@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/grokBrokerCredentialAuthority.js

@@ -0,0 +1,150 @@
+import { randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { mkdir, open, rename, unlink } from "node:fs/promises";
+import path from "node:path";
+import { readGrokBrokerCredential } from "./grokBrokerCredentialReader.js";
+import { refreshGrokBrokerCredential } from "./grokBrokerRefresh.js";
+import { EngineBrokerGenerationFence, EngineBrokerSingleflight } from "./engineBrokerSingleflight.js";
+import { BROKER_CREDENTIAL_MAX_ANCESTORS, parseBrokerCredentialJournal, recoverBrokerCredentialJournal } from "./engineBrokerCredentialJournal.js";
+export class DurableGrokBrokerCredentialAuthority {
+    command;
+    home;
+    authFile;
+    flight = new EngineBrokerSingleflight();
+    fence = new EngineBrokerGenerationFence();
+    stale = false;
+    initialized = false;
+    staleWrite;
+    lastDigest;
+    generation = 0;
+    ancestorDigests = [];
+    constructor(command, home, authFile = path.join(home, "auth.json")) {
+        this.command = command;
+        this.home = home;
+        this.authFile = authFile;
+    }
+    async initialize() {
+        if (this.initialized)
+            return;
+        const credential = await readGrokBrokerCredential(this.authFile);
+        this.lastDigest = credential.digest;
+        const file = path.join(this.home, ".daimon-broker", "credential-journal.json");
+        let handle;
+        try {
+            handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.size > 65536)
+                throw unavailable();
+            const journal = parseBrokerCredentialJournal(JSON.parse(await handle.readFile("utf8")));
+            this.generation = journal.generation;
+            if (recoverBrokerCredentialJournal(journal, credential.digest) === "stale") {
+                await this.markStale();
+                throw unavailable();
+            }
+            this.ancestorDigests = [...new Set([...(journal.ancestorDigests ?? []), journal.sourceDigest])]
+                .filter((digest) => digest !== credential.digest);
+            if (journal.state === "refreshing") {
+                // The durable credential still matches the pre-exchange source. Settle
+                // before serving it so writeback and drain need no subsequent refresh.
+                // No exchange completed: preserve the generation and existing lineage.
+                await this.write({ state: "promoted", generation: journal.generation,
+                    sourceDigest: credential.digest, promotedDigest: credential.digest });
+            }
+            this.fence.restore(journal.generation);
+        }
+        catch (error) {
+            // Only a missing journal on open is an unjournaled bootstrap. A failed
+            // recovery write (including ENOENT) must never publish readiness.
+            if (handle !== undefined || error.code !== "ENOENT")
+                throw unavailable();
+        }
+        finally {
+            await handle?.close().catch(() => undefined);
+        }
+        this.initialized = true;
+    }
+    async accessToken(forceRefresh) {
+        if (!this.initialized)
+            await this.initialize();
+        if (this.stale)
+            throw unavailable();
+        if (!forceRefresh)
+            return (await readGrokBrokerCredential(this.authFile)).accessToken;
+        return this.refresh();
+    }
+    async refreshAfterRejection(rejectedTokenDigest) { if (!/^[a-f0-9]{64}$/u.test(rejectedTokenDigest))
+        throw unavailable(); return this.refresh(rejectedTokenDigest); }
+    refresh(rejectedTokenDigest) {
+        return this.flight.run(async () => {
+            if (this.stale)
+                throw unavailable();
+            const generation = this.fence.snapshot();
+            const before = await readGrokBrokerCredential(this.authFile);
+            if (rejectedTokenDigest !== undefined && createHash("sha256").update(before.accessToken).digest("hex") !== rejectedTokenDigest)
+                return before.accessToken;
+            // Never spend a refresh whose lineage cannot be persisted. Advancing expiry
+            // normally clears the history, so this bound applies to one expiry epoch.
+            const ancestors = [...new Set([...this.ancestorDigests, before.digest])];
+            if (ancestors.length > BROKER_CREDENTIAL_MAX_ANCESTORS)
+                throw unavailable();
+            try {
+                await this.write({ state: "refreshing", generation, sourceDigest: before.digest });
+                await refreshGrokBrokerCredential(this.command, this.home);
+                const after = await readGrokBrokerCredential(this.authFile);
+                if (after.digest === before.digest)
+                    throw unavailable();
+                const next = this.fence.promote(generation);
+                this.generation = next;
+                const ancestorDigests = before.expiresAt !== undefined && after.expiresAt !== undefined && after.expiresAt > before.expiresAt ? [] : ancestors;
+                await this.write({ state: "promoted", generation: next, sourceDigest: before.digest, promotedDigest: after.digest, ancestorDigests });
+                this.ancestorDigests = ancestorDigests;
+                this.lastDigest = after.digest;
+                return after.accessToken;
+            }
+            catch {
+                await this.markStale();
+                throw unavailable();
+            }
+        });
+    }
+    async markRejected(rejectedTokenDigest) { if (rejectedTokenDigest !== undefined) {
+        if (!/^[a-f0-9]{64}$/u.test(rejectedTokenDigest))
+            throw unavailable();
+        const current = await readGrokBrokerCredential(this.authFile);
+        if (createHash("sha256").update(current.accessToken).digest("hex") !== rejectedTokenDigest)
+            throw unavailable();
+    } if (!this.stale)
+        await this.markStale(); throw unavailable(); }
+    isStale() { return this.stale; }
+    markStale() { if (this.staleWrite)
+        return this.staleWrite; this.stale = true; this.fence.markStale(); return this.staleWrite = (async () => { const rejected = this.lastDigest ?? (await readGrokBrokerCredential(this.authFile)).digest; await this.write({ state: "stale", generation: this.generation, sourceDigest: rejected, promotedDigest: rejected }); })(); }
+    async write(value) {
+        const root = path.join(this.home, ".daimon-broker");
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const file = path.join(root, "credential-journal.json");
+        const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+        const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify({ version: "noopolis.daimon.broker-credential-journal.v1", ancestorDigests: this.ancestorDigests, ...value })}\n`);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            await rename(temporary, file);
+            const directory = await open(root, constants.O_RDONLY);
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+        finally {
+            await unlink(temporary).catch(() => undefined);
+        }
+    }
+}
+const unavailable = () => new Error("Grok broker credential authority unavailable");

