@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/contract-manifest.json

@@ -0,0 +1 @@
+{"activityResponseSchema":{"additionalProperties":false,"properties":{"items":{"items":{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"id":{"format":"uuid","pattern":"^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$","type":"string"},"kind":{"enum":["wake_started","wake_completed","wake_rejected","wake_aborted","agent_stopped"]},"occurredAt":{"format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$","type":"string"},"wakeId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["id","agentId","kind","occurredAt"],"type":"object"},"maxItems":100,"type":"array"},"nextCursor":{"maxLength":16,"minLength":1,"pattern":"^(0|[1-9][0-9]{0,15})$","type":"string"},"version":{"const":"noopolis.daimon.organization-runtime-activity.v1"}},"required":["version","items"],"type":"object"},"activityV2ResponseSchema":{"additionalProperties":false,"properties":{"executions":{"items":{"additionalProperties":false,"properties":{"agent_id":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"delivery_ids":{"items":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"maxItems":32,"type":"array"},"execution_id":{"type":"string"},"state":{"const":"running"}},"required":["agent_id","execution_id","state","delivery_ids"],"type":"object"},"maxItems":32,"type":"array"},"items":{"items":{"additionalProperties":false,"properties":{"acceptance_id":{"type":"string"},"accepted_at":{"format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$","type":"string"},"active":{"type":"boolean"},"agent_id":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"code":{"enum":["engine_failed","host_stopped","host_stopping","queued_wake_stopped","active_wake_aborted","queue_full","unknown_agent"]},"deferred":{"type":"boolean"},"delivery_id":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"execution_id":{"type":"string"},"queue_position":{"minimum":1,"type":"integer"},"request_digest":{"type":"string"},"state":{"enum":["accepted","running","completed","failed","stopped"]},"text":{"maxLength":16384,"type":"string"},"updated_at":{"format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$","type":"string"},"version":{"const":"noopolis.daimon.wake-receipt-status.v2"}},"required":["version","acceptance_id","agent_id","delivery_id","request_digest","state","accepted_at","updated_at","active"],"type":"object"},"maxItems":2112,"type":"array"},"state":{"enum":["running","stopped"]},"version":{"const":"noopolis.daimon.organization-runtime-activity.v2"}},"required":["version","items"],"type":"object"},"agySubscriptionRealm":{"directoryMode":448,"durableMountPath":"/var/lib/spawnfile/daimon/agy-subscription-realm","fileMode":384,"maxUnlockBytes":4096,"unlockMountPath":"/var/lib/spawnfile/daimon/agy-unlock-secret","unlockSourceSlot":"agy-unlock-secret"},"attention":{"accounting":"execution-start-reservations","busyDispatch":"bounded-pending-message-batch","completion":"explicit-per-delivery","defaultMaxBatchBytes":12000,"defaultMaxBatchMessages":8,"enabledBy":"agents[].attention","idleDispatch":"immediate","unhandled":"deferred-until-new-input"},"consumedConfigFields":["version","host.bindHost","host.port","host.controlTokenEnv","agents[].id","agents[].name","agents[].instructions","agents[].workspacePath","agents[].runtimeHomePath","agents[].engine.kind","agents[].engine.model","agents[].engine.reasoningEffort","agents[].engine.codexSandbox","agents[].schedule.kind","agents[].schedule.interval_ms","agents[].schedule.cron","agents[].schedule.timezone","agents[].schedule.prompt","agents[].schedule.jitter_seconds","agents[].mcp","agents[].moltnet","agents[].memory","agents[].attention"],"deliverySemantics":{"activeDeliveryIdempotency":"unbounded-until-terminal","concurrentSameAgentTurns":false,"externalEffectsExactlyOnce":false,"recovery":"at-least-once-with-stable-wake-id","terminalReceiptHorizon":2048},"engineCredentialMaterial":{"codex":{"destinationRelativePath":".codex/auth.json","directoryMode":448,"fileMode":384,"sourceRelativePath":".daimon-inbound/codex-auth","sourceSlot":"codex-auth"}},"grokEngineBroker":{"artifacts":{"arm64Sha256":"c07d22225ff968bc289e5ddf0981cdd5d64040eee6e3ea45da7d03e1439dea98","sourceSha256":"dd39aacfece496cc6528f6acdb4f1066a848a0fb5b0961f5c70b0ba00440dc24","x64Sha256":"67e3624d3198e9c59e1ffafa4eca7c895dfe265d5b8bb0614cb547b68b8b93a7"},"backendSocketPath":"/run/daimon-engine-broker/backend.sock","bounds":{"capabilityBundleBytes":8196,"capabilityBytes":4096,"outputBytes":262144,"promptBytes":65536},"controlProtocolVersion":"noopolis.daimon.engine-broker.v2","controlSocketPath":"/run/daimon-engine-broker/control.sock","credentialHomePath":"/var/lib/spawnfile/daimon/grok-subscription-realm","grokCliArtifacts":{"arm64":{"bytes":136090504,"sha256":"39ab87666877d64ef3a40aa60fbe0c3b6a6acd7001b78fe60e2c76bb6cfc4a94","url":"https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-1.0.34-linux-aarch64"},"x64":{"bytes":163035648,"sha256":"be5905e107d2b8b5f3c142d21ecfe4c8fd32a913d2fd551b788707930c4dc80d","url":"https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-1.0.34-linux-x86_64"}},"grokCliBuild":"3736acbc8658","grokCliVersion":"1.0.34","grokExecutablePath":"/usr/local/bin/grok","identities":{"brokerUid":2100,"firstWorkerUid":2200,"organizationUid":2000},"inferenceGrants":{"bodyMembers":["messages","model","reasoning_effort","response_format","stream","stream_options"],"client":{"configSha256":{"grok-4.5":{"high":"ffbc33728b821e9854fbc7c93601e599225da421ecfd6ebf10d314afcc28d6f2","low":"a07f7436f1268bb399ec233c65d3b3d8fb99a11a1f175f8da1ca133c9367bc74","medium":"1f4c0d4dad1f3b09419b5739db6423a09e0049abc091594c64123a75dd53dfb9"},"grok-4.6":{"high":"5652656effa82f0c4f09cf8226b16e6140332a5a358b571194bb5563312367ac","low":"79314d039f787e4ebfec7dacf57adc969086b948f564dec008f0ed6367e6062f","medium":"6f538de0547c0c4e6a3f04ae08595ceadadabb06b75f6b6ee4c428744bb95cd8"},"grok-build":{"high":"98d16f2b7d12f4eb540d625c853e51d227933e204923e43e8b9b4176f10aca2c","low":"ca15c6a562a008227d39c51d3a3a83715663089b3784e8b46debb1fb67b3c4a1","medium":"01783fb6beadcf6f8486fff0836820ad43fab5662b812a907fe9cfdb83e9804d"}},"envKey":"DAIMON_INFERENCE_GRANT","modelId":"daimon-inference-grok"},"failureCodes":["auth_stale","grant_limit","invalid_request","unavailable"],"ledgerDedupeKey":["grant","request"],"ledgerVersion":"noopolis.daimon.inference-usage.v1","limits":{"maxRequests":64,"maxTokens":2000000},"maxInFlightRequestsPerGrant":1,"maxLiveGrants":8,"messageRoles":["system","user","assistant"],"purposes":["judge","optimizer"],"requestKinds":["request_inference_grant","release_inference_grant"],"tokenPrefix":"inference_","ttlMs":600000},"launcherSocketPath":"/run/daimon-engine-broker/launcher.sock","mcpFacade":{"host":"127.0.0.1","path":"/mcp","port":43124},"nativeAbiVersion":2,"nativeExecutablePath":"/opt/daimon/bin/daimon-engine-broker","projectionVersion":"noopolis.daimon.grok-broker-projection.v1","providerProxy":{"host":"127.0.0.1","port":43123},"registrationPath":"/etc/daimon-engine-broker/registrations.bin","serviceConfigPath":"/etc/daimon-engine-broker/service.json","serviceConfigVersions":["noopolis.daimon.engine-broker-service.v1","noopolis.daimon.engine-broker-service.v2"],"slotPreflightVersion":"noopolis.daimon.grok-slot-preflight.v2","turnLimits":{"bounds":{"maxRequests":[1,48],"maxTokens":[1,10000000],"timeoutMs":[1000,3600000]},"keys":["maxRequests","maxTokens","timeoutMs"],"limitReasons":["tokens","requests","timeout","none"],"maxInFlightRequests":1,"missingUsageEstimate":{"inputBytesPerToken":2,"outputTokens":4096},"requestUsageMaxTokens":500000,"tokenCeilingOvershoot":"at-most-one-request","v1Defaults":{"maxRequests":32,"maxTokens":300000,"timeoutMs":240000},"wakeMayOnlyLower":true},"turnRecordVersions":["noopolis.daimon.engine-broker-turn.v1","noopolis.daimon.engine-broker-turn.v2"],"turnStorePath":"/var/lib/spawnfile/daimon/grok-subscription-realm/turns","wakeLimitEnvironment":{"maxTokens":"DAIMON_ENGINE_WAKE_TOKEN_CEILING","timeoutMs":"DAIMON_ENGINE_WAKE_TIMEOUT_MS"},"worker":{"configSha256":{"grok-4.5":{"high":"c63c3387ce92d94ec3f690abfe98942afcd7c9e17ff84816bbe751f340ab251f","low":"8247127c3625ff7c5d8d527a53596b89ec6557a821ac46cfd00bd122b90daff6","medium":"59288cee61297bb8c002097061a48f77b09d310754187a253ee089f7172a9155"},"grok-4.6":{"high":"65b0212564fb74042b1503d293fb8d3620276033264c0efade2a539ca09218e3","low":"ab58499ac32678097c146479896f2b8a8e2b0e39aea22dc0a60b6227e370538e","medium":"df1a5cc84346e7f6bf6090492fbd19faaefb42953e3bb2e8c6cbc0572242403f"},"grok-build":{"high":"a23724e00d670caee185ba7690d2daa868173e53905cf446f5329666f01ab4e3","low":"fb343f2809903f26d21681470943235031f946e99085542fd89555eb7782cbb5","medium":"8a587ef75c90eab70d19b24583e60051d6fba9d90c558839fdbb15588b4cc656"}},"defaultModel":"grok-4.6","defaultReasoningEffort":"low","home":{"directory":{"group":"worker","mode":1017,"uid":0},"organizationRuntimeHome":{"group":"worker","mode":456,"owner":"organization"},"privateTmp":{"mode":448,"owner":"worker","relativeToWorkerHome":"tmp"},"readOnlyFiles":{"gid":0,"mode":292,"names":["config.toml","managed_config.toml","requirements.toml","sandbox.toml","trusted_folders.toml"],"uid":0},"sandboxEvents":{"group":"broker","mode":416,"owner":"worker","relativePath":"sessions/sandbox-events.jsonl"},"sessionsDirectory":{"group":"worker","mode":1017,"relativePath":"sessions","uid":0},"sharedTmp":{"maxGroupExclusive":2200,"mode":1020,"otherMode":4,"paths":["/tmp","/var/tmp"],"uid":0},"spillDirectory":{"fileMode":416,"group":"worker","mode":1512,"owner":"organization","relativeToRuntimeHome":"tool-output"}},"maxTurns":48,"modelId":"daimon-broker-grok","models":["grok-4.6","grok-4.5","grok-build"],"reasoningEfforts":["low","medium","high"],"systemPromptSha256":"2c31c0085a54a4efbf9c0cf0b8124c56e47f38691b7f0c7fa233a74abaa8ddf8","toolIds":["run_terminal_cmd","read_file","grep","list_dir","search_tool","use_tool"],"visibleTools":["grep","list_dir","read_file","run_terminal_command","search_tool","use_tool"]}},"grokSubscriptionRealm":{"agentCredentialRelativePath":".grok/auth.json","bootstrapMountPath":"/var/lib/spawnfile/daimon/grok-bootstrap-auth","bootstrapSourceSlot":"grok-auth","directoryMode":448,"durableMountPath":"/var/lib/spawnfile/daimon/grok-subscription-realm","fileMode":384,"maxCredentialBytes":65536},"healthResponseSchema":{"additionalProperties":false,"properties":{"agents":{"items":{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"state":{"enum":["starting","running","stopping","stopped","idle","failed"]}},"required":["agentId","state"],"type":"object"},"maxItems":32,"type":"array"},"state":{"enum":["starting","running","stopping","stopped"]},"version":{"const":"noopolis.daimon.organization-runtime-health.v1"}},"required":["version","state","agents"],"type":"object"},"organizationRuntimeConfigSchema":{"$id":"noopolis.daimon.organization-runtime.v1","$schema":"https://json-schema.org/draft/2020-12/schema","additionalProperties":false,"properties":{"agents":{"items":{"additionalProperties":false,"properties":{"attention":{"additionalProperties":false,"properties":{"maxBatchBytes":{"maximum":12000,"minimum":1024,"type":"integer"},"maxBatchMessages":{"maximum":32,"minimum":1,"type":"integer"},"maxExecutions":{"maximum":9007199254740991,"minimum":1,"type":"integer"},"maxTokens":{"maximum":9007199254740991,"minimum":1,"type":"integer"}},"type":"object"},"engine":{"additionalProperties":false,"allOf":[{"if":{"properties":{"kind":{"const":"grok"}}},"then":{"dependentRequired":{"model":["reasoningEffort"],"reasoningEffort":["model"]},"properties":{"codexSandbox":false,"model":{"enum":["grok-4.6","grok-4.5","grok-build"]},"reasoningEffort":{"enum":["low","medium","high"]}}}},{"if":{"properties":{"kind":{"const":"agy"}}},"then":{"properties":{"codexSandbox":false,"model":false,"reasoningEffort":false}}}],"properties":{"codexSandbox":{"additionalProperties":false,"properties":{"mode":{"const":"workspace-write"},"networkAccess":{"const":false},"webSearch":{"const":"disabled"}},"required":["mode","networkAccess","webSearch"],"type":"object"},"kind":{"enum":["codex","grok","agy"]},"model":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"reasoningEffort":{"enum":["none","minimal","low","medium","high","xhigh","max","ultra","persistent"]}},"required":["kind"],"type":"object"},"id":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"instructions":{"maxLength":16384,"minLength":1,"pattern":"\\S","type":"string"},"mcp":{"items":{"additionalProperties":false,"properties":{"args":{"items":{"maxLength":4096,"type":"string"},"maxItems":32,"type":"array"},"authSecretEnv":{"pattern":"^[A-Za-z_][A-Za-z0-9_]*$","type":"string"},"command":{"pattern":"^/","type":"string"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"name":{"maxLength":4096,"minLength":1,"type":"string"},"tools":{"items":{"maxLength":4096,"minLength":1,"type":"string"},"maxItems":32,"minItems":1,"type":"array","uniqueItems":true},"transport":{"enum":["stdio","sse","streamable_http"]},"url":{"type":"string"}},"required":["name","transport","args","env","tools"],"type":"object"},"maxItems":8,"type":"array"},"memory":{"additionalProperties":false,"properties":{"runtimeHomePath":{"maxLength":4096,"pattern":"^/","type":"string"},"source":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"tokenBudget":{"maximum":1000000,"minimum":1,"type":"integer"}},"required":["runtimeHomePath"],"type":"object"},"moltnet":{"additionalProperties":false,"properties":{"cliPath":{"pattern":"^/","type":"string"},"configPath":{"pattern":"^/","type":"string"},"networks":{"items":{"additionalProperties":false,"properties":{"dms":{"type":"boolean"},"id":{"minLength":1,"type":"string"},"rooms":{"items":{"minLength":1,"type":"string"},"type":"array","uniqueItems":true}},"required":["id","rooms","dms"],"type":"object"},"maxItems":16,"type":"array"}},"required":["cliPath","configPath","networks"],"type":"object"},"name":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"runtimeHomePath":{"maxLength":4096,"pattern":"^/","type":"string"},"workspacePath":{"maxLength":4096,"pattern":"^/","type":"string"}},"required":["id","name","instructions","workspacePath","runtimeHomePath","engine"],"type":"object"},"maxItems":32,"minItems":1,"type":"array"},"host":{"additionalProperties":false,"properties":{"bindHost":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"controlTokenEnv":{"maxLength":4096,"pattern":"^[A-Za-z_][A-Za-z0-9_]*$","type":"string"},"port":{"maximum":65535,"minimum":1,"type":"integer"}},"required":["bindHost","port","controlTokenEnv"],"type":"object"},"version":{"const":"noopolis.daimon.organization-runtime.v1"}},"required":["version","host","agents"],"type":"object"},"organizationRuntimeConfigV2Schema":{"$id":"noopolis.daimon.organization-runtime.v2","$schema":"https://json-schema.org/draft/2020-12/schema","additionalProperties":false,"properties":{"agents":{"items":{"additionalProperties":false,"properties":{"attention":{"additionalProperties":false,"properties":{"maxBatchBytes":{"maximum":12000,"minimum":1024,"type":"integer"},"maxBatchMessages":{"maximum":32,"minimum":1,"type":"integer"},"maxExecutions":{"maximum":9007199254740991,"minimum":1,"type":"integer"},"maxTokens":{"maximum":9007199254740991,"minimum":1,"type":"integer"}},"type":"object"},"engine":{"additionalProperties":false,"allOf":[{"if":{"properties":{"kind":{"const":"grok"}}},"then":{"dependentRequired":{"model":["reasoningEffort"],"reasoningEffort":["model"]},"properties":{"codexSandbox":false,"model":{"enum":["grok-4.6","grok-4.5","grok-build"]},"reasoningEffort":{"enum":["low","medium","high"]}}}},{"if":{"properties":{"kind":{"const":"agy"}}},"then":{"properties":{"codexSandbox":false,"model":false,"reasoningEffort":false