@noopolis/daimon 0.1.2 → 0.2.0

package/README.md

@@ -8,8 +8,11 @@ top of Pi. A Daimon runs one harnessed agent inside a caller-prepared workspace.
 Spawnfile compiles and deploys orgs, nested teams, member-owned schedules,
 Moltnet wiring, and workspace resources. Daimon executes one agent runtime: it
 accepts a wake selected by that runtime's organization policy and runs one
-turn. It does not know the org graph, schedule other agents, or let Simfile or
-a world service trigger cognition.
+turn. Its strict organization-runtime v2 host owns each configured agent's
+durable `cron`, `every`, or `disabled` schedule without learning the Spawnfile
+org graph. Simfile and world services do not trigger cognition.
+
+Spawnfile may also compile per-agent production MCP and Moltnet capabilities into this config. Daimon lists each MCP server at startup, mounts only its declared tool allowlist into Codex/Grok cognition turns, and bounds calls to 10 seconds and 64 KiB. Moltnet exposes one scoped natural-language send tool whose deterministic delivery id derives from the active wake, agent, target, and text. Accepted tool receipts are fsynced under the agent runtime home and replayed after restart; transport policy remains Spawnfile/Moltnet-owned.
 
 For a world-capable `kind: every` wake, the harness starts without a decision
 token and privately calls `world_claim` before exposing any other world tool.
@@ -25,7 +28,7 @@ independent wake and claim—they are never Daimon wake inputs.
 npm install @noopolis/daimon
 ```
 
-The latest published version is 0.1.1; this README describes the source tree (0.1.2).
+The latest published version may differ; this README describes the source tree (0.2.0).
 
 For Pi agents with memory enabled, install Mneme too:
 
@@ -49,6 +52,250 @@ Pi-specific exports live under the Pi subpath:
 import { PiHarnessAdapter } from "@noopolis/daimon/pi";
 ```
 
