@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/grokInferenceProxyRequest.js

@@ -0,0 +1,63 @@
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
+const MAX_BODY = 2 * 1024 * 1024;
+const SPEC = GROK_ENGINE_BROKER.inferenceGrants;
+const BODY_MEMBERS = new Set(SPEC.bodyMembers);
+const ROLES = new Set(SPEC.messageRoles);
+const plain = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const rejected = () => new Error("inference grant request rejected");
+/**
+ * Authorizes one evaluator grant request body and rebuilds it for the provider.
+ *
+ * The accepted shape is exactly what Grok CLI 1.0.34 sends for a Paideia
+ * judge/optimizer call (`--tools read_file --disallowed-tools
+ * read_file,search_tool,use_tool --max-turns 1`, with and without
+ * `--system-prompt-override` and `--json-schema`; live stub capture):
+ *
+ * - `stream: true` with `stream_options: {include_usage: true}` — the CLI never
+ *   sends a non-streaming request, so none is accepted;
+ * - `model` and `reasoning_effort` equal to the grant's declaration;
+ * - `messages` of plain `{role, content}` string turns, roles system/user/assistant;
+ * - optional `response_format` `{type: "json_schema", json_schema: {name, schema, strict}}`;
+ * - no `tools` and no `tool_choice` member at all, not even an empty one. The
+ *   CLI's per-call `session_title` request carries both and is refused here.
+ *
+ * The client version must be the pinned CLI, and the forwarded body is the
+ * re-serialized parse, never the caller's bytes.
+ */
+export function authorizeGrokInferenceProxyRequest(input, bearer, policy) {
+    const declared = parseGrokBrokerModelPolicy(policy);
+    if (input.method !== "POST" || input.pathname !== "/v1/chat/completions" || input.body.byteLength < 2 || input.body.byteLength > MAX_BODY)
+        throw rejected();
+    if (!bearer || /[\r\n]/u.test(bearer))
+        throw new Error("broker credential authority unavailable");
+    const clientVersion = input.headers["x-grok-client-version"];
+    if (clientVersion !== GROK_ENGINE_BROKER.grokCliVersion)
+        throw rejected();
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(input.body).toString("utf8"), (key, value) => { if (key === "__proto__")
+            throw new Error(); return value; });
+    }
+    catch {
+        throw rejected();
+    }
+    if (!plain(parsed) || Object.keys(parsed).some((key) => !BODY_MEMBERS.has(key)))
+        throw rejected();
+    if (parsed.model !== declared.model || parsed.reasoning_effort !== declared.reasoningEffort || parsed.stream !== true)
+        throw rejected();
+    if (!plain(parsed.stream_options) || Object.keys(parsed.stream_options).length !== 1 || parsed.stream_options.include_usage !== true)
+        throw rejected();
+    if (!Array.isArray(parsed.messages) || parsed.messages.length === 0 || !parsed.messages.every(plainMessage))
+        throw rejected();
+    if (parsed.response_format !== undefined && !jsonSchemaFormat(parsed.response_format))
+        throw rejected();
+    return { url: "https://cli-chat-proxy.grok.com/v1/chat/completions", headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json", "x-xai-token-auth": "xai-grok-cli", "x-grok-model-override": declared.model, "x-grok-client-version": clientVersion, "x-grok-client-identifier": "grok-shell" }, body: Buffer.from(JSON.stringify(parsed)) };
+}
+const plainMessage = (message) => plain(message) && Object.keys(message).length === 2 && ROLES.has(message.role) && typeof message.content === "string";
+const jsonSchemaFormat = (value) => {
+    if (!plain(value) || Object.keys(value).length !== 2 || value.type !== "json_schema" || !plain(value.json_schema))
+        return false;
+    const schema = value.json_schema;
+    return Object.keys(schema).every((key) => key === "name" || key === "schema" || key === "strict") && typeof schema.name === "string" && plain(schema.schema) && (schema.strict === undefined || typeof schema.strict === "boolean");
+};

