@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/engineReadiness.js

@@ -0,0 +1,222 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { cliChildEnvironment } from "../pi/cliEnvironment.js";
+import { hasRefreshablePortableCredential, portableCredentialSecretValues } from "./portableCredentialAuth.js";
+const MAX_AUTH_BYTES = 64 * 1024;
+const MAX_PROBE_BYTES = 8 * 1024;
+/**
+ * Resolves and pins the small, local authority needed by one CLI engine. This
+ * deliberately does not start an agent, contact a provider, or read a secret
+ * beyond the bounded structural authentication check.
+ */
+export async function prepareEngineReadiness(agent, runtimeHomePath, agyBusAddress) {
+    const executable = await prepareEngineExecutable(agent.id, agent.engine.kind);
+    const executablePath = executable.executablePath;
+    const engineHomePath = agent.engine.kind === "agy" ? runtimeHomePath : path.join(runtimeHomePath, engineHomeName(agent.engine.kind));
+    await verifyEngineAuth(agent.id, agent.engine.kind, engineHomePath, executablePath, runtimeHomePath, agyBusAddress);
+    return {
+        executablePath,
+        engineHomePath,
+        async verify() {
+            await executable.verify();
+            await verifyEngineAuth(agent.id, agent.engine.kind, engineHomePath, executablePath, runtimeHomePath, agyBusAddress);
+        }
+    };
+}
+export async function prepareEngineExecutable(agentId, engine) {
+    const executablePath = await resolveExecutable(agentId, engine);
+    const executableIdentity = identity(await stat(executablePath));
+    const capability = await probeExecutable(agentId, executablePath, engine);
+    return {
+        executablePath,
+        async verify() {
+            let current;
+            try {
+                const entry = await lstat(executablePath);
+                if (entry.isSymbolicLink())
+                    throw new Error("link");
+                current = await stat(executablePath);
+            }
+            catch {
+                throw unavailable(agentId, engine, "engine executable changed");
+            }
+            if (!sameIdentity(executableIdentity, identity(current)) || !current.isFile()) {
+                throw unavailable(agentId, engine, "engine executable changed");
+            }
+            if (await probeExecutable(agentId, executablePath, engine) !== capability) {
+                throw unavailable(agentId, engine, "engine capability changed");
+            }
+        }
+    };
+}
+export function engineHomeName(engine) {
+    return engine === "codex" ? ".codex" : ".grok";
+}
+export function engineAuthFile(_engine, engineHomePath) {
+    return path.join(engineHomePath, "auth.json");
+}
+async function resolveExecutable(agentId, engine) {
+    const sourcePath = process.env.PATH ?? "";
+    for (const directory of sourcePath.split(path.delimiter)) {
+        if (!directory || !path.isAbsolute(directory))
+            continue;
+        try {
+            const canonicalDirectory = await realpath(directory);
+            const directoryEntry = await lstat(canonicalDirectory);
+            if (!directoryEntry.isDirectory() || directoryEntry.isSymbolicLink() || (directoryEntry.mode & 0o022) !== 0)
+                continue;
+            const candidate = path.join(canonicalDirectory, engine);
+            const entry = await lstat(candidate);
+            if (!entry.isFile() && !entry.isSymbolicLink())
+                continue;
+            const canonical = await realpath(candidate);
+            const resolved = await lstat(canonical);
+            if (!resolved.isFile() || resolved.isSymbolicLink() || (resolved.mode & 0o111) === 0)
+                continue;
+            return canonical;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw unavailable(agentId, engine, "engine executable cannot be inspected");
+        }
+    }
+    throw unavailable(agentId, engine, "engine executable is unavailable");
+}
+async function probeExecutable(agentId, executablePath, engine) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(executablePath, ["--version"], { cwd: path.dirname(executablePath), env: { PATH: process.env.PATH ?? path.dirname(executablePath), LANG: "C", LC_ALL: "C" }, stdio: ["ignore", "pipe", "pipe"] });
+        let bytes = 0;
+        const output = [];
+        // Only stdout fingerprints the capability. stderr carries environment-dependent
+        // diagnostics -- allocator warnings under emulation, for one -- which are not a
+        // capability change but would otherwise invalidate the engine mid-run.
+        const consume = (chunk, capture) => { bytes += chunk.length; if (bytes > MAX_PROBE_BYTES)
+            child.kill("SIGKILL");
+        else if (capture)
+            output.push(chunk); };
+        child.stdout?.on("data", (chunk) => consume(chunk, true));
+        child.stderr?.on("data", (chunk) => consume(chunk, false));
+        const timer = setTimeout(() => child.kill("SIGKILL"), 3_000);
+        child.once("error", () => { clearTimeout(timer); reject(unavailable(agentId, engine, "engine capability probe failed")); });
+        child.once("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0 && bytes <= MAX_PROBE_BYTES)
+                resolve(createHash("sha256").update(Buffer.concat(output)).digest("hex"));
