@ouro.bot/cli 0.1.0-alpha.810 → 0.1.0-alpha.812

package/dist/heart/daemon/daemon.js

@@ -65,6 +65,7 @@ const pending_1 = require("../../mind/pending");
 const agent_service_1 = require("./agent-service");
 const friends_1 = require("@ouro.bot/friends");
 const mcp_manager_1 = require("../../repertoire/mcp-manager");
+const mcp_tools_1 = require("../../repertoire/mcp-tools");
 const mailbox_http_1 = require("../mailbox/mailbox-http");
 const mailbox_types_1 = require("../mailbox/mailbox-types");
 const mailbox_read_1 = require("../mailbox/mailbox-read");
@@ -1161,7 +1162,6 @@ class OuroDaemon {
         }
         this.frontendSessionService.close?.();
         (0, update_checker_1.stopUpdateChecker)();
-        (0, mcp_manager_1.shutdownSharedMcpManager)();
         this.scheduler.stop?.();
         this.healthMonitor.stopPeriodicChecks?.();
         if (this.senseAutostartTimer) {
@@ -1172,7 +1172,10 @@ class OuroDaemon {
             clearInterval(this.externalEventReconcileTimer);
             this.externalEventReconcileTimer = null;
         }
-        const workerStopTasks = [Promise.resolve().then(() => this.processManager.stopAll())];
+        const workerStopTasks = [
+            Promise.resolve().then(() => this.processManager.stopAll()),
+            Promise.resolve().then(() => (0, mcp_manager_1.shutdownSharedMcpManager)()),
+        ];
         if (this.senseManager) {
             workerStopTasks.push(Promise.resolve().then(() => this.senseManager.stopAll()));
         }
@@ -2446,28 +2449,35 @@ class OuroDaemon {
             }
             case "mcp.list": {
                 return (0, turn_execution_lease_1.withTurnExecutionLease)(async () => {
-                    (0, identity_1.setAgentName)(command.agent ?? "default");
-                    const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)();
+                    const agentName = command.agent ?? "default";
+                    const owner = { agentName, agentRoot: (0, identity_1.getAgentRoot)(agentName) };
+                    (0, identity_1.setAgentName)(agentName);
+                    const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)(owner);
                     if (!mcpManager) {
                         return { ok: true, data: [], message: "no MCP servers configured" };
                     }
-                    return { ok: true, data: mcpManager.listAllTools() };
+                    return { ok: true, data: mcpManager.entries.map(({ server, tools, pluginId }) => ({ server, tools, pluginId })) };
                 });
             }
             case "mcp.call": {
                 return (0, turn_execution_lease_1.withTurnExecutionLease)(async () => {
-                    (0, identity_1.setAgentName)(command.agent ?? "default");
-                    const mcpCallManager = await (0, mcp_manager_1.getSharedMcpManager)();
+                    const agentName = command.agent ?? "default";
+                    const owner = { agentName, agentRoot: (0, identity_1.getAgentRoot)(agentName) };
+                    (0, identity_1.setAgentName)(agentName);
+                    const mcpCallManager = await (0, mcp_manager_1.getSharedMcpManager)(owner);
                     if (!mcpCallManager) {
                         return { ok: false, error: "no MCP servers configured" };
                     }
                     try {
                         const parsedArgs = command.args ? JSON.parse(command.args) : {};
-                        const result = await mcpCallManager.callTool(command.server, command.tool, parsedArgs);
+                        const matches = (0, mcp_tools_1.mcpToolsAsDefinitions)(mcpCallManager).filter((definition) => definition.mcpBinding?.server === command.server && definition.mcpBinding.rawName === command.tool);
+                        const binding = matches.length === 1 ? matches[0].mcpBinding : undefined;
+                        if (!binding)
+                            return { ok: false, error: "MCP tool is unavailable or ambiguous" };
+                        const result = await mcpCallManager.manager.callTool(binding, parsedArgs, owner);
                         return { ok: true, data: result };
                     }
                     catch (error) {
-                        /* v8 ignore next -- defensive: callTool errors are always Error instances @preserve */
                         return { ok: false, error: error instanceof Error ? error.message : String(error) };
                     }
                 });

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -60,6 +60,7 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_net_1 = require("node:net");
 const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
 const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../../nerves/runtime");
@@ -258,6 +259,7 @@ function createSanctuaryAcceptanceAdapterDependencies(secretFd = 3, options = {}
         createTelegramApi: telegram_client_1.createTelegramBotApi,
         readLiveGrounding: readIndependentSanctuaryGrounding,
         runProductionBoundaryProbe: runSanctuaryProductionBoundaryProbe,
+        providerRuntime: core_1.getProviderRuntime,
     };
     const healthDriver = createSanctuaryHealthAcceptanceScenarioDriver(dependencies.hostRequest);
     const scenarioAgentRoot = options.scenarioCapture?.agentRoot ?? (0, identity_1.getAgentRoot)(TARGET_ID);
@@ -937,32 +939,57 @@ function canonicalDockerIdFromUnraidPrefixedId(value) {
         throw new Error("Unraid Docker PrefixedID is invalid");
     return value.slice(65);
 }
-async function runSanctuaryProductionBoundaryProbe(telegramSchemas) {
-    const excludedNames = ["shell", "read_file", "edit_file", "vault_get", "mcp_call", "exec", "credential_get"];
+function containmentToolContext(agentRoot, profileId) {
+    const profile = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot).profiles[profileId];
+    if (!profile)
+        throw new Error("Sanctuary containment profile is missing");
+    return {
+        signin: async () => undefined, agentName: TARGET_ID, agentRoot,
+        relationshipAuthorization: {
+            profileId, authorizedContextScopes: profile.contextScopes, advertisedToolNames: profile.toolNames,
+            // This request-bound subject audits the profile contract; it is not a persisted Friend or grant.
