@ouro.bot/cli 0.1.0-alpha.873 → 0.1.0-alpha.876

package/dist/heart/source-grounding.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXEMPT_WORDS = exports.HOUSE_VOCABULARY = exports.LABEL_WORDS = exports.COMMON_STARTERS = void 0;
+exports.isLookupToolCall = isLookupToolCall;
+exports.mentions = mentions;
+exports.candidateNames = candidateNames;
+exports.lowercaseListNames = lowercaseListNames;
+exports.sourceGroundingFinding = sourceGroundingFinding;
+exports.sourceGroundingError = sourceGroundingError;
+exports.withUnverifiedDisclosure = withUnverifiedDisclosure;
+/**
+ * Primary-source grounding for claims about external works (books, shows, films, their characters).
+ *
+ * A model asked about a work it half-remembers will invent plausible names and present them as fact; a principle in
+ * the prompt did not stop that. This check runs where an answer is about to be delivered and judges the answer against
+ * what the turn actually looked up: a name that appears in no lookup result, and is not house vocabulary or the
+ * person's own words, is a name the model made up. Only a lookup (a web search or page fetch, a catalog lookup, a
+ * curl, the books tool) can clear a name that is claimed to come from a work. Memory, notes, the diary and ordinary
+ * shell output cannot, because they may hold an earlier fabrication. Pure functions; the runtime calls them at settle
+ * for agents that opt in (see ToolContext.answerGates).
+ */
+const runtime_1 = require("../nerves/runtime");
+const LOOKUP_TOOL_NAMES = new Set(["web_search", "media_search", "media_episodes"]);
+const LOOKUP_TOOL_PATTERN = /^(web_fetch|fetch_url|fetch_page|read_url|read_page|browse\w*)$/;
+/** A lookup is a command whose command word is curl or wget, or the books tool; echoing a URL, a here-string or a grep over text is not one. */
+const SHELL_LOOKUP_SEGMENT = /^\s*(?:\w+=\S*\s+)*(?:(?:sudo|env|command|time|nohup)\s+)*(?:(?:curl|wget)\b|books\s+(?:get|search|series|library\s+(?:find|search))\b)/;
+const SHELL_SEGMENT_SEPARATOR = /&&|\|\||[;|\n]/;
+const STRONG_CUE = /\b(books?|novels?|movies?|films?|anime|saga|trilogy|albums?|episodes?|protagonists?)\b/i;
+const WORK_CUE = /\b(books?|novels?|series|saga|trilogy|shows?|movies?|films?|anime|characters?|protagonists?|authors?|episodes?|seasons?|albums?|bands?|lore|cast)\b/i;
+const COPULA_AFTER_NAME = /^(?:['’]s\b|\s+(?:is|was|are|were|isn['’]t|wasn['’]t|has|had|does|did)\b)/i;
+/** Words that start a sentence or a bullet without being a name. */
+exports.COMMON_STARTERS = new Set([
+    "the", "this", "that", "these", "those", "it", "its", "i", "so", "and", "but", "or", "yes", "no", "not", "sure", "okay", "ok", "here", "there",
+    "what", "when", "where", "why", "how", "who", "which", "if", "then", "now", "also", "both", "one", "two", "my", "your", "our", "we", "you", "he", "she", "they",
+    "got", "thanks", "thank", "done", "understood", "noted", "good", "great", "fine", "sorry", "will", "can", "could", "would", "should", "let", "yeah", "yep", "nope",
+    "right", "well", "anyway", "still", "just", "all", "any", "some", "each", "every", "for", "from", "with", "without", "to", "in", "on", "at", "by", "as", "is",
+    "are", "was", "were", "do", "does", "did", "have", "has", "had", "maybe", "probably", "honestly", "unfortunately", "looks", "seems", "see", "check", "try",
+    "use", "make", "keep", "stop", "start", "once", "first", "next", "last", "before", "after", "because", "since", "while", "though", "although", "however",
+    "otherwise", "instead", "meanwhile", "today", "tonight", "tomorrow", "yesterday", "more", "most", "many", "other", "another", "such", "only", "even",
+    "about", "over", "under", "between", "among", "like", "per", "plus", "both", "either", "neither", "whether", "yet", "nothing", "something", "everything",
+    "anything", "everyone", "someone", "anyone", "nobody", "overall", "basically", "actually", "generally", "usually", "often", "sometimes", "never", "always",
+    "note", "tip", "warning", "heads", "update", "summary", "answer", "plan", "status", "result", "results", "source", "sources", "todo",
+]);
+/** A sentence-opening "Word:" is a label when the word is one of these; any other "Name:" is treated as a name. */
+exports.LABEL_WORDS = new Set([
+    "note", "notes", "tip", "warning", "update", "summary", "answer", "plan", "status", "result", "results", "source", "sources", "todo", "next", "why", "how", "what",
+    "done", "reply", "title", "healthy", "snoozed", "down", "up", "broken", "failed", "pending", "running", "stopped", "paused", "queued", "cast", "characters", "authors", "books", "series", "shows", "movies", "episodes", "tldr", "caveat", "caveats", "options", "option",
+]);
+/** Words that read as names but are not about a work: the house, the tools it uses, months, weekdays, common brands and services. */