package/dist/runtime/grokSlotPreflightReceipt.d.ts

@@ -0,0 +1,70 @@
+import { z } from "zod";
+import { type OrganizationGrokBrokerProjection } from "./grokBrokerProjection.js";
+export declare const GROK_SLOT_PREFLIGHT_VERSION: "noopolis.daimon.grok-slot-preflight.v2";
+/**
+ * One denied-path canary: the root supervisor ran a real sandboxed read of
+ * `path` as the slot's worker uid (a stub-model turn under the attested
+ * profile) and the read was denied. Only denials are representable — a
+ * supervisor that observed a readable path writes no receipt at all.
+ */
+export declare const grokSlotPreflightCanarySchema: z.ZodObject<{
+    path: z.ZodString;
+    method: z.ZodLiteral<"sandboxed-read">;
+    result: z.ZodLiteral<"denied">;
+}, z.core.$strict>;
+/**
+ * `noopolis.daimon.grok-slot-preflight.v2`: what the root slot supervisor (P5)
+ * writes after provisioning or recycling one broker slot, and what an
+ * evaluator (Paideia, P4) must hold before it runs a Grok subject turn in that
+ * slot. It binds the slot to one exact projection by digest, so any change to
+ * the model, limits, deny list, profile, worker config, or pinned executable
+ * invalidates it.
+ *
+ * The projection digest is identical across recycles of the same slot, so v1
+ * could not tell this recycle's receipt from an earlier one. v2 adds
+ * freshness: `generation` is the supervisor-owned per-slot counter, strictly
+ * increasing on every provision/recycle, and `nonce` echoes the 32 random
+ * bytes (hex) the evaluator passed in its recycle request. A v1 receipt is
+ * refused.
+ */
+export declare const grokSlotPreflightReceiptSchema: z.ZodObject<{
+    version: z.ZodLiteral<"noopolis.daimon.grok-slot-preflight.v2">;
+    slot: z.ZodNumber;
+    worker_uid: z.ZodNumber;
+    generation: z.ZodNumber;
+    nonce: z.ZodString;
+    projection_sha256: z.ZodString;
+    sandbox_profile_sha256: z.ZodString;
+    seccomp_profile_sha256: z.ZodString;
+    sandbox_runtime: z.ZodLiteral<"bubblewrap">;
+    grok_executable_sha256: z.ZodString;
+    canaries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        method: z.ZodLiteral<"sandboxed-read">;
+        result: z.ZodLiteral<"denied">;
+    }, z.core.$strict>>;
+    created_at: z.ZodString;
+}, z.core.$strict>;
+export type GrokSlotPreflightReceipt = z.infer<typeof grokSlotPreflightReceiptSchema>;
+/** Strict parse: unknown members, off-contract values, or duplicate canaries throw. */
+export declare function parseGrokSlotPreflightReceipt(value: unknown): GrokSlotPreflightReceipt;
+/**
+ * What the evaluator knows about *this* recycle: the nonce it sent, and the
+ * lowest generation it will accept — one above the last generation it
+ * accepted for the slot (1 for a slot it has never seen).
+ */
+export type GrokSlotPreflightFreshness = Readonly<{
+    expectedNonce: string;
+    minGeneration: number;
+}>;
+/**
+ * Parse a receipt and require that it proves *this* projection's slot: same
+ * digest, slot, worker uid, profile and executable, and a denied canary for
+ * exactly every projected deny path (no more, no fewer), under the projected
+ * seccomp profile and sandbox runtime — and that it is *this* recycle's
+ * receipt: the caller's nonce, at or above the caller's minimum generation.
+ * A receipt replayed from an earlier recycle fails on the nonce, and one
+ * whose generation went backwards fails on the generation.
+ */
+export declare function verifyGrokSlotPreflightReceipt(value: unknown, projection: OrganizationGrokBrokerProjection, freshness: GrokSlotPreflightFreshness): GrokSlotPreflightReceipt;
+//# sourceMappingURL=grokSlotPreflightReceipt.d.ts.map

