@noopolis/daimon 0.2.1 → 0.2.2

package/dist/runtime/agentSkillsDirectory.d.ts

@@ -0,0 +1,25 @@
+import { type AgentSkill } from "./grokWorkerSkills.js";
+/**
+ * What every entry of a skills tree must satisfy beyond being a plain,
+ * non-symlink directory or regular file. Attesting a root-provisioned
+ * `$GROK_HOME/skills` sets both; reading a compiled workspace leaves them unset.
+ */
+export type AgentSkillsTreePolicy = Readonly<{
+    ownerUid?: number;
+    readOnly?: boolean;
+}>;
+/**
+ * Reads a skills tree — `<root>/<name>/SKILL.md` plus any supporting files —
+ * into the engine-neutral {@link AgentSkill} input, or `undefined` when `root`
+ * does not exist.
+ *
+ * It is the same reader for both ends of the Grok skills path: provisioning
+ * reads the compiled workspace's `.agents/skills` (the tree Codex reads in
+ * place), and the broker re-reads the rendered `$GROK_HOME/skills` before every
+ * turn under a root-owned, read-only policy. Symlinks, special files, hard
+ * links (read-only policy), non-UTF-8 content and anything past the
+ * {@link AGENT_SKILLS_BOUNDS} are refused rather than skipped, because a
+ * skipped entry would make the attested digest describe less than Grok loads.
+ */
+export declare function readAgentSkillsDirectory(root: string, policy?: AgentSkillsTreePolicy): Promise<readonly AgentSkill[] | undefined>;
+//# sourceMappingURL=agentSkillsDirectory.d.ts.map

package/dist/runtime/agentSkillsDirectory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentSkillsDirectory.d.ts","sourceRoot":"","sources":["../../src/runtime/agentSkillsDirectory.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAEpH;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAKxF;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,qBAA0B,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,GAAG,SAAS,CAAC,CAqC3I"}

package/dist/runtime/agentSkillsDirectory.js

@@ -0,0 +1,101 @@
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
+import path from "node:path";
+import { AGENT_SKILLS_BOUNDS, parseAgentSkills } from "./grokWorkerSkills.js";
+const invalid = (detail) => new TypeError(`invalid agent skills directory: ${detail}`);
+const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+/**
+ * Reads a skills tree — `<root>/<name>/SKILL.md` plus any supporting files —
+ * into the engine-neutral {@link AgentSkill} input, or `undefined` when `root`
+ * does not exist.
+ *
+ * It is the same reader for both ends of the Grok skills path: provisioning
+ * reads the compiled workspace's `.agents/skills` (the tree Codex reads in
+ * place), and the broker re-reads the rendered `$GROK_HOME/skills` before every
+ * turn under a root-owned, read-only policy. Symlinks, special files, hard
+ * links (read-only policy), non-UTF-8 content and anything past the
+ * {@link AGENT_SKILLS_BOUNDS} are refused rather than skipped, because a
+ * skipped entry would make the attested digest describe less than Grok loads.
+ */
+export async function readAgentSkillsDirectory(root, policy = {}) {
+    let top;
+    try {
+        top = await lstat(root);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw invalid("unreadable root");
+    }
+    assertEntry(top, "directory", policy, ".");
+    const names = await boundedEntries(root, AGENT_SKILLS_BOUNDS.skills);
+    const skills = [];
+    let budget = AGENT_SKILLS_BOUNDS.totalBytes;
+    for (const name of names) {
+        const directory = path.join(root, name);
+        assertEntry(await lstat(directory), "directory", policy, name);
+        const files = [];
+        const walk = async (relative, depth) => {
+            for (const child of await boundedEntries(path.join(directory, relative), AGENT_SKILLS_BOUNDS.filesPerSkill)) {
+                const childRelative = relative === "" ? child : `${relative}/${child}`;
+                const absolute = path.join(directory, childRelative);
+                const where = `${name}/${childRelative}`;
+                const entry = await lstat(absolute);
+                if (entry.isDirectory()) {
+                    if (depth + 1 >= AGENT_SKILLS_BOUNDS.depth)
+                        throw invalid(`too deep at ${JSON.stringify(where)}`);
+                    assertEntry(entry, "directory", policy, where);
+                    await walk(childRelative, depth + 1);
+                    continue;
+                }
+                assertEntry(entry, "file", policy, where);
+                if (files.length >= AGENT_SKILLS_BOUNDS.filesPerSkill)
+                    throw invalid(`too many files in ${JSON.stringify(name)}`);
+                const content = await readPinnedFile(absolute, where, entry, Math.min(AGENT_SKILLS_BOUNDS.fileBytes, budget));
+                budget -= Buffer.byteLength(content, "utf8");
+                files.push({ path: childRelative, content });
+            }
+        };
+        await walk("", 0);
+        skills.push({ name, files });
+    }
+    return parseAgentSkills(skills);
+}
+/** `where` is the entry's path relative to the skills root, named in every refusal. */
+function assertEntry(entry, kind, policy, where) {
+    if (entry.isSymbolicLink() || (kind === "directory" ? !entry.isDirectory() : !entry.isFile()))
+        throw invalid(`expected a plain ${kind} at ${JSON.stringify(where)}`);
+    if (policy.ownerUid !== undefined && entry.uid !== policy.ownerUid)
+        throw invalid(`unexpected owner of ${JSON.stringify(where)}`);
+    if (policy.readOnly === true && ((Number(entry.mode) & 0o7222) !== 0 || (kind === "file" && entry.nlink !== 1)))
+        throw invalid(`writable or linked entry ${JSON.stringify(where)}`);
+}
+async function boundedEntries(directory, limit) {
+    const entries = await readdir(directory);
+    if (entries.length > limit)
+        throw invalid(`too many entries in ${JSON.stringify(path.basename(directory))}`);
+    return entries.sort();
+}
+/** Opens without following links and requires the inode `lstat` saw, so a swap between the two cannot change the bytes read. */
+async function readPinnedFile(file, where, seen, limit) {
+    if (seen.size > limit)
+        throw invalid(`file too large ${JSON.stringify(where)}`);
+    const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.dev !== seen.dev || opened.ino !== seen.ino || opened.uid !== seen.uid || opened.mode !== seen.mode || opened.nlink !== seen.nlink || opened.size > limit)
+            throw invalid(`file changed while read ${JSON.stringify(where)}`);
+        const bytes = await handle.readFile();
+        if (bytes.length > limit)
+            throw invalid(`file too large ${JSON.stringify(where)}`);
+        try {
+            return decoder.decode(bytes);
+        }
+        catch {
+            throw invalid(`file is not UTF-8 ${JSON.stringify(where)}`);
+        }
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}

