@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/grokWorkerAttestation.js

@@ -0,0 +1,266 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import path from "node:path";
+import { assertGrokWorkerDenyPathsPlaceable } from "./grokWorkerDenyPlacement.js";
+import { verifyGrokWorkerHome } from "./grokWorkerHomeAttestation.js";
+import { grokWorkerHomeForProfile, verifyGrokWorkerTmp } from "./grokWorkerTmpAttestation.js";
+import { grokWorkerEventsPathFor } from "./grokWorkerSandboxProfile.js";
+export class GrokWorkerAttestationFailure extends Error {
+    failureClass;
+    constructor(failureClass) {
+        super("Grok worker isolation attestation unavailable");
+        this.failureClass = failureClass;
+    }
+}
+/**
+ * Reads the `deny` list out of a worker sandbox profile, but only after the
+ * bytes match `profileSha256` exactly.
+ *
+ * There is no minimum length, and a populated list is supported. Grok 1.0.13
+ * refused to start on any non-empty `deny` (its mode-000 placeholders failed
+ * an EACCES "__GROK_INSIDE_BWRAP spoof" check), so deployments rendered
+ * `deny = []`. Grok 1.0.34 runs every profile inside bubblewrap and enforces a
+ * non-empty list, and since its strict base reads all of `/run`, `/var` and
+ * `/tmp`, the deny list is what keeps evaluator and host-bind paths away from
+ * the worker. `grokWorkerSandboxProfile.ts` renders these bytes.
+ *
+ * The integrity guarantee is the hash pin, not the length. `profileSha256`
+ * comes from `/etc/daimon-engine-broker/service.json`, which the root
+ * provisioning phase writes `0440 root:2100` with `flag: 'wx'` and computes
+ * from the same `profileFor()` bytes it writes to the profile; the broker
+ * reads that config as uid 2100 and cannot rewrite it. A weaker profile
+ * therefore cannot be attested: changing any byte — dropping
+ * `restrict_network`, swapping `extends = "strict"` for a permissive base,
+ * renaming the profile — changes the digest and fails here. And the deny list
+ * this returns is not merely parsed and discarded: it is carried into the
+ * snapshot and re-asserted against the kernel's own `ProfileApplied`
+ * `deny_paths` by `parseGrokWorkerProfileApplied`, which independently
+ * requires `enforced`, `restrict_network`, `platform === "linux/landlock"`
+ * and the exact workspace. A length floor would only have caught a Spawnfile
+ * rendering bug that produced a trivial profile *and* pinned it consistently
+ * — and Spawnfile's own tests pin the rendered bytes.
+ */
+export function parseGrokWorkerSandboxProfile(bytes, profileSha256) {
+    // Never copy the caller's bytes: `prepareGrokWorkerAttestation` zeroes the
+    // buffer it owns, and a private copy here would survive that.
+    const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (createHash("sha256").update(buffer).digest("hex") !== profileSha256)
+        throw new Error("Grok worker isolation attestation unavailable");
+    const line = buffer.toString("utf8").split("\n").find((entry) => entry.startsWith("deny = "));
+    let parsed;
+    try {
+        parsed = JSON.parse(line?.slice(7) ?? "null");
+    }
+    catch {
+        throw new Error("Grok worker isolation attestation unavailable");
+    }
+    if (!Array.isArray(parsed) || parsed.some((entry) => typeof entry !== "string") || new Set(parsed).size !== parsed.length)
+        throw new Error("Grok worker isolation attestation unavailable");
+    return [...parsed].sort();
+}
+/**
+ * Pre-launch half of the per-turn attestation. Besides the pinned profile and
+ * the events watermark it requires the 1.0.34 layout: events under
+ * `$GROK_HOME/sessions/` (the root `sandbox-events.jsonl` stays empty on
+ * 1.0.34), and a root-owned read-only worker home whose `config.toml` hashes to
+ * the declared renderer output (`grokWorkerHomeAttestation.ts`).
+ *
+ * It also refuses a deny list bubblewrap could not materialize
+ * (`grokWorkerDenyPlacement.ts`), naming the entry and the ancestor that stops
+ * it. Without this the worker dies with a bare `bwrap: Can't create file at
+ * …: Permission denied` on *every* turn, because one unplaceable entry makes
+ * Grok refuse the whole profile. The broker cannot descend into a directory
+ * opened to the worker's group alone (`<runtime home>/tool-state` under a
+ * `2000:<worker> 0710` home), so an `EACCES` there is left undecided; root
+ * provisioning, which holds `CAP_DAC_READ_SEARCH`, is the authority that
+ * decides every entry.
