@ouro.bot/cli 0.1.0-alpha.840 → 0.1.0-alpha.841

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.841",
+      "changes": [
+        "Sanctuary: the root lifecycle accepts the host keeper as the boot owner (D-045), so staging and retirement no longer refuse on a keeper-managed Unraid host; the upgrade orchestrator prunes old Butler images after a successful upgrade, keeping the live and rollback images (D-046: docker.img had reached 88%)."
+      ]
+    },
     {
       "version": "0.1.0-alpha.840",
       "changes": [

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -823,6 +823,21 @@ function pinTemplate(version) {
   ok(`DockerMan template pins ${image(version)}`)
 }
 
+// Every release pulls a ~1 GB Butler image, and Unraid's docker.img filled to 88% with
+// twenty of them (D-046). After a successful upgrade keep only the live image and the
+// authority's recorded rollback image; Docker itself refuses to remove an image in use.
+function pruneButlerImages() {
+  const activation = JSON.parse(readFileSync(`${ROOT}/activation.json`, "utf8"))
+  const keep = new Set([activation.targetImageId, activation.rollbackImageId])
+  let removed = 0
+  for (const line of docker(["images", "--no-trunc", "--format", "{{.ID}} {{.Tag}}", "ghcr.io/ourostack/ouroboros-butler"]).trim().split("\n").filter(Boolean)) {
+    const [id, tag] = line.split(" ")
+    if (keep.has(id) || !tag || tag === "<none>") continue
+    try { docker(["rmi", `ghcr.io/ourostack/ouroboros-butler:${tag}`], { stdio: ["ignore", "pipe", "pipe"] }); removed += 1 } catch { /* in use */ }
+  }
+  ok(`pruned ${removed} old Butler image(s); kept the live and rollback images`)
+}
+
 function lifecycleFailure(e) {
   const detail = [e.stderr, e.stdout].map((x) => (x ? String(x).trim() : "")).filter(Boolean).join(" | ")
   let last = ""
@@ -871,7 +886,7 @@ function upgrade(version, rehearse) {
       resumeSupervision()
       fail(`ROLLBACK FAILED: ${lifecycleFailure(e)}\nThe journal is kept; the next authority boot (or \`upgrade-rollback\`) retries it.`)
     }
-  } else pinTemplate(version)
+  } else { pinTemplate(version); pruneButlerImages() }
   resumeSupervision()
   say("preservation")
   docker(["inspect", "jellyfin", "--format", "{{.Id}}|{{.Image}}|{{.RestartCount}}|{{.State.StartedAt}}"]).trim() === jellyfinBefore ? ok("jellyfin unchanged") : fail("JELLYFIN CHANGED")

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.840",
+  "runtimeVersion": "0.1.0-alpha.841",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.840</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.841</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SanctuaryAuthorityRootLifecycle = exports.SANCTUARY_UPGRADE_STEPS = void 0;
+exports.SanctuaryAuthorityRootLifecycle = exports.SANCTUARY_UPGRADE_STEPS = exports.SANCTUARY_KEEPER_BOOT_LINES = void 0;
 exports.recordSanctuaryRootLifecycleFailure = recordSanctuaryRootLifecycleFailure;
 exports.runSanctuaryAuthorityRootCli = runSanctuaryAuthorityRootCli;
 const node_child_process_1 = require("node:child_process");
@@ -58,6 +58,16 @@ const STAGING = "/var/lib/ouro-authority/staging";
 const CGROUP = "/sys/fs/cgroup/ouro-authority";
 const BOOT = "/boot/config/custom/ouro-authority/start.sh";
 const BOOT_LINE = `/bin/sh ${BOOT} --boot & # ouro-authority`;
+// On Unraid the host keeper owns boot instead (it runs BOOT --boot itself, D-032), and the
+// upgrade orchestrator installs exactly these lines in place of BOOT_LINE (D-045).
+const KEEPER_SUPERVISOR = "/boot/config/custom/ouro-authority/gateway-supervisor.sh";
+const KEEPER_WATCHDOG = "/boot/config/custom/ouro-authority/gateway-keeper-watchdog.sh";
+exports.SANCTUARY_KEEPER_BOOT_LINES = {
+    supervisor: `setsid /bin/sh ${KEEPER_SUPERVISOR} >/dev/null 2>&1 & # ouro-authority-gateway`,
+    watchdog: `(crontab -l 2>/dev/null | grep -v gateway-keeper-watchdog; echo "*/2 * * * * /bin/sh ${KEEPER_WATCHDOG} # ouro-authority-gateway-watchdog") | crontab - # ouro-authority-gateway-watchdog`,
+};
+const BOOT_OWNERS = [BOOT_LINE, exports.SANCTUARY_KEEPER_BOOT_LINES.supervisor];
+const KNOWN_BOOT_LINES = [...BOOT_OWNERS, exports.SANCTUARY_KEEPER_BOOT_LINES.watchdog];
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 // The gateway verifies every pinned package file before it reports ready. With a cold
 // page cache on Unraid's array that takes minutes, so readiness gets a generous budget
@@ -293,7 +303,7 @@ class SanctuaryAuthorityRootLifecycle {
             return false;
         this.#record(`${this.#epochRoot()}/stage.json`, { packageDigest: this.#request.packageDigest });
         this.#verifyPackage(undefined, hostExecution);
-        if (this.#bootScript().text.split("\n").filter((line) => line === BOOT_LINE).length !== 1
+        if (this.#bootScript().text.split("\n").filter((line) => BOOT_OWNERS.includes(line)).length !== 1
             || digest(this.#private(BOOT)) !== digest(fs.readFileSync(this.#p(`${ROOT}/package/deploy/unraid/sanctuary-authority-service.sh`))))
             throw new Error("Sanctuary installed boot lifecycle changed");
         return true;
@@ -379,10 +389,10 @@ class SanctuaryAuthorityRootLifecycle {
         }
         this.#verifyPackage(undefined, hostExecution);
         const { text: boot, mode: bootMode } = this.#bootScript();
-        if (boot.split("\n").some((line) => line.includes("ouro-authority") && line !== BOOT_LINE))
+        if (boot.split("\n").some((line) => line.includes("ouro-authority") && !KNOWN_BOOT_LINES.includes(line)))
             throw new Error("Sanctuary boot ownership is ambiguous");
         this.#write(BOOT, fs.readFileSync(this.#p(`${ROOT}/package/deploy/unraid/sanctuary-authority-service.sh`), "utf8"));
-        if (!boot.split("\n").includes(BOOT_LINE))
+        if (!boot.split("\n").some((line) => BOOT_OWNERS.includes(line)))
             this.#write("/boot/config/go", `${boot}${boot.endsWith("\n") ? "" : "\n"}${BOOT_LINE}\n`, bootMode);
         this.#write(`${this.#epochRoot()}/stage.json`, JSON.stringify({ packageDigest: this.#request.packageDigest }));
     }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.840",
+  "version": "0.1.0-alpha.841",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.840",
+      "version": "0.1.0-alpha.841",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.840",
+  "version": "0.1.0-alpha.841",
   "engines": {
     "node": ">=22"
   },