@ouro.bot/cli 0.1.0-alpha.835 → 0.1.0-alpha.837

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.837",
+      "changes": [
+        "Sanctuary: the root authority keeps a permanent empty child cgroup (ouro-keep), so Unraid's cgroup2-unraid can no longer remove the authority cgroup (D-026). The host keeper now lets the reaper run and pauses it only while the keep child is missing; every reader of the authority cgroup ignores the keep child."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.836",
+      "changes": [
+        "release:bump appends new change lines to an existing top changelog entry instead of silently replacing them (D-042); --replace keeps the old rewrite behaviour."
+      ]
+    },
     {
       "version": "0.1.0-alpha.835",
       "changes": [

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -428,12 +428,13 @@ const GATEWAY_SUPERVISOR = `${AUTHORITY_CUSTOM}/gateway-supervisor.sh`
 const GATEWAY_WATCHDOG = `${AUTHORITY_CUSTOM}/gateway-keeper-watchdog.sh`
 const UNRAID_STOP_HOOK = "/boot/config/stop"
 const GATEWAY_SUPERVISOR_SH = String.raw`#!/bin/sh
-# Ouro authority gateway keeper for Unraid (D-026 workaround).
-# The .830 root-authority gateway needs /sys/fs/cgroup/ouro-authority to persist while it
-# runs, but Unraid's cgroup2-unraid reaps empty cgroups and the gateway never populates it,
-# so the reaper deletes the cgroup and kills the gateway. A FIRM (not per-loop-racing) reaper
-# pause is required for the gateway to reach readiness. This keeper:
-#   - firmly pauses the reaper and keeps it paused,
+# Ouro authority gateway keeper for Unraid.
+# The root-authority gateway needs /sys/fs/cgroup/ouro-authority to persist, and Unraid's
+# cgroup2-unraid removes every top-level cgroup that reports populated 0. The kernel will not
+# remove a cgroup that has a child cgroup, so the authority keeps an empty ouro-keep child
+# (D-026). This keeper:
+#   - creates that keep child and lets the reaper run; it pauses the reaper only while the
+#     keep child is missing (a fresh boot, or an authority older than the keep child),
 #   - keeps the gateway process alive,
 #   - reconnects the resident (docker restart) if it is unhealthy while the gateway is ready
 #     (handles reboot ordering, where Docker autostarts the resident before the gateway).
@@ -443,15 +444,17 @@ R=/mnt/user/appdata/ouro-authority
 GW=$R/package/dist/heart/daemon/sanctuary-telegram-authority-entry.js
 CFG=$R/active.json
 LOG=/var/log/ouro-gateway.log
-pause_reaper() {
+reaper_policy() {
   P=$(cat /run/cgroup2-unraid.pid 2>/dev/null) || return 0
   [ -n "$P" ] || return 0
+  if [ -d "$CG/ouro-keep" ]; then kill -CONT "$P" 2>/dev/null; return 0; fi
   S=$(ps -o stat= -p "$P" 2>/dev/null | tr -d ' ')
   case "$S" in T*) : ;; *) kill -STOP "$P" 2>/dev/null ;; esac
 }
 ensure_cg() {
   [ -d "$CG" ] || { mkdir -m 700 "$CG" 2>/dev/null; chown 0:0 "$CG" 2>/dev/null
     for c in cpu memory pids; do echo "+$c" > "$CG/cgroup.subtree_control" 2>/dev/null; done; }
+  [ -d "$CG/ouro-keep" ] || mkdir -m 700 "$CG/ouro-keep" 2>/dev/null
 }
 ensure_sock() {
   # Docker autostarts the resident before us and auto-creates its missing bind
@@ -475,12 +478,12 @@ start_gw() {
 }
 # An in-place upgrade pauses us with a flag; a stale flag (> 30 min) is ignored.
 maintenance() { [ -n "$(find /run/ouro-authority-maintenance -mmin -30 2>/dev/null)" ]; }
-pause_reaper; ensure_cg; ensure_sock
+ensure_cg; reaper_policy; ensure_sock
 last_res=0
 while true; do
   if maintenance; then sleep 15; continue; fi
-  pause_reaper
   ensure_cg
+  reaper_policy
   ensure_sock
   [ -n "$(gw_pid)" ] || { start_gw; sleep 8; }
   rd=$(jq -rc .status "$R"/epochs/*/readiness.json 2>/dev/null)

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.835",
+  "runtimeVersion": "0.1.0-alpha.837",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.835</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.837</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-installation.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_CGROUP_KEEP = void 0;
+exports.sanctuaryCgroupChildren = sanctuaryCgroupChildren;
 exports.verifySanctuaryAuthorityInstallation = verifySanctuaryAuthorityInstallation;
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
@@ -70,6 +72,16 @@ function readOwned(filePath, uid, gid, mode) {
         fs.closeSync(descriptor);
     }
 }
+/**
+ * Unraid's cgroup2-unraid removes every top-level cgroup that reports `populated 0`,
+ * and the kernel refuses to remove a cgroup that has child cgroups. So the authority
+ * keeps one permanent empty child, and every reader of its cgroup ignores it (D-026).
+ */
+exports.SANCTUARY_CGROUP_KEEP = "ouro-keep";
+/** The authority cgroup's execution children: directories other than the keep child. */
+function sanctuaryCgroupChildren(cgroupRoot) {
+    return fs.readdirSync(cgroupRoot).filter((name) => name !== exports.SANCTUARY_CGROUP_KEEP && fs.lstatSync(path.join(cgroupRoot, name)).isDirectory());
+}
 function verifySanctuaryAuthorityInstallation(input) {
     const { expectedUid: uid, expectedGid: gid } = input;
     for (const root of [input.packageRoot, input.stateRoot, input.stagingRoot, input.cgroupRoot])

