@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/engineBrokerTurnRegistry.js

@@ -0,0 +1,158 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
+import path from "node:path";
+import { parseEngineBrokerResponse, parseEngineBrokerV1TerminalResponse } from "./engineBrokerProtocol.js";
+import { EMPTY_BROKER_TURN_LEDGER, parseBrokerTurnLedgerLines } from "./grokEngineBrokerLedger.js";
+export const ENGINE_BROKER_TURN_RECORD_V1 = "noopolis.daimon.engine-broker-turn.v1";
+export const ENGINE_BROKER_TURN_RECORD_V2 = "noopolis.daimon.engine-broker-turn.v2";
+// The digest deliberately excludes `limits` and the protocol version, so a v1
+// record written before the upgrade still identifies the same turn.
+const digest = (request) => createHash("sha256").update(JSON.stringify([request.turnId, request.agentId, request.wakeId, request.prompt, request.mcpEndpoint])).digest("hex");
+const safe = (turnId) => `${createHash("sha256").update(turnId).digest("hex")}.json`;
+/**
+ * Durable per-turn state. Record v2 stores the terminal response *with* its
+ * sealed accounting (usage, outcome, model, requests, limitReason), so a replay
+ * returns exactly what was metered and never meters again: metering happens
+ * only on the path that returned `"start"`.
+ */
+export class EngineBrokerTurnRegistry {
+    root;
+    bootId;
+    syncDirectoryOf;
+    /** `syncDirectoryOf` is injectable only so the post-publish failure path can be exercised under test. */
+    constructor(root, bootId = randomUUID(), syncDirectoryOf = syncDirectory) {
+        this.root = root;
+        this.bootId = bootId;
+        this.syncDirectoryOf = syncDirectoryOf;
+    }
+    /** `model` is the registration's declared model, used only to upgrade a v1 record on replay. */
+    async begin(request, model) {
+        await mkdir(this.root, { recursive: true, mode: 0o700 });
+        const file = path.join(this.root, safe(request.turnId));
+        const expected = digest(request);
+        try {
+            const handle = await open(file, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify({ version: ENGINE_BROKER_TURN_RECORD_V2, digest: expected, state: "active", bootId: this.bootId })}\n`);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await this.syncDirectoryOf(this.root);
+            return "start";
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw new Error("broker turn registry unavailable");
+        }
+        const observed = parseEngineBrokerTurnRecord(await readFile(file, "utf8"), model);
+        if (observed.digest !== expected)
+            throw new Error("broker turn conflict");
+        if (observed.state === "terminal" && observed.response !== undefined)
+            return { replay: observed.response, ledger: observed.ledger ?? EMPTY_BROKER_TURN_LEDGER };
+        if (observed.state === "active" && observed.bootId !== this.bootId) {
+            const response = { version: request.version, kind: "failed", requestId: request.requestId, turnId: request.turnId, code: "engine_failed", outcome: "failed", usage: null, model, requests: 0, limitReason: "none" };
+            await this.finish(request, response);
+            return { replay: response, ledger: EMPTY_BROKER_TURN_LEDGER };
+        }
+        throw new Error("broker turn already active");
+    }
+    /**
+     * `ledger` is the exact ledger bytes this turn owes, sealed with it so a replay can finish an interrupted append.
+     *
+     * The rename is the publish point. A failure before it rejects (nothing was
+     * published); a failure after it — the directory fsync — must not, because
+     * the terminal record is already the visible truth and a caller that saw a
+     * rejection would believe the turn unsealed and write a contradicting
+     * record over it. That durability gap is reported as `directorySynced: false`
+     * instead: the record is published but may not survive a power loss.