package/dist/runtime/grokBrokerCredentialReader.d.ts

@@ -0,0 +1,6 @@
+export declare function readGrokBrokerCredential(file: string): Promise<Readonly<{
+    accessToken: string;
+    digest: string;
+    expiresAt?: number;
+}>>;
+//# sourceMappingURL=grokBrokerCredentialReader.d.ts.map

package/dist/runtime/grokBrokerCredentialReader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerCredentialReader.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialReader.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW3I"}

package/dist/runtime/grokBrokerCredentialReader.js

@@ -0,0 +1,38 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+export async function readGrokBrokerCredential(file) {
+    let handle;
+    let bytes;
+    try {
+        const before = await lstat(file);
+        assertFile(before);
+        handle = await open(file, constants.O_RDONLY | noFollow());
+        const opened = await handle.stat();
+        assertFile(opened);
+        if (before.dev !== opened.dev || before.ino !== opened.ino)
+            throw new Error();
+        bytes = await handle.readFile();
+        if (bytes.length > 64 * 1024)
+            throw new Error();
+        const after = await handle.stat();
+        if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs)
+            throw new Error();
+        const root = JSON.parse(bytes.toString("utf8"));
+        const rows = Object.values(root).filter((value) => value !== null && typeof value === "object" && !Array.isArray(value));
+        if (rows.length !== 1 || typeof rows[0].key !== "string" || rows[0].key.length < 32 || typeof rows[0].refresh_token !== "string" || rows[0].refresh_token.length < 16)
+            throw new Error();
+        const expiresAt = typeof rows[0].expires_at === "string" ? Date.parse(rows[0].expires_at) : NaN;
+        return { accessToken: rows[0].key, digest: createHash("sha256").update(bytes).digest("hex"), ...(Number.isFinite(expiresAt) ? { expiresAt } : {}) };
+    }
+    catch {
+        throw new Error("Grok broker credential authority unavailable");
+    }
+    finally {
+        bytes?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+}
+function assertFile(entry) { if (!entry.isFile() || entry.isSymbolicLink() || Number(entry.uid) !== process.getuid?.() || Number(entry.nlink) !== 1 || (Number(entry.mode) & 0o777) !== 0o600 || Number(entry.size) < 2 || Number(entry.size) > 64 * 1024)
+    throw new Error(); }
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }

