@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/grokWorkerSandboxProfile.js

@@ -0,0 +1,44 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { assertGrokWorkerDenyPathShape } from "./grokWorkerDenyPlacement.js";
+export const GROK_WORKER_SANDBOX_PROFILE = "daimon-strict";
+export const GROK_WORKER_SANDBOX_EVENTS_RELATIVE_PATH = "sessions/sandbox-events.jsonl";
+/**
+ * The only source of `daimon-strict` sandbox profile bytes.
+ *
+ * Grok 1.0.34 runs every Landlock profile inside bubblewrap, and there a
+ * non-empty `deny` list works: each entry is bind-masked for both the shell
+ * tool and in-process `read_file` (P0: `/run/paideia` denied, controls intact).
+ * The strict base still reads all of `/run`, `/var`, `/tmp` and `/etc`, so the
+ * deny list — not Landlock's allowlist — is what keeps evaluator and host-bind
+ * paths away from the worker. Which paths to deny is a registration input
+ * supplied by the deployment; Daimon only renders, pins, and attests them.
+ *
+ * Entries are sorted and deduplicated so equal sets render equal bytes (and the
+ * same `profileSha256`). A path that is not absolute and canonical, or that
+ * carries a character TOML or Grok would reinterpret, is refused — and so is
+ * one that equals or contains a base-profile grant, the first half of the
+ * deny-placement policy (`grokWorkerDenyPlacement.ts`). The other half —
+ * the entry exists and every ancestor is searchable by the worker uid — needs
+ * a filesystem, so it is asserted by whoever provisions the paths and, on the
+ * direct path, before every turn.
+ */
+export function renderGrokWorkerSandboxProfile(denyPaths = []) {
+    const denied = [...new Set(denyPaths)].sort();
+    for (const entry of denied) {
+        if (!path.posix.isAbsolute(entry) || path.posix.normalize(entry) !== entry || entry === "/" || entry.endsWith("/") || /["\\\u0000-\u001f\u007f*?[\]]/u.test(entry)) {
+            throw new TypeError("invalid Grok worker sandbox deny path");
+        }
+        assertGrokWorkerDenyPathShape(entry);
+    }
+    return [
+        `[profiles.${GROK_WORKER_SANDBOX_PROFILE}]`,
+        'extends = "strict"',
+        "restrict_network = true",
+        `deny = [${denied.map((entry) => JSON.stringify(entry)).join(", ")}]`,
+        ""
+    ].join("\n");
+}
+export const grokWorkerSandboxProfileSha256 = (denyPaths = []) => createHash("sha256").update(renderGrokWorkerSandboxProfile(denyPaths)).digest("hex");
+/** `$GROK_HOME` is the profile's directory; 1.0.34 logs sandbox events under `sessions/`. */
+export const grokWorkerEventsPathFor = (profilePath) => path.posix.join(path.posix.dirname(profilePath), GROK_WORKER_SANDBOX_EVENTS_RELATIVE_PATH);

