@ouro.bot/cli 0.1.0-alpha.871 → 0.1.0-alpha.874

package/changelog.json

@@ -1,6 +1,24 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.874",
+      "changes": [
+        "Replay identities (the replay gate's test peers) can no longer write the real owner steward policy, even by a no-op restatement; a new steward_policy_manage correct_provenance action fixes a wrong attribution with an audited, value-preserving write; and the replay gate gains an owner-policy-untouched case that hashes steward.json and its audit file before the first case and after the last"
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.873",
+      "changes": [
+        "A new butler:ship command (npm run butler:ship -- <version>) ships a Butler release through the replay gate in one step: it waits for the release's coverage-gate and the image on the host, stages that release's upgrade and gate scripts, runs preflight, starts the detached gated upgrade, follows the case lines until the upgrade process has exited, and verifies, then prints one JSON result (kept, rolled_back, refused or failed); it stops early with a clear message when no push-triggered coverage-gate run exists for the merge commit, because the image would never be published."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.872",
+      "changes": [
+        "The replay gate's books-up case accepts a live service probe as well as the container list, so a correct live answer no longer fails the upgrade."
+      ]
+    },
     {
       "version": "0.1.0-alpha.871",
       "changes": [

package/deploy/unraid/README.txt

@@ -2981,3 +2981,13 @@ Audit and safety verification:
   key can be adopted after process death. Raw recovery proof is durably deleted
   only after the exact authentication rejection and its redacted replayable
   receipt are fsynced. Never substitute names for IDs when revoking keys.
+
+Shipping a Butler release (one command)
+
+  From the Mac, after the release PR has merged to main:
+
+    npm run butler:ship -- <version> [--host sanctuary] [--no-gate] [--plant <case>] [--dry-run]
+
+  It resolves the release merge commit, waits for that commit's coverage-gate and for the GHCR image to resolve on the host, backs up the host's /tmp/butler-upgrade.mjs and /tmp/sanctuary-replay-gate.mjs to .bak-<previous>, stages the release's own copies, runs preflight, starts the gated upgrade detached with its log at /var/log/ouro-upgrade-<version>.log, follows the case lines to a terminal line and runs verify. The last stdout line is one JSON result: {version, result: kept|rolled_back|refused|failed, running_image, cases, verify, log}. Exit 0 only when the result is kept and verify is green. --dry-run runs only the read-only steps. BUTLER_HOST overrides the default host alias.
+
+  Manual fallback (the script automates exactly these): wait for coverage-gate and `docker manifest inspect ghcr.io/ourostack/ouroboros-butler:<version>` on the host; copy deploy/unraid/sanctuary-butler-upgrade.mjs to /tmp/butler-upgrade.mjs and deploy/unraid/sanctuary-replay-gate.mjs to /tmp/sanctuary-replay-gate.mjs; run `node /tmp/butler-upgrade.mjs preflight <version>`; start `setsid nohup /usr/local/bin/node /tmp/butler-upgrade.mjs upgrade <version> > /var/log/ouro-upgrade-<version>.log 2>&1 < /dev/null &`; read the log for GATE PASS, GATE FAIL (rolled back), UPGRADE done, REFUSING or FAILED; then run `node /tmp/butler-upgrade.mjs verify`. Check for a live upgrade with pgrep -f "[b]utler-upgrade.mjs upgrade" so the check does not match its own shell.

package/deploy/unraid/sanctuary-replay-gate.mjs

@@ -151,7 +151,8 @@ export const CASES = [
       const claim = upDownClaim(reply)
       const actual = after.containers["calibre-web"] ? "up" : "down"
       return [
-        check("the container list tool was used", callsNamed(trace, /^unraid_list_containers$/).length > 0),
+        // Either live check counts: the container list, or the service probe of the Books URL. An answer from memory does not.
+        check("a live status tool was used", callsNamed(trace, /^unraid_(list_containers|check_services)$/).length > 0),
         check("the reply's up/down claim matches docker ps", claim === actual, `claimed ${claim}, docker says ${actual}`),
       ]
     },
@@ -244,6 +245,18 @@ export function newAwaits(before, after) {
   return [...after.awaiting.filter((entry) => !known.has(key(entry))).map((entry) => view(entry, false)), ...after.done.filter((entry) => !known.has(key(entry))).map((entry) => view(entry, true))]
 }
 