package/dist/runtime/grokBrokerModelPolicy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The closed model and reasoning-effort vocabulary a Grok broker worker may be
+ * declared with.
+ *
+ * Both halves of one declaration are consumed from this single parser: the
+ * worker `config.toml` renderer (`grokBrokerWorkerConfig.ts`) writes them into
+ * the worker's only custom model, and the provider proxy
+ * (`grokBrokerProxyRequest.ts`) refuses any request body that does not carry
+ * exactly them. Nothing is inherited: Grok 1.0.34 silently drops an effort for
+ * a model that does not declare effort support, and its embedded catalog
+ * default for `grok-4.6` is `high`.
+ */
+import { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS } from "../contracts/grokWorkerContract.js";
+export { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS };
+export type GrokBrokerModel = (typeof GROK_BROKER_MODELS)[number];
+export type GrokBrokerReasoningEffort = (typeof GROK_BROKER_REASONING_EFFORTS)[number];
+export type GrokBrokerModelPolicy = Readonly<{
+    model: GrokBrokerModel;
+    reasoningEffort: GrokBrokerReasoningEffort;
+}>;
+export declare const DEFAULT_GROK_BROKER_MODEL_POLICY: GrokBrokerModelPolicy;
+export declare function parseGrokBrokerModelPolicy(value?: unknown): GrokBrokerModelPolicy;
+//# sourceMappingURL=grokBrokerModelPolicy.d.ts.map

package/dist/runtime/grokBrokerModelPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerModelPolicy.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerModelPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACvF,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,yBAAyB,CAAA;CAAE,CAAC,CAAC;AAErH,eAAO,MAAM,gCAAgC,EAAE,qBAAoF,CAAC;AAEpI,wBAAgB,0BAA0B,CAAC,KAAK,GAAE,OAAY,GAAG,qBAAqB,CAUrF"}

package/dist/runtime/grokBrokerModelPolicy.js

@@ -0,0 +1,28 @@
+/**
+ * The closed model and reasoning-effort vocabulary a Grok broker worker may be
+ * declared with.
+ *
+ * Both halves of one declaration are consumed from this single parser: the
+ * worker `config.toml` renderer (`grokBrokerWorkerConfig.ts`) writes them into
+ * the worker's only custom model, and the provider proxy
+ * (`grokBrokerProxyRequest.ts`) refuses any request body that does not carry
+ * exactly them. Nothing is inherited: Grok 1.0.34 silently drops an effort for
+ * a model that does not declare effort support, and its embedded catalog
+ * default for `grok-4.6` is `high`.
+ */
+import { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS } from "../contracts/grokWorkerContract.js";
+export { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS };
+export const DEFAULT_GROK_BROKER_MODEL_POLICY = Object.freeze({ model: "grok-4.6", reasoningEffort: "low" });
+export function parseGrokBrokerModelPolicy(value = {}) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("invalid Grok broker model policy");
+    const input = value;
+    if (Object.keys(input).some((key) => key !== "model" && key !== "reasoningEffort"))
+        throw new TypeError("invalid Grok broker model policy");
+    const model = input.model ?? DEFAULT_GROK_BROKER_MODEL_POLICY.model;
+    const reasoningEffort = input.reasoningEffort ?? DEFAULT_GROK_BROKER_MODEL_POLICY.reasoningEffort;
+    if (!GROK_BROKER_MODELS.includes(model) || !GROK_BROKER_REASONING_EFFORTS.includes(reasoningEffort)) {
+        throw new TypeError("invalid Grok broker model policy");
+    }
+    return Object.freeze({ model: model, reasoningEffort: reasoningEffort });
+}

