@ouro.bot/cli 0.1.0-alpha.990 → 0.1.0-alpha.992

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.992",
+      "changes": [
+        "The Butler's container keeps its bundle sync key mount through a release: the root authority's activation, which recreates the container after the upgrade, now mounts the key folder read-only as the upgrade does, and a rollback gives it back only to a release that has bundle sync."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.991",
+      "changes": [
+        "The Butler's home now syncs to its own private GitHub repository: the bundle carries its own git, pushes through a deploy key it can never read, holds its first push for the owner's yes, and the host's hourly backup hands over through a cutover that can always roll back."
+      ]
+    },
     {
       "version": "0.1.0-alpha.990",
       "changes": [

package/deploy/unraid/Dockerfile

@@ -7,14 +7,16 @@ ARG TARGETARCH
 ARG SUPERCRONIC_AMD64_SHA256=5adff01c5a797663948e656d2b61d10932369ee437eb5cb54fa872b2960f222b
 ARG SUPERCRONIC_ARM64_SHA256=c0576a8eb092e3f79108ed0a2155a25c7766af78456e5a6070e54757ef513bfe
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends ca-certificates curl procps python3 make g++ \
+  && apt-get install -y --no-install-recommends ca-certificates curl procps python3 make g++ git openssh-client sudo \
   && rm -rf /var/lib/apt/lists/* \
   && case "$TARGETARCH" in amd64) SUPERCRONIC_SHA256="$SUPERCRONIC_AMD64_SHA256" ;; arm64) SUPERCRONIC_SHA256="$SUPERCRONIC_ARM64_SHA256" ;; *) echo "unsupported architecture: $TARGETARCH" >&2; exit 1 ;; esac \
   && curl -fsSLo /usr/local/bin/supercronic "https://github.com/aptible/supercronic/releases/download/v0.2.46/supercronic-linux-${TARGETARCH}" \
   && echo "${SUPERCRONIC_SHA256}  /usr/local/bin/supercronic" | sha256sum -c - \
   && chmod 0755 /usr/local/bin/supercronic \
   && groupadd --gid 10001 ouro \
-  && useradd --uid 10001 --gid 10001 --home-dir /home/ouro --create-home --shell /usr/sbin/nologin ouro
+  && useradd --uid 10001 --gid 10001 --home-dir /home/ouro --create-home --shell /usr/sbin/nologin ouro \
+  && groupadd --system --gid 10002 ouro-sync \
+  && useradd --system --uid 10002 --gid 10002 --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin ouro-sync
 
 WORKDIR /opt/ouro
 COPY package.json npm-shrinkwrap.json ./
@@ -35,6 +37,17 @@ COPY skills ./skills
 COPY changelog.json ./changelog.json
 COPY deploy/unraid/container-runtime.json ./container-runtime.json
 COPY deploy/unraid /opt/ouro/deploy/unraid
+# Bundle sync pushes over ssh with the deploy key mounted at /run/ouro-sync. The key is 10002:10002 mode 0400, so
+# only ouro-sync can read it; the agent (ouro, 10001) reaches it only through sudo and the root-owned wrapper, which
+# accepts nothing but git's ssh call for one GitHub repository and trusts only GitHub's published host keys.
+COPY deploy/unraid/github_known_hosts /etc/ouro/github_known_hosts
+COPY deploy/unraid/ouro-sync-ssh /usr/local/libexec/ouro-sync-ssh
+COPY deploy/unraid/ouro-sync.sudoers /etc/sudoers.d/ouro-sync
+RUN chown root:root /etc/ouro /etc/ouro/github_known_hosts /usr/local/libexec/ouro-sync-ssh /etc/sudoers.d/ouro-sync \
+  && chmod 0755 /etc/ouro /usr/local/libexec/ouro-sync-ssh \
+  && chmod 0644 /etc/ouro/github_known_hosts \
+  && chmod 0440 /etc/sudoers.d/ouro-sync \
+  && visudo -cf /etc/sudoers.d/ouro-sync
 COPY assets/sanctuary-host-launcher.sh /opt/ouro/deploy/unraid/sanctuary-host-launcher.sh
 RUN chown -R 10001:10001 /opt/ouro /home/ouro
 