+            authorizeTool: async (name) => (0, relationship_authorization_1.authorizeRelationshipAccess)({
+                relationship: { friendId: "sanctuary-containment-probe", trustLevel: profileId === "sanctuary-household" ? "friend" : "family", admissionState: "active", initiativePolicy: "reactive_only", capabilityProfileId: profileId },
+                profiles: Object.values((0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot).profiles),
+                request: { kind: "tool", name, requestId: "sanctuary-containment-probe", returnTargetFriendId: "sanctuary-containment-probe" },
+                activeRequestId: "sanctuary-containment-probe", requestPhase: "inbound",
+            }),
+        },
+    };
+}
+async function runSanctuaryProductionBoundaryProbe(input) {
+    const excludedNames = ["vault_get", "mcp_call", "exec", "credential_get", ...(input.profileId === "sanctuary-owner" ? [] : tools_1.SANCTUARY_OWNER_ADDITIONS)];
+    const inner = input.profileId === "sanctuary-event";
+    const terminal = inner ? "rest" : "settle";
     const turns = [
         { content: "", toolCalls: excludedNames.map((name, index) => ({ id: `sanctuary-excluded-${index}`, name, arguments: "{}" })), outputItems: [] },
         { content: "", toolCalls: [{ id: "sanctuary-valid-system", name: "unraid_get_system", arguments: "{}" }], outputItems: [] },
-        { content: "", toolCalls: [{ id: "sanctuary-boundary-settle", name: "settle", arguments: JSON.stringify({ answer: "boundary complete" }) }], outputItems: [] },
+        { content: "", toolCalls: [{ id: "sanctuary-boundary-terminal", name: terminal, arguments: JSON.stringify(inner ? { note: "boundary complete" } : { answer: "boundary complete", intent: "complete" }) }], outputItems: [] },
     ];
     let turn = 0;
     const controlOutputs = [];
     const providerRuntime = {
-        id: "minimax", model: "sanctuary-production-boundary-probe", client: null, capabilities: new Set(),
+        ...input.providerRuntime, client: null,
         streamTurn: async () => turns[turn++] ?? (() => { throw new Error("production boundary probe exceeded its turn budget"); })(),
         appendToolOutput: (callId, output) => { if (callId === "sanctuary-valid-system")
             controlOutputs.push(output); }, resetTurnState: () => undefined, ping: async () => undefined, classifyError: () => "unknown",
     };
     const receipts = [];
     const sanctuary = (0, sanctuary_runtime_1.createSanctuaryToolContext)(TARGET_ID).sanctuary;
+    const context = containmentToolContext(input.agentRoot, input.profileId);
+    const relationship = context.relationshipAuthorization;
+    const poisonedContext = { ...context, sanctuary, relationshipAuthorization: {
+            ...relationship, advertisedToolNames: [...relationship.advertisedToolNames, ...excludedNames, "mcp__containment_poison"],
+        } };
     const observed = await (0, sanctuary_runtime_1.runWithSanctuaryToolReceiptCollection)(() => (0, core_1.runAgent)([{ role: "user", content: "Run the bounded production tool authorization probe." }], {
         onModelStart: () => undefined, onModelStreamStart: () => undefined, onTextChunk: () => undefined, onReasoningChunk: () => undefined,
         onToolStart: () => undefined, onToolEnd: () => undefined, onError: () => undefined, onClearText: () => undefined,
-    }, "telegram", undefined, {
-        tools: telegramSchemas, providerRuntimeOverride: providerRuntime, toolBoundaryObserver: (receipt) => receipts.push(receipt),
-        toolContext: { signin: async () => undefined, sanctuary },
+    }, inner ? "inner" : "telegram", undefined, {
+        skipKeptNotes: true, providerRuntimeOverride: providerRuntime, toolBoundaryObserver: (receipt) => receipts.push(receipt),
+        toolContext: poisonedContext,
     }));
     const controlReceipts = receipts.filter((receipt) => receipt.name === "unraid_get_system");
-    if (observed.result.outcome !== "settled" || controlReceipts.length !== 1
+    if (observed.result.outcome !== (inner ? "rested" : "settled") || controlReceipts.length !== 1
         || controlReceipts[0].reason !== "dispatched" || !controlReceipts[0].invoked || controlReceipts[0].sideEffect
         || observed.toolResultDigests.length !== 1 || controlOutputs.length !== 1
         || (0, node_crypto_1.createHash)("sha256").update(controlOutputs[0]).digest("hex") !== observed.toolResultDigests[0]) {
@@ -973,7 +1000,7 @@ async function runSanctuaryProductionBoundaryProbe(telegramSchemas) {
     if (controlResult.ok !== true || typeof controlData.sourceIdentityDigest !== "string" || !SHA256.test(controlData.sourceIdentityDigest)) {
         throw new Error("production boundary valid control result is invalid");
     }