package/dist/runtime/engineBrokerServiceConfig.d.ts

@@ -16,6 +16,13 @@ export type EngineBrokerServiceRegistration = Readonly<{
     usageLedgerPath: string;
     limits: EngineBrokerTurnLimits;
     model: GrokBrokerModelPolicy;
+    /**
+     * Digest of the skills root provisioning rendered into `$GROK_HOME/skills`
+     * (`grokWorkerSkillsSha256`), attested before every turn. Optional in v2
+     * registrations and v3 slot policies; absent means the slot has no skills and
+     * the directory must not exist.
+     */
+    skillsSha256?: string;
 }>;
 /**
  * `inferenceLedgerPath` (v2, optional) is where evaluator inference grants
@@ -46,8 +53,9 @@ export declare const engineBrokerSealLedgerPathFor: (usageLedgerPath: string) =>
  * v3 retains seven-field registrations and binds slotPolicies by slot; agent IDs
  * may repeat, while worker UIDs, slots and ledger streams must be distinct.
  * v2 requires every registration to declare its usage ledger, limits and model
- * (`model.id`/`model.reasoningEffort` from the closed lists); unknown keys at
- * any level are refused. v1 is still accepted and receives today's defaults:
+ * (`model.id`/`model.reasoningEffort` from the closed lists) and may declare
+ * `skillsSha256` (v3: on its slot policy); unknown keys at any level are
+ * refused. v1 is still accepted and receives today's defaults:
  * the container ledger, {@link DEFAULT_GROK_BROKER_TURN_LIMITS}, and
  * `grok-4.6`/`low`.
  */

package/dist/runtime/engineBrokerServiceConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engineBrokerServiceConfig.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerServiceConfig.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgE,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC5I,OAAO,EAAuF,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAK7J,eAAO,MAAM,wBAAwB,EAAG,0CAAmD,CAAC;AAC5F,eAAO,MAAM,wBAAwB,EAAG,0CAAmD,CAAC;AAC5F,eAAO,MAAM,wBAAwB,EAAG,0CAAmD,CAAC;AAE5F,mHAAmH;AACnH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IACpI,oJAAoJ;IACpJ,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,SAAS,+BAA+B,EAAE,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc5O,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,GAAI,iBAAiB,MAAM,KAAG,MAAgF,CAAC;AAE5J;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,iBAAiB,MAAM,KAAG,MAA6E,CAAC;AAEtJ;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAwDxF"}
+{"version":3,"file":"engineBrokerServiceConfig.d.ts","sourceRoot":"","sources":["../../src/runtime/engineBrokerServiceConfig.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgE,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC5I,OAAO,EAAuF,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAK7J,eAAO,MAAM,wBAAwB,EAAG,0CAAmD,CAAC;AAC5F,eAAO,MAAM,wBAAwB,EAAG,0CAAmD,CAAC;AAC5F,eAAO,MAAM,wBAAwB,EAAG,0CAAmD,CAAC;AAE5F,mHAAmH;AACnH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IACpI,oJAAoJ;IACpJ,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,SAAS,+BAA+B,EAAE,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc5O,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,GAAI,iBAAiB,MAAM,KAAG,MAAgF,CAAC;AAE5J;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GAAI,iBAAiB,MAAM,KAAG,MAA6E,CAAC;AAEtJ;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAyDxF"}