package/deploy/unraid/README.txt

@@ -45,7 +45,34 @@ Effective-spec audit helper:
   Before any sequence, define this helper. It captures one actual container
   inspect and its reviewed image inspect without printing either, invokes the
   packaged auditor from the explicit validated runner image argument, and
-  removes its mode-0600 inputs on success or shell exit:
+  removes its mode-0600 inputs on success or shell exit. bundle_sync_enabled
+  prints true or false from the bundle's agent.json and fails, with a fixed
+  message, when it is a symlink, is not a regular file (a FIFO would block the
+  read), or cannot be read or parsed; audits of the container being installed pass `bundle` so the
+  auditor requires the sync key mount while sync is on:
+    bundle_sync_enabled() {
+      BUNDLE_AGENT_JSON=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro/agent.json
+      if test -L "$BUNDLE_AGENT_JSON"; then
+        printf '%s\n' "bundle sync check: agent.json is a symlink; refusing to read it" >&2
+        return 1
+      fi
+      /usr/local/bin/node -e '
+        const fs = require("node:fs");
+        let agent;
+        try {
+          const fd = fs.openSync(process.argv[1], fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+          if (!fs.fstatSync(fd).isFile()) {
+            process.stderr.write("bundle sync check: agent.json is not a regular file; refusing to read it\n");
+            process.exit(1);
+          }
+          agent = JSON.parse(fs.readFileSync(fd, "utf8"));
+        } catch {
+          process.stderr.write("bundle sync check: agent.json is unreadable or not valid JSON\n");
+          process.exit(1);
+        }
+        process.stdout.write(agent?.sync?.enabled === true ? "true" : "false");
+      ' "$BUNDLE_AGENT_JSON"
+    }
     audit_effective() {
       (
       AUDIT_CONTAINER=$1
@@ -54,6 +81,7 @@ Effective-spec audit helper:
       AUDIT_MOUNT_CONTRACT=${4-}
       AUDIT_EXPECTED_IMAGE_REFERENCE=${5-}
       AUDIT_EXPECTED_ICON=${6-}
+      AUDIT_SYNC_SOURCE=${7-}
       validate_exact_image_id "$AUDIT_EXPECTED_IMAGE" || return $?
       validate_exact_image_id "$AUDIT_RUNNER_IMAGE_ID" || return $?
       test "$AUDIT_RUNNER_IMAGE_ID" != sha256:681449ad47a2621705cd339b481e6339236b31dc65e195b1cf5025d0f2191d7d || return $?
@@ -62,6 +90,11 @@ Effective-spec audit helper:
         test -n "$AUDIT_EXPECTED_IMAGE_REFERENCE" || return 1
         test "$AUDIT_EXPECTED_ICON" = https://raw.githubusercontent.com/ourostack/ouroboros/main/assets/ouroboros.png || return 1
         set -- --mount-contract "$AUDIT_MOUNT_CONTRACT" --expected-image-reference "$AUDIT_EXPECTED_IMAGE_REFERENCE" --expected-icon "$AUDIT_EXPECTED_ICON"
+        case "$AUDIT_SYNC_SOURCE" in
+          bundle) AUDIT_SYNC_ENABLED=$(bundle_sync_enabled) || return $?; set -- "$@" --sync-enabled "$AUDIT_SYNC_ENABLED" ;;
+          "") ;;
+          *) return 1 ;;
+        esac
         ;;
         legacy-alpha742) set -- --mount-contract "$AUDIT_MOUNT_CONTRACT" ;;
         *) return 1 ;;
@@ -920,7 +953,8 @@ Effective-spec audit helper:
       validate_exact_image_id "$REGISTERED_TEMPLATE_RUNNER_IMAGE_ID" || return $?
       printf '%s\n' "$REGISTERED_TEMPLATE_VERSION_IMAGE" | grep -Eq '^ghcr\.io/ourostack/ouroboros-butler:[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$' || return $?
       test -f "$REGISTERED_TEMPLATE_PATH" && test ! -L "$REGISTERED_TEMPLATE_PATH" || return 1
