@ouro.bot/cli 0.1.0-alpha.840 → 0.1.0-alpha.842

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.842",
+      "changes": [
+        "A2A: a verified friend's turn with the Sanctuary agent gets the same typed Sanctuary runtime the Telegram sense attaches, so the Butler's house tools work over A2A (every Unraid read had answered 'Sanctuary runtime is unavailable'). The relationship profile still decides which tools the peer may call."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.841",
+      "changes": [
+        "Sanctuary: the root lifecycle accepts the host keeper as the boot owner (D-045), so staging and retirement no longer refuse on a keeper-managed Unraid host; the upgrade orchestrator prunes old Butler images after a successful upgrade, keeping the live and rollback images (D-046: docker.img had reached 88%)."
+      ]
+    },
     {
       "version": "0.1.0-alpha.840",
       "changes": [

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -823,6 +823,21 @@ function pinTemplate(version) {
   ok(`DockerMan template pins ${image(version)}`)
 }
 
+// Every release pulls a ~1 GB Butler image, and Unraid's docker.img filled to 88% with
+// twenty of them (D-046). After a successful upgrade keep only the live image and the
+// authority's recorded rollback image; Docker itself refuses to remove an image in use.
+function pruneButlerImages() {
+  const activation = JSON.parse(readFileSync(`${ROOT}/activation.json`, "utf8"))
+  const keep = new Set([activation.targetImageId, activation.rollbackImageId])
+  let removed = 0
+  for (const line of docker(["images", "--no-trunc", "--format", "{{.ID}} {{.Tag}}", "ghcr.io/ourostack/ouroboros-butler"]).trim().split("\n").filter(Boolean)) {
+    const [id, tag] = line.split(" ")
+    if (keep.has(id) || !tag || tag === "<none>") continue
+    try { docker(["rmi", `ghcr.io/ourostack/ouroboros-butler:${tag}`], { stdio: ["ignore", "pipe", "pipe"] }); removed += 1 } catch { /* in use */ }
+  }
+  ok(`pruned ${removed} old Butler image(s); kept the live and rollback images`)
+}
+
 function lifecycleFailure(e) {
   const detail = [e.stderr, e.stdout].map((x) => (x ? String(x).trim() : "")).filter(Boolean).join(" | ")
   let last = ""
@@ -871,7 +886,7 @@ function upgrade(version, rehearse) {
       resumeSupervision()
       fail(`ROLLBACK FAILED: ${lifecycleFailure(e)}\nThe journal is kept; the next authority boot (or \`upgrade-rollback\`) retries it.`)
     }
-  } else pinTemplate(version)
+  } else { pinTemplate(version); pruneButlerImages() }
   resumeSupervision()
   say("preservation")
   docker(["inspect", "jellyfin", "--format", "{{.Id}}|{{.Image}}|{{.RestartCount}}|{{.State.StartedAt}}"]).trim() === jellyfinBefore ? ok("jellyfin unchanged") : fail("JELLYFIN CHANGED")

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.840",
+  "runtimeVersion": "0.1.0-alpha.842",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.840</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.842</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/a2a/server.js

@@ -48,6 +48,7 @@ const pin_store_1 = require("./pin-store");
 const seen_ledger_1 = require("./seen-ledger");
 const did_resolution_1 = require("./did-resolution");
 const inbound_share_1 = require("./inbound-share");
+const sanctuary_runtime_1 = require("../senses/sanctuary-runtime");
 const sealed_chat_1 = require("./sealed-chat");
 const relationship_authorization_1 = require("../repertoire/relationship-authorization");
 const mission_result_wire_1 = require("./mission-result-wire");
@@ -158,7 +159,14 @@ async function defaultTurnRunner(input) {
             externalId: input.peerAgentId,
             displayName: input.peerName,
         },
-        ...(input.relationshipAuthorization ? { toolContext: { relationshipAuthorization: input.relationshipAuthorization } } : {}),
+        // The Butler's house tools read a typed Sanctuary runtime from the tool context; the
+        // Telegram sense attaches it, and a verified A2A friend's turn needs it too (without it
+        // every Unraid read answered "Sanctuary runtime is unavailable"). The relationship
+        // profile still decides which of those tools the peer may call.
+        toolContext: {
+            ...(input.agentName === "sanctuary" ? (0, sanctuary_runtime_1.createSanctuaryToolContext)(input.agentName) : {}),
+            ...(input.relationshipAuthorization ? { relationshipAuthorization: input.relationshipAuthorization } : {}),
+        },
     });
     return { response: result.response };
 }