+ */
+export async function prepareGrokWorkerAttestation(input, profileOwner = { uid: 0, gid: 0 }) {
+    if (input.eventsPath !== grokWorkerEventsPathFor(input.profilePath))
+        throw new Error("Grok worker sandbox events must be read from $GROK_HOME/sessions/sandbox-events.jsonl");
+    const profile = await secureOpen(input.profilePath, profileOwner.uid, profileOwner.gid, 0o444, 65_536);
+    let bytes;
+    let denyPaths = [];
+    try {
+        bytes = await profile.readFile();
+        denyPaths = parseGrokWorkerSandboxProfile(bytes, input.profileSha256);
+    }
+    catch {
+        throw new Error("Grok worker isolation attestation unavailable");
+    }
+    finally {
+        bytes?.fill(0);
+        await profile.close();
+    }
+    // The launcher exports TMPDIR=<registered home>/tmp; the profile lives at <home>/.grok/sandbox.toml.
+    // Every registered worker's private temp is attested, not only this one's (a sibling's open temp is a shared channel).
+    await assertGrokWorkerDenyPathsPlaceable(denyPaths, { uid: input.workerUid, gid: input.workerGid ?? input.workerUid });
+    const workers = [{ profilePath: input.profilePath, workerUid: input.workerUid }, ...(input.registeredWorkers ?? [])].map((worker) => ({ home: grokWorkerHomeForProfile(worker.profilePath), uid: worker.workerUid }));
+    if (workers.some((worker) => worker.home === undefined))
+        throw new Error("Grok worker isolation attestation unavailable");
+    await verifyGrokWorkerTmp(workers, profileOwner.tmp);
+    await verifyGrokWorkerHome(path.dirname(input.profilePath), input.configSha256);
+    const events = await secureOpen(input.eventsPath, input.workerUid, input.brokerGid, 0o640, 16 * 1024 * 1024);
+    try {
+        const stat = await events.stat();
+        return { dev: Number(stat.dev), ino: Number(stat.ino), size: Number(stat.size), denyPaths };
+    }
+    finally {
+        await events.close();
+    }
+}
+/** The per-turn attestation input for one registration, carrying every registered worker so sibling temp is attested too. */
+export const grokBrokerAttestationInput = (registration, registrations, configSha256) => ({ ...registration, brokerGid: 2100, configSha256, registeredWorkers: registrations.map((entry) => ({ profilePath: entry.profilePath, workerUid: entry.workerUid })) });
+/**
+ * The per-turn isolation guard: every model request of a turn, and the
+ * post-turn check, go through the same lock.
+ *
+ * Why the first verification is trustworthy: the proxy awaits this guard before
+ * *every* upstream request, including the first, and the only worker-uid
+ * process that exists before request 1 is the Grok the launcher started under
+ * the pinned profile — tool children are created only after a model response.
+ * So the event accepted at request 1 was written before any tool child could
+ * write to the (worker-owned) events file. Later requests must find that exact
+ * line, byte for byte, at the same offset: a `ProfileApplied` appended later —
+ * which a tool child could forge — is never a substitute, and once a turn has
+ * been refused it stays refused.
+ */
+export function createGrokWorkerIsolationGuard(input, before) {
+    const lock = {};
+    return async () => {
+        if (lock.refused !== undefined)
+            throw new GrokWorkerAttestationFailure(lock.refused);
+        try {
+            await verifyGrokWorkerAttestation(input, before, lock);
+        }
+        catch (error) {
+            const failure = error instanceof GrokWorkerAttestationFailure ? error : new GrokWorkerAttestationFailure("profile_invalid");
+            lock.refused = failure.failureClass;
+            throw failure;
+        }
+    };
+}
+export async function verifyGrokWorkerAttestation(input, before, lock) {
+    let handle;
+    try {
+        handle = await secureOpen(input.eventsPath, input.workerUid, input.brokerGid, 0o640, 16 * 1024 * 1024);
+    }
+    catch {
+        throw new GrokWorkerAttestationFailure("profile_invalid");
+    }
+    let bytes;
+    try {
+        const stat = await handle.stat();
+        if (Number(stat.dev) !== before.dev || Number(stat.ino) !== before.ino)
+            throw new GrokWorkerAttestationFailure("profile_invalid");
+        if (Number(stat.size) <= before.size)
+            throw new GrokWorkerAttestationFailure("profile_missing");
+        const accepted = lock?.accepted;
+        const start = accepted === undefined ? before.size : before.size + accepted.offset;
+        const length = accepted === undefined ? Number(stat.size) - before.size : accepted.length;
+        if (start + length > Number(stat.size))
+            throw new GrokWorkerAttestationFailure("profile_invalid");
+        bytes = Buffer.alloc(length);
+        const read = await handle.read(bytes, 0, bytes.length, start);
+        if (read.bytesRead !== bytes.length)
+            throw new GrokWorkerAttestationFailure("profile_invalid");
+        // The file must not change while it is read: a concurrent writer could
+        // otherwise show this check bytes that no single state of the file held.