package/dist/runtime/grokSlotPreflightReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokSlotPreflightReceipt.d.ts","sourceRoot":"","sources":["../../src/runtime/grokSlotPreflightReceipt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA8B,KAAK,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE9G,eAAO,MAAM,2BAA2B,0CAA0C,CAAC;AAMnF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;kBAIxC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAqBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,uFAAuF;AACvF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAItF;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEpG;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,gCAAgC,EAAE,SAAS,EAAE,0BAA0B,GAAG,wBAAwB,CAgB5K"}

package/dist/runtime/grokSlotPreflightReceipt.js

@@ -0,0 +1,101 @@
+import path from "node:path";
+import { z } from "zod";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { grokBrokerProjectionSha256 } from "./grokBrokerProjection.js";
+export const GROK_SLOT_PREFLIGHT_VERSION = GROK_ENGINE_BROKER.slotPreflightVersion;
+const sha256 = z.string().regex(/^[a-f0-9]{64}$/u);
+const NONCE = /^[a-f0-9]{64}$/u;
+const canonicalAbsolute = z.string().max(4_096).refine((value) => path.posix.isAbsolute(value) && path.posix.normalize(value) === value && value !== "/" && !value.endsWith("/") && !value.includes("\0"), "canonical absolute path");
+/**
+ * One denied-path canary: the root supervisor ran a real sandboxed read of
+ * `path` as the slot's worker uid (a stub-model turn under the attested
+ * profile) and the read was denied. Only denials are representable — a
+ * supervisor that observed a readable path writes no receipt at all.
+ */
+export const grokSlotPreflightCanarySchema = z.strictObject({
+    path: canonicalAbsolute,
+    method: z.literal("sandboxed-read"),
+    result: z.literal("denied")
+});
+/**
+ * `noopolis.daimon.grok-slot-preflight.v2`: what the root slot supervisor (P5)
+ * writes after provisioning or recycling one broker slot, and what an
+ * evaluator (Paideia, P4) must hold before it runs a Grok subject turn in that
+ * slot. It binds the slot to one exact projection by digest, so any change to
+ * the model, limits, deny list, profile, worker config, or pinned executable
+ * invalidates it.
+ *
+ * The projection digest is identical across recycles of the same slot, so v1
+ * could not tell this recycle's receipt from an earlier one. v2 adds
+ * freshness: `generation` is the supervisor-owned per-slot counter, strictly
+ * increasing on every provision/recycle, and `nonce` echoes the 32 random
+ * bytes (hex) the evaluator passed in its recycle request. A v1 receipt is
+ * refused.
+ */
+export const grokSlotPreflightReceiptSchema = z.strictObject({
+    version: z.literal(GROK_SLOT_PREFLIGHT_VERSION),
+    slot: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    worker_uid: z.number().int().min(GROK_ENGINE_BROKER.identities.firstWorkerUid).max(4_294_967_294),
+    /** Supervisor-owned, strictly increasing per slot across provisions and recycles; starts at 1. */
+    generation: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+    /** The caller's recycle nonce: 32 random bytes, lowercase hex. */
+    nonce: z.string().regex(NONCE),
+    projection_sha256: sha256,
+    /** The bubblewrap/Landlock `daimon-strict` profile bytes' digest (the projection's `profileSha256`). */
+    sandbox_profile_sha256: sha256,
+    /** The container seccomp profile the worker ran under. */
+    seccomp_profile_sha256: sha256,
+    /** Grok 1.0.34 runs every profile inside bubblewrap; the supervisor observed it present and working. */
+    sandbox_runtime: z.literal("bubblewrap"),
+    grok_executable_sha256: sha256,
+    canaries: z.array(grokSlotPreflightCanarySchema).min(1).max(256),
+    created_at: z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u).refine((value) => !Number.isNaN(Date.parse(value)) && new Date(value).toISOString() === value, "exact RFC3339 timestamp")
