@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/deploy/unraid/sanctuary-unit16-run.sh

@@ -0,0 +1,560 @@
+#!/bin/sh
+set -eu
+
+RUNTIME_ROOT=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli
+BUNDLE_ROOT=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro
+test "$#" -ge 1 || exit 2
+IMAGE_ID=$1
+shift
+TARGET_PROFILE=staging
+if test "${1:-}" = --profile; then
+  test "$#" -ge 2 || exit 2
+  TARGET_PROFILE=$2
+  shift 2
+fi
+case "$TARGET_PROFILE" in
+  staging)
+    CONFIG_ROOT=/mnt/user/appdata/ouro-butler/acceptance/configs
+    EVIDENCE_ROOT=/mnt/user/appdata/ouro-butler/acceptance/evidence
+    PRODUCTION_CONTAINER=ouro-butler-staging
+    ;;
+  final)
+    CONFIG_ROOT=/mnt/user/appdata/ouro-butler/acceptance/final/configs
+    EVIDENCE_ROOT=/mnt/user/appdata/ouro-butler/acceptance/final/evidence
+    PRODUCTION_CONTAINER=ouro-butler
+    ;;
+  *) exit 2 ;;
+esac
+TARGET_CONTAINER_ID=
+MODE=${1:-}
+case "$MODE" in --*) exit 2 ;; esac
+BROKER_PID=
+PRIVATE_ROOT=
+PRODUCTION_STOPPED=no
+HOST_REBOOT_COMMIT_STATE=not_sent
+ACCEPTANCE_ALIAS_MOUNTED=no
+ACCEPTANCE_CANONICAL_PINNED=no
+ACCEPTANCE_PIN_ROOT=
+ACCEPTANCE_STATE_ROOT=
+
+assert_health_probe_cleanup() {
+  /usr/bin/timeout -s KILL 10 /usr/local/bin/node -e '
+    const fs = require("node:fs");
+    const path = require("node:path");
+    const acceptance = process.argv[1];
+    for (const name of ["health-probe-workspaces", "health-probe-pending", "health-probe-processes"]) {
+      const target = path.join(acceptance, name);
+      if (fs.existsSync(target) && fs.readdirSync(target).length !== 0) process.exit(1);
+    }
+    if (fs.existsSync(process.argv[2])) process.exit(1);
+  ' "$ACCEPTANCE_STATE_ROOT" "$BUNDLE_ROOT/state/health/sanctuary-health.json.lease"
+}
+
+terminate_broker() {
+  test -n "$BROKER_PID" || return 0
+  kill "$BROKER_PID" 2>/dev/null || true
+  BROKER_WAIT=0
+  while kill -0 "$BROKER_PID" 2>/dev/null && test "$BROKER_WAIT" -lt 10; do
+    sleep 1
+    BROKER_WAIT=$(( BROKER_WAIT + 1 ))
+  done
+  if kill -0 "$BROKER_PID" 2>/dev/null; then kill -KILL "$BROKER_PID" 2>/dev/null || true; fi
+  wait "$BROKER_PID" 2>/dev/null || true
+  BROKER_PID=
+}
+
+cleanup_unit16() {
+  CLEANUP_STATUS=$?
+  terminate_broker
+  if test "$ACCEPTANCE_CANONICAL_PINNED" = yes && ! assert_health_probe_cleanup; then CLEANUP_STATUS=1; fi
+  if test "$PRODUCTION_STOPPED" = yes && test "$HOST_REBOOT_COMMIT_STATE" = not_sent; then
+    if ! restore_production_container; then CLEANUP_STATUS=1; fi
+    PRODUCTION_STOPPED=no
+  fi
+  if test "$ACCEPTANCE_CANONICAL_PINNED" = yes; then
+    if /usr/bin/timeout -s KILL 10 /bin/umount "$ACCEPTANCE_STATE_ROOT"; then
+      ACCEPTANCE_CANONICAL_PINNED=no
+    else CLEANUP_STATUS=1
+    fi
+  fi
+  if test "$ACCEPTANCE_ALIAS_MOUNTED" = yes; then
+    if /usr/bin/timeout -s KILL 10 /bin/umount "$ACCEPTANCE_PIN_ROOT"; then
+      ACCEPTANCE_ALIAS_MOUNTED=no
+    else CLEANUP_STATUS=1
+    fi
+  fi
+  if test "$ACCEPTANCE_ALIAS_MOUNTED" = no && test -n "$PRIVATE_ROOT" && test -d "$PRIVATE_ROOT"; then rm -rf -- "$PRIVATE_ROOT"; fi
+  return "$CLEANUP_STATUS"
+}
+trap cleanup_unit16 EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+case "$MODE" in
+  materialize)
+    test "$#" -eq 2 || { test "$#" -eq 3 && test "$2" = cursor-snapshot; } || exit 2
+    COMMAND=${2:-}
+    PHASE=${3:-}
+    ;;
+  *)
+    test "$#" -eq 2 || exit 2
+    COMMAND=$MODE
+    CONFIG_NAME=${2:-}
+    ;;
+esac