+            else
+                reject(unavailable(agentId, engine, "engine capability probe failed"));
+        });
+    });
+}
+async function verifyEngineAuth(agentId, engine, engineHomePath, executablePath, runtimeHomePath, agyBusAddress) {
+    if (engine === "agy") {
+        await verifyAgySubscriptionEnrollment(agentId, executablePath, runtimeHomePath, agyBusAddress);
+        return;
+    }
+    await verifyPortableEngineAuth(agentId, engine, engineHomePath);
+}
+async function verifyPortableEngineAuth(agentId, engine, engineHomePath) {
+    const authPath = engineAuthFile(engine, engineHomePath);
+    let handle;
+    let buffer;
+    try {
+        const home = await lstat(engineHomePath);
+        if (!home.isDirectory() || home.isSymbolicLink() || home.uid !== process.getuid?.() || (home.mode & 0o777) !== 0o700) {
+            throw new Error("unsafe engine home");
+        }
+        const entry = await lstat(authPath);
+        assertPrivateAuthEntry(entry);
+        handle = await open(authPath, constants.O_RDONLY | noFollow());
+        const opened = await handle.stat();
+        assertPrivateAuthEntry(opened);
+        if (!sameIdentity(identity(entry), identity(opened)))
+            throw new Error("auth artifact changed");
+        buffer = await handle.readFile();
+        const after = await handle.stat();
+        assertPrivateAuthEntry(after);
+        if (!sameIdentity(identity(opened), identity(after)))
+            throw new Error("auth artifact changed");
+        if (!hasRefreshablePortableCredential(engine, buffer))
+            throw new Error("unsupported auth artifact");
+    }
+    catch {
+        throw unavailable(agentId, engine, "subscription authentication is not ready; provision the supported local credential and retry");
+    }
+    finally {
+        buffer?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+}
+/** Securely rereads the currently staged provider credential for exact output redaction. */
+export async function readPortableEngineCredentialSecrets(agentId, engine, engineHomePath) {
+    const authPath = engineAuthFile(engine, engineHomePath);
+    let handle;
+    let buffer;
+    try {
+        const home = await lstat(engineHomePath);
+        if (!home.isDirectory() || home.isSymbolicLink() || home.uid !== process.getuid?.() || (home.mode & 0o777) !== 0o700)
+            throw new Error("unsafe");
+        const before = await lstat(authPath);
+        assertPrivateAuthEntry(before);
+        handle = await open(authPath, constants.O_RDONLY | noFollow());
+        const opened = await handle.stat();
+        assertPrivateAuthEntry(opened);
+        if (!sameIdentity(identity(before), identity(opened)))
+            throw new Error("changed");
+        buffer = await handle.readFile();
+        const after = await handle.stat();
+        assertPrivateAuthEntry(after);
+        if (!sameIdentity(identity(opened), identity(after)) || !hasRefreshablePortableCredential(engine, buffer))
+            throw new Error("changed");
+        return portableCredentialSecretValues(engine, buffer);
+    }
+    catch {
+        throw unavailable(agentId, engine, "subscription authentication is not ready");
+    }
+    finally {
+        buffer?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+}
+function assertPrivateAuthEntry(entry) {
+    if (!entry.isFile() || entry.isSymbolicLink() || Number(entry.uid) !== process.getuid?.()
+        || Number(entry.nlink) !== 1 || (Number(entry.mode) & 0o777) !== 0o600
+        || Number(entry.size) < 1 || Number(entry.size) > MAX_AUTH_BYTES) {
+        throw new Error("unsafe auth artifact");
+    }
+}
+export async function verifyAgySubscriptionEnrollment(agentId, executablePath, runtimeHomePath, busAddress) {
+    if (busAddress === undefined)
+        throw unavailable(agentId, "agy", "Daimon subscription realm is unavailable");
+    await new Promise((resolve, reject) => {
+        const child = spawn(executablePath, ["models"], {
+            cwd: runtimeHomePath,
+            env: cliChildEnvironment([], runtimeHomePath, {
+                dbusSessionBusAddress: busAddress,
+                engine: "agy",
+                executablePath,
+                engineHomePath: runtimeHomePath
+            }),
+            stdio: ["ignore", "ignore", "ignore"]
+        });
+        const timer = setTimeout(() => child.kill("SIGKILL"), 10_000);
+        child.once("error", () => { clearTimeout(timer); reject(unavailable(agentId, "agy", "native secure-storage authentication probe failed")); });
+        child.once("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(unavailable(agentId, "agy", "subscription enrollment is required; run the Daimon AGY bootstrap command"));
+        });
+    });
+}
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }
+function identity(value) {
+    const numeric = value;
+    return { dev: numeric.dev, ino: numeric.ino, size: numeric.size, mtimeMs: numeric.mtimeMs, mode: numeric.mode & 0o7777 };
+}
+function sameIdentity(left, right) { return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.mode === right.mode; }
+function unavailable(agentId, engine, detail) { return new Error(`agent ${agentId} ${engine} is unavailable: ${detail}`); }

