@noopolis/daimon 0.2.0 → 0.2.1

package/dist/runtime/engineBrokerServiceConfig.js

@@ -5,6 +5,7 @@ import { grokWorkerEventsPathFor } from "./grokWorkerSandboxProfile.js";
 import { TURN_REQUEST_LEDGER } from "./turnRequestLedger.js";
 import { TURN_USAGE_LEDGER } from "./turnUsageLedger.js";
 export const ENGINE_BROKER_SERVICE_V1 = "noopolis.daimon.engine-broker-service.v1";
+export const ENGINE_BROKER_SERVICE_V3 = "noopolis.daimon.engine-broker-service.v3";
 export const ENGINE_BROKER_SERVICE_V2 = "noopolis.daimon.engine-broker-service.v2";
 const V1_REGISTRATION = ["agentId", "slot", "workerUid", "workspace", "profilePath", "eventsPath", "profileSha256"];
 const V2_REGISTRATION = [...V1_REGISTRATION, "usageLedgerPath", "limits", "model"];
@@ -29,6 +30,8 @@ export const engineBrokerSealLedgerPathFor = (usageLedgerPath) => path.posix.joi
 /**
  * Strict `service.json` parser.
  *
+ * v3 retains seven-field registrations and binds slotPolicies by slot; agent IDs
+ * may repeat, while worker UIDs, slots and ledger streams must be distinct.
  * v2 requires every registration to declare its usage ledger, limits and model
  * (`model.id`/`model.reasoningEffort` from the closed lists); unknown keys at
  * any level are refused. v1 is still accepted and receives today's defaults:
@@ -38,39 +41,74 @@ export const engineBrokerSealLedgerPathFor = (usageLedgerPath) => path.posix.joi
 export function parseEngineBrokerServiceConfig(value) {
     if (!plain(value))
         throw invalid();
-    const v2 = value.version === ENGINE_BROKER_SERVICE_V2;
+    const v3 = value.version === ENGINE_BROKER_SERVICE_V3;
+    const v2 = v3 || value.version === ENGINE_BROKER_SERVICE_V2;
     if (!v2 && value.version !== ENGINE_BROKER_SERVICE_V1)
         throw invalid();
-    const top = ["version", "credentialHome", "turnStore", "registrations"];
+    const top = ["version", "credentialHome", "turnStore", "registrations", ...(v3 ? ["slotPolicies"] : [])];
+    if (v3 && Object.hasOwn(value, "maxRunRequests")) {
+        if (!Number.isSafeInteger(value.maxRunRequests) || value.maxRunRequests < 1)
+            throw invalid();
+        top.push("maxRunRequests");
+    }
+    if (v3 && Object.hasOwn(value, "runRequestStore")) {
+        if (!absolute(value.runRequestStore) || value.maxRunRequests === undefined)
+            throw invalid();
+        top.push("runRequestStore");
+    }
     exact(value, v2 && Object.hasOwn(value, "inferenceLedgerPath") ? [...top, "inferenceLedgerPath"] : top);
     if (!absolute(value.credentialHome) || !absolute(value.turnStore) || !Array.isArray(value.registrations) || value.registrations.length === 0)
         throw invalid();
-    const seen = new Set(), slots = new Set();
+    const policies = new Map();
+    if (v3) {
+        if (!Array.isArray(value.slotPolicies) || value.slotPolicies.length !== value.registrations.length)
+            throw invalid();
+        for (const policy of value.slotPolicies) {
+            if (!plain(policy))
+                throw invalid();
+            exact(policy, ["slot", "usageLedgerPath", "limits", "model"]);
+            if (!Number.isSafeInteger(policy.slot) || policy.slot < 0 || policies.has(policy.slot))
+                throw invalid();
+            policies.set(policy.slot, policy);
+        }
+    }
+    const seen = new Set(), slots = new Set(), workers = new Set();
+    const ledgers = new Set();
     const registrations = value.registrations.map((entry) => {
         if (!plain(entry))
             throw invalid();
-        exact(entry, v2 ? V2_REGISTRATION : V1_REGISTRATION);
+        exact(entry, v2 && !v3 ? V2_REGISTRATION : V1_REGISTRATION);
         const { agentId, slot, workerUid, workspace, profilePath, eventsPath, profileSha256 } = entry;
-        if (typeof agentId !== "string" || !agentId.trim() || seen.has(agentId) || !Number.isSafeInteger(slot) || slot < 0 || slots.has(slot) || !Number.isSafeInteger(workerUid) || workerUid < 2200 || !absolute(workspace) || !absolute(profilePath) || !absolute(eventsPath) || typeof profileSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(profileSha256) || eventsPath !== grokWorkerEventsPathFor(profilePath) || !profilePath.endsWith("/sandbox.toml"))
+        if (typeof agentId !== "string" || !agentId.trim() || (!v3 && seen.has(agentId)) || !Number.isSafeInteger(slot) || slot < 0 || slots.has(slot) || !Number.isSafeInteger(workerUid) || workerUid < 2200 || workers.has(workerUid) || !absolute(workspace) || !absolute(profilePath) || !absolute(eventsPath) || typeof profileSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(profileSha256) || eventsPath !== grokWorkerEventsPathFor(profilePath) || !profilePath.endsWith("/sandbox.toml"))
             throw invalid();
         seen.add(agentId);
         slots.add(slot);
+        workers.add(workerUid);
         const base = { agentId, slot: slot, workerUid: workerUid, workspace, profilePath, eventsPath, profileSha256 };
         if (!v2)
             return { ...base, usageLedgerPath: TURN_USAGE_LEDGER.filePath, limits: DEFAULT_GROK_BROKER_TURN_LIMITS, model: DEFAULT_GROK_BROKER_MODEL_POLICY };
-        const usageLedgerPath = entry.usageLedgerPath;
+        const policy = v3 ? policies.get(slot) : entry;
+        if (policy === undefined)
+            throw invalid();
+        const usageLedgerPath = policy.usageLedgerPath;
         if (!ledgerPath(usageLedgerPath) || usageLedgerPath === engineBrokerRequestLedgerPathFor(usageLedgerPath) || usageLedgerPath === engineBrokerSealLedgerPathFor(usageLedgerPath))
             throw invalid();
+        const streams = [usageLedgerPath, engineBrokerRequestLedgerPathFor(usageLedgerPath), engineBrokerSealLedgerPathFor(usageLedgerPath)];
+        if (v3 && streams.some((file) => ledgers.has(file)))
+            throw invalid();
+        streams.forEach((file) => ledgers.add(file));
         let limits;
         try {
-            limits = parseEngineBrokerTurnLimits(entry.limits);
+            limits = parseEngineBrokerTurnLimits(policy.limits);
         }
         catch {
             throw invalid();
         }
-        return { ...base, usageLedgerPath, limits, model: parseServiceModel(entry.model) };
+        return { ...base, usageLedgerPath, limits, model: parseServiceModel(policy.model) };
     });
-    const base = { credentialHome: value.credentialHome, turnStore: value.turnStore, registrations };
+    const base = { credentialHome: value.credentialHome, turnStore: value.turnStore, registrations,
+        ...(value.runRequestStore === undefined ? {} : { runRequestStore: value.runRequestStore }),
+        ...(value.maxRunRequests === undefined ? {} : { maxRunRequests: value.maxRunRequests }) };
     if (!Object.hasOwn(value, "inferenceLedgerPath"))
         return base;
     const inferenceLedgerPath = value.inferenceLedgerPath;