+exports.HOUSE_VOCABULARY = new Set([
+    "ari", "butler", "claude", "code", "sanctuary", "jellyfin", "sonarr", "radarr", "prowlarr", "jellyseerr", "calibre", "books", "telegram", "unraid", "docker",
+    "mendelow", "cloud", "pocketbook", "astraweb", "usenet", "sabnzbd", "bazarr", "tmdb", "tvdb", "libgen", "plex", "github", "google", "apple", "amazon", "netflix",
+    "hulu", "disney", "youtube", "spotify", "kindle", "kobo", "goodreads", "audible", "python", "javascript", "typescript", "node", "lodash", "vitest", "react",
+    "linux", "windows", "macos", "android", "chrome", "firefox", "safari", "slack", "discord", "wikipedia", "english", "ouro", "ouroboros", "a2a", "radarr", "http", "https",
+    "january", "february", "march", "april", "may", "june", "july", "august", "september", "october", "november", "december",
+    "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday",
+]);
+/** Status verbs and media nouns that open or fill ordinary replies about media work ("Added the show Silo. Season 1 is grabbing now."): never names, wherever they sit. */
+exports.EXEMPT_WORDS = new Set([
+    "added", "adding", "found", "finding", "sent", "sending", "searching", "searched", "grabbing", "grabbed", "grab", "season", "seasons", "episode", "episodes", "queued", "queueing",
+    "monitoring", "monitored", "imported", "importing", "downloading", "downloaded", "download", "downloads", "requested", "requesting", "removed", "removing", "deleted", "updated", "updating",
+    "checking", "checked", "looking", "looked", "started", "starting", "finished", "finishing", "waiting", "stalled", "retrying", "retried", "marked", "set", "setting", "assigned", "assigning",
+    "movie", "movies", "show", "shows", "book", "books", "series", "film", "films", "less", "tell", "ready", "missing", "available", "unavailable", "specials", "special",
+]);
+/** Contractions are never names: I'll, I'm, They're. */
+const CONTRACTION = /^\p{L}+['’](?:ll|m|re|ve|d|t)$/iu;
+const MIN_NAME_LENGTH = 3;
+const MAX_ACRONYM_LENGTH = 5;
+const LOWERCASE_LIST_INTRO = /\b(?:characters?|cast|names?|authors?|protagonists?|bands?|members?)\b[ \t]*(?::|—|-|are|includes?|including|like|such as)[ \t]+([^.!?\n]+)/gi;
+const LOWERCASE_LIST_ITEM = /^[a-z][a-z'’-]{3,}$/;
+const LOWERCASE_LIST_STOP = new Set(["others", "etc", "more", "many", "several", "various", "everyone", "anyone", "someone", "people", "these", "those", "them", "others", "similar", "same", "like"]);
+/** True when the call read a primary source: a web search or page fetch, a catalog lookup, a curl, or the books tool. */
+function isLookupToolCall(record) {
+    if (LOOKUP_TOOL_NAMES.has(record.name) || LOOKUP_TOOL_PATTERN.test(record.name))
+        return true;
+    return record.name === "shell" && (record.args.command ?? "").split(SHELL_SEGMENT_SEPARATOR).some((segment) => SHELL_LOOKUP_SEGMENT.test(segment));
+}
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Whole-word, case-insensitive, Unicode-aware: "Dross" is not found inside "Drossel" or "Gross". */
+function mentions(haystack, name) {
+    return new RegExp(`(?<![\\p{L}\\p{N}])${escapeRegExp(name)}(?![\\p{L}\\p{N}])`, "iu").test(haystack);
+}
+const TOKEN = /\p{Lu}[\p{L}\p{M}'’]*/gu;
+/** Capitalised words that read as names, in order of first appearance, case-insensitively de-duplicated. House vocabulary is not a name. */
+function candidateNames(text) {
+    const seen = new Set();
+    const names = [];
+    for (const match of text.matchAll(TOKEN)) {
+        const word = match[0].replace(/['’]s$/i, "").replace(/['’]$/, "");
+        if (word.length < MIN_NAME_LENGTH)
+            continue;
+        if (word.length <= MAX_ACRONYM_LENGTH && word === word.toUpperCase())
+            continue;
+        const lower = word.toLowerCase();
+        if (lower === "the" || CONTRACTION.test(word) || exports.HOUSE_VOCABULARY.has(lower) || exports.EXEMPT_WORDS.has(lower) || seen.has(lower))
+            continue;
+        const before = text.slice(0, match.index).replace(/[ \t"'“‘(\[*_#>-]+$/u, "");
+        const startsSentence = before === "" || /[.!?:\n]$/.test(before);
+        const after = text.slice(match.index + match[0].length);
+        if (startsSentence && exports.COMMON_STARTERS.has(lower))
+            continue;
+        if (startsSentence && exports.LABEL_WORDS.has(lower) && after.startsWith(":"))
+            continue;
+        if (startsSentence && !startsLikeName(text, match.index, after, lower))
+            continue;
+        seen.add(lower);
+        names.push(word);
+    }
+    return names;
+}
+/**
+ * An ordinary sentence opens with a capital whether or not the word is a name ("Silo is in Sonarr", "Remember to..."). A sentence-opening word
+ * therefore counts as a name only with a sign it is one: it is capitalised elsewhere mid-sentence, it sits in a quote or emphasis or opens a bullet,