}}}],"properties":{"codexSandbox":{"additionalProperties":false,"properties":{"mode":{"const":"workspace-write"},"networkAccess":{"const":false},"webSearch":{"const":"disabled"}},"required":["mode","networkAccess","webSearch"],"type":"object"},"kind":{"enum":["codex","grok","agy"]},"model":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"reasoningEffort":{"enum":["none","minimal","low","medium","high","xhigh","max","ultra","persistent"]}},"required":["kind"],"type":"object"},"id":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"instructions":{"maxLength":16384,"minLength":1,"pattern":"\\S","type":"string"},"mcp":{"items":{"additionalProperties":false,"properties":{"args":{"items":{"maxLength":4096,"type":"string"},"maxItems":32,"type":"array"},"authSecretEnv":{"pattern":"^[A-Za-z_][A-Za-z0-9_]*$","type":"string"},"command":{"pattern":"^/","type":"string"},"env":{"additionalProperties":{"type":"string"},"type":"object"},"name":{"maxLength":4096,"minLength":1,"type":"string"},"tools":{"items":{"maxLength":4096,"minLength":1,"type":"string"},"maxItems":32,"minItems":1,"type":"array","uniqueItems":true},"transport":{"enum":["stdio","sse","streamable_http"]},"url":{"type":"string"}},"required":["name","transport","args","env","tools"],"type":"object"},"maxItems":8,"type":"array"},"memory":{"additionalProperties":false,"properties":{"runtimeHomePath":{"maxLength":4096,"pattern":"^/","type":"string"},"source":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"tokenBudget":{"maximum":1000000,"minimum":1,"type":"integer"}},"required":["runtimeHomePath"],"type":"object"},"moltnet":{"additionalProperties":false,"properties":{"cliPath":{"pattern":"^/","type":"string"},"configPath":{"pattern":"^/","type":"string"},"networks":{"items":{"additionalProperties":false,"properties":{"dms":{"type":"boolean"},"id":{"minLength":1,"type":"string"},"rooms":{"items":{"minLength":1,"type":"string"},"type":"array","uniqueItems":true}},"required":["id","rooms","dms"],"type":"object"},"maxItems":16,"type":"array"}},"required":["cliPath","configPath","networks"],"type":"object"},"name":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"runtimeHomePath":{"maxLength":4096,"pattern":"^/","type":"string"},"schedule":{"oneOf":[{"additionalProperties":false,"properties":{"kind":{"const":"disabled"}},"required":["kind"],"type":"object"},{"additionalProperties":false,"properties":{"interval_ms":{"maximum":31536000000,"minimum":1,"type":"integer"},"jitter_seconds":{"maximum":3600,"minimum":0,"type":"integer"},"kind":{"const":"every"},"prompt":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["kind","interval_ms","prompt"],"type":"object"},{"additionalProperties":false,"properties":{"cron":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"jitter_seconds":{"maximum":3600,"minimum":0,"type":"integer"},"kind":{"const":"cron"},"prompt":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"timezone":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["kind","cron","timezone","prompt"],"type":"object"}]},"workspacePath":{"maxLength":4096,"pattern":"^/","type":"string"}},"required":["id","name","instructions","workspacePath","runtimeHomePath","engine","schedule"],"type":"object"},"maxItems":32,"minItems":1,"type":"array"},"host":{"additionalProperties":false,"properties":{"bindHost":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"controlTokenEnv":{"maxLength":4096,"pattern":"^[A-Za-z_][A-Za-z0-9_]*$","type":"string"},"port":{"maximum":65535,"minimum":1,"type":"integer"}},"required":["bindHost","port","controlTokenEnv"],"type":"object"},"version":{"const":"noopolis.daimon.organization-runtime.v2"}},"required":["version","host","agents"],"type":"object"},"supportedEngineKinds":["agy","codex","grok"],"version":"noopolis.daimon.runtime-contract-manifest.v3","wakeAcceptanceTypes":["manual","message","schedule","external"],"wakeRequestSchema":{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"event":{"additionalProperties":false,"properties":{"id":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"kind":{"enum":["manual","message","schedule","external"]},"occurredAt":{"format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$","type":"string"},"text":{"maxLength":4096,"type":"string"},"version":{"const":"noopolis.daimon.wake.v1"}},"required":["version","id","kind","text","occurredAt"],"type":"object"}},"required":["agentId","event"],"type":"object"},"wakeResultSchema":{"oneOf":[{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"durationMs":{"minimum":0,"type":"integer"},"status":{"const":"completed"},"text":{"maxLength":4096,"type":"string"},"version":{"const":"noopolis.daimon.wake-result.v1"},"wakeId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["version","status","agentId","wakeId","text","durationMs"],"type":"object"},{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"code":{"enum":["unauthorized","unknown_agent","queue_full","durable_inbox_required"]},"status":{"const":"rejected"},"version":{"const":"noopolis.daimon.wake-result.v1"},"wakeId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["version","status","agentId","wakeId","code"],"type":"object"},{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"type":"string"},"code":{"const":"invalid_request"},"status":{"const":"rejected"},"version":{"const":"noopolis.daimon.wake-result.v1"},"wakeId":{"maxLength":4096,"type":"string"}},"required":["version","status","agentId","wakeId","code"],"type":"object"},{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"code":{"enum":["host_stopping","host_stopped","queued_wake_stopped","active_wake_aborted"]},"status":{"const":"stopped"},"version":{"const":"noopolis.daimon.wake-result.v1"},"wakeId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["version","status","agentId","wakeId","code"],"type":"object"},{"additionalProperties":false,"properties":{"agentId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"},"code":{"const":"engine_failed"},"status":{"const":"failed"},"version":{"const":"noopolis.daimon.wake-result.v1"},"wakeId":{"maxLength":4096,"minLength":1,"pattern":"\\S","type":"string"}},"required":["version","status","agentId","wakeId","code"],"type":"object"}]},"workAvailabilityResponseSchema":{"additionalProperties":false,"properties":{"agents":{"items":{"additionalProperties":false,"properties":{"agent_id":{"type":"string"},"budget":{"additionalProperties":false,"properties":{"agent_executions_remaining":{"minimum":0,"type":"integer"},"agent_executions_used":{"minimum":0,"type":"integer"},"agent_tokens_remaining":{"minimum":0,"type":"integer"},"agent_tokens_used":{"minimum":0,"type":"integer"},"armed":{"type":"boolean"},"epoch":{"type":"string"},"executions_remaining":{"minimum":0,"type":"integer"},"executions_used":{"minimum":0,"type":"integer"},"reason":{"type":"string"},"state":{"enum":["available","paused","stopped"]},"tokens_remaining":{"minimum":0,"type":"integer"},"tokens_used":{"minimum":0,"type":"integer"}},"required":["armed","epoch","state","executions_used","executions_remaining","tokens_used","tokens_remaining","agent_executions_used","agent_tokens_used"],"type":"object"},"deferred":{"minimum":0,"type":"integer"},"error":{"type":"string"},"pending":{"minimum":0,"type":"integer"},"running":{"type":"boolean"}},"required":["agent_id","pending","running","deferred","budget"],"type":"object"},"maxItems":32,"type":"array"},"state":{"enum":["running","paused","stopped"]},"version":{"const":"noopolis.daimon.work-availability.v1"}},"required":["version","state","agents"],"type":"object"},"workBlockedSchema":{"additionalProperties":false,"properties":{"reason":{"enum":["operator_stop","ledger_unavailable","host_stopping","host_stopped","queue_full"]},"retry_after_ms":{"maximum":300000,"minimum":1000,"type":"integer"},"version":{"const":"noopolis.daimon.work-blocked.v1"}},"required":["version","reason","retry_after_ms"],"type":"object"}}