+## Organization-runtime contract
+
+For a strict Codex agent in an already prepared runtime, the public
+`resolveOrganizationCodexSandboxProjection(config, agentId, { acceptanceStorePath })`
+API returns `noopolis.daimon.codex-sandbox-projection.v1`: canonical workspace/home
+paths, the resolved executable, and `sandboxArgs` containing the exact permission
+profile rendered for production. Append only `--` and a mechanical command when
+checking whether that policy can execute in the caller's container.
+
+The resolver opens and verifies caller-owned path identities and executes the
+Codex version probe. It does not import/read authentication, create an agent,
+accept a wake or invoke a model. The acceptance-store path must be the same one
+given to the control host. This API projects command permissions, not the complete
+cognition invocation: Codex's `sandbox` subcommand lacks the strict configuration
+flags accepted by `exec`. A caller must therefore use a fresh empty `HOME` and
+`CODEX_HOME` and a restricted environment for its mechanical probe. Do not infer
+successful tool use or completed agent work from this projection alone.
+
+`@noopolis/daimon/runtime` exports a standard JSON Schema for structural
+validation plus the strict, side-effect-free semantic
+`validateOrganizationRuntimeConfig` / `parseOrganizationRuntimeConfig` API and
+a narrow multi-agent Daimon host:
+
+```ts
+import { parseOrganizationRuntimeConfig } from "@noopolis/daimon/runtime";
+
+const config = parseOrganizationRuntimeConfig({
+  version: "noopolis.daimon.organization-runtime.v1",
+  host: {
+    bindHost: "127.0.0.1",
+    port: 4318,
+    controlTokenEnv: "DAIMON_CONTROL_TOKEN"
+  },
+  agents: [{
+    id: "writer",
+    name: "Writer",
+    instructions: "Write the report.",
+    workspacePath: "/runtime/workspaces/writer",
+    runtimeHomePath: "/runtime/homes/writer",
+    engine: { kind: "codex" }
+  }]
+});
+```
+
+The package also includes the canonical runtime contract at
+`dist/runtime/contract-manifest.json` and its exact-byte SHA-256 sidecar at
+`dist/runtime/contract-manifest.sha256`. Every build regenerates both from the
+same data-only constants exported as `RUNTIME_CONTRACT_MANIFEST`; the digest is
+encoded as `sha256:<lowercase hex>`.
+
+It intentionally contains no teams, roles, parent/member links, wake policies,
+deployment settings, Moltnet data, commands, argument arrays, environment maps,
+or credentials. V2 agents carry one normalized native schedule; durable state
+and acceptance provide restart-safe occurrence execution. `controlTokenEnv` is only the safe name of a
+variable; the token value is never serialized. The only organization-host
+engine intents are `codex`, `grok`, and `agy`; Pi remains available through the
+separate one-agent `@noopolis/daimon/pi` API.
+
+`createOrganizationRuntimeHost(config)` creates an organization runtime host.
+Call `await host.start()` to construct one isolated Daimon harness per agent,
+after reading the non-blank control token named by `controlTokenEnv`.
+It routes only authenticated, targeted wakes; each agent's wakes are serial,
+while separate agents can run concurrently. It has no organization or
+coordination API. Run the HTTP control process with:
+
+```bash
+daimon-runtime run --config /runtime/daimon-runtime.json
+```
+
+The process exposes authenticated `POST /v1/wake`, `GET /v1/health`, and
+`GET /v1/activity` endpoints. Send the token only as `Authorization: Bearer
+<token>`; it never appears in configuration or activity output.
+
+For durable control-plane delivery, provide a caller-created, current-user
+owned `0700` directory in `DAIMON_RUNTIME_ACCEPTANCE_STORE`. This enables the
+additive authenticated v2 API: `POST /v2/wakes` persistently accepts one
+bounded, addressed wake under its `(agent_id, delivery_id, request digest)`
+identity before the turn starts, and `GET /v2/wake-receipts/<acceptance_id>`
+returns only its strict redacted lifecycle status. The store is a private
+runtime authority, not a credential directory; it must be mounted only into
+the Daimon host. Equal retries return the original acceptance, while a changed
+payload for that delivery id is rejected. `GET /v2/activity` exposes bounded
+receipt history and active execution identities. Completed receipts can include
+redacted terminal output; acceptance responses never contain model output. If the variable is not
+provided, the v1 endpoints remain available and v2 is not exposed.
+
+Per-agent `attention` opts into interruption-aware inbox processing:
+
+```json
+"attention": { "maxBatchMessages": 8, "maxBatchBytes": 12000, "maxExecutions": 30, "maxTokens": 3000000 }
+```
+
+An idle agent starts promptly. Messages arriving while it works accumulate into
+one bounded next turn; manual and scheduled events remain distinct. The agent
+uses `daimon_inbox` to read selected deliveries and `daimon_inbox_disposition`