+ * it is followed by a colon, a copula, or a list continuation ("Lindon and Yerin").
+ */
+function startsLikeName(text, index, after, lower) {
+    const rawBefore = index > 0 ? text[index - 1] : "";
+    if (/["“‘'*_]/.test(rawBefore))
+        return true;
+    const line = text.slice(text.lastIndexOf("\n", index - 1) + 1, index);
+    if (/^\s*(?:[-*•>]|\d+[.)])\s+$/.test(line))
+        return true;
+    if (after.startsWith(":") || COPULA_AFTER_NAME.test(after) || /^(?:,|\s+and|\s*&)\s*\p{Lu}/u.test(after))
+        return true;
+    return midSentenceCapitalised(text, lower);
+}
+function midSentenceCapitalised(text, lower) {
+    for (const match of text.matchAll(TOKEN)) {
+        const word = match[0].replace(/['’]s$/i, "").replace(/['’]$/, "");
+        if (word.toLowerCase() !== lower)
+            continue;
+        const before = text.slice(0, match.index).replace(/[ \t"'“‘(\[*_#>-]+$/u, "");
+        if (!(before === "" || /[.!?:\n]$/.test(before)))
+            return true;
+    }
+    return false;
+}
+/** Lowercase items in a list a work cue introduces ("characters: lindon, yerin and eithan"): two or more are treated as names. */
+function lowercaseListNames(text) {
+    const names = [];
+    for (const intro of text.matchAll(LOWERCASE_LIST_INTRO)) {
+        const items = intro[1].split(/,|;|\band\b|\bor\b/i).map((item) => item.trim().split(/\s+/).slice(0, 2).join(" ")).map((item) => (/\s/.test(item) ? item.split(" ")[0] : item));
+        const words = items.filter((item) => LOWERCASE_LIST_ITEM.test(item) && !exports.COMMON_STARTERS.has(item) && !LOWERCASE_LIST_STOP.has(item) && !exports.HOUSE_VOCABULARY.has(item));
+        if (words.length >= 2)
+            names.push(...words);
+    }
+    return [...new Set(names)];
+}
+function claimsSomethingAbout(answer, name) {
+    const lower = answer.toLowerCase();
+    const needle = name.toLowerCase();
+    for (let at = lower.indexOf(needle); at !== -1; at = lower.indexOf(needle, at + needle.length)) {
+        if (COPULA_AFTER_NAME.test(answer.slice(at + needle.length)))
+            return true;
+    }
+    return false;
+}
+/**
+ * What is wrong with a reply about an external work, or null: it names things no lookup this turn contains (invented),
+ * or states something about a work the person only named, with no lookup at all (unsourced_claim).
+ */
+function sourceGroundingFinding(input) {
+    if (!WORK_CUE.test(input.answer))
+        return null;
+    const lookups = input.tools.filter(isLookupToolCall);
+    const lookedUp = lookups.map((record) => record.result).join("\n");
+    const names = [...candidateNames(input.answer), ...lowercaseListNames(input.answer)];
+    const invented = names.filter((name) => !mentions(lookedUp, name) && !mentions(input.userText, name));
+    if (invented.length > 0 && (invented.length >= 2 || STRONG_CUE.test(input.answer))) {
+        const named = invented.join(", ");
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.unsourced_work_claim", message: "a reply named things from a work that the turn did not look up", meta: { names: invented.length, lookups: lookups.length } });
+        return {
+            kind: "invented", names: invented, lookups: lookups.length,
+            message: lookups.length === 0
+                ? `you named ${named} as part of a book, show, film or its cast, and you looked up nothing this turn. don't state facts about a work from memory. read a primary source first (web_search, or fetch the page), then answer only from what it says. if you can't find it, say so plainly.`
+                : `${named} do not appear in anything you looked up this turn, so they may be made up. check them against the source you read, drop the ones it does not support, or look them up, then settle again.`,
+        };
+    }
+    const unsourced = names.filter((name) => mentions(input.userText, name) && !mentions(lookedUp, name) && claimsSomethingAbout(input.answer, name));
+    if (lookups.length === 0 && unsourced.length > 0) {
+        return {
+            kind: "unsourced_claim", names: unsourced, lookups: 0,
+            message: `you stated something about ${unsourced.join(", ")} and looked up nothing this turn. read a primary source first (web_search, or fetch the page), then answer only from what it says. if you can't find it, say so plainly.`,
+        };
+    }
+    return null;
+}
+function sourceGroundingError(input) {
+    return sourceGroundingFinding(input)?.message ?? null;
+}
+/** When the model keeps naming unsourced things after the retries are spent, say so rather than deliver them as fact. */
+function withUnverifiedDisclosure(answer, names) {
+    return `I couldn't verify ${names.join(", ")} against a source, so treat ${names.length === 1 ? "that" : "those"} as unconfirmed.\n\n${answer}`;
+}