package/dist/runtime/engineBrokerServiceConfig.js

@@ -33,8 +33,9 @@ export const engineBrokerSealLedgerPathFor = (usageLedgerPath) => path.posix.joi
  * v3 retains seven-field registrations and binds slotPolicies by slot; agent IDs
  * may repeat, while worker UIDs, slots and ledger streams must be distinct.
  * v2 requires every registration to declare its usage ledger, limits and model
- * (`model.id`/`model.reasoningEffort` from the closed lists); unknown keys at
- * any level are refused. v1 is still accepted and receives today's defaults:
+ * (`model.id`/`model.reasoningEffort` from the closed lists) and may declare
+ * `skillsSha256` (v3: on its slot policy); unknown keys at any level are
+ * refused. v1 is still accepted and receives today's defaults:
  * the container ledger, {@link DEFAULT_GROK_BROKER_TURN_LIMITS}, and
  * `grok-4.6`/`low`.
  */
@@ -66,7 +67,7 @@ export function parseEngineBrokerServiceConfig(value) {
         for (const policy of value.slotPolicies) {
             if (!plain(policy))
                 throw invalid();
-            exact(policy, ["slot", "usageLedgerPath", "limits", "model"]);
+            exact(policy, ["slot", "usageLedgerPath", "limits", "model", ...withSkills(policy)]);
             if (!Number.isSafeInteger(policy.slot) || policy.slot < 0 || policies.has(policy.slot))
                 throw invalid();
             policies.set(policy.slot, policy);
@@ -77,7 +78,7 @@ export function parseEngineBrokerServiceConfig(value) {
     const registrations = value.registrations.map((entry) => {
         if (!plain(entry))
             throw invalid();
-        exact(entry, v2 && !v3 ? V2_REGISTRATION : V1_REGISTRATION);
+        exact(entry, v2 && !v3 ? [...V2_REGISTRATION, ...withSkills(entry)] : V1_REGISTRATION);
         const { agentId, slot, workerUid, workspace, profilePath, eventsPath, profileSha256 } = entry;
         if (typeof agentId !== "string" || !agentId.trim() || (!v3 && seen.has(agentId)) || !Number.isSafeInteger(slot) || slot < 0 || slots.has(slot) || !Number.isSafeInteger(workerUid) || workerUid < 2200 || workers.has(workerUid) || !absolute(workspace) || !absolute(profilePath) || !absolute(eventsPath) || typeof profileSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(profileSha256) || eventsPath !== grokWorkerEventsPathFor(profilePath) || !profilePath.endsWith("/sandbox.toml"))
             throw invalid();
@@ -104,7 +105,9 @@ export function parseEngineBrokerServiceConfig(value) {
         catch {
             throw invalid();
         }
-        return { ...base, usageLedgerPath, limits, model: parseServiceModel(policy.model) };
+        if (Object.hasOwn(policy, "skillsSha256") && (typeof policy.skillsSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(policy.skillsSha256)))
+            throw invalid();
+        return { ...base, usageLedgerPath, limits, model: parseServiceModel(policy.model), ...(Object.hasOwn(policy, "skillsSha256") ? { skillsSha256: policy.skillsSha256 } : {}) };
     });
     const base = { credentialHome: value.credentialHome, turnStore: value.turnStore, registrations,
         ...(value.runRequestStore === undefined ? {} : { runRequestStore: value.runRequestStore }),
@@ -119,6 +122,7 @@ export function parseEngineBrokerServiceConfig(value) {
         throw invalid();
     return { ...base, inferenceLedgerPath };
 }
+const withSkills = (value) => Object.hasOwn(value, "skillsSha256") ? ["skillsSha256"] : [];
 const ledgerPath = (item) => absolute(item) && item.endsWith(".jsonl") && path.posix.normalize(item) === item;
 function parseServiceModel(value) {
     if (!plain(value))