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -151,7 +151,7 @@ class SanctuaryAuthorityRootLifecycle {
                     throw new Error("Resolve pending execution state before re-pinning");
             }
         }
-        if (fs.readdirSync(this.#p(CGROUP)).some(name => fs.lstatSync(this.#p(`${CGROUP}/${name}`)).isDirectory()))
+        if ((0, sanctuary_authority_installation_1.sanctuaryCgroupChildren)(this.#p(CGROUP)).length !== 0)
             throw new Error("Resolve pending cgroups before re-pinning");
         this.#verifyPrimitive("/usr/bin/prlimit", prlimitDigest);
         this.#verifyPrimitive("/usr/bin/setsid", setsidDigest);
@@ -294,9 +294,26 @@ class SanctuaryAuthorityRootLifecycle {
             throw new Error("Sanctuary installed boot lifecycle changed");
         return true;
     }
+    /** Create the authority cgroup with its keep child. The reaper can remove a freshly
+     * made (still empty) cgroup before the child exists, so retry that race a few times. */
+    #cgroup() {
+        const keep = this.#p(`${CGROUP}/${sanctuary_authority_installation_1.SANCTUARY_CGROUP_KEEP}`);
+        for (let attempt = 1; !fs.existsSync(keep); attempt += 1) {
+            try {
+                this.#directory(CGROUP);
+                fs.mkdirSync(keep, { mode: 0o700 });
+            }
+            catch (error) {
+                if (error.code !== "ENOENT" || attempt >= 5)
+                    throw error;
+            }
+        }
+        this.#directory(CGROUP);
+    }
     #runtimeDirectories() {
-        for (const directory of [this.#epochRoot(), STAGING, CGROUP])
+        for (const directory of [this.#epochRoot(), STAGING])
             this.#directory(directory);
+        this.#cgroup();
         this.#directory(SOCKET, 0o750, this.#socketGid);
         // Add only the required controllers; never replace another owner's controls.
         for (const root of ["/sys/fs/cgroup", CGROUP]) {
@@ -546,7 +563,7 @@ class SanctuaryAuthorityRootLifecycle {
         const epoch = this.#epoch();
         if (proof.schemaVersion !== 1 || proof.keyId !== epoch.epochId || proof.publicKeyDigest !== epoch.publicKeyDigest || proof.quiescent !== true
             || !Number.isSafeInteger(proof.cursor) || proof.cursor < epoch.predecessorCursor
-            || fs.readdirSync(this.#p(CGROUP)).some((entry) => fs.lstatSync(this.#p(`${CGROUP}/${entry}`)).isDirectory()))
+            || (0, sanctuary_authority_installation_1.sanctuaryCgroupChildren)(this.#p(CGROUP)).length !== 0)
             throw new Error("Sanctuary gateway retirement cleanup is unproven");
         return true;
     }
@@ -854,6 +871,7 @@ class SanctuaryAuthorityRootLifecycle {
     }
     /** Start the gateway, then the resident, and prove both. */
     async #startUpgraded() {
+        this.#runtimeDirectories();
         await this.#startGateway();
         this.#docker(["start", "ouro-butler"]);
         await this.#wait(async () => this.#target().State.Running && this.#target().State.Health?.Status === "healthy" && await this.#ready(), 300_000);

package/dist/heart/daemon/sanctuary-host-detached-supervisor.js

@@ -39,6 +39,7 @@ const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../../nerves/runtime");
+const sanctuary_authority_installation_1 = require("./sanctuary-authority-installation");
 const SCHEMA_VERSION = 1;
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 const PERMIT_ID = /^permit-[A-Za-z0-9_-]{43}$/u;
@@ -183,10 +184,8 @@ class DetachedSanctuaryHostSupervisor {
                 throw new Error("Sanctuary host supervisor state is unmatched");
             }
         }
-        for (const permitId of fs.readdirSync(this.#options.cgroupRoot)) {
+        for (const permitId of (0, sanctuary_authority_installation_1.sanctuaryCgroupChildren)(this.#options.cgroupRoot)) {
             const cgroupPath = path.join(this.#options.cgroupRoot, permitId);
-            if (!fs.lstatSync(cgroupPath).isDirectory())
-                continue;
             if (!PERMIT_ID.test(permitId))
                 throw new Error("Sanctuary host cgroup entry is invalid");
             if (!known.has(permitId) && !await this.#reconcileCgroup(cgroupPath)) {

package/dist/heart/daemon/sanctuary-telegram-authority-entry.js

@@ -346,7 +346,7 @@ async function startSanctuaryTelegramAuthority(options) {
                 hostAuthority.retireRegistrations(ledger);
                 await reconcileExecutions();
                 if (hostAuthority.retireRegistrations(ledger).length !== 0
-                    || fs.readdirSync(config.hostCgroupRoot).some((entry) => fs.lstatSync(path.join(config.hostCgroupRoot, entry)).isDirectory()))
+                    || (0, sanctuary_authority_installation_1.sanctuaryCgroupChildren)(config.hostCgroupRoot).length !== 0)
                     throw new Error("Sanctuary authority retirement cleanup is unproven");
                 writePrivateJson(path.join(config.epochRoot, "retirement.json"), {
                     schemaVersion: 1, keyId: config.keyId, publicKeyDigest: config.publicKeyDigest,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.835",
+  "version": "0.1.0-alpha.837",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.835",
+      "version": "0.1.0-alpha.837",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.835",
+  "version": "0.1.0-alpha.837",
   "engines": {
     "node": ">=22"
   },