-      docker run --rm --pull=never --network=none --user 0:0 --read-only --cap-drop=ALL --security-opt=no-new-privileges --entrypoint /opt/ouro/deploy/unraid/audit-container-spec.sh --mount "type=bind,src=$REGISTERED_TEMPLATE_PATH,dst=/audit/sanctuary.xml,readonly" "$REGISTERED_TEMPLATE_RUNNER_IMAGE_ID" --persistent-template /audit/sanctuary.xml --runtime-policy /opt/ouro/deploy/unraid/container-runtime.json --expected-image-reference "$REGISTERED_TEMPLATE_VERSION_IMAGE" --mount-contract "$REGISTERED_TEMPLATE_MOUNT_CONTRACT" || return $?
+      REGISTERED_TEMPLATE_SYNC_ENABLED=$(bundle_sync_enabled) || return $?
+      docker run --rm --pull=never --network=none --user 0:0 --read-only --cap-drop=ALL --security-opt=no-new-privileges --entrypoint /opt/ouro/deploy/unraid/audit-container-spec.sh --mount "type=bind,src=$REGISTERED_TEMPLATE_PATH,dst=/audit/sanctuary.xml,readonly" "$REGISTERED_TEMPLATE_RUNNER_IMAGE_ID" --persistent-template /audit/sanctuary.xml --runtime-policy /opt/ouro/deploy/unraid/container-runtime.json --expected-image-reference "$REGISTERED_TEMPLATE_VERSION_IMAGE" --mount-contract "$REGISTERED_TEMPLATE_MOUNT_CONTRACT" --sync-enabled "$REGISTERED_TEMPLATE_SYNC_ENABLED" || return $?
     }
     verify_known_good_rollback_artifact() {
       EXPECTED_KNOWN_GOOD_IMAGE_ID=$1
@@ -1203,7 +1237,7 @@ Effective-spec audit helper:
         test "$(docker inspect --format '{{.Image}}' ouro-butler-rollback)" = "$TEMPLATE_RECOVERY_ROLLBACK_IMAGE_ID" || return 1
         test "$(docker inspect --format '{{.State.Running}}' ouro-butler-rollback)" = false || return 1
         assert_only_running_butler ouro-butler || return $?
-        audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" || return $?
+        audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" bundle || return $?
         migrate_sanctuary_package_managed_bundle "$IMAGE_ID" inspect >"$TEMPLATE_RECOVERY_INSPECTION" || return $?
         chown 0:0 "$TEMPLATE_RECOVERY_INSPECTION" && chmod 0600 "$TEMPLATE_RECOVERY_INSPECTION" || return $?
         write_dockerman_recovery_evidence committing target-exact-committing "$TEMPLATE_RECOVERY_INSPECTION" "$TEMPLATE_RECOVERY_EVIDENCE" || return $?
@@ -1255,7 +1289,7 @@ Effective-spec audit helper:
         TEMPLATE_RECOVERY_LEGACY_EVIDENCE_IMAGE_ID=$(docker inspect --format '{{.Image}}' ouro-butler-legacy-evidence) || return $?
         test "$TEMPLATE_RECOVERY_LEGACY_EVIDENCE_IMAGE_ID" = "$TEMPLATE_RECOVERY_ROLLBACK_IMAGE_ID" || return 1
         test "$(docker inspect --format '{{.State.Running}}' ouro-butler-legacy-evidence)" = false || return 1
-        audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" || return $?
+        audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" bundle || return $?
         start_only_butler_for_recovery || return $?
         wait_butler_ready ouro-butler || return $?
         migrate_sanctuary_package_managed_bundle "$IMAGE_ID" inspect >"$TEMPLATE_RECOVERY_INSPECTION" || return $?
@@ -1265,7 +1299,7 @@ Effective-spec audit helper:
         enable_butler_autostart || return $?
         /usr/local/bin/node "$STAGED_DOCKERMAN_TRANSACTION" mark-committing >/dev/null || return $?
       elif test "$TEMPLATE_RECOVERY_BUNDLE_STATE" = absent && test "$TEMPLATE_RECOVERY_STATE" = committing && test "$TEMPLATE_RECOVERY_PRODUCTION_IMAGE_ID" = "$IMAGE_ID"; then
-        audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" || return $?
+        audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" bundle || return $?
         wait_butler_ready ouro-butler || return $?
         verify_butler_autostart "1 0 0 0" || return $?
         migrate_sanctuary_package_managed_bundle "$IMAGE_ID" inspect >"$TEMPLATE_RECOVERY_INSPECTION" || return $?