+with a `delivery_id` and `complete` or `defer` disposition. Reading a message or
+ending a turn never completes it. Unmarked and deferred messages wait durably
+for new input, including after restart. A single oversized delivery stays
+intact in the inbox tool and is referenced instead of copied into the prompt.
+Omitting `attention` retains single-delivery, automatic completion behavior.
+Attention requires the durable control host and `POST /v2/wakes`; synchronous
+`POST /v1/wake` rejects attention-enabled agents with `durable_inbox_required`
+before starting cognition.
+
+Delivery acceptance does not spend an execution allowance. The existing global
+wake fuse counts execution-start reservations, including historical admissions;
+optional per-agent execution/token ceilings apply within the same explicit
+epoch. Retries reserve another execution while retaining the stable wake id
+used by idempotent tools. Reported token usage is a lagging bound, not an
+in-flight spending guarantee. Budget pauses preserve and continue accepting
+pending deliveries. The inbox has a separate hard storage bound of 2,176
+receipts; it never evicts pending work to accept another delivery.
+
+Authenticated `GET /v2/availability` reports running work, pending/deferred
+counts, limits, remaining allowances and the pause reason. Global operator-stop
+and ledger-failure latches stay hard: HTTP 409 carries a versioned `blocked`
+descriptor with a bounded retry delay. A budget pause never becomes a terminal
+receipt. Existing fuse trip markers remain latched until explicit operator
+recovery; changing attention settings does not erase historical spending.
+
+A batch's atomic per-agent claim records its complete membership and stable
+`execution_id` before cognition. Individual receipts retain their delivery ids
+and explicit state. `GET /v2/activity.executions` identifies the live turn even
+when all its message receipts have already completed; integrations should bind
+turn authority to that execution id. The wake environment uses the same id.
+
+Each accepted delivery also has a private, bounded execution claim with an
+owner and generation fence. A second host sharing the authority may observe a
+receipt but cannot dispatch while the live claimant owns it; only the matching,
+unexpired fence can record its terminal state. Claim revalidation and receipt
+replacement are covered by a separate exclusive, fsynced per-receipt transition
+lock; a recovered generation fences an older paused writer before replacement.
+After a host crash, a bounded stale claim can be recovered and replayed. This is durable at-least-once turn
+delivery, not exactly-once cognition: if an engine has an external effect and
+the host crashes before its terminal receipt is persisted, recovery can run the
+turn again. Callers requiring exactly-once external effects must fence or
+deduplicate those effects at their own destination.
+
+The durable v2 store is a Linux-container contract. Its non-expiring commit
+lock records the owner PID, Linux `/proc` process-start identity, boot id, and
+PID-namespace device/inode identity; recovery is allowed only after that exact
+owner is proven dead in the same namespace, so PID reuse cannot unlock a live
+writer. A different or unobservable PID namespace raises the typed,
+path-free `WakeTransitionLockBlockedError` with code
+`offline_reconciliation_required`; it is never automatically cleared. For a
+replacement container, deployment authority must first prove the prior
+container absent or quiescent, then perform an explicit offline stale-lock
+reconciliation. On a platform where this identity cannot be proven, v2 fails
+closed rather than using a clock-based lock; v1 remains available without the
+v2 store.
+
+### Offline transition reconciliation
+
+`reconcileOfflineWakeTransition` is a deployment-admin library operation, not
+an HTTP endpoint and never a normal host action. It accepts only the versioned
+`noopolis.daimon.offline-transition-reconciliation.v1` request, including the
+exact store and lock device/inode identities, owner/generation/PID-namespace
+identity, and an opaque absent-or-quiescent deployment attestation. The caller
+must mount the store exclusively offline and supply the deployment authority's
+attestation verifier. Daimon gives that verifier a canonical immutable
+authorization context (deployment identity, nonce, request digest, every
+store/delivery/lock identity, and every stale host registration's exact file
+device/inode, owner, process, boot, and PID-namespace identity); its returned
+proof receipt must echo that exact digest and nonce and certify
+`exclusive_store: true`. A same-namespace registration is cleared only when
+its owner is proven dead. A cross-namespace registration is cleared only when
+the proof authorizes that exact canonical registration digest after deployment
+has proven the old container absent or quiescent. Unknown, live, unlisted, or