package/dist/runtime/grokWorkerTmpAttestation.d.ts

@@ -0,0 +1,55 @@
+import type { Stats } from "node:fs";
+type Entry = Pick<Stats, "uid" | "gid" | "mode"> & Readonly<{
+    isDirectory(): boolean;
+}>;
+export type GrokWorkerTmpWorker = Readonly<{
+    home: string;
+    uid: number;
+}>;
+/** Test seams only; production uses the manifest defaults. */
+export type GrokWorkerTmpOptions = Readonly<{
+    sharedRoots?: readonly string[];
+    sharedOwnerUid?: number;
+    firstWorkerUid?: number;
+}>;
+/**
+ * Temp-directory isolation, checked before every turn for *every* registered
+ * worker, not only the one about to run: a misprovisioned sibling temp
+ * directory (group- or world-writable) would be a place this worker could
+ * write into and that sibling would read from.
+ *
+ * Grok 1.0.34's strict profile grants shared `/tmp` and `/var/tmp`
+ * read-write, and it refuses to start when either (or any ancestor of a
+ * granted path) is in `deny` — verified live: `deny = ["/tmp"]`,
+ * `["/var/tmp"]`, `["/run"]`, `["/etc"]` all fail with "could not apply the
+ * sandbox profile", while `["/tmp/sub"]` works. So the kernel profile cannot
+ * keep evaluator temp files away from the worker. Unix modes can, because the
+ * launcher drops the worker to its own uid/gid with no supplementary groups:
+ *
+ * - shared temp roots are root-owned, owned by a group below the worker range,
+ *   and give "other" at most read (Grok opens the directory; without search
+ *   the worker can list names but cannot open, stat, or create anything); a
+ *   deployment that lets workers traverse or write them is refused;
+ * - the worker's own `<home>/tmp` (the launcher's compiled `TMPDIR`, which
+ *   strict grants read-write) is a real directory owned by the worker with no
+ *   group or other access, and every registered worker's is checked.
+ *
+ *
+ * Entries come from `lstat`, so a symlink is never a directory here: a
+ * symlinked temp root or private temp is refused by the directory check.
+ *
+ * Pure so every refusal is testable without root.
+ */
+export declare function assertGrokWorkerTmpEntries(entries: Readonly<{
+    privateTmps: readonly Readonly<{
+        uid: number;
+        entry: Entry | undefined;
+    }>[];
+    shared: readonly (Entry | undefined)[];
+}>, options?: GrokWorkerTmpOptions): void;
+/** `workers` must list every registered worker (the running one included). */
+export declare function verifyGrokWorkerTmp(workers: readonly GrokWorkerTmpWorker[], options?: GrokWorkerTmpOptions): Promise<void>;
+/** A registration's worker home is the parent of its `<home>/.grok/sandbox.toml`. */
+export declare const grokWorkerHomeForProfile: (profilePath: string) => string | undefined;
+export {};
+//# sourceMappingURL=grokWorkerTmpAttestation.d.ts.map

package/dist/runtime/grokWorkerTmpAttestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerTmpAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerTmpAttestation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAMrC,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC;IAAE,WAAW,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAIxF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC1E,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEnI;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAE,WAAW,EAAE,SAAS,QAAQ,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAA;KAAE,CAAC,EAAE,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;CAAE,CAAC,EAAE,OAAO,GAAE,oBAAyB,GAAG,IAAI,CAU/N;AAED,8EAA8E;AAC9E,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpI;AAED,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,GAAI,aAAa,MAAM,KAAG,MAAM,GAAG,SACoC,CAAC"}