+case "$COMMAND" in
+  telegram-bootstrap|cursor-snapshot|cursor-delta|callback-inject|unraid-key-rotate|evidence-snapshot|reboot-request|reboot-resume|evidence-bundle-index|evidence-bundle-verify) ;;
+  *) exit 2 ;;
+esac
+
+IMAGE_DIGEST=${IMAGE_ID#sha256:}
+test "$IMAGE_DIGEST" != "$IMAGE_ID" || exit 2
+test "${#IMAGE_DIGEST}" -eq 64 || exit 2
+case "$IMAGE_DIGEST" in *[!0-9a-f]*) exit 2 ;; esac
+test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker image inspect --format '{{.Id}}' "$IMAGE_ID")" = "$IMAGE_ID" || exit 1
+test -d "$CONFIG_ROOT" && test ! -L "$CONFIG_ROOT" || exit 1
+test -d "$EVIDENCE_ROOT" && test ! -L "$EVIDENCE_ROOT" || exit 1
+test "$(stat -c '%u:%g %a' "$CONFIG_ROOT")" = "10001:10001 700" || exit 1
+test "$(stat -c '%u:%g %a' "$EVIDENCE_ROOT")" = "10001:10001 700" || exit 1
+
+PRIVATE_ROOT=$(mktemp -d /run/ouro-unit16.XXXXXX)
+chmod 0700 "$PRIVATE_ROOT"
+chown 0:0 "$PRIVATE_ROOT"
+SOCKET_ROOT=$PRIVATE_ROOT/socket
+install -d -m 0750 -o 0 -g 10001 "$SOCKET_ROOT"
+BROKER_SOCKET=$SOCKET_ROOT/adapter.sock
+CLOSED_INVENTORY=$PRIVATE_ROOT/closed-inventory.json
+BROKER_SNAPSHOT=$PRIVATE_ROOT/broker-container-inspect.json
+BROKER_PROGRAM=$PRIVATE_ROOT/sanctuary-unit16-host-broker.mjs
+TARGET_AUDITOR=$PRIVATE_ROOT/sanctuary-deployment-target.mjs
+IMAGE_FACT=$PRIVATE_ROOT/image-digest
+CONTAINER_FACT=$PRIVATE_ROOT/container-digest
+PROCESS_BINDING_FACT=$PRIVATE_ROOT/process-binding-digest
+HEALTH_FACT=$PRIVATE_ROOT/postboot-health.json
+CONTAINER_INSPECT_FACT=$PRIVATE_ROOT/container-inspect.json
+
+start_broker() {
+  /usr/bin/timeout -s KILL 20 /usr/bin/docker run --rm --pull=never --network none \
+    --entrypoint /bin/cat "$IMAGE_ID" /opt/ouro/deploy/unraid/sanctuary-deployment-target.mjs >"$TARGET_AUDITOR"
+  /usr/bin/timeout -s KILL 20 /usr/bin/docker run --rm --pull=never --network none \
+    --entrypoint /bin/cat "$IMAGE_ID" /opt/ouro/deploy/unraid/sanctuary-unit16-host-broker.mjs >"$BROKER_PROGRAM"
+  chmod 0500 "$BROKER_PROGRAM" "$TARGET_AUDITOR"
+  chown 0:0 "$BROKER_PROGRAM" "$TARGET_AUDITOR"
+  /usr/local/bin/node "$TARGET_AUDITOR" "$TARGET_PROFILE" "$IMAGE_ID" >"$PRIVATE_ROOT/deployment-target.json"
+  chmod 0400 "$PRIVATE_ROOT/deployment-target.json"
+  chown 0:0 "$PRIVATE_ROOT/deployment-target.json"
+  TARGET_CONTAINER_BINDING=$(/usr/local/bin/node -e '
+    const fs = require("node:fs"); const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); const deployment = value && value.deployment;
+    if (value?.schemaVersion !== "sanctuary-effective-deployment-v1" || deployment?.schemaVersion !== "sanctuary-deployment-target-v1"
+      || deployment.profile !== process.argv[3] || deployment.targetContainerName !== process.argv[4]
+      || deployment.targetImageId !== process.argv[2] || !/^[0-9a-f]{64}$/.test(deployment.targetContainerId)
+      || !Number.isSafeInteger(deployment.targetPid) || deployment.targetPid <= 0 || deployment.targetPid > 4_194_304) process.exit(1);
+    process.stdout.write(`${deployment.targetContainerId} ${deployment.targetPid}`);
+  ' "$PRIVATE_ROOT/deployment-target.json" "$IMAGE_ID" "$TARGET_PROFILE" "$PRODUCTION_CONTAINER")
+  set -- $TARGET_CONTAINER_BINDING
+  test "$#" -eq 2 || return 1
+  TARGET_CONTAINER_ID=$1
+  TARGET_CONTAINER_PID=$2
+  /usr/local/bin/node "$BROKER_PROGRAM" "$TARGET_PROFILE" "$TARGET_CONTAINER_ID" "$BROKER_SOCKET" "$CLOSED_INVENTORY" "$IMAGE_ID" "$BROKER_SNAPSHOT" </dev/null >/dev/null 2>&1 &
+  BROKER_PID=$!