package/dist/runtime/contract-manifest.sha256

@@ -0,0 +1 @@
+sha256:c672ed47e4a01a75f1482ea6e4b6ecb28205aab344741a10cad8783f5501b6c4

package/dist/runtime/contractManifest.d.ts

@@ -0,0 +1,8 @@
+import { canonicalJson } from "../contracts/canonicalJson.js";
+import { AGY_SUBSCRIPTION_REALM, ENGINE_CREDENTIAL_MATERIAL, GROK_ENGINE_BROKER, GROK_SUBSCRIPTION_REALM, ORGANIZATION_RUNTIME_ACTIVITY_V2_VERSION, RUNTIME_CONTRACT_MANIFEST, RUNTIME_CONTRACT_MANIFEST_VERSION } from "../contracts/runtimeContractManifest.js";
+export { AGY_SUBSCRIPTION_REALM, canonicalJson, ENGINE_CREDENTIAL_MATERIAL, GROK_ENGINE_BROKER, GROK_SUBSCRIPTION_REALM, ORGANIZATION_RUNTIME_ACTIVITY_V2_VERSION, RUNTIME_CONTRACT_MANIFEST, RUNTIME_CONTRACT_MANIFEST_VERSION };
+export type RuntimeContractManifest = typeof RUNTIME_CONTRACT_MANIFEST;
+export type EngineCredentialKind = keyof typeof ENGINE_CREDENTIAL_MATERIAL;
+export type EngineCredentialSlot = (typeof ENGINE_CREDENTIAL_MATERIAL)[EngineCredentialKind]["sourceSlot"];
+export declare const canonicalRuntimeContractManifest: () => string;
+//# sourceMappingURL=contractManifest.d.ts.map

package/dist/runtime/contractManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contractManifest.d.ts","sourceRoot":"","sources":["../../src/runtime/contractManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,wCAAwC,EACxC,yBAAyB,EACzB,iCAAiC,EAClC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,wCAAwC,EACxC,yBAAyB,EACzB,iCAAiC,EAClC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,OAAO,yBAAyB,CAAC;AACvE,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,0BAA0B,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,oBAAoB,CAAC,CAAC,YAAY,CAAC,CAAC;AAE3G,eAAO,MAAM,gCAAgC,QAAO,MAAkD,CAAC"}

package/dist/runtime/contractManifest.js

@@ -0,0 +1,4 @@
+import { canonicalJson } from "../contracts/canonicalJson.js";
+import { AGY_SUBSCRIPTION_REALM, ENGINE_CREDENTIAL_MATERIAL, GROK_ENGINE_BROKER, GROK_SUBSCRIPTION_REALM, ORGANIZATION_RUNTIME_ACTIVITY_V2_VERSION, RUNTIME_CONTRACT_MANIFEST, RUNTIME_CONTRACT_MANIFEST_VERSION } from "../contracts/runtimeContractManifest.js";
+export { AGY_SUBSCRIPTION_REALM, canonicalJson, ENGINE_CREDENTIAL_MATERIAL, GROK_ENGINE_BROKER, GROK_SUBSCRIPTION_REALM, ORGANIZATION_RUNTIME_ACTIVITY_V2_VERSION, RUNTIME_CONTRACT_MANIFEST, RUNTIME_CONTRACT_MANIFEST_VERSION };
+export const canonicalRuntimeContractManifest = () => canonicalJson(RUNTIME_CONTRACT_MANIFEST);