+     */
+    async finish(request, response, ledger = EMPTY_BROKER_TURN_LEDGER) {
+        const file = path.join(this.root, safe(request.turnId));
+        const temporary = `${file}.${randomUUID()}.tmp`;
+        const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify({ version: ENGINE_BROKER_TURN_RECORD_V2, digest: digest(request), state: "terminal", bootId: this.bootId, response, ledger })}\n`);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            await rename(temporary, file);
+        }
+        finally {
+            await unlink(temporary).catch(() => undefined);
+        }
+        try {
+            await this.syncDirectoryOf(this.root);
+            return { directorySynced: true };
+        }
+        catch {
+            return { directorySynced: false };
+        }
+    }
+}
+/**
+ * Strict record parser. v2 accepts exactly `{version,digest,state,bootId}`
+ * plus `response` and its sealed `ledger` bytes when terminal, and the response must be a v2 terminal frame.
+ * v1 records keep their historical looser shape and are upgraded on read: no
+ * usage (`null`), zero requests, `limitReason: "none"`, the declared model.
+ */
+export function parseEngineBrokerTurnRecord(text, model) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new Error("broker turn registry unavailable");
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new Error("broker turn registry unavailable");
+    const input = value;
+    if (typeof input.digest !== "string" || !/^[a-f0-9]{64}$/u.test(input.digest) || typeof input.bootId !== "string" || (input.state !== "active" && input.state !== "terminal"))
+        throw new Error("broker turn registry unavailable");
+    const base = { digest: input.digest, state: input.state, bootId: input.bootId };
+    if (input.version === ENGINE_BROKER_TURN_RECORD_V1) {
+        if (input.state !== "terminal" || input.response === undefined)
+            return { version: ENGINE_BROKER_TURN_RECORD_V1, ...base };
+        let legacy;
+        try {
+            legacy = parseEngineBrokerV1TerminalResponse(input.response);
+        }
+        catch {
+            throw new Error("broker turn registry unavailable");
+        }
+        const accounting = { outcome: legacy.kind, usage: null, model, requests: 0, limitReason: "none" };
+        const response = { ...legacy, ...accounting, version: "noopolis.daimon.engine-broker.v2" };
+        return { version: ENGINE_BROKER_TURN_RECORD_V1, ...base, response };
+    }
+    if (input.version !== ENGINE_BROKER_TURN_RECORD_V2)
+        throw new Error("broker turn conflict");
+    const fields = input.state === "terminal" ? ["version", "digest", "state", "bootId", "response", "ledger"] : ["version", "digest", "state", "bootId"];
+    if (Object.keys(input).length !== fields.length || fields.some((field) => !Object.hasOwn(input, field)))
+        throw new Error("broker turn registry unavailable");
+    if (input.state === "active")
+        return { version: ENGINE_BROKER_TURN_RECORD_V2, ...base };
+    let response;
+    try {
+        response = parseEngineBrokerResponse(input.response);
+    }
+    catch {
+        throw new Error("broker turn registry unavailable");
+    }
+    if (response.kind !== "completed" && response.kind !== "failed")
+        throw new Error("broker turn registry unavailable");
+    const ledger = parseBrokerTurnLedgerLines(input.ledger, response.turnId);
+    if ((response.usage === null) !== (ledger.usage === null))
+        throw new Error("broker turn registry unavailable");
+    return { version: ENGINE_BROKER_TURN_RECORD_V2, ...base, response, ledger };
+}
+async function syncDirectory(directory) { const handle = await open(directory, constants.O_RDONLY); try {
+    await handle.sync();
+}
+finally {
+    await handle.close();
+} }

package/dist/runtime/engineDispatcher.d.ts

@@ -0,0 +1,36 @@
+import { type AttentionRegistry } from "./attention.js";
+import type { AgentHandle } from "../core/types.js";
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+import type { OrganizationRuntimePathAuthority } from "./physicalReadiness.js";
+import type { EngineBrokerTurnClient } from "./engineBrokerControlClient.js";
+/**
+ * The production-only bridge from a closed runtime engine intent to Daimon's
+ * existing one-agent harness. Configuration never carries a command or env.