+  ATTEMPT=0
+  while test "$ATTEMPT" -lt 600 && { test ! -S "$BROKER_SOCKET" || test ! -f "$CLOSED_INVENTORY" || test ! -f "$BROKER_SNAPSHOT"; }; do
+    kill -0 "$BROKER_PID" 2>/dev/null || return 1
+    ATTEMPT=$((ATTEMPT + 1))
+    sleep 0.1
+  done
+  test -S "$BROKER_SOCKET" || return 1
+  test "$(stat -c '%u:%g %a' "$BROKER_SOCKET")" = "0:10001 660" || return 1
+  test "$(stat -c '%u:%g %a' "$CLOSED_INVENTORY")" = "0:0 600" || return 1
+  test "$(stat -c '%u:%g %a' "$BROKER_SNAPSHOT")" = "0:0 600" || return 1
+  await_post_audit_health
+  refresh_live_facts
+}
+
+await_post_audit_health() {
+  POST_AUDIT_ATTEMPT=0
+  while test "$POST_AUDIT_ATTEMPT" -lt 120; do
+    POST_AUDIT_STATE=$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Id}} {{.Name}} {{.Image}} {{.State.Running}} {{.State.Paused}} {{.State.Restarting}} {{.State.Dead}} {{.State.Pid}} {{if .State.Health}}{{.State.Health.Status}}{{else}}missing{{end}}' "$TARGET_CONTAINER_ID") || return 1
+    set -- $POST_AUDIT_STATE
+    test "$#" -eq 9 || return 1
+    test "$1" = "$TARGET_CONTAINER_ID" && test "$2" = "/$PRODUCTION_CONTAINER" && test "$3" = "$IMAGE_ID" || return 1
+    test "$4" = true && test "$6" = false && test "$7" = false || return 1
+    test "$8" = "$TARGET_CONTAINER_PID" || return 1
+    if test "$5" = false && test "$9" = healthy; then return 0; fi
+    test "$5" = true || test "$5" = false || return 1
+    test "$9" = starting || test "$9" = unhealthy || return 1
+    POST_AUDIT_ATTEMPT=$((POST_AUDIT_ATTEMPT + 1))
+    sleep 1
+  done
+  return 1
+}
+
+prepare_live_facts() {
+  install -m 0444 -o 0 -g 0 "$BROKER_SNAPSHOT" "$CONTAINER_INSPECT_FACT"
+  /usr/local/bin/node -e '
+      const fs = require("node:fs");
+      const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+      const expectedKeys = ["autostartExact", "containerId", "health", "imageId", "liveProcessUser", "manualAuthRequired", "mountCount", "mountsDigest", "mountsExact", "networkMode", "processBindingDigest", "publishedPortCount", "readOnlyRoot", "recoveryMilestones", "restartCount", "restartPolicy", "running", "schemaVersion", "securityExact", "updaterDisabled", "user", "vaultUnlocked", "writableKeyExposure"];
+      if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify(expectedKeys) || value.schemaVersion !== 1
+        || value.imageId !== process.argv[2] || !/^[0-9a-f]{64}$/.test(value.containerId)
+        || value.liveProcessUser !== "10001:10001" || !/^[0-9a-f]{64}$/.test(value.processBindingDigest)
+        || !/^[0-9a-f]{64}$/.test(value.mountsDigest) || !Number.isSafeInteger(value.restartCount) || value.restartCount < 0
+        || typeof value.autostartExact !== "boolean" || typeof value.updaterDisabled !== "boolean"
+        || typeof value.vaultUnlocked !== "boolean" || typeof value.manualAuthRequired !== "boolean"
+        || typeof value.mountsExact !== "boolean" || typeof value.securityExact !== "boolean" || typeof value.writableKeyExposure !== "boolean") process.exit(1);
+      const milestones = value.recoveryMilestones;
+      if (!milestones || JSON.stringify(Object.keys(milestones).sort()) !== JSON.stringify(["arrayReady", "butlerReady", "dockerReady", "hostReady", "sshReady", "tailscaleReady"])
+        || !Object.values(milestones).every((entry) => typeof entry === "boolean")) process.exit(1);
+      fs.writeFileSync(process.argv[3], `${value.imageId.slice("sha256:".length)}\n`);
+      fs.writeFileSync(process.argv[4], `${value.containerId}\n`);
+      fs.writeFileSync(process.argv[5], `${JSON.stringify({ healthy: value.health === "healthy" })}\n`);
+      fs.writeFileSync(process.argv[6], `${value.processBindingDigest}\n`);
+    ' "$CONTAINER_INSPECT_FACT" "$IMAGE_ID" "$IMAGE_FACT" "$CONTAINER_FACT" "$HEALTH_FACT" "$PROCESS_BINDING_FACT"
+  chmod 0444 "$IMAGE_FACT" "$CONTAINER_FACT" "$PROCESS_BINDING_FACT" "$HEALTH_FACT" "$CONTAINER_INSPECT_FACT"
+  chown 0:0 "$IMAGE_FACT" "$CONTAINER_FACT" "$PROCESS_BINDING_FACT" "$HEALTH_FACT" "$CONTAINER_INSPECT_FACT"
+}
+