+changed registrations block. Daimon validates the physical store, delivery
+record, and lock again immediately before its fsynced removal. The proof
+itself is never persisted or returned; the durable redacted receipt records
+only cleared registration digests.
+
+The operation writes a durable redacted receipt and returns it on an identical
+replay. An identity mismatch, invalid proof, concurrent administrative lease,
+or changed replay returns the stable blocked result
+`{ state: "blocked", code: "offline_reconciliation_required" }`. It performs
+no runtime auto-clear and has no CLI or public-server admin route in C0. The
+admin lease itself carries PID/start/boot/PID-namespace identity: a retry may
+recover it only after proving the prior owner dead in the same namespace. Lease
+unlink and directory fsync failures prevent a successful result; the durable
+prepared receipt lets an authorized offline retry finish after a crash.
+
+Every running wake-acceptance store also holds its own fsynced host-lifetime
+registration with the same process identity. A host writes that registration
+before becoming usable and rechecks the offline lease; the offline operation
+takes its lease first, then rejects live or unprovable host registrations.
+This permits normal concurrent hosts, but prevents either startup/admin race
+from overlapping an administrative reconciliation.
+
+The runtime may bind `0.0.0.0` when its caller places it on a dedicated private
+container network. Daimon neither publishes ports nor selects networks; the
+deployer must keep the control endpoint un-published and allow only its
+authorized control-plane client to reach it.
+
+The JSON Schema is deliberately standard and structural. The pure parser and
+validator are normative for semantic checks that standard JSON Schema cannot
+express, including unique ids, own-property records, and pairwise
+non-overlapping canonical POSIX workspace/runtime-home paths; call the parser
+before runtime side effects. The parser canonicalizes absolute path spellings
+before retaining or comparing them. Before creating agents, the host verifies
+that caller-created roots are real, current-user-owned directories without
+symlink components; runtime homes must be exactly `0700`, and workspaces must
+not be group/other writable. Daimon never creates or removes these roots.
+
+For a production CLI engine, Daimon resolves the engine from `PATH` once,
+pins its canonical executable identity, probes only `--version`, and rechecks
+that identity before every child process. Codex uses a caller-provisioned
+private `.codex/auth.json` refresh credential beneath each agent's
+`runtimeHomePath`. Grok instead uses one host-wide durable subscription realm:
+a read-only operator bootstrap seeds the authority, and Daimon serializes
+turns while staging and reconciling the rotating credential into each private
+agent home. Sessions and non-auth state remain isolated per agent. Engine
+children receive only the matching engine home, runtime/XDG paths,
+locale/timezone, and a PATH sufficient for the already pinned executable.
+Before every Grok process, Daimon rewrites its exact custom sandbox profile and
+requires a fresh kernel-enforcement receipt covering the durable realm,
+read-only bootstrap, and every peer workspace/runtime home. A fail-open
+Landlock/Seatbelt warning, missing deny path, or profile mutation fails the
+wake before cognition.
+They never inherit arbitrary host variables. Missing, replaced, malformed,
+stale, or unsafe engine authority prevents startup or fails the affected wake
+without publishing credential contents or file paths.
+
+AGY subscription authentication is different: it uses OS-native secure
+storage. Daimon supervises one private D-Bus plus Secret Service realm for all
+AGY agents on the host, holds an exclusive lease on its durable encrypted
+keyring volume, and unlocks it from an independent caller-owned `0600`
+read-only mount through bounded stdin. Only AGY children receive that realm's
+exact bus address. Normal startup proves enrollment with `agy models` before
+any agent starts.
+
+Enroll an empty realm once from an interactive terminal:
+
+```bash
+daimon-runtime auth agy login --config /runtime/daimon-runtime.json
+```
+
+The command starts the same realm and launches the pinned `agy` as a Daimon
+child with no AGY arguments, allowing its remote URL-and-code sign-in flow.
+After the operator exits AGY, Daimon runs the noninteractive enrollment proof
+and preserves the durable keyring state. It never accepts a portable AGY token
+file, API key, ADC credential, token export, or ambient D-Bus session.
+
 By default, the in-process Mneme runtime uses the same path as each agent's
 `runtimeHomePath`. If you need agents to keep separate Pi/runtime directories but
 share one memory bank, pass an explicit `memory.runtimeHomePath` in
@@ -98,18 +345,26 @@ upstream-documented dummy `ollama` value.
 