package/dist/runtime/grokAuthenticationError.d.ts

@@ -0,0 +1,8 @@
+/** Classifies a bounded streaming diagnostic without retaining provider output. */
+export declare function classifyGrokAuthenticationDiagnostic(diagnostic: string): GrokSubscriptionAuthenticationRejectedError | undefined;
+/** Fixed-message marker used to stale-fence a rotating Grok credential realm. */
+export declare class GrokSubscriptionAuthenticationRejectedError extends Error {
+    constructor(cleanupFailure?: Error);
+}
+export declare function asGrokAuthenticationRejected(error: unknown): GrokSubscriptionAuthenticationRejectedError | undefined;
+//# sourceMappingURL=grokAuthenticationError.d.ts.map

package/dist/runtime/grokAuthenticationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokAuthenticationError.d.ts","sourceRoot":"","sources":["../../src/runtime/grokAuthenticationError.ts"],"names":[],"mappings":"AAEA,mFAAmF;AACnF,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,MAAM,GACjB,2CAA2C,GAAG,SAAS,CAIzD;AAED,iFAAiF;AACjF,qBAAa,2CAA4C,SAAQ,KAAK;gBACjD,cAAc,CAAC,EAAE,KAAK;CAO1C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,2CAA2C,GAAG,SAAS,CAIpH"}

