@ouro.bot/cli 0.1.0-alpha.991 → 0.1.0-alpha.992

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.992",
+      "changes": [
+        "The Butler's container keeps its bundle sync key mount through a release: the root authority's activation, which recreates the container after the upgrade, now mounts the key folder read-only as the upgrade does, and a rollback gives it back only to a release that has bundle sync."
+      ]
+    },
     {
       "version": "0.1.0-alpha.991",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.991",
+  "runtimeVersion": "0.1.0-alpha.992",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.991</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.992</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -36,6 +36,7 @@ var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SanctuaryAuthorityRootLifecycle = exports.SANCTUARY_UPGRADE_STEPS = exports.SANCTUARY_KEEPER_BOOT_LINES = void 0;
 exports.predecessorExpectsPsycheMount = predecessorExpectsPsycheMount;
+exports.predecessorHasBundleSync = predecessorHasBundleSync;
 exports.recordSanctuaryRootLifecycleFailure = recordSanctuaryRootLifecycleFailure;
 exports.runSanctuaryAuthorityRootCli = runSanctuaryAuthorityRootCli;
 const node_child_process_1 = require("node:child_process");
@@ -57,6 +58,8 @@ const OFFSET = `${BUNDLE}/state/senses/telegram/offset.json`;
 const SOCKET = "/run/ouro-authority";
 // Operator-set grants, root-owned on the host and mounted read-only into the Butler at /etc/ouro/trust/sanctuary.
 const TRUST = "/mnt/user/appdata/ouro-butler/trust/sanctuary";
+// The bundle sync deploy key's host folder, mounted read-only where the sync wrapper reads it (from alpha.991).
+const SYNC = "/mnt/user/appdata/ouro-butler/sync";
 const STAGING = "/var/lib/ouro-authority/staging";
 const CGROUP = "/sys/fs/cgroup/ouro-authority";
 const BOOT = "/boot/config/custom/ouro-authority/start.sh";
@@ -855,7 +858,7 @@ class SanctuaryAuthorityRootLifecycle {
         const steps = {
             stop: () => this.#halt(),
             switch: async () => { await this.#halt(); this.#switchPackage(journal); },
-            resident: () => this.#recreateResident(journal.to.imageReference, journal.to.imageId, { psycheMount: false }),
+            resident: () => this.#recreateResident(journal.to.imageReference, journal.to.imageId, { psycheMount: false, syncMount: true }),
             migrate: () => target().#bundle(["--operation", "migrate", "--rollback-image-id", journal.from.imageId, "--target-image-id", journal.to.imageId]),
             start: () => target().#startUpgraded(),
         };
@@ -918,7 +921,7 @@ class SanctuaryAuthorityRootLifecycle {
         predecessor.#publishBoot();
         if (this.#containers().find((container) => container.Name === "/ouro-butler")?.Image !== journal.from.imageId) {
             // A predecessor up to alpha.978 expects its psyche read-only over the bundle; alpha.979 and later own a writable one.
-            predecessor.#recreateResident(journal.from.imageReference, journal.from.imageId, { psycheMount: predecessorExpectsPsycheMount(journal.from.imageReference) });
+            predecessor.#recreateResident(journal.from.imageReference, journal.from.imageId, { psycheMount: predecessorExpectsPsycheMount(journal.from.imageReference), syncMount: predecessorHasBundleSync(journal.from.imageReference) });
         }
         await predecessor.#startUpgraded(PREDECESSOR_READY_TIMEOUT_MS);
         this.#remove(UPGRADE);
@@ -1027,8 +1030,12 @@ class SanctuaryAuthorityRootLifecycle {
     #publishBoot() {
         this.#write(BOOT, fs.readFileSync(this.#p(`${ROOT}/package/deploy/unraid/sanctuary-authority-service.sh`), "utf8"));
     }
-    /** `psycheMount` adds the read-only psyche mount that releases up to alpha.978 expect; only a rollback to such a release passes true. */
-    #recreateResident(reference, imageId, { psycheMount }) {
+    /**
+     * `psycheMount` adds the read-only psyche mount that releases up to alpha.978 expect; only a rollback to such a release
+     * passes true. `syncMount` adds the read-only bundle sync key mount that releases from alpha.991 carry; an older
+     * release's audit refuses it.
+     */
+    #recreateResident(reference, imageId, { psycheMount, syncMount }) {
         if (this.#containers().some((container) => container.Name === "/ouro-butler"))
             this.#docker(["rm", "-f", "ouro-butler"]);
         this.#docker(["create", "--name", "ouro-butler", "--network", "host", "--restart", "unless-stopped", "--user", "10001:10001",
@@ -1036,7 +1043,8 @@ class SanctuaryAuthorityRootLifecycle {
             "-v", `${RUNTIME}:/home/ouro/.ouro-cli:rw`, "-v", `${BUNDLE}:/home/ouro/AgentBundles/sanctuary.ouro:rw`,
             "-v", `${EVENTS}:/run/ouro-events:ro`, "-v", `${SOCKET}:${SOCKET}:ro`,
             ...(psycheMount ? ["-v", `${BUNDLE}/psyche:/home/ouro/AgentBundles/sanctuary.ouro/psyche:ro`] : []),
-            "-v", `${TRUST}:/etc/ouro/trust/sanctuary:ro`, reference]);
+            "-v", `${TRUST}:/etc/ouro/trust/sanctuary:ro`,
+            ...(syncMount ? ["-v", `${SYNC}:/run/ouro-sync:ro`] : []), reference]);
         const resident = this.#containers().find((container) => container.Name === "/ouro-butler");
         if (resident?.Image !== imageId || resident.State.Running)
             throw new Error("Sanctuary resident recreation readback failed");
@@ -1260,6 +1268,14 @@ function predecessorExpectsPsycheMount(imageReference) {
     const release = /^0\.1\.0-alpha\.(\d+)$/u.exec(imageReference.slice(imageReference.lastIndexOf(":") + 1));
     return release !== null && Number(release[1]) <= 978;
 }
+/** Whether a release's image carries bundle sync (alpha.991 or later, or a release with no prerelease tag), so its resident gets the sync key mount. */
+function predecessorHasBundleSync(imageReference) {
+    const tag = imageReference.slice(imageReference.lastIndexOf(":") + 1);
+    if (/^\d+\.\d+\.\d+$/u.test(tag))
+        return true;
+    const release = /^0\.1\.0-alpha\.(\d+)$/u.exec(tag);
+    return release !== null && Number(release[1]) >= 991;
+}
 /**
  * Keep the real failure where only root can read it (D-034). Stderr stays generic
  * because a parse error can quote private bytes; the authority root is as private

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.991",
+  "version": "0.1.0-alpha.992",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.991",
+      "version": "0.1.0-alpha.992",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.991",
+  "version": "0.1.0-alpha.992",
   "engines": {
     "node": ">=22"
   },