 ## Pi E2E
 
+`npm run live:grok-broker` checks an existing Grok subscription login through
+the real CLI and Daimon provider proxy, then repeats after restarting the proxy.
+It spends two short model turns, requires their exact terminal reply and real
+usage, and gives each CLI a temporary home containing only a scoped capability.
+The operator credential is read in the parent process and is never copied or
+refreshed. This is a local authentication/transport check; it does not exercise
+the Linux native launcher, worker attestation, MCP tools, or OAuth renewal.
+Success ends with `GROK_BROKER_AUTH_RESTART_OK`.
+
 The Pi E2E uses the local Codex CLI subscription auth file to seed an ignored Pi
 `auth.json` under `.runtime/`.
 
 These are live runs: they spend real tokens and require local engine auth
-(`~/.codex/auth.json` for Pi/Codex; mixed-engine and triad additionally need
+(`~/.codex/auth.json` for Pi/Codex; triad additionally needs
 authenticated `grok` and `agy` CLIs on PATH). They are not part of `npm test`.
 
 ```bash
 npm install
 npm run e2e:pi-agent
 npm run e2e:pi-memory-org
-npm run e2e:mixed-engine-org
 npm run e2e:jungian-play-org
 npm run e2e:jungian-triad-org
 ```
@@ -141,52 +396,15 @@ speaks through a Pi agent seeded from local Codex subscription auth. All three
 selves carry the same full archetype set, rotated through the run so every
 archetype gets consulted.
 
-## Design Notes
-
-- `MEMORY-SYSTEM.md` describes the implemented scoped memory runtime.
-- `ENGINE-SYSTEM.md` describes the engine abstraction plan: Pi, local/API
-  model providers, and CLI-backed engines such as `codex`, `claude`, `grok`,
-  and `agy`.
-- Mneme is a sibling package, `@noopolis/mneme`, published separately and used
-  by Daimon in-process for Pi agents. Other runtimes can use Mneme through its
-  MCP server. The agent-facing tools stay named `memory_search`,
-  `memory_register`, and `memory.*` at the protocol boundary because those names
-  are clearer to agents.
-
-## Runtime Artifact Image
-
-Daimon defines a local copy-only runtime artifact image build for Spawnfile:
-
-```bash
-npm run image:runtime:local
-```
-
-Status: this build currently fails against the public npm registry. The
-Dockerfile pins `@noopolis/daimon@0.1.2` and `@noopolis/mneme@0.1.1`, and
-neither is published yet (registry has daimon 0.1.1 and mneme 0.1.0). Works
-only after those versions publish or against a registry that has them. Treat
-as pending publish.
+## Docs
 
-This creates:
+Start with `docs/README.md` for the current documentation map:
 
-```text
-noopolis/spawnfile-runtime-daimon:0.1.2-local
-```
-
-The image is not a full organization image and is not intended to be run
-directly. It contains only:
-
-```text
-/opt/spawnfile/runtime-installs/daimon
-```
-
-Spawnfile can copy that path into generated organization images:
-
-```bash
-SPAWNFILE_DAIMON_RUNTIME_IMAGE=noopolis/spawnfile-runtime-daimon:0.1.2-local \
-  spawnfile build ./agentic-org
-```
+- `docs/runtime.md` explains the organization-runtime config, control API,
+  schedules, durable wake acceptance, and attention.
+- `docs/engines.md` explains Pi and CLI engine boundaries.
+- `docs/memory.md` explains Daimon's Mneme adapter.
+- `docs/observability.md` explains causal events, raw capture, and world
+  trajectories.
 
-This keeps mixed-runtime organizations composable: a generated image can copy
-Daimon, OpenClaw, PicoClaw, or any future runtime artifact independently instead
-of depending on one prebuilt image for every runtime combination.
+Historical migration plans and audits live under `archive/`.