package/dist/runtime/grokBrokerProjection.d.ts

@@ -0,0 +1,114 @@
+import { GROK_BROKER_TASK_CLOCK, type GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
+import { type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
+import { type EngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
+import type { GrokBrokerModel, GrokBrokerReasoningEffort } from "./grokBrokerModelPolicy.js";
+import { GROK_WORKER_SANDBOX_PROFILE } from "./grokWorkerSandboxProfile.js";
+export declare const GROK_BROKER_PROJECTION_VERSION: "noopolis.daimon.grok-broker-projection.v3";
+/**
+ * Everything a consumer (Spawnfile provisioning, Paideia's native adapter, the
+ * root slot supervisor) needs to know about one brokered Grok agent's slot,
+ * computed by Daimon from the same renderers and collectors the broker attests
+ * against. It never reads credentials, runs a worker, or touches the realm.
+ */
+export type OrganizationGrokBrokerProjection = Readonly<{
+    version: typeof GROK_BROKER_PROJECTION_VERSION;
+    agentId: string;
+    workspacePath: string;
+    runtimeHomePath: string;
+    workerUid: number;
+    slot: number;
+    profilePath: string;
+    profileSha256: string;
+    denyPaths: readonly string[];
+    workerConfigSha256: string;
+    workerConfigVariant: GrokWorkerConfigVariant;
+    taskClock?: Omit<typeof GROK_BROKER_TASK_CLOCK, "directoryPath" | "timestampFilePath"> & Readonly<{
+        directoryPath: string;
+        timestampFilePath: string;
+    }>;
+    systemPromptSha256: string;
+    grokCliVersion: string;
+    grokExecutableSha256: string;
+    nativeAbiVersion: number;
+    model: GrokBrokerModel;
+    reasoningEffort: GrokBrokerReasoningEffort;
+    limits: EngineBrokerTurnLimits;
+    usageLedgerPath: string;
+    /** The container seccomp profile the worker must run under (the pinned default-plus-userns profile bubblewrap needs). */
+    seccompProfileSha256: string;
+    attestation: Readonly<{
+        platform: "linux/landlock";
+        enforced: true;
+        restrictNetwork: true;
+        profileName: typeof GROK_WORKER_SANDBOX_PROFILE;
+        sandboxRuntime: "bubblewrap";
+        eventsPath: string;
+    }>;
+}>;
+export type OrganizationGrokBrokerProjectionOptions = Readonly<{
+    /** Clocked configs require an isolated clock directory per slot. Defaults to the unchanged production bytes. */
+    workerConfigVariant?: GrokWorkerConfigVariant;
+    /** Deployment-assigned slot identity. */
+    slot: number;
+    workerUid: number;
+    /** The worker's home; its `GROK_HOME` is `<workerHomePath>/.grok`. */
+    workerHomePath: string;
+    architecture: "arm64" | "x64";
+    usageLedgerPath: string;
+    limits: EngineBrokerTurnLimits;
+    /**
+     * The deny entry that protects the durable wake-acceptance store: the store
+     * itself, or a directory containing it.
+     *
+     * Grok 1.0.34 materializes every deny target inside bubblewrap **as the
+     * worker uid**, so a target whose parent directory the worker cannot search
+     * is unplaceable and makes Grok refuse the whole profile — every turn of that
+     * worker then fails, not just that path. Deployments that keep the store
+     * under a private `state` directory (`2000:2000 0700`) therefore declare that
+     * directory here: it covers the store, nothing else lives there, and lifting
+     * the mask adds the worker no reach, where opening the parent with `o+x`
+     * would. The caller is the one party that knows both the layout and the
+     * modes; whoever recomputes this projection must pass the same value or the
+     * digests will not match, which is the intended fail-closed outcome.
+     */
+    acceptanceStorePath: string;
+    /** Evaluator and host-bind paths the deployment must keep from the worker (R4). */
+    denyPaths?: readonly string[];
+    /** sha256 of the seccomp profile bytes the deployment runs the worker under. */
+    seccompProfileSha256: string;
+    /** When the caller already holds a rendered profile digest, it must equal Daimon's. */
+    profileSha256?: string;
+}>;
+/**
+ * Resolve the public Grok broker projection for one agent.
+ *
+ * Paths are taken as given, never resolved: the caller (Spawnfile provisioning)
+ * must supply canonical, non-symlink paths — the fixed tmpfs/workspace roots it
+ * creates — and its provisioning must verify they are not symlinks before a
+ * slot is used; the broker's own attestation re-checks the worker home at
+ * every turn.
+ *
+ * Deterministic and I/O-free on purpose: its digest
+ * ({@link grokBrokerProjectionSha256}) is what the slot preflight receipt
+ * binds, so the supervisor that writes the receipt and the evaluator that reads
+ * it must compute byte-equal projections from the same inputs.
+ *
+ * The agent must be a Grok agent that *declares* its model and reasoning
+ * effort; nothing is defaulted. The deny list is Daimon's own protected set for
+ * this agent (realm, bootstrap, peers, and the mask covering the acceptance
+ * store) plus the caller's evaluator paths, sorted and deduplicated exactly as
+ * the profile renderer does. A supplied `profileSha256` that differs is
+ * refused.
+ */
+export declare function resolveOrganizationGrokBrokerProjection(config: unknown, agentId: string, options: OrganizationGrokBrokerProjectionOptions): OrganizationGrokBrokerProjection;
+/** sha256 over the projection's canonical JSON; what a slot preflight receipt binds. */
+export declare const grokBrokerProjectionSha256: (projection: OrganizationGrokBrokerProjection) => string;
+/** The `service.json` v2 registration a deployment provisions for this projection, validated by the broker's own parser. */
+export declare function grokBrokerServiceRegistrationFor(projection: OrganizationGrokBrokerProjection): Readonly<Record<string, unknown>>;
+/**
+ * Refuses a provisioned registration that does not describe this projection:
+ * any differing member — a weaker profile digest, another model, raised
+ * limits, a different ledger — is a mismatch, never a merge.
+ */
+export declare function verifyGrokBrokerRegistrationMatchesProjection(registration: EngineBrokerServiceRegistration, projection: OrganizationGrokBrokerProjection): void;
+//# sourceMappingURL=grokBrokerProjection.d.ts.map