+/**
+ * Cross-cutting proof that the replay run never wrote the real owner policy: the sha256 of the steward.json bytes and of
+ * the audit file, taken before the first case and after the last, must be identical. No case may change them, whatever
+ * the Butler decided inside its turn (a refused policy write is fine; a written one is not).
+ */
+export function ownerPolicyUntouched(before, after) {
+  return [
+    check("the real steward.json bytes are unchanged", before.stewardSha === after.stewardSha, `${before.stewardSha?.slice(0, 12) ?? "absent"} -> ${after.stewardSha?.slice(0, 12) ?? "absent"}`),
+    check("the policy audit file bytes are unchanged", before.auditSha === after.auditSha, `${before.auditSha?.slice(0, 12) ?? "absent"} -> ${after.auditSha?.slice(0, 12) ?? "absent"}`),
+  ]
+}
+
 // ---- orchestration (all I/O is behind `host`) --------------------------------------------------------------------
 
 export async function runCase(host, testCase, { plant } = {}) {
@@ -288,6 +301,7 @@ export async function runSuite(host, { cases = CASES.map((entry) => entry.id), p
   const selected = CASES.filter((entry) => cases.includes(entry.id))
   await host.waitReady?.()
   const runStart = host.now()
+  const baseline = await host.observe()
   const results = []
   host.openWindow(windowMinutes)
   try {
@@ -309,7 +323,9 @@ export async function runSuite(host, { cases = CASES.map((entry) => entry.id), p
   const clean = readable && leaks.length === 0
   const detail = readable ? [...leaks.map((leak) => `${leak.key} (${leak.reason})`), ...info.map((entry) => `info: ${entry.key} (${entry.reason})`)].join(", ") : "state/telegram/effects is not readable, so the absence of a leak cannot be shown"
   const telegram = { id: "no-telegram", status: clean ? "pass" : "fail", checks: [check("no owner-notice Telegram effect attributable to the replay run was recorded", clean, detail)] }
-  const all = [...results, telegram]
+  const policyChecks = ownerPolicyUntouched(baseline, finalObservation)
+  const policy = { id: "owner-policy-untouched", status: policyChecks.every((entry) => entry.ok) ? "pass" : "fail", checks: policyChecks }
+  const all = [...results, policy, telegram]
   const failed = all.filter((entry) => entry.status === "fail").map((entry) => entry.id)
   return { results: all, summary: { ok: failed.length === 0, passed: all.filter((entry) => entry.status === "pass").length, skipped: all.filter((entry) => entry.status === "skipped").length, failed } }
 }
@@ -378,6 +394,11 @@ export function selfTest() {
       if (pass !== (kind === "pass")) problems.push(`${testCase.id}: the ${kind} fixture ${pass ? "passed" : "failed"} (${checks.filter((entry) => !entry.ok).map((entry) => entry.name).join("; ")})`)
     }
   }
+  const same = ownerPolicyUntouched(emptyObservation({ auditSha: "x" }), emptyObservation({ auditSha: "x" }))
+  if (!same.every((entry) => entry.ok)) problems.push("owner-policy-untouched failed on identical policy bytes")
+  for (const [name, changed] of [["steward.json", { stewardSha: "bbb" }], ["audit file", { auditSha: "y" }]]) {
+    if (ownerPolicyUntouched(emptyObservation({ auditSha: "x" }), emptyObservation({ auditSha: "x", ...changed })).every((entry) => entry.ok)) problems.push(`owner-policy-untouched passed with different ${name} bytes`)
+  }
   const stalled = { trackedDownloadStatus: "warning" }
   if (CASES.find((entry) => entry.id === "stall-kept").applicable(emptyObservation({ queue: [{ id: 1 }] })) === null) problems.push("stall-kept ran with no stalled item")
   if (CASES.find((entry) => entry.id === "stall-kept").applicable(emptyObservation({ queue: [stalled] })) !== null) problems.push("stall-kept skipped with a stalled item")
@@ -470,6 +491,7 @@ export function makeHost({ bundle = DEFAULT_BUNDLE, cardUrl, log = console.error
     },
     async observe() {
       const policy = path.join(state, "policy", "steward.json")
+      const audit = path.join(state, "policy", "policy-audit.ndjson")
       const ledger = path.join(bundle, "books", "ledger.ndjson")
       let queue = null
       try {
@@ -486,6 +508,7 @@ export function makeHost({ bundle = DEFAULT_BUNDLE, cardUrl, log = console.error
       })
       return {
         stewardSha: existsSync(policy) ? sha256(readFileSync(policy)) : null,
+        auditSha: existsSync(audit) ? sha256(readFileSync(audit)) : null,
         ledgerLines: readLines(ledger).length,
         queue,
         containers,
@@ -535,6 +558,7 @@ export function provision({ bundle = DEFAULT_BUNDLE, cardUrl, log = console.log,
   const sink = path.join(replayDir, "notices.ndjson")
   writeFileSync(sink, "", { flag: "a", mode: 0o600 }); chownSync(sink, owner.uid, owner.gid)
   mkdirSync(clientDir, { recursive: true, mode: 0o700 }); chownSync(clientDir, owner.uid, owner.gid)
+  const replayIdentities = {}
   const previous = existsSync(path.join(clientDir, "provision.json")) ? JSON.parse(readFileSync(path.join(clientDir, "provision.json"), "utf8")) : {}
   const resolvedCard = cardUrl ?? previous.cardUrl ?? discover()
   const out = { cardUrl: resolvedCard }
@@ -554,8 +578,15 @@ export function provision({ bundle = DEFAULT_BUNDLE, cardUrl, log = console.log,
     if (grant && record.delegationGrant?.scope !== "principal_commands") grantPrincipalCommands(file)
     if (!grant && record.delegationGrant) throw new Error(`${name} must not hold a delegation grant`)
     out[who] = { friendId, did, containerIdentityFile, hostIdentity }
+    replayIdentities[friendId] = { name, who }
     log(`${name}: friend ${friendId} (${trust}${grant ? ", principal_commands" : ", no grant"})`)
   }
+  // Permanent marker, root-owned and never cleared with the window: the Butler refuses every owner-policy write from these friends (src/a2a/replay-harness.ts isReplayIdentity).
+  const registry = path.join(replayDir, "identities.json")
+  let known = {}
+  try { known = JSON.parse(readFileSync(registry, "utf8")).friends ?? {} } catch { /* first provision */ }
+  writeAtomic(registry, JSON.stringify({ friends: { ...known, ...replayIdentities } }, null, 2), 0o644)
+  chownSync(registry, rootUid, rootGid)
   writeAtomic(path.join(clientDir, "provision.json"), JSON.stringify(out, null, 2), 0o644)
   log(`provisioned; card ${resolvedCard}`)
   return out