+ */
+export declare function startOrganizationRuntimeEngine(agent: OrganizationRuntimeAgentConfig, controlTokenEnv: string, paths?: ReturnType<OrganizationRuntimePathAuthority["forAgent"]>, agyBusAddress?: string, grokBroker?: EngineBrokerTurnClient, organizationAgents?: readonly OrganizationRuntimeAgentConfig[], sharedProtectedPaths?: readonly string[], attention?: AttentionRegistry): Promise<AgentHandle>;
+export declare function grokSandboxProtectedPaths(currentAgentId: string, organizationAgents: readonly OrganizationRuntimeAgentConfig[], sharedProtectedPaths?: readonly string[]): readonly string[];
+export declare function codexSandboxProtectedPaths(currentAgentId: string, currentAgent: OrganizationRuntimeAgentConfig, currentEngineHomePath: string, organizationAgents: readonly OrganizationRuntimeAgentConfig[], sharedProtectedPaths?: readonly string[]): readonly string[];
+export declare function codexSandboxReadablePaths(currentAgent: OrganizationRuntimeAgentConfig): readonly string[];
+/**
+ * CLI engines do not consume Pi's resource loader. Frame the same immutable
+ * identity in JSON so arbitrary names/instructions cannot change its shape.
+ */
+/**
+ * The caller-owned prompt preamble.
+ *
+ * It names the mounted tools explicitly, because a CLI engine reaches Daimon's
+ * tools over MCP and an agent whose instructions name another engine's tool
+ * spelling can finish a turn having called nothing. The declared names are the
+ * caller's own configuration, not engine-supplied text.
+ *
+ * On Grok the bare names are not the callable ones: every Daimon tool is a
+ * deferred MCP tool of server `daimon`, and Grok 1.0.34 refuses an unqualified
+ * name before any HTTP ("Tool names must be qualified as `server__tool`"). This
+ * envelope used to instruct exactly that refused form. The correct rule is not
+ * restated here — it is rendered by `grokMountedToolNamingRule` in the same
+ * contract module that renders the worker's pinned system prompt, so the two
+ * texts cannot contradict each other again. Every other engine's sentence is
+ * unchanged, byte for byte.
+ */
+export declare function identityEnvelope(agent: OrganizationRuntimeAgentConfig, mountedToolNames?: readonly string[]): string;
+//# sourceMappingURL=engineDispatcher.d.ts.map

package/dist/runtime/engineDispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineDispatcher.d.ts","sourceRoot":"","sources":["../../src/runtime/engineDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQpD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAM7E;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,8BAA8B,EACrC,eAAe,EAAE,MAAM,EACvB,KAAK,CAAC,EAAE,UAAU,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAC,EAChE,aAAa,CAAC,EAAE,MAAM,EACtB,UAAU,CAAC,EAAE,sBAAsB,EACnC,kBAAkB,CAAC,EAAE,SAAS,8BAA8B,EAAE,EAC9D,oBAAoB,GAAE,SAAS,MAAM,EAAO,EAC5C,SAAS,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA8CtB;AAED,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,oBAAoB,GAAE,SAAS,MAAM,EAAO,GAC3C,SAAS,MAAM,EAAE,CAYnB;AAED,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,8BAA8B,EAC5C,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,oBAAoB,GAAE,SAAS,MAAM,EAAO,GAC3C,SAAS,MAAM,EAAE,CAQnB;AAED,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,8BAA8B,GAC3C,SAAS,MAAM,EAAE,CAEnB;AAwDD;;;GAGG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAkBxH"}

package/dist/runtime/engineDispatcher.js

@@ -0,0 +1,216 @@
+import { attentionTools } from "./attention.js";
+import { grokDaimonToolName, grokMountedToolNamingRule } from "../contracts/grokWorkerContract.js";
+import path from "node:path";
+import { AGY_MAX_TOOL_TURNS, createCliSessionFactory, resolveCodexWakeTimeoutMs, resolveCodexWakeTokenCeiling, resolveEngineWakeLimitOverrides } from "../pi/cliSession.js";
+import { GROK_DAIMON_SANDBOX_PROFILE, prepareAndVerifyGrokSandbox } from "../pi/grokSandbox.js";
+import { PiHarnessAdapter } from "../pi/piHarness.js";
+import { engineAuthFile, engineHomeName, prepareEngineExecutable, prepareEngineReadiness, readPortableEngineCredentialSecrets } from "./engineReadiness.js";
+import { createProductionAgentTools } from "./productionAgentTools.js";
+import { AGY_SUBSCRIPTION_REALM, GROK_SUBSCRIPTION_REALM } from "./contractManifest.js";
+import { recordTurnUsage, resolveTurnUsageLedgerPath } from "./turnUsageLedger.js";
+import { recordCodexTurnRequests } from "./turnRequestLedger.js";
+/**
+ * The production-only bridge from a closed runtime engine intent to Daimon's
+ * existing one-agent harness. Configuration never carries a command or env.
