@ouro.bot/cli 0.1.0-alpha.886 → 0.1.0-alpha.888

package/changelog.json

@@ -1,6 +1,33 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.888",
+      "changes": [
+        "Answer gates (source grounding and brevity) now hold a plain-text reply as well as a settle answer, so a reply with no settle call can no longer name an unsourced cast or ignore a brevity request."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.887",
+      "changes": [
+        "Delegated commands and escalation now come only from root-owned grant files in /etc/ouro/trust/<agent> (or OURO_OPERATOR_TRUST_DIR/<agent>, resolved through symlinks), checked up the whole directory chain and pinned to the sender's DID; grant writes are locked, fsynced and backed up, and the Butler's grants moved there with an upgrade check that refuses to silently drop an escalation grant",
+        "New 'ouro a2a delegated-commands grant|revoke|list' operator command and a DID-pinned 'escalation grant', both refusing this agent's own DID and a DID another holder already has, and both revoking by id when the friend record is gone; refusals say nothing ran and what to do next, and peers that are not active family only ever see no_grant",
+        "The replay gate now grants delegated commands only for the length of a window and revokes them on close, a replay grant without an expiry is refused, a forged delegation banner is neutralised on every turn (including Unicode look-alikes), and the friends store is protected from the model's file tools and any shell command that is not read-only",
+        "Telegram messages are now shielded from forged delegated-command banners at ingress",
+        "The replay gate refuses planted symlinks and wrong file types, using no-follow descriptors",
+        "provision --rotate-replay-identities mints new replay seeds and rewrites the replay grants as root",
+        "Revoke never writes the friend record as root and prints the docker exec follow-up",
+        "Permanent replay grants are refused from a root-owned replay list inside the trust directory",
+        "Stale trust-dir lock takeover is serialized, and the replay gate takes the same lock",
+        "The friends and psyche guards refuse writes whose globs or variables could reach protected stores",
+        "Admitted delegated turns carry a runtime marker, and banner text in a message grants nothing",
+        "A DID the agent publishes in its bundle is advisory: grant and escalation commands always run the twin check and name where the DID came from",
+        "Replay identity seeds and the provisioning record now live in a root-owned host folder outside the bundle; root never takes over a folder the agent made, refuses one swapped in mid-check, and takes replay friend ids and DIDs only from root-owned state",
+        "The verified-delegated-command phrase is shielded in every tool result, including punctuated and look-alike spellings, and delegate and principal names are kept to one plain line in the prompt",
+        "An untrusted or malformed replay list denies no-expiry grants, a stale trust-dir lock is reclaimed only when its writer's pid is gone, and rotation demotes old replay friends to stranger, clears their DID pin and keeps going when a record is missing",
+        "The replay gate reads agent-writable files without following symlinks and never echoes file contents in parse errors"
+      ]
+    },
     {
       "version": "0.1.0-alpha.886",
       "changes": [

package/deploy/unraid/README.txt

@@ -1,14 +1,16 @@
 Mendelow Cloud Butler operator runbook
 
-The production container is ouro-butler. It runs as UID/GID 10001, publishes no ports, uses host networking only so its loopback-only Unraid GraphQL client can reach 127.0.0.1, mounts the runtime and sanctuary.ouro bundle read-write, the bundle psyche folder read-only over it so the Butler can neither edit nor replace its psyche, plus the privileged event spool read-only, and uses restart policy unless-stopped. The canonical-gateway image appends /run/ouro-authority -> /run/ouro-authority, readonly, rprivate, and the psyche mount (<bundle>/psyche -> /home/ouro/AgentBundles/sanctuary.ouro/psyche, readonly, rprivate). The pinned alpha.816 predecessor has only the first three mounts. Root token, issuer, package and authority state are never mounted into the resident.
+The production container is ouro-butler. It runs as UID/GID 10001, publishes no ports, uses host networking only so its loopback-only Unraid GraphQL client can reach 127.0.0.1, mounts the runtime and sanctuary.ouro bundle read-write, the bundle psyche folder read-only over it so the Butler can neither edit nor replace its psyche, plus the privileged event spool read-only, and uses restart policy unless-stopped. The canonical-gateway image appends /run/ouro-authority -> /run/ouro-authority, readonly, rprivate, and the psyche mount (<bundle>/psyche -> /home/ouro/AgentBundles/sanctuary.ouro/psyche, readonly, rprivate) and the operator trust mount (/mnt/user/appdata/ouro-butler/trust/sanctuary -> /etc/ouro/trust/sanctuary, readonly, rprivate), a root-owned directory outside the bundle that holds the grants the Butler honours. The pinned alpha.816 predecessor has only the first three mounts. Root token, issuer, package and authority state are never mounted into the resident.
 