package/dist/runtime/grokWorkerTmpAttestation.js

@@ -0,0 +1,63 @@
+import { lstat } from "node:fs/promises";
+import path from "node:path";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+const HOME = GROK_ENGINE_BROKER.worker.home;
+const FIRST_WORKER_UID = GROK_ENGINE_BROKER.identities.firstWorkerUid;
+/**
+ * Temp-directory isolation, checked before every turn for *every* registered
+ * worker, not only the one about to run: a misprovisioned sibling temp
+ * directory (group- or world-writable) would be a place this worker could
+ * write into and that sibling would read from.
+ *
+ * Grok 1.0.34's strict profile grants shared `/tmp` and `/var/tmp`
+ * read-write, and it refuses to start when either (or any ancestor of a
+ * granted path) is in `deny` — verified live: `deny = ["/tmp"]`,
+ * `["/var/tmp"]`, `["/run"]`, `["/etc"]` all fail with "could not apply the
+ * sandbox profile", while `["/tmp/sub"]` works. So the kernel profile cannot
+ * keep evaluator temp files away from the worker. Unix modes can, because the
+ * launcher drops the worker to its own uid/gid with no supplementary groups:
+ *
+ * - shared temp roots are root-owned, owned by a group below the worker range,
+ *   and give "other" at most read (Grok opens the directory; without search
+ *   the worker can list names but cannot open, stat, or create anything); a
+ *   deployment that lets workers traverse or write them is refused;
+ * - the worker's own `<home>/tmp` (the launcher's compiled `TMPDIR`, which
+ *   strict grants read-write) is a real directory owned by the worker with no
+ *   group or other access, and every registered worker's is checked.
+ *
+ *
+ * Entries come from `lstat`, so a symlink is never a directory here: a
+ * symlinked temp root or private temp is refused by the directory check.
+ *
+ * Pure so every refusal is testable without root.
+ */
+export function assertGrokWorkerTmpEntries(entries, options = {}) {
+    const shared = HOME.sharedTmp;
+    const firstWorkerUid = options.firstWorkerUid ?? FIRST_WORKER_UID;
+    if (entries.shared.length === 0 || entries.privateTmps.length === 0)
+        throw unavailable();
+    for (const entry of entries.shared) {
+        if (entry === undefined || !entry.isDirectory() || entry.uid !== (options.sharedOwnerUid ?? shared.uid) || entry.gid >= shared.maxGroupExclusive || (Number(entry.mode) & 0o007 & ~shared.otherMode) !== 0)
+            throw unavailable();
+    }
+    for (const { uid, entry } of entries.privateTmps) {
+        if (!Number.isSafeInteger(uid) || uid < firstWorkerUid || entry === undefined || !entry.isDirectory() || entry.uid !== uid || (Number(entry.mode) & 0o077) !== 0)
+            throw unavailable();
+    }
+}
+/** `workers` must list every registered worker (the running one included). */
+export async function verifyGrokWorkerTmp(workers, options = {}) {
+    const inspect = async (file) => { try {
+        return await lstat(file);
+    }
+    catch {
+        return undefined;
+    } };
+    assertGrokWorkerTmpEntries({
+        privateTmps: await Promise.all(workers.map(async (worker) => ({ uid: worker.uid, entry: await inspect(path.join(worker.home, HOME.privateTmp.relativeToWorkerHome)) }))),
+        shared: await Promise.all((options.sharedRoots ?? HOME.sharedTmp.paths).map(inspect))
+    }, options);
+}
+/** A registration's worker home is the parent of its `<home>/.grok/sandbox.toml`. */
+export const grokWorkerHomeForProfile = (profilePath) => path.basename(path.dirname(profilePath)) === ".grok" ? path.dirname(path.dirname(profilePath)) : undefined;
+const unavailable = () => new Error("Grok worker temp isolation attestation unavailable");