package/dist/runtime/grokBrokerProjection.d.ts

@@ -2,6 +2,7 @@ import { GROK_BROKER_TASK_CLOCK, type GrokWorkerConfigVariant } from "../contrac
 import { type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
 import { type EngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
 import type { GrokBrokerModel, GrokBrokerReasoningEffort } from "./grokBrokerModelPolicy.js";
+import { type AgentSkill } from "./grokWorkerSkills.js";
 import { GROK_WORKER_SANDBOX_PROFILE } from "./grokWorkerSandboxProfile.js";
 export declare const GROK_BROKER_PROJECTION_VERSION: "noopolis.daimon.grok-broker-projection.v3";
 /**
@@ -27,6 +28,13 @@ export type OrganizationGrokBrokerProjection = Readonly<{
         timestampFilePath: string;
     }>;
     systemPromptSha256: string;
+    /**
+     * Digest of the declared skills rendered into `$GROK_HOME/skills`
+     * (`grokWorkerSkillsSha256`). Present only when the agent declares at least
+     * one skill, so a skill-less projection is byte-identical to one computed
+     * before skills existed.
+     */
+    skillsSha256?: string;
     grokCliVersion: string;
     grokExecutableSha256: string;
     nativeAbiVersion: number;
@@ -78,6 +86,13 @@ export type OrganizationGrokBrokerProjectionOptions = Readonly<{
     seccompProfileSha256: string;
     /** When the caller already holds a rendered profile digest, it must equal Daimon's. */
     profileSha256?: string;
+    /**
+     * The agent's declared skills: the compiled workspace `.agents/skills` tree
+     * every engine is given (`readAgentSkillsDirectory`), which root provisioning
+     * renders into `$GROK_HOME/skills` (`renderGrokWorkerSkillsTree`). Omitted or
+     * empty means no skills.
+     */
+    skills?: readonly AgentSkill[];
 }>;
 /**
  * Resolve the public Grok broker projection for one agent.
@@ -98,7 +113,8 @@ export type OrganizationGrokBrokerProjectionOptions = Readonly<{
  * this agent (realm, bootstrap, peers, and the mask covering the acceptance
  * store) plus the caller's evaluator paths, sorted and deduplicated exactly as
  * the profile renderer does. A supplied `profileSha256` that differs is
- * refused.
+ * refused. Declared `skills` add `skillsSha256`, which the implied
+ * registration carries and the broker attests against `$GROK_HOME/skills`.
  */
 export declare function resolveOrganizationGrokBrokerProjection(config: unknown, agentId: string, options: OrganizationGrokBrokerProjectionOptions): OrganizationGrokBrokerProjection;
 /** sha256 over the projection's canonical JSON; what a slot preflight receipt binds. */

package/dist/runtime/grokBrokerProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerProjection.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAQ3G,OAAO,EAAkC,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAA2F,MAAM,+BAA+B,CAAC;AAGrK,eAAO,MAAM,8BAA8B,6CAAuC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,sBAAsB,EAAE,eAAe,GAAG,mBAAmB,CAAC,GAAG,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxJ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;QAAC,cAAc,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjM,CAAC,CAAC;AAEH,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,gHAAgH;IAChH,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,GAAG,gCAAgC,CAkC5K;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,GAAI,YAAY,gCAAgC,KAAG,MACpB,CAAC;AAEvE,4HAA4H;AAC5H,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQhI;AAED;;;;GAIG;AACH,wBAAgB,6CAA6C,CAAC,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,gCAAgC,GAAG,IAAI,CAG/J"}
+{"version":3,"file":"grokBrokerProjection.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAQ3G,OAAO,EAAkC,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAA4C,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,2BAA2B,EAA2F,MAAM,+BAA+B,CAAC;AAGrK,eAAO,MAAM,8BAA8B,6CAAuC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,sBAAsB,EAAE,eAAe,GAAG,mBAAmB,CAAC,GAAG,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxJ,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,IAAI,CAAC;QAAC,WAAW,EAAE,OAAO,2BAA2B,CAAC;QAAC,cAAc,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjM,CAAC,CAAC;AAEH,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,gHAAgH;IAChH,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,GAAG,gCAAgC,CAmC5K;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,GAAI,YAAY,gCAAgC,KAAG,MACpB,CAAC;AAEvE,4HAA4H;AAC5H,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAShI;AAED;;;;GAIG;AACH,wBAAgB,6CAA6C,CAAC,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,gCAAgC,GAAG,IAAI,CAG/J"}