+refresh_live_facts() {
+  REFRESHED_SNAPSHOT=$PRIVATE_ROOT/broker-container-inspect.refresh.json
+  rm -f -- "$REFRESHED_SNAPSHOT"
+  /usr/bin/timeout -s KILL 60 /usr/local/bin/node -e '
+    const fs = require("node:fs");
+    const net = require("node:net");
+    const [socketPath, outputPath] = process.argv.slice(1);
+    const socket = net.createConnection(socketPath);
+    let response = "";
+    socket.setEncoding("utf8");
+    socket.on("connect", () => socket.end(JSON.stringify({ operation: "container_snapshot", targetId: "sanctuary" })));
+    socket.on("data", (chunk) => {
+      response += chunk;
+      if (Buffer.byteLength(response) > 1024 * 1024) socket.destroy(new Error("container snapshot response exceeds its bound"));
+    });
+    socket.on("end", () => {
+      const envelope = JSON.parse(response);
+      if (!envelope || envelope.ok !== true || !envelope.result || typeof envelope.result !== "object" || Array.isArray(envelope.result)) process.exit(1);
+      fs.writeFileSync(outputPath, `${JSON.stringify(envelope.result)}\n`, { flag: "wx", mode: 0o600 });
+    });
+    socket.on("error", () => process.exit(1));
+  ' "$BROKER_SOCKET" "$REFRESHED_SNAPSHOT"
+  test "$(stat -c '%u:%g %a' "$REFRESHED_SNAPSHOT")" = "0:0 600" || return 1
+  mv -f -- "$REFRESHED_SNAPSHOT" "$BROKER_SNAPSHOT"
+  prepare_live_facts
+}
+
+restore_production_container() {
+  EXPECTED_CONTAINER_ID=$(cat "$CONTAINER_FACT") || return 1
+  test "$EXPECTED_CONTAINER_ID" = "$TARGET_CONTAINER_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Id}}' "$EXPECTED_CONTAINER_ID")" = "$EXPECTED_CONTAINER_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Name}}' "$EXPECTED_CONTAINER_ID")" = "/$PRODUCTION_CONTAINER" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Image}}' "$EXPECTED_CONTAINER_ID")" = "$IMAGE_ID" || return 1
+  if test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.State.Running}}' "$EXPECTED_CONTAINER_ID")" = false; then
+    /usr/bin/timeout -s KILL 30 /usr/bin/docker start "$EXPECTED_CONTAINER_ID" >/dev/null || return 1
+  fi
+  RESTORE_ATTEMPT=0
+  while test "$RESTORE_ATTEMPT" -lt 120; do
+    test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Id}}' "$EXPECTED_CONTAINER_ID")" = "$EXPECTED_CONTAINER_ID" || return 1
+    RESTORE_RUNNING=$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.State.Running}}' "$EXPECTED_CONTAINER_ID") || return 1
+    RESTORE_HEALTH=$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}missing{{end}}' "$EXPECTED_CONTAINER_ID") || return 1
+    if test "$RESTORE_RUNNING" = true && test "$RESTORE_HEALTH" = healthy; then return 0; fi
+    RESTORE_ATTEMPT=$((RESTORE_ATTEMPT + 1))
+    sleep 1
+  done
+  return 1
+}
+
+stop_exact_production_container() {
+  EXPECTED_CONTAINER_ID=$(cat "$CONTAINER_FACT") || return 1
+  test "$EXPECTED_CONTAINER_ID" = "$TARGET_CONTAINER_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Id}}' "$EXPECTED_CONTAINER_ID")" = "$EXPECTED_CONTAINER_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Name}}' "$EXPECTED_CONTAINER_ID")" = "/$PRODUCTION_CONTAINER" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Image}}' "$EXPECTED_CONTAINER_ID")" = "$IMAGE_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.State.Running}}' "$EXPECTED_CONTAINER_ID")" = true || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}missing{{end}}' "$EXPECTED_CONTAINER_ID")" = healthy || return 1
+  PRODUCTION_STOPPED=yes
+  /usr/bin/timeout -s KILL 45 /usr/bin/docker stop --time 30 "$EXPECTED_CONTAINER_ID" >/dev/null || true
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Id}}' "$EXPECTED_CONTAINER_ID")" = "$EXPECTED_CONTAINER_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Image}}' "$EXPECTED_CONTAINER_ID")" = "$IMAGE_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.State.Running}}' "$EXPECTED_CONTAINER_ID")" = false || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.State.Pid}}' "$EXPECTED_CONTAINER_ID")" = 0 || return 1
+}
+
+materialize_config() {
+  OUTPUT=$1
+  SNAPSHOT_PHASE=${2:-}