package/dist/runtime/grokAuthenticationError.js

@@ -0,0 +1,20 @@
+const AUTH_REJECTION = /(?:Authentication rejected by server|Auth recovery exhausted|RefreshTokenRejected|Not signed in|Not logged in|NoRefresh|NoRecovery|PinnedTeamMismatch|ServerRejected)/iu;
+/** Classifies a bounded streaming diagnostic without retaining provider output. */
+export function classifyGrokAuthenticationDiagnostic(diagnostic) {
+    return AUTH_REJECTION.test(diagnostic)
+        ? new GrokSubscriptionAuthenticationRejectedError()
+        : undefined;
+}
+/** Fixed-message marker used to stale-fence a rotating Grok credential realm. */
+export class GrokSubscriptionAuthenticationRejectedError extends Error {
+    constructor(cleanupFailure) {
+        super("Grok subscription authentication was rejected; operator re-enrollment is required", cleanupFailure === undefined ? undefined : { cause: cleanupFailure });
+        this.name = "GrokSubscriptionAuthenticationRejectedError";
+    }
+}
+export function asGrokAuthenticationRejected(error) {
+    if (error instanceof GrokSubscriptionAuthenticationRejectedError)
+        return error;
+    const message = error instanceof Error ? error.message : String(error);
+    return classifyGrokAuthenticationDiagnostic(message);
+}

package/dist/runtime/grokBrokerCredentialAuthority.d.ts

@@ -0,0 +1,22 @@
+export declare class DurableGrokBrokerCredentialAuthority {
+    private readonly command;
+    private readonly home;
+    private readonly authFile;
+    private readonly flight;
+    private readonly fence;
+    private stale;
+    private initialized;
+    private staleWrite;
+    private lastDigest;
+    private generation;
+    constructor(command: string, home: string, authFile?: string);
+    initialize(): Promise<void>;
+    accessToken(forceRefresh: boolean): Promise<string>;
+    refreshAfterRejection(rejectedTokenDigest: string): Promise<string>;
+    private refresh;
+    markRejected(rejectedTokenDigest?: string): Promise<void>;
+    isStale(): boolean;
+    private markStale;
+    private write;
+}
+//# sourceMappingURL=grokBrokerCredentialAuthority.d.ts.map

package/dist/runtime/grokBrokerCredentialAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerCredentialAuthority.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialAuthority.ts"],"names":[],"mappings":"AAUA,qBAAa,oCAAoC;IAEnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADtG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAAC,OAAO,CAAC,KAAK,CAAS;IAAA,OAAO,CAAC,WAAW,CAAO;IAAA,OAAO,CAAC,UAAU,CAAyB;IAAA,OAAO,CAAC,UAAU,CAAkB;IAAA,OAAO,CAAC,UAAU,CAAG;gBACrP,OAAO,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM,EAAmB,QAAQ,SAA+B;IAC/H,UAAU,IAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,WAAW,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,qBAAqB,CAAC,mBAAmB,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC;IACvE,OAAO,CAAC,OAAO;IAOT,YAAY,CAAC,mBAAmB,CAAC,EAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,OAAO,IAAG,OAAO;IACjB,OAAO,CAAC,SAAS;YACH,KAAK;CAKpB"}