+        const after = await handle.stat();
+        if (Number(after.size) !== Number(stat.size) || Number(after.mtimeMs) !== Number(stat.mtimeMs))
+            throw new GrokWorkerAttestationFailure("profile_invalid");
+        if (accepted !== undefined) {
+            if (createHash("sha256").update(bytes).digest("hex") !== accepted.digest)
+                throw new GrokWorkerAttestationFailure("profile_invalid");
+            return;
+        }
+        const event = locateGrokWorkerProfileApplied(bytes, input.workspace, before.denyPaths);
+        if (lock !== undefined)
+            lock.accepted = { offset: event.offset, length: event.length, digest: createHash("sha256").update(bytes.subarray(event.offset, event.offset + event.length)).digest("hex") };
+    }
+    catch (error) {
+        if (error instanceof GrokWorkerAttestationFailure)
+            throw error;
+        throw new GrokWorkerAttestationFailure("profile_invalid");
+    }
+    finally {
+        bytes?.fill(0);
+        await handle.close();
+    }
+}
+/**
+ * Requires one fully-conforming `ProfileApplied` event *somewhere* in the
+ * fresh region — not as its last line.
+ *
+ * `sandbox-events.jsonl` is not a profile log. Grok (1.0.13 and 1.0.34) writes its whole
+ * sandbox event vocabulary there — verified by reading the shipped binary:
+ * `ProfileApplied, ApplyFailed, FsViolation, NetViolation, BypassGranted,
+ * BypassDenied` (one contiguous enum blob beside the record fields
+ * `timestamp, event_type, read_only_paths, deny_paths, operation, target,
+ * command, tool_call_id`, emitted from `xai_grok_sandbox::logging`), and its
+ * own embedded documentation says so outright: "Sandbox events (profile
+ * applied, violations) are logged to `~/.grok/sandbox-events.jsonl`" (1.0.34
+ * moved the file to `~/.grok/sessions/`; a 1.0.34 turn logs `ProfileApplied`
+ * followed by an `FsViolation` for every denied read).
+ *
+ * Requiring `ProfileApplied` to be the *last* line therefore failed on the
+ * first denied access of any turn: the violation Grok logged next became the
+ * last line, this threw, the proxy's per-request isolation guard refused, and
+ * the turn died `profile_invalid`. Denials are the normal operating state of
+ * a working sandbox, so that check turned the sandbox doing its job into a
+ * turn failure.
+ *
+ * Scanning the region is not weaker. The region is fresh by construction —
+ * the caller reads only bytes above the pre-launch dev/ino/size watermark, so
+ * nothing here predates this turn and a stale or replayed event below it is
+ * unreachable. Both forms are equally forgeable by the same single actor (a
+ * worker-uid process, which can only exist by being a Grok that the launcher
+ * already started under the pinned profile), and both detect the failure this
+ * guard exists for: a Grok that came up without kernel enforcement, which
+ * emits no conforming `ProfileApplied` at all.