package/dist/contracts/attentionContract.d.ts

@@ -0,0 +1,117 @@
+export type AttentionConfig = Readonly<{
+    maxBatchMessages?: number;
+    maxBatchBytes?: number;
+    maxExecutions?: number;
+    maxTokens?: number;
+}>;
+export declare const WORK_AVAILABILITY_SCHEMA: {
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["version", "state", "agents"];
+    readonly properties: {
+        readonly version: {
+            readonly const: "noopolis.daimon.work-availability.v1";
+        };
+        readonly state: {
+            readonly enum: readonly ["running", "paused", "stopped"];
+        };
+        readonly agents: {
+            readonly type: "array";
+            readonly maxItems: 32;
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["agent_id", "pending", "running", "deferred", "budget"];
+                readonly properties: {
+                    readonly agent_id: {
+                        readonly type: "string";
+                    };
+                    readonly pending: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                    readonly running: {
+                        readonly type: "boolean";
+                    };
+                    readonly deferred: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                    readonly budget: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["armed", "epoch", "state", "executions_used", "executions_remaining", "tokens_used", "tokens_remaining", "agent_executions_used", "agent_tokens_used"];
+                        readonly properties: {
+                            readonly armed: {
+                                readonly type: "boolean";
+                            };
+                            readonly epoch: {
+                                readonly type: "string";
+                            };
+                            readonly state: {
+                                readonly enum: readonly ["available", "paused", "stopped"];
+                            };
+                            readonly reason: {
+                                readonly type: "string";
+                            };
+                            readonly executions_used: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly executions_remaining: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly tokens_used: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly tokens_remaining: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly agent_executions_used: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly agent_executions_remaining: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly agent_tokens_used: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly agent_tokens_remaining: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                        };
+                    };
+                    readonly error: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
+    };
+};
+export declare const WORK_BLOCKED_SCHEMA: {
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["version", "reason", "retry_after_ms"];
+    readonly properties: {
+        readonly version: {
+            readonly const: "noopolis.daimon.work-blocked.v1";
+        };
+        readonly reason: {
+            readonly enum: readonly ["operator_stop", "ledger_unavailable", "host_stopping", "host_stopped", "queue_full"];
+        };
+        readonly retry_after_ms: {
+            readonly type: "integer";
+            readonly minimum: 1000;
+            readonly maximum: 300000;
+        };
+    };
+};
+//# sourceMappingURL=attentionContract.d.ts.map

package/dist/contracts/attentionContract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attentionContract.d.ts","sourceRoot":"","sources":["../../src/contracts/attentionContract.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAQ1I,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGzB,CAAC;AACb,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;CAEpB,CAAC"}

package/dist/contracts/attentionContract.js

@@ -0,0 +1,14 @@
+/** Additive control surfaces; delivery receipts remain the v2 wire contract. */
+const count = { type: "integer", minimum: 0 };
+const budget = { type: "object", additionalProperties: false, required: ["armed", "epoch", "state", "executions_used", "executions_remaining", "tokens_used", "tokens_remaining", "agent_executions_used", "agent_tokens_used"], properties: {
+        armed: { type: "boolean" }, epoch: { type: "string" }, state: { enum: ["available", "paused", "stopped"] }, reason: { type: "string" },
+        executions_used: count, executions_remaining: count, tokens_used: count, tokens_remaining: count,
+        agent_executions_used: count, agent_executions_remaining: count, agent_tokens_used: count, agent_tokens_remaining: count
+    } };
+export const WORK_AVAILABILITY_SCHEMA = { type: "object", additionalProperties: false, required: ["version", "state", "agents"], properties: {
+        version: { const: "noopolis.daimon.work-availability.v1" }, state: { enum: ["running", "paused", "stopped"] },
+        agents: { type: "array", maxItems: 32, items: { type: "object", additionalProperties: false, required: ["agent_id", "pending", "running", "deferred", "budget"], properties: { agent_id: { type: "string" }, pending: count, running: { type: "boolean" }, deferred: count, budget, error: { type: "string" } } } }
+    } };
+export const WORK_BLOCKED_SCHEMA = { type: "object", additionalProperties: false, required: ["version", "reason", "retry_after_ms"], properties: {
+        version: { const: "noopolis.daimon.work-blocked.v1" }, reason: { enum: ["operator_stop", "ledger_unavailable", "host_stopping", "host_stopped", "queue_full"] }, retry_after_ms: { type: "integer", minimum: 1000, maximum: 300000 }
+    } };