package/dist/runtime/engineBrokerCapabilities.d.ts

@@ -0,0 +1,30 @@
+export declare class EngineBrokerCapabilities {
+    private readonly grants;
+    issue(agentId: string, turnId: string, ttlMs?: number, maxRequests?: number): string;
+    authorize(agentId: string, turnId: string, token: string): boolean;
+    authorizeToken(token: string): Readonly<{
+        agentId: string;
+        turnId: string;
+    }> | undefined;
+    /**
+     * Which grant a token names and why it would be refused, *without* spending
+     * it.
+     *
+     * The facade needs this on its refusal path alone. A 403 it cannot attribute
+     * to a turn is a 403 that seals as nothing at all, and a turn whose every
+     * request was refused then reads exactly like a healthy one — the silence
+     * `engineBrokerMcpCallLog.ts` exists to end. A token no grant matches names
+     * no turn and stays unattributed; nothing here returns the token, the grant
+     * or the agent's capability, only the turn id and a closed reason.
+     */
+    classifyToken(token: string): Readonly<{
+        turnId: string;
+        state: "live" | "expired" | "exhausted";
+    }> | undefined;
+    inspectToken(token: string): Readonly<{
+        agentId: string;
+        turnId: string;
+    }> | undefined;
+    revoke(turnId: string): void;
+}
+//# sourceMappingURL=engineBrokerCapabilities.d.ts.map

package/dist/runtime/engineBrokerCapabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineBrokerCapabilities.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerCapabilities.ts"],"names":[],"mappings":"AAIA,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,SAAc,EAAE,WAAW,SAAK,GAAG,MAAM;IAMrF,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAKlE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS;IAQxF;;;;;;;;;;OAUG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC,GAAG,SAAS;IAW/G,YAAY,CAAC,KAAK,EAAC,MAAM,GAAE,QAAQ,CAAC;QAAC,OAAO,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAA;KAAC,CAAC,GAAC,SAAS;IAC7E,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAC7B"}

package/dist/runtime/engineBrokerCapabilities.js

@@ -0,0 +1,59 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export class EngineBrokerCapabilities {
+    grants = new Map();
+    issue(agentId, turnId, ttlMs = 15 * 60_000, maxRequests = 64) {
+        if (ttlMs < 1 || maxRequests < 1)
+            throw new TypeError("invalid broker capability policy");
+        const token = randomBytes(32).toString("base64url");
+        this.grants.set(turnId, { agentId, turnId, digest: hash(token), expiresAt: Date.now() + ttlMs, maxRequests, requests: 0 });
+        return token;
+    }
+    authorize(agentId, turnId, token) {
+        const grant = this.grants.get(turnId);
+        const candidate = hash(token);
+        if (grant === undefined || grant.agentId !== agentId || grant.expiresAt <= Date.now() || grant.requests >= grant.maxRequests || !timingSafeEqual(grant.digest, candidate))
+            return false;
+        grant.requests += 1;
+        return true;
+    }
+    authorizeToken(token) {
+        const candidate = hash(token);
+        for (const grant of this.grants.values()) {
+            if (grant.expiresAt <= Date.now() || grant.requests >= grant.maxRequests || !timingSafeEqual(grant.digest, candidate))
+                continue;
+            grant.requests += 1;
+            return { agentId: grant.agentId, turnId: grant.turnId };
+        }
+        return undefined;
+    }
+    /**
+     * Which grant a token names and why it would be refused, *without* spending
+     * it.
+     *
+     * The facade needs this on its refusal path alone. A 403 it cannot attribute
+     * to a turn is a 403 that seals as nothing at all, and a turn whose every
+     * request was refused then reads exactly like a healthy one — the silence
+     * `engineBrokerMcpCallLog.ts` exists to end. A token no grant matches names
+     * no turn and stays unattributed; nothing here returns the token, the grant
+     * or the agent's capability, only the turn id and a closed reason.
+     */
+    classifyToken(token) {
+        const candidate = hash(token);
+        for (const grant of this.grants.values()) {
+            if (!timingSafeEqual(grant.digest, candidate))
+                continue;
+            // Budget before expiry: the TTL outlives every declared turn limit, so an
+            // exhausted grant is the reachable refusal and the actionable answer.
+            if (grant.requests >= grant.maxRequests)
+                return { turnId: grant.turnId, state: "exhausted" };
+            return { turnId: grant.turnId, state: grant.expiresAt <= Date.now() ? "expired" : "live" };
+        }
+        return undefined;
+    }
+    inspectToken(token) { const candidate = hash(token); for (const grant of this.grants.values()) {
+        if (grant.expiresAt > Date.now() && grant.requests < grant.maxRequests && timingSafeEqual(grant.digest, candidate))
+            return { agentId: grant.agentId, turnId: grant.turnId };
+    } return undefined; }
+    revoke(turnId) { const grant = this.grants.get(turnId); grant?.digest.fill(0); this.grants.delete(turnId); }
+}
+const hash = (value) => createHash("sha256").update(value).digest();

package/dist/runtime/engineBrokerControlClient.d.ts

@@ -0,0 +1,44 @@
+import type { EngineBrokerInferenceFailureCode, EngineBrokerInferenceResponse } from "./engineBrokerInferenceProtocol.js";
+import type { EngineBrokerTurnLimitOverrides } from "./engineBrokerTurnAccounting.js";
+import type { GrokBrokerModel, GrokBrokerReasoningEffort } from "./grokBrokerModelPolicy.js";
+import type { GrokInferencePurpose } from "./inferenceUsageLedger.js";
+export type EngineBrokerInferenceGrant = Omit<Extract<EngineBrokerInferenceResponse, {
+    kind: "inference_grant";
+}>, "version" | "kind" | "requestId">;
+/** A refused grant request; `code` is closed (`auth_stale` is the stale shared realm, `grant_limit` the live-grant cap). */
+export declare class EngineBrokerInferenceGrantRefused extends Error {
+    readonly code: EngineBrokerInferenceFailureCode;
+    constructor(code: EngineBrokerInferenceFailureCode);
+}
+/**
+ * What the organization runtime asks of a brokered turn beyond the prompt:
+ * `limits` may only lower the registration's declared limits, and `model`,
+ * when the agent declared one, must equal the model the broker sealed.
+ */
+export type EngineBrokerTurnOptions = Readonly<{
+    limits?: EngineBrokerTurnLimitOverrides;
+    model?: string;
+}>;
+export interface EngineBrokerTurnClient {
+    turn(agentId: string, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, options?: EngineBrokerTurnOptions): Promise<string>;
+}
+export declare class EngineBrokerControlClient implements EngineBrokerTurnClient {
+    private readonly socketPath;
+    constructor(socketPath?: string);
+    ready(): Promise<void>;
+    /**
+     * Evaluator side (organization uid only; the native relay enforces it):
+     * borrow the broker credential for one sequential lane of judge or optimizer
+     * requests. Refusals reject with {@link EngineBrokerInferenceGrantRefused};
+     * a broker that cannot answer rejects with `engine broker unavailable`.
+     */
+    requestInferenceGrant(request: Readonly<{
+        model: GrokBrokerModel;
+        reasoningEffort: GrokBrokerReasoningEffort;
+        purpose: GrokInferencePurpose;
+    }>): Promise<EngineBrokerInferenceGrant>;
+    releaseInferenceGrant(grantId: string): Promise<boolean>;
+    private exchange;
+    turn(agentId: string, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, options?: EngineBrokerTurnOptions): Promise<string>;
+}
+//# sourceMappingURL=engineBrokerControlClient.d.ts.map