+  EXTRA_MOUNT=
+  if test "$COMMAND" = unraid-key-rotate; then
+    test -f "$CLOSED_INVENTORY" || return 1
+    install -m 0400 -o 10001 -g 10001 "$CLOSED_INVENTORY" "$PRIVATE_ROOT/container-inventory.json"
+    EXTRA_MOUNT=$PRIVATE_ROOT/container-inventory.json
+  fi
+  if test -n "$EXTRA_MOUNT"; then
+    /usr/bin/timeout -s KILL 90 /usr/bin/docker run --rm --pull=never --network none \
+      --user 10001:10001 --read-only \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence,readonly" \
+      --mount "type=bind,src=$EXTRA_MOUNT,dst=/run/ouro-acceptance/closed-inventory.json,readonly" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh \
+      "$IMAGE_ID" materialize-config "$COMMAND" >"$OUTPUT"
+  elif test -n "$SNAPSHOT_PHASE"; then
+    /usr/bin/timeout -s KILL 90 /usr/bin/docker run --rm --pull=never --network none \
+      --user 10001:10001 --read-only \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence,readonly" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh \
+      "$IMAGE_ID" materialize-config "$COMMAND" "$SNAPSHOT_PHASE" >"$OUTPUT"
+  else
+    /usr/bin/timeout -s KILL 90 /usr/bin/docker run --rm --pull=never --network none \
+      --user 10001:10001 --read-only \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence,readonly" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh \
+      "$IMAGE_ID" materialize-config "$COMMAND" >"$OUTPUT"
+  fi
+  /usr/local/bin/node -e '
+    const fs = require("node:fs");
+    const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    if (!value || value.allowedRoot !== "/evidence") process.exit(1);
+  ' "$OUTPUT"
+}
+
+if test "$MODE" = materialize; then
+  CONFIG_NAME=$COMMAND.json
+  if test "$COMMAND" = unraid-key-rotate; then start_broker; fi
+  CONFIG_TMP=$(mktemp "$CONFIG_ROOT/.$CONFIG_NAME.tmp.XXXXXX")
+  materialize_config "$CONFIG_TMP" "${PHASE:-}"
+  install -m 0600 -o 10001 -g 10001 "$CONFIG_TMP" "$CONFIG_ROOT/$CONFIG_NAME"
+  sync -f "$CONFIG_ROOT/$CONFIG_NAME"
+  sync -f "$CONFIG_ROOT"
+  rm -f -- "$CONFIG_TMP"
+  exit 0
+fi
+
+test "$CONFIG_NAME" = "$COMMAND.json" || exit 2
+case "$CONFIG_NAME" in *[!A-Za-z0-9._-]*) exit 2 ;; esac
+CONFIG_PATH=$CONFIG_ROOT/$CONFIG_NAME
+test -f "$CONFIG_PATH" && test ! -L "$CONFIG_PATH" || exit 1
+test "$(stat -c '%u:%g %a' "$CONFIG_PATH")" = "10001:10001 600" || exit 1
+
+start_broker
+EXPECTED_CONFIG=$PRIVATE_ROOT/expected-config.json
+SNAPSHOT_PHASE=
+if test "$COMMAND" = cursor-snapshot; then
+  SNAPSHOT_PHASE=$(/usr/local/bin/node -e '
+    const fs = require("node:fs"); const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    if (value.evidencePath === "/evidence/cursor-before.json") process.stdout.write("before");
+    else if (value.evidencePath === "/evidence/cursor-after.json") process.stdout.write("after");
+    else process.exit(1);
+  ' "$CONFIG_PATH")
+fi
+materialize_config "$EXPECTED_CONFIG" "$SNAPSHOT_PHASE"
+cmp -s "$EXPECTED_CONFIG" "$CONFIG_PATH" || exit 1
+case "$COMMAND" in callback-inject) test -r /proc/self/fd/3 || exit 2 ;; esac
+prepare_live_facts
+if test "$COMMAND" = telegram-bootstrap; then stop_exact_production_container; fi
+if test "$COMMAND" = unraid-key-rotate; then stop_exact_production_container; fi
+
+case "$COMMAND" in
+  telegram-bootstrap) TIME_LIMIT=900; NETWORK=none; INPUT=no; BUNDLE_MODE=readonly; BROKER=no ;;
+  callback-inject) TIME_LIMIT=120; NETWORK=host; INPUT=yes; BUNDLE_MODE=rw; BROKER=no ;;
+  unraid-key-rotate) TIME_LIMIT=600; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
+  evidence-snapshot) TIME_LIMIT=5700; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
+  reboot-request) TIME_LIMIT=300; NETWORK=none; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
+  reboot-resume) TIME_LIMIT=780; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
+  *) TIME_LIMIT=120; NETWORK=none; INPUT=no; BUNDLE_MODE=readonly; BROKER=no ;;
+esac
+
+assert_acceptance_state_inode() {
+  ACCEPTANCE_PIN_INODE=$(stat -Lc '%d:%i' "$ACCEPTANCE_PIN_ROOT") || return 1