@@ -2109,12 +2143,13 @@ Update:
       INSTALLED_SPOOL_SIZE=$(findmnt -bn -o SIZE --target /boot/config/custom/ouro-events/spool)
       test "$INSTALLED_SPOOL_SIZE" -le 4194304
     }
+    STAGED_SYNC_ENABLED=$(bundle_sync_enabled)
     docker run --rm --pull=never --network=none \
       --user 0:0 --read-only --cap-drop=ALL --security-opt=no-new-privileges \
       --entrypoint /opt/ouro/deploy/unraid/audit-container-spec.sh \
       --mount "type=bind,src=$STAGED_TEMPLATE,dst=/audit/sanctuary.xml,readonly" \
       --mount "type=bind,src=$STAGED_RUNTIME_POLICY,dst=/audit/container-runtime.json,readonly" \
-      "$IMAGE_ID" --persistent-template /audit/sanctuary.xml --runtime-policy /audit/container-runtime.json --expected-image-reference "$VERSION_IMAGE" --mount-contract "$TARGET_MOUNT_CONTRACT"
+      "$IMAGE_ID" --persistent-template /audit/sanctuary.xml --runtime-policy /audit/container-runtime.json --expected-image-reference "$VERSION_IMAGE" --mount-contract "$TARGET_MOUNT_CONTRACT" --sync-enabled "$STAGED_SYNC_ENABLED"
     /usr/local/bin/node -e '
       const fs = require("node:fs");
       const [sourcePath, destinationPath, imageId] = process.argv.slice(1);
@@ -2134,7 +2169,7 @@ Update:
       --entrypoint /opt/ouro/deploy/unraid/audit-container-spec.sh \
       --mount "type=bind,src=$STAGED_EXACT_TEMPLATE,dst=/audit/sanctuary.exact-image.xml,readonly" \
       --mount "type=bind,src=$STAGED_RUNTIME_POLICY,dst=/audit/container-runtime.json,readonly" \
-      "$IMAGE_ID" --template /audit/sanctuary.exact-image.xml --runtime-policy /audit/container-runtime.json --expected-image "$IMAGE_ID" --mount-contract "$TARGET_MOUNT_CONTRACT"
+      "$IMAGE_ID" --template /audit/sanctuary.exact-image.xml --runtime-policy /audit/container-runtime.json --expected-image "$IMAGE_ID" --mount-contract "$TARGET_MOUNT_CONTRACT" --sync-enabled "$STAGED_SYNC_ENABLED"
     recover_dockerman_template_transaction
     recover_pending_sanctuary_bundle_migration "$IMAGE_ID"
     classify_sanctuary_update_source
@@ -2301,7 +2336,7 @@ ouro-butler-rollback
     if test "$(inspect_registry_manifest_digest "$VERSION_IMAGE")" = "$MANIFEST_DIGEST" \
       && test "$(docker image inspect --format '{{.Id}}' "$VERSION_IMAGE")" = "$IMAGE_ID" \
       && create_sanctuary_container "$IMAGE_ID" "$VERSION_IMAGE" "$TARGET_MOUNT_CONTRACT" \
-      && audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" \
+      && audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$TARGET_MOUNT_CONTRACT" "$VERSION_IMAGE" "$TEMPLATE_ICON" bundle \
       && assert_only_running_butler - \
       && /usr/local/bin/node "$STAGED_DOCKERMAN_TRANSACTION" authority-activate >/dev/null \
       && assert_only_running_butler ouro-butler \
@@ -2646,7 +2681,7 @@ Restore:
       && rm -f "$HOST_RESTORE_INSTALLER" \
       && docker image inspect "$IMAGE_ID" >/dev/null \
       && create_sanctuary_container "$IMAGE_ID" "$RESTORE_VERSION_IMAGE" "$RESTORE_MOUNT_CONTRACT" \
-      && audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$RESTORE_MOUNT_CONTRACT" "$RESTORE_VERSION_IMAGE" https://raw.githubusercontent.com/ourostack/ouroboros/main/assets/ouroboros.png \
+      && audit_effective ouro-butler "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" "$RESTORE_MOUNT_CONTRACT" "$RESTORE_VERSION_IMAGE" https://raw.githubusercontent.com/ourostack/ouroboros/main/assets/ouroboros.png bundle \
       && assert_only_running_butler - \
       && docker start ouro-butler \
       && assert_only_running_butler ouro-butler \