package/dist/runtime/grokBrokerProjection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerProjection.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAQ3G,OAAO,EAAkC,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAA2F,MAAM,+BAA+B,CAAC;AAGrK,eAAO,MAAM,8BAA8B,6CAAuC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,sBAAsB,EAAE,eAAe,GAAG,mBAAmB,CAAC,GAAG,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxJ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;QAAC,cAAc,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjM,CAAC,CAAC;AAEH,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,gHAAgH;IAChH,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,GAAG,gCAAgC,CAkC5K;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,GAAI,YAAY,gCAAgC,KAAG,MACpB,CAAC;AAEvE,4HAA4H;AAC5H,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQhI;AAED;;;;GAIG;AACH,wBAAgB,6CAA6C,CAAC,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,gCAAgC,GAAG,IAAI,CAG/J"}

package/dist/runtime/grokBrokerProjection.js

@@ -0,0 +1,101 @@
+import { brokerTaskClockFileFor } from "./grokBrokerSlot.js";
+import { GROK_BROKER_TASK_CLOCK } from "../contracts/grokBrokerTaskClock.js";
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { canonicalJson } from "../contracts/canonicalJson.js";
+import { DAIMON_GROK_SYSTEM_PROMPT } from "../contracts/grokWorkerContract.js";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { grokSandboxProtectedPaths } from "./engineDispatcher.js";
+import { parseEngineBrokerServiceConfig } from "./engineBrokerServiceConfig.js";
+import { parseEngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
+import { grokBrokerWorkerConfigPins, grokBrokerWorkerConfigSha256 } from "./grokBrokerWorkerConfig.js";
+import { GROK_WORKER_SANDBOX_PROFILE, grokWorkerEventsPathFor, renderGrokWorkerSandboxProfile, grokWorkerSandboxProfileSha256 } from "./grokWorkerSandboxProfile.js";
+import { parseOrganizationRuntimeConfig } from "./organizationRuntime.js";
+export const GROK_BROKER_PROJECTION_VERSION = GROK_ENGINE_BROKER.projectionVersion;
+/**
+ * Resolve the public Grok broker projection for one agent.
+ *
+ * Paths are taken as given, never resolved: the caller (Spawnfile provisioning)
+ * must supply canonical, non-symlink paths — the fixed tmpfs/workspace roots it
+ * creates — and its provisioning must verify they are not symlinks before a
+ * slot is used; the broker's own attestation re-checks the worker home at
+ * every turn.
+ *
+ * Deterministic and I/O-free on purpose: its digest
+ * ({@link grokBrokerProjectionSha256}) is what the slot preflight receipt
+ * binds, so the supervisor that writes the receipt and the evaluator that reads
+ * it must compute byte-equal projections from the same inputs.
+ *
+ * The agent must be a Grok agent that *declares* its model and reasoning
+ * effort; nothing is defaulted. The deny list is Daimon's own protected set for
+ * this agent (realm, bootstrap, peers, and the mask covering the acceptance
+ * store) plus the caller's evaluator paths, sorted and deduplicated exactly as
+ * the profile renderer does. A supplied `profileSha256` that differs is
+ * refused.
+ */
+export function resolveOrganizationGrokBrokerProjection(config, agentId, options) {
+    const parsed = parseOrganizationRuntimeConfig(config);
+    const agent = parsed.agents.find((entry) => entry.id === agentId);
+    if (agent === undefined || agent.engine.kind !== "grok")
+        throw new Error("Grok broker projection requires a known Grok agent");
+    if (agent.engine.model === undefined || agent.engine.reasoningEffort === undefined)
+        throw new Error("Grok broker projection requires a declared model and reasoning effort");
+    for (const [label, value] of [["workerHomePath", options.workerHomePath], ["acceptanceStorePath", options.acceptanceStorePath]]) {
+        if (!path.posix.isAbsolute(value) || path.posix.normalize(value) !== value || value === "/" || value.endsWith("/"))
+            throw new Error(`Grok broker projection requires a canonical absolute ${label}`);
+    }
+    if (!/^[a-f0-9]{64}$/u.test(options.seccompProfileSha256))
+        throw new Error("Grok broker projection requires a seccomp profile sha256");
+    const model = agent.engine.model, reasoningEffort = agent.engine.reasoningEffort;
+    const denyPaths = [...new Set([...grokSandboxProtectedPaths(agent.id, parsed.agents, [options.acceptanceStorePath]), ...(options.denyPaths ?? [])])].sort();
+    renderGrokWorkerSandboxProfile(denyPaths);
+    const profileSha256 = grokWorkerSandboxProfileSha256(denyPaths);
