBundle = commitSanctuaryPackageManagedBundle;
@@ -42,7 +46,6 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const runtime_1 = require("../../nerves/runtime");
-const steward_policy_1 = require("../steward-policy");
 exports.SANCTUARY_PACKAGE_MANAGED_FILES = [
     "provider-readiness.json",
     "tool-profiles.json",
@@ -56,12 +59,83 @@ exports.SANCTUARY_PACKAGE_MANAGED_FILES = [
 exports.SANCTUARY_BUNDLE_ROLLBACK_FILE = ".sanctuary-package-managed-rollback.json";
 const SANCTUARY_BUNDLE_COMMITTING_FILE = `${exports.SANCTUARY_BUNDLE_ROLLBACK_FILE}.committing`;
 const BUNDLE_META_VERSION_FIELDS = ["runtimeVersion", "bundleSchemaVersion", "lastUpdated"];
+class SanctuaryInspectionFault extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+const CANONICAL_EMPTY_PACKAGED_POLICY = { schemaVersion: 1, version: 0, desiredStates: {}, routineActionGrants: {}, updatedAt: null };
 function readObject(filePath) {
     const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error(`${path.basename(filePath)} must contain an object`);
     return value;
 }
+function isMissing(error) {
+    return !!error && typeof error === "object" && "code" in error && error.code === "ENOENT";
+}
+function isFilesystemFailure(error) {
+    return !!error && typeof error === "object" && "code" in error && typeof error.code === "string";
+}
+function inspectSanctuaryDirectoryFromBase(baseRoot, segments) {
+    if (!path.isAbsolute(baseRoot))
+        return null;
+    let current = path.resolve(baseRoot);
+    let stat = null;
+    for (const candidate of [current, ...segments.map((segment) => { current = path.join(current, segment); return current; })]) {
+        try {
+            stat = fs.lstatSync(candidate);
+        }
+        catch (error) {
+            if (isMissing(error))
+                return null;
+            throw error;
+        }
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            return null;
+    }
+    const realPath = fs.realpathSync(current);
+    if (realPath !== path.resolve(current))
+        return null;
+    return { realPath, device: stat.dev, inode: stat.ino };
+}
+function sanctuaryDirectoriesShareIdentity(left, right) {
+    return left.realPath === right.realPath || (left.device === right.device && left.inode === right.inode);
+}
+function inspectStandaloneSanctuaryDirectory(root) {
+    if (!path.isAbsolute(root))
+        return null;
+    const resolved = path.resolve(root);
+    return inspectSanctuaryDirectoryFromBase(path.dirname(resolved), [path.basename(resolved)]);
+}
+function isCanonicalEmptyPackagedPolicy(value) {
+    return JSON.stringify(Object.keys(value).sort()) === JSON.stringify(Object.keys(CANONICAL_EMPTY_PACKAGED_POLICY).sort())
+        && value.schemaVersion === 1
+        && value.version === 0
+        && value.updatedAt === null
+        && !!value.desiredStates
+        && typeof value.desiredStates === "object"
+        && !Array.isArray(value.desiredStates)
+        && Object.keys(value.desiredStates).length === 0
+        && !!value.routineActionGrants
+        && typeof value.routineActionGrants === "object"
+        && !Array.isArray(value.routineActionGrants)
+        && Object.keys(value.routineActionGrants).length === 0;
+}
+function validatePackagedPolicy(packageRoot) {
+    const relative = "state/policy/steward.json";
+    validateDestination(packageRoot, relative);
+    requirePlainFile(path.join(packageRoot, relative), "packaged steward policy");
+    const value = readObject(path.join(packageRoot, relative));
+    if (value.routineActionGrants && typeof value.routineActionGrants === "object" && !Array.isArray(value.routineActionGrants) && Object.keys(value.routineActionGrants).length > 0)
+        throw new Error("packaged steward policy must not carry routine action grants; authorize them through an authenticated owner session");
+    if (value.desiredStates && typeof value.desiredStates === "object" && !Array.isArray(value.desiredStates) && Object.keys(value.desiredStates).length > 0)
+        throw new Error("packaged steward policy must not carry desired state");
+    if (!isCanonicalEmptyPackagedPolicy(value))
+        throw new Error("packaged steward policy must be the canonical empty policy");
+}
 function requirePlainFile(filePath, label) {
     let stat;
     try {
@@ -102,13 +176,29 @@ function validateDestination(agentRoot, relative) {