package/dist/runtime/engineBrokerTurnRegistry.d.ts

@@ -48,7 +48,7 @@ export declare class EngineBrokerTurnRegistry {
 }
 /**
  * Strict record parser. v2 accepts exactly `{version,digest,state,bootId}`
- * plus `response` and its sealed `ledger` bytes when terminal, and the response must be a v2 terminal frame.
+ * plus `response` and its sealed `ledger` bytes when terminal, and the response may be a v2, v3 or v4 terminal frame (older frames upgrade on read).
  * v1 records keep their historical looser shape and are upgraded on read: no
  * usage (`null`), zero requests, `limitReason: "none"`, the declared model.
  */

package/dist/runtime/engineBrokerTurnRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engineBrokerTurnRegistry.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerTurnRegistry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkE,KAAK,mBAAmB,EAAE,KAAK,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACxK,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAwD,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE/H,KAAK,KAAK,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAClE,KAAK,QAAQ,GAAG,4BAA4B,CAAC;AAC7C,eAAO,MAAM,4BAA4B,EAAG,uCAAgD,CAAC;AAC7F,eAAO,MAAM,4BAA4B,EAAG,uCAAgD,CAAC;AAK7F,KAAK,QAAQ,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,4BAA4B,GAAG,OAAO,4BAA4B,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC;AAEpO;;;;;GAKG;AACH,qBAAa,wBAAwB;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAS,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAqB,OAAO,CAAC,QAAQ,CAAC,eAAe;IADtH,yGAAyG;gBAC5E,IAAI,EAAE,MAAM,EAAkB,MAAM,GAAC,MAAmB,EAAkB,eAAe,GAAC,CAAC,SAAS,EAAC,MAAM,KAAG,OAAO,CAAC,IAAI,CAAe;IACtK,gGAAgG;IAC1F,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,GAAG;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAC;IAW3H;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAE,qBAAgD,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAO5J;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,QAAQ,CAyB1F"}
+{"version":3,"file":"engineBrokerTurnRegistry.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerTurnRegistry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAmK,KAAK,mBAAmB,EAAE,KAAK,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzQ,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAwD,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE/H,KAAK,KAAK,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAClE,KAAK,QAAQ,GAAG,4BAA4B,CAAC;AAC7C,eAAO,MAAM,4BAA4B,EAAG,uCAAgD,CAAC;AAC7F,eAAO,MAAM,4BAA4B,EAAG,uCAAgD,CAAC;AAM7F,KAAK,QAAQ,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,4BAA4B,GAAG,OAAO,4BAA4B,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC;AAEpO;;;;;GAKG;AACH,qBAAa,wBAAwB;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAS,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAqB,OAAO,CAAC,QAAQ,CAAC,eAAe;IADtH,yGAAyG;gBAC5E,IAAI,EAAE,MAAM,EAAkB,MAAM,GAAC,MAAmB,EAAkB,eAAe,GAAC,CAAC,SAAS,EAAC,MAAM,KAAG,OAAO,CAAC,IAAI,CAAe;IACtK,gGAAgG;IAC1F,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,GAAG;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAC;IAW3H;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAE,qBAAgD,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAO5J;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,QAAQ,CAyB1F"}