+ */
+export async function startOrganizationRuntimeEngine(agent, controlTokenEnv, paths, agyBusAddress, grokBroker, organizationAgents, sharedProtectedPaths = [], attention) {
+    // A declared Grok model is enforced by the broker proxy and worker config;
+    // the direct path has neither, so it refuses rather than silently ignoring it.
+    if (agent.engine.kind === "grok" && agent.engine.model !== undefined && grokBroker === undefined)
+        throw new Error(`Agent ${agent.id} declares a Grok model, which requires the engine broker`);
+    await paths?.verify();
+    const canonicalAgent = paths === undefined ? agent : { ...agent, workspacePath: paths.workspacePath, runtimeHomePath: paths.runtimeHomePath };
+    const readiness = canonicalAgent.engine.kind === "grok" && grokBroker !== undefined
+        ? { ...(await prepareEngineExecutable(canonicalAgent.id, "grok")), engineHomePath: path.join(canonicalAgent.runtimeHomePath, engineHomeName("grok")) }
+        : await prepareEngineReadiness(canonicalAgent, canonicalAgent.runtimeHomePath, agyBusAddress);
+    const wakeContext = {};
+    const grokSandbox = canonicalAgent.engine.kind === "grok" && paths !== undefined && organizationAgents !== undefined
+        ? () => prepareAndVerifyGrokSandbox({
+            command: readiness.executablePath,
+            cwd: canonicalAgent.workspacePath,
+            engineHomePath: readiness.engineHomePath,
+            protectedPaths: grokSandboxProtectedPaths(canonicalAgent.id, organizationAgents, sharedProtectedPaths),
+            runtimeHomePath: canonicalAgent.runtimeHomePath
+        })
+        : undefined;
+    const codexSandboxPaths = canonicalAgent.engine.kind === "codex" && canonicalAgent.engine.codexSandbox !== undefined
+        ? {
+            protectedPaths: codexSandboxProtectedPaths(canonicalAgent.id, canonicalAgent, readiness.engineHomePath, organizationAgents ?? [canonicalAgent], sharedProtectedPaths),
+            readablePaths: codexSandboxReadablePaths(canonicalAgent)
+        }
+        : undefined;
+    const mountedTools = [...await createProductionAgentTools(canonicalAgent, wakeContext), ...(agent.attention !== undefined && attention !== undefined ? attentionTools(agent.id, attention) : [])];
+    const adapter = adapterFor(canonicalAgent, controlTokenEnv, readiness.verify, readiness.executablePath, readiness.engineHomePath, paths?.verify, agyBusAddress, mountedTools, wakeContext, grokSandbox, grokBroker, codexSandboxPaths, mountedTools.map((tool) => tool.name));
+    const handle = await adapter.startAgent({
+        id: canonicalAgent.id,
+        name: canonicalAgent.name,
+        instructions: canonicalAgent.instructions,
+        runtimeHomePath: canonicalAgent.runtimeHomePath,
+        workspacePath: canonicalAgent.workspacePath
+    });
+    await paths?.verify();
+    const result = {
+        ...handle,
+        async wake(event) {
+            await paths?.verify();
+            await readiness.verify();
+            try {
+                return await handle.wake(event);
+            }
+            finally {
+                await paths?.verify();
+                await readiness.verify();
+            }
+        },
+        async stop() { await handle.stop(); },
+        status: () => handle.status()
+    };
+    return result;
+}
+export function grokSandboxProtectedPaths(currentAgentId, organizationAgents, sharedProtectedPaths = []) {
+    return [
+        GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
+        GROK_SUBSCRIPTION_REALM.durableMountPath,