             throw new Error(`package-managed destination must be a regular file: ${relative}`);
     }
 }
-function writeAtomic(filePath, content) {
+function syncDirectory(directoryPath) {
+    const directory = fs.openSync(directoryPath, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    try {
+        fs.fsyncSync(directory);
+    }
+    finally {
+        fs.closeSync(directory);
+    }
+}
+function syncNearestExistingDirectory(directoryPath, agentRoot) {
+    let current = directoryPath;
+    while (current !== agentRoot && !fs.existsSync(current))
+        current = path.dirname(current);
+    syncDirectory(current);
+}
+function writeAtomic(filePath, content, mode = 0o600) {
     const stagingDirectory = fs.mkdtempSync(`${filePath}.package-migration.`);
     const temporary = path.join(stagingDirectory, "value");
     try {
         const fd = fs.openSync(temporary, "wx", 0o600);
         try {
             fs.writeFileSync(fd, content);
+            fs.fchmodSync(fd, mode);
             fs.fsyncSync(fd);
         }
         finally {
@@ -120,41 +210,60 @@ function writeAtomic(filePath, content) {
         fs.rmSync(temporary, { force: true });
         fs.rmdirSync(stagingDirectory);
     }
-    fs.chmodSync(filePath, 0o600);
-    const directory = fs.openSync(path.dirname(filePath), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
-    try {
-        fs.fsyncSync(directory);
-    }
-    finally {
-        fs.closeSync(directory);
-    }
+    syncDirectory(path.dirname(filePath));
 }
-function cleanupInterruptedWrites(filePath) {
-    const parent = path.dirname(filePath);
-    const prefix = `${path.basename(filePath)}.package-migration.`;
-    if (!fs.existsSync(parent))
-        return;
-    for (const name of fs.readdirSync(parent)) {
-        if (!name.startsWith(prefix))
-            continue;
-        const stagingDirectory = path.join(parent, name);
-        const stagingStat = fs.lstatSync(stagingDirectory);
-        if (stagingStat.isSymbolicLink() || !stagingStat.isDirectory())
-            throw new Error(`interrupted package migration stage is invalid: ${name}`);
-        const entries = fs.readdirSync(stagingDirectory);
-        if (entries.some((entry) => entry !== "value"))
-            throw new Error(`interrupted package migration stage contains unexpected entries: ${name}`);
-        const temporary = path.join(stagingDirectory, "value");
-        if (fs.existsSync(temporary)) {
-            const temporaryStat = fs.lstatSync(temporary);
-            if (temporaryStat.isSymbolicLink() || !temporaryStat.isFile())
-                throw new Error(`interrupted package migration value is invalid: ${name}`);
-            fs.unlinkSync(temporary);
+const SNAPSHOT_RELATIVES = [...exports.SANCTUARY_PACKAGE_MANAGED_FILES, "bundle-meta.json"];
+function packageManagedArtifactPaths(agentRoot) {
+    return SNAPSHOT_RELATIVES.map((relative) => path.join(agentRoot, relative));
+}
+function inspectInterruptedWrites(filePaths, restoredModes) {
+    const stages = [];
+    for (const filePath of [...filePaths].sort()) {
+        const parent = path.dirname(filePath);
+        const prefix = `${path.basename(filePath)}.package-migration.`;
+        let names;
+        try {
+            names = fs.readdirSync(parent).sort();
+        }
+        catch (error) {
+            if (isMissing(error))
+                continue;
+            throw error;
+        }
+        for (const name of names) {
+            if (!name.startsWith(prefix))
+                continue;
+            const stagingDirectory = path.join(parent, name);
+            const parentStat = fs.lstatSync(parent);
+            const stagingStat = fs.lstatSync(stagingDirectory);
+            if (parentStat.isSymbolicLink() || !parentStat.isDirectory() || stagingStat.isSymbolicLink() || !stagingStat.isDirectory() || (stagingStat.mode & 0o777) !== 0o700 || stagingStat.uid !== parentStat.uid || stagingStat.gid !== parentStat.gid)
+                throw new Error(`interrupted package migration stage is invalid: ${name}`);
+            const entries = fs.readdirSync(stagingDirectory);
+            if (entries.some((entry) => entry !== "value"))
+                throw new Error(`interrupted package migration stage contains unexpected entries: ${name}`);
+            const temporary = entries.includes("value") ? path.join(stagingDirectory, "value") : null;