+  test "$(stat -Lc '%d:%i' "$ACCEPTANCE_STATE_ROOT")" = "$ACCEPTANCE_PIN_INODE" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker inspect --format '{{.Name}} {{.Image}}' "$TARGET_CONTAINER_ID")" = "/$PRODUCTION_CONTAINER $IMAGE_ID" || return 1
+  test "$(/usr/bin/timeout -s KILL 20 /usr/bin/docker exec "$TARGET_CONTAINER_ID" stat -Lc '%d:%i' /home/ouro/AgentBundles/sanctuary.ouro/state/acceptance)" = "$ACCEPTANCE_PIN_INODE" || return 1
+}
+
+if test "$COMMAND" = evidence-snapshot || test "$COMMAND" = reboot-request || test "$COMMAND" = reboot-resume; then
+  stop_exact_production_container
+  BUNDLE_STATE_ROOT=$BUNDLE_ROOT/state
+  test -d "$BUNDLE_STATE_ROOT" && test ! -L "$BUNDLE_STATE_ROOT" || exit 1
+  test "$(stat -c '%u:%g %a' "$BUNDLE_STATE_ROOT")" = "10001:10001 700" || exit 1
+  ACCEPTANCE_STATE_ROOT=$BUNDLE_ROOT/state/acceptance
+  if test ! -e "$ACCEPTANCE_STATE_ROOT"; then
+    install -d -m 0700 -o 10001 -g 10001 "$ACCEPTANCE_STATE_ROOT"
+  fi
+  test -d "$ACCEPTANCE_STATE_ROOT" && test ! -L "$ACCEPTANCE_STATE_ROOT" || exit 1
+  test "$(stat -c '%u:%g %a' "$ACCEPTANCE_STATE_ROOT")" = "10001:10001 700" || exit 1
+  ACCEPTANCE_PIN_ROOT=$PRIVATE_ROOT/pinned-acceptance-state
+  install -d -m 0700 -o 0 -g 0 "$ACCEPTANCE_PIN_ROOT"
+  ! /bin/mountpoint -q "$ACCEPTANCE_PIN_ROOT" || exit 1
+  ! /bin/mountpoint -q "$ACCEPTANCE_STATE_ROOT" || exit 1
+  ACCEPTANCE_ALIAS_MOUNTED=yes
+  /usr/bin/timeout -s KILL 20 /usr/local/bin/node -e '
+    const { spawnSync } = require("node:child_process");
+    const { closeSync, constants, fstatSync, openSync } = require("node:fs");
+    const [sourcePath, target] = process.argv.slice(1);
+    const source = openSync(sourcePath, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+      const metadata = fstatSync(source);
+      if (!metadata.isDirectory() || metadata.uid !== 10001 || (metadata.mode & 0o777) !== 0o700) process.exit(1);
+      const result = spawnSync("/bin/mount", ["--bind", "/proc/self/fd/3", target], {
+        cwd: "/", timeout: 10_000, env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
+        stdio: ["ignore", "ignore", "ignore", source],
+      });
+      if (result.error || result.status !== 0) process.exit(1);
+    } finally { closeSync(source); }
+  ' "$ACCEPTANCE_STATE_ROOT" "$ACCEPTANCE_PIN_ROOT"
+  ACCEPTANCE_CANONICAL_PINNED=yes
+  /usr/bin/timeout -s KILL 10 /bin/mount --bind "$ACCEPTANCE_PIN_ROOT" "$ACCEPTANCE_STATE_ROOT"
+  restore_production_container
+  PRODUCTION_STOPPED=no
+  refresh_live_facts
+  assert_acceptance_state_inode
+fi
+
+run_harness() {
+  if test "$BUNDLE_MODE" = rw; then BUNDLE_SUFFIX=; else BUNDLE_SUFFIX=,readonly; fi
+  if test "$COMMAND" = telegram-bootstrap; then
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm --pull=never --network "$NETWORK" \
+      --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro$BUNDLE_SUFFIX" \
+      --mount "type=bind,src=$SOCKET_ROOT,dst=/run/ouro-host-acceptance,readonly" \
+      --mount "type=bind,src=$IMAGE_FACT,dst=/run/ouro-acceptance/image-digest,readonly" \
+      --mount "type=bind,src=$CONTAINER_FACT,dst=/run/ouro-acceptance/container-digest,readonly" \
+      --mount "type=bind,src=$PROCESS_BINDING_FACT,dst=/run/ouro-acceptance/process-binding-digest,readonly" \
+      --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
+      --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
+      --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh "$IMAGE_ID" \
+      "$COMMAND" --config /run/ouro-acceptance/config.json
+  elif test "$COMMAND" = callback-inject; then
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm -i --pull=never --network "$NETWORK" \
+      --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro$BUNDLE_SUFFIX" \
+      --mount "type=bind,src=$IMAGE_FACT,dst=/run/ouro-acceptance/image-digest,readonly" \
+      --mount "type=bind,src=$CONTAINER_FACT,dst=/run/ouro-acceptance/container-digest,readonly" \
+      --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
