@ouro.bot/cli 0.1.0-alpha.822 → 0.1.0-alpha.824

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.824",
+      "changes": [
+        "Sanctuary: vault removal is reachable only from the authority install transaction, so the destructive verb can no longer be run bare against a host with no root authority installed."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.823",
+      "changes": [
+        "Make a promised follow-up an obligation the Butler returns to unasked."
+      ]
+    },
     {
       "version": "0.1.0-alpha.822",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.822",
+  "runtimeVersion": "0.1.0-alpha.824",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.ouro/psyche/TACIT.md

@@ -7,6 +7,8 @@
 - For Ari's whole-household status questions, read current evidence before answering and separate active work, waiting on Ari, snoozed wake times, intentionally quiet services, healthy systems, and other current issues. Do not narrate daemon, event-queue, provider-lane, or backend service internals; translate them into compact household outcomes only when they are currently relevant.
 - For household media questions, use the media tools when they are available and the restricted catalog read otherwise. Answer like a tasteful steward of the shelf: pick, recommend, compare, or confirm from current evidence without volunteering an AI or `I cannot watch` disclaimer.
 - Check shelf state before naming a title. Never suggest going to find something that is already here, and never name a title the current search did not return.
+- A promise of follow-up is an obligation, not a pleasantry. When I say I will watch something, check back, or tell Ari when it lands, I file the watch in the same turn and I return to it unasked — when it happens, when it clearly will not, or when I have been quiet long enough that silence has become the answer. Ari should never have to ask whether I am still on it.
+- Closing a loop is worth a short message even when the news is dull. "Still nothing, here is why, next check is X" is a better neighbour than silence.
 - Do not open a reply by announcing its honesty. Say the true thing plainly; `Honest:`, `Honest answer:`, and `To be honest` add nothing and read as apology. Report a limit once, without ceremony, and never in place of an answer that the tools can actually give.
 - Never touch array/parity/disk configuration, permissions, network/security settings, or `/mnt/user` paths.
 - Never send server data off-box or enter credentials into another system.

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.822</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.824</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -739,6 +739,7 @@ class SanctuaryAuthorityRootLifecycle {
             "--mount", `type=bind,src=${BUNDLE},dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly`,
             "--tmpfs", "/home/ouro/.ouro-cli/bitwarden:rw,nosuid,nodev,noexec,mode=0700",
             "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,mode=0700",
+            "--env", `OURO_AUTHORITY_REMOVE_INTERLOCK=${this.#request.epochId}`,
             this.#transaction.targetImageId, "/opt/ouro/dist/heart/daemon/sanctuary-authority-root-lifecycle.js", "vault", operation,
         ], input === undefined ? undefined : JSON.stringify(input)));
     }
@@ -748,6 +749,17 @@ async function runSanctuaryAuthorityRootCli(argv, write = (text) => process.stdo
     if (process.getuid() !== 0 || process.getgid() !== 0)
         throw new Error("Sanctuary root lifecycle requires root");
     if (argv.length === 2 && argv[0] === "vault") {
+        // `remove` is the one vault verb that can strand the household. It is safe
+        // only inside the install transaction, which has already proven the same
+        // token into root custody at `verify-token-rotation`. Run bare against a
+        // host with no installed root authority it leaves the Butler with no route
+        // to Telegram at all, which is how Sanctuary lost its front door on
+        // 2026-09-21. This is a safety interlock against invoking it outside its
+        // transaction, not a privilege boundary: root can always set the variable,
+        // but it can no longer do this by reaching for a documented verb.
+        if (argv[1] === "remove" && !process.env.OURO_AUTHORITY_REMOVE_INTERLOCK) {
+            throw new Error("Sanctuary vault removal runs only inside the authority install transaction; use docker-man-template-transaction.mjs authority-install");
+        }
         const input = argv[1] === "restore" ? JSON.parse(fs.readFileSync(0, "utf8")) : undefined;
         write(`${JSON.stringify(await (0, sanctuary_authority_vault_migration_1.migrateSanctuaryAuthorityVault)(argv[1], input))}\n`);
         return;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.822",
+  "version": "0.1.0-alpha.824",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.822",
+      "version": "0.1.0-alpha.824",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.822",
+  "version": "0.1.0-alpha.824",
   "engines": {
     "node": ">=22"
   },