-    return receipts.filter((receipt) => receipt.name !== "settle");
+    return receipts.filter((receipt) => receipt.name !== terminal);
 }
 function parseInteractiveDriverReceipt(raw, label, scenarioHandleDigest) {
     if (raw === null)
@@ -1505,26 +1532,52 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         })).sort((left, right) => left.name.localeCompare(right.name));
         const readRecord = inventory.find((record) => record.name === "Butler RO");
         const writeRecord = inventory.find((record) => record.name === "Butler RW");
+        const rawProfiles = (0, node_fs_1.readFileSync)(path.join(agentRoot, "tool-profiles.json"), "utf8");
+        const packagedProfiles = (0, node_fs_1.readFileSync)(path.resolve(__dirname, "../../../deploy/unraid/sanctuary.ouro/tool-profiles.json"), "utf8");
+        if (!(0, node_util_1.isDeepStrictEqual)(JSON.parse(rawProfiles), JSON.parse(packagedProfiles)))
+            throw new Error("Sanctuary containment profiles do not match the verified package");
         const relationshipRegistry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot);
-        const telegramProfile = relationshipRegistry.profiles["sanctuary-owner"];
-        const privateProfile = relationshipRegistry.profiles["sanctuary-event"];
-        const telegramNames = telegramProfile?.toolNames ?? [];
-        const privateNames = privateProfile?.toolNames ?? [];
-        const relationshipProfilesExact = telegramNames.length > 0 && privateNames.length > 0;
-        const flowSchemas = new Map([tools_1.ponderTool, tools_1.settleTool, tools_1.speakTool, tools_1.restTool].map((tool) => [tool.function.name, tool]));
-        const schemasFor = (names) => names.flatMap((name) => {
-            const schema = (0, tools_1.resolveToolDefinition)(name)?.tool ?? flowSchemas.get(name);
-            return schema ? [schema] : [];
-        });
-        const telegramSchemas = schemasFor(telegramNames);
-        const privateSchemas = schemasFor(privateNames);
-        const handlerResolves = (name) => typeof (0, tools_1.resolveToolDefinition)(name)?.handler === "function" || flowSchemas.has(name);
-        const resolvedHandlerCount = [...telegramNames, ...privateNames].filter(handlerResolves).length;
-        const handlersExact = resolvedHandlerCount === telegramNames.length + privateNames.length;
-        const excludedNames = ["shell", "read_file", "edit_file", "vault_get", "mcp_call", "exec", "credential_get"];
-        const excludedSchemaIntersection = excludedNames.filter((name) => telegramNames.includes(name) || privateNames.includes(name));
-        const productionBoundaryReceipts = await dependency(deps.runProductionBoundaryProbe, "production tool boundary probe")(telegramSchemas);
-        const excludedAttempts = productionBoundaryReceipts.filter((receipt) => excludedNames.includes(receipt.name));
+        const digest = (value) => (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+        const boundaryFor = async (profileId) => {
+            const profile = relationshipRegistry.profiles[profileId];
+            const inner = profileId === "sanctuary-event";
+            const runtime = await dependency(deps.providerRuntime, "current provider runtime")(inner ? "agent" : "human", { agentName: TARGET_ID, agentRoot });
+            const context = containmentToolContext(agentRoot, profileId);
+            const select = (toolContext) => (0, tools_1.selectToolsForChannel)((0, friends_1.getChannelCapabilities)(inner ? "inner" : "telegram"), undefined, undefined, runtime.capabilities, undefined, undefined, toolContext);
+            const selection = select(context);
+            const schemas = (0, tools_1.toolSelectionSchemas)(selection);
+            const schemaToolNames = schemas.map((tool) => tool.function.name);
+            const expectedNames = profile.toolNames.filter((name) => (inner || name !== "rest") && (name !== "set_reasoning_effort" || runtime.capabilities.has("reasoning-effort")));
+            const excludedNames = ["vault_get", "mcp_call", "exec", "credential_get", ...(profileId === "sanctuary-owner" ? [] : tools_1.SANCTUARY_OWNER_ADDITIONS)];
+            const poisoned = select({ ...context, relationshipAuthorization: {
+                    ...context.relationshipAuthorization, advertisedToolNames: [...profile.toolNames, ...excludedNames, "mcp__containment_poison"],
+                } });
+            const productionBoundaryReceipts = await dependency(deps.runProductionBoundaryProbe, "production tool boundary probe")({ agentRoot, profileId, providerRuntime: runtime });
+            const excludedAttempts = productionBoundaryReceipts.filter((receipt) => receipt.name !== "unraid_get_system");
+            return {