package/dist/contracts/canonicalJson.d.ts

@@ -0,0 +1,3 @@
+/** Deterministically serializes JSON data and rejects non-JSON or ambiguous values. */
+export declare const canonicalJson: (value: unknown) => string;
+//# sourceMappingURL=canonicalJson.d.ts.map

package/dist/contracts/canonicalJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalJson.d.ts","sourceRoot":"","sources":["../../src/contracts/canonicalJson.ts"],"names":[],"mappings":"AAiBA,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,MA4B9C,CAAC"}

package/dist/contracts/canonicalJson.js

@@ -0,0 +1,54 @@
+const invalid = (detail) => {
+    throw new TypeError(`value is not canonical JSON data: ${detail}`);
+};
+const assertUnicodeScalarString = (value) => {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                invalid("unpaired surrogate");
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            invalid("unpaired surrogate");
+        }
+    }
+};
+/** Deterministically serializes JSON data and rejects non-JSON or ambiguous values. */
+export const canonicalJson = (value) => {
+    if (value === null || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value) || Object.is(value, -0))
+            invalid("non-finite or negative-zero number");
+        return JSON.stringify(value);
+    }
+    if (typeof value === "string") {
+        assertUnicodeScalarString(value);
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            if (!Object.hasOwn(value, index))
+                invalid("sparse array");
+        }
+        return `[${value.map(canonicalJson).join(",")}]`;
+    }
+    if (typeof value !== "object")
+        return invalid(typeof value);
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        invalid("non-plain object");
+    const ownKeys = Reflect.ownKeys(value);
+    if (ownKeys.some((key) => typeof key !== "string"))
+        invalid("symbol key");
+    const keys = ownKeys.sort();
+    return `{${keys.map((key) => {
+        assertUnicodeScalarString(key);
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+            return invalid("non-data property");
+        return `${JSON.stringify(key)}:${canonicalJson(descriptor.value)}`;
+    }).join(",")}}`;
+};