package/dist/runtime/engineBrokerControlClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineBrokerControlClient.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerControlClient.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gCAAgC,EAAgC,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAExJ,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAetE,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC;AACrJ,4HAA4H;AAC5H,qBAAa,iCAAkC,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,gCAAgC;gBAAtC,IAAI,EAAE,gCAAgC;CAC5D;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAAE,MAAM,CAAC,EAAE,8BAA8B,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC5G,MAAM,WAAW,sBAAsB;IAAG,IAAI,CAAC,OAAO,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,EAAC,MAAM,CAAC,EAAC,WAAW,EAAC,OAAO,CAAC,EAAC,uBAAuB,GAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CAAE;AACrL,qBAAa,yBAA0B,YAAW,sBAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,SAAyC;IAC1E,KAAK,IAAG,OAAO,CAAC,IAAI,CAAC;IAC3B;;;;;OAKG;IACG,qBAAqB,CAAC,OAAO,EAAC,QAAQ,CAAC;QAAC,KAAK,EAAC,eAAe,CAAC;QAAA,eAAe,EAAC,yBAAyB,CAAC;QAAA,OAAO,EAAC,oBAAoB,CAAA;KAAC,CAAC,GAAE,OAAO,CAAC,0BAA0B,CAAC;IAM3K,qBAAqB,CAAC,OAAO,EAAC,MAAM,GAAE,OAAO,CAAC,OAAO,CAAC;IAM5D,OAAO,CAAC,QAAQ;IACV,IAAI,CAAC,OAAO,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,EAAC,MAAM,CAAC,EAAC,WAAW,EAAC,OAAO,GAAC,uBAA0B,GAAE,OAAO,CAAC,MAAM,CAAC;CAMjJ"}

package/dist/runtime/engineBrokerControlClient.js

@@ -0,0 +1,132 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createConnection } from "node:net";
+import { ENGINE_BROKER_VERSION, encodeEngineBrokerFrame, EngineBrokerFrameDecoder, parseEngineBrokerResponse } from "./engineBrokerProtocol.js";
+import { ENGINE_BROKER_MCP_REFUSAL_REASONS } from "./engineBrokerMcpCallLog.js";
+/**
+ * What the broker saw of the worker's MCP tool calls on a failed turn
+ * (`engineBrokerMcpCallLog.ts`). Absent for a turn with no observation at all;
+ * `outstanding` names every call that started and was never answered, with how
+ * long it had been waiting — the one thing a completion-only tool receipt can
+ * never say.
+ */
+const renderMcpCalls = (calls) => calls === undefined ? "" : `; mcp=${calls.answered}/${calls.started} answered${calls.undecoded === 0 ? "" : `; mcp_undecoded=${calls.undecoded}`}${calls.outstanding.length === 0 ? "" : `; mcp_outstanding=${calls.outstanding.map((call) => `${call.name}@${call.outstandingMs}ms`).join(",")}`}${renderMcpRefusals(calls.refusals)}${renderMcpTunnels(calls.tunnels)}`;
+/** The refusals the facade never relayed, by reason class, and only the classes that happened: a turn refused 403 must not read as a turn that was served. */
+const renderMcpRefusals = (refusals) => { if (refusals === undefined)
+    return ""; const named = ENGINE_BROKER_MCP_REFUSAL_REASONS.filter((reason) => refusals[reason] > 0); return named.length === 0 ? "" : `; mcp_refused=${named.map((reason) => `${reason}:${refusals[reason]}`).join(",")}`; };
+/** The session's GET SSE tunnels: how many closed of how many opened, and each one still open with its age and whether the mount ever pushed through it. */
+const renderMcpTunnels = (tunnels) => tunnels === undefined ? "" : `; mcp_get=${tunnels.closed}/${tunnels.opened} closed, ${tunnels.delivered} delivered${tunnels.open.length === 0 ? "" : `; mcp_get_open=${tunnels.open.map((tunnel) => `${tunnel.openMs}ms/${tunnel.delivered ? "delivered" : "silent"}`).join(",")}`}`;
+/** A refused grant request; `code` is closed (`auth_stale` is the stale shared realm, `grant_limit` the live-grant cap). */
+export class EngineBrokerInferenceGrantRefused extends Error {
+    code;
+    constructor(code) {
+        super(`engine broker inference grant refused (${code})`);
+        this.code = code;
+    }
+}
+export class EngineBrokerControlClient {
+    socketPath;
+    constructor(socketPath = "/run/daimon-engine-broker/control.sock") {
+        this.socketPath = socketPath;
+    }
+    async ready() { const requestId = randomUUID(), socket = createConnection({ path: this.socketPath }), decoder = new EngineBrokerFrameDecoder(); await new Promise((resolve, reject) => { let settled = false; const fail = () => { if (settled)
+        return; settled = true; socket.destroy(); reject(new Error("engine broker unavailable")); }; socket.once("error", fail); socket.once("close", fail); socket.once("connect", () => socket.write(encodeEngineBrokerFrame({ version: ENGINE_BROKER_VERSION, kind: "health", requestId }))); socket.on("data", (chunk) => { try {
+        for (const value of decoder.push(chunk)) {
+            const response = parseEngineBrokerResponse(value);
+            if (response.kind !== "ready" || response.requestId !== requestId || settled)
+                throw new Error();
+            settled = true;
+            socket.destroy();
+            resolve();
+        }
+    }
+    catch {
+        fail();
+    } }); }); }
+    /**
+     * Evaluator side (organization uid only; the native relay enforces it):
+     * borrow the broker credential for one sequential lane of judge or optimizer
+     * requests. Refusals reject with {@link EngineBrokerInferenceGrantRefused};
+     * a broker that cannot answer rejects with `engine broker unavailable`.
+     */
+    async requestInferenceGrant(request) {
+        const response = await this.exchange({ version: ENGINE_BROKER_VERSION, kind: "request_inference_grant", requestId: randomUUID(), model: request.model, reasoningEffort: request.reasoningEffort, purpose: request.purpose });
+        if (response.kind === "inference_grant_refused")
+            throw new EngineBrokerInferenceGrantRefused(response.code);
+        if (response.kind !== "inference_grant" || response.model !== request.model || response.reasoningEffort !== request.reasoningEffort || response.purpose !== request.purpose)
+            throw new Error("engine broker unavailable");
+        const { version: _version, kind: _kind, requestId: _requestId, ...grant } = response;
+        return grant;
+    }
+    async releaseInferenceGrant(grantId) {
+        const response = await this.exchange({ version: ENGINE_BROKER_VERSION, kind: "release_inference_grant", requestId: randomUUID(), grantId });
+        if (response.kind === "inference_grant_refused")
+            throw new EngineBrokerInferenceGrantRefused(response.code);
+        if (response.kind !== "inference_grant_released" || response.grantId !== grantId)
+            throw new Error("engine broker unavailable");
+        return response.released;
+    }
+    exchange(request) { const socket = createConnection({ path: this.socketPath }), decoder = new EngineBrokerFrameDecoder(); return new Promise((resolve, reject) => { let settled = false; const fail = () => { if (settled)
+        return; settled = true; socket.destroy(); reject(new Error("engine broker unavailable")); }; socket.once("error", fail); socket.once("close", fail); socket.once("connect", () => socket.write(encodeEngineBrokerFrame(request))); socket.on("data", (chunk) => { try {
+        for (const value of decoder.push(chunk)) {
+            const response = parseEngineBrokerResponse(value);
+            if (settled || response.requestId !== request.requestId || (response.kind !== "inference_grant" && response.kind !== "inference_grant_released" && response.kind !== "inference_grant_refused"))
+                throw new Error();
+            settled = true;
+            socket.destroy();
+            resolve(response);
+        }
+    }
+    catch {
+        fail();
+    } }); }); }
+    async turn(agentId, wakeId, prompt, mcpEndpoint, signal, options = {}) {
+        const turnId = createHash("sha256").update(`${agentId}\0${wakeId}`).digest("hex"), requestId = randomUUID();
+        const request = { version: ENGINE_BROKER_VERSION, kind: "start_turn", requestId, turnId, agentId, wakeId, prompt, mcpEndpoint, ...(options.limits === undefined ? {} : { limits: options.limits }) };
+        const socket = createConnection({ path: this.socketPath });
+        const decoder = new EngineBrokerFrameDecoder();
+        return new Promise((resolve, reject) => {
+            let accepted = false, settled = false;
+            const fail = () => { if (settled)
+                return; settled = true; cleanup(); reject(new Error("engine broker unavailable")); };
+            const cleanup = () => { signal?.removeEventListener("abort", abort); socket.destroy(); };
+            const abort = () => fail();
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted)
+                return abort();
+            socket.once("connect", () => socket.write(encodeEngineBrokerFrame(request)));
+            socket.on("data", (chunk) => {
+                try {
+                    for (const value of decoder.push(chunk)) {
+                        const response = parseEngineBrokerResponse(value);
+                        if ((response.kind !== "accepted" && response.kind !== "completed" && response.kind !== "failed") || response.requestId !== requestId || response.turnId !== turnId)
+                            throw new Error();
+                        if (response.kind === "accepted") {
+                            if (accepted)
+                                throw new Error();
+                            accepted = true;
+                            continue;
+                        }
+                        if (!accepted || settled)
+                            throw new Error();
+                        settled = true;
+                        cleanup();
+                        if (options.model !== undefined && response.model !== options.model) {
+                            reject(new Error(`engine broker turn used model ${response.model}, not the declared ${options.model}`));
+                            return;
+                        }
+                        if (response.kind === "completed")
+                            resolve(response.text);
+                        else
+                            reject(new Error(`engine broker turn failed (${response.code}${response.limitReason === "none" ? "" : `; limit=${response.limitReason}`}${response.diagnostic ? `; ${response.diagnostic.stage}/${response.diagnostic.failureClass}; exit=${response.diagnostic.exitCode}; signal=${response.diagnostic.termSignal}${response.diagnostic.reason === undefined ? "" : `; reason=${response.diagnostic.reason}`}` : ""}${renderMcpCalls(response.mcpCalls)})`));
+                    }
+                }
+                catch {
+                    fail();
+                }
+            });
+            socket.once("error", fail);
+            socket.once("close", () => { if (!settled)
+                fail(); });
+        });
+    }
+}