+        ...(organizationAgents.some((peer) => peer.engine.kind === "agy") ? [
+            AGY_SUBSCRIPTION_REALM.unlockMountPath,
+            AGY_SUBSCRIPTION_REALM.durableMountPath
+        ] : []),
+        ...sharedProtectedPaths,
+        ...organizationAgents.filter((peer) => peer.id !== currentAgentId)
+            .flatMap((peer) => [peer.runtimeHomePath, peer.workspacePath])
+    ];
+}
+export function codexSandboxProtectedPaths(currentAgentId, currentAgent, currentEngineHomePath, organizationAgents, sharedProtectedPaths = []) {
+    return [...new Set([
+            engineAuthFile("codex", currentEngineHomePath),
+            path.join(currentAgent.runtimeHomePath, ".daimon-inbound"),
+            "/proc",
+            "/run",
+            ...grokSandboxProtectedPaths(currentAgentId, organizationAgents, sharedProtectedPaths)
+        ])];
+}
+export function codexSandboxReadablePaths(currentAgent) {
+    return [path.join(currentAgent.runtimeHomePath, "tool-output")];
+}
+function adapterFor(agent, controlTokenEnv, verifyExecutable, executablePath, engineHomePath, verifyRuntimePaths, agyBusAddress, productionTools = [], wakeEnvironmentContext = {}, verifyGrokSandbox, grokBroker, codexSandboxPaths, mountedToolNames = []) {
+    const engine = agent.engine.kind;
+    const sessionFactory = createCliSessionFactory(engine === "agy"
+        ? { engine, maxToolTurns: AGY_MAX_TOOL_TURNS, timeoutMs: 180_000, dbusSessionBusAddress: agyBusAddress, redactedEnvironmentNames: [controlTokenEnv], identityPrompt: identityEnvelope(agent, mountedToolNames), command: executablePath, engineHomePath, verifyExecutable, verifyRuntimePaths,
+            // AGY has no broker to meter it, so the session hands its decoded
+            // terminal-frame usage straight to the same ledger the Grok broker
+            // appends to. `recordTurnUsage` is advisory and never rejects.
+            onTurnUsage: (usage, outcome) => recordTurnUsage(resolveTurnUsageLedgerPath(), { agent: agent.id, wake: wakeEnvironmentContext.current ?? "wake", engine: "agy", usage, outcome }) }
+        : { engine, redactedEnvironmentNames: [controlTokenEnv], identityPrompt: identityEnvelope(agent, mountedToolNames), command: executablePath, engineHomePath, verifyExecutable, verifyRuntimePaths,
+            ...(engine === "codex" ? {
+                // Codex has no broker to meter it, so publish terminal-frame usage
+                // to the shared advisory ledger — on the wake that published and on
+                // the wake that failed after Codex had already reported its spend.
+                onTurnUsage: (usage, outcome) => recordTurnUsage(resolveTurnUsageLedgerPath(), { agent: agent.id, wake: wakeEnvironmentContext.current ?? "wake", engine: "codex", usage, outcome }),
+                // Per-model-request accounting, written to its own stream beside the
+                // ledger. `engineHomePath` is the agent's `CODEX_HOME`
+                // (`../pi/cliEnvironment.ts`), so the rollout Codex just wrote for
+                // this thread is under it. Advisory throughout: it never fails a wake.
+                onCodexTurnRequests: (threadId) => recordCodexTurnRequests({ agent: agent.id, wake: wakeEnvironmentContext.current ?? "wake", codexHome: engineHomePath, threadId }).then(() => undefined),
+                // `maxToolTurns` mediates only daimon-MCP tool calls; Codex's own
+                // shell is never routed through it, so it gets its own wall-clock
+                // and per-wake token bounds instead (`cliSession.ts`).