package/dist/runtime/grokBrokerCredentialAuthority.js

@@ -0,0 +1,124 @@
+import { randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { mkdir, open, rename, unlink } from "node:fs/promises";
+import path from "node:path";
+import { readGrokBrokerCredential } from "./grokBrokerCredentialReader.js";
+import { refreshGrokBrokerCredential } from "./grokBrokerRefresh.js";
+import { EngineBrokerGenerationFence, EngineBrokerSingleflight } from "./engineBrokerSingleflight.js";
+import { parseBrokerCredentialJournal, recoverBrokerCredentialJournal } from "./engineBrokerCredentialJournal.js";
+export class DurableGrokBrokerCredentialAuthority {
+    command;
+    home;
+    authFile;
+    flight = new EngineBrokerSingleflight();
+    fence = new EngineBrokerGenerationFence();
+    stale = false;
+    initialized = false;
+    staleWrite;
+    lastDigest;
+    generation = 0;
+    constructor(command, home, authFile = path.join(home, "auth.json")) {
+        this.command = command;
+        this.home = home;
+        this.authFile = authFile;
+    }
+    async initialize() { if (this.initialized)
+        return; const credential = await readGrokBrokerCredential(this.authFile); this.lastDigest = credential.digest; const file = path.join(this.home, ".daimon-broker", "credential-journal.json"); let handle; try {
+        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.size > 4096)
+            throw unavailable();
+        const journal = parseBrokerCredentialJournal(JSON.parse(await handle.readFile("utf8")));
+        if (recoverBrokerCredentialJournal(journal, credential.digest) === "stale") {
+            this.generation = journal.generation;
+            await this.markStale();
+            throw unavailable();
+        }
+        this.generation = journal.generation;
+        this.fence.restore(journal.generation);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw unavailable();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    } this.initialized = true; }
+    async accessToken(forceRefresh) {
+        if (!this.initialized)
+            await this.initialize();
+        if (this.stale)
+            throw unavailable();
+        if (!forceRefresh)
+            return (await readGrokBrokerCredential(this.authFile)).accessToken;
+        return this.refresh();
+    }
+    async refreshAfterRejection(rejectedTokenDigest) { if (!/^[a-f0-9]{64}$/u.test(rejectedTokenDigest))
+        throw unavailable(); return this.refresh(rejectedTokenDigest); }
+    refresh(rejectedTokenDigest) {
+        return this.flight.run(async () => {
+            if (this.stale)
+                throw unavailable();
+            const generation = this.fence.snapshot();
+            const before = await readGrokBrokerCredential(this.authFile);
+            if (rejectedTokenDigest !== undefined && createHash("sha256").update(before.accessToken).digest("hex") !== rejectedTokenDigest)
+                return before.accessToken;
+            try {
+                await this.write({ state: "refreshing", generation, sourceDigest: before.digest });
+                await refreshGrokBrokerCredential(this.command, this.home);
+                const after = await readGrokBrokerCredential(this.authFile);
+                if (after.digest === before.digest)
+                    throw unavailable();
+                const next = this.fence.promote(generation);
+                this.generation = next;
+                await this.write({ state: "promoted", generation: next, sourceDigest: before.digest, promotedDigest: after.digest });
+                this.lastDigest = after.digest;
+                return after.accessToken;
+            }
+            catch {
+                await this.markStale();
+                throw unavailable();
+            }
+        });
+    }
+    async markRejected(rejectedTokenDigest) { if (rejectedTokenDigest !== undefined) {
+        if (!/^[a-f0-9]{64}$/u.test(rejectedTokenDigest))
+            throw unavailable();
+        const current = await readGrokBrokerCredential(this.authFile);
+        if (createHash("sha256").update(current.accessToken).digest("hex") !== rejectedTokenDigest)
+            throw unavailable();
+    } if (!this.stale)
+        await this.markStale(); throw unavailable(); }
+    isStale() { return this.stale; }
+    markStale() { if (this.staleWrite)
+        return this.staleWrite; this.stale = true; this.fence.markStale(); return this.staleWrite = (async () => { const rejected = this.lastDigest ?? (await readGrokBrokerCredential(this.authFile)).digest; await this.write({ state: "stale", generation: this.generation, sourceDigest: rejected, promotedDigest: rejected }); })(); }
+    async write(value) {
+        const root = path.join(this.home, ".daimon-broker");
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const file = path.join(root, "credential-journal.json");
+        const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+        const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify({ version: "noopolis.daimon.broker-credential-journal.v1", ...value })}\n`);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            await rename(temporary, file);
+            const directory = await open(root, constants.O_RDONLY);
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+        finally {
+            await unlink(temporary).catch(() => undefined);
+        }
+    }
+}
+const unavailable = () => new Error("Grok broker credential authority unavailable");

package/dist/runtime/grokBrokerCredentialReader.d.ts

@@ -0,0 +1,5 @@
+export declare function readGrokBrokerCredential(file: string): Promise<Readonly<{
+    accessToken: string;
+    digest: string;
+}>>;
+//# sourceMappingURL=grokBrokerCredentialReader.d.ts.map