 Root authority lifecycle
 
 The existing DockerMan transaction owns authority-install, authority-activate, authority-retire and authority-restore. A complete exact-image package, including dist and production dependencies, must remain at its package-relative paths; extracting only the old five deployment assets cannot execute this lifecycle. The reviewed root-only inputs are /mnt/user/appdata/ouro-authority/incoming-package, package-manifest.json, request.json and incoming-token. They are not a new resident credential policy. The human rotates the existing bot token directly into root custody; the root owner proves the previous token returns 401 and the fresh token belongs to the same numeric bot before continuing.
 
-First rollout of the psyche mount: the live container before this release has four mounts, but the canonical-gateway contract now requires five (the psyche folder read-only over the bundle). assert_update_source audits the live source container against its image's contract, so on that first update it fails with "effective mounts do not match the selected Sanctuary mount contract". The failure is expected and changes nothing. Recreate the live resident once by hand with the five-mount create (the canonical-gateway line in create_sanctuary_container, including the psyche mount), leave it stopped, then rerun the update. Psyche files stay owned by uid 10001 at mode 0600 because the resident's boot check requires exactly that; the read-only mount, not ownership, keeps the resident from editing or replacing them.
+First rollout of the psyche mount: the live container before this release has four mounts, but the canonical-gateway contract now requires six (the psyche folder read-only over the bundle and the operator trust directory). assert_update_source audits the live source container against its image's contract, so on that first update it fails with "effective mounts do not match the selected Sanctuary mount contract". The failure is expected and changes nothing. Recreate the live resident once by hand with the six-mount create (the canonical-gateway line in create_sanctuary_container, including the psyche and trust mounts), leave it stopped, then rerun the update. Psyche files stay owned by uid 10001 at mode 0600 because the resident's boot check requires exactly that; the read-only mount, not ownership, keeps the resident from editing or replacing them.
 