+            if (temporary) {
+                const temporaryStat = fs.lstatSync(temporary);
+                const temporaryMode = temporaryStat.mode & 0o777;
+                if (temporaryStat.isSymbolicLink() || !temporaryStat.isFile() || (temporaryMode !== 0o600 && temporaryMode !== restoredModes?.get(filePath)) || temporaryStat.uid !== stagingStat.uid || temporaryStat.gid !== stagingStat.gid)
+                    throw new Error(`interrupted package migration value is invalid: ${name}`);
+            }
+            stages.push({ stagingDirectory, temporary });
         }
-        fs.rmdirSync(stagingDirectory);
+    }
+    return stages;
+}
+function cleanupInterruptedWrites(filePaths, restoredModes) {
+    const stages = inspectInterruptedWrites(filePaths, restoredModes);
+    for (const stage of stages) {
+        if (stage.temporary)
+            fs.unlinkSync(stage.temporary);
+        fs.rmdirSync(stage.stagingDirectory);
+    }
+    for (const parent of [...new Set(stages.map((stage) => path.dirname(stage.stagingDirectory)))].sort()) {
+        syncDirectory(parent);
     }
 }
-const SNAPSHOT_RELATIVES = [...exports.SANCTUARY_PACKAGE_MANAGED_FILES, "bundle-meta.json"];
 function snapshotDirectoryRelatives() {
     const directories = new Set();
     for (const relative of SNAPSHOT_RELATIVES) {
@@ -197,20 +306,33 @@ function durableSnapshot(agentRoot, snapshot, rollbackImageId, targetImageId) {
     return { ...payload, snapshotDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(payload)).digest("hex") };
 }
 function readDurableRecord(agentRoot) {
-    const candidates = [rollbackPath(agentRoot), path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE)].filter((candidate) => fs.existsSync(candidate));
+    const names = fs.readdirSync(agentRoot);
+    const stagePrefixes = [`${exports.SANCTUARY_BUNDLE_ROLLBACK_FILE}.package-migration.`, `${SANCTUARY_BUNDLE_COMMITTING_FILE}.package-migration.`];
+    if (names.some((name) => stagePrefixes.some((prefix) => name.startsWith(prefix))))
+        throw new Error("Sanctuary bundle journal staging residue requires verified recovery");
+    const candidates = [rollbackPath(agentRoot), path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE)].flatMap((filePath) => {
+        try {
+            return [{ filePath, stat: fs.lstatSync(filePath) }];
+        }
+        catch (error) {
+            if (isMissing(error))
+                return [];
+            throw error;
+        }
+    });
     if (candidates.length === 0)
         return null;
     if (candidates.length !== 1)
         throw new Error("Sanctuary bundle rollback record state is ambiguous");
-    const [filePath] = candidates;
-    const stat = fs.lstatSync(filePath);
+    const [{ filePath, stat }] = candidates;
     if (stat.isSymbolicLink())
         throw new Error("Sanctuary bundle rollback record must not be a symlink");
     if (!stat.isFile() || (stat.mode & 0o777) !== 0o600)
         throw new Error("Sanctuary bundle rollback record must be a mode-0600 regular file");
+    const serialized = fs.readFileSync(filePath, "utf8");
     let value;
     try {
-        value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        value = JSON.parse(serialized);
     }
     catch {
         throw new Error("Sanctuary bundle rollback record is invalid JSON");
@@ -248,20 +370,210 @@ function readDurableRecord(agentRoot) {
 }
 function removeRollbackRecord(agentRoot, filePath) {
     fs.unlinkSync(filePath);
-    const root = fs.openSync(agentRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
-    try {
-        fs.fsyncSync(root);
-    }
-    finally {
-        fs.closeSync(root);
-    }
+    syncDirectory(agentRoot);
 }
 function validateAgentRoot(agentRoot) {
     if (!path.isAbsolute(agentRoot))
         throw new Error("agent root must be an absolute path");
-    const stat = fs.lstatSync(agentRoot);
-    if (stat.isSymbolicLink() || !stat.isDirectory())
-        throw new Error("agent root must be a real directory");
+    if (!inspectStandaloneSanctuaryDirectory(agentRoot))
+        throw new Error("agent root must be a canonical real directory");
+}
+function inspectionError(code) {
+    if (code === "invalid_package_root" || code === "invalid_package_source" || code === "packaged_policy_not_empty" || code === "package_version_mismatch") {