package/dist/heart/steward-policy.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readStewardPolicy = readStewardPolicy;
+exports.assertNotReplayIdentity = assertNotReplayIdentity;
 exports.updateStewardPolicy = updateStewardPolicy;
 exports.readRoutineActionReceipts = readRoutineActionReceipts;
 exports.inspectRoutineActionGrant = inspectRoutineActionGrant;
@@ -47,6 +48,7 @@ const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const node_util_1 = require("node:util");
 const runtime_1 = require("../nerves/runtime");
+const replay_harness_1 = require("../a2a/replay-harness");
 const session_transaction_1 = require("../mind/session-transaction");
 const EMPTY_POLICY = { schemaVersion: 1, version: 0, desiredStates: {}, routineActionGrants: {}, updatedAt: null };
 const MAX_POLICY_BYTES = 1024 * 1024;
@@ -82,8 +84,8 @@ function delegation(value) {
         && text(value.delegateFriendId) && text(value.delegateDid) && text(value.noticeId);
 }
 function desiredEntry(value, version) {
-    return record(value) && exactKeys(value, ["value", "provenance", "version", "source"], ["expiresAt"])
-        && text(value.value) && text(value.source) && positiveInteger(value.version) && value.version <= version
+    return record(value) && exactKeys(value, ["value", "provenance", "version", "source"], ["correction", "expiresAt"])
+        && text(value.value) && text(value.source) && (value.correction === undefined || text(value.correction)) && positiveInteger(value.version) && value.version <= version
         && (value.provenance === "stated" || value.provenance === "observed" || value.provenance === "default")
         && (value.expiresAt === undefined || canonicalTime(value.expiresAt));
 }
@@ -131,14 +133,14 @@ function operationIdentity(issuer, event, requestId, kind, key) {
 }
 function auditRow(value) {
     if (!record(value) || !exactKeys(value, ["schemaVersion", "transactionId", "precedingBytesSha256", "mutationKind", "key", "mutationFingerprint", "affectedKeyResult", "affectedKeyResultSha256", "issuer", "authorizingSessionEvent", "authorization", "preimage", "preimageVersion", "preimageSha256", "postimage", "postimageVersion", "postimageSha256", "at"], ["delegatedVia"])
-        || value.schemaVersion !== 2 || (value.mutationKind !== "set_desired_state" && value.mutationKind !== "grant_routine_action")
+        || value.schemaVersion !== 2 || (value.mutationKind !== "set_desired_state" && value.mutationKind !== "grant_routine_action" && value.mutationKind !== "correct_provenance")
         || !text(value.key) || !text(value.issuer) || !text(value.authorizingSessionEvent) || !ownerAuthorization(value.authorization)
         || (value.delegatedVia !== undefined && !delegation(value.delegatedVia))
         || typeof value.preimage !== "string" || typeof value.postimage !== "string" || !canonicalTime(value.at))
         return false;
     const before = policyImage(value.preimage);
     const after = policyImage(value.postimage);
-    const result = value.mutationKind === "set_desired_state" ? after.desiredStates[value.key] : after.routineActionGrants[value.key];
+    const result = value.mutationKind === "grant_routine_action" ? after.routineActionGrants[value.key] : after.desiredStates[value.key];
     if (!result || value.preimageVersion !== before.version || value.postimageVersion !== after.version
         || after.version !== before.version + 1 || result.version !== after.version || after.updatedAt !== value.at
         || value.preimageSha256 !== sha256(value.preimage) || value.postimageSha256 !== sha256(value.postimage)
@@ -149,9 +151,17 @@ function auditRow(value) {
         return false;
     if ("action" in result && (result.issuer !== value.issuer || result.authorizingSessionEvent !== value.authorizingSessionEvent || result.authorizedAt !== value.at))
         return false;
+    if (value.mutationKind === "correct_provenance") {
+        // A correction changes the source and records its note on one existing entry, and nothing else about it.
+        // A missing prior entry spreads to nothing, so the comparison fails without a separate branch.
+        const prior = before.desiredStates[value.key];
+        const corrected = result;
+        if (!(0, node_util_1.isDeepStrictEqual)(result, { ...prior, source: corrected.source, correction: corrected.correction, version: after.version }))
+            return false;
+    }
     const expected = {
         ...before, version: after.version, updatedAt: value.at,
-        desiredStates: value.mutationKind === "set_desired_state" ? { ...before.desiredStates, [value.key]: result } : before.desiredStates,
+        desiredStates: value.mutationKind !== "grant_routine_action" ? { ...before.desiredStates, [value.key]: result } : before.desiredStates,
         routineActionGrants: value.mutationKind === "grant_routine_action" ? { ...before.routineActionGrants, [value.key]: result } : before.routineActionGrants,
     };
     return (0, node_util_1.isDeepStrictEqual)(after, expected);
@@ -312,7 +322,13 @@ function readPolicyState(agentRoot) {
 function readStewardPolicy(agentRoot) {
     return readPolicyState(agentRoot).policy;
 }
+/** Replay identities (the gate's test peers) can never write owner policy: the marker comes from the friend ids, never from model text. */
+function assertNotReplayIdentity(agentRoot, friendIds) {
+    if (friendIds.some((friendId) => friendId !== undefined && (0, replay_harness_1.isReplayIdentity)(agentRoot, friendId)))
+        throw new Error("replay identities cannot write owner policy");
+}
 function updateStewardPolicy(agentRoot, input) {
+    assertNotReplayIdentity(agentRoot, [input.actor.friendId, input.actor.delegatedVia?.delegateFriendId]);
     if (input.actor.trustLevel !== "family")
         throw new Error("steward policy mutation requires family authority");
     const authorizingSessionEvent = requireText(input.actor.sessionEventId, "authorizing session event");
@@ -322,7 +338,7 @@ function updateStewardPolicy(agentRoot, input) {
         throw new Error("steward policy mutation requires current owner authorization");
     if (input.actor.delegatedVia !== undefined && !delegation(input.actor.delegatedVia))