package/dist/runtime/grokBrokerProjection.js

@@ -9,6 +9,7 @@ import { grokSandboxProtectedPaths } from "./engineDispatcher.js";
 import { parseEngineBrokerServiceConfig } from "./engineBrokerServiceConfig.js";
 import { parseEngineBrokerTurnLimits } from "./engineBrokerTurnAccounting.js";
 import { grokBrokerWorkerConfigPins, grokBrokerWorkerConfigSha256 } from "./grokBrokerWorkerConfig.js";
+import { grokWorkerSkillsSha256, parseAgentSkills } from "./grokWorkerSkills.js";
 import { GROK_WORKER_SANDBOX_PROFILE, grokWorkerEventsPathFor, renderGrokWorkerSandboxProfile, grokWorkerSandboxProfileSha256 } from "./grokWorkerSandboxProfile.js";
 import { parseOrganizationRuntimeConfig } from "./organizationRuntime.js";
 export const GROK_BROKER_PROJECTION_VERSION = GROK_ENGINE_BROKER.projectionVersion;
@@ -31,7 +32,8 @@ export const GROK_BROKER_PROJECTION_VERSION = GROK_ENGINE_BROKER.projectionVersi
  * this agent (realm, bootstrap, peers, and the mask covering the acceptance
  * store) plus the caller's evaluator paths, sorted and deduplicated exactly as
  * the profile renderer does. A supplied `profileSha256` that differs is
- * refused.
+ * refused. Declared `skills` add `skillsSha256`, which the implied
+ * registration carries and the broker attests against `$GROK_HOME/skills`.
  */
 export function resolveOrganizationGrokBrokerProjection(config, agentId, options) {
     const parsed = parseOrganizationRuntimeConfig(config);
@@ -64,12 +66,13 @@ export function resolveOrganizationGrokBrokerProjection(config, agentId, options
     const artifact = GROK_ENGINE_BROKER.grokCliArtifacts[options.architecture];
     if (artifact === undefined)
         throw new Error("Grok broker projection requires a pinned architecture");
+    const skills = parseAgentSkills(options.skills ?? []);
     const profilePath = path.posix.join(options.workerHomePath, ".grok", "sandbox.toml");
     const projection = {
         version: GROK_BROKER_PROJECTION_VERSION, agentId, workspacePath: agent.workspacePath, runtimeHomePath: agent.runtimeHomePath,
         workerUid: options.workerUid, slot: options.slot, profilePath, profileSha256, denyPaths, workerConfigSha256, workerConfigVariant,
         ...(workerConfigVariant === "clocked" ? { taskClock: { ...GROK_BROKER_TASK_CLOCK, directoryPath: path.posix.dirname(brokerTaskClockFileFor(options.slot)), timestampFilePath: brokerTaskClockFileFor(options.slot) } } : {}),
-        systemPromptSha256: GROK_ENGINE_BROKER.worker.systemPromptSha256, grokCliVersion: GROK_ENGINE_BROKER.grokCliVersion, grokExecutableSha256: artifact.sha256,
+        systemPromptSha256: GROK_ENGINE_BROKER.worker.systemPromptSha256, ...(skills.length === 0 ? {} : { skillsSha256: grokWorkerSkillsSha256(skills) }), grokCliVersion: GROK_ENGINE_BROKER.grokCliVersion, grokExecutableSha256: artifact.sha256,
         nativeAbiVersion: GROK_ENGINE_BROKER.nativeAbiVersion, model, reasoningEffort, limits: parseEngineBrokerTurnLimits(options.limits), usageLedgerPath: options.usageLedgerPath, seccompProfileSha256: options.seccompProfileSha256,
         attestation: { platform: "linux/landlock", enforced: true, restrictNetwork: true, profileName: GROK_WORKER_SANDBOX_PROFILE, sandboxRuntime: "bubblewrap", eventsPath: grokWorkerEventsPathFor(profilePath) }
     };
@@ -84,7 +87,8 @@ export function grokBrokerServiceRegistrationFor(projection) {
     const registration = {
         agentId: projection.agentId, slot: projection.slot, workerUid: projection.workerUid, workspace: projection.workspacePath,
         profilePath: projection.profilePath, eventsPath: projection.attestation.eventsPath, profileSha256: projection.profileSha256,
-        usageLedgerPath: projection.usageLedgerPath, limits: projection.limits, model: { id: projection.model, reasoningEffort: projection.reasoningEffort }
+        usageLedgerPath: projection.usageLedgerPath, limits: projection.limits, model: { id: projection.model, reasoningEffort: projection.reasoningEffort },
+        ...(projection.skillsSha256 === undefined ? {} : { skillsSha256: projection.skillsSha256 })
     };
     parseEngineBrokerServiceConfig({ version: "noopolis.daimon.engine-broker-service.v2", credentialHome: GROK_ENGINE_BROKER.credentialHomePath, turnStore: GROK_ENGINE_BROKER.turnStorePath, registrations: [registration] });
     return registration;