+    if (options.profileSha256 !== undefined && options.profileSha256 !== profileSha256)
+        throw new Error("Grok broker projection profile digest mismatch");
+    const workerConfigVariant = options.workerConfigVariant ?? "unclocked";
+    const workerConfigSha256 = grokBrokerWorkerConfigSha256({ model, reasoningEffort }, workerConfigVariant, options.slot);
+    const pin = grokBrokerWorkerConfigPins({ model, reasoningEffort }, options.slot)[workerConfigVariant];
+    if (workerConfigVariant === "clocked" && denyPaths.some((denied) => [brokerTaskClockFileFor(options.slot), GROK_BROKER_TASK_CLOCK.preloadPath].some((file) => file === denied || file.startsWith(`${denied}/`))))
+        throw new Error("Grok broker task clock path is denied");
+    if (workerConfigSha256 !== pin)
+        throw new Error("Grok broker projection worker config drifted from the manifest");
+    if (createHash("sha256").update(DAIMON_GROK_SYSTEM_PROMPT).digest("hex") !== GROK_ENGINE_BROKER.worker.systemPromptSha256)
+        throw new Error("Grok broker projection system prompt drifted from the manifest");
+    const artifact = GROK_ENGINE_BROKER.grokCliArtifacts[options.architecture];
+    if (artifact === undefined)
+        throw new Error("Grok broker projection requires a pinned architecture");
+    const profilePath = path.posix.join(options.workerHomePath, ".grok", "sandbox.toml");
+    const projection = {
+        version: GROK_BROKER_PROJECTION_VERSION, agentId, workspacePath: agent.workspacePath, runtimeHomePath: agent.runtimeHomePath,
+        workerUid: options.workerUid, slot: options.slot, profilePath, profileSha256, denyPaths, workerConfigSha256, workerConfigVariant,
+        ...(workerConfigVariant === "clocked" ? { taskClock: { ...GROK_BROKER_TASK_CLOCK, directoryPath: path.posix.dirname(brokerTaskClockFileFor(options.slot)), timestampFilePath: brokerTaskClockFileFor(options.slot) } } : {}),
+        systemPromptSha256: GROK_ENGINE_BROKER.worker.systemPromptSha256, grokCliVersion: GROK_ENGINE_BROKER.grokCliVersion, grokExecutableSha256: artifact.sha256,
+        nativeAbiVersion: GROK_ENGINE_BROKER.nativeAbiVersion, model, reasoningEffort, limits: parseEngineBrokerTurnLimits(options.limits), usageLedgerPath: options.usageLedgerPath, seccompProfileSha256: options.seccompProfileSha256,
+        attestation: { platform: "linux/landlock", enforced: true, restrictNetwork: true, profileName: GROK_WORKER_SANDBOX_PROFILE, sandboxRuntime: "bubblewrap", eventsPath: grokWorkerEventsPathFor(profilePath) }
+    };
+    // The registration this projection implies must itself be a valid v2 service.json entry.
+    grokBrokerServiceRegistrationFor(projection);
+    return projection;
+}
+/** sha256 over the projection's canonical JSON; what a slot preflight receipt binds. */
+export const grokBrokerProjectionSha256 = (projection) => createHash("sha256").update(canonicalJson(projection)).digest("hex");
+/** The `service.json` v2 registration a deployment provisions for this projection, validated by the broker's own parser. */
+export function grokBrokerServiceRegistrationFor(projection) {
+    const registration = {
+        agentId: projection.agentId, slot: projection.slot, workerUid: projection.workerUid, workspace: projection.workspacePath,
+        profilePath: projection.profilePath, eventsPath: projection.attestation.eventsPath, profileSha256: projection.profileSha256,
+        usageLedgerPath: projection.usageLedgerPath, limits: projection.limits, model: { id: projection.model, reasoningEffort: projection.reasoningEffort }
+    };
+    parseEngineBrokerServiceConfig({ version: "noopolis.daimon.engine-broker-service.v2", credentialHome: GROK_ENGINE_BROKER.credentialHomePath, turnStore: GROK_ENGINE_BROKER.turnStorePath, registrations: [registration] });
+    return registration;
+}
+/**
+ * Refuses a provisioned registration that does not describe this projection:
+ * any differing member — a weaker profile digest, another model, raised
+ * limits, a different ledger — is a mismatch, never a merge.
+ */
+export function verifyGrokBrokerRegistrationMatchesProjection(registration, projection) {
+    const expected = parseEngineBrokerServiceConfig({ version: "noopolis.daimon.engine-broker-service.v2", credentialHome: GROK_ENGINE_BROKER.credentialHomePath, turnStore: GROK_ENGINE_BROKER.turnStorePath, registrations: [grokBrokerServiceRegistrationFor(projection)] }).registrations[0];
+    if (canonicalJson(expected) !== canonicalJson(registration))
+        throw new Error("Grok broker registration does not match its projection");
+}