-During installation the resident is stopped, the root gateway is installed and proven, tokenless readiness runs, and authority-activate starts the exact five-mount target. On failure, authority-retire must finish before restoring bundle/config/mounts or starting the exact three-mount predecessor; authority-restore proves that rollback before the outer template journal is removed. An uncertain or interrupted handoff leaves autostart disabled and preserves both journals and root inputs for the same reviewed recovery, never a raw old-template start. Retired keys, policy, history and Jellyfin remain untouched. Re-enabling authority requires a new human token rotation and issuer epoch, not reuse of retired authority.
+Operator trust directory. Delegated-command and escalation grants live on the host in /mnt/user/appdata/ouro-butler/trust/sanctuary, owned by root:root, mode 0755, with every file in it root-owned and mode 0644, and the directory is outside the bundle so the upgrade's recursive chown cannot reach it. The container sees it read-only at /etc/ouro/trust/sanctuary; the Butler honours a grant only when the file and every directory above it up to / are real, root-owned and closed to group and other writes. Create it once as root before the first create: `install -d -o root -g root -m 0755 /mnt/user/appdata/ouro-butler /mnt/user/appdata/ouro-butler/trust /mnt/user/appdata/ouro-butler/trust/sanctuary` (this also makes /mnt/user/appdata/ouro-butler itself root-owned 0755, which the replay gate needs for its host folder below; the agent and runtime folders inside it keep their own owners). Manage grants on the host as root with a one-off container that mounts the directory read-write (the resident's mount is read-only): `docker run --rm --user 0:0 --entrypoint node --pull=never --network none -v /mnt/user/appdata/ouro-butler/trust/sanctuary:/etc/ouro/trust/sanctuary -v /mnt/user/appdata/ouro-butler/agent/sanctuary.ouro:/home/ouro/AgentBundles/sanctuary.ouro:ro <butler image> /opt/ouro/dist/heart/daemon/ouro-entry.js a2a delegated-commands grant --agent sanctuary --friend <friend id> --did <did:key> [--expires <ISO date>] [--source <text>]`, and likewise `a2a delegated-commands revoke|list` and `a2a escalation grant --friend <id> --did <did:key>|revoke|list`. Setting OURO_OPERATOR_TRUST_DIR replaces the trust root (/etc/ouro/trust) and keeps the per-agent folder, so the files sit in <dir>/<agent>/. Grant commands take an exclusive .lock file in the directory (the lock records the writer's pid and host; one older than two minutes is taken over only when that pid is no longer running on the same host, and one written on another host only after an hour; remove a stuck one by hand) and flush the directory after each rename. A one-off container cannot read the agent's own DID, so grant then compares --did with every friend record and refuses a DID a second record also carries, and prints a note saying so; revoke works by friend id even when the friend record is gone. Revoke never writes the friend record (it runs as root); when the record still carries a legacy delegationGrant it prints a REQUIRED FOLLOW-UP docker exec -u 10001 line that clears the legacy delegationGrant field as the resident user (friend records are never written as root). The replay gate grants its replay principal and escalation peer with an expiry equal to the replay window and removes them when it closes; the replay gate keeps a root-owned list of its replay peers in the trust directory (replay-identities.json), the Butler refuses any grant without an expiry for a friend on that list (the grant's source text and the bundle's own replay registry decide nothing), and the grant commands refuse a no-expiry grant, and any escalation grant, for a listed friend. Replay seeds and the provisioning record live outside the bundle, in the root-owned host folder /mnt/user/appdata/ouro-butler/replay-client (the gate's --client-dir overrides it), created by provision as root 0700 under a parent that is root-owned and closed to group and other writes (by default only that parent, /mnt/user/appdata/ouro-butler, is checked, because Unraid's shared /mnt/user/appdata is usually nobody:users 0777); the gate refuses a folder, a parent or a seed that root did not make, and never takes over one the Butler's user could have written. Only root-owned state may supply replay friend ids and DIDs: that folder and the trust directory's replay-identities.json. Nothing in the bundle's state/replay-client or state/replay does, and a provision.json found in the bundle is ignored (its friend ids are only printed, as unverified). A run copies the seeds into a root-only directory it makes inside the container with mktemp -d, drives the CLI as root from there, and deletes it when the window closes. An existing state/replay in the bundle that root does not own is moved aside as replay.untrusted-<time> and made fresh. One-time step on the upgrade that moves the replay seeds out of the bundle: run `node sanctuary-replay-gate.mjs provision --rotate-replay-identities` as root. Earlier replay seeds were written by the Butler's user and must be treated as known to it, so this mints three new seeds (root-owned 0600, in the host folder above), moves any old seed in that folder aside as *.retired-<time>, removes the retired peers' trusted grants, marks their friend records revoked, demotes them to stranger and drops their DID pin and A2A identity (the last two as the resident user, never as root), onboards the new peers and rewrites state/replay/identities.json from the root-owned list; the old friend ids stay in that registry so they stay blocked from owner-policy writes. The peers it retires are the ones the root-owned record and replay list name. The earlier bundle copy of provision.json is not trusted, so the first rotation prints the friend ids it names as unverified; for each one you have checked is a replay peer, add `--retire-friend <id>` (repeatable). Always pass the DID the holder really signs with (`ouro a2a identity --json` on the holder's side); the Butler refuses a message signed by any other DID. First rollout of the trust mount: the live container has five mounts, so the first update fails the six-mount audit exactly as the psyche rollout did; recreate the resident once by hand with the six-mount create and rerun the update.
+
+During installation the resident is stopped, the root gateway is installed and proven, tokenless readiness runs, and authority-activate starts the exact six-mount target. On failure, authority-retire must finish before restoring bundle/config/mounts or starting the exact three-mount predecessor; authority-restore proves that rollback before the outer template journal is removed. An uncertain or interrupted handoff leaves autostart disabled and preserves both journals and root inputs for the same reviewed recovery, never a raw old-template start. Retired keys, policy, history and Jellyfin remain untouched. Re-enabling authority requires a new human token rotation and issuer epoch, not reuse of retired authority.
 