package/dist/runtime/grokWorkerAttestation.d.ts

@@ -53,7 +53,8 @@ export declare function parseGrokWorkerSandboxProfile(bytes: Uint8Array, profile
  * the events watermark it requires the 1.0.34 layout: events under
  * `$GROK_HOME/sessions/` (the root `sandbox-events.jsonl` stays empty on
  * 1.0.34), and a root-owned read-only worker home whose `config.toml` hashes to
- * the declared renderer output (`grokWorkerHomeAttestation.ts`).
+ * the declared renderer output and whose `skills/` is exactly the declared
+ * skills (`skillsSha256`; absent for none) (`grokWorkerHomeAttestation.ts`).
  *
  * It also refuses a deny list bubblewrap could not materialize
  * (`grokWorkerDenyPlacement.ts`), naming the entry and the ancestor that stops
@@ -73,6 +74,7 @@ export declare function prepareGrokWorkerAttestation(input: Readonly<{
     workerGid?: number;
     brokerGid: number;
     configSha256: GrokWorkerConfigPins;
+    skillsSha256?: string;
     registeredWorkers?: readonly Readonly<{
         profilePath: string;
         workerUid: number;

package/dist/runtime/grokWorkerAttestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokWorkerAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerAttestation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAiD,KAAK,oBAAoB,EAA4B,MAAM,+BAA+B,CAAC;AAGnJ;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,SAAS,MAAM,EAAE,CAAC;IAAA,aAAa,CAAC,EAAC,uBAAuB,CAAA;CAAC,CAAC,CAAC;AAC3J,KAAK,QAAQ,GAAC,6BAA6B,CAAC;AAC5C,qBAAa,4BAA6B,SAAQ,KAAK;IAAe,QAAQ,CAAC,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;gBAAhD,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;CAA4D;AAC3L;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,aAAa,EAAC,MAAM,GAAE,SAAS,MAAM,EAAE,CAUrG;AACD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,oBAAoB,CAAC;IAAA,iBAAiB,CAAC,EAAC,SAAS,QAAQ,CAAC;QAAC,WAAW,EAAC,MAAM,CAAC;QAAA,SAAS,EAAC,MAAM,CAAA;KAAC,CAAC,EAAE,CAAA;CAAC,CAAC,EAAC,YAAY,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,CAAC,EAAC,oBAAoB,CAAA;CAAC,CAAe,GAAE,OAAO,CAAC,QAAQ,GAAG;IAAE,aAAa,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAWxb;AACD,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,GAAE,CAAC,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,cAAa,CAAC,EAAC,eAAc,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,EAAC,cAAa,oBAAoB;;;;;;;CAA4J,CAAC;AACja;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAC;IAAC,QAAQ,CAAC,EAAC,QAAQ,CAAC;QAAC,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAA;KAAC,CAAC,CAAC;IAAA,OAAO,CAAC,EAAC,4BAA4B,CAAC,cAAc,CAAC,CAAA;CAAC,CAAC;AAE9J;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,GAAE,MAAI,OAAO,CAAC,IAAI,CAAC,CAOxI;AACD,wBAAsB,2BAA2B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,UAAU,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,IAAI,CAAC,EAAC,yBAAyB,GAAE,OAAO,CAAC,IAAI,CAAC,CAyBtM;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,IAAI,CAA4D;AAChL,uFAAuF;AACvF,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,QAAQ,CAAC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,MAAM,CAAA;CAAC,CAAC,CAavJ"}
+{"version":3,"file":"grokWorkerAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerAttestation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAiD,KAAK,oBAAoB,EAA4B,MAAM,+BAA+B,CAAC;AAGnJ;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,SAAS,MAAM,EAAE,CAAC;IAAA,aAAa,CAAC,EAAC,uBAAuB,CAAA;CAAC,CAAC,CAAC;AAC3J,KAAK,QAAQ,GAAC,6BAA6B,CAAC;AAC5C,qBAAa,4BAA6B,SAAQ,KAAK;IAAe,QAAQ,CAAC,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;gBAAhD,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;CAA4D;AAC3L;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,aAAa,EAAC,MAAM,GAAE,SAAS,MAAM,EAAE,CAUrG;AACD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,oBAAoB,CAAC;IAAA,YAAY,CAAC,EAAC,MAAM,CAAC;IAAA,iBAAiB,CAAC,EAAC,SAAS,QAAQ,CAAC;QAAC,WAAW,EAAC,MAAM,CAAC;QAAA,SAAS,EAAC,MAAM,CAAA;KAAC,CAAC,EAAE,CAAA;CAAC,CAAC,EAAC,YAAY,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,CAAC,EAAC,oBAAoB,CAAA;CAAC,CAAe,GAAE,OAAO,CAAC,QAAQ,GAAG;IAAE,aAAa,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAY7c;AACD,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,GAAE,CAAC,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,cAAa,CAAC,EAAC,eAAc,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,EAAC,cAAa,oBAAoB;;;;;;;CAA4J,CAAC;AACja;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAC;IAAC,QAAQ,CAAC,EAAC,QAAQ,CAAC;QAAC,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAA;KAAC,CAAC,CAAC;IAAA,OAAO,CAAC,EAAC,4BAA4B,CAAC,cAAc,CAAC,CAAA;CAAC,CAAC;AAE9J;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,GAAE,MAAI,OAAO,CAAC,IAAI,CAAC,CAOxI;AACD,wBAAsB,2BAA2B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,UAAU,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,IAAI,CAAC,EAAC,yBAAyB,GAAE,OAAO,CAAC,IAAI,CAAC,CAyBtM;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,IAAI,CAA4D;AAChL,uFAAuF;AACvF,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,QAAQ,CAAC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,MAAM,CAAA;CAAC,CAAC,CAavJ"}