+                profileId, profileVersion: profile.version, profileDigest: digest(profile), profileToolNames: profile.toolNames,
+                providerCapabilities: [...runtime.capabilities], schemaDigest: digest(schemas), schemaToolNames,
+                ordinaryDefinitionCount: selection.ordinary.length, engineSchemaCount: selection.engine.length,
+                profileExact: true, schemasExact: (0, node_util_1.isDeepStrictEqual)([...schemaToolNames].sort(), [...expectedNames].sort()),
+                handlersExact: selection.ordinary.every((definition) => typeof definition.handler === "function") && selection.engine.every((schema) => [tools_1.ponderTool, tools_1.settleTool, tools_1.speakTool, tools_1.restTool].includes(schema)),
+                poisonedSchemaIntersectionCount: (0, tools_1.toolSelectionSchemas)(poisoned).filter((schema) => !schemaToolNames.includes(schema.function.name)).length,
+                excludedToolNames: excludedAttempts.map((receipt) => receipt.name),
+                excludedSchemaIntersectionCount: schemaToolNames.filter((name) => excludedNames.includes(name)).length,
+                fabricatedHandlerInvocationCount: excludedAttempts.filter((receipt) => receipt.invoked).length,
+                excludedToolAttemptCount: excludedAttempts.length,
+                excludedToolRejectedCount: excludedAttempts.filter((receipt) => receipt.reason === "profile_excluded").length,
+                excludedToolInvokedCount: excludedAttempts.filter((receipt) => receipt.invoked).length,
+                excludedToolSideEffectCount: excludedAttempts.filter((receipt) => receipt.sideEffect).length,
+                globallyResolvableExcludedToolCount: excludedAttempts.filter((receipt) => receipt.globallyResolvable).length,
+            };
+        };
+        const profileBoundaries = {
+            "sanctuary-owner": await boundaryFor("sanctuary-owner"),
+            "sanctuary-household": await boundaryFor("sanctuary-household"),
+            "sanctuary-event": await boundaryFor("sanctuary-event"),
+        };
+        if ((0, node_fs_1.readFileSync)(path.join(agentRoot, "tool-profiles.json"), "utf8") !== rawProfiles)
+            throw new Error("Sanctuary containment profiles changed during the audit");
         const restartDefinition = (0, tools_1.resolveToolDefinition)("unraid_restart_container");
         const writeApprovalPolicy = restartDefinition.approvalPolicy({ container: "calibre-web" });
         const writeApprovalPolicyExact = writeApprovalPolicy.kind === "required"
@@ -1543,30 +1596,16 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         }
         const rawWriteMaterialFieldCount = rawInventory.reduce((count, record) => count
             + Object.keys(record).filter((field) => /^(?:key|credential|secret|token)$/iu.test(field)).length, 0);
+        if (container && typeof container.readOnlyRoot !== "boolean")
+            throw new Error("containment root-mode observation must be boolean");
         containment = {
-            schemaVersion: "sanctuary-containment-audit-v1",
+            schemaVersion: "sanctuary-containment-audit-v2",
             keyCount: inventory.length,
             keyInventoryDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(redactedInventory)).digest("hex"),
             readScopeDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(readRecord ? flattenedPermissions(readRecord) : [])).digest("hex"),
             writeScopeDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(writeRecord ? flattenedPermissions(writeRecord) : [])).digest("hex"),
             keyRoleAssignmentCount: inventory.reduce((count, record) => count + record.roles.length, 0),
-            telegramToolCount: telegramNames.length,
-            telegramProfileDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(telegramNames)).digest("hex"),
-            telegramSchemaDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(telegramSchemas)).digest("hex"),
-            privateToolCount: privateNames.length,
-            privateProfileDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(privateNames)).digest("hex"),
-            privateSchemaDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(privateSchemas)).digest("hex"),
-            resolvedHandlerCount,
-            relationshipProfilesExact,
-            handlersExact,
-            excludedToolCount: excludedNames.length,
-            excludedSchemaIntersectionCount: excludedSchemaIntersection.length,
-            fabricatedHandlerInvocationCount: excludedSchemaIntersection.filter(handlerResolves).length,
-            excludedToolAttemptCount: excludedAttempts.length,
-            excludedToolRejectedCount: excludedAttempts.filter((attempt) => attempt.reason === "profile_excluded").length,