+      --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
+      --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
+      --entrypoint /bin/sh "$IMAGE_ID" -ceu \
+      'exec 3<&0; exec /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh "$@" 3<&3' \
+      sanctuary-unit16 "$COMMAND" --config /run/ouro-acceptance/config.json <&3
+  elif test "$COMMAND" = evidence-snapshot; then
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm --pull=never --network "$NETWORK" \
+      --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly" \
+      --mount "type=bind,src=$ACCEPTANCE_PIN_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance" \
+      --mount "type=bind,src=$SOCKET_ROOT,dst=/run/ouro-host-acceptance,readonly" \
+      --mount "type=bind,src=$IMAGE_FACT,dst=/run/ouro-acceptance/image-digest,readonly" \
+      --mount "type=bind,src=$CONTAINER_FACT,dst=/run/ouro-acceptance/container-digest,readonly" \
+      --mount "type=bind,src=$PROCESS_BINDING_FACT,dst=/run/ouro-acceptance/process-binding-digest,readonly" \
+      --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
+      --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
+      --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh \
+      "$IMAGE_ID" "$COMMAND" --config /run/ouro-acceptance/config.json
+  elif test "$BROKER" = yes; then
+    if test "$COMMAND" = reboot-request || test "$COMMAND" = reboot-resume; then ACCEPTANCE_MOUNT="--mount type=bind,src=$ACCEPTANCE_PIN_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro/state/acceptance"; else ACCEPTANCE_MOUNT=; fi
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm --pull=never --network "$NETWORK" \
+      --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro$BUNDLE_SUFFIX" \
+      $ACCEPTANCE_MOUNT \
+      --mount "type=bind,src=$SOCKET_ROOT,dst=/run/ouro-host-acceptance,readonly" \
+      --mount "type=bind,src=$IMAGE_FACT,dst=/run/ouro-acceptance/image-digest,readonly" \
+      --mount "type=bind,src=$CONTAINER_FACT,dst=/run/ouro-acceptance/container-digest,readonly" \
+      --mount "type=bind,src=$PROCESS_BINDING_FACT,dst=/run/ouro-acceptance/process-binding-digest,readonly" \
+      --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
+      --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
+      --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh \
+      "$IMAGE_ID" "$COMMAND" --config /run/ouro-acceptance/config.json
+  else
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm --pull=never --network "$NETWORK" \
+      --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
+      --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" \
+      --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
+      --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
+      --mount "type=bind,src=$RUNTIME_ROOT,dst=/home/ouro/.ouro-cli,readonly" \
+      --mount "type=bind,src=$BUNDLE_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro$BUNDLE_SUFFIX" \
+      --mount "type=bind,src=$IMAGE_FACT,dst=/run/ouro-acceptance/image-digest,readonly" \
+      --mount "type=bind,src=$CONTAINER_FACT,dst=/run/ouro-acceptance/container-digest,readonly" \
+      --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
+      --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
+      --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh \
+      "$IMAGE_ID" "$COMMAND" --config /run/ouro-acceptance/config.json
+  fi
+}
+
+run_harness
+if test "$COMMAND" = evidence-snapshot || test "$COMMAND" = reboot-request || test "$COMMAND" = reboot-resume; then assert_acceptance_state_inode; fi
+
+if test "$COMMAND" = reboot-request; then
+  /usr/local/bin/node -e '
+    const fs = require("node:fs"); const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    if (value.operation !== "reboot" || value.phase !== "requested" || !/^[0-9a-f]{64}$/.test(value.requestId)
+      || !/^[0-9a-f]{64}$/.test(value.reservationId) || !/^[0-9a-f]{64}$/.test(value.processBindingDigest)) process.exit(1);