+        return { ok: false, error: { code, message: "verified release contents are invalid", degraded: true, repair: { actor: "human-required", action: "roll_back_or_install_verified_release" } } };
+    }
+    if (code === "invalid_live_root" || code === "invalid_live_bundle") {
+        return { ok: false, error: { code, message: "installed Sanctuary bundle is invalid", degraded: true, repair: { actor: "human-required", action: "roll_back_or_install_verified_release" } } };
+    }
+    if (code === "invalid_journal") {
+        return { ok: false, error: { code, message: "Sanctuary update recovery is required", degraded: true, repair: { actor: "human-required", action: "run_verified_update_recovery" } } };
+    }
+    return { ok: false, error: { code, message: "Sanctuary install state is unavailable", degraded: true, repair: { actor: "human-required", action: "run_verified_update_recovery" } } };
+}
+function validateInspectionRoot(root, code) {
+    const identity = inspectStandaloneSanctuaryDirectory(root);
+    if (!identity)
+        throw new SanctuaryInspectionFault(code);
+    return identity;
+}
+function inspectRelativeFile(root, relative, code) {
+    let current = root;
+    let result = null;
+    const segments = relative.split(path.sep);
+    for (let index = 0; index < segments.length; index += 1) {
+        current = path.join(current, segments[index]);
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (error) {
+            if (isMissing(error))
+                return null;
+            throw error;
+        }
+        if (stat.isSymbolicLink())
+            throw new SanctuaryInspectionFault(code);
+        if (index < segments.length - 1 && !stat.isDirectory())
+            throw new SanctuaryInspectionFault(code);
+        if (index === segments.length - 1 && !stat.isFile())
+            throw new SanctuaryInspectionFault(code);
+        if (index === segments.length - 1)
+            result = stat;
+    }
+    return result;
+}
+function readInspectionObject(filePath, code) {
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new SanctuaryInspectionFault(code);
+        throw error;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new SanctuaryInspectionFault(code);
+    return value;
+}
+function inspectPackageSources(packageRoot, runtimePackageVersion) {
+    const managed = new Map();
+    for (const relative of exports.SANCTUARY_PACKAGE_MANAGED_FILES) {
+        if (!inspectRelativeFile(packageRoot, relative, "invalid_package_source"))
+            throw new SanctuaryInspectionFault("invalid_package_source");
+        managed.set(relative, fs.readFileSync(path.join(packageRoot, relative)));
+    }
+    if (!inspectRelativeFile(packageRoot, "bundle-meta.json", "invalid_package_source"))
+        throw new SanctuaryInspectionFault("invalid_package_source");
+    const metadata = readInspectionObject(path.join(packageRoot, "bundle-meta.json"), "invalid_package_source");
+    if (typeof metadata.runtimeVersion !== "string" || metadata.runtimeVersion.length === 0 || !Number.isInteger(metadata.bundleSchemaVersion) || typeof metadata.lastUpdated !== "string" || metadata.lastUpdated.length === 0)
+        throw new SanctuaryInspectionFault("invalid_package_source");
+    if (!inspectRelativeFile(packageRoot, "state/policy/steward.json", "invalid_package_source"))
+        throw new SanctuaryInspectionFault("invalid_package_source");
+    const policy = readInspectionObject(path.join(packageRoot, "state/policy/steward.json"), "invalid_package_source");
+    if (!isCanonicalEmptyPackagedPolicy(policy))
+        throw new SanctuaryInspectionFault("packaged_policy_not_empty");
+    if (runtimePackageVersion.length === 0 || metadata.runtimeVersion !== runtimePackageVersion)
+        throw new SanctuaryInspectionFault("package_version_mismatch");
+    return { managed, metadata, packagedBundleVersion: metadata.runtimeVersion };
+}
+function journalRepair(journalState, parity) {
+    if (parity === "exact" && journalState !== "committing")
+        return { actor: "none", action: "none" };
+    if (parity === "mismatch" && journalState === "absent")
+        return { actor: "human-required", action: "restart_from_verified_release" };
+    return { actor: "human-required", action: "run_verified_update_recovery" };
+}
+function inspectSanctuaryPackageManagedBundle(input) {
+    try {