         throw new Error("steward policy delegation is invalid");
-    if (input.mutation.kind !== "set_desired_state" && input.mutation.kind !== "grant_routine_action")
+    if (input.mutation.kind !== "set_desired_state" && input.mutation.kind !== "grant_routine_action" && input.mutation.kind !== "correct_provenance")
         throw new Error("steward policy mutation kind is invalid");
     return (0, session_transaction_1.withImmediateSessionTurnLease)(policyPath(agentRoot), (lease) => {
         const snapshot = readAuditedPolicy(agentRoot, lease);
@@ -330,14 +346,21 @@ function updateStewardPolicy(agentRoot, input) {
         const now = input.now ?? new Date().toISOString();
         if (!canonicalTime(now))
             throw new Error("policy update time must be canonical");
-        const expiresAt = optionalExpiry(input.mutation.expiresAt);
+        const expiresAt = input.mutation.kind === "correct_provenance" ? undefined : optionalExpiry(input.mutation.expiresAt);
         const version = current.version + 1;
         if (!positiveInteger(version))
             throw new Error("steward policy version is exhausted");
         const next = { ...current, version, desiredStates: { ...current.desiredStates }, routineActionGrants: { ...current.routineActionGrants }, updatedAt: now };
-        const key = requireText(input.mutation.key, input.mutation.kind === "set_desired_state" ? "desired state key" : "routine action key");
+        const key = requireText(input.mutation.key, input.mutation.kind === "grant_routine_action" ? "routine action key" : "desired state key");
         let affectedKeyResult;
-        if (input.mutation.kind === "set_desired_state") {
+        if (input.mutation.kind === "correct_provenance") {
+            const existing = current.desiredStates[key];
+            if (!existing)
+                throw new Error("provenance correction requires an existing desired state key");
+            affectedKeyResult = { ...existing, source: requireText(input.mutation.source, "corrected source"), correction: requireText(input.mutation.correction, "correction"), version };
+            next.desiredStates = { ...current.desiredStates, [key]: affectedKeyResult };
+        }
+        else if (input.mutation.kind === "set_desired_state") {
             if (input.mutation.provenance !== "stated" && input.mutation.provenance !== "observed" && input.mutation.provenance !== "default")
                 throw new Error("desired state provenance is invalid");
             affectedKeyResult = {
@@ -373,7 +396,7 @@ function updateStewardPolicy(agentRoot, input) {
         const previousIndex = snapshot.rows.findIndex((row) => operationIdentity(row.issuer, row.authorizingSessionEvent, row.authorization.requestId, row.mutationKind, row.key) === identity);
         if (previousIndex >= 0) {
             const previous = snapshot.rows[previousIndex];
-            const currentResult = previous.mutationKind === "set_desired_state" ? current.desiredStates[key] : current.routineActionGrants[key];
+            const currentResult = previous.mutationKind === "grant_routine_action" ? current.routineActionGrants[key] : current.desiredStates[key];
             if (previous.mutationFingerprint !== fingerprint || snapshot.rows.slice(previousIndex + 1).some((row) => row.mutationKind === previous.mutationKind && row.key === key)
                 || !(0, node_util_1.isDeepStrictEqual)(currentResult, previous.affectedKeyResult))
                 throw new Error("steward policy transaction replay changed");
@@ -442,8 +465,8 @@ function currentRequester(value, target) {
         && text(value.event.recordPath) && text(value.event.agent) && positiveInteger(value.event.generation)
         && text(value.event.observationRevision) && text(value.event.claimOwner);
 }
-function appliedEntry(rows, kind, key, entry) {
-    return rows.some((row) => row.mutationKind === kind && row.key === key && row.postimageVersion === entry.version && (0, node_util_1.isDeepStrictEqual)(row.affectedKeyResult, entry));
+function appliedEntry(rows, kinds, key, entry) {
+    return rows.some((row) => kinds.includes(row.mutationKind) && row.key === key && row.postimageVersion === entry.version && (0, node_util_1.isDeepStrictEqual)(row.affectedKeyResult, entry));
 }
 const UNRESOLVED_ACTION_STATES = new Set(["reserved", "attempting", "effect_acknowledged", "recovery_pending", "indeterminate"]);
 function inspectRoutineActionGrantSnapshot(policy, rows, receipts, input) {
@@ -472,7 +495,7 @@ function inspectRoutineActionGrantSnapshot(policy, rows, receipts, input) {
         return { allowed: false, reason: "routine action grant is missing", ...fallback };
     if (grant.provenance !== "stated")
         return { allowed: false, reason: "routine action grant must be owner-stated" };
-    if (!appliedEntry(rows, "grant_routine_action", input.key, grant))
+    if (!appliedEntry(rows, ["grant_routine_action"], input.key, grant))
         return { allowed: false, reason: "routine action grant has no applied owner authorization" };
     if (grant.action !== input.action)
         return { allowed: false, reason: "routine action does not match the grant" };
@@ -480,7 +503,7 @@ function inspectRoutineActionGrantSnapshot(policy, rows, receipts, input) {
         return { allowed: false, reason: "routine action target is not authorized" };
     if (grant.expiresAt && Date.parse(grant.expiresAt) <= Date.parse(now))
         return { allowed: false, reason: "routine action grant expired", ...fallback };
-    if (!activeDesired || desired.provenance !== "stated" || !appliedEntry(rows, "set_desired_state", desiredKey, desired))
+    if (!activeDesired || desired.provenance !== "stated" || !appliedEntry(rows, ["set_desired_state", "correct_provenance"], desiredKey, desired))
         return { allowed: false, reason: "container has no active applied owner-stated desired state" };
     if (!["on", "always_on", "expected_on"].includes(desiredValue) && !(desiredValue === "on_demand" && input.requester.kind !== "owner_event"))
         return { allowed: false, reason: "container desired state does not authorize this request" };

