@ouro.bot/cli 0.1.0-alpha.871 → 0.1.0-alpha.873

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.873",
+      "changes": [
+        "A new butler:ship command (npm run butler:ship -- <version>) ships a Butler release through the replay gate in one step: it waits for the release's coverage-gate and the image on the host, stages that release's upgrade and gate scripts, runs preflight, starts the detached gated upgrade, follows the case lines until the upgrade process has exited, and verifies, then prints one JSON result (kept, rolled_back, refused or failed); it stops early with a clear message when no push-triggered coverage-gate run exists for the merge commit, because the image would never be published."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.872",
+      "changes": [
+        "The replay gate's books-up case accepts a live service probe as well as the container list, so a correct live answer no longer fails the upgrade."
+      ]
+    },
     {
       "version": "0.1.0-alpha.871",
       "changes": [

package/deploy/unraid/README.txt

@@ -2981,3 +2981,13 @@ Audit and safety verification:
   key can be adopted after process death. Raw recovery proof is durably deleted
   only after the exact authentication rejection and its redacted replayable
   receipt are fsynced. Never substitute names for IDs when revoking keys.
+
+Shipping a Butler release (one command)
+
+  From the Mac, after the release PR has merged to main:
+
+    npm run butler:ship -- <version> [--host sanctuary] [--no-gate] [--plant <case>] [--dry-run]
+
+  It resolves the release merge commit, waits for that commit's coverage-gate and for the GHCR image to resolve on the host, backs up the host's /tmp/butler-upgrade.mjs and /tmp/sanctuary-replay-gate.mjs to .bak-<previous>, stages the release's own copies, runs preflight, starts the gated upgrade detached with its log at /var/log/ouro-upgrade-<version>.log, follows the case lines to a terminal line and runs verify. The last stdout line is one JSON result: {version, result: kept|rolled_back|refused|failed, running_image, cases, verify, log}. Exit 0 only when the result is kept and verify is green. --dry-run runs only the read-only steps. BUTLER_HOST overrides the default host alias.
+
+  Manual fallback (the script automates exactly these): wait for coverage-gate and `docker manifest inspect ghcr.io/ourostack/ouroboros-butler:<version>` on the host; copy deploy/unraid/sanctuary-butler-upgrade.mjs to /tmp/butler-upgrade.mjs and deploy/unraid/sanctuary-replay-gate.mjs to /tmp/sanctuary-replay-gate.mjs; run `node /tmp/butler-upgrade.mjs preflight <version>`; start `setsid nohup /usr/local/bin/node /tmp/butler-upgrade.mjs upgrade <version> > /var/log/ouro-upgrade-<version>.log 2>&1 < /dev/null &`; read the log for GATE PASS, GATE FAIL (rolled back), UPGRADE done, REFUSING or FAILED; then run `node /tmp/butler-upgrade.mjs verify`. Check for a live upgrade with pgrep -f "[b]utler-upgrade.mjs upgrade" so the check does not match its own shell.

package/deploy/unraid/sanctuary-replay-gate.mjs

@@ -151,7 +151,8 @@ export const CASES = [
       const claim = upDownClaim(reply)
       const actual = after.containers["calibre-web"] ? "up" : "down"
       return [
-        check("the container list tool was used", callsNamed(trace, /^unraid_list_containers$/).length > 0),
+        // Either live check counts: the container list, or the service probe of the Books URL. An answer from memory does not.
+        check("a live status tool was used", callsNamed(trace, /^unraid_(list_containers|check_services)$/).length > 0),
         check("the reply's up/down claim matches docker ps", claim === actual, `claimed ${claim}, docker says ${actual}`),
       ]
     },

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.871",
+  "runtimeVersion": "0.1.0-alpha.873",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.871</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.873</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.871",
+  "version": "0.1.0-alpha.873",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.871",
+      "version": "0.1.0-alpha.873",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.871",
+  "version": "0.1.0-alpha.873",
   "engines": {
     "node": ">=22"
   },
@@ -46,6 +46,7 @@
     "lint": "eslint src/",
     "package:verify-assets": "node scripts/package-assets.cjs",
     "prepack": "npm run build && npm run package:verify-assets",
+    "butler:ship": "node scripts/butler-ship.mjs",
     "release:bump": "node scripts/release-bump.cjs",
     "release:preflight": "node scripts/release-preflight.cjs",
     "release:trust:check": "node scripts/npm-trusted-publishers.cjs check",