+ */
+export function parseGrokWorkerProfileApplied(bytes, workspace, denyPaths = []) { locateGrokWorkerProfileApplied(bytes, workspace, denyPaths); }
+/** Byte range (within `bytes`) of the first fully-conforming `ProfileApplied` line. */
+export function locateGrokWorkerProfileApplied(bytes, workspace, denyPaths = []) {
+    const expected = JSON.stringify([...denyPaths].sort());
+    const buffer = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    for (let offset = 0; offset < buffer.length;) {
+        const newline = buffer.indexOf(0x0a, offset);
+        const end = newline === -1 ? buffer.length : newline;
+        const line = buffer.subarray(offset, end).toString("utf8");
+        const lineOffset = offset;
+        offset = end + 1;
+        if (line.trim() === "")
+            continue;
+        let event;
+        try {
+            const parsed = JSON.parse(line);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+                continue;
+            event = parsed;
+        }
+        catch {
+            continue;
+        }
+        if (event.event_type !== "ProfileApplied")
+            continue;
+        const observed = Array.isArray(event.deny_paths) ? event.deny_paths.filter((entry) => typeof entry === "string").sort() : [];
+        if (event.profile === "daimon-strict" && event.enforced === true && event.restrict_network === true && event.platform === "linux/landlock" && event.workspace === workspace && JSON.stringify(observed) === expected)
+            return { offset: lineOffset, length: end - lineOffset };
+    }
+    throw new Error("Grok worker isolation attestation unavailable");
+}
+async function secureOpen(file, uid, gid, mode, max, links = 1) { try {
+    const before = await lstat(file);
+    const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.isSymbolicLink() || Number(stat.uid) !== uid || Number(stat.gid) !== gid || (Number(stat.mode) & 0o777) !== mode || Number(stat.nlink) !== links || Number(stat.size) > max || before.dev !== stat.dev || before.ino !== stat.ino) {
+        await handle.close();
+        throw new Error();
+    }
+    return handle;
+}
+catch {
+    throw new Error("Grok worker isolation attestation unavailable");
+} }

package/dist/runtime/grokWorkerDenyPlacement.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Paths Grok 1.0.34's strict base profile grants read or read-write. A `deny`
+ * entry that equals or contains one of them makes Grok refuse the profile
+ * outright (verified for `/tmp`, `/var/tmp`, `/run`, `/etc`, `/var` and
+ * `sessions`; `/tmp/sub` is accepted), so every entry must sit strictly below
+ * each grant it touches.
+ */
+export declare const GROK_WORKER_BASE_PROFILE_GRANTS: readonly ["/bin", "/dev", "/etc", "/lib", "/proc", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var", "/var/tmp"];
+export declare class GrokWorkerDenyPlacementError extends Error {
+    readonly denyPath: string;
+    readonly reason: string;
+    constructor(denyPath: string, reason: string);
+}
+/**
+ * The shape half of the deny-placement policy: everything decidable without
+ * touching a filesystem, so the profile renderer can refuse a bad entry before
+ * its bytes are ever pinned or written.
+ *
+ * `renderGrokWorkerSandboxProfile` already refuses entries that are relative,
+ * non-canonical, `/`, trailing-slashed, or carrying a character TOML or Grok
+ * would reinterpret; this adds the base-profile grant rule.
+ */
+export declare function assertGrokWorkerDenyPathShape(denyPath: string): void;
+/** The subset of `lstat` the placement rules read; pure so every refusal is testable without root. */
+export type GrokWorkerDenyPathEntry = Readonly<{
+    uid: number;
+    gid: number;
+    mode: number;
+    isDirectory: () => boolean;
+    isSymbolicLink: () => boolean;
+}>;
+/** One resolved path component: the entry, or the errno that stopped the walk. */
+export type GrokWorkerDenyPathStep = Readonly<{
+    path: string;
+    entry?: GrokWorkerDenyPathEntry;
+    code?: string;
+}>;
+export type GrokWorkerDenyPathWorker = Readonly<{
+    uid: number;
+    gid: number;
+}>;
+/**
+ * POSIX search permission: owner bits win, then group, then other. The worker
+ * runs with its supplementary groups cleared, so its primary gid is the only
+ * group that can apply.
+ */
+export declare const grokWorkerCanSearch: (entry: GrokWorkerDenyPathEntry, worker: GrokWorkerDenyPathWorker) => boolean;
+/** The `/`-rooted ancestor chain of `denyPath`, deepest last, followed by the entry itself. */
+export declare const grokWorkerDenyPathChain: (denyPath: string) => readonly string[];
+/**
+ * The placement half of the policy, as a pure function of an already-walked
+ * chain.
+ *
+ * Grok 1.0.34 materializes every `deny` entry inside bubblewrap **as the worker
+ * uid**, by bind-mounting `$GROK_HOME/sandbox-blocked-{file,dir}` over the
+ * target. So bwrap must be able to *resolve* the target as that uid: every
+ * ancestor directory needs the search bit for it, and the target must already
+ * exist — otherwise bwrap tries to create it and needs write on the parent,
+ * which a private parent never grants. A single unplaceable entry makes Grok
+ * refuse the whole profile, so every turn of that worker fails, not just that
+ * path. Verified matrix: `.runtime/grok-deny-placement/EVIDENCE.md`.