 On installed cold boot, the original unless-stopped and DockerMan autostart remain unchanged: /boot/config/custom/ouro-authority/start.sh --boot waits for the array and responsive Docker, then starts the fenced root gateway. Docker may already have started the tokenless resident; it fails closed until the gateway is ready. There is no pre-Docker gate, whole-array gate, resident direct poller or resident token fallback.
 
@@ -328,7 +330,7 @@ Effective-spec audit helper:
       test "$(sanctuary_image_mount_contract "$CREATE_IMAGE_ID")" = "$CREATE_MOUNT_CONTRACT" || return 1
       test "$(docker image inspect --format '{{.Id}}' "$CREATE_IMAGE_REFERENCE")" = "$CREATE_IMAGE_ID" || return 1
       case "$CREATE_MOUNT_CONTRACT" in
-        canonical-gateway) set -- --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro/psyche,dst=/home/ouro/AgentBundles/sanctuary.ouro/psyche,readonly" ;;
+        canonical-gateway) set -- --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro/psyche,dst=/home/ouro/AgentBundles/sanctuary.ouro/psyche,readonly" --mount "type=bind,src=/mnt/user/appdata/ouro-butler/trust/sanctuary,dst=/etc/ouro/trust/sanctuary,readonly" ;;
         canonical-pre-gateway) set -- ;;
         *) return 1 ;;
       esac
@@ -1671,7 +1673,7 @@ NODE
       TELEGRAM_READINESS_CONTRACT=$(sanctuary_image_mount_contract "$TELEGRAM_READINESS_IMAGE_ID") || return $?
       TELEGRAM_READINESS_CONTEXT=${2-}
       case "$TELEGRAM_READINESS_CONTRACT" in
-        canonical-gateway) TELEGRAM_READINESS_CONTEXT=${TELEGRAM_READINESS_CONTEXT:-strict}; set -- --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro/psyche,dst=/home/ouro/AgentBundles/sanctuary.ouro/psyche,readonly" ;;
+        canonical-gateway) TELEGRAM_READINESS_CONTEXT=${TELEGRAM_READINESS_CONTEXT:-strict}; set -- --mount "type=bind,src=/run/ouro-authority,dst=/run/ouro-authority,readonly" --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro/psyche,dst=/home/ouro/AgentBundles/sanctuary.ouro/psyche,readonly" --mount "type=bind,src=/mnt/user/appdata/ouro-butler/trust/sanctuary,dst=/etc/ouro/trust/sanctuary,readonly" ;;
         canonical-pre-gateway) TELEGRAM_READINESS_CONTEXT=${TELEGRAM_READINESS_CONTEXT:-live-precutover}; set -- ;;
         *) return 1 ;;
       esac

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -72,7 +72,8 @@ const MAINTENANCE = "/run/ouro-authority-maintenance"
 // The stop hook's flag: every keeper watchdog version stands down while it exists.
 const SHUTDOWN_FLAG = "/run/ouro-authority-shutdown"
 const GATE_SCRIPT = `${ROOT}/package/deploy/unraid/sanctuary-replay-gate.mjs`
-const GATE_PROVISION = `${BUNDLE}/state/replay-client/provision.json`
+// The replay clients' seeds and provisioning record: a root-owned host folder outside the bundle, which the Butler's user cannot write.
+const GATE_PROVISION = "/mnt/user/appdata/ouro-butler/replay-client/provision.json"
 // The whole gate (every case, including the eight-minute await wait) must finish well inside this; a hung gate is a failed gate.
 export const GATE_TIMEOUT_MS = 95 * 60 * 1000
 const UPGRADE_STEPS = ["stop", "switch", "resident", "migrate", "start"]
@@ -163,6 +164,26 @@ function preflight(version) {
     } catch { bad(`${f} is missing`) }
   }
 