package/dist/runtime/grokBrokerProviderClock.d.ts

@@ -0,0 +1,26 @@
+export type GrokBrokerProviderClockObservation = Readonly<{
+    requests: number;
+    linesRewritten: number;
+    requestsWithoutDateLine: number;
+    /** Date-like message lines outside the injected block; absent on older seals. */
+    linesIgnored?: number;
+    /** The last rewritten line's dates; null until a line is rewritten. */
+    injectedDate: string | null;
+    taskDate: string | null;
+}>;
+export declare class GrokBrokerProviderClockRefusal extends Error {
+    readonly reason: "task_clock_date_format" | "task_clock_date_range" | "request_body_rejected";
+    constructor(reason: "task_clock_date_format" | "task_clock_date_range" | "request_body_rejected");
+}
+/** One processClock, owned by one turn; never reads the broker's ambient TZ. */
+export declare class GrokBrokerProviderClock {
+    private readonly now;
+    private readonly offsetMs;
+    private observation;
+    constructor(processClock: string, now?: () => number);
+    rewrite(body: Uint8Array): Uint8Array;
+    snapshot(): GrokBrokerProviderClockObservation;
+}
+/** Closed, dates-only observation on the v3 terminal frame and durable seal. */
+export declare function parseGrokBrokerProviderClockObservation(value: unknown): GrokBrokerProviderClockObservation;
+//# sourceMappingURL=grokBrokerProviderClock.d.ts.map

package/dist/runtime/grokBrokerProviderClock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerProviderClock.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProviderClock.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAAC;AAEH,qBAAa,8BAA+B,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,wBAAwB,GAAG,uBAAuB,GAAG,uBAAuB;gBAApF,MAAM,EAAE,wBAAwB,GAAG,uBAAuB,GAAG,uBAAuB;CAG1G;AAOD,gFAAgF;AAChF,qBAAa,uBAAuB;IAOA,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,WAAW,CAGjB;gBAEU,YAAY,EAAE,MAAM,EAAmB,GAAG,GAAE,MAAM,MAAyB;IAIvF,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU;IAuErC,QAAQ,IAAI,kCAAkC;CAG/C;AAKD,gFAAgF;AAChF,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,OAAO,GAAG,kCAAkC,CAuB1G"}