package/dist/runtime/grokBrokerCredentialReader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerCredentialReader.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialReader.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAUvH"}

package/dist/runtime/grokBrokerCredentialReader.js

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+export async function readGrokBrokerCredential(file) {
+    let handle;
+    let bytes;
+    try {
+        const before = await lstat(file);
+        assertFile(before);
+        handle = await open(file, constants.O_RDONLY | noFollow());
+        const opened = await handle.stat();
+        assertFile(opened);
+        if (before.dev !== opened.dev || before.ino !== opened.ino)
+            throw new Error();
+        bytes = await handle.readFile();
+        if (bytes.length > 64 * 1024)
+            throw new Error();
+        const after = await handle.stat();
+        if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs)
+            throw new Error();
+        const root = JSON.parse(bytes.toString("utf8"));
+        const rows = Object.values(root).filter((value) => value !== null && typeof value === "object" && !Array.isArray(value));
+        if (rows.length !== 1 || typeof rows[0].key !== "string" || rows[0].key.length < 32 || typeof rows[0].refresh_token !== "string" || rows[0].refresh_token.length < 16)
+            throw new Error();
+        return { accessToken: rows[0].key, digest: createHash("sha256").update(bytes).digest("hex") };
+    }
+    catch {
+        throw new Error("Grok broker credential authority unavailable");
+    }
+    finally {
+        bytes?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+}
+function assertFile(entry) { if (!entry.isFile() || entry.isSymbolicLink() || Number(entry.uid) !== process.getuid?.() || Number(entry.nlink) !== 1 || (Number(entry.mode) & 0o777) !== 0o600 || Number(entry.size) < 2 || Number(entry.size) > 64 * 1024)
+    throw new Error(); }
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }

package/dist/runtime/grokBrokerModelPolicy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The closed model and reasoning-effort vocabulary a Grok broker worker may be
+ * declared with.
+ *
+ * Both halves of one declaration are consumed from this single parser: the
+ * worker `config.toml` renderer (`grokBrokerWorkerConfig.ts`) writes them into
+ * the worker's only custom model, and the provider proxy
+ * (`grokBrokerProxyRequest.ts`) refuses any request body that does not carry
+ * exactly them. Nothing is inherited: Grok 1.0.34 silently drops an effort for
+ * a model that does not declare effort support, and its embedded catalog
+ * default for `grok-4.6` is `high`.
+ */
+import { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS } from "../contracts/grokWorkerContract.js";
+export { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS };
+export type GrokBrokerModel = (typeof GROK_BROKER_MODELS)[number];
+export type GrokBrokerReasoningEffort = (typeof GROK_BROKER_REASONING_EFFORTS)[number];
+export type GrokBrokerModelPolicy = Readonly<{
+    model: GrokBrokerModel;
+    reasoningEffort: GrokBrokerReasoningEffort;
+}>;
+export declare const DEFAULT_GROK_BROKER_MODEL_POLICY: GrokBrokerModelPolicy;
+export declare function parseGrokBrokerModelPolicy(value?: unknown): GrokBrokerModelPolicy;
+//# sourceMappingURL=grokBrokerModelPolicy.d.ts.map

package/dist/runtime/grokBrokerModelPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerModelPolicy.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerModelPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACvF,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,yBAAyB,CAAA;CAAE,CAAC,CAAC;AAErH,eAAO,MAAM,gCAAgC,EAAE,qBAAoF,CAAC;AAEpI,wBAAgB,0BAA0B,CAAC,KAAK,GAAE,OAAY,GAAG,qBAAqB,CAUrF"}