package/dist/runtime/engineBrokerCredentialJournal.d.ts

@@ -0,0 +1,10 @@
+export type BrokerCredentialJournal = Readonly<{
+    version: "noopolis.daimon.broker-credential-journal.v1";
+    state: "refreshing" | "promoted" | "stale";
+    generation: number;
+    sourceDigest: string;
+    promotedDigest?: string;
+}>;
+export declare function parseBrokerCredentialJournal(value: unknown): BrokerCredentialJournal;
+export declare function recoverBrokerCredentialJournal(journal: BrokerCredentialJournal, authorityDigest: string): "ready" | "stale";
+//# sourceMappingURL=engineBrokerCredentialJournal.d.ts.map

package/dist/runtime/engineBrokerCredentialJournal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineBrokerCredentialJournal.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerCredentialJournal.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,8CAA8C,CAAC;IAAC,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAG3N,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAKpF;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAI3H"}

package/dist/runtime/engineBrokerCredentialJournal.js

@@ -0,0 +1,17 @@
+const DIGEST = /^[a-f0-9]{64}$/u;
+export function parseBrokerCredentialJournal(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("invalid credential journal");
+    const input = value;
+    const fields = input.state === "refreshing" ? ["version", "state", "generation", "sourceDigest"] : ["version", "state", "generation", "sourceDigest", "promotedDigest"];
+    if (Object.keys(input).length !== fields.length || fields.some((key) => !Object.hasOwn(input, key)) || input.version !== "noopolis.daimon.broker-credential-journal.v1" || !["refreshing", "promoted", "stale"].includes(String(input.state)) || !Number.isSafeInteger(input.generation) || input.generation < 0 || !DIGEST.test(String(input.sourceDigest)) || (input.state !== "refreshing" && !DIGEST.test(String(input.promotedDigest))))
+        throw new TypeError("invalid credential journal");
+    return input;
+}
+export function recoverBrokerCredentialJournal(journal, authorityDigest) {
+    if (journal.state === "stale")
+        return "stale";
+    if (journal.state === "refreshing")
+        return authorityDigest === journal.sourceDigest ? "ready" : "stale";
+    return authorityDigest === journal.promotedDigest ? "ready" : "stale";
+}

package/dist/runtime/engineBrokerInferenceProtocol.d.ts

@@ -0,0 +1,52 @@
+import type { EngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
+import type { GrokBrokerModel, GrokBrokerReasoningEffort } from "./grokBrokerModelPolicy.js";
+import type { GrokInferencePurpose } from "./inferenceUsageLedger.js";
+export declare const ENGINE_BROKER_INFERENCE_FAILURE_CODES: readonly ["auth_stale", "grant_limit", "invalid_request", "unavailable"];
+export type EngineBrokerInferenceFailureCode = (typeof ENGINE_BROKER_INFERENCE_FAILURE_CODES)[number];
+export declare const GROK_INFERENCE_PROXY_BASE_URL: "http://127.0.0.1:43123/v1";
+type V = "noopolis.daimon.engine-broker.v2";
+export type EngineBrokerInferenceRequest = Readonly<{
+    version: V;
+    kind: "request_inference_grant";
+    requestId: string;
+    model: GrokBrokerModel;
+    reasoningEffort: GrokBrokerReasoningEffort;
+    purpose: GrokInferencePurpose;
+}> | Readonly<{
+    version: V;
+    kind: "release_inference_grant";
+    requestId: string;
+    grantId: string;
+}>;
+export type EngineBrokerInferenceResponse = Readonly<{
+    version: V;
+    kind: "inference_grant";
+    requestId: string;
+    grantId: string;
+    token: string;
+    baseUrl: typeof GROK_INFERENCE_PROXY_BASE_URL;
+    model: GrokBrokerModel;
+    reasoningEffort: GrokBrokerReasoningEffort;
+    purpose: GrokInferencePurpose;
+    expiresAt: string;
+    limits: EngineBrokerTurnLimits;
+}> | Readonly<{
+    version: V;
+    kind: "inference_grant_released";
+    requestId: string;
+    grantId: string;
+    released: boolean;
+}> | Readonly<{
+    version: V;
+    kind: "inference_grant_refused";
+    requestId: string;
+    code: EngineBrokerInferenceFailureCode;
+}>;
+type JsonRecord = Record<string, unknown>;
+/** `input` has already passed the v2 envelope checks; `requestId` is the parsed id. */
+export declare function parseEngineBrokerInferenceRequest(input: JsonRecord, requestId: string, version: V): EngineBrokerInferenceRequest;
+export declare function parseEngineBrokerInferenceResponse(input: JsonRecord, requestId: string, version: V): EngineBrokerInferenceResponse;
+export declare const isEngineBrokerInferenceRequestKind: (kind: unknown) => boolean;
+export declare const isEngineBrokerInferenceResponseKind: (kind: unknown) => boolean;
+export {};
+//# sourceMappingURL=engineBrokerInferenceProtocol.d.ts.map