package/dist/contracts/grokWorkerContract.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Fixed operating contract every broker-launched Grok worker receives through
+ * `--system-prompt-override`.
+ *
+ * The override replaces Grok's ~12k-token coding-agent system prompt and stops
+ * cwd `AGENTS.md` injection; the agent's identity and instructions still arrive
+ * in the prompt file. It is compiled into the native launcher byte-for-byte
+ * (`DBL_GROK_SYSTEM_PROMPT`), pinned by sha256 in the runtime contract
+ * manifest, and must stay ASCII without quotes or backslashes so the C literal
+ * needs no escaping.
+ *
+ * Daimon's per-wake tools reach Grok as deferred MCP tools named
+ * `daimon__<tool>` (server `[mcp_servers.daimon]`). Naming them lets `use_tool`
+ * run directly and saves one `search_tool` round trip per tool (P0: 3 → 2
+ * requests).
+ */
+/**
+ * The atoms of that route, and its single definition.
+ *
+ * Both texts a Grok worker receives are rendered from them: the pinned system
+ * prompt below, and the caller's identity envelope
+ * ({@link grokMountedToolNamingRule}, used by `src/runtime/engineDispatcher.ts`).
+ * They were worded independently once, and the envelope told the model to call
+ * the tools by their bare names - which Grok 1.0.34 refuses outright, before
+ * any HTTP: `'moltnet_read' is not a valid MCP tool name. Tool names must be
+ * qualified as \`server__tool\`` (local rig, real CLI, real rendered config).
+ * There is exactly one valid spelling, so two independently worded naming rules
+ * are one rule too many; this is the single definition both render from.
+ */
+export declare const DAIMON_GROK_MCP_SERVER: "daimon";
+/** Grok's own name for an MCP tool of that server: exactly what `tool_name` must carry. */
+export declare const DAIMON_GROK_TOOL_PREFIX: "daimon__";
+export declare const grokDaimonToolName: (tool: string) => string;
+/** Grok's two MCP meta-tools, and the argument that names a tool for the first. */
+export declare const GROK_MCP_INVOKE_TOOL: "use_tool";
+export declare const GROK_MCP_SEARCH_TOOL: "search_tool";
+export declare const GROK_MCP_TOOL_NAME_ARGUMENT: "tool_name";
+export declare const DAIMON_GROK_SYSTEM_PROMPT: string;
+/**
+ * The same route, stated once for the caller's identity envelope, where a
+ * wake's real mounted tools are known.
+ *
+ * It contributes exactly what the pinned prompt cannot know - the wake's real
+ * mounted names - and the one rule that makes them callable. It asserts rather
+ * than corrects: one bare catalogue, one prefix rule, one example, and the
+ * prefixed form named as the *only* valid form, because that is the CLI's own
+ * verdict on a bare name rather than a preference.
+ *
+ * What it deliberately leaves out is as load bearing. It never claims the
+ * agent's own instructions spell a tool wrongly, never offers a shell or CLI
+ * route, never repeats the catalogue in prefixed form - and never restates the
+ * `search_tool` rule. A Grok worker already reads two authoritative sentences
+ * about `search_tool`: the pinned prompt's ("only for a name you do not know")
+ * and Grok's own injected notice, which says the model MUST call it before any
+ * MCP tool. Observed on the rig: that contradiction is not enforced, and
+ * `use_tool` works with no prior `search_tool`. A third wording would only add
+ * a voice, so this sentence stays out of that argument entirely.
+ */
+export declare const grokMountedToolNamingRule: (mountedToolNames: readonly string[]) => string;
+/** Closed declared-model vocabulary; defaults are `grok-4.6` at `low`. */
+export declare const GROK_BROKER_MODELS: readonly ["grok-4.6", "grok-4.5", "grok-build"];
+export declare const GROK_BROKER_REASONING_EFFORTS: readonly ["low", "medium", "high"];
+/** `--tools` input ids. These are NOT the model-visible names (see below). */
+export declare const GROK_WORKER_TOOL_IDS: readonly ["run_terminal_cmd", "read_file", "grep", "list_dir", "search_tool", "use_tool"];
+/**
+ * The exact tool names a lean worker request body must carry.
+ *
+ * Grok 1.0.34 fails open on an unmappable `--tools` entry and ships all 19
+ * tools, so the proxy compares every upstream body against this set.
+ */
+export declare const GROK_WORKER_VISIBLE_TOOLS: readonly ["grep", "list_dir", "read_file", "run_terminal_command", "search_tool", "use_tool"];
+/** `--max-turns` backstop compiled into the launcher; per-wake ceilings belong to the broker. */
+export declare const GROK_WORKER_MAX_TURNS: 48;
+//# sourceMappingURL=grokWorkerContract.d.ts.map

package/dist/contracts/grokWorkerContract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerContract.d.ts","sourceRoot":"","sources":["../../src/contracts/grokWorkerContract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,EAAG,QAAiB,CAAC;AACxD,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,YAAyC,CAAC;AAC9E,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAA6C,CAAC;AAChG,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,EAAG,UAAmB,CAAC;AACxD,eAAO,MAAM,oBAAoB,EAAG,aAAsB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,EAAG,WAAoB,CAAC;AAIhE,eAAO,MAAM,yBAAyB,QAO3B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,GAAI,kBAAkB,SAAS,MAAM,EAAE,KAAG,MAM/E,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,iDAAiE,CAAC;AACjG,eAAO,MAAM,6BAA6B,oCAAoD,CAAC;AAE/F,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,2FAA2G,CAAC;AAE7I;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,+FAA+G,CAAC;AAEtJ,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,EAAG,EAAW,CAAC"}