-            excludedToolInvokedCount: excludedAttempts.filter((attempt) => attempt.invoked).length,
-            excludedToolSideEffectCount: excludedAttempts.filter((attempt) => attempt.sideEffect).length,
-            globallyResolvableExcludedToolCount: excludedAttempts.filter((attempt) => attempt.globallyResolvable).length,
+            profileBoundaries,
             auditPathDigest: (0, node_crypto_1.createHash)("sha256").update(TELEGRAM_AUDIT).digest("hex"),
             auditLedgerDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(auditLedgerEntries)).digest("hex"),
             auditRecordCount: auditLedgerEntries.length,
@@ -1582,7 +1621,7 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
             updaterDisabled: container?.updaterDisabled === true,
             writableKeyExposure: container?.writableKeyExposure !== false,
             rawWriteMaterialFieldCount,
-            typedWriteExecutorCount: telegramNames.filter((name) => name === "unraid_restart_container" && writeApprovalPolicy.kind === "required").length,
+            typedWriteExecutorCount: relationshipRegistry.profiles["sanctuary-owner"].toolNames.filter((name) => name === "unraid_restart_container" && writeApprovalPolicy.kind === "required").length,
             writeApprovalPolicyDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(writeApprovalPolicy)).digest("hex"),
             writeApprovalPolicyExact,
             sensitiveMaterialObserved: auditContainsSensitiveMaterial(auditRaw ?? "", deps.telegramCredentials?.()) || rawWriteMaterialFieldCount > 0 || container?.writableKeyExposure === true,
@@ -1652,9 +1691,8 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
         digest: health && digestFiredWithinMs !== null ? { scheduleObserved: Boolean(cronRaw && canonicalSanctuaryHealthCronRegistered(cronRaw)), messageCount: scenarioDeliveries.filter((receipt) => receipt.kind === "digest" || receipt.kind === "transition_and_digest").length, firedWithinMs: digestFiredWithinMs, productionRestored: container?.running === true && container.health === "healthy" } : undefined,
         reboot,
         containment: containment ?? {
-            schemaVersion: "sanctuary-containment-audit-v1", keyCount: 0, keyInventoryDigest: "", readScopeDigest: "", writeScopeDigest: "", keyRoleAssignmentCount: 0,
-            telegramToolCount: 0, telegramProfileDigest: "", telegramSchemaDigest: "", privateToolCount: 0, privateProfileDigest: "", privateSchemaDigest: "", resolvedHandlerCount: 0, relationshipProfilesExact: false, handlersExact: false,
-            excludedToolCount: 0, excludedSchemaIntersectionCount: 0, fabricatedHandlerInvocationCount: 0, excludedToolAttemptCount: 0, excludedToolRejectedCount: 0, excludedToolInvokedCount: 0, excludedToolSideEffectCount: 0, globallyResolvableExcludedToolCount: 0, auditPathDigest: "", auditLedgerDigest: "", auditRecordCount: 0, auditLifecyclePairCount: 0,
+            schemaVersion: "sanctuary-containment-audit-v2", keyCount: 0, keyInventoryDigest: "", readScopeDigest: "", writeScopeDigest: "", keyRoleAssignmentCount: 0,
+            profileBoundaries: null, auditPathDigest: "", auditLedgerDigest: "", auditRecordCount: 0, auditLifecyclePairCount: 0,
             containerUser: "", liveProcessUser: "", mountCount: 0, publishedPortCount: 0, networkMode: "", readOnlyRoot: false, mountsExact: false, securityExact: false, updaterDisabled: false,
             writableKeyExposure: container?.writableKeyExposure === true, rawWriteMaterialFieldCount: 0, typedWriteExecutorCount: 0, writeApprovalPolicyDigest: "", writeApprovalPolicyExact: false,
             sensitiveMaterialObserved: auditContainsSensitiveMaterial(auditRaw ?? "") || container?.writableKeyExposure === true,

package/dist/heart/daemon/sanctuary-acceptance-harness.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SANCTUARY_SCENARIO_SOURCES = exports.SANCTUARY_SCENARIO_GATES = exports.SANCTUARY_UNIT_16_EVIDENCE_LABELS = void 0;
+exports.exactSanctuaryContainmentProfileBoundaries = exactSanctuaryContainmentProfileBoundaries;
 exports.resolveSanctuaryAdapterTimeoutMs = resolveSanctuaryAdapterTimeoutMs;
 exports.createSanctuaryAcceptanceHarnessDependencies = createSanctuaryAcceptanceHarnessDependencies;
 exports.sanctuaryScenarioTimeoutBudget = sanctuaryScenarioTimeoutBudget;
@@ -44,14 +45,57 @@ const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_fs_2 = require("node:fs");
 const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const friends_1 = require("@ouro.bot/friends");
 const runtime_1 = require("../../nerves/runtime");
 const telegram_1 = require("../../senses/telegram");
 const runtime_credentials_1 = require("../runtime-credentials");
