@ouro.bot/cli 0.1.0-alpha.843 → 0.1.0-alpha.844

package/changelog.json

@@ -1,6 +1,13 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.844",
+      "changes": [
+        "Sanctuary authority start is faster and no longer blind (D-036): package verification walks the tree once without following symlinks and then reads each file with O_NOFOLLOW, instead of resolving every file's real path (on Unraid that was two-thirds of each pass: about 15 s instead of about 47 s per pass, and a gateway start runs two), and the gateway's own output now goes to a root-only, size-capped gateway.log in the authority directory instead of nowhere.",
+        "Sanctuary: the agent's own view of its senses reports the tokenless root-authority Telegram as ready (it said needs_config while Telegram worked), and a token found in the resident's config as needs_config, matching the daemon's rule (D-047)."
+      ]
+    },
     {
       "version": "0.1.0-alpha.843",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.843",
+  "runtimeVersion": "0.1.0-alpha.844",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.843</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.844</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-installation.js

@@ -58,8 +58,12 @@ function directory(filePath, uid, gid, mode) {
         throw new Error("Sanctuary authority installation directory metadata changed");
     }
 }
-function readOwned(filePath, uid, gid, mode) {
-    canonical(filePath);
+/** `trustedParent`: the caller already walked every parent directory without following
+ * symlinks, so only the leaf needs guarding, and O_NOFOLLOW does that. Resolving each
+ * package file's real path cost two-thirds of every verification on Unraid (D-036). */
+function readOwned(filePath, uid, gid, mode, trustedParent = false) {
+    if (!trustedParent)
+        canonical(filePath);
     const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
     try {
         const stat = fs.fstatSync(descriptor);
@@ -102,8 +106,6 @@ function verifySanctuaryAuthorityInstallation(input) {
             || typeof pin.digest !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(pin.digest) || ![0o600, 0o644, 0o700, 0o755].includes(pin.mode)) {
             throw new Error("Sanctuary authority package file pin is invalid");
         }
-        if (digest(readOwned(path.join(input.packageRoot, relative), uid, gid, pin.mode)) !== pin.digest)
-            throw new Error("Sanctuary authority package file digest changed");
     }
     const actual = [];
     const walk = (relative) => {
@@ -125,6 +127,13 @@ function verifySanctuaryAuthorityInstallation(input) {
     walk("");
     if (JSON.stringify(actual.sort()) !== JSON.stringify(expected))
         throw new Error("Sanctuary authority package inventory changed");
+    // The walk above reached every file through real (not symlinked) directories, so a
+    // file read only needs to refuse a symlinked leaf.
+    for (const relative of expected) {
+        const pin = manifest.files[relative];
+        if (digest(readOwned(path.join(input.packageRoot, relative), uid, gid, pin.mode, true)) !== pin.digest)
+            throw new Error("Sanctuary authority package file digest changed");
+    }
     const controllers = ["cpu", "memory", "pids"];
     const readControl = (name) => fs.readFileSync(path.join(input.cgroupRoot, name), "utf8").trim();
     for (const name of ["cgroup.controllers", "cgroup.subtree_control"]) {

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -73,6 +73,7 @@ const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 // page cache on Unraid's array that takes minutes, so readiness gets a generous budget
 // (a 120 s budget failed a real rollback on 2026-09-24).
 const GATEWAY_READY_TIMEOUT_MS = 900_000;
+const GATEWAY_LOG_MAX_BYTES = 5 * 1024 * 1024;
 const TEMPLATE_JOURNAL = "/boot/config/custom/ouro-butler/docker-man-template-transaction.json";
 // In-place upgrade of an installed authority: same epoch (token, issuer, cursor,
 // gateway state), new reviewed package and resident image. Every root record it
@@ -536,9 +537,16 @@ class SanctuaryAuthorityRootLifecycle {
             throw new Error("Sanctuary root token custody is not exclusive");
         if (this.#pid() === null) {
             this.#remove(`${this.#epochRoot()}/readiness.json`);
-            const child = (0, node_child_process_1.spawn)(this.#p("/usr/local/bin/node"), [this.#p(`${ROOT}/package/dist/heart/daemon/sanctuary-telegram-authority-entry.js`), "--config", this.#p(`${ROOT}/active.json`)], {
-                cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }, detached: true, stdio: "ignore",
-            });
+            const log = this.#gatewayLog();
+            let child;
+            try {
+                child = (0, node_child_process_1.spawn)(this.#p("/usr/local/bin/node"), [this.#p(`${ROOT}/package/dist/heart/daemon/sanctuary-telegram-authority-entry.js`), "--config", this.#p(`${ROOT}/active.json`)], {
+                    cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }, detached: true, stdio: ["ignore", log, log],
+                });
+            }
+            finally {
+                fs.closeSync(log);
+            }
             child.unref();
             let failed = false;
             child.once("error", () => { failed = true; });
@@ -551,6 +559,17 @@ class SanctuaryAuthorityRootLifecycle {
         else
             await this.#wait(() => this.#ready(), GATEWAY_READY_TIMEOUT_MS);
     }
+    /** The gateway's own output, kept root-only beside the token it guards and capped at two
+     * generations. It used to go nowhere, so a gateway that exited at startup said nothing
+     * (D-036: finding "host cgroup entry is invalid" took a hand-run gateway). */
+    #gatewayLog() {
+        const file = this.#p(`${ROOT}/gateway.log`);
+        if (fs.existsSync(file) && fs.statSync(file).size > GATEWAY_LOG_MAX_BYTES)
+            fs.renameSync(file, `${file}.1`);
+        const fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW, 0o600);
+        fs.fchmodSync(fd, 0o600);
+        return fd;
+    }
     #target() {
         const target = this.#containers().find((container) => container.Name === "/ouro-butler");
         if (!target || target.Image !== this.#transaction.targetImageId || target.Config.User !== "10001:10001"

package/dist/heart/turn-context.js

@@ -212,9 +212,14 @@ function readSenseStatusLines() {
                 ? openAIRealtimeVoiceReady
                 : cascadeVoiceReady,
         a2a: true,
-        telegram: hasTextField(runtimePayload, "telegramBotToken")
-            && hasTextField(runtimePayload, "telegramAuthorizedUserId")
-            && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
+        // Sanctuary's resident is deliberately tokenless: the root authority gateway holds the
+        // token, so a token in the resident's config would be the misconfiguration. Mirror the
+        // daemon's rule (sense-manager) instead of reporting a working sense as needs_config (D-047).
+        telegram: agentName === "sanctuary"
+            ? runtimeConfig.ok && machineRuntimeConfig.ok && !Object.hasOwn(runtimePayload, "telegramBotToken") && !Object.hasOwn(machinePayload, "telegramBotToken")
+            : hasTextField(runtimePayload, "telegramBotToken")
+                && hasTextField(runtimePayload, "telegramAuthorizedUserId")
+                && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
     };
     const rows = [

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.843",
+  "version": "0.1.0-alpha.844",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.843",
+      "version": "0.1.0-alpha.844",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.843",
+  "version": "0.1.0-alpha.844",
   "engines": {
     "node": ">=22"
   },