+ *
+ * The walk may legitimately stop early: a caller that is neither root nor the
+ * worker (the broker, uid 2100) cannot descend into a directory the worker's
+ * own group opens to it alone — `<runtime home>/tool-state` under a
+ * `2000:<worker> 0710` runtime home is exactly that. An `EACCES` below an
+ * ancestor the *worker* can search is therefore "not decidable from here", not
+ * a refusal; every decidable failure still refuses.
+ */
+export declare function assertGrokWorkerDenyPathPlacement(denyPath: string, steps: readonly GrokWorkerDenyPathStep[], worker: GrokWorkerDenyPathWorker): void;
+/** Walks one deny path on the real filesystem, recording what stopped it rather than throwing. */
+export declare function readGrokWorkerDenyPathChain(denyPath: string): Promise<readonly GrokWorkerDenyPathStep[]>;
+/**
+ * Fails closed before a worker is ever launched with a profile Grok would
+ * refuse. Callers with the widest view run it: root provisioning at container
+ * start and on every slot recycle, and the direct (non-broker) path, which runs
+ * as the worker uid itself.
+ */
+export declare function assertGrokWorkerDenyPathsPlaceable(denyPaths: readonly string[], worker: GrokWorkerDenyPathWorker): Promise<void>;
+//# sourceMappingURL=grokWorkerDenyPlacement.d.ts.map

package/dist/runtime/grokWorkerDenyPlacement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerDenyPlacement.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerDenyPlacement.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,iHAEjC,CAAC;AAIZ,qBAAa,4BAA6B,SAAQ,KAAK;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAzC,QAAQ,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAI/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAKpE;AAED,sGAAsG;AACtG,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,cAAc,EAAE,MAAM,OAAO,CAAC;CAC/B,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,uBAAuB,EAAE,QAAQ,wBAAwB,KAAG,OAGrE,CAAC;AAEnC,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,SAAS,MAAM,EAGzE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,sBAAsB,EAAE,EACxC,MAAM,EAAE,wBAAwB,GAC/B,IAAI,CAqBN;AAED,kGAAkG;AAClG,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAa9G;AAED;;;;;GAKG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/runtime/grokWorkerDenyPlacement.js

@@ -0,0 +1,128 @@
+import { lstat } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Paths Grok 1.0.34's strict base profile grants read or read-write. A `deny`
+ * entry that equals or contains one of them makes Grok refuse the profile
+ * outright (verified for `/tmp`, `/var/tmp`, `/run`, `/etc`, `/var` and
+ * `sessions`; `/tmp/sub` is accepted), so every entry must sit strictly below
+ * each grant it touches.
+ */
+export const GROK_WORKER_BASE_PROFILE_GRANTS = Object.freeze([
+    "/bin", "/dev", "/etc", "/lib", "/proc", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var", "/var/tmp"
+]);
+const within = (candidate, root) => candidate === root || candidate.startsWith(`${root}/`);
+export class GrokWorkerDenyPlacementError extends Error {
+    denyPath;
+    reason;
+    constructor(denyPath, reason) {
+        super(`Grok worker sandbox deny path ${JSON.stringify(denyPath)} is not placeable: ${reason}`);
+        this.denyPath = denyPath;
+        this.reason = reason;
+        this.name = "GrokWorkerDenyPlacementError";
+    }
+}
+/**
+ * The shape half of the deny-placement policy: everything decidable without
+ * touching a filesystem, so the profile renderer can refuse a bad entry before
+ * its bytes are ever pinned or written.
+ *
+ * `renderGrokWorkerSandboxProfile` already refuses entries that are relative,
+ * non-canonical, `/`, trailing-slashed, or carrying a character TOML or Grok
+ * would reinterpret; this adds the base-profile grant rule.
+ */
+export function assertGrokWorkerDenyPathShape(denyPath) {
+    const grant = GROK_WORKER_BASE_PROFILE_GRANTS.find((candidate) => within(candidate, denyPath));
+    if (grant !== undefined) {
+        throw new GrokWorkerDenyPlacementError(denyPath, `it equals or contains the base profile grant ${grant}, which Grok refuses`);
+    }
+}
+/**
+ * POSIX search permission: owner bits win, then group, then other. The worker
+ * runs with its supplementary groups cleared, so its primary gid is the only
+ * group that can apply.