+  ' "$EVIDENCE_ROOT/reboot.json"
+  PRODUCTION_STOPPED=yes
+  /usr/bin/timeout -s KILL 60 /usr/local/bin/node -e '
+    const fs = require("node:fs"); const net = require("node:net");
+    const checkpoint = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+    const request = JSON.stringify({ operation: "stop_reboot_owner", targetId: "sanctuary", requestId: checkpoint.requestId, reservationId: checkpoint.reservationId, processBindingDigest: checkpoint.processBindingDigest });
+    let raw = ""; const socket = net.createConnection(process.argv[1]);
+    socket.setEncoding("utf8"); socket.setTimeout(55000, () => socket.destroy(new Error("timeout")));
+    socket.on("connect", () => socket.end(request));
+    socket.on("data", (chunk) => { raw += chunk; if (Buffer.byteLength(raw) > 65536) socket.destroy(new Error("oversize")); });
+    socket.on("end", () => {
+      const envelope = JSON.parse(raw); const result = envelope && envelope.ok === true ? envelope.result : null;
+      if (!result || result.stopped !== true || result.targetId !== "sanctuary" || result.requestId !== checkpoint.requestId
+        || result.reservationId !== checkpoint.reservationId || result.processBindingDigest !== checkpoint.processBindingDigest) process.exitCode = 1;
+    });
+    socket.on("error", () => { process.exitCode = 1; });
+  ' "$BROKER_SOCKET" "$EVIDENCE_ROOT/reboot.json"
+  sync -f "$EVIDENCE_ROOT/reboot.json"
+  sync -f "$EVIDENCE_ROOT"
+  HOST_REBOOT_COMMIT_STATE=attempting
+  /usr/bin/timeout -s KILL 20 /usr/local/bin/node -e '
+    const fs = require("node:fs"); const net = require("node:net");
+    const checkpoint = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+    if (checkpoint.operation !== "reboot" || checkpoint.phase !== "requested"
+      || !/^[0-9a-f]{64}$/.test(checkpoint.requestId) || !/^[0-9a-f]{64}$/.test(checkpoint.reservationId)) process.exit(1);
+    const request = JSON.stringify({ operation: "commit_reboot", targetId: "sanctuary", requestId: checkpoint.requestId, reservationId: checkpoint.reservationId, processBindingDigest: checkpoint.processBindingDigest });
+    let raw = ""; const socket = net.createConnection(process.argv[1]);
+    socket.setEncoding("utf8"); socket.setTimeout(15000, () => socket.destroy(new Error("timeout")));
+    socket.on("connect", () => socket.end(request));
+    socket.on("data", (chunk) => { raw += chunk; if (Buffer.byteLength(raw) > 65536) socket.destroy(new Error("oversize")); });
+    socket.on("end", () => {
+      const envelope = JSON.parse(raw); const result = envelope && envelope.ok === true ? envelope.result : null;
+      if (!result || result.committed !== true || result.targetId !== "sanctuary"
+        || result.requestId !== checkpoint.requestId || result.reservationId !== checkpoint.reservationId
+        || result.processBindingDigest !== checkpoint.processBindingDigest) process.exitCode = 1;
+    });
+    socket.on("error", () => { process.exitCode = 1; });
+  ' "$BROKER_SOCKET" "$EVIDENCE_ROOT/reboot.json"
+  HOST_REBOOT_COMMIT_STATE=confirmed
+  cleanup_unit16
+  BROKER_PID=
+  PRIVATE_ROOT=
+  exit 0
+fi

package/deploy/unraid/sanctuary-unit18-target-audit.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+IMAGE_ID=${1:-}
+test "$#" -eq 1 || exit 2
+IMAGE_DIGEST=${IMAGE_ID#sha256:}
+test "$IMAGE_DIGEST" != "$IMAGE_ID" && test "${#IMAGE_DIGEST}" -eq 64 || exit 2
+case "$IMAGE_DIGEST" in *[!0-9a-f]*) exit 2 ;; esac
+
+AUDIT_ROOT=$(mktemp -d /run/ouro-unit18-target.XXXXXX)
+AUDITOR=$AUDIT_ROOT/sanctuary-deployment-target.mjs
+cleanup() {
+  STATUS=$?
+  rm -f -- "$AUDITOR"
+  rmdir -- "$AUDIT_ROOT" 2>/dev/null || STATUS=1
+  return "$STATUS"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+/usr/bin/timeout -s KILL 20 /usr/bin/docker run --rm --pull=never --network none \
+  --entrypoint /bin/cat "$IMAGE_ID" /opt/ouro/deploy/unraid/sanctuary-deployment-target.mjs >"$AUDITOR"
+chmod 0500 "$AUDITOR"
+chown 0:0 "$AUDITOR"
+/usr/local/bin/node "$AUDITOR" final "$IMAGE_ID"