package/dist/runtime/grokBrokerProviderClock.js

@@ -0,0 +1,133 @@
+import { parseBrokerProcessClock } from "./grokBrokerTaskClock.js";
+import { parseGrokBrokerProxyJson } from "./grokBrokerProxyJson.js";
+export class GrokBrokerProviderClockRefusal extends Error {
+    reason;
+    constructor(reason) {
+        super(`grok broker proxy refused: ${reason}`);
+        this.reason = reason;
+    }
+}
+const DATE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/u;
+const DATE_LINE = /^Today's date: ([0-9]{4}-[0-9]{2}-[0-9]{2})$/u;
+const DATE_LIKE = /today['’]?s\s+date\b/iu;
+const MAX_TASK_MS = 253_402_300_799_999;
+/** One processClock, owned by one turn; never reads the broker's ambient TZ. */
+export class GrokBrokerProviderClock {
+    now;
+    offsetMs;
+    observation = {
+        requests: 0, linesRewritten: 0, requestsWithoutDateLine: 0, linesIgnored: 0,
+        injectedDate: null, taskDate: null
+    };
+    constructor(processClock, now = () => Date.now()) {
+        this.now = now;
+        this.offsetMs = Math.round(Number(parseBrokerProcessClock(processClock)) * 1000);
+    }
+    rewrite(body) {
+        this.observation = { ...this.observation, requests: this.observation.requests + 1 };
+        let parsed;
+        try {
+            parsed = parseGrokBrokerProxyJson(body);
+        }
+        catch {
+            throw new GrokBrokerProviderClockRefusal("request_body_rejected");
+        }
+        const taskMs = this.now() + this.offsetMs;
+        if (!Number.isSafeInteger(taskMs) || taskMs < 0 || taskMs > MAX_TASK_MS) {
+            throw new GrokBrokerProviderClockRefusal("task_clock_date_range");
+        }
+        // The native launcher pins TZ=UTC. Compute once per request, including
+        // history resends; a long turn may cross midnight between requests.
+        const taskDate = new Date(taskMs).toISOString().slice(0, 10);
+        let lines = 0;
+        let ignored = 0;
+        let injectedDate = null;
+        const countIgnored = (text) => text.split(/\r\n|\r|\n/u).filter((line) => DATE_LIKE.test(line)).length;
+        const rewriteText = (text, injected) => {
+            const block = injected ? /<user_info>([\s\S]*?)<\/user_info>/u.exec(text) : null;
+            if (block === null) {
+                ignored += countIgnored(text);
+                return text;
+            }
+            const before = text.slice(0, block.index), after = text.slice(block.index + block[0].length);
+            ignored += countIgnored(before) + countIgnored(after);
+            const rewritten = block[1].split(/(\r\n|\r|\n)/u).map((line) => {
+                if (!DATE_LIKE.test(line))
+                    return line;
+                const match = DATE_LINE.exec(line);
+                if (match === null)
+                    throw new GrokBrokerProviderClockRefusal("task_clock_date_format");
+                lines++;
+                injectedDate = match[1];
+                return `Today's date: ${taskDate}`;
+            }).join("");
+            return `${before}<user_info>${rewritten}</user_info>${after}`;
+        };
+        if (Array.isArray(parsed.value.messages)) {
+            let firstUser = true;
+            for (const message of parsed.value.messages) {
+                if (!isRecord(message))
+                    continue;
+                const injected = message.role === "user" && firstUser;
+                if (message.role === "user")
+                    firstUser = false;
+                if (typeof message.content === "string") {
+                    message.content = rewriteText(message.content, injected);
+                }
+                else if (Array.isArray(message.content)) {
+                    const parts = message.content.filter((part) => isRecord(part) && part.type === "text" && typeof part.text === "string");
+                    // A block or date can straddle text parts. Replacements have exactly
+                    // the same width, so slicing restores every original part boundary.
+                    const rewritten = rewriteText(parts.map((part) => part.text).join(""), injected);
+                    let start = 0;
+                    for (const part of parts) {
+                        const end = start + part.text.length;
+                        part.text = rewritten.slice(start, end);
+                        start = end;
+                    }
+                }
+            }
+        }
+        // Commit only after the entire body passes: a refused request rewrites no
+        // lines upstream, even when an earlier line had the recognized format.
+        this.observation = {
+            requests: this.observation.requests,
+            linesRewritten: this.observation.linesRewritten + lines,
+            requestsWithoutDateLine: this.observation.requestsWithoutDateLine + (lines === 0 ? 1 : 0),
+            linesIgnored: (this.observation.linesIgnored ?? 0) + ignored,
+            injectedDate: lines === 0 ? this.observation.injectedDate : injectedDate,
+            taskDate: lines === 0 ? this.observation.taskDate : taskDate
+        };
+        return lines === 0 ? parsed.body : Buffer.from(JSON.stringify(parsed.value));
+    }
+    snapshot() {
+        return { ...this.observation };
+    }
+}
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Closed, dates-only observation on the v3 terminal frame and durable seal. */
+export function parseGrokBrokerProviderClockObservation(value) {
+    if (!isRecord(value))
+        throw new TypeError("invalid broker frame");
+    const fields = ["requests", "linesRewritten", "requestsWithoutDateLine", "injectedDate", "taskDate"];
+    if (Object.keys(value).some((key) => !fields.includes(key) && key !== "linesIgnored") ||
+        fields.some((key) => !Object.hasOwn(value, key))) {
+        throw new TypeError("invalid broker frame");
+    }
+    for (const key of [...fields.slice(0, 3), ...(Object.hasOwn(value, "linesIgnored") ? ["linesIgnored"] : [])]) {
+        if (!Number.isSafeInteger(value[key]) || value[key] < 0) {
+            throw new TypeError("invalid broker frame");
+        }
+    }
+    const result = value;
+    if (result.requestsWithoutDateLine > result.requests ||
+        (result.linesRewritten > 0 && result.requestsWithoutDateLine === result.requests)) {
+        throw new TypeError("invalid broker frame");
+    }
+    for (const date of [result.injectedDate, result.taskDate]) {
+        if (result.linesRewritten === 0 ? date !== null : typeof date !== "string" || !DATE.test(date)) {
+            throw new TypeError("invalid broker frame");
+        }
+    }
+    return { ...result };
+}