package/dist/repertoire/guardrails.js

@@ -49,6 +49,7 @@ const REASONS = {
     readBeforeEdit: "i need to read that file first before i can edit it.",
     readBeforeOverwrite: "i need to read that file first before i can overwrite it.",
     protectedPath: "that path is protected — i can read it but not modify it.",
+    psychePath: "my psyche files ship from the repository through a pull request and the replay gate; i can read them but not change them. i file the change request with Claude Code instead.",
     destructiveCommand: "that command is too dangerous to run — it could cause irreversible damage.",
     // Trust reasons (vary by relationship)
     needsTrust: "i'd need a closer friend to vouch for you before i can do that.",
@@ -64,6 +65,14 @@ const PROTECTED_PATH_SEGMENTS = [
     "state/policy/",
 ];
 const PROTECTED_FILENAMES = ["agent.json", "tool-profiles.json"];
+/** The agent's psyche folder ships only from the repository (a pull request and the replay gate), so no tool writes into it. */
+function isPsychePath(filePath, agentRoot) {
+    if (!agentRoot || !filePath)
+        return false;
+    const psyche = path.resolve(agentRoot, "psyche");
+    const target = path.resolve(agentRoot, filePath);
+    return target === psyche || target.startsWith(`${psyche}${path.sep}`);
+}
 function isProtectedPath(filePath) {
     for (const segment of PROTECTED_PATH_SEGMENTS) {
         if (filePath.includes(`/${segment}`) || filePath.startsWith(segment))
@@ -104,6 +113,50 @@ function shellWritesToProtectedPath(command) {
         return true;
     return false;
 }
+// --- the psyche folder in shell commands ---
+// The psyche folder is mounted read-only into the resident at the OS level (the upgrade recreates the container that way). This is the
+// defence in depth in front of that: a shell command that mentions the psyche folder at all runs only if every part of it is
+// a read-only command, because enumerating the ways to write a file (>, >>, tee, cp, mv, sed -i, node -e, python, cd then
+// redirect) is a list the model can always step around.
+const PSYCHE_READ_ONLY_COMMANDS = new Set(["cat", "ls", "head", "tail", "grep", "wc", "sha256sum", "stat", "cd", "pwd"]);
+const SEGMENT_OPERATORS = new Set(["&&", "||", ";", "|"]);
+function commandMentionsPsyche(command, words, agentRoot) {
+    const psyche = path.resolve(agentRoot, "psyche");
+    if (command.includes(psyche) || words.some((word) => word.includes(psyche)))
+        return true;
+    if (words.some((word) => word === "psyche" || isPsychePath(word, agentRoot)))
+        return true;
+    // A relative "psyche/..." inside code or a quoted argument, when this agent has such a folder.
+    return /(?:^|[\s'"=(])psyche\//.test(command) && fs.existsSync(psyche);
+}
+function psycheShellWriteRefused(command, agentRoot) {
+    if (!agentRoot)
+        return false;
+    const entries = (0, shell_quote_1.parse)(command);
+    const words = entries.filter((entry) => typeof entry === "string");
+    if (!commandMentionsPsyche(command, words, agentRoot))
+        return false;
+    // Substitution, heredocs and any $VAR or ${VAR} expansion: the shell could build a psyche path or a command word we cannot see.
+    if (/\$[({A-Za-z_]|`|<\(|<</.test(command))
+        return true;
+    let expectCommandWord = true;
+    for (const entry of entries) {
+        if (typeof entry === "string") {
+            if (expectCommandWord && !/^\w+=/.test(entry)) {
+                if (!PSYCHE_READ_ONLY_COMMANDS.has(entry))
+                    return true;
+                expectCommandWord = false;
+            }
+            continue;
+        }
+        const op = "op" in entry ? entry.op : "comment";
+        if (SEGMENT_OPERATORS.has(op))
+            expectCommandWord = true;
+        else if (op !== "glob")
+            return true;
+    }
+    return false;
+}
 // --- structural guardrail checks (always on, all trust levels) ---
 function checkReadBeforeWrite(toolName, args, context) {
     if (toolName === "edit_file") {
@@ -132,21 +185,25 @@ function checkDestructiveShellPatterns(toolName, args) {
     }
     return allow;
 }
-function checkProtectedPaths(toolName, args) {
+function checkProtectedPaths(toolName, args, context) {
     if (toolName === "write_file" || toolName === "edit_file") {
         const filePath = args.path || "";
+        if (isPsychePath(filePath, context.agentRoot))
+            return deny(REASONS.psychePath);
         if (isProtectedPath(filePath))
             return deny(REASONS.protectedPath);
     }
     if (toolName === "shell") {
         const command = args.command || "";
+        if (psycheShellWriteRefused(command, context.agentRoot))
+            return deny(REASONS.psychePath);
         if (shellWritesToProtectedPath(command))
             return deny(REASONS.protectedPath);
     }
     return allow;
 }
 function checkStructuralGuardrails(toolName, args, context) {
-    const protectedResult = checkProtectedPaths(toolName, args);
+    const protectedResult = checkProtectedPaths(toolName, args, context);
     if (!protectedResult.allowed)
         return protectedResult;
     const destructiveResult = checkDestructiveShellPatterns(toolName, args);

package/dist/repertoire/mcp-tools.js

@@ -9,6 +9,7 @@ exports.mcpToolSchema = mcpToolSchema;
 exports.mcpToolsAsDefinitions = mcpToolsAsDefinitions;
 const runtime_1 = require("../nerves/runtime");
 const tool_arguments_1 = require("./tool-arguments");
+const mcp_write_guard_1 = require("./mcp-write-guard");
 class McpCallRejectedError extends Error {
     constructor(message) {
         super(message);
@@ -90,8 +91,11 @@ function mcpToolsAsDefinitions(view) {
                     message: `calling MCP tool ${entry.server}/${tool.name}`,
                     meta: { server: entry.server, tool: tool.name },
                 });
+                const guarded = (0, mcp_write_guard_1.guardMcpArgs)({ toolName: tool.name, declaresDryRun: Object.hasOwn((tool.inputSchema?.properties ?? {}), "dry_run"), args, ctx });
+                if (guarded.rejected !== undefined)
+                    throw new McpCallRejectedError(guarded.rejected);
                 try {
-                    const result = await view.manager.callTool(binding, args, { agentName: ctx.agentName, agentRoot: ctx.agentRoot });
+                    const result = await view.manager.callTool(binding, guarded.args, { agentName: ctx.agentName, agentRoot: ctx.agentRoot });
                     const text = result.content
                         .filter((c) => c.type === "text" && c.text)
                         .map((c) => c.text)