package/dist/runtime/engineBrokerTurnRegistry.js

@@ -2,13 +2,14 @@ import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import path from "node:path";
-import { parseEngineBrokerResponse, parseEngineBrokerV1TerminalResponse } from "./engineBrokerProtocol.js";
+import { ENGINE_BROKER_VERSION, parseEngineBrokerResponse, parseEngineBrokerV1TerminalResponse, parseEngineBrokerV2TerminalResponse, parseEngineBrokerV3TerminalResponse } from "./engineBrokerProtocol.js";
 import { EMPTY_BROKER_TURN_LEDGER, parseBrokerTurnLedgerLines } from "./grokEngineBrokerLedger.js";
 export const ENGINE_BROKER_TURN_RECORD_V1 = "noopolis.daimon.engine-broker-turn.v1";
 export const ENGINE_BROKER_TURN_RECORD_V2 = "noopolis.daimon.engine-broker-turn.v2";
 // The digest deliberately excludes `limits` and the protocol version, so a v1
-// record written before the upgrade still identifies the same turn.
-const digest = (request) => createHash("sha256").update(JSON.stringify([request.turnId, request.agentId, request.wakeId, request.prompt, request.mcpEndpoint])).digest("hex");
+// record written before the upgrade still identifies the same unclocked turn.
+// A supplied process clock changes execution and must conflict with any other value.
+const digest = (request) => createHash("sha256").update(JSON.stringify([request.turnId, request.agentId, request.wakeId, request.prompt, request.mcpEndpoint, ...(request.processClock === undefined ? [] : [request.processClock])])).digest("hex");
 const safe = (turnId) => `${createHash("sha256").update(turnId).digest("hex")}.json`;
 /**
  * Durable per-turn state. Record v2 stores the terminal response *with* its
@@ -97,7 +98,7 @@ export class EngineBrokerTurnRegistry {
 }
 /**
  * Strict record parser. v2 accepts exactly `{version,digest,state,bootId}`
- * plus `response` and its sealed `ledger` bytes when terminal, and the response must be a v2 terminal frame.
+ * plus `response` and its sealed `ledger` bytes when terminal, and the response may be a v2, v3 or v4 terminal frame (older frames upgrade on read).
  * v1 records keep their historical looser shape and are upgraded on read: no
  * usage (`null`), zero requests, `limitReason: "none"`, the declared model.
  */
@@ -126,7 +127,7 @@ export function parseEngineBrokerTurnRecord(text, model) {
             throw new Error("broker turn registry unavailable");
         }
         const accounting = { outcome: legacy.kind, usage: null, model, requests: 0, limitReason: "none" };
-        const response = { ...legacy, ...accounting, version: "noopolis.daimon.engine-broker.v2" };
+        const response = { ...legacy, ...accounting, version: ENGINE_BROKER_VERSION };
         return { version: ENGINE_BROKER_TURN_RECORD_V1, ...base, response };
     }
     if (input.version !== ENGINE_BROKER_TURN_RECORD_V2)
@@ -138,7 +139,7 @@ export function parseEngineBrokerTurnRecord(text, model) {
         return { version: ENGINE_BROKER_TURN_RECORD_V2, ...base };
     let response;
     try {
-        response = parseEngineBrokerResponse(input.response);
+        response = input.response?.version === "noopolis.daimon.engine-broker.v2" ? parseEngineBrokerV2TerminalResponse(input.response) : input.response?.version === "noopolis.daimon.engine-broker.v3" ? parseEngineBrokerV3TerminalResponse(input.response) : parseEngineBrokerResponse(input.response);
     }
     catch {
         throw new Error("broker turn registry unavailable");

package/dist/runtime/engineDispatcher.d.ts

@@ -11,6 +11,8 @@ export declare function startOrganizationRuntimeEngine(agent: OrganizationRuntim
 export declare function grokSandboxProtectedPaths(currentAgentId: string, organizationAgents: readonly OrganizationRuntimeAgentConfig[], sharedProtectedPaths?: readonly string[]): readonly string[];
 export declare function codexSandboxProtectedPaths(currentAgentId: string, currentAgent: OrganizationRuntimeAgentConfig, currentEngineHomePath: string, organizationAgents: readonly OrganizationRuntimeAgentConfig[], sharedProtectedPaths?: readonly string[]): readonly string[];
 export declare function codexSandboxReadablePaths(currentAgent: OrganizationRuntimeAgentConfig): readonly string[];
+/** @internal The same callback used by the production session; no native process clock enters the engine environment. */
+export declare function grokBrokerTurnFor(agent: OrganizationRuntimeAgentConfig, grokBroker: EngineBrokerTurnClient, wakeEnvironmentContext: import("../pi/piAgentWakeSupport.js").PiWakeEnvironmentContextRef): (prompt: string, endpoint: string, signal: AbortSignal) => Promise<string>;
 /**
  * CLI engines do not consume Pi's resource loader. Frame the same immutable
  * identity in JSON so arbitrary names/instructions cannot change its shape.