package/dist/runtime/index.d.ts

@@ -0,0 +1,26 @@
+export * from "./organizationRuntime.js";
+export * from "./contractManifest.js";
+export * from "./agySubscriptionRealm.js";
+export { createOrganizationRuntimeHost } from "./organizationRuntimeHost.js";
+export { createOrganizationRuntimeControlHost } from "./organizationRuntimeControl.js";
+export { CODEX_SANDBOX_PROJECTION_VERSION, resolveOrganizationCodexSandboxProjection, type OrganizationCodexSandboxProjection } from "./codexSandboxProjection.js";
+export { GROK_BROKER_PROJECTION_VERSION, grokBrokerProjectionSha256, grokBrokerServiceRegistrationFor, resolveOrganizationGrokBrokerProjection, verifyGrokBrokerRegistrationMatchesProjection, type OrganizationGrokBrokerProjection, type OrganizationGrokBrokerProjectionOptions } from "./grokBrokerProjection.js";
+export { GROK_SLOT_PREFLIGHT_VERSION, grokSlotPreflightCanarySchema, grokSlotPreflightReceiptSchema, parseGrokSlotPreflightReceipt, type GrokSlotPreflightFreshness, verifyGrokSlotPreflightReceipt, type GrokSlotPreflightReceipt } from "./grokSlotPreflightReceipt.js";
+export { grokBrokerWorkerConfigSha256, renderGrokBrokerWorkerConfig } from "./grokBrokerWorkerConfig.js";
+export { GROK_INFERENCE_CLIENT_MODEL_ID, GROK_INFERENCE_GRANT_ENV, grokInferenceClientConfigSha256, renderGrokInferenceClientConfig, renderProductionGrokInferenceClientConfig, type GrokInferenceClientConfigInput } from "./grokInferenceClientConfig.js";
+export { GROK_INFERENCE_PROXY_BASE_URL, ENGINE_BROKER_INFERENCE_FAILURE_CODES, type EngineBrokerInferenceFailureCode } from "./engineBrokerInferenceProtocol.js";
+export { dedupeInferenceUsageRows, INFERENCE_USAGE_LEDGER_VERSION, GROK_INFERENCE_PURPOSES, type GrokInferencePurpose } from "./inferenceUsageLedger.js";
+export { GROK_INFERENCE_AUTH_STALE_BODY } from "./grokInferenceProxy.js";
+export { assertGrokWorkerDenyPathPlacement, assertGrokWorkerDenyPathShape, assertGrokWorkerDenyPathsPlaceable, GROK_WORKER_BASE_PROFILE_GRANTS, grokWorkerCanSearch, grokWorkerDenyPathChain, GrokWorkerDenyPlacementError, readGrokWorkerDenyPathChain } from "./grokWorkerDenyPlacement.js";
+export type { GrokWorkerDenyPathEntry, GrokWorkerDenyPathStep, GrokWorkerDenyPathWorker } from "./grokWorkerDenyPlacement.js";
+export { grokWorkerSandboxProfileSha256, renderGrokWorkerSandboxProfile } from "./grokWorkerSandboxProfile.js";
+export { engineBrokerRequestLedgerPathFor, engineBrokerSealLedgerPathFor, parseEngineBrokerServiceConfig, type EngineBrokerServiceConfig, type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
+export { TURN_SEAL_LEDGER, TURN_SEAL_LEDGER_VERSION } from "./engineBrokerSealLedger.js";
+export { DEFAULT_GROK_BROKER_TURN_LIMITS, ENGINE_BROKER_LIMIT_REASONS, type EngineBrokerLimitReason, type EngineBrokerTurnAccounting, type EngineBrokerTurnLimits, type EngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";
+export { dedupeTurnUsageRows } from "./turnUsageLedger.js";
+export { WakeTransitionLockBlockedError } from "./wakeAcceptanceStore.js";
+export { OFFLINE_RECONCILIATION_BLOCKED_CODE, OFFLINE_RECONCILIATION_REQUEST_SCHEMA, OFFLINE_RECONCILIATION_VERSION, assertOfflineReconciliationLeaseAvailable, OfflineTransitionReconciliationBlockedError, parseOfflineTransitionReconciliationRequest, reconcileOfflineWakeTransition, type OfflineDeploymentAttestation, type OfflineTransitionReconciliationAuthorizationContext, type OfflineTransitionReconciliationOptions, type OfflineTransitionReconciliationProofReceipt, type OfflineTransitionReconciliationReceipt, type OfflineTransitionReconciliationRequest, type OfflineTransitionReconciliationResult } from "./wakeAcceptanceReconciliation.js";
+export { MAX_WAKE_ACCEPTANCE_BYTES, MAX_WAKE_ACCEPTANCE_RECORD_BYTES, WAKE_ACCEPTANCE_VERSION, WAKE_ACCEPTANCE_REQUEST_SCHEMA, WAKE_RECEIPT_STATUS_VERSION, WAKE_RECEIPT_STATUS_SCHEMA, WAKE_V2_VERSION, parseWakeAcceptanceRequest, wakeAcceptanceDigest, type OrganizationRuntimeWakeAcceptance, type OrganizationRuntimeWakeAcceptanceRequest, type OrganizationRuntimeWakeAcceptanceResult, type OrganizationRuntimeWakeReceiptStatus, type WakeReceiptCode, type WakeReceiptState } from "./wakeAcceptanceTypes.js";
+export type { OrganizationRuntimeControlHost, OrganizationRuntimeControlOptions } from "./organizationRuntimeControl.js";
+export { EngineBrokerControlClient, EngineBrokerInferenceGrantRefused, type EngineBrokerInferenceGrant } from "./engineBrokerControlClient.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,yCAAyC,EAClF,KAAK,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,uCAAuC,EAC5I,6CAA6C,EAAE,KAAK,gCAAgC,EAAE,KAAK,uCAAuC,EAAE,MAAM,2BAA2B,CAAC;AACxK,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EACjK,8BAA8B,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,yCAAyC,EAAE,KAAK,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAC5P,OAAO,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,KAAK,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACjK,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACzJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,iCAAiC,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC9R,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC9H,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACvN,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,EAClI,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,8BAA8B,EAC9B,yCAAyC,EACzC,2CAA2C,EAC3C,2CAA2C,EAC3C,8BAA8B,EAC9B,KAAK,4BAA4B,EACjC,KAAK,mDAAmD,EACxD,KAAK,sCAAsC,EAC3C,KAAK,2CAA2C,EAChD,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,uCAAuC,EAC5C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,KAAK,0BAA0B,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/runtime/index.js