+        const packageIdentity = validateInspectionRoot(input.packageRoot, "invalid_package_root");
+        const packaged = inspectPackageSources(input.packageRoot, input.runtimePackageVersion);
+        const agentIdentity = validateInspectionRoot(input.agentRoot, "invalid_live_root");
+        if (sanctuaryDirectoriesShareIdentity(packageIdentity, agentIdentity))
+            throw new SanctuaryInspectionFault("invalid_live_root");
+        let managedMissing = false;
+        let managedContent = false;
+        let managedMode = false;
+        for (const relative of exports.SANCTUARY_PACKAGE_MANAGED_FILES) {
+            const stat = inspectRelativeFile(input.agentRoot, relative, "invalid_live_bundle");
+            if (!stat) {
+                managedMissing = true;
+                continue;
+            }
+            if (!fs.readFileSync(path.join(input.agentRoot, relative)).equals(packaged.managed.get(relative)))
+                managedContent = true;
+            if ((stat.mode & 0o777) !== 0o600)
+                managedMode = true;
+        }
+        let liveBundleVersion = null;
+        let bundleMetaMissing = false;
+        let bundleMetaField = false;
+        let bundleMetaMode = false;
+        const liveMetaStat = inspectRelativeFile(input.agentRoot, "bundle-meta.json", "invalid_live_bundle");
+        if (!liveMetaStat) {
+            bundleMetaMissing = true;
+        }
+        else {
+            const liveMeta = readInspectionObject(path.join(input.agentRoot, "bundle-meta.json"), "invalid_live_bundle");
+            liveBundleVersion = typeof liveMeta.runtimeVersion === "string" ? liveMeta.runtimeVersion : null;
+            bundleMetaField = BUNDLE_META_VERSION_FIELDS.some((field) => liveMeta[field] !== packaged.metadata[field]);
+            bundleMetaMode = (liveMetaStat.mode & 0o777) !== 0o600;
+        }
+        let journalState = "absent";
+        try {
+            if (inspectInterruptedWrites(packageManagedArtifactPaths(input.agentRoot)).length > 0)
+                throw new Error("Sanctuary bundle staging residue requires verified recovery");
+            journalState = readDurableRecord(input.agentRoot)?.state ?? "absent";
+        }
+        catch (error) {
+            if (isFilesystemFailure(error))
+                throw error;
+            throw new SanctuaryInspectionFault("invalid_journal");
+        }
+        const mismatchCodes = [];
+        if (managedMissing)
+            mismatchCodes.push("managed_file_missing");
+        if (managedContent)
+            mismatchCodes.push("managed_file_content");
+        if (managedMode)
+            mismatchCodes.push("managed_file_mode");
+        if (bundleMetaMissing)
+            mismatchCodes.push("bundle_meta_missing");
+        if (bundleMetaField)
+            mismatchCodes.push("bundle_meta_field");
+        if (bundleMetaMode)
+            mismatchCodes.push("bundle_meta_mode");
+        const parity = mismatchCodes.length === 0 ? "exact" : "mismatch";
+        const ready = parity === "exact" && journalState !== "committing";
+        return {
+            ok: true,
+            data: {
+                runtimePackageVersion: input.runtimePackageVersion,
+                packagedBundleVersion: packaged.packagedBundleVersion,
+                liveBundleVersion,
+                parity,
+                mismatchCodes,
+                journalState,
+                ready,
+                repair: journalRepair(journalState, parity),
+            },
+        };
+    }
+    catch (error) {
+        return inspectionError(error instanceof SanctuaryInspectionFault ? error.code : "inspection_unavailable");
+    }
+}
+function ensureSanctuaryPackageManagedBundle(input, deps = {}) {
+    const inspect = deps.inspect ?? inspectSanctuaryPackageManagedBundle;
+    const before = inspect(input);
+    if (!before.ok) {
+        if (before.error.code !== "invalid_journal")
+            return before;
+        try {
+            (deps.migrate ?? migrateSanctuaryPackageManagedBundle)({ packageRoot: input.packageRoot, agentRoot: input.agentRoot });
+        }
+        catch {
+            return before;
+        }
+    }
+    else if (before.data.ready) {
+        return before;
+    }
+    else if (before.data.parity === "mismatch" && before.data.journalState !== "absent") {
+        return before;
+    }