+}).superRefine((receipt, context) => {
+    const paths = receipt.canaries.map((canary) => canary.path);
+    if (new Set(paths).size !== paths.length)
+        context.addIssue({ code: "custom", path: ["canaries"], message: "duplicate canary path" });
+});
+/** Strict parse: unknown members, off-contract values, or duplicate canaries throw. */
+export function parseGrokSlotPreflightReceipt(value) {
+    const result = grokSlotPreflightReceiptSchema.safeParse(value);
+    if (!result.success)
+        throw new TypeError(`invalid Grok slot preflight receipt: ${result.error.issues.map((issue) => `${issue.path.join(".") || "receipt"}: ${issue.message}`).join("; ")}`);
+    return result.data;
+}
+/**
+ * Parse a receipt and require that it proves *this* projection's slot: same
+ * digest, slot, worker uid, profile and executable, and a denied canary for
+ * exactly every projected deny path (no more, no fewer), under the projected
+ * seccomp profile and sandbox runtime — and that it is *this* recycle's
+ * receipt: the caller's nonce, at or above the caller's minimum generation.
+ * A receipt replayed from an earlier recycle fails on the nonce, and one
+ * whose generation went backwards fails on the generation.
+ */
+export function verifyGrokSlotPreflightReceipt(value, projection, freshness) {
+    if (freshness === null || typeof freshness !== "object" || typeof freshness.expectedNonce !== "string" || !NONCE.test(freshness.expectedNonce) || !Number.isSafeInteger(freshness.minGeneration) || freshness.minGeneration < 1)
+        throw new TypeError("invalid Grok slot preflight freshness");
+    const receipt = parseGrokSlotPreflightReceipt(value);
+    const mismatch = (member) => { throw new Error(`Grok slot preflight receipt does not match the projection: ${member}`); };
+    if (receipt.nonce !== freshness.expectedNonce)
+        throw new Error("Grok slot preflight receipt is stale: nonce");
+    if (receipt.generation < freshness.minGeneration)
+        throw new Error("Grok slot preflight receipt is stale: generation");
+    if (receipt.projection_sha256 !== grokBrokerProjectionSha256(projection))
+        mismatch("projection_sha256");
+    if (receipt.slot !== projection.slot)
+        mismatch("slot");
+    if (receipt.worker_uid !== projection.workerUid)
+        mismatch("worker_uid");
+    if (receipt.sandbox_profile_sha256 !== projection.profileSha256)
+        mismatch("sandbox_profile_sha256");
+    if (receipt.grok_executable_sha256 !== projection.grokExecutableSha256)
+        mismatch("grok_executable_sha256");
+    if (receipt.seccomp_profile_sha256 !== projection.seccompProfileSha256)
+        mismatch("seccomp_profile_sha256");
+    if (receipt.sandbox_runtime !== projection.attestation.sandboxRuntime)
+        mismatch("sandbox_runtime");
+    const denied = receipt.canaries.map((canary) => canary.path).sort();
+    if (denied.length !== projection.denyPaths.length || denied.some((entry, index) => entry !== projection.denyPaths[index]))
+        mismatch("canaries");
+    return receipt;
+}

package/dist/runtime/grokSubscriptionRealm.d.ts

@@ -0,0 +1,4 @@
+import type { GrokAgent, GrokSubscriptionRealm, GrokSubscriptionRealmOptions } from "./grokSubscriptionRealmTypes.js";
+export type { GrokSubscriptionRealm, GrokSubscriptionRealmOptions } from "./grokSubscriptionRealmTypes.js";
+export declare function startGrokSubscriptionRealm(configuredAgents: readonly GrokAgent[], options?: GrokSubscriptionRealmOptions): Promise<GrokSubscriptionRealm>;
+//# sourceMappingURL=grokSubscriptionRealm.d.ts.map

package/dist/runtime/grokSubscriptionRealm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokSubscriptionRealm.d.ts","sourceRoot":"","sources":["../../src/runtime/grokSubscriptionRealm.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,SAAS,EAET,qBAAqB,EACrB,4BAA4B,EAC7B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAO3G,wBAAsB,0BAA0B,CAC9C,gBAAgB,EAAE,SAAS,SAAS,EAAE,EACtC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAqChC"}