@@ -0,0 +1,23 @@
+export * from "./organizationRuntime.js";
+export * from "./contractManifest.js";
+export * from "./agySubscriptionRealm.js";
+export { createOrganizationRuntimeHost } from "./organizationRuntimeHost.js";
+export { createOrganizationRuntimeControlHost } from "./organizationRuntimeControl.js";
+export { CODEX_SANDBOX_PROJECTION_VERSION, resolveOrganizationCodexSandboxProjection } from "./codexSandboxProjection.js";
+export { GROK_BROKER_PROJECTION_VERSION, grokBrokerProjectionSha256, grokBrokerServiceRegistrationFor, resolveOrganizationGrokBrokerProjection, verifyGrokBrokerRegistrationMatchesProjection } from "./grokBrokerProjection.js";
+export { GROK_SLOT_PREFLIGHT_VERSION, grokSlotPreflightCanarySchema, grokSlotPreflightReceiptSchema, parseGrokSlotPreflightReceipt, verifyGrokSlotPreflightReceipt } from "./grokSlotPreflightReceipt.js";
+export { grokBrokerWorkerConfigSha256, renderGrokBrokerWorkerConfig } from "./grokBrokerWorkerConfig.js";
+export { GROK_INFERENCE_CLIENT_MODEL_ID, GROK_INFERENCE_GRANT_ENV, grokInferenceClientConfigSha256, renderGrokInferenceClientConfig, renderProductionGrokInferenceClientConfig } from "./grokInferenceClientConfig.js";
+export { GROK_INFERENCE_PROXY_BASE_URL, ENGINE_BROKER_INFERENCE_FAILURE_CODES } from "./engineBrokerInferenceProtocol.js";
+export { dedupeInferenceUsageRows, INFERENCE_USAGE_LEDGER_VERSION, GROK_INFERENCE_PURPOSES } from "./inferenceUsageLedger.js";
+export { GROK_INFERENCE_AUTH_STALE_BODY } from "./grokInferenceProxy.js";
+export { assertGrokWorkerDenyPathPlacement, assertGrokWorkerDenyPathShape, assertGrokWorkerDenyPathsPlaceable, GROK_WORKER_BASE_PROFILE_GRANTS, grokWorkerCanSearch, grokWorkerDenyPathChain, GrokWorkerDenyPlacementError, readGrokWorkerDenyPathChain } from "./grokWorkerDenyPlacement.js";
+export { grokWorkerSandboxProfileSha256, renderGrokWorkerSandboxProfile } from "./grokWorkerSandboxProfile.js";
+export { engineBrokerRequestLedgerPathFor, engineBrokerSealLedgerPathFor, parseEngineBrokerServiceConfig } from "./engineBrokerServiceConfig.js";
+export { TURN_SEAL_LEDGER, TURN_SEAL_LEDGER_VERSION } from "./engineBrokerSealLedger.js";
+export { DEFAULT_GROK_BROKER_TURN_LIMITS, ENGINE_BROKER_LIMIT_REASONS } from "./engineBrokerTurnAccounting.js";
+export { dedupeTurnUsageRows } from "./turnUsageLedger.js";
+export { WakeTransitionLockBlockedError } from "./wakeAcceptanceStore.js";
+export { OFFLINE_RECONCILIATION_BLOCKED_CODE, OFFLINE_RECONCILIATION_REQUEST_SCHEMA, OFFLINE_RECONCILIATION_VERSION, assertOfflineReconciliationLeaseAvailable, OfflineTransitionReconciliationBlockedError, parseOfflineTransitionReconciliationRequest, reconcileOfflineWakeTransition } from "./wakeAcceptanceReconciliation.js";
+export { MAX_WAKE_ACCEPTANCE_BYTES, MAX_WAKE_ACCEPTANCE_RECORD_BYTES, WAKE_ACCEPTANCE_VERSION, WAKE_ACCEPTANCE_REQUEST_SCHEMA, WAKE_RECEIPT_STATUS_VERSION, WAKE_RECEIPT_STATUS_SCHEMA, WAKE_V2_VERSION, parseWakeAcceptanceRequest, wakeAcceptanceDigest } from "./wakeAcceptanceTypes.js";
+export { EngineBrokerControlClient, EngineBrokerInferenceGrantRefused } from "./engineBrokerControlClient.js";