package/dist/runtime/engineDispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engineDispatcher.d.ts","sourceRoot":"","sources":["../../src/runtime/engineDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQpD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAM7E;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,8BAA8B,EACrC,eAAe,EAAE,MAAM,EACvB,KAAK,CAAC,EAAE,UAAU,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAC,EAChE,aAAa,CAAC,EAAE,MAAM,EACtB,UAAU,CAAC,EAAE,sBAAsB,EACnC,kBAAkB,CAAC,EAAE,SAAS,8BAA8B,EAAE,EAC9D,oBAAoB,GAAE,SAAS,MAAM,EAAO,EAC5C,SAAS,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA8CtB;AAED,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,oBAAoB,GAAE,SAAS,MAAM,EAAO,GAC3C,SAAS,MAAM,EAAE,CAYnB;AAED,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,8BAA8B,EAC5C,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,oBAAoB,GAAE,SAAS,MAAM,EAAO,GAC3C,SAAS,MAAM,EAAE,CAQnB;AAED,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,8BAA8B,GAC3C,SAAS,MAAM,EAAE,CAEnB;AAwDD;;;GAGG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAkBxH"}
+{"version":3,"file":"engineDispatcher.d.ts","sourceRoot":"","sources":["../../src/runtime/engineDispatcher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAMxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQpD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAM7E;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,8BAA8B,EACrC,eAAe,EAAE,MAAM,EACvB,KAAK,CAAC,EAAE,UAAU,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAC,EAChE,aAAa,CAAC,EAAE,MAAM,EACtB,UAAU,CAAC,EAAE,sBAAsB,EACnC,kBAAkB,CAAC,EAAE,SAAS,8BAA8B,EAAE,EAC9D,oBAAoB,GAAE,SAAS,MAAM,EAAO,EAC5C,SAAS,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAiDtB;AAED,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,oBAAoB,GAAE,SAAS,MAAM,EAAO,GAC3C,SAAS,MAAM,EAAE,CAYnB;AAED,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,8BAA8B,EAC5C,qBAAqB,EAAE,MAAM,EAC7B,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,oBAAoB,GAAE,SAAS,MAAM,EAAO,GAC3C,SAAS,MAAM,EAAE,CAQnB;AAED,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,8BAA8B,GAC3C,SAAS,MAAM,EAAE,CAEnB;AAkDD,yHAAyH;AACzH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,UAAU,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,OAAO,6BAA6B,EAAE,2BAA2B,IAG5L,QAAQ,MAAM,EAAE,UAAU,MAAM,EAAE,QAAQ,WAAW,qBAI9D;AAED;;;GAGG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAkBxH"}

package/dist/runtime/engineDispatcher.js

@@ -1,4 +1,8 @@
+import { brokerProcessClock } from "./grokBrokerTaskClock.js";
+import { reportEngineTaskClockGap } from "../pi/engineTaskClock.js";
 import { attentionTools } from "./attention.js";
+import { readTaskClock } from "./taskClock.js";
+import { memoryClockOptions } from "../pi/memoryClock.js";
 import { grokDaimonToolName, grokMountedToolNamingRule } from "../contracts/grokWorkerContract.js";
 import path from "node:path";
 import { AGY_MAX_TOOL_TURNS, createCliSessionFactory, resolveCodexWakeTimeoutMs, resolveCodexWakeTokenCeiling, resolveEngineWakeLimitOverrides } from "../pi/cliSession.js";
@@ -14,6 +18,10 @@ import { recordCodexTurnRequests } from "./turnRequestLedger.js";
  * existing one-agent harness. Configuration never carries a command or env.
  */
 export async function startOrganizationRuntimeEngine(agent, controlTokenEnv, paths, agyBusAddress, grokBroker, organizationAgents, sharedProtectedPaths = [], attention) {
+    const clock = readTaskClock();
+    reportEngineTaskClockGap(agent.engine.kind);
+    if (agent.memory !== undefined)
+        memoryClockOptions(clock);
     // A declared Grok model is enforced by the broker proxy and worker config;
     // the direct path has neither, so it refuses rather than silently ignoring it.
     if (agent.engine.kind === "grok" && agent.engine.model !== undefined && grokBroker === undefined)
@@ -137,10 +145,14 @@ function adapterFor(agent, controlTokenEnv, verifyExecutable, executablePath, en
             } : {}) });
     return cliHarness(agent, sessionFactory, [controlTokenEnv], productionTools, wakeEnvironmentContext);
 }
-function grokBrokerTurnFor(agent, grokBroker, wakeEnvironmentContext) {
+/** @internal The same callback used by the production session; no native process clock enters the engine environment. */
+export function grokBrokerTurnFor(agent, grokBroker, wakeEnvironmentContext) {
     const limits = resolveEngineWakeLimitOverrides();
     const options = { ...(limits === undefined ? {} : { limits }), ...(agent.engine.model === undefined ? {} : { model: agent.engine.model }) };
-    return (prompt, endpoint, signal) => grokBroker.turn(agent.id, wakeEnvironmentContext.current ?? "wake", prompt, endpoint, signal, options);
+    return (prompt, endpoint, signal) => {
+        const processClock = brokerProcessClock();
+        return grokBroker.turn(agent.id, wakeEnvironmentContext.current ?? "wake", prompt, endpoint, signal, { ...options, ...(processClock === undefined ? {} : { processClock }) });
+    };
 }
 /**
  * CLI engines do not consume Pi's resource loader. Frame the same immutable