package/dist/runtime/engineBrokerInferenceProtocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineBrokerInferenceProtocol.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerInferenceProtocol.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAgBtE,eAAO,MAAM,qCAAqC,0EAAoB,CAAC;AACvE,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,qCAAqC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtG,eAAO,MAAM,6BAA6B,6BAAyG,CAAC;AAEpJ,KAAK,CAAC,GAAG,kCAAkC,CAAC;AAC5C,MAAM,MAAM,4BAA4B,GACpC,QAAQ,CAAC;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,yBAAyB,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC,GAC/K,QAAQ,CAAC;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAClG,MAAM,MAAM,6BAA6B,GACrC,QAAQ,CAAC;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,6BAA6B,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,yBAAyB,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC,GACzS,QAAQ,CAAC;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,GACjH,QAAQ,CAAC;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gCAAgC,CAAA;CAAE,CAAC,CAAC;AAEzH,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAO1C,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,4BAA4B,CAUhI;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,6BAA6B,CAoBlI;AAED,eAAO,MAAM,kCAAkC,GAAI,MAAM,OAAO,KAAG,OAAmF,CAAC;AACvJ,eAAO,MAAM,mCAAmC,GAAI,MAAM,OAAO,KAAG,OAAkH,CAAC"}

package/dist/runtime/engineBrokerInferenceProtocol.js

@@ -0,0 +1,65 @@
+import { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS } from "../contracts/grokWorkerContract.js";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+/**
+ * Evaluator inference grant frames, additive kinds of control protocol v2.
+ *
+ * Both ends ship in this package (the organization-side client and the broker
+ * service), so the kinds join v2 without a version bump; a broker that
+ * predates them refuses the unknown kind and closes the connection, which the
+ * client reports as `unavailable`. The native relay forwards frames opaquely
+ * and admits only the organization uid on `control.sock` (`SO_PEERCRED`), so
+ * that check is what limits grants to the evaluator side.
+ *
+ * The grant `token` is the bearer the evaluator's Grok CLI presents to the
+ * provider proxy (`env_key`). It never carries the broker credential.
+ */
+const SPEC = GROK_ENGINE_BROKER.inferenceGrants;
+export const ENGINE_BROKER_INFERENCE_FAILURE_CODES = SPEC.failureCodes;
+export const GROK_INFERENCE_PROXY_BASE_URL = `http://${GROK_ENGINE_BROKER.providerProxy.host}:${GROK_ENGINE_BROKER.providerProxy.port}/v1`;
+const invalid = () => new TypeError("invalid broker frame");
+const exact = (value, fields) => { if (Object.keys(value).length !== fields.length || fields.some((field) => !Object.hasOwn(value, field)))
+    throw invalid(); };
+const member = (list, value) => { if (!list.includes(value))
+    throw invalid(); return value; };
+const grantId = (value) => { if (typeof value !== "string" || !/^[a-f0-9]{32}$/u.test(value))
+    throw invalid(); return value; };
+const TOKEN = new RegExp(`^${SPEC.tokenPrefix}[A-Za-z0-9_-]{43}$`, "u");
+/** `input` has already passed the v2 envelope checks; `requestId` is the parsed id. */
+export function parseEngineBrokerInferenceRequest(input, requestId, version) {
+    if (input.kind === "request_inference_grant") {
+        exact(input, ["version", "kind", "requestId", "model", "reasoningEffort", "purpose"]);
+        return { version, kind: "request_inference_grant", requestId, model: member(GROK_BROKER_MODELS, input.model), reasoningEffort: member(GROK_BROKER_REASONING_EFFORTS, input.reasoningEffort), purpose: member(SPEC.purposes, input.purpose) };
+    }
+    if (input.kind === "release_inference_grant") {
+        exact(input, ["version", "kind", "requestId", "grantId"]);
+        return { version, kind: "release_inference_grant", requestId, grantId: grantId(input.grantId) };
+    }
+    throw invalid();
+}
+export function parseEngineBrokerInferenceResponse(input, requestId, version) {
+    if (input.kind === "inference_grant") {
+        exact(input, ["version", "kind", "requestId", "grantId", "token", "baseUrl", "model", "reasoningEffort", "purpose", "expiresAt", "limits"]);
+        if (typeof input.token !== "string" || !TOKEN.test(input.token) || input.baseUrl !== GROK_INFERENCE_PROXY_BASE_URL || typeof input.expiresAt !== "string" || Number.isNaN(Date.parse(input.expiresAt)) || new Date(input.expiresAt).toISOString() !== input.expiresAt)
+            throw invalid();
+        const limits = input.limits;
+        if (limits === null || typeof limits !== "object" || Array.isArray(limits))
+            throw invalid();
+        exact(limits, ["maxRequests", "maxTokens", "timeoutMs"]);
+        if (!(Number.isSafeInteger(limits.maxRequests) && limits.maxRequests >= 1 && limits.maxRequests <= SPEC.limits.maxRequests && Number.isSafeInteger(limits.maxTokens) && limits.maxTokens >= 1 && limits.maxTokens <= SPEC.limits.maxTokens && Number.isSafeInteger(limits.timeoutMs) && limits.timeoutMs >= 1 && limits.timeoutMs <= SPEC.ttlMs))
+            throw invalid();
+        return { version, kind: "inference_grant", requestId, grantId: grantId(input.grantId), token: input.token, baseUrl: GROK_INFERENCE_PROXY_BASE_URL, model: member(GROK_BROKER_MODELS, input.model), reasoningEffort: member(GROK_BROKER_REASONING_EFFORTS, input.reasoningEffort), purpose: member(SPEC.purposes, input.purpose), expiresAt: input.expiresAt, limits: { maxRequests: limits.maxRequests, maxTokens: limits.maxTokens, timeoutMs: limits.timeoutMs } };
+    }
+    if (input.kind === "inference_grant_released") {
+        exact(input, ["version", "kind", "requestId", "grantId", "released"]);
+        if (typeof input.released !== "boolean")
+            throw invalid();
+        return { version, kind: "inference_grant_released", requestId, grantId: grantId(input.grantId), released: input.released };
+    }
+    if (input.kind === "inference_grant_refused") {
+        exact(input, ["version", "kind", "requestId", "code"]);
+        return { version, kind: "inference_grant_refused", requestId, code: member(ENGINE_BROKER_INFERENCE_FAILURE_CODES, input.code) };
+    }
+    throw invalid();
+}
+export const isEngineBrokerInferenceRequestKind = (kind) => kind === "request_inference_grant" || kind === "release_inference_grant";
+export const isEngineBrokerInferenceResponseKind = (kind) => kind === "inference_grant" || kind === "inference_grant_released" || kind === "inference_grant_refused";