package/deploy/unraid/github_known_hosts

@@ -0,0 +1,3 @@
+github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
+github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
+github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

package/deploy/unraid/ouro-sync-ssh

@@ -0,0 +1,98 @@
+#!/bin/sh
+# Bundle sync's ssh for git. Runs as ouro-sync under sudo, so only ouro-sync can read the deploy key.
+# It accepts only git's own ssh invocation for one GitHub repository and passes nothing else to ssh.
+# It runs no tool through PATH: validation is shell builtins only, and ssh is called by absolute path.
+set -u
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+# The character checks below use ranges, which follow the locale under bash.
+LC_ALL=C
+export LC_ALL
+
+refuse() {
+  printf 'ouro-sync-ssh: refused: %s\n' "$1" >&2
+  exit 2
+}
+
+login=""
+host=""
+command=""
+have_host=0
+have_command=0
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o)
+      [ "$#" -ge 2 ] && [ "$2" = "SendEnv=GIT_PROTOCOL" ] || refuse "only -o SendEnv=GIT_PROTOCOL is allowed"
+      shift 2
+      ;;
+    -p)
+      [ "$#" -ge 2 ] && [ "$2" = "22" ] || refuse "only -p 22 is allowed"
+      shift 2
+      ;;
+    -l)
+      [ "$#" -ge 2 ] && [ "$2" = "git" ] || refuse "only -l git is allowed"
+      login=git
+      shift 2
+      ;;
+    -*)
+      refuse "option $1 is not allowed"
+      ;;
+    *)
+      if [ "$have_host" -eq 0 ]; then
+        host=$1
+        have_host=1
+      elif [ "$have_command" -eq 0 ]; then
+        command=$1
+        have_command=1
+      else
+        refuse "too many arguments"
+      fi
+      shift
+      ;;
+  esac
+done
+
+case "$host" in
+  git@github.com) [ -z "$login" ] || refuse "host must be git@github.com" ;;
+  github.com) [ "$login" = git ] || refuse "host must be git@github.com" ;;
+  *) refuse "host must be git@github.com" ;;
+esac
+[ "$have_command" -eq 1 ] || refuse "a git command is required"
+case "$command" in
+  *"
+"*) refuse "the git command must be one line" ;;
+esac
+bad_command="only git-upload-pack or git-receive-pack for one repository is allowed"
+case "$command" in
+  "git-upload-pack "*) quoted=${command#git-upload-pack } ;;
+  "git-receive-pack "*) quoted=${command#git-receive-pack } ;;
+  *) refuse "$bad_command" ;;
+esac
+case "$quoted" in
+  *[!A-Za-z0-9._/\'-]*) refuse "$bad_command" ;;
+esac
+# Either 'owner/repo' with both quotes, or owner/repo with none.
+case "$quoted" in
+  \'*\') repo=${quoted#\'}; repo=${repo%\'} ;;
+  *\'*) refuse "the repository's quotes must be balanced" ;;
+  *) repo=$quoted ;;
+esac
+case "$repo" in
+  */*/*) refuse "$bad_command" ;;
+  */*) ;;
+  *) refuse "$bad_command" ;;
+esac
+owner=${repo%%/*}
+name=${repo#*/}
+name=${name%.git}
+for segment in "$owner" "$name"; do
+  case "$segment" in
+    "" | *[!A-Za-z0-9._-]*) refuse "$bad_command" ;;
+    . | ..) refuse "the repository path may not contain . or .." ;;
+  esac
+done
+
+exec /usr/bin/ssh -i /run/ouro-sync/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
+  -o UserKnownHostsFile=/etc/ouro/github_known_hosts -o BatchMode=yes \
+  -o ConnectTimeout=10 -o ServerAliveInterval=5 -o ServerAliveCountMax=2 \
+  -F /dev/null git@github.com "$command"

package/deploy/unraid/ouro-sync.sudoers

@@ -0,0 +1,3 @@
+Defaults!/usr/local/libexec/ouro-sync-ssh env_reset
+Defaults!/usr/local/libexec/ouro-sync-ssh secure_path="/usr/sbin:/usr/bin:/sbin:/bin"
+ouro ALL=(ouro-sync) NOPASSWD: /usr/local/libexec/ouro-sync-ssh

package/deploy/unraid/sanctuary-butler-upgrade.mjs

@@ -477,6 +477,11 @@ function enableResidentAutostart() {
 // read-only at /etc/ouro/trust/sanctuary. The bundle's recursive chown cannot reach it, and the resident cannot write it.
 export const TRUST_HOST_DIR = "/mnt/user/appdata/ouro-butler/trust/sanctuary"
 export const TRUST_MOUNT = `${TRUST_HOST_DIR}:/etc/ouro/trust/sanctuary:ro`
+// The bundle sync deploy key: root places it on the host, and the Butler reads it through a read-only mount. The key can
+// push to the owner's repo, so nothing inside the Butler can write the mount.
+export const SYNC_HOST_DIR = "/mnt/user/appdata/ouro-butler/sync"
+export const SYNC_TARGET = "/run/ouro-sync"
+export const SYNC_MOUNT = `${SYNC_HOST_DIR}:${SYNC_TARGET}:ro`
 