+                timeoutMs: resolveCodexWakeTimeoutMs(),
+                codexTokenCeiling: resolveCodexWakeTokenCeiling(),
+                // Present only when the parsed config declared them; absent keeps
+                // today's unpinned Codex CLI default and today's exact argv.
+                ...(agent.engine.model === undefined ? {} : { model: agent.engine.model }),
+                ...(agent.engine.reasoningEffort === undefined ? {} : { reasoningEffort: agent.engine.reasoningEffort }),
+                ...(agent.engine.codexSandbox === undefined ? {} : { codexSandbox: agent.engine.codexSandbox }),
+                ...(codexSandboxPaths === undefined ? {} : {
+                    codexSandboxProtectedPaths: codexSandboxPaths.protectedPaths,
+                    codexSandboxReadablePaths: codexSandboxPaths.readablePaths
+                })
+            } : {}),
+            ...(engine === "grok" && grokBroker !== undefined ? {} : { credentialSecretValues: () => readPortableEngineCredentialSecrets(agent.id, engine, engineHomePath) }),
+            // The broker seals usage and enforces its registration's limits; the
+            // wake may only lower them (DAIMON_ENGINE_WAKE_*), and a declared model
+            // must be the one the broker reports it ran.
+            ...(engine === "grok" && grokBroker !== undefined ? { grokBrokerTurn: grokBrokerTurnFor(agent, grokBroker, wakeEnvironmentContext) } : {}),
+            ...(engine === "grok" && verifyGrokSandbox ? {
+                grokSandboxProfile: GROK_DAIMON_SANDBOX_PROFILE,
+                verifyGrokSandbox
+            } : {}) });
+    return cliHarness(agent, sessionFactory, [controlTokenEnv], productionTools, wakeEnvironmentContext);
+}
+function grokBrokerTurnFor(agent, grokBroker, wakeEnvironmentContext) {
+    const limits = resolveEngineWakeLimitOverrides();
+    const options = { ...(limits === undefined ? {} : { limits }), ...(agent.engine.model === undefined ? {} : { model: agent.engine.model }) };
+    return (prompt, endpoint, signal) => grokBroker.turn(agent.id, wakeEnvironmentContext.current ?? "wake", prompt, endpoint, signal, options);
+}
+/**
+ * CLI engines do not consume Pi's resource loader. Frame the same immutable
+ * identity in JSON so arbitrary names/instructions cannot change its shape.
+ */
+/**
+ * The caller-owned prompt preamble.
+ *
+ * It names the mounted tools explicitly, because a CLI engine reaches Daimon's
+ * tools over MCP and an agent whose instructions name another engine's tool
+ * spelling can finish a turn having called nothing. The declared names are the
+ * caller's own configuration, not engine-supplied text.
+ *
+ * On Grok the bare names are not the callable ones: every Daimon tool is a
+ * deferred MCP tool of server `daimon`, and Grok 1.0.34 refuses an unqualified
+ * name before any HTTP ("Tool names must be qualified as `server__tool`"). This
+ * envelope used to instruct exactly that refused form. The correct rule is not
+ * restated here — it is rendered by `grokMountedToolNamingRule` in the same
+ * contract module that renders the worker's pinned system prompt, so the two
+ * texts cannot contradict each other again. Every other engine's sentence is
+ * unchanged, byte for byte.
+ */
+export function identityEnvelope(agent, mountedToolNames = []) {
+    return [
+        "<daimon-agent-identity>",
+        JSON.stringify({ id: agent.id, name: agent.name, instructions: agent.instructions }),
+        "</daimon-agent-identity>",
+        ...(mountedToolNames.length === 0 ? [] : [
+            (agent.engine.kind === "grok"
+                ? grokMountedToolNamingRule(mountedToolNames)
+                : `Your mounted tools are exactly: ${mountedToolNames.join(", ")}. Call them by these names; `
+                    + "your instructions may spell them differently.")
+                + " No other tool reaches the newsroom."
+        ]),
+        // The one tool that reaches colleagues is named the way this engine can
+        // call it. Meaning and prohibition are unchanged; only the spelling is.