package/dist/runtime/engineReadiness.js

@@ -1,7 +1,7 @@
 import { constants } from "node:fs";
 import { lstat, open, realpath, stat } from "node:fs/promises";
 import path from "node:path";
-import { spawn } from "node:child_process";
+import { spawnRealTime as spawn } from "./taskClockProcess.js";
 import { createHash } from "node:crypto";
 import { cliChildEnvironment } from "../pi/cliEnvironment.js";
 import { hasRefreshablePortableCredential, portableCredentialSecretValues } from "./portableCredentialAuth.js";

package/dist/runtime/grokBrokerCredentialAuthority.d.ts

@@ -9,6 +9,7 @@ export declare class DurableGrokBrokerCredentialAuthority {
     private staleWrite;
     private lastDigest;
     private generation;
+    private ancestorDigests;
     constructor(command: string, home: string, authFile?: string);
     initialize(): Promise<void>;
     accessToken(forceRefresh: boolean): Promise<string>;

package/dist/runtime/grokBrokerCredentialAuthority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerCredentialAuthority.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialAuthority.ts"],"names":[],"mappings":"AAUA,qBAAa,oCAAoC;IAEnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADtG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAAC,OAAO,CAAC,KAAK,CAAS;IAAA,OAAO,CAAC,WAAW,CAAO;IAAA,OAAO,CAAC,UAAU,CAAyB;IAAA,OAAO,CAAC,UAAU,CAAkB;IAAA,OAAO,CAAC,UAAU,CAAG;gBACrP,OAAO,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM,EAAmB,QAAQ,SAA+B;IAC/H,UAAU,IAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,WAAW,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,qBAAqB,CAAC,mBAAmB,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC;IACvE,OAAO,CAAC,OAAO;IAOT,YAAY,CAAC,mBAAmB,CAAC,EAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,OAAO,IAAG,OAAO;IACjB,OAAO,CAAC,SAAS;YACH,KAAK;CAKpB"}
+{"version":3,"file":"grokBrokerCredentialAuthority.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialAuthority.ts"],"names":[],"mappings":"AAUA,qBAAa,oCAAoC;IAGnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAFtG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAAC,OAAO,CAAC,KAAK,CAAS;IAAA,OAAO,CAAC,WAAW,CAAO;IAAA,OAAO,CAAC,UAAU,CAAyB;IAAA,OAAO,CAAC,UAAU,CAAkB;IAAA,OAAO,CAAC,UAAU,CAAG;IAClR,OAAO,CAAC,eAAe,CAAyB;gBACnB,OAAO,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM,EAAmB,QAAQ,SAA+B;IAC/H,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC3B,WAAW,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,qBAAqB,CAAC,mBAAmB,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC;IACvE,OAAO,CAAC,OAAO;IAYT,YAAY,CAAC,mBAAmB,CAAC,EAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,OAAO,IAAG,OAAO;IACjB,OAAO,CAAC,SAAS;YACH,KAAK;CAKpB"}

