@ouro.bot/cli 0.1.0-alpha.839 → 0.1.0-alpha.840

package/changelog.json

@@ -1,6 +1,13 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.840",
+      "changes": [
+        "Sanctuary upgrade rollback robustness, from the 837 rehearsal on the real host: gateway readiness gets a 15-minute budget (verifying every pinned package file with a cold Unraid page cache takes minutes, and a 120-second budget failed a real rollback after it had restored every record), and a rollback marks its journal so an upgrade can never resume forward from a half-rolled-back journal; only upgrade-rollback continues it.",
+        "Sanctuary: the cgroup keep child is used only while the installed package understands it. An older gateway (before 837) refuses an unknown child cgroup, so a rollback to it now removes the keep child and holds Unraid's reaper first, and the host keeper does the same. Found when a rollback from 837 to 830 left the 830 gateway exiting on the keep child; the Butler was recovered by hand in about 17 minutes."
+      ]
+    },
     {
       "version": "0.1.0-alpha.839",
       "changes": [

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -446,17 +446,23 @@ R=/mnt/user/appdata/ouro-authority
 GW=$R/package/dist/heart/daemon/sanctuary-telegram-authority-entry.js
 CFG=$R/active.json
 LOG=/var/log/ouro-gateway.log
+# Only an authority from 0.1.0-alpha.837 on understands the keep child; an older gateway
+# refuses to start beside an unknown cgroup (a rollback to 830 hit exactly that). So the
+# keep child exists only while the installed package supports it; otherwise it is removed
+# and the reaper stays paused, the pre-837 behaviour.
+keep_supported() { grep -q ouro-keep "$R/package/dist/heart/daemon/sanctuary-authority-installation.js" 2>/dev/null; }
 reaper_policy() {
   P=$(cat /run/cgroup2-unraid.pid 2>/dev/null) || return 0
   [ -n "$P" ] || return 0
-  if [ -d "$CG/ouro-keep" ]; then kill -CONT "$P" 2>/dev/null; return 0; fi
+  if keep_supported && [ -d "$CG/ouro-keep" ]; then kill -CONT "$P" 2>/dev/null; return 0; fi
   S=$(ps -o stat= -p "$P" 2>/dev/null | tr -d ' ')
   case "$S" in T*) : ;; *) kill -STOP "$P" 2>/dev/null ;; esac
 }
 ensure_cg() {
   [ -d "$CG" ] || { mkdir -m 700 "$CG" 2>/dev/null; chown 0:0 "$CG" 2>/dev/null
     for c in cpu memory pids; do echo "+$c" > "$CG/cgroup.subtree_control" 2>/dev/null; done; }
-  [ -d "$CG/ouro-keep" ] || mkdir -m 700 "$CG/ouro-keep" 2>/dev/null
+  if keep_supported; then [ -d "$CG/ouro-keep" ] || mkdir -m 700 "$CG/ouro-keep" 2>/dev/null
+  else [ -d "$CG/ouro-keep" ] && rmdir "$CG/ouro-keep" 2>/dev/null; fi
 }
 ensure_sock() {
   # Docker autostarts the resident before us and auto-creates its missing bind
@@ -480,10 +486,11 @@ start_gw() {
 }
 # An in-place upgrade pauses us with a flag; a stale flag (> 30 min) is ignored.
 maintenance() { [ -n "$(find /run/ouro-authority-maintenance -mmin -30 2>/dev/null)" ]; }
-ensure_cg; reaper_policy; ensure_sock
+reaper_policy; ensure_cg; ensure_sock
 last_res=0
 while true; do
   if maintenance; then sleep 15; continue; fi
+  reaper_policy
   ensure_cg
   reaper_policy
   ensure_sock