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.871",
+  "runtimeVersion": "0.1.0-alpha.874",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.871</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.874</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/a2a/replay-harness.js

@@ -36,6 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.REPLAY_WINDOW_MAX_MS = void 0;
 exports.replayWindowPath = replayWindowPath;
 exports.replaySinkPath = replaySinkPath;
+exports.replayIdentitiesPath = replayIdentitiesPath;
+exports.isReplayIdentity = isReplayIdentity;
 exports.isReplayWindowOpen = isReplayWindowOpen;
 exports.appendReplayNotice = appendReplayNotice;
 exports.replayNoticeRecorded = replayNoticeRecorded;
@@ -62,6 +64,30 @@ function replayWindowPath(agentRoot) {
 function replaySinkPath(agentRoot) {
     return path.join(replayDir(agentRoot), "notices.ndjson");
 }
+/** Permanent registry of replay identities, written by the host's provisioning and never cleared. */
+function replayIdentitiesPath(agentRoot) {
+    return path.join(replayDir(agentRoot), "identities.json");
+}
+function listsFriend(file, friendId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        // A missing file lists nobody; a file that exists but cannot be read or parsed fails closed.
+        return error.code !== "ENOENT";
+    }
+    const friends = parsed?.friends;
+    return !!friends && typeof friends === "object" && Object.hasOwn(friends, friendId);
+}
+/**
+ * True when `friendId` is a replay identity: listed in the permanent registry, or holding any window entry (open or
+ * expired). Unlike the window check this needs no trusted-owner proof, because the marker only ever restricts: forging
+ * an entry can block a friend from writing owner policy, never grant anything. Owner policy writes refuse these identities.
+ */
+function isReplayIdentity(agentRoot, friendId) {
+    return listsFriend(replayIdentitiesPath(agentRoot), friendId) || listsFriend(replayWindowPath(agentRoot), friendId);
+}
 /** A root-controlled directory: a real directory (no symlink), owned by the trusted uid, writable by neither group nor other. */
 function isTrustedDirectory(target, trustedUid) {
     try {