+ */
+export const grokWorkerCanSearch = (entry, worker) => entry.uid === worker.uid ? (entry.mode & 0o100) !== 0
+    : entry.gid === worker.gid ? (entry.mode & 0o010) !== 0
+        : (entry.mode & 0o001) !== 0;
+/** The `/`-rooted ancestor chain of `denyPath`, deepest last, followed by the entry itself. */
+export const grokWorkerDenyPathChain = (denyPath) => {
+    const components = denyPath.split("/").slice(1);
+    return ["/", ...components.map((_, index) => `/${components.slice(0, index + 1).join("/")}`)];
+};
+/**
+ * The placement half of the policy, as a pure function of an already-walked
+ * chain.
+ *
+ * Grok 1.0.34 materializes every `deny` entry inside bubblewrap **as the worker
+ * uid**, by bind-mounting `$GROK_HOME/sandbox-blocked-{file,dir}` over the
+ * target. So bwrap must be able to *resolve* the target as that uid: every
+ * ancestor directory needs the search bit for it, and the target must already
+ * exist — otherwise bwrap tries to create it and needs write on the parent,
+ * which a private parent never grants. A single unplaceable entry makes Grok
+ * refuse the whole profile, so every turn of that worker fails, not just that
+ * path. Verified matrix: `.runtime/grok-deny-placement/EVIDENCE.md`.
+ *
+ * The walk may legitimately stop early: a caller that is neither root nor the
+ * worker (the broker, uid 2100) cannot descend into a directory the worker's
+ * own group opens to it alone — `<runtime home>/tool-state` under a
+ * `2000:<worker> 0710` runtime home is exactly that. An `EACCES` below an
+ * ancestor the *worker* can search is therefore "not decidable from here", not
+ * a refusal; every decidable failure still refuses.
+ */
+export function assertGrokWorkerDenyPathPlacement(denyPath, steps, worker) {
+    assertGrokWorkerDenyPathShape(denyPath);
+    const chain = grokWorkerDenyPathChain(denyPath);
+    if (steps.length !== chain.length || steps.some((step, index) => step.path !== chain[index])) {
+        throw new GrokWorkerDenyPlacementError(denyPath, "its resolved path chain does not match the entry");
+    }
+    for (const [index, step] of steps.entries()) {
+        const ancestor = index < steps.length - 1;
+        if (step.entry === undefined) {
+            if (step.code === "ENOENT")
+                throw new GrokWorkerDenyPlacementError(denyPath, `${step.path} does not exist; bubblewrap would have to create it as the worker uid`);
+            if (step.code !== "EACCES")
+                throw new GrokWorkerDenyPlacementError(denyPath, `${step.path} could not be read (${step.code ?? "unknown error"})`);
+            // Undecidable from here, and only after every shallower ancestor passed.
+            return;
+        }
+        if (step.entry.isSymbolicLink())
+            throw new GrokWorkerDenyPlacementError(denyPath, `${step.path} is a symlink; bubblewrap refuses to bind over one`);
+        if (!ancestor)
+            return;
+        if (!step.entry.isDirectory())
+            throw new GrokWorkerDenyPlacementError(denyPath, `${step.path} is not a directory`);
+        if (!grokWorkerCanSearch(step.entry, worker)) {
+            throw new GrokWorkerDenyPlacementError(denyPath, `worker uid ${worker.uid} cannot search ${step.path} (${(step.entry.mode & 0o7777).toString(8)} ${step.entry.uid}:${step.entry.gid}); deny that directory itself instead`);
+        }
+    }
+}
+/** Walks one deny path on the real filesystem, recording what stopped it rather than throwing. */
+export async function readGrokWorkerDenyPathChain(denyPath) {
+    const steps = [];
+    for (const target of grokWorkerDenyPathChain(denyPath)) {
+        try {
+            steps.push({ path: target, entry: await lstat(target) });
+        }
+        catch (error) {
+            steps.push({ path: target, code: error.code });
+            break;
+        }
+    }
+    const chain = grokWorkerDenyPathChain(denyPath);
+    while (steps.length < chain.length)
+        steps.push({ path: chain[steps.length], code: steps.at(-1)?.code ?? "EACCES" });
+    return steps;
+}
+/**
+ * Fails closed before a worker is ever launched with a profile Grok would
+ * refuse. Callers with the widest view run it: root provisioning at container
+ * start and on every slot recycle, and the direct (non-broker) path, which runs
+ * as the worker uid itself.