package/dist/repertoire/mcp-write-guard.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REPLAY_REFUSED_WRITE_TOOLS = exports.OWNER_ONLY_WRITE_TOOLS = void 0;
+exports.guardMcpArgs = guardMcpArgs;
+/**
+ * Runtime guards on MCP tool arguments that the MCP server itself cannot enforce, because only the runtime knows who is calling.
+ *
+ *  - A replay identity (the host's replay gate, src/a2a/replay-harness.ts) never applies a change: every tool that declares a
+ *    `dry_run` argument is forced to a dry run for it, so a gate case can never alter the live house.
+ *  - A replay identity may not call a write tool that has no dry run at all (see REPLAY_REFUSED_WRITE_TOOLS).
+ *  - Some tools change settings only the owner may change: applying (dry_run false) is refused for any other caller, and the
+ *    caller is stamped into the arguments so the tool's audit line names who asked.
+ */
+const replay_harness_1 = require("../a2a/replay-harness");
+const runtime_1 = require("../nerves/runtime");
+/** MCP tools whose applied writes are owner-only. */
+exports.OWNER_ONLY_WRITE_TOOLS = new Set(["media_quality_profile"]);
+/** MCP tools that change the house and have no dry run: a replay identity may not call them at all. media_manual_import is a write only in `import` mode. */
+exports.REPLAY_REFUSED_WRITE_TOOLS = new Set(["media_request", "media_search_now", "media_blocklist", "media_blocklist_stalled", "media_fill_missing", "media_release_grab", "media_manual_import"]);
+const isWrite = (args) => (args.dry_run === false || args.dry_run === "false") && args.action !== "read";
+function callerFriend(ctx) {
+    const friend = ctx?.context?.friend;
+    return { id: friend?.id ?? ctx?.relationshipAuthorization?.actor?.friendId, name: friend?.name };
+}
+function guardMcpArgs(input) {
+    const { toolName, declaresDryRun, ctx } = input;
+    let args = input.args;
+    const caller = callerFriend(ctx);
+    if (exports.OWNER_ONLY_WRITE_TOOLS.has(toolName)) {
+        if (isWrite(args) && ctx?.relationshipAuthorization?.profileId !== "sanctuary-owner") {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "repertoire", event: "mcp.write_refused_non_owner", message: "an owner-only MCP write was refused", meta: { tool: toolName } });
+            return { rejected: `${toolName} changes settings only the owner may change. Show the owner the dry run and ask them to confirm; do not apply it for anyone else.` };
+        }
+        args = { ...args, caller: caller.id ? `${caller.id}${caller.name ? ` (${caller.name})` : ""}` : "unknown" };
+    }
+    const replay = Boolean(caller.id && ctx?.agentRoot && (0, replay_harness_1.isReplayIdentity)(ctx.agentRoot, caller.id));
+    if (replay && !declaresDryRun && exports.REPLAY_REFUSED_WRITE_TOOLS.has(toolName) && (toolName !== "media_manual_import" || args.mode === "import")) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "repertoire", event: "mcp.replay_write_refused", message: "a replay identity's MCP write with no dry run was refused", meta: { tool: toolName } });
+        return { rejected: `${toolName} changes the live house and has no dry run, so a replay identity may not call it. Describe what you would do instead.` };
+    }
+    if (replay && declaresDryRun && args.dry_run !== true) {
+        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "repertoire", event: "mcp.replay_forced_dry_run", message: "a replay identity's MCP call was forced to a dry run", meta: { tool: toolName } });
+        args = { ...args, dry_run: true };
+    }
+    return { args };
+}

package/dist/repertoire/tools-notes.js

@@ -33,7 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.notesToolDefinitions = void 0;
+exports.notesToolDefinitions = exports.OWN_PERSONA_NOTE_REFUSAL = void 0;
+exports.isOwnPersonaNote = isOwnPersonaNote;
 const child_process_1 = require("child_process");
 const path = __importStar(require("path"));
 const skills_1 = require("./skills");
@@ -54,6 +55,14 @@ function bundleRelativeLocator(filePath, ctx) {
     }
     return filePath.split(path.sep).join("/");
 }
+// A friend note is a fact or preference about a person. The agent's own personality, voice and psyche are not facts
+// about the person: they live in the bundle's psyche folder, which ships from the repo and is changed by pull request.
+const OWN_PERSONA_NOTE = /\b(?:your|my|the\s+(?:agent|butler|bot|assistant)(?:['\u2019]s)?)\s+(?:own\s+)?(?:personality|persona|psyche|soul|identity|character|voice|self[- ]concept)\b|\b(?:channel|embody|role-?play|act\s+like|talk\s+like|sound\s+like|be\s+more)\b[^.\n]{0,40}\b(?:energy|vibe|character|persona)\b|\b(?:act|behave)\s+like\s+(?:a|an|the)\b/i;
+const PERSONA_KEY = /^\s*(?:persona|personality|psyche|soul)\s*$/i;
+function isOwnPersonaNote(key, content) {
+    return PERSONA_KEY.test(key ?? "") || OWN_PERSONA_NOTE.test(`${key ?? ""} ${content ?? ""}`);
+}
+exports.OWN_PERSONA_NOTE_REFUSAL = "that note is about my own personality or voice, not about the person, so it does not belong in a friend note. my psyche lives in the bundle's psyche folder and ships from the repo; i do not edit it live. a personality change goes to Claude Code as a request (over A2A, or as a failure or feature report), and it ships by pull request through the replay gate. this is a guardrail on persona content, not on the person: a note about the person themselves (their facts, preferences, voice, character in a game) is fine and saves normally. friend notes hold facts and preferences about this person only.";
 exports.notesToolDefinitions = [
     {
         tool: {
@@ -417,6 +426,8 @@ exports.notesToolDefinitions = [
             const friendId = ctx.context.friend?.id;
             if (!friendId)
                 return "i can't save notes -- no friend identity available";
+            if (a.type !== "name" && isOwnPersonaNote(a.key, a.content))
+                return exports.OWN_PERSONA_NOTE_REFUSAL;
             const actor = ctx.relationshipAuthorization?.actor;
             const isSanctuaryRelationship = ctx.context.friend?.capabilityProfileId?.startsWith("sanctuary-") === true;
             const preferenceSource = a.source;

