@ouro.bot/cli 0.1.0-alpha.815 → 0.1.0-alpha.817

package/assets/sanctuary-host-launcher.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 4 ]; then
+  exit 64
+fi
+
+cgroup_procs=$1
+prlimit=$2
+setsid=$3
+shift 3
+
+printf '%s\n' "$$" > "$cgroup_procs"
+printf 'ready\n' >&3
+exec 3>&-
+exec "$prlimit" --nproc=256 --as=1073741824 -- "$setsid" --wait "$@"

package/changelog.json

@@ -1,6 +1,24 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.817",
+      "changes": [
+        "Add root-authenticated Sanctuary host execution with exact owner approval, one-time permits, durable receipts, and tokenless Telegram transport.",
+        "Package journaled token/cursor migration and rollback with exact read-only authority socket mounts, preserving typed tools and owner-authored steward policy.",
+        "Keep Telegram and retirement available during execution-pin maintenance, with a root-only reviewed-hash refresh command that preserves authority identity and state.",
+        "Verify Linux system executable aliases against their resolved owned bytes without changing invocation paths or relaxing package-script pinning.",
+        "Build the pinned SQLite binding for the image libc, verify a real database load, and remove build-only artifacts before publication."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.816",
+      "changes": [
+        "Support bounded Sanctuary service restarts only when a fresh request or health event intersects with explicit owner-stated desired state and restart grants.",
+        "Record applied policy changes, recheck authority and exact service identity before each restart, enforce durable restart limits, and preserve honest action and verification outcomes through approvals and event recovery.",
+        "Document fresh post-install owner provisioning and retire the fulfilled alpha.797 source-adoption path while preserving current package-managed update, recovery and empty packaged authority."
+      ]
+    },
     {
       "version": "0.1.0-alpha.815",
       "changes": [

package/deploy/unraid/Dockerfile

@@ -1,6 +1,7 @@
 FROM node:22-bookworm-slim
 
 LABEL org.opencontainers.image.source="https://github.com/ourostack/ouroboros"
+LABEL bot.ouro.sanctuary.mount-contract="canonical-gateway"
 
 ARG TARGETARCH
 ARG SUPERCRONIC_AMD64_SHA256=5adff01c5a797663948e656d2b61d10932369ee437eb5cb54fa872b2960f222b
@@ -18,6 +19,10 @@ RUN apt-get update \
 WORKDIR /opt/ouro
 COPY package.json npm-shrinkwrap.json ./
 RUN npm ci --omit=dev --legacy-peer-deps --workspaces=false --no-audit --no-fund \
+  && npm run build-release --prefix node_modules/better-sqlite3 \
+  && cp node_modules/better-sqlite3/build/Release/better_sqlite3.node "node_modules/better-sqlite3/prebuilds/linux-$(node -p process.arch).node" \
+  && node -e 'const Database = require("better-sqlite3"); const db = new Database(":memory:"); if (db.prepare("SELECT 1 AS ready").get().ready !== 1) process.exit(1); db.close()' \
+  && rm -rf node_modules/better-sqlite3/build \
   && test -x /opt/ouro/node_modules/.bin/bw \
   && ln -s /opt/ouro/node_modules/.bin/bw /usr/local/bin/bw
 COPY dist ./dist
@@ -26,6 +31,7 @@ COPY skills ./skills
 COPY changelog.json ./changelog.json
 COPY deploy/unraid/container-runtime.json ./container-runtime.json
 COPY deploy/unraid /opt/ouro/deploy/unraid
+COPY assets/sanctuary-host-launcher.sh /opt/ouro/deploy/unraid/sanctuary-host-launcher.sh
 RUN chown -R 10001:10001 /opt/ouro /home/ouro
 
 USER 10001:10001