+ */
+export async function assertGrokWorkerDenyPathsPlaceable(denyPaths, worker) {
+    for (const denyPath of denyPaths) {
+        if (!path.posix.isAbsolute(denyPath))
+            throw new GrokWorkerDenyPlacementError(denyPath, "it is not an absolute path");
+        assertGrokWorkerDenyPathPlacement(denyPath, await readGrokWorkerDenyPathChain(denyPath), worker);
+    }
+}

package/dist/runtime/grokWorkerHomeAttestation.d.ts

@@ -0,0 +1,30 @@
+import { type Stats } from "node:fs";
+type Entry = Pick<Stats, "uid" | "mode" | "nlink"> & Partial<Pick<Stats, "dev" | "ino">> & Readonly<{
+    isFile(): boolean;
+    isDirectory(): boolean;
+    isSymbolicLink(): boolean;
+}>;
+/**
+ * The worker must not be able to change what Grok reads before its next turn.
+ *
+ * Grok writes its own state (sessions, hooks, locks, docs) into `$GROK_HOME`,
+ * so the directory is worker-group writable — but root-owned and sticky, so a
+ * worker can neither rename nor unlink a root-owned file in it. Every file
+ * that decides a turn's behaviour is root-owned with no write bit: `config.toml`
+ * (model, effort, MCP, skills), `sandbox.toml`, `trusted_folders.toml` (trust
+ * would re-enable cwd `AGENTS.md` and project skills), and the managed and
+ * requirements layers that can override user config. A missing file fails
+ * too: the worker could create it.
+ *
+ * Pure so every refusal is testable without root.
+ */
+export declare function assertGrokWorkerHomeEntries(entries: Readonly<Record<string, Entry | undefined>>, rootUid?: number): void;
+/** The worker's `config.toml` must be exactly the renderer's bytes for the declared policy. */
+export declare function assertGrokWorkerConfigBytes(bytes: Uint8Array, configSha256: string): void;
+/**
+ * Attests the worker home layout and that `config.toml` is exactly the
+ * renderer's bytes for the declared model policy (`configSha256`).
+ */
+export declare function verifyGrokWorkerHome(grokHome: string, configSha256: string, rootUid?: number): Promise<void>;
+export {};
+//# sourceMappingURL=grokWorkerHomeAttestation.d.ts.map

package/dist/runtime/grokWorkerHomeAttestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerHomeAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerHomeAttestation.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAMhD,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC;IAAE,MAAM,IAAI,OAAO,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC;IAAC,cAAc,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAG9K;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,GAAE,MAA2B,GAAG,IAAI,CAS5I;AAED,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAEzF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAetI"}

package/dist/runtime/grokWorkerHomeAttestation.js

@@ -0,0 +1,69 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import path from "node:path";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+const HOME = GROK_ENGINE_BROKER.worker.home;
+/**
+ * The worker must not be able to change what Grok reads before its next turn.
+ *
+ * Grok writes its own state (sessions, hooks, locks, docs) into `$GROK_HOME`,
+ * so the directory is worker-group writable — but root-owned and sticky, so a
+ * worker can neither rename nor unlink a root-owned file in it. Every file
+ * that decides a turn's behaviour is root-owned with no write bit: `config.toml`
+ * (model, effort, MCP, skills), `sandbox.toml`, `trusted_folders.toml` (trust
+ * would re-enable cwd `AGENTS.md` and project skills), and the managed and
+ * requirements layers that can override user config. A missing file fails
+ * too: the worker could create it.
+ *
+ * Pure so every refusal is testable without root.