+  say("delegated-command grants the Butler will still honour")
+  {
+    const friendRecords = {}
+    try {
+      for (const file of readdirSync(`${BUNDLE}/friends`).filter((name) => name.endsWith(".json"))) {
+        try { friendRecords[file.replace(/\.json$/u, "")] = JSON.parse(readFileSync(`${BUNDLE}/friends/${file}`, "utf8")) } catch { /* unreadable record: not a grant source */ }
+      }
+    } catch { /* no friends folder yet */ }
+    let trustedGrants = {}
+    try { trustedGrants = JSON.parse(readFileSync(`${TRUST_HOST_DIR}/delegated-command-grants.json`, "utf8")).grants ?? {} } catch { /* no trusted grants yet */ }
+    const warnings = legacyDelegationGrantWarnings(friendRecords, trustedGrants)
+    warnings.length === 0 ? ok("no friend record relies on the old delegationGrant") : warnings.forEach((line) => console.log(`  WARNING: ${line}`))
+  }
+
+  say("escalation holders the upgrade would drop")
+  {
+    const dropped = escalationGrantProblems()
+    dropped.length === 0 ? ok("every escalation holder in the bundle is already in the trusted file") : dropped.forEach((line) => bad(line))
+  }
+
   say("required programs in the target image")
   try {
     const missing = REQUIRED_PROGRAMS.filter((p) => {
@@ -397,9 +418,66 @@ function enableResidentAutostart() {
 // resident's boot check requires exactly that. On a normal boot the files already match the package, so the check writes
 // nothing; if they ever drift, its repair write fails with EROFS and startup fails loudly rather than silently rewriting psyche.
 export const PSYCHE_MOUNT = `${BUNDLE}/psyche:/home/ouro/AgentBundles/sanctuary.ouro/psyche:ro`
+// Operator-set grants (delegated commands, escalation) live outside the bundle, in a root-owned host directory mounted
+// read-only at /etc/ouro/trust/sanctuary. The bundle's recursive chown cannot reach it, and the resident cannot write it.
+export const TRUST_HOST_DIR = "/mnt/user/appdata/ouro-butler/trust/sanctuary"
+export const TRUST_MOUNT = `${TRUST_HOST_DIR}:/etc/ouro/trust/sanctuary:ro`
+
+/** What is wrong with a host trust directory's stat, or null when it is a real root-owned directory closed to group and other writes. */
+export function trustDirIssue(stat) {
+  if (stat.isSymbolicLink()) return `${TRUST_HOST_DIR} is a symlink`
+  if (!stat.isDirectory()) return `${TRUST_HOST_DIR} is not a directory`
+  if (stat.uid !== 0) return `${TRUST_HOST_DIR} must be owned by root`
+  if ((stat.mode & 0o022) !== 0) return `${TRUST_HOST_DIR} is writable by group or other`
+  return null
+}
+
+// Creates the host trust directory root-owned 0755 when it is missing; refuses one the resident could have made.
+function ensureTrustHostDir() {
+  if (!existsSync(TRUST_HOST_DIR)) {
+    sh("/bin/mkdir", ["-p", TRUST_HOST_DIR])
+    sh("/bin/chown", ["-h", "0:0", TRUST_HOST_DIR])
+    chmodSync(TRUST_HOST_DIR, 0o755)
+  }
+  const issue = trustDirIssue(lstatSync(TRUST_HOST_DIR))
+  if (issue) fail(`${issue}; fix it as root before the upgrade`)
+}
+
+/** What is wrong with the resident's trust mount, from `docker inspect` Mounts, or null when it is the read-only host directory. */
+export function trustMountIssue(mounts) {
+  const mount = (Array.isArray(mounts) ? mounts : []).find((entry) => entry?.Destination === "/etc/ouro/trust/sanctuary")
+  if (!mount) return "the operator trust directory is not mounted in the resident, so no grant would be honoured"
+  if (mount.Source !== TRUST_HOST_DIR) return `the operator trust directory is mounted from ${mount.Source}, not the root-owned host directory`
+  return mount.RW === false ? null : "the operator trust directory is mounted read-write in the resident"
+}
+
+/** Friends whose records still carry the old delegationGrant but have no trusted grant: the record is now only a hint, so they are refused. */
+export function legacyDelegationGrantWarnings(friendRecords, trustedGrants) {
+  return Object.entries(friendRecords)
+    .filter(([id, record]) => record?.delegationGrant && !(id in trustedGrants))
+    .map(([id, record]) => `${record.name ?? id} (${id}) has a delegationGrant on its friend record that is no longer honoured; grant it with \`ouro a2a delegated-commands grant --friend ${id} --did <did:key>\` as root`)
+}
+
+/**
+ * Escalation holders the old harness honoured (the bundle's state/a2a/escalation-grants.json) that the trusted file does not list. The
+ * upgrade never copies a grant out of the bundle, so each of these loses the escalation grant until the operator re-grants it.
+ */
+export function legacyEscalationGrantProblems(legacyGrants, trustedGrants) {
+  return Object.entries(legacyGrants ?? {})
+    .filter(([id]) => !(id in (trustedGrants ?? {})))
+    .map(([id, grant]) => `escalation holder ${id} is in the bundle's state/a2a/escalation-grants.json but not in ${TRUST_HOST_DIR}/escalation-grants.json, so the upgrade would drop it; grant it as root first with \`ouro a2a escalation grant --agent sanctuary --friend ${id} --did ${typeof grant?.did === "string" ? grant.did : "<did:key>"}\` (the one-off container form is in deploy/unraid/README.txt)`)
+}
+
+/** Reads the legacy bundle file and the trusted file from the host and returns the holders the upgrade would drop. */
+function escalationGrantProblems() {
+  const read = (file) => { try { return JSON.parse(readFileSync(file, "utf8")).grants ?? {} } catch { return {} } }
+  return legacyEscalationGrantProblems(read(`${BUNDLE}/state/a2a/escalation-grants.json`), read(`${TRUST_HOST_DIR}/escalation-grants.json`))
+}
+
 function recreateResident(version) {
   say("recreate resident container (tokenless, gateway socket mounted)")
   disableResidentAutostart()
+  ensureTrustHostDir()
   const icon = "https://raw.githubusercontent.com/ourostack/ouroboros/main/assets/ouroboros.png"
   docker(["rm", "-f", CONTAINER], { stdio: "ignore" })
   docker(["create", "--name", CONTAINER, "--network", "host", "--restart", "unless-stopped", "--user", "10001:10001",
@@ -411,6 +489,7 @@ function recreateResident(version) {
     "-v", "/boot/config/custom/ouro-events/spool:/run/ouro-events:ro",
     "-v", "/run/ouro-authority:/run/ouro-authority:ro",
     "-v", PSYCHE_MOUNT,
+    "-v", TRUST_MOUNT,
     image(version)])
   const ref = docker(["inspect", CONTAINER, "--format", "{{.Config.Image}}"]).trim()
   if (ref !== image(version)) fail(`recreated resident is ${ref}, expected ${image(version)}`)
@@ -488,33 +567,6 @@ export function psycheMountIssue(mounts) {
   return mount.RW === false ? null : "psyche is mounted read-write in the resident"
 }
 