package/dist/runtime/grokBrokerModelPolicy.js

@@ -0,0 +1,28 @@
+/**
+ * The closed model and reasoning-effort vocabulary a Grok broker worker may be
+ * declared with.
+ *
+ * Both halves of one declaration are consumed from this single parser: the
+ * worker `config.toml` renderer (`grokBrokerWorkerConfig.ts`) writes them into
+ * the worker's only custom model, and the provider proxy
+ * (`grokBrokerProxyRequest.ts`) refuses any request body that does not carry
+ * exactly them. Nothing is inherited: Grok 1.0.34 silently drops an effort for
+ * a model that does not declare effort support, and its embedded catalog
+ * default for `grok-4.6` is `high`.
+ */
+import { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS } from "../contracts/grokWorkerContract.js";
+export { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS };
+export const DEFAULT_GROK_BROKER_MODEL_POLICY = Object.freeze({ model: "grok-4.6", reasoningEffort: "low" });
+export function parseGrokBrokerModelPolicy(value = {}) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("invalid Grok broker model policy");
+    const input = value;
+    if (Object.keys(input).some((key) => key !== "model" && key !== "reasoningEffort"))
+        throw new TypeError("invalid Grok broker model policy");
+    const model = input.model ?? DEFAULT_GROK_BROKER_MODEL_POLICY.model;
+    const reasoningEffort = input.reasoningEffort ?? DEFAULT_GROK_BROKER_MODEL_POLICY.reasoningEffort;
+    if (!GROK_BROKER_MODELS.includes(model) || !GROK_BROKER_REASONING_EFFORTS.includes(reasoningEffort)) {
+        throw new TypeError("invalid Grok broker model policy");
+    }
+    return Object.freeze({ model: model, reasoningEffort: reasoningEffort });
+}