+ */
+export function assertGrokWorkerHomeEntries(entries, rootUid = HOME.directory.uid) {
+    const directory = (entry) => entry !== undefined && entry.isDirectory() && !entry.isSymbolicLink() && entry.uid === rootUid
+        && (Number(entry.mode) & 0o002) === 0 && ((Number(entry.mode) & 0o020) === 0 || (Number(entry.mode) & 0o1000) !== 0);
+    if (!directory(entries["."]) || !directory(entries[HOME.sessionsDirectory.relativePath]))
+        throw unavailable();
+    for (const name of HOME.readOnlyFiles.names) {
+        const entry = entries[name];
+        if (entry === undefined || !entry.isFile() || entry.isSymbolicLink() || entry.uid !== rootUid || entry.nlink !== 1 || (Number(entry.mode) & 0o7222) !== 0)
+            throw unavailable();
+    }
+}
+/** The worker's `config.toml` must be exactly the renderer's bytes for the declared policy. */
+export function assertGrokWorkerConfigBytes(bytes, configSha256) {
+    if (!/^[0-9a-f]{64}$/u.test(configSha256) || createHash("sha256").update(bytes).digest("hex") !== configSha256)
+        throw unavailable();
+}
+/**
+ * Attests the worker home layout and that `config.toml` is exactly the
+ * renderer's bytes for the declared model policy (`configSha256`).
+ */
+export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOME.directory.uid) {
+    const entries = {};
+    for (const name of [".", HOME.sessionsDirectory.relativePath, ...HOME.readOnlyFiles.names]) {
+        try {
+            entries[name] = await lstat(path.join(grokHome, name));
+        }
+        catch {
+            entries[name] = undefined;
+        }
+    }
+    assertGrokWorkerHomeEntries(entries, rootUid);
+    let handle;
+    try {
+        handle = await open(path.join(grokHome, "config.toml"), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const opened = await handle.stat();
+        const before = entries["config.toml"];
+        // Same inode as the lstat above, as in `secureOpen`: a rename between the two cannot swap in other bytes.
+        if (!opened.isFile() || opened.size > 65_536 || opened.dev !== before.dev || opened.ino !== before.ino || opened.uid !== before.uid || opened.mode !== before.mode || opened.nlink !== 1)
+            throw unavailable();
+        assertGrokWorkerConfigBytes(await handle.readFile(), configSha256);
+    }
+    catch {
+        throw unavailable();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+const unavailable = () => new Error("Grok worker isolation attestation unavailable");

package/dist/runtime/grokWorkerSandboxProfile.d.ts

@@ -0,0 +1,27 @@
+export declare const GROK_WORKER_SANDBOX_PROFILE: "daimon-strict";
+export declare const GROK_WORKER_SANDBOX_EVENTS_RELATIVE_PATH: "sessions/sandbox-events.jsonl";
+/**
+ * The only source of `daimon-strict` sandbox profile bytes.
+ *
+ * Grok 1.0.34 runs every Landlock profile inside bubblewrap, and there a
+ * non-empty `deny` list works: each entry is bind-masked for both the shell
+ * tool and in-process `read_file` (P0: `/run/paideia` denied, controls intact).
+ * The strict base still reads all of `/run`, `/var`, `/tmp` and `/etc`, so the
+ * deny list — not Landlock's allowlist — is what keeps evaluator and host-bind
+ * paths away from the worker. Which paths to deny is a registration input
+ * supplied by the deployment; Daimon only renders, pins, and attests them.
+ *
+ * Entries are sorted and deduplicated so equal sets render equal bytes (and the
+ * same `profileSha256`). A path that is not absolute and canonical, or that
+ * carries a character TOML or Grok would reinterpret, is refused — and so is
+ * one that equals or contains a base-profile grant, the first half of the
+ * deny-placement policy (`grokWorkerDenyPlacement.ts`). The other half —
+ * the entry exists and every ancestor is searchable by the worker uid — needs
+ * a filesystem, so it is asserted by whoever provisions the paths and, on the
+ * direct path, before every turn.
+ */
+export declare function renderGrokWorkerSandboxProfile(denyPaths?: readonly string[]): string;
+export declare const grokWorkerSandboxProfileSha256: (denyPaths?: readonly string[]) => string;
+/** `$GROK_HOME` is the profile's directory; 1.0.34 logs sandbox events under `sessions/`. */
+export declare const grokWorkerEventsPathFor: (profilePath: string) => string;
+//# sourceMappingURL=grokWorkerSandboxProfile.d.ts.map

package/dist/runtime/grokWorkerSandboxProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerSandboxProfile.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerSandboxProfile.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,2BAA2B,EAAG,eAAwB,CAAC;AACpE,eAAO,MAAM,wCAAwC,EAAG,+BAAwC,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAexF;AAED,eAAO,MAAM,8BAA8B,GAAI,YAAW,SAAS,MAAM,EAAO,KAAG,MACG,CAAC;AAEvF,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,GAAI,aAAa,MAAM,KAAG,MAC8B,CAAC"}