+const relationship_authorization_1 = require("../../repertoire/relationship-authorization");
+const tools_1 = require("../../repertoire/tools");
 const MAX_ADAPTER_OUTPUT = 1_048_576;
 const DEFAULT_ADAPTER_TIMEOUT_MS = 240_000;
 const DEFAULT_TELEGRAM_TIMEOUT_MS = 10_000;
 const PACKAGED_PROVENANCE_ADAPTER = "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh";
 const OPAQUE_DIGEST = /^[0-9a-f]{64}$/u;
+function exactSanctuaryContainmentProfileBoundaries(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const boundaries = value;
+    const versions = { "sanctuary-owner": 8, "sanctuary-household": 5, "sanctuary-event": 4 };
+    if (!(0, node_util_1.isDeepStrictEqual)(Object.keys(boundaries).sort(), Object.keys(versions).sort()))
+        return false;
+    const packageRoot = path.resolve(__dirname, "../../../deploy/unraid/sanctuary.ouro");
+    const registry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(packageRoot);
+    const digest = (input) => (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(input)).digest("hex");
+    return Object.entries(versions).every(([id, version]) => {
+        const raw = boundaries[id];
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return false;
+        const boundary = raw;
+        const capabilities = boundary.providerCapabilities;
+        if (!Array.isArray(capabilities) || !capabilities.every((entry) => entry === "reasoning-effort" || entry === "phase-annotation")
+            || new Set(capabilities).size !== capabilities.length)
+            return false;
+        const profile = registry.profiles[id];
+        if (profile.version !== version)
+            return false;
+        const selection = (0, tools_1.selectToolsForChannel)((0, friends_1.getChannelCapabilities)(id === "sanctuary-event" ? "inner" : "telegram"), undefined, undefined, new Set(capabilities), undefined, undefined, {
+            agentName: "sanctuary", relationshipAuthorization: { profileId: id, advertisedToolNames: profile.toolNames },
+        });
+        const schemas = (0, tools_1.toolSelectionSchemas)(selection);
+        const excludedToolNames = ["vault_get", "mcp_call", "exec", "credential_get", ...(id === "sanctuary-owner" ? [] : tools_1.SANCTUARY_OWNER_ADDITIONS)];
+        const globallyResolvableExcludedToolCount = excludedToolNames.filter((name) => (0, tools_1.resolveToolDefinition)(name)).length;
+        return globallyResolvableExcludedToolCount > 0 && (0, node_util_1.isDeepStrictEqual)(boundary, {
+            profileId: id, profileVersion: version, profileDigest: digest(profile), profileToolNames: profile.toolNames,
+            providerCapabilities: capabilities, schemaDigest: digest(schemas), schemaToolNames: schemas.map((tool) => tool.function.name),
+            ordinaryDefinitionCount: selection.ordinary.length, engineSchemaCount: selection.engine.length,
+            profileExact: true, schemasExact: true, handlersExact: true, poisonedSchemaIntersectionCount: 0,
+            excludedToolNames, excludedSchemaIntersectionCount: 0, fabricatedHandlerInvocationCount: 0,
+            excludedToolAttemptCount: excludedToolNames.length, excludedToolRejectedCount: excludedToolNames.length,
+            excludedToolInvokedCount: 0, excludedToolSideEffectCount: 0, globallyResolvableExcludedToolCount,
+        });
+    });
+}
 function resolveSanctuaryAdapterTimeoutMs(configured, remaining) {
     const maximum = configured ?? DEFAULT_ADAPTER_TIMEOUT_MS;
     return Math.max(1, Math.min(maximum, remaining ?? maximum));
@@ -494,15 +538,14 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
         case "unit-16e-containment-audit":
             exact([
                 "schemaVersion", "keyCount", "keyInventoryDigest", "readScopeDigest", "writeScopeDigest", "keyRoleAssignmentCount",
-                "telegramToolCount", "telegramProfileDigest", "telegramSchemaDigest", "privateToolCount", "privateProfileDigest", "privateSchemaDigest", "resolvedHandlerCount", "relationshipProfilesExact", "handlersExact",
-                "excludedToolCount", "excludedSchemaIntersectionCount", "fabricatedHandlerInvocationCount", "excludedToolAttemptCount", "excludedToolRejectedCount", "excludedToolInvokedCount", "excludedToolSideEffectCount", "globallyResolvableExcludedToolCount",
+                "profileBoundaries",
                 "auditPathDigest", "auditLedgerDigest", "auditRecordCount", "auditLifecyclePairCount",
                 "containerUser", "liveProcessUser", "mountCount", "publishedPortCount", "networkMode", "readOnlyRoot", "mountsExact", "securityExact", "updaterDisabled", "writableKeyExposure",
                 "rawWriteMaterialFieldCount", "typedWriteExecutorCount", "writeApprovalPolicyDigest", "writeApprovalPolicyExact", "sensitiveMaterialObserved", "mutationCount",