package/dist/runtime/inferenceUsageLedger.d.ts

@@ -0,0 +1,38 @@
+import type { EngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";
+import type { GrokBrokerModel } from "./grokBrokerModelPolicy.js";
+/**
+ * Evaluator inference spend, one row per upstream model request of one grant.
+ *
+ * This is a separate stream at a separate path (`service.json`
+ * `inferenceLedgerPath`), never the subject usage ledger: the org wake fuse and
+ * Spawnfile's subject accounting sum that ledger, and a judge's tokens are not
+ * a subject wake's. Rows carry `kind: "inference"` so a reader that is pointed
+ * at the wrong file can still tell them apart (`wakeFuse.ts` skips them).
+ *
+ * Grants are not sealed in a durable registry: each request is appended when
+ * it settles. `(grant, request)` identifies a row; readers dedupe on it
+ * ({@link dedupeInferenceUsageRows}).
+ */
+export declare const INFERENCE_USAGE_LEDGER_VERSION: "noopolis.daimon.inference-usage.v1";
+export declare const GROK_INFERENCE_PURPOSES: readonly ["judge", "optimizer"];
+export type GrokInferencePurpose = (typeof GROK_INFERENCE_PURPOSES)[number];
+export type InferenceUsageEntry = Readonly<{
+    grant: string;
+    purpose: GrokInferencePurpose;
+    model: GrokBrokerModel;
+    request: number;
+    usage: EngineBrokerTurnUsage;
+    usageSource: "upstream" | "estimated";
+    startedAt: string;
+    endedAt: string;
+    at?: string;
+}>;
+export declare const renderInferenceUsageLine: (entry: InferenceUsageEntry) => string;
+/** Advisory, never rejects: an evaluator request that already spent tokens must not fail on its ledger. */
+export declare const recordInferenceUsage: (file: string, entry: InferenceUsageEntry) => Promise<boolean>;
+/** Keeps the first row of each `(grant, request)`; rows without both keys are not inference rows and are dropped. */
+export declare const dedupeInferenceUsageRows: <T extends Readonly<{
+    grant?: unknown;
+    request?: unknown;
+}>>(rows: readonly T[]) => T[];
+//# sourceMappingURL=inferenceUsageLedger.d.ts.map

package/dist/runtime/inferenceUsageLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferenceUsageLedger.d.ts","sourceRoot":"","sources":["../../src/runtime/inferenceUsageLedger.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,sCAAmD,CAAC;AAC/F,eAAO,MAAM,uBAAuB,iCAA8C,CAAC;AACnF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,WAAW,EAAE,UAAU,GAAG,WAAW,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,eAAO,MAAM,wBAAwB,GAAI,OAAO,mBAAmB,KAAG,MASrE,CAAC;AAEF,2GAA2G;AAC3G,eAAO,MAAM,oBAAoB,GAAU,MAAM,MAAM,EAAE,OAAO,mBAAmB,KAAG,OAAO,CAAC,OAAO,CAIpG,CAAC;AAEF,qHAAqH;AACrH,eAAO,MAAM,wBAAwB,GAAI,CAAC,SAAS,QAAQ,CAAC;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,MAAM,SAAS,CAAC,EAAE,KAAG,CAAC,EAQ1H,CAAC"}