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SanctuaryAuthorityRootLifecycle = exports.SANCTUARY_UPGRADE_STEPS = void 0;
+exports.SanctuaryAuthorityRootLifecycle = exports.SANCTUARY_UPGRADE_STEPS = exports.SANCTUARY_KEEPER_BOOT_LINES = void 0;
 exports.recordSanctuaryRootLifecycleFailure = recordSanctuaryRootLifecycleFailure;
 exports.runSanctuaryAuthorityRootCli = runSanctuaryAuthorityRootCli;
 const node_child_process_1 = require("node:child_process");
@@ -58,6 +58,16 @@ const STAGING = "/var/lib/ouro-authority/staging";
 const CGROUP = "/sys/fs/cgroup/ouro-authority";
 const BOOT = "/boot/config/custom/ouro-authority/start.sh";
 const BOOT_LINE = `/bin/sh ${BOOT} --boot & # ouro-authority`;
+// On Unraid the host keeper owns boot instead (it runs BOOT --boot itself, D-032), and the
+// upgrade orchestrator installs exactly these lines in place of BOOT_LINE (D-045).
+const KEEPER_SUPERVISOR = "/boot/config/custom/ouro-authority/gateway-supervisor.sh";
+const KEEPER_WATCHDOG = "/boot/config/custom/ouro-authority/gateway-keeper-watchdog.sh";
+exports.SANCTUARY_KEEPER_BOOT_LINES = {
+    supervisor: `setsid /bin/sh ${KEEPER_SUPERVISOR} >/dev/null 2>&1 & # ouro-authority-gateway`,
+    watchdog: `(crontab -l 2>/dev/null | grep -v gateway-keeper-watchdog; echo "*/2 * * * * /bin/sh ${KEEPER_WATCHDOG} # ouro-authority-gateway-watchdog") | crontab - # ouro-authority-gateway-watchdog`,
+};
+const BOOT_OWNERS = [BOOT_LINE, exports.SANCTUARY_KEEPER_BOOT_LINES.supervisor];
+const KNOWN_BOOT_LINES = [...BOOT_OWNERS, exports.SANCTUARY_KEEPER_BOOT_LINES.watchdog];
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 // The gateway verifies every pinned package file before it reports ready. With a cold
 // page cache on Unraid's array that takes minutes, so readiness gets a generous budget
@@ -293,7 +303,7 @@ class SanctuaryAuthorityRootLifecycle {
             return false;
         this.#record(`${this.#epochRoot()}/stage.json`, { packageDigest: this.#request.packageDigest });
         this.#verifyPackage(undefined, hostExecution);
-        if (this.#bootScript().text.split("\n").filter((line) => line === BOOT_LINE).length !== 1
+        if (this.#bootScript().text.split("\n").filter((line) => BOOT_OWNERS.includes(line)).length !== 1
             || digest(this.#private(BOOT)) !== digest(fs.readFileSync(this.#p(`${ROOT}/package/deploy/unraid/sanctuary-authority-service.sh`))))
             throw new Error("Sanctuary installed boot lifecycle changed");
         return true;
@@ -379,10 +389,10 @@ class SanctuaryAuthorityRootLifecycle {
         }
         this.#verifyPackage(undefined, hostExecution);
         const { text: boot, mode: bootMode } = this.#bootScript();
-        if (boot.split("\n").some((line) => line.includes("ouro-authority") && line !== BOOT_LINE))
+        if (boot.split("\n").some((line) => line.includes("ouro-authority") && !KNOWN_BOOT_LINES.includes(line)))
             throw new Error("Sanctuary boot ownership is ambiguous");
         this.#write(BOOT, fs.readFileSync(this.#p(`${ROOT}/package/deploy/unraid/sanctuary-authority-service.sh`), "utf8"));
-        if (!boot.split("\n").includes(BOOT_LINE))
+        if (!boot.split("\n").some((line) => BOOT_OWNERS.includes(line)))
             this.#write("/boot/config/go", `${boot}${boot.endsWith("\n") ? "" : "\n"}${BOOT_LINE}\n`, bootMode);
         this.#write(`${this.#epochRoot()}/stage.json`, JSON.stringify({ packageDigest: this.#request.packageDigest }));
     }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.840",
+  "version": "0.1.0-alpha.842",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.840",
+      "version": "0.1.0-alpha.842",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.840",
+  "version": "0.1.0-alpha.842",
   "engines": {
     "node": ">=22"
   },