package/dist/repertoire/tools-steward-policy.js

@@ -16,16 +16,17 @@ exports.stewardPolicyToolDefinition = {
         type: "function",
         function: {
             name: "steward_policy_manage",
-            description: "Read or update the household steward's typed desired-state and routine-action policy. Updates require the current authenticated owner Telegram request and fresh authorization. expectedVersion is optional; omit it to apply against the current policy version, or supply a version from read for explicit stale-write detection.",
+            description: "Read or update the household steward's typed desired-state and routine-action policy. Updates require the current authenticated owner Telegram request and fresh authorization. Replay identities can never update it. correct_provenance (key, source, correction) is only for fixing a wrong attribution on an existing desired state: it replaces the recorded source and records the correction note, never changes the value, and leaves an audit row; do not use it to change a value. expectedVersion is optional; omit it to apply against the current policy version, or supply a version from read for explicit stale-write detection.",
             parameters: {
                 type: "object",
                 properties: {
-                    action: { type: "string", enum: ["read", "set_desired_state", "grant_routine_action"] },
+                    action: { type: "string", enum: ["read", "set_desired_state", "grant_routine_action", "correct_provenance"] },
                     expectedVersion: { type: "integer", minimum: 0, description: "Optional version returned by read. When omitted, the runtime uses the current policy version." },
                     key: { type: "string" },
                     value: { type: "string" },
                     provenance: { type: "string", enum: ["stated", "observed", "default", "installed_explicit_policy"] },
-                    source: { type: "string" },
+                    source: { type: "string", description: "Who or what stated this. For correct_provenance, the corrected attribution that replaces the recorded source." },
+                    correction: { type: "string", description: "correct_provenance only: required note naming what is being corrected and why." },
                     routineAction: { type: "string" },
                     targetsJson: { type: "string", description: "JSON array of exact target names" },
                     maxCount: { type: "integer", minimum: 1 },
@@ -54,6 +55,7 @@ exports.stewardPolicyToolDefinition = {
             throw new Error("steward policy mutation requires authenticated relationship authority");
         const { friendId, trustLevel, sessionEventId } = actor;
         const { profileId, requestId } = relationship;
+        (0, steward_policy_1.assertNotReplayIdentity)(ctx.agentRoot, [friendId, ctx.delegatedCommand?.delegateFriendId]);
         const sessionKey = ctx.currentSession?.key;
         const delegated = ctx.delegatedCommand;
         // Two ways to hold owner authority: the owner's own Telegram turn, or a delegated
@@ -82,6 +84,9 @@ exports.stewardPolicyToolDefinition = {
                 throw new Error("desired state provenance is invalid");
             mutation = { kind: "set_desired_state", key: args.key ?? "", value: args.value ?? "", provenance: args.provenance, source: sourceFor(args.source), ...(args.expiresAt ? { expiresAt: args.expiresAt } : {}) };
         }
+        else if (args.action === "correct_provenance") {
+            mutation = { kind: "correct_provenance", key: args.key ?? "", source: sourceFor(args.source), correction: args.correction ?? "" };
+        }
         else if (args.action === "grant_routine_action") {
             if (args.provenance !== "stated" && args.provenance !== "installed_explicit_policy")
                 throw new Error("routine action provenance is invalid");

package/dist/repertoire/tools.js

@@ -73,7 +73,7 @@ const SANCTUARY_RELATIONSHIP_BASE_TOOLS = new Set([
 exports.SANCTUARY_MCP_PROVIDED_TOOLS = new Set([
     "media_search", "media_request", "media_request_status",
     "media_diagnose_and_fix", "media_chain_health", "media_play_or_resolve",
-    "media_search_now", "media_queue", "media_blocklist_stalled", "media_episodes", "media_indexer_search", "media_release_search", "media_release_grab", "media_blocklist", "media_manual_import", "media_fill_missing",
+    "media_search_now", "media_queue", "media_blocklist_stalled", "media_episodes", "media_indexer_search", "media_release_search", "media_release_grab", "media_blocklist", "media_manual_import", "media_quality_profile", "media_fill_missing",
 ]);
 /** Channels a Sanctuary turn can arrive on from the host itself, not from a remote party. */
 const SANCTUARY_LOCAL_CHANNELS = new Set(["inner", "cli", "mcp"]);

package/dist/senses/sanctuary-runtime.js

@@ -284,6 +284,8 @@ function createSanctuaryToolContext(agentName) {
     });
     return {
         agentRoot,
+        // The Sanctuary profile opts in to the settle-time checks: replies about a work are held to what the turn looked up, and a brevity request is honored.
+        answerGates: { sourceGrounding: true, brevity: true },
         sanctuary: {
             listContainers: acceptanceRead("unraid_list_containers", reads.listContainers),
             getContainerLogs: acceptanceRead("unraid_get_container_logs", reads.getContainerLogs),