             ]);
-            if (text(value.schemaVersion, `${label} schemaVersion`) !== "sanctuary-containment-audit-v1")
+            if (text(value.schemaVersion, `${label} schemaVersion`) !== "sanctuary-containment-audit-v2")
                 throw new Error(`${label} schemaVersion is invalid`);
-            for (const key of ["keyInventoryDigest", "readScopeDigest", "writeScopeDigest", "telegramProfileDigest", "telegramSchemaDigest", "privateProfileDigest", "privateSchemaDigest", "auditPathDigest", "auditLedgerDigest", "writeApprovalPolicyDigest"])
+            for (const key of ["keyInventoryDigest", "readScopeDigest", "writeScopeDigest", "auditPathDigest", "auditLedgerDigest", "writeApprovalPolicyDigest"])
                 opaqueDigest(value[key], `${label} ${key}`);
             for (const [key, expected] of Object.entries({
                 readScopeDigest: "9914469afdcb574937d1020a03faa82e3c02d767169d3eccae4b81863dafa06e",
@@ -513,24 +556,19 @@ function validateSanctuaryUnit16EvidenceAssertions(label, raw) {
                     throw new Error(`${label} ${key} does not match the canonical contract`);
             requiredInteger(value, "keyCount", 2, label);
             requiredInteger(value, "keyRoleAssignmentCount", 0, label);
-            const telegramToolCount = integer(value.telegramToolCount, `${label} telegramToolCount`, 1);
-            const privateToolCount = integer(value.privateToolCount, `${label} privateToolCount`, 1);
-            if (integer(value.resolvedHandlerCount, `${label} resolvedHandlerCount`, 1) !== telegramToolCount + privateToolCount)
-                throw new Error(`${label} handler count does not match the live relationship profiles`);
-            requiredInteger(value, "excludedToolCount", 7, label);
-            requiredInteger(value, "excludedToolAttemptCount", 7, label);
-            requiredInteger(value, "excludedToolRejectedCount", 7, label);
-            integer(value.globallyResolvableExcludedToolCount, `${label} globallyResolvableExcludedToolCount`, 1);
-            allZero(["excludedSchemaIntersectionCount", "fabricatedHandlerInvocationCount", "excludedToolInvokedCount", "excludedToolSideEffectCount", "publishedPortCount", "rawWriteMaterialFieldCount", "mutationCount"]);
+            if (!exactSanctuaryContainmentProfileBoundaries(value.profileBoundaries))
+                throw new Error(`${label} profileBoundaries do not match the canonical contract`);
+            allZero(["publishedPortCount", "rawWriteMaterialFieldCount", "mutationCount"]);
             requiredFalse(value, "sensitiveMaterialObserved", label);
             requiredFalse(value, "writableKeyExposure", label);
+            requiredFalse(value, "readOnlyRoot", label);
             integer(value.auditRecordCount, `${label} auditRecordCount`, 2);
             integer(value.auditLifecyclePairCount, `${label} auditLifecyclePairCount`, 1);
             if (text(value.containerUser, `${label} containerUser`) !== "10001:10001" || text(value.liveProcessUser, `${label} liveProcessUser`) !== "10001:10001" || text(value.networkMode, `${label} networkMode`) !== "host")
                 throw new Error(`${label} container identity or network is invalid`);
-            requiredInteger(value, "mountCount", 4, label);
+            requiredInteger(value, "mountCount", 3, label);
             requiredInteger(value, "typedWriteExecutorCount", 1, label);
-            allTrue(["relationshipProfilesExact", "handlersExact", "writeApprovalPolicyExact", "readOnlyRoot", "mountsExact", "securityExact", "updaterDisabled"]);
+            allTrue(["writeApprovalPolicyExact", "mountsExact", "securityExact", "updaterDisabled"]);
             break;
         case "unit-16e-1-stop-denial":
         case "unit-16e-2-restart-denial":

package/dist/heart/daemon/sanctuary-acceptance-scenarios.js

@@ -121,30 +121,19 @@ function hash(value) {
 }
 const CONTAINMENT_READ_SCOPE = ["ARRAY", "DASHBOARD", "DISK", "DOCKER", "INFO", "LOGS", "NOTIFICATIONS", "SHARE", "VARS"]
     .map((resource) => `${resource}:READ_ANY`).sort();
-const CONTAINMENT_EXCLUDED_TOOLS = ["shell", "read_file", "edit_file", "vault_get", "mcp_call", "exec", "credential_get"];
 const CONTAINMENT_AUDIT_PATH = "/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance/telegram-audit-chain.ndjson";
 function exactContainmentAudit(evidence) {
-    const digestFields = [evidence.keyInventoryDigest, evidence.telegramProfileDigest, evidence.telegramSchemaDigest, evidence.privateProfileDigest, evidence.privateSchemaDigest, evidence.auditLedgerDigest, evidence.writeApprovalPolicyDigest];
-    return evidence.schemaVersion === "sanctuary-containment-audit-v1"