-// The same recursive chown would also hand state/a2a and the escalation grant file to the resident. The Butler honours
-// a grant only when the file and its directory are root-owned and writable by no one else, so a prompt-injected model
-// running as uid 10001 cannot mint one. Put them back; the subdirectories the resident writes stay with it, created
-// first so it never needs to mkdir inside the root-owned directory.
-export function restoreEscalationGrantRoot(bundle = BUNDLE, { lstat = lstatSync, chmod = chmodSync, run = sh, log = warn, realpath = realpathSync } = {}) {
-  // lstat, never stat or exists: a link the resident planted must not carry the chown or chmod to its target.
-  const dir = trustedStateChild(bundle, "a2a", { lstat, realpath, log })
-  if (!dir) return
-  const refuse = (target, reason) => log(`upgrade restore REFUSED ${target}: ${reason}; no chown or chmod was applied through it`)
-  for (const sub of ["tasks", "pins", "seen"]) {
-    const target = `${dir}/${sub}`
-    let existing = null
-    try { existing = lstat(target) } catch { /* absent: created below */ }
-    if (existing && !existing.isDirectory()) { refuse(target, existing.isSymbolicLink() ? "symlink" : "not a directory"); continue }
-    run("/bin/mkdir", ["-p", target])
-    run("/bin/chown", ["-R", "10001:10001", target])
-  }
-  run("/bin/chown", ["-h", "0:0", dir])
-  chmod(dir, 0o755)
-  const grants = `${dir}/escalation-grants.json`
-  let grantStat = null
-  try { grantStat = lstat(grants) } catch { /* no grant written yet */ }
-  if (!grantStat) return
-  if (!grantStat.isFile()) { refuse(grants, grantStat.isSymbolicLink() ? "symlink" : "not a regular file"); return }
-  run("/bin/chown", ["-h", "0:0", grants])
-  chmod(grants, 0o644)
-}
 function migrateBundle(version, rollbackImage) {
   say(`migrate agent bundle to ${version}`)
   const pkgBundle = `${ROOT}/incoming-package/deploy/unraid/sanctuary.ouro`
@@ -528,7 +580,6 @@ function migrateBundle(version, rollbackImage) {
   sh("/bin/chown", ["-R", "10001:10001", BUNDLE])
   restoreReplayRoot()
   restorePsycheRoot()
-  restoreEscalationGrantRoot()
   ok("bundle committed (ownership restored to resident)")
 }
 