+        `Colleagues only hear you when you call ${engineToolName(agent, "moltnet_send")}; your terminal response is a private note to the runtime, not a message to anyone — keep it to one line or leave it empty. `
+            + "Do not seek transport credentials or invoke a transport CLI unless the caller explicitly mounted an authenticated transport tool.",
+        "The following is the current wake event."
+    ].join("\n") + "\n";
+}
+/**
+ * One Daimon tool name, spelled the way this agent's engine accepts it.
+ *
+ * On Grok the bare form is refused as an invalid MCP tool name, so any
+ * engine-facing sentence that *names* a tool renders it through the contract's
+ * `grokDaimonToolName`; every other engine keeps the bare name byte for byte.
+ * Grok's own native tools (`read_file`, `search_tool`, `use_tool`) are not
+ * Daimon tools and never take the prefix.
+ */
+const engineToolName = (agent, tool) => agent.engine.kind === "grok" ? grokDaimonToolName(tool) : tool;
+function cliHarness(agent, sessionFactory, protectedEnvironmentNames, productionTools, wakeEnvironmentContext) {
+    return new PiHarnessAdapter({
+        authPath: path.join(agent.runtimeHomePath, "auth.json"),
+        // Pi owns the harness envelope while the session factory owns this CLI.
+        model: {
+            auth: { method: "none" },
+            endpoint: { baseUrl: "http://127.0.0.1/daimon-cli", compatibility: "openai" },
+            name: "daimon-cli",
+            provider: "daimon-cli"
+        },
+        sessionFactory,
+        protectedEnvironmentNames,
+        productionTools,
+        ...(agent.engine.kind === "codex" && agent.engine.codexSandbox !== undefined ? { toolNames: [] } : {}),
+        wakeEnvironmentContext,
+        ...(agent.memory === undefined ? {} : { memory: {
+                runtimeHomePath: agent.memory.runtimeHomePath,
+                ...(agent.memory.source === undefined ? {} : { source: agent.memory.source }),
+                ...(agent.memory.tokenBudget === undefined ? {} : { tokenBudget: agent.memory.tokenBudget })
+            } })
+    });
+}

package/dist/runtime/engineReadiness.d.ts

@@ -0,0 +1,23 @@
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+export type EngineReadiness = Readonly<{
+    executablePath: string;
+    engineHomePath: string;
+    verify(): Promise<void>;
+}>;
+export type EngineExecutableReadiness = Readonly<{
+    executablePath: string;
+    verify(): Promise<void>;
+}>;
+/**
+ * Resolves and pins the small, local authority needed by one CLI engine. This
+ * deliberately does not start an agent, contact a provider, or read a secret
+ * beyond the bounded structural authentication check.
+ */
+export declare function prepareEngineReadiness(agent: OrganizationRuntimeAgentConfig, runtimeHomePath: string, agyBusAddress?: string): Promise<EngineReadiness>;
+export declare function prepareEngineExecutable(agentId: string, engine: "codex" | "grok" | "agy"): Promise<EngineExecutableReadiness>;
+export declare function engineHomeName(engine: "codex" | "grok"): string;
+export declare function engineAuthFile(_engine: "codex" | "grok", engineHomePath: string): string;
+/** Securely rereads the currently staged provider credential for exact output redaction. */
+export declare function readPortableEngineCredentialSecrets(agentId: string, engine: "codex" | "grok", engineHomePath: string): Promise<readonly string[]>;
+export declare function verifyAgySubscriptionEnrollment(agentId: string, executablePath: string, runtimeHomePath: string, busAddress: string | undefined): Promise<void>;
+//# sourceMappingURL=engineReadiness.d.ts.map

package/dist/runtime/engineReadiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineReadiness.d.ts","sourceRoot":"","sources":["../../src/runtime/engineReadiness.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAM/E,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC,CAAC;AAIH;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,8BAA8B,EACrC,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAC/B,OAAO,CAAC,yBAAyB,CAAC,CAqBpC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAExF;AAqFD,4FAA4F;AAC5F,wBAAsB,mCAAmC,CACvD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,MAAM,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAqB5B;AAUD,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAqBf"}