package/dist/heart/steward-policy.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readStewardPolicy = readStewardPolicy;
+exports.assertNotReplayIdentity = assertNotReplayIdentity;
 exports.updateStewardPolicy = updateStewardPolicy;
 exports.readRoutineActionReceipts = readRoutineActionReceipts;
 exports.inspectRoutineActionGrant = inspectRoutineActionGrant;
@@ -47,6 +48,7 @@ const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const node_util_1 = require("node:util");
 const runtime_1 = require("../nerves/runtime");
+const replay_harness_1 = require("../a2a/replay-harness");
 const session_transaction_1 = require("../mind/session-transaction");
 const EMPTY_POLICY = { schemaVersion: 1, version: 0, desiredStates: {}, routineActionGrants: {}, updatedAt: null };
 const MAX_POLICY_BYTES = 1024 * 1024;
@@ -82,8 +84,8 @@ function delegation(value) {
         && text(value.delegateFriendId) && text(value.delegateDid) && text(value.noticeId);
 }
 function desiredEntry(value, version) {
-    return record(value) && exactKeys(value, ["value", "provenance", "version", "source"], ["expiresAt"])
-        && text(value.value) && text(value.source) && positiveInteger(value.version) && value.version <= version
+    return record(value) && exactKeys(value, ["value", "provenance", "version", "source"], ["correction", "expiresAt"])
+        && text(value.value) && text(value.source) && (value.correction === undefined || text(value.correction)) && positiveInteger(value.version) && value.version <= version
         && (value.provenance === "stated" || value.provenance === "observed" || value.provenance === "default")
         && (value.expiresAt === undefined || canonicalTime(value.expiresAt));
 }
@@ -131,14 +133,14 @@ function operationIdentity(issuer, event, requestId, kind, key) {
 }
 function auditRow(value) {
     if (!record(value) || !exactKeys(value, ["schemaVersion", "transactionId", "precedingBytesSha256", "mutationKind", "key", "mutationFingerprint", "affectedKeyResult", "affectedKeyResultSha256", "issuer", "authorizingSessionEvent", "authorization", "preimage", "preimageVersion", "preimageSha256", "postimage", "postimageVersion", "postimageSha256", "at"], ["delegatedVia"])
-        || value.schemaVersion !== 2 || (value.mutationKind !== "set_desired_state" && value.mutationKind !== "grant_routine_action")
+        || value.schemaVersion !== 2 || (value.mutationKind !== "set_desired_state" && value.mutationKind !== "grant_routine_action" && value.mutationKind !== "correct_provenance")
         || !text(value.key) || !text(value.issuer) || !text(value.authorizingSessionEvent) || !ownerAuthorization(value.authorization)
         || (value.delegatedVia !== undefined && !delegation(value.delegatedVia))
         || typeof value.preimage !== "string" || typeof value.postimage !== "string" || !canonicalTime(value.at))
         return false;
     const before = policyImage(value.preimage);
     const after = policyImage(value.postimage);
-    const result = value.mutationKind === "set_desired_state" ? after.desiredStates[value.key] : after.routineActionGrants[value.key];
+    const result = value.mutationKind === "grant_routine_action" ? after.routineActionGrants[value.key] : after.desiredStates[value.key];
     if (!result || value.preimageVersion !== before.version || value.postimageVersion !== after.version
         || after.version !== before.version + 1 || result.version !== after.version || after.updatedAt !== value.at
         || value.preimageSha256 !== sha256(value.preimage) || value.postimageSha256 !== sha256(value.postimage)
@@ -149,9 +151,17 @@ function auditRow(value) {
         return false;
     if ("action" in result && (result.issuer !== value.issuer || result.authorizingSessionEvent !== value.authorizingSessionEvent || result.authorizedAt !== value.at))
         return false;
+    if (value.mutationKind === "correct_provenance") {
+        // A correction changes the source and records its note on one existing entry, and nothing else about it.
+        // A missing prior entry spreads to nothing, so the comparison fails without a separate branch.