package/dist/runtime/grokBrokerProjection.d.ts

@@ -0,0 +1,106 @@
+import { type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
+import { type EngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
+import type { GrokBrokerModel, GrokBrokerReasoningEffort } from "./grokBrokerModelPolicy.js";
+import { GROK_WORKER_SANDBOX_PROFILE } from "./grokWorkerSandboxProfile.js";
+export declare const GROK_BROKER_PROJECTION_VERSION: "noopolis.daimon.grok-broker-projection.v1";
+/**
+ * Everything a consumer (Spawnfile provisioning, Paideia's native adapter, the
+ * root slot supervisor) needs to know about one brokered Grok agent's slot,
+ * computed by Daimon from the same renderers and collectors the broker attests
+ * against. It never reads credentials, runs a worker, or touches the realm.
+ */
+export type OrganizationGrokBrokerProjection = Readonly<{
+    version: typeof GROK_BROKER_PROJECTION_VERSION;
+    agentId: string;
+    workspacePath: string;
+    runtimeHomePath: string;
+    workerUid: number;
+    slot: number;
+    profilePath: string;
+    profileSha256: string;
+    denyPaths: readonly string[];
+    workerConfigSha256: string;
+    systemPromptSha256: string;
+    grokCliVersion: string;
+    grokExecutableSha256: string;
+    nativeAbiVersion: number;
+    model: GrokBrokerModel;
+    reasoningEffort: GrokBrokerReasoningEffort;
+    limits: EngineBrokerTurnLimits;
+    usageLedgerPath: string;
+    /** The container seccomp profile the worker must run under (the pinned default-plus-userns profile bubblewrap needs). */
+    seccompProfileSha256: string;
+    attestation: Readonly<{
+        platform: "linux/landlock";
+        enforced: true;
+        restrictNetwork: true;
+        profileName: typeof GROK_WORKER_SANDBOX_PROFILE;
+        sandboxRuntime: "bubblewrap";
+        eventsPath: string;
+    }>;
+}>;
+export type OrganizationGrokBrokerProjectionOptions = Readonly<{
+    /** Deployment-assigned slot identity. */
+    slot: number;
+    workerUid: number;
+    /** The worker's home; its `GROK_HOME` is `<workerHomePath>/.grok`. */
+    workerHomePath: string;
+    architecture: "arm64" | "x64";
+    usageLedgerPath: string;
+    limits: EngineBrokerTurnLimits;
+    /**
+     * The deny entry that protects the durable wake-acceptance store: the store
+     * itself, or a directory containing it.
+     *
+     * Grok 1.0.34 materializes every deny target inside bubblewrap **as the
+     * worker uid**, so a target whose parent directory the worker cannot search
+     * is unplaceable and makes Grok refuse the whole profile — every turn of that
+     * worker then fails, not just that path. Deployments that keep the store
+     * under a private `state` directory (`2000:2000 0700`) therefore declare that
+     * directory here: it covers the store, nothing else lives there, and lifting
+     * the mask adds the worker no reach, where opening the parent with `o+x`
+     * would. The caller is the one party that knows both the layout and the
+     * modes; whoever recomputes this projection must pass the same value or the
+     * digests will not match, which is the intended fail-closed outcome.
+     */
+    acceptanceStorePath: string;
+    /** Evaluator and host-bind paths the deployment must keep from the worker (R4). */
+    denyPaths?: readonly string[];
+    /** sha256 of the seccomp profile bytes the deployment runs the worker under. */
+    seccompProfileSha256: string;
+    /** When the caller already holds a rendered profile digest, it must equal Daimon's. */
+    profileSha256?: string;
+}>;
+/**
+ * Resolve the public Grok broker projection for one agent.
+ *
+ * Paths are taken as given, never resolved: the caller (Spawnfile provisioning)
+ * must supply canonical, non-symlink paths — the fixed tmpfs/workspace roots it
+ * creates — and its provisioning must verify they are not symlinks before a
+ * slot is used; the broker's own attestation re-checks the worker home at
+ * every turn.
+ *
+ * Deterministic and I/O-free on purpose: its digest
+ * ({@link grokBrokerProjectionSha256}) is what the slot preflight receipt
+ * binds, so the supervisor that writes the receipt and the evaluator that reads
+ * it must compute byte-equal projections from the same inputs.
+ *
+ * The agent must be a Grok agent that *declares* its model and reasoning
+ * effort; nothing is defaulted. The deny list is Daimon's own protected set for
+ * this agent (realm, bootstrap, peers, and the mask covering the acceptance
+ * store) plus the caller's evaluator paths, sorted and deduplicated exactly as
+ * the profile renderer does. A supplied `profileSha256` that differs is
+ * refused.
+ */
+export declare function resolveOrganizationGrokBrokerProjection(config: unknown, agentId: string, options: OrganizationGrokBrokerProjectionOptions): OrganizationGrokBrokerProjection;
+/** sha256 over the projection's canonical JSON; what a slot preflight receipt binds. */
+export declare const grokBrokerProjectionSha256: (projection: OrganizationGrokBrokerProjection) => string;
+/** The `service.json` v2 registration a deployment provisions for this projection, validated by the broker's own parser. */
+export declare function grokBrokerServiceRegistrationFor(projection: OrganizationGrokBrokerProjection): Readonly<Record<string, unknown>>;
+/**
+ * Refuses a provisioned registration that does not describe this projection:
+ * any differing member — a weaker profile digest, another model, raised
+ * limits, a different ledger — is a mismatch, never a merge.
+ */
+export declare function verifyGrokBrokerRegistrationMatchesProjection(registration: EngineBrokerServiceRegistration, projection: OrganizationGrokBrokerProjection): void;
+//# sourceMappingURL=grokBrokerProjection.d.ts.map

package/dist/runtime/grokBrokerProjection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerProjection.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProjection.ts"],"names":[],"mappings":"AAOA,OAAO,EAAkC,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAA2F,MAAM,+BAA+B,CAAC;AAGrK,eAAO,MAAM,8BAA8B,6CAAuC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;QAAC,cAAc,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjM,CAAC,CAAC;AAEH,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,GAAG,gCAAgC,CA8B5K;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,GAAI,YAAY,gCAAgC,KAAG,MACpB,CAAC;AAEvE,4HAA4H;AAC5H,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQhI;AAED;;;;GAIG;AACH,wBAAgB,6CAA6C,CAAC,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,gCAAgC,GAAG,IAAI,CAG/J"}