package/dist/runtime/inferenceUsageLedger.js

@@ -0,0 +1,53 @@
+import { GROK_BROKER_MODELS } from "../contracts/grokWorkerContract.js";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { recordLedgerLines } from "./turnRequestLedger.js";
+/**
+ * Evaluator inference spend, one row per upstream model request of one grant.
+ *
+ * This is a separate stream at a separate path (`service.json`
+ * `inferenceLedgerPath`), never the subject usage ledger: the org wake fuse and
+ * Spawnfile's subject accounting sum that ledger, and a judge's tokens are not
+ * a subject wake's. Rows carry `kind: "inference"` so a reader that is pointed
+ * at the wrong file can still tell them apart (`wakeFuse.ts` skips them).
+ *
+ * Grants are not sealed in a durable registry: each request is appended when
+ * it settles. `(grant, request)` identifies a row; readers dedupe on it
+ * ({@link dedupeInferenceUsageRows}).
+ */
+export const INFERENCE_USAGE_LEDGER_VERSION = GROK_ENGINE_BROKER.inferenceGrants.ledgerVersion;
+export const GROK_INFERENCE_PURPOSES = GROK_ENGINE_BROKER.inferenceGrants.purposes;
+export const renderInferenceUsageLine = (entry) => {
+    if (!/^[a-f0-9]{32}$/u.test(entry.grant) || !GROK_INFERENCE_PURPOSES.includes(entry.purpose) || !GROK_BROKER_MODELS.includes(entry.model) || !Number.isSafeInteger(entry.request) || entry.request < 0)
+        throw new TypeError("invalid inference usage entry");
+    const { usage } = entry;
+    return `${JSON.stringify({
+        v: INFERENCE_USAGE_LEDGER_VERSION, kind: "inference", purpose: entry.purpose, grant: entry.grant, request: entry.request,
+        at: entry.at ?? new Date().toISOString(), started_at: entry.startedAt, ended_at: entry.endedAt, model: entry.model,
+        input: usage.input, cache_read: usage.cacheRead, cache_write: usage.cacheWrite, output: usage.output, total: usage.total,
+        usage_source: entry.usageSource
+    })}\n`;
+};
+/** Advisory, never rejects: an evaluator request that already spent tokens must not fail on its ledger. */
+export const recordInferenceUsage = async (file, entry) => {
+    let line;
+    try {
+        line = renderInferenceUsageLine(entry);
+    }
+    catch {
+        return false;
+    }
+    return recordLedgerLines(file, line);
+};
+/** Keeps the first row of each `(grant, request)`; rows without both keys are not inference rows and are dropped. */
+export const dedupeInferenceUsageRows = (rows) => {
+    const seen = new Set();
+    return rows.filter((row) => {
+        if (typeof row.grant !== "string" || typeof row.request !== "number")
+            return false;
+        const key = `${row.grant}\0${row.request}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+};