package/dist/runtime/grokBrokerCredentialAuthority.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { readGrokBrokerCredential } from "./grokBrokerCredentialReader.js";
 import { refreshGrokBrokerCredential } from "./grokBrokerRefresh.js";
 import { EngineBrokerGenerationFence, EngineBrokerSingleflight } from "./engineBrokerSingleflight.js";
-import { parseBrokerCredentialJournal, recoverBrokerCredentialJournal } from "./engineBrokerCredentialJournal.js";
+import { BROKER_CREDENTIAL_MAX_ANCESTORS, parseBrokerCredentialJournal, recoverBrokerCredentialJournal } from "./engineBrokerCredentialJournal.js";
 export class DurableGrokBrokerCredentialAuthority {
     command;
     home;
@@ -18,33 +18,52 @@ export class DurableGrokBrokerCredentialAuthority {
     staleWrite;
     lastDigest;
     generation = 0;
+    ancestorDigests = [];
     constructor(command, home, authFile = path.join(home, "auth.json")) {
         this.command = command;
         this.home = home;
         this.authFile = authFile;
     }
-    async initialize() { if (this.initialized)
-        return; const credential = await readGrokBrokerCredential(this.authFile); this.lastDigest = credential.digest; const file = path.join(this.home, ".daimon-broker", "credential-journal.json"); let handle; try {
-        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
-        const stat = await handle.stat();
-        if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.size > 4096)
-            throw unavailable();
-        const journal = parseBrokerCredentialJournal(JSON.parse(await handle.readFile("utf8")));
-        if (recoverBrokerCredentialJournal(journal, credential.digest) === "stale") {
+    async initialize() {
+        if (this.initialized)
+            return;
+        const credential = await readGrokBrokerCredential(this.authFile);
+        this.lastDigest = credential.digest;
+        const file = path.join(this.home, ".daimon-broker", "credential-journal.json");
+        let handle;
+        try {
+            handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.size > 65536)
+                throw unavailable();
+            const journal = parseBrokerCredentialJournal(JSON.parse(await handle.readFile("utf8")));
             this.generation = journal.generation;
-            await this.markStale();
-            throw unavailable();
+            if (recoverBrokerCredentialJournal(journal, credential.digest) === "stale") {
+                await this.markStale();
+                throw unavailable();
+            }
+            this.ancestorDigests = [...new Set([...(journal.ancestorDigests ?? []), journal.sourceDigest])]
+                .filter((digest) => digest !== credential.digest);
+            if (journal.state === "refreshing") {
+                // The durable credential still matches the pre-exchange source. Settle
+                // before serving it so writeback and drain need no subsequent refresh.
+                // No exchange completed: preserve the generation and existing lineage.
+                await this.write({ state: "promoted", generation: journal.generation,
+                    sourceDigest: credential.digest, promotedDigest: credential.digest });
+            }
+            this.fence.restore(journal.generation);
         }
-        this.generation = journal.generation;
-        this.fence.restore(journal.generation);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw unavailable();
+        catch (error) {
+            // Only a missing journal on open is an unjournaled bootstrap. A failed
+            // recovery write (including ENOENT) must never publish readiness.
+            if (handle !== undefined || error.code !== "ENOENT")
+                throw unavailable();
+        }
+        finally {
+            await handle?.close().catch(() => undefined);
+        }
+        this.initialized = true;
     }
-    finally {
-        await handle?.close().catch(() => undefined);
-    } this.initialized = true; }
     async accessToken(forceRefresh) {
         if (!this.initialized)
             await this.initialize();
@@ -64,6 +83,11 @@ export class DurableGrokBrokerCredentialAuthority {
             const before = await readGrokBrokerCredential(this.authFile);
             if (rejectedTokenDigest !== undefined && createHash("sha256").update(before.accessToken).digest("hex") !== rejectedTokenDigest)
                 return before.accessToken;
+            // Never spend a refresh whose lineage cannot be persisted. Advancing expiry
+            // normally clears the history, so this bound applies to one expiry epoch.
+            const ancestors = [...new Set([...this.ancestorDigests, before.digest])];
+            if (ancestors.length > BROKER_CREDENTIAL_MAX_ANCESTORS)
+                throw unavailable();
             try {
                 await this.write({ state: "refreshing", generation, sourceDigest: before.digest });
                 await refreshGrokBrokerCredential(this.command, this.home);
@@ -72,7 +96,9 @@ export class DurableGrokBrokerCredentialAuthority {
                     throw unavailable();
                 const next = this.fence.promote(generation);
                 this.generation = next;
-                await this.write({ state: "promoted", generation: next, sourceDigest: before.digest, promotedDigest: after.digest });
+                const ancestorDigests = before.expiresAt !== undefined && after.expiresAt !== undefined && after.expiresAt > before.expiresAt ? [] : ancestors;
+                await this.write({ state: "promoted", generation: next, sourceDigest: before.digest, promotedDigest: after.digest, ancestorDigests });
+                this.ancestorDigests = ancestorDigests;
                 this.lastDigest = after.digest;
                 return after.accessToken;
             }
@@ -100,7 +126,7 @@ export class DurableGrokBrokerCredentialAuthority {
         const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
         const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
         try {
-            await handle.writeFile(`${JSON.stringify({ version: "noopolis.daimon.broker-credential-journal.v1", ...value })}\n`);
+            await handle.writeFile(`${JSON.stringify({ version: "noopolis.daimon.broker-credential-journal.v1", ancestorDigests: this.ancestorDigests, ...value })}\n`);
             await handle.sync();
         }
         finally {

package/dist/runtime/grokBrokerCredentialReader.d.ts

@@ -1,5 +1,6 @@
 export declare function readGrokBrokerCredential(file: string): Promise<Readonly<{
     accessToken: string;
     digest: string;
+    expiresAt?: number;
 }>>;
 //# sourceMappingURL=grokBrokerCredentialReader.d.ts.map

package/dist/runtime/grokBrokerCredentialReader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerCredentialReader.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialReader.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAUvH"}
+{"version":3,"file":"grokBrokerCredentialReader.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialReader.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW3I"}

package/dist/runtime/grokBrokerCredentialReader.js

@@ -22,7 +22,8 @@ export async function readGrokBrokerCredential(file) {
         const rows = Object.values(root).filter((value) => value !== null && typeof value === "object" && !Array.isArray(value));
         if (rows.length !== 1 || typeof rows[0].key !== "string" || rows[0].key.length < 32 || typeof rows[0].refresh_token !== "string" || rows[0].refresh_token.length < 16)
             throw new Error();
-        return { accessToken: rows[0].key, digest: createHash("sha256").update(bytes).digest("hex") };
+        const expiresAt = typeof rows[0].expires_at === "string" ? Date.parse(rows[0].expires_at) : NaN;
+        return { accessToken: rows[0].key, digest: createHash("sha256").update(bytes).digest("hex"), ...(Number.isFinite(expiresAt) ? { expiresAt } : {}) };
     }
     catch {
         throw new Error("Grok broker credential authority unavailable");