@@ -1040,7 +1091,7 @@ async function upgrade(version, rehearse, { noGate = false, plant } = {}) {
   if (rehearse && !UPGRADE_STEPS.includes(rehearse)) fail(`--rehearse takes one of: ${UPGRADE_STEPS.join(", ")}`)
   const gated = !rehearse && !noGate
   if (noGate && !rehearse) console.log("\n!! --no-gate: this upgrade will NOT be replay-gated or auto-rolled-back on a behavioural regression")
-  if (gated && !existsSync(GATE_PROVISION)) fail(`replay peers are not provisioned (${GATE_PROVISION}); run \`sanctuary-replay-gate.mjs provision\` first, or pass --no-gate`)
+  if (gated && !existsSync(GATE_PROVISION)) fail(`replay peers are not provisioned (${GATE_PROVISION}); run \`sanctuary-replay-gate.mjs provision\` first (once, on the upgrade that moves the replay seeds out of the bundle into that root-owned folder, run \`provision --rotate-replay-identities\` instead so no earlier seed survives; any seed or provision.json under state/replay-client in the bundle was writable by the Butler and is ignored), or pass --no-gate`)
   if (!existsSync(`${ROOT}/active.json`) || !existsSync(`${ROOT}/activation.json`)) fail("no installed authority; use prepare + install")
   if (existsSync(JOURNAL)) fail("a template transaction is pending; resolve it first")
   let id = imageId(version)
@@ -1144,6 +1195,12 @@ function verify(withGate = false) {
   existsSync(POLICY) ? ok(`steward policy ${sha12(POLICY)}`) : bad("steward policy missing")
   const psycheMount = JSON.parse(docker(["inspect", CONTAINER, "--format", "{{json .Mounts}}"]) || "[]")
   psycheMountIssue(psycheMount) === null ? ok("psyche is mounted read-only in the resident") : bad(psycheMountIssue(psycheMount))
+  const trustMount = JSON.parse(docker(["inspect", CONTAINER, "--format", "{{json .Mounts}}"]) || "[]")
+  trustMountIssue(trustMount) === null ? ok("the operator trust directory is mounted read-only in the resident") : bad(trustMountIssue(trustMount))
+  const trustIssue = existsSync(TRUST_HOST_DIR) ? trustDirIssue(lstatSync(TRUST_HOST_DIR)) : `${TRUST_HOST_DIR} is missing`
+  trustIssue === null ? ok("the host trust directory is root-owned and closed to group and other writes") : bad(trustIssue)
+  const droppedHolders = escalationGrantProblems()
+  droppedHolders.length === 0 ? ok("every escalation holder is in the trusted file") : droppedHolders.forEach((line) => bad(line))
   const psycheDir = `${BUNDLE}/psyche`
   if (existsSync(psycheDir)) {
     const psycheIssues = psycheProblems(psycheDir)