@ouro.bot/cli 0.1.0-alpha.878 → 0.1.0-alpha.879

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.879",
+      "changes": [
+        "The upgrade lifecycle puts state/a2a and the escalation grant back under root after its recursive ownership restore, so escalation holders are honoured on a shipped release; the replay gate seeds outbox directories as the Butler and asks psyche-via-pr a concrete question"
+      ]
+    },
     {
       "version": "0.1.0-alpha.878",
       "changes": [

package/deploy/unraid/sanctuary-replay-gate.mjs

@@ -374,7 +374,8 @@ export const CASES = [
   },
   {
     id: "psyche-via-pr",
-    words: "can you change your personality?",
+    // A concrete ask. Given only "can you change your personality?" the Butler describes the pull-request path and offers to file it once told what to change (alpha.878 session bf112be9), which is reasonable, so he never calls a filing tool.
+    words: "change your personality: drop the jokes and be formal and flat with me from now on",
     sender: "principal",
     delegated: false,
     readback: ({ trace, reply, said, before, after }) => {
@@ -707,6 +708,17 @@ function sh(file, args, options = {}) {
   return execFileSync(file, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], ...options })
 }
 
+/**
+ * Creates `dir` and every missing directory between `root` and it, each handed to the Butler's user. The gate runs as root:
+ * a plain recursive mkdir would leave state/outbox itself root-owned and closed (0700), and the Butler could then neither
+ * list nor write any outbox beneath it (the alpha.878 outbox-isolation and peer-await-delivers failures).
+ */
+export function mkdirOwned(root, dir, owner, { mkdir = mkdirSync, chown = chownSync, exists = existsSync } = {}) {
+  const missing = []
+  for (let current = dir; current !== root && current.startsWith(root + path.sep) && !exists(current); current = path.dirname(current)) missing.unshift(current)
+  for (const made of missing) { mkdir(made, { mode: 0o700 }); chown(made, owner.uid, owner.gid) }
+}
+
 export function makeHost({ bundle = DEFAULT_BUNDLE, cardUrl, log = console.error, exec = sh } = {}) {
   const state = path.join(bundle, "state")
   const replayDir = path.join(state, "replay")
@@ -772,8 +784,8 @@ export function makeHost({ bundle = DEFAULT_BUNDLE, cardUrl, log = console.error
     async seedOutbox(friendId, body) {
       if (!replayPeers.includes(friendId)) throw new Error(`refusing to seed the outbox of a non-replay friend: ${friendId}`)
       const dir = path.join(state, "outbox", friendId)
-      mkdirSync(dir, { recursive: true, mode: 0o700 })
       const owner = statSync(state)
+      mkdirOwned(state, dir, owner)
       const id = `${String(Date.now()).padStart(13, "0")}-${randomUUID().replace(/-/g, "").slice(0, 6)}`
       writeAtomic(path.join(dir, `${id}.json`), JSON.stringify({ id, kind: "isolation_canary", createdAt: new Date().toISOString(), body }), 0o600)
       chownSync(dir, owner.uid, owner.gid); chownSync(path.join(dir, `${id}.json`), owner.uid, owner.gid)

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.878",
+  "runtimeVersion": "0.1.0-alpha.879",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.878</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.879</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -986,6 +986,7 @@ class SanctuaryAuthorityRootLifecycle {
         });
         (0, node_child_process_1.execFileSync)("/bin/chown", ["-R", "10001:10001", this.#p(BUNDLE)], { stdio: "ignore" });
         this.#restoreReplayRoot();
+        this.#restoreEscalationGrantRoot();
     }
     /**
      * The recursive restore above hands the whole bundle to the resident, including state/replay. That directory is the
@@ -1009,6 +1010,38 @@ class SanctuaryAuthorityRootLifecycle {
         fs.chmodSync(directory, 0o755);
         fs.rmSync(path.join(directory, "window.json"), { force: true, recursive: true });
     }
+    /**
+     * The same recursive restore hands state/a2a and the escalation grant file to the resident. The Butler honours a grant
+     * only while the file and its directory are root-owned and closed to everyone else (src/a2a/trusted-files.ts), so
+     * after every restore they go back under root, and a prompt-injected model running as the resident cannot mint one.
+     * The subdirectories the resident writes (tasks, pins, seen) are created first and stay with it, so it never needs to
+     * create anything inside the root-owned directory. Missing this is what made every report_failure and outbox case of
+     * the alpha.878 replay gate fail: no peer held the grant, so no peer was an escalation holder.
+     */
+    #restoreEscalationGrantRoot() {
+        const directory = this.#p(`${BUNDLE}/state/a2a`);
+        let stat;
+        try {
+            stat = fs.lstatSync(directory);
+        }
+        catch {
+            return;
+        }
+        if (!stat.isDirectory())
+            return;
+        for (const sub of ["tasks", "pins", "seen"]) {
+            fs.mkdirSync(path.join(directory, sub), { recursive: true });
+            (0, node_child_process_1.execFileSync)("/bin/chown", ["-R", "10001:10001", path.join(directory, sub)], { stdio: "ignore" });
+        }
+        // Ownership first, before anything else can fail: nothing the Butler left in the directory may stop it going back under root.
+        (0, node_child_process_1.execFileSync)("/bin/chown", ["-h", "0:0", directory], { stdio: "ignore" });
+        fs.chmodSync(directory, 0o755);
+        const grants = path.join(directory, "escalation-grants.json");
+        if (fs.existsSync(grants)) {
+            (0, node_child_process_1.execFileSync)("/bin/chown", ["-h", "0:0", grants], { stdio: "ignore" });
+            fs.chmodSync(grants, 0o644);
+        }
+    }
     /** Start the gateway, then the resident, and prove both. */
     async #startUpgraded() {
         this.#runtimeDirectories();

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.878",
+  "version": "0.1.0-alpha.879",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.878",
+      "version": "0.1.0-alpha.879",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.878",
+  "version": "0.1.0-alpha.879",
   "engines": {
     "node": ">=22"
   },