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.839",
+  "runtimeVersion": "0.1.0-alpha.840",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.839</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.840</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -59,6 +59,10 @@ const CGROUP = "/sys/fs/cgroup/ouro-authority";
 const BOOT = "/boot/config/custom/ouro-authority/start.sh";
 const BOOT_LINE = `/bin/sh ${BOOT} --boot & # ouro-authority`;
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+// The gateway verifies every pinned package file before it reports ready. With a cold
+// page cache on Unraid's array that takes minutes, so readiness gets a generous budget
+// (a 120 s budget failed a real rollback on 2026-09-24).
+const GATEWAY_READY_TIMEOUT_MS = 900_000;
 const TEMPLATE_JOURNAL = "/boot/config/custom/ouro-butler/docker-man-template-transaction.json";
 // In-place upgrade of an installed authority: same epoch (token, issuer, cursor,
 // gateway state), new reviewed package and resident image. Every root record it
@@ -298,6 +302,15 @@ class SanctuaryAuthorityRootLifecycle {
      * made (still empty) cgroup before the child exists, so retry that race a few times. */
     #cgroup() {
         const keep = this.#p(`${CGROUP}/${sanctuary_authority_installation_1.SANCTUARY_CGROUP_KEEP}`);
+        if (!this.#keepSupported()) {
+            // A package from before the keep child refuses an unknown child cgroup and relies on
+            // the host keeper holding Unraid's reaper paused (a rollback to 830 hit exactly that).
+            this.#freezeUnraidReaper();
+            if (fs.existsSync(keep))
+                fs.rmdirSync(keep);
+            this.#directory(CGROUP);
+            return;
+        }
         for (let attempt = 1; !fs.existsSync(keep); attempt += 1) {
             try {
                 this.#directory(CGROUP);
@@ -310,6 +323,23 @@ class SanctuaryAuthorityRootLifecycle {
         }
         this.#directory(CGROUP);
     }
+    /** Whether the installed package's gateway understands the keep child (0.1.0-alpha.837+). */
+    #keepSupported() {
+        const installation = this.#p(`${ROOT}/package/dist/heart/daemon/sanctuary-authority-installation.js`);
+        return fs.existsSync(installation) && fs.readFileSync(installation, "utf8").includes(sanctuary_authority_installation_1.SANCTUARY_CGROUP_KEEP);
+    }
+    #freezeUnraidReaper() {
+        const pidFile = this.#p("/run/cgroup2-unraid.pid");
+        if (!fs.existsSync(pidFile))
+            return;
+        const pid = Number(fs.readFileSync(pidFile, "utf8").trim());
+        if (!Number.isSafeInteger(pid) || pid <= 0)
+            return;
+        try {
+            process.kill(pid, "SIGSTOP");
+        }
+        catch { /* not running: nothing to hold */ }
+    }
     #runtimeDirectories() {
         for (const directory of [this.#epochRoot(), STAGING])
             this.#directory(directory);
@@ -506,10 +536,10 @@ class SanctuaryAuthorityRootLifecycle {
                 if (failed)
                     throw new Error("Sanctuary gateway launch failed");
                 return this.#ready();
-            });
+            }, GATEWAY_READY_TIMEOUT_MS);
         }
         else
-            await this.#wait(() => this.#ready());
+            await this.#wait(() => this.#ready(), GATEWAY_READY_TIMEOUT_MS);
     }
     #target() {
         const target = this.#containers().find((container) => container.Name === "/ouro-butler");
@@ -682,6 +712,10 @@ class SanctuaryAuthorityRootLifecycle {
         if (fs.existsSync(this.#p(TEMPLATE_JOURNAL)))
             throw new Error("Finish the pending installation before upgrading");
         let journal = fs.existsSync(this.#p(UPGRADE)) ? this.#upgradeJournal() : this.#beginUpgrade(input);
+        // A rollback that stopped partway has already restored some records; resuming
+        // forward from its step list would act on a predecessor that the list calls switched.
+        if (journal.rollingBack)
+            throw new Error("A Sanctuary upgrade rollback is pending; run upgrade-rollback to finish it");
         if (journal.to.imageId !== input.targetImageId || journal.to.imageReference !== input.imageReference)
             throw new Error("A different Sanctuary upgrade is pending; roll it back first");
         const target = () => new _a({ targetImageId: journal.to.imageId, rollbackImageId: journal.from.imageId }, this.#options);
@@ -714,6 +748,10 @@ class SanctuaryAuthorityRootLifecycle {
         if (!fs.existsSync(this.#p(UPGRADE)))
             return false;
         let journal = this.#upgradeJournal();
+        if (!journal.rollingBack) {
+            journal = { ...journal, rollingBack: true };
+            this.#write(UPGRADE, JSON.stringify(journal));
+        }
         await this.#halt();
         if (journal.completed.includes("switch")) {
             // A migration interrupted before the journal recorded it may or may not be
@@ -755,6 +793,7 @@ class SanctuaryAuthorityRootLifecycle {
         const sides = [journal?.from, journal?.to];
         if (!journal || journal.schemaVersion !== 1 || journal.epochId !== this.#request.epochId || !Array.isArray(journal.completed)
             || !journal.completed.every((step) => exports.SANCTUARY_UPGRADE_STEPS.includes(step))
+            || (journal.rollingBack !== undefined && journal.rollingBack !== true)
             || !sides.every((side) => side && DIGEST.test(side.imageId) && DIGEST.test(side.packageDigest) && IMAGE_REFERENCE.test(side.imageReference))
             || !DIGEST.test(journal.from.rollbackImageId))
             throw new Error("Sanctuary upgrade journal is invalid");

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.839",
+  "version": "0.1.0-alpha.840",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.839",
+      "version": "0.1.0-alpha.840",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.839",
+  "version": "0.1.0-alpha.840",
   "engines": {
     "node": ">=22"
   },