package/dist/runtime/mcpToolResult.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Lowering an upstream MCP server's `CallToolResult` onto a Pi tool result.
+ *
+ * Every `mcp_*` tool is a *passthrough*: Daimon calls a declared MCP server and
+ * has to hand the model back what that server actually said. It used to hand
+ * back routing metadata instead — `details: { server, tool, is_error }` — and
+ * because the MCP mount lowers `details` to `structuredContent`
+ * (`src/mcp/toolServer.ts`) and the engines render `structuredContent` in
+ * preference to `content`, an agent calling any declared MCP tool saw
+ * `{"server":"newsroom","tool":"file_article","is_error":true}` and nothing
+ * else. The tool's own answer, and the reason for its own failure, never
+ * reached the model. `moltnet_read` was the same defect in a Daimon-authored
+ * tool; this is the wider one, in the tools Daimon does not author.
+ *
+ * Three rules follow, and they are the whole design:
+ *
+ *   1. **Both channels always carry the payload.** `content` and
+ *      `structuredContent` are each filled with the result, mirroring whichever
+ *      one the server did not send. Daimon has already been wrong once about
+ *      which channel an engine renders; carrying the answer in both is the only
+ *      shape where being wrong again costs nothing. A server that sent
+ *      `structuredContent` gets it forwarded *verbatim*, so a declared
+ *      `outputSchema` still describes what the model sees.
+ *
+ *   2. **`isError` is raised, not reported.** Pi's `AgentToolResult` has no
+ *      error channel — a Pi tool signals failure by throwing, and
+ *      `toolServer.ts` lowers a throw to `isError: true` plus the message. So an
+ *      upstream `isError: true` becomes a thrown {@link McpToolCallError}
+ *      carrying the server's own reason text. The model then gets a result
+ *      flagged as a failure *and* the sentence explaining it, which is the
+ *      difference between correcting a call and guessing at it.
+ *
+ *   3. **The bound truncates; it never throws the payload away.** An oversized
+ *      result used to be refused outright, so the agent got
+ *      `Error: MCP tool result exceeds bound` and none of the data. It is now
+ *      degraded to a head of the serialized result plus an explicit marker
+ *      naming both sizes.
+ *
+ * Daimon deliberately does *not* re-declare the upstream `outputSchema` on its
+ * own mount. A declared output schema obliges every result to carry conforming
+ * `structuredContent`, which neither a content-only server response nor rule 3's
+ * truncation marker can satisfy — declaring it would turn a degraded result into
+ * a client-side protocol error and lose the payload all over again.
+ */
+/**
+ * Headroom left inside the receipt bound for the receipt's own envelope.
+ *
+ * A successful MCP result is stored in its receipt so a replayed identical call
+ * in the same wake answers with the result rather than with a digest of it. The
+ * envelope (`kind`, ids, engine, server, tool, digest, `is_error`, `at`) is a
+ * few hundred bytes for any sane name; 4096 is generous enough that a stored
+ * result can never push the receipt past its own bound.
+ */
+export declare const MCP_RECEIPT_ENVELOPE_RESERVE_BYTES = 4096;
+/** Bound on one lowered MCP tool result, model-facing and receipt-facing alike. */
+export declare const MCP_TOOL_RESULT_MAX_BYTES: number;
+/** Rendered for a server that answered with neither content nor structured content. */
+export declare const MCP_EMPTY_RESULT_TEXT = "[daimon: the MCP server returned a result with no content]";
+/** Reason used when a server flags an error but supplies no text for it. */
+export declare const MCP_ERROR_WITHOUT_DETAIL = "the MCP server reported an error and gave no reason";
+/**
+ * An upstream MCP tool that answered with `isError: true`.
+ *
+ * The reason is the server's own words. `toolServer.ts` renders a thrown error
+ * as `"<name>: <message>"` inside an `isError: true` result, so the model
+ * receives both the failure flag and the explanation.
+ */
+export declare class McpToolCallError extends Error {
+    readonly server: string;
+    readonly tool: string;
+    readonly reason: string;
+    constructor(server: string, tool: string, reason: string);
+}
+/** The fields of an upstream `CallToolResult` that Daimon reads. */
+export interface McpUpstreamResult {
+    readonly content?: unknown;
+    readonly structuredContent?: unknown;
+    readonly isError?: unknown;
+}
+/** A lowered result, ready to be returned from a Pi `ToolDefinition.execute`. */
+export interface RenderedMcpToolResult {
+    readonly content: readonly unknown[];
+    readonly details: Record<string, unknown>;
+    readonly truncated: boolean;
+}
+/** Flatten an MCP content array to text, naming the parts that are not text. */
+export declare function mcpContentText(content: unknown): string;
+/** Truncate to a byte budget without splitting a UTF-8 code point. */
+export declare function truncateUtf8(value: string, maxBytes: number): {
+    text: string;
+    truncated: boolean;
+    originalBytes: number;
+};
+/**
+ * The server's own explanation for an `isError: true` result.
+ *
+ * Both channels are consulted, because a server may put a human sentence in
+ * `content` and a machine-readable code in `structuredContent`, and an agent
+ * that has to fix its own call needs whichever one it was given.
+ */
+export declare function mcpErrorReason(result: McpUpstreamResult, maxBytes: number): string;
+/**
+ * Lower one upstream result, or throw {@link McpToolCallError} when it is an
+ * error result.
+ */
+export declare function renderMcpToolResult(input: {
+    readonly server: string;
+    readonly tool: string;
+    readonly result: McpUpstreamResult;
+    readonly maxBytes?: number;
+}): RenderedMcpToolResult;
+/** The result of one MCP call, as stored in its receipt for replay. */
+export interface McpReceiptResult {
+    readonly content: readonly unknown[];
+    readonly details: Record<string, unknown>;
+}
+/**
+ * Rebuild a tool answer from a receipt written by an earlier identical call.
+ *
+ * The wake-scoped receipt exists so a repeated identical call is not sent
+ * upstream twice. It used to be *returned* to the model in place of the result,
+ * so a retried call answered with `{"kind":"mcp",…,"digest":"sha256:…"}` — the
+ * least useful thing an agent stuck in a retry loop could possibly receive.
+ * A recorded failure is replayed as the same failure, with the same reason.
+ */
+export declare function replayMcpReceipt(server: string, tool: string, receipt: Record<string, unknown>): RenderedMcpToolResult;
+//# sourceMappingURL=mcpToolResult.d.ts.map

package/dist/runtime/mcpToolResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpToolResult.d.ts","sourceRoot":"","sources":["../../src/runtime/mcpToolResult.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAKH;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AAExD,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,QAAyD,CAAC;AAEhG,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,+DAA+D,CAAC;AAElG,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,wDAAwD,CAAC;AAE9F;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAOhE;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAKD,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAUvD;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAMzH;AAKD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOlF;AAoBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,qBAAqB,CAqBxB;AA+BD,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,qBAAqB,CAWtH"}