+        const prior = before.desiredStates[value.key];
+        const corrected = result;
+        if (!(0, node_util_1.isDeepStrictEqual)(result, { ...prior, source: corrected.source, correction: corrected.correction, version: after.version }))
+            return false;
+    }
     const expected = {
         ...before, version: after.version, updatedAt: value.at,
-        desiredStates: value.mutationKind === "set_desired_state" ? { ...before.desiredStates, [value.key]: result } : before.desiredStates,
+        desiredStates: value.mutationKind !== "grant_routine_action" ? { ...before.desiredStates, [value.key]: result } : before.desiredStates,
         routineActionGrants: value.mutationKind === "grant_routine_action" ? { ...before.routineActionGrants, [value.key]: result } : before.routineActionGrants,
     };
     return (0, node_util_1.isDeepStrictEqual)(after, expected);
@@ -312,7 +322,13 @@ function readPolicyState(agentRoot) {
 function readStewardPolicy(agentRoot) {
     return readPolicyState(agentRoot).policy;
 }
+/** Replay identities (the gate's test peers) can never write owner policy: the marker comes from the friend ids, never from model text. */
+function assertNotReplayIdentity(agentRoot, friendIds) {
+    if (friendIds.some((friendId) => friendId !== undefined && (0, replay_harness_1.isReplayIdentity)(agentRoot, friendId)))
+        throw new Error("replay identities cannot write owner policy");
+}
 function updateStewardPolicy(agentRoot, input) {
+    assertNotReplayIdentity(agentRoot, [input.actor.friendId, input.actor.delegatedVia?.delegateFriendId]);
     if (input.actor.trustLevel !== "family")
         throw new Error("steward policy mutation requires family authority");
     const authorizingSessionEvent = requireText(input.actor.sessionEventId, "authorizing session event");
@@ -322,7 +338,7 @@ function updateStewardPolicy(agentRoot, input) {
         throw new Error("steward policy mutation requires current owner authorization");
     if (input.actor.delegatedVia !== undefined && !delegation(input.actor.delegatedVia))
         throw new Error("steward policy delegation is invalid");
-    if (input.mutation.kind !== "set_desired_state" && input.mutation.kind !== "grant_routine_action")
+    if (input.mutation.kind !== "set_desired_state" && input.mutation.kind !== "grant_routine_action" && input.mutation.kind !== "correct_provenance")
         throw new Error("steward policy mutation kind is invalid");
     return (0, session_transaction_1.withImmediateSessionTurnLease)(policyPath(agentRoot), (lease) => {
         const snapshot = readAuditedPolicy(agentRoot, lease);
@@ -330,14 +346,21 @@ function updateStewardPolicy(agentRoot, input) {
         const now = input.now ?? new Date().toISOString();
         if (!canonicalTime(now))
             throw new Error("policy update time must be canonical");
-        const expiresAt = optionalExpiry(input.mutation.expiresAt);
+        const expiresAt = input.mutation.kind === "correct_provenance" ? undefined : optionalExpiry(input.mutation.expiresAt);
         const version = current.version + 1;
         if (!positiveInteger(version))
             throw new Error("steward policy version is exhausted");
         const next = { ...current, version, desiredStates: { ...current.desiredStates }, routineActionGrants: { ...current.routineActionGrants }, updatedAt: now };
-        const key = requireText(input.mutation.key, input.mutation.kind === "set_desired_state" ? "desired state key" : "routine action key");
+        const key = requireText(input.mutation.key, input.mutation.kind === "grant_routine_action" ? "routine action key" : "desired state key");
         let affectedKeyResult;
-        if (input.mutation.kind === "set_desired_state") {
+        if (input.mutation.kind === "correct_provenance") {
+            const existing = current.desiredStates[key];
+            if (!existing)
+                throw new Error("provenance correction requires an existing desired state key");
+            affectedKeyResult = { ...existing, source: requireText(input.mutation.source, "corrected source"), correction: requireText(input.mutation.correction, "correction"), version };