package/dist/runtime/grokWorkerAttestation.js

@@ -64,7 +64,8 @@ export function parseGrokWorkerSandboxProfile(bytes, profileSha256) {
  * the events watermark it requires the 1.0.34 layout: events under
  * `$GROK_HOME/sessions/` (the root `sandbox-events.jsonl` stays empty on
  * 1.0.34), and a root-owned read-only worker home whose `config.toml` hashes to
- * the declared renderer output (`grokWorkerHomeAttestation.ts`).
+ * the declared renderer output and whose `skills/` is exactly the declared
+ * skills (`skillsSha256`; absent for none) (`grokWorkerHomeAttestation.ts`).
  *
  * It also refuses a deny list bubblewrap could not materialize
  * (`grokWorkerDenyPlacement.ts`), naming the entry and the ancestor that stops
@@ -100,7 +101,8 @@ export async function prepareGrokWorkerAttestation(input, profileOwner = { uid:
     if (workers.some((worker) => worker.home === undefined))
         throw new Error("Grok worker isolation attestation unavailable");
     await verifyGrokWorkerTmp(workers, profileOwner.tmp);
-    const configVariant = await verifyGrokWorkerHome(path.dirname(input.profilePath), input.configSha256);
+    // The home's read-only files share the profile's owner (root in production: `sandbox.toml` is one of them).
+    const configVariant = await verifyGrokWorkerHome(path.dirname(input.profilePath), input.configSha256, profileOwner.uid, input.skillsSha256);
     const events = await secureOpen(input.eventsPath, input.workerUid, input.brokerGid, 0o640, 16 * 1024 * 1024);
     try {
         const stat = await events.stat();