+    const digestFields = [evidence.keyInventoryDigest, evidence.auditLedgerDigest, evidence.writeApprovalPolicyDigest];
+    return evidence.schemaVersion === "sanctuary-containment-audit-v2"
         && evidence.keyCount === 2
         && evidence.readScopeDigest === hash(CONTAINMENT_READ_SCOPE)
         && evidence.writeScopeDigest === hash([...CONTAINMENT_READ_SCOPE, "DOCKER:UPDATE_ANY"].sort())
         && evidence.keyRoleAssignmentCount === 0
-        && Number.isSafeInteger(evidence.telegramToolCount) && evidence.telegramToolCount > 0
-        && Number.isSafeInteger(evidence.privateToolCount) && evidence.privateToolCount > 0
-        && evidence.relationshipProfilesExact && evidence.handlersExact
-        && evidence.resolvedHandlerCount === evidence.telegramToolCount + evidence.privateToolCount
-        && evidence.excludedToolCount === CONTAINMENT_EXCLUDED_TOOLS.length
-        && evidence.excludedSchemaIntersectionCount === 0
-        && evidence.fabricatedHandlerInvocationCount === 0
-        && evidence.excludedToolAttemptCount === CONTAINMENT_EXCLUDED_TOOLS.length
-        && evidence.excludedToolRejectedCount === CONTAINMENT_EXCLUDED_TOOLS.length
-        && evidence.excludedToolInvokedCount === 0 && evidence.excludedToolSideEffectCount === 0
-        && evidence.globallyResolvableExcludedToolCount >= 1
+        && (0, sanctuary_acceptance_harness_1.exactSanctuaryContainmentProfileBoundaries)(evidence.profileBoundaries)
         && evidence.auditPathDigest === (0, node_crypto_1.createHash)("sha256").update(CONTAINMENT_AUDIT_PATH).digest("hex")
         && evidence.auditRecordCount >= 2 && evidence.auditLifecyclePairCount >= 1
-        && evidence.containerUser === "10001:10001" && evidence.liveProcessUser === "10001:10001" && evidence.mountCount === 4 && evidence.publishedPortCount === 0
-        && evidence.networkMode === "host" && evidence.readOnlyRoot && evidence.mountsExact && evidence.securityExact && evidence.updaterDisabled
+        && evidence.containerUser === "10001:10001" && evidence.liveProcessUser === "10001:10001" && evidence.mountCount === 3 && evidence.publishedPortCount === 0
+        && evidence.networkMode === "host" && evidence.readOnlyRoot === false && evidence.mountsExact && evidence.securityExact && evidence.updaterDisabled
         && !evidence.writableKeyExposure && evidence.rawWriteMaterialFieldCount === 0 && evidence.typedWriteExecutorCount === 1
         && evidence.writeApprovalPolicyExact && !evidence.sensitiveMaterialObserved
         && digestFields.every((value) => SHA256.test(value));
@@ -499,16 +488,7 @@ function deriveSanctuaryScenarioAssertions(label, before, after, _now, scenarioH
                 keyCount: after.containment.keyCount, keyInventoryDigest: after.containment.keyInventoryDigest,
                 readScopeDigest: after.containment.readScopeDigest, writeScopeDigest: after.containment.writeScopeDigest,
                 keyRoleAssignmentCount: after.containment.keyRoleAssignmentCount,
-                telegramToolCount: after.containment.telegramToolCount, telegramProfileDigest: after.containment.telegramProfileDigest,
-                telegramSchemaDigest: after.containment.telegramSchemaDigest,
-                privateToolCount: after.containment.privateToolCount, privateProfileDigest: after.containment.privateProfileDigest,
-                privateSchemaDigest: after.containment.privateSchemaDigest, resolvedHandlerCount: after.containment.resolvedHandlerCount,
-                relationshipProfilesExact: after.containment.relationshipProfilesExact, handlersExact: after.containment.handlersExact,
-                excludedToolCount: after.containment.excludedToolCount, excludedSchemaIntersectionCount: after.containment.excludedSchemaIntersectionCount,
-                fabricatedHandlerInvocationCount: after.containment.fabricatedHandlerInvocationCount,
-                excludedToolAttemptCount: after.containment.excludedToolAttemptCount, excludedToolRejectedCount: after.containment.excludedToolRejectedCount,
-                excludedToolInvokedCount: after.containment.excludedToolInvokedCount, excludedToolSideEffectCount: after.containment.excludedToolSideEffectCount,
-                globallyResolvableExcludedToolCount: after.containment.globallyResolvableExcludedToolCount,
+                profileBoundaries: after.containment.profileBoundaries,
                 auditPathDigest: after.containment.auditPathDigest, auditLedgerDigest: after.containment.auditLedgerDigest,
                 auditRecordCount: after.containment.auditRecordCount, auditLifecyclePairCount: after.containment.auditLifecyclePairCount,
                 containerUser: after.containment.containerUser, liveProcessUser: after.containment.liveProcessUser, mountCount: after.containment.mountCount,