+            next.desiredStates = { ...current.desiredStates, [key]: affectedKeyResult };
+        }
+        else if (input.mutation.kind === "set_desired_state") {
             if (input.mutation.provenance !== "stated" && input.mutation.provenance !== "observed" && input.mutation.provenance !== "default")
                 throw new Error("desired state provenance is invalid");
             affectedKeyResult = {
@@ -373,7 +396,7 @@ function updateStewardPolicy(agentRoot, input) {
         const previousIndex = snapshot.rows.findIndex((row) => operationIdentity(row.issuer, row.authorizingSessionEvent, row.authorization.requestId, row.mutationKind, row.key) === identity);
         if (previousIndex >= 0) {
             const previous = snapshot.rows[previousIndex];
-            const currentResult = previous.mutationKind === "set_desired_state" ? current.desiredStates[key] : current.routineActionGrants[key];
+            const currentResult = previous.mutationKind === "grant_routine_action" ? current.routineActionGrants[key] : current.desiredStates[key];
             if (previous.mutationFingerprint !== fingerprint || snapshot.rows.slice(previousIndex + 1).some((row) => row.mutationKind === previous.mutationKind && row.key === key)
                 || !(0, node_util_1.isDeepStrictEqual)(currentResult, previous.affectedKeyResult))
                 throw new Error("steward policy transaction replay changed");
@@ -442,8 +465,8 @@ function currentRequester(value, target) {
         && text(value.event.recordPath) && text(value.event.agent) && positiveInteger(value.event.generation)
         && text(value.event.observationRevision) && text(value.event.claimOwner);
 }
-function appliedEntry(rows, kind, key, entry) {
-    return rows.some((row) => row.mutationKind === kind && row.key === key && row.postimageVersion === entry.version && (0, node_util_1.isDeepStrictEqual)(row.affectedKeyResult, entry));
+function appliedEntry(rows, kinds, key, entry) {
+    return rows.some((row) => kinds.includes(row.mutationKind) && row.key === key && row.postimageVersion === entry.version && (0, node_util_1.isDeepStrictEqual)(row.affectedKeyResult, entry));
 }
 const UNRESOLVED_ACTION_STATES = new Set(["reserved", "attempting", "effect_acknowledged", "recovery_pending", "indeterminate"]);
 function inspectRoutineActionGrantSnapshot(policy, rows, receipts, input) {
@@ -472,7 +495,7 @@ function inspectRoutineActionGrantSnapshot(policy, rows, receipts, input) {
         return { allowed: false, reason: "routine action grant is missing", ...fallback };
     if (grant.provenance !== "stated")
         return { allowed: false, reason: "routine action grant must be owner-stated" };
-    if (!appliedEntry(rows, "grant_routine_action", input.key, grant))
+    if (!appliedEntry(rows, ["grant_routine_action"], input.key, grant))
         return { allowed: false, reason: "routine action grant has no applied owner authorization" };
     if (grant.action !== input.action)
         return { allowed: false, reason: "routine action does not match the grant" };
@@ -480,7 +503,7 @@ function inspectRoutineActionGrantSnapshot(policy, rows, receipts, input) {
         return { allowed: false, reason: "routine action target is not authorized" };
     if (grant.expiresAt && Date.parse(grant.expiresAt) <= Date.parse(now))
         return { allowed: false, reason: "routine action grant expired", ...fallback };
-    if (!activeDesired || desired.provenance !== "stated" || !appliedEntry(rows, "set_desired_state", desiredKey, desired))
+    if (!activeDesired || desired.provenance !== "stated" || !appliedEntry(rows, ["set_desired_state", "correct_provenance"], desiredKey, desired))
         return { allowed: false, reason: "container has no active applied owner-stated desired state" };
     if (!["on", "always_on", "expected_on"].includes(desiredValue) && !(desiredValue === "on_demand" && input.requester.kind !== "owner_event"))
         return { allowed: false, reason: "container desired state does not authorize this request" };