+    else if (before.data.parity === "exact" && before.data.journalState === "committing") {
+        (deps.commit ?? commitSanctuaryPackageManagedBundle)(input.agentRoot);
+    }
+    else {
+        (deps.migrate ?? migrateSanctuaryPackageManagedBundle)({ packageRoot: input.packageRoot, agentRoot: input.agentRoot });
+    }
+    const after = inspect(input);
+    if (!after.ok || !after.data.ready)
+        return after;
+    if (after.data.parity !== "exact" || after.data.journalState !== "absent")
+        throw new Error("Sanctuary package-managed bundle did not converge");
+    return after;
 }
 function inspectSanctuaryPackageManagedBundleRollback(agentRoot) {
     validateAgentRoot(agentRoot);
@@ -275,7 +587,7 @@ function rollbackSanctuaryPackageManagedBundle(agentRoot, options = {}) {
         return false;
     if (record.state === "committing")
         throw new Error("Sanctuary bundle commit is pending and cannot be rolled back");
-    restoreMigrationSnapshot(record.snapshot);
+    restoreMigrationSnapshot(record.snapshot, agentRoot);
     if (!options.retainRecord)
         removeRollbackRecord(agentRoot, record.filePath);
     return true;
@@ -288,37 +600,45 @@ function commitSanctuaryPackageManagedBundle(agentRoot) {
     const committingPath = path.join(agentRoot, SANCTUARY_BUNDLE_COMMITTING_FILE);
     if (record.filePath !== committingPath) {
         fs.renameSync(record.filePath, committingPath);
-        const root = fs.openSync(agentRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
-        try {
-            fs.fsyncSync(root);
-        }
-        finally {
-            fs.closeSync(root);
-        }
+        syncDirectory(agentRoot);
     }
     removeRollbackRecord(agentRoot, committingPath);
     return true;
 }
-function restoreMigrationSnapshot(snapshot) {
+function restoreMigrationSnapshot(snapshot, agentRoot) {
+    const restoredModes = new Map();
+    for (const file of snapshot.files)
+        if (file.mode !== null)
+            restoredModes.set(file.path, file.mode);
+    cleanupInterruptedWrites(snapshot.files.map((file) => file.path), restoredModes);
     for (const file of snapshot.files) {
-        cleanupInterruptedWrites(file.path);
         if (file.content === null) {
             fs.rmSync(file.path, { force: true });
+            syncNearestExistingDirectory(path.dirname(file.path), agentRoot);
         }
         else {
-            writeAtomic(file.path, file.content);
-            fs.chmodSync(file.path, file.mode);
+            writeAtomic(file.path, file.content, file.mode);
         }
     }
     for (const directory of [...snapshot.directories].reverse()) {
         if (directory.mode === null) {
-            if (!fs.existsSync(directory.path))
-                continue;
-            if (fs.readdirSync(directory.path).length === 0)
+            if (!fs.existsSync(directory.path)) {
+                syncNearestExistingDirectory(path.dirname(directory.path), agentRoot);
+            }
+            else if (fs.readdirSync(directory.path).length === 0) {
                 fs.rmdirSync(directory.path);
+                syncNearestExistingDirectory(path.dirname(directory.path), agentRoot);
+            }
         }
         else {
-            fs.chmodSync(directory.path, directory.mode);
+            const handle = fs.openSync(directory.path, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+            try {
+                fs.fchmodSync(handle, directory.mode);
+                fs.fsyncSync(handle);
+            }
+            finally {
+                fs.closeSync(handle);
+            }
         }
     }
 }
@@ -326,14 +646,16 @@ function migrateSanctuaryPackageManagedBundle(input) {
     (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_start", message: "starting Sanctuary package-managed bundle migration", meta: { agentRoot: input.agentRoot } });
     let snapshot = null;
     try {
-        if (!path.isAbsolute(input.packageRoot) || !path.isAbsolute(input.agentRoot) || input.packageRoot === input.agentRoot)
-            throw new Error("package and agent roots must be distinct absolute paths");
-        const packageStat = fs.lstatSync(input.packageRoot);
-        const agentStat = fs.lstatSync(input.agentRoot);
-        if (packageStat.isSymbolicLink() || !packageStat.isDirectory())
-            throw new Error("package root must be a real directory");