package/dist/runtime/grokBrokerProjection.d.ts

@@ -1,8 +1,9 @@
+import { GROK_BROKER_TASK_CLOCK, type GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
 import { type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
 import { type EngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
 import type { GrokBrokerModel, GrokBrokerReasoningEffort } from "./grokBrokerModelPolicy.js";
 import { GROK_WORKER_SANDBOX_PROFILE } from "./grokWorkerSandboxProfile.js";
-export declare const GROK_BROKER_PROJECTION_VERSION: "noopolis.daimon.grok-broker-projection.v1";
+export declare const GROK_BROKER_PROJECTION_VERSION: "noopolis.daimon.grok-broker-projection.v3";
 /**
  * Everything a consumer (Spawnfile provisioning, Paideia's native adapter, the
  * root slot supervisor) needs to know about one brokered Grok agent's slot,
@@ -20,6 +21,11 @@ export type OrganizationGrokBrokerProjection = Readonly<{
     profileSha256: string;
     denyPaths: readonly string[];
     workerConfigSha256: string;
+    workerConfigVariant: GrokWorkerConfigVariant;
+    taskClock?: Omit<typeof GROK_BROKER_TASK_CLOCK, "directoryPath" | "timestampFilePath"> & Readonly<{
+        directoryPath: string;
+        timestampFilePath: string;
+    }>;
     systemPromptSha256: string;
     grokCliVersion: string;
     grokExecutableSha256: string;
@@ -40,6 +46,8 @@ export type OrganizationGrokBrokerProjection = Readonly<{
     }>;
 }>;
 export type OrganizationGrokBrokerProjectionOptions = Readonly<{
+    /** Clocked configs require an isolated clock directory per slot. Defaults to the unchanged production bytes. */
+    workerConfigVariant?: GrokWorkerConfigVariant;
     /** Deployment-assigned slot identity. */
     slot: number;
     workerUid: number;

package/dist/runtime/grokBrokerProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerProjection.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProjection.ts"],"names":[],"mappings":"AAOA,OAAO,EAAkC,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAA2F,MAAM,+BAA+B,CAAC;AAGrK,eAAO,MAAM,8BAA8B,6CAAuC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;QAAC,cAAc,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjM,CAAC,CAAC;AAEH,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,GAAG,gCAAgC,CA8B5K;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,GAAI,YAAY,gCAAgC,KAAG,MACpB,CAAC;AAEvE,4HAA4H;AAC5H,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQhI;AAED;;;;GAIG;AACH,wBAAgB,6CAA6C,CAAC,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,gCAAgC,GAAG,IAAI,CAG/J"}
+{"version":3,"file":"grokBrokerProjection.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAQ3G,OAAO,EAAkC,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAA2F,MAAM,+BAA+B,CAAC;AAGrK,eAAO,MAAM,8BAA8B,6CAAuC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,sBAAsB,EAAE,eAAe,GAAG,mBAAmB,CAAC,GAAG,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxJ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;QAAC,cAAc,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjM,CAAC,CAAC;AAEH,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,gHAAgH;IAChH,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,GAAG,gCAAgC,CAkC5K;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,GAAI,YAAY,gCAAgC,KAAG,MACpB,CAAC;AAEvE,4HAA4H;AAC5H,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQhI;AAED;;;;GAIG;AACH,wBAAgB,6CAA6C,CAAC,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,gCAAgC,GAAG,IAAI,CAG/J"}