package/dist/repertoire/tools-steward-policy.js

@@ -16,16 +16,17 @@ exports.stewardPolicyToolDefinition = {
         type: "function",
         function: {
             name: "steward_policy_manage",
-            description: "Read or update the household steward's typed desired-state and routine-action policy. Updates require the current authenticated owner Telegram request and fresh authorization. expectedVersion is optional; omit it to apply against the current policy version, or supply a version from read for explicit stale-write detection.",
+            description: "Read or update the household steward's typed desired-state and routine-action policy. Updates require the current authenticated owner Telegram request and fresh authorization. Replay identities can never update it. correct_provenance (key, source, correction) is only for fixing a wrong attribution on an existing desired state: it replaces the recorded source and records the correction note, never changes the value, and leaves an audit row; do not use it to change a value. expectedVersion is optional; omit it to apply against the current policy version, or supply a version from read for explicit stale-write detection.",
             parameters: {
                 type: "object",
                 properties: {
-                    action: { type: "string", enum: ["read", "set_desired_state", "grant_routine_action"] },
+                    action: { type: "string", enum: ["read", "set_desired_state", "grant_routine_action", "correct_provenance"] },
                     expectedVersion: { type: "integer", minimum: 0, description: "Optional version returned by read. When omitted, the runtime uses the current policy version." },
                     key: { type: "string" },
                     value: { type: "string" },
                     provenance: { type: "string", enum: ["stated", "observed", "default", "installed_explicit_policy"] },
-                    source: { type: "string" },
+                    source: { type: "string", description: "Who or what stated this. For correct_provenance, the corrected attribution that replaces the recorded source." },
+                    correction: { type: "string", description: "correct_provenance only: required note naming what is being corrected and why." },
                     routineAction: { type: "string" },
                     targetsJson: { type: "string", description: "JSON array of exact target names" },
                     maxCount: { type: "integer", minimum: 1 },
@@ -54,6 +55,7 @@ exports.stewardPolicyToolDefinition = {
             throw new Error("steward policy mutation requires authenticated relationship authority");
         const { friendId, trustLevel, sessionEventId } = actor;
         const { profileId, requestId } = relationship;
+        (0, steward_policy_1.assertNotReplayIdentity)(ctx.agentRoot, [friendId, ctx.delegatedCommand?.delegateFriendId]);
         const sessionKey = ctx.currentSession?.key;
         const delegated = ctx.delegatedCommand;
         // Two ways to hold owner authority: the owner's own Telegram turn, or a delegated
@@ -82,6 +84,9 @@ exports.stewardPolicyToolDefinition = {
                 throw new Error("desired state provenance is invalid");
             mutation = { kind: "set_desired_state", key: args.key ?? "", value: args.value ?? "", provenance: args.provenance, source: sourceFor(args.source), ...(args.expiresAt ? { expiresAt: args.expiresAt } : {}) };
         }
+        else if (args.action === "correct_provenance") {
+            mutation = { kind: "correct_provenance", key: args.key ?? "", source: sourceFor(args.source), correction: args.correction ?? "" };
+        }
         else if (args.action === "grant_routine_action") {
             if (args.provenance !== "stated" && args.provenance !== "installed_explicit_policy")
                 throw new Error("routine action provenance is invalid");

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.871",
+  "version": "0.1.0-alpha.874",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.871",
+      "version": "0.1.0-alpha.874",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.871",
+  "version": "0.1.0-alpha.874",
   "engines": {
     "node": ">=22"
   },
@@ -46,6 +46,7 @@
     "lint": "eslint src/",
     "package:verify-assets": "node scripts/package-assets.cjs",
     "prepack": "npm run build && npm run package:verify-assets",
+    "butler:ship": "node scripts/butler-ship.mjs",
     "release:bump": "node scripts/release-bump.cjs",
     "release:preflight": "node scripts/release-preflight.cjs",
     "release:trust:check": "node scripts/npm-trusted-publishers.cjs check",