-        if (agentStat.isSymbolicLink() || !agentStat.isDirectory())
-            throw new Error("agent root must be a real directory");
+        if (!path.isAbsolute(input.packageRoot) || !path.isAbsolute(input.agentRoot))
+            throw new Error("package and agent roots must be absolute paths");
+        const packageIdentity = inspectStandaloneSanctuaryDirectory(input.packageRoot);
+        const agentIdentity = inspectStandaloneSanctuaryDirectory(input.agentRoot);
+        if (!packageIdentity)
+            throw new Error("package root must be a canonical real directory");
+        if (!agentIdentity)
+            throw new Error("agent root must be a canonical real directory");
+        if (sanctuaryDirectoriesShareIdentity(packageIdentity, agentIdentity))
+            throw new Error("package and agent roots must be distinct real directories");
         if (input.retainRollback && (!input.rollbackImageId || !/^sha256:[0-9a-f]{64}$/u.test(input.rollbackImageId) || !input.targetImageId || !/^sha256:[0-9a-f]{64}$/u.test(input.targetImageId) || input.targetImageId === input.rollbackImageId))
             throw new Error("retained rollback requires distinct exact rollback and target image IDs");
         const existingRollback = rollbackPath(input.agentRoot);
@@ -349,13 +671,10 @@ function migrateSanctuaryPackageManagedBundle(input) {
         for (const field of BUNDLE_META_VERSION_FIELDS)
             if (!(field in packagedMeta))
                 throw new Error(`packaged bundle-meta.json is missing ${field}`);
-        const packagedPolicy = (0, steward_policy_1.readStewardPolicy)(input.packageRoot);
-        if (Object.keys(packagedPolicy.routineActionGrants).length > 0) {
-            throw new Error("packaged steward policy must not carry routine action grants; authorize them through an authenticated owner session");
-        }
+        validatePackagedPolicy(input.packageRoot);
+        cleanupInterruptedWrites(packageManagedArtifactPaths(input.agentRoot));
         snapshot = captureMigrationSnapshot(input.agentRoot);
         if (input.retainRollback) {
-            cleanupInterruptedWrites(existingRollback);
             writeAtomic(existingRollback, `${JSON.stringify(durableSnapshot(input.agentRoot, snapshot, input.rollbackImageId, input.targetImageId))}\n`);
         }
         let managedFilesUpdated = 0;
@@ -369,13 +688,24 @@ function migrateSanctuaryPackageManagedBundle(input) {
             managedFilesUpdated += 1;
         }
         const metaPath = path.join(input.agentRoot, "bundle-meta.json");
-        const currentMeta = fs.existsSync(metaPath) ? readObject(metaPath) : {};
+        const metaExists = fs.existsSync(metaPath);
+        const currentMeta = metaExists ? readObject(metaPath) : {};
         const nextMeta = { ...currentMeta };
         for (const field of BUNDLE_META_VERSION_FIELDS)
             nextMeta[field] = packagedMeta[field];
-        const nextMetaText = `${JSON.stringify(nextMeta, null, 2)}\n`;
-        if (!fs.existsSync(metaPath) || fs.readFileSync(metaPath, "utf8") !== nextMetaText)
-            writeAtomic(metaPath, nextMetaText);
+        if (!metaExists || BUNDLE_META_VERSION_FIELDS.some((field) => currentMeta[field] !== packagedMeta[field])) {
+            writeAtomic(metaPath, `${JSON.stringify(nextMeta, null, 2)}\n`);
+        }
+        else if ((fs.statSync(metaPath).mode & 0o777) !== 0o600) {
+            fs.chmodSync(metaPath, 0o600);
+            const meta = fs.openSync(metaPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            try {
+                fs.fsyncSync(meta);
+            }
+            finally {
+                fs.closeSync(meta);
+            }
+        }
         const result = { managedFilesUpdated };
         (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_bundle_migration_end", message: "completed Sanctuary package-managed bundle migration", meta: result });
         return result;
@@ -384,7 +714,7 @@ function migrateSanctuaryPackageManagedBundle(input) {
         let failure = error;
         if (snapshot) {
             try {
-                restoreMigrationSnapshot(snapshot);
+                restoreMigrationSnapshot(snapshot, input.agentRoot);
                 if (fs.existsSync(rollbackPath(input.agentRoot)))
                     removeRollbackRecord(input.agentRoot, rollbackPath(input.agentRoot));
             }