package/dist/runtime/grokBrokerProjection.js

@@ -1,3 +1,5 @@
+import { brokerTaskClockFileFor } from "./grokBrokerSlot.js";
+import { GROK_BROKER_TASK_CLOCK } from "../contracts/grokBrokerTaskClock.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { canonicalJson } from "../contracts/canonicalJson.js";
@@ -6,7 +8,7 @@ import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
 import { grokSandboxProtectedPaths } from "./engineDispatcher.js";
 import { parseEngineBrokerServiceConfig } from "./engineBrokerServiceConfig.js";
 import { parseEngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
-import { grokBrokerWorkerConfigSha256 } from "./grokBrokerWorkerConfig.js";
+import { grokBrokerWorkerConfigPins, grokBrokerWorkerConfigSha256 } from "./grokBrokerWorkerConfig.js";
 import { GROK_WORKER_SANDBOX_PROFILE, grokWorkerEventsPathFor, renderGrokWorkerSandboxProfile, grokWorkerSandboxProfileSha256 } from "./grokWorkerSandboxProfile.js";
 import { parseOrganizationRuntimeConfig } from "./organizationRuntime.js";
 export const GROK_BROKER_PROJECTION_VERSION = GROK_ENGINE_BROKER.projectionVersion;
@@ -50,8 +52,12 @@ export function resolveOrganizationGrokBrokerProjection(config, agentId, options
     const profileSha256 = grokWorkerSandboxProfileSha256(denyPaths);
     if (options.profileSha256 !== undefined && options.profileSha256 !== profileSha256)
         throw new Error("Grok broker projection profile digest mismatch");
-    const workerConfigSha256 = grokBrokerWorkerConfigSha256({ model, reasoningEffort });
-    if (workerConfigSha256 !== GROK_ENGINE_BROKER.worker.configSha256[model][reasoningEffort])
+    const workerConfigVariant = options.workerConfigVariant ?? "unclocked";
+    const workerConfigSha256 = grokBrokerWorkerConfigSha256({ model, reasoningEffort }, workerConfigVariant, options.slot);
+    const pin = grokBrokerWorkerConfigPins({ model, reasoningEffort }, options.slot)[workerConfigVariant];
+    if (workerConfigVariant === "clocked" && denyPaths.some((denied) => [brokerTaskClockFileFor(options.slot), GROK_BROKER_TASK_CLOCK.preloadPath].some((file) => file === denied || file.startsWith(`${denied}/`))))
+        throw new Error("Grok broker task clock path is denied");
+    if (workerConfigSha256 !== pin)
         throw new Error("Grok broker projection worker config drifted from the manifest");
     if (createHash("sha256").update(DAIMON_GROK_SYSTEM_PROMPT).digest("hex") !== GROK_ENGINE_BROKER.worker.systemPromptSha256)
         throw new Error("Grok broker projection system prompt drifted from the manifest");
@@ -61,7 +67,8 @@ export function resolveOrganizationGrokBrokerProjection(config, agentId, options
     const profilePath = path.posix.join(options.workerHomePath, ".grok", "sandbox.toml");
     const projection = {
         version: GROK_BROKER_PROJECTION_VERSION, agentId, workspacePath: agent.workspacePath, runtimeHomePath: agent.runtimeHomePath,
-        workerUid: options.workerUid, slot: options.slot, profilePath, profileSha256, denyPaths, workerConfigSha256,
+        workerUid: options.workerUid, slot: options.slot, profilePath, profileSha256, denyPaths, workerConfigSha256, workerConfigVariant,
+        ...(workerConfigVariant === "clocked" ? { taskClock: { ...GROK_BROKER_TASK_CLOCK, directoryPath: path.posix.dirname(brokerTaskClockFileFor(options.slot)), timestampFilePath: brokerTaskClockFileFor(options.slot) } } : {}),
         systemPromptSha256: GROK_ENGINE_BROKER.worker.systemPromptSha256, grokCliVersion: GROK_ENGINE_BROKER.grokCliVersion, grokExecutableSha256: artifact.sha256,
         nativeAbiVersion: GROK_ENGINE_BROKER.nativeAbiVersion, model, reasoningEffort, limits: parseEngineBrokerTurnLimits(options.limits), usageLedgerPath: options.usageLedgerPath, seccompProfileSha256: options.seccompProfileSha256,
         attestation: { platform: "linux/landlock", enforced: true, restrictNetwork: true, profileName: GROK_WORKER_SANDBOX_PROFILE, sandboxRuntime: "bubblewrap", eventsPath: grokWorkerEventsPathFor(profilePath) }

package/dist/runtime/grokBrokerProviderClock.d.ts

@@ -0,0 +1,26 @@
+export type GrokBrokerProviderClockObservation = Readonly<{
+    requests: number;
+    linesRewritten: number;
+    requestsWithoutDateLine: number;
+    /** Date-like message lines outside the injected block; absent on older seals. */
+    linesIgnored?: number;
+    /** The last rewritten line's dates; null until a line is rewritten. */
+    injectedDate: string | null;
+    taskDate: string | null;
+}>;
+export declare class GrokBrokerProviderClockRefusal extends Error {
+    readonly reason: "task_clock_date_format" | "task_clock_date_range" | "request_body_rejected";
+    constructor(reason: "task_clock_date_format" | "task_clock_date_range" | "request_body_rejected");
+}
+/** One processClock, owned by one turn; never reads the broker's ambient TZ. */
+export declare class GrokBrokerProviderClock {
+    private readonly now;
+    private readonly offsetMs;
+    private observation;
+    constructor(processClock: string, now?: () => number);
+    rewrite(body: Uint8Array): Uint8Array;
+    snapshot(): GrokBrokerProviderClockObservation;
+}
+/** Closed, dates-only observation on the v3 terminal frame and durable seal. */
+export declare function parseGrokBrokerProviderClockObservation(value: unknown): GrokBrokerProviderClockObservation;
+//# sourceMappingURL=grokBrokerProviderClock.d.ts.map

package/dist/runtime/grokBrokerProviderClock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerProviderClock.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProviderClock.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAAC;AAEH,qBAAa,8BAA+B,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,wBAAwB,GAAG,uBAAuB,GAAG,uBAAuB;gBAApF,MAAM,EAAE,wBAAwB,GAAG,uBAAuB,GAAG,uBAAuB;CAG1G;AAOD,gFAAgF;AAChF,qBAAa,uBAAuB;IAOA,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,WAAW,CAGjB;gBAEU,YAAY,EAAE,MAAM,EAAmB,GAAG,GAAE,MAAM,MAAyB;IAIvF,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU;IAuErC,QAAQ,IAAI,kCAAkC;CAG/C;AAKD,gFAAgF;AAChF,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,OAAO,GAAG,kCAAkC,CAuB1G"}