 /** What is wrong with a host trust directory's stat, or null when it is a real root-owned directory closed to group and other writes. */
 export function trustDirIssue(stat) {
@@ -544,6 +549,7 @@ function recreateResident(version) {
     "-v", "/boot/config/custom/ouro-events/spool:/run/ouro-events:ro",
     "-v", "/run/ouro-authority:/run/ouro-authority:ro",
     "-v", TRUST_MOUNT,
+    "-v", SYNC_MOUNT,
     image(version)])
   const ref = docker(["inspect", CONTAINER, "--format", "{{.Config.Image}}"]).trim()
   if (ref !== image(version)) fail(`recreated resident is ${ref}, expected ${image(version)}`)
@@ -1195,6 +1201,23 @@ export function withoutPsycheConfig(text, parse) {
   return after && psycheConfigs(after) === 0 && after.children.length === before.children.length - 1 ? next : text
 }
 
+export const SYNC_CONFIG = `  <Config Name="Bundle sync key (read-only)" Target="${SYNC_TARGET}" Default="${SYNC_HOST_DIR}" Mode="ro" Description="Deploy key the Butler's bundle sync pushes with, owned by 10002:10002 mode 0400 so only the sync wrapper reads it. Read-only inside the Butler" Type="Path" Display="always" Required="true" Mask="false">${SYNC_HOST_DIR}</Config>`
+
+/**
+ * The DockerMan template with the sync key's read-only Config added before </Container>, so a DockerMan Apply keeps the
+ * mount. `parse` is docker-man-template-xml.cjs's parseDockerManTemplateXml: a template it cannot read, one that already
+ * has a Config for the target, or one where the insertion does not add exactly that element comes back unchanged.
+ */
+export function withSyncConfig(text, parse) {
+  const syncConfigs = (document) => document?.children.filter((child) => child.name === "Config" && child.attributes.Target === SYNC_TARGET).length
+  const before = parse(text)
+  if (!before || syncConfigs(before) !== 0) return text
+  const close = text.lastIndexOf("</Container>")
+  const next = `${text.slice(0, close)}${SYNC_CONFIG}\n${text.slice(close)}`
+  const after = parse(next)
+  return after && syncConfigs(after) === 1 && after.children.length === before.children.length + 1 ? next : text
+}
+
 // Keep Unraid's DockerMan template (what the UI's Apply/Update uses) on the live image, without the old psyche mount.
 // Runs after the commit, so the parser comes from the installed package (this script is staged on its own, without siblings).
 function pinTemplate(version) {
@@ -1204,9 +1227,10 @@ function pinTemplate(version) {
   if (!next.includes(`<Repository>${image(version)}</Repository>`)) { console.log("  WARN: DockerMan template Repository not recognised; left unchanged"); return }
   try {
     const { parseDockerManTemplateXml } = createRequire(import.meta.url)(`${ROOT}/package/deploy/unraid/docker-man-template-xml.cjs`)
-    next = withoutPsycheConfig(next, parseDockerManTemplateXml)
-  } catch (error) { console.log(`  WARN: could not load the DockerMan template parser (${error.message}); psyche Config left in place`) }
+    next = withSyncConfig(withoutPsycheConfig(next, parseDockerManTemplateXml), parseDockerManTemplateXml)
+  } catch (error) { console.log(`  WARN: could not load the DockerMan template parser (${error.message}); psyche Config left in place, sync key Config not added`) }
   if (next.includes(`Target="${PSYCHE_TARGET}"`)) console.log("  WARN: DockerMan template still has a psyche Config; remove it before the next DockerMan Apply")
+  if (!next.includes(`Target="${SYNC_TARGET}"`)) console.log(`  WARN: DockerMan template has no ${SYNC_TARGET} Config; add it before the next DockerMan Apply`)
   if (next !== text) { writeFileSync(`${TEMPLATE}.prev`, text); writeFileSync(TEMPLATE, next) }
   ok(`DockerMan template pins ${image(version)}`)
 }