package/dist/runtime/grokWorkerHomeAttestation.d.ts

@@ -13,7 +13,7 @@ type Entry = Pick<Stats, "uid" | "mode" | "nlink"> & Partial<Pick<Stats, "dev" |
  * so the directory is worker-group writable — but root-owned and sticky, so a
  * worker can neither rename nor unlink a root-owned file in it. Every file
  * that decides a turn's behaviour is root-owned with no write bit: `config.toml`
- * (model, effort, MCP, skills), `sandbox.toml`, `trusted_folders.toml` (trust
+ * (model, effort, MCP, bundled-skill toggles), `sandbox.toml`, `trusted_folders.toml` (trust
  * would re-enable cwd `AGENTS.md` and project skills), and the managed and
  * requirements layers that can override user config. A missing file fails
  * too: the worker could create it.
@@ -24,9 +24,53 @@ export declare function assertGrokWorkerHomeEntries(entries: Readonly<Record<str
 /** The worker's `config.toml` must be exactly the renderer's bytes for the declared policy. */
 export declare function assertGrokWorkerConfigBytes(bytes: Uint8Array, pins: GrokWorkerConfigPins): GrokWorkerConfigVariant;
 /**
- * Attests the worker home layout and that `config.toml` is exactly the
- * renderer's bytes for the declared model policy (`configSha256`).
+ * The worker's `$GROK_HOME/skills` must be exactly the declared skills.
+ *
+ * Grok loads that directory as user-scoped skills even in an untrusted
+ * workspace, and `$GROK_HOME` is worker-group writable, so a worker could plant
+ * a skill there for its next turn. With no `skillsSha256` declared the
+ * directory must be absent (or an empty root-owned read-only directory); with
+ * one declared, every entry must be root-owned with no write bit and the tree
+ * must hash to it. A worker-created or worker-modified tree fails either way.
+ */
+export declare function verifyGrokWorkerSkills(grokHome: string, skillsSha256: string | undefined, rootUid?: number): Promise<void>;
+/**
+ * Every other skill root Grok discovers at user scope, which the worker could
+ * plant into: under `$GROK_HOME` (root-owned but worker-group writable and
+ * sticky, so the worker can create new entries) and under the worker's own
+ * `$HOME` (the launcher exports `HOME=<home>` and `GROK_HOME=<home>/.grok`;
+ * `<home>` is worker-owned). Only `$GROK_HOME/skills` may carry skills, and only
+ * the declared ones; each root here must be absent, or an empty root-owned
+ * directory with no write bit.
+ *
+ * Set from `grok inspect` with scratch `HOME`/`GROK_HOME` and no network
+ * (1.0.60: every root below listed a planted skill or command; `.codex/skills`,
+ * `.ai/skills`, `$HOME/.config/*` and `$HOME/.agents/plugins` did not) and from
+ * the pinned 1.0.34 binary's own skills table (`~/.grok/{skills,commands}`,
+ * `~/.claude/{skills,commands}`, `~/.cursor/skills`, `.agents/{skills,commands}`
+ * at each tier). `bundled/skills` is the bundled-skill cache: never created on
+ * 1.0.34 (P0 container evidence), but a skill planted there loads with a name
+ * `[skills] disabled` does not cover. `plugins/` folders load their skills and
+ * commands as trusted user plugins.
+ */
+export declare const GROK_WORKER_FOREIGN_SKILL_ROOTS: Readonly<{
+    grokHome: readonly ["commands", "bundled/skills", "plugins"];
+    home: readonly [".agents/skills", ".agents/commands", ".claude/skills", ".claude/commands", ".cursor/skills", ".cursor/commands"];
+}>;
+/**
+ * Refuses a foreign skill root (`GROK_WORKER_FOREIGN_SKILL_ROOTS`) that exists
+ * and is not an empty root-owned read-only directory. A deployment that never
+ * creates them passes unchanged. `grokHome` must be `<home>/.grok`, the
+ * launcher's layout, so `<home>` is its parent.
+ */
+export declare function verifyGrokWorkerForeignSkillRoots(grokHome: string, rootUid?: number): Promise<void>;
+/**
+ * Attests the worker home layout, that `config.toml` is exactly the
+ * renderer's bytes for the declared model policy (`configSha256`), that
+ * `skills/` is exactly the declared skills (`skillsSha256`, absent for none),
+ * and that no other user skill root holds anything
+ * (`verifyGrokWorkerForeignSkillRoots`).
  */
-export declare function verifyGrokWorkerHome(grokHome: string, configSha256: GrokWorkerConfigPins, rootUid?: number): Promise<GrokWorkerConfigVariant>;
+export declare function verifyGrokWorkerHome(grokHome: string, configSha256: GrokWorkerConfigPins, rootUid?: number, skillsSha256?: string): Promise<GrokWorkerConfigVariant>;
 export {};
 //# sourceMappingURL=grokWorkerHomeAttestation.d.ts.map

package/dist/runtime/grokWorkerHomeAttestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokWorkerHomeAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerHomeAttestation.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAKhD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9F,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC;IAAE,MAAM,IAAI,OAAO,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC;IAAC,cAAc,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAG9K;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,GAAE,MAA2B,GAAG,IAAI,CAS5I;AAED,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,GAAG,uBAAuB,CAQlH;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAevK"}
+{"version":3,"file":"grokWorkerHomeAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerHomeAttestation.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAKhD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAInF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9F,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC;IAAE,MAAM,IAAI,OAAO,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC;IAAC,cAAc,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAG9K;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,GAAE,MAA2B,GAAG,IAAI,CAS5I;AAED,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,GAAG,uBAAuB,CAQlH;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpJ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,+BAA+B;;;EAG1C,CAAC;AAEH;;;;;GAKG;AACH,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB7H;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,OAAO,GAAE,MAA2B,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkB9L"}

package/dist/runtime/grokWorkerHomeAttestation.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, open } from "node:fs/promises";
+import { lstat, open, readdir } from "node:fs/promises";
 import path from "node:path";
 import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { readAgentSkillsDirectory } from "./agentSkillsDirectory.js";
+import { GROK_WORKER_SKILLS_LAYOUT, grokWorkerSkillsSha256 } from "./grokWorkerSkills.js";
 const HOME = GROK_ENGINE_BROKER.worker.home;
 /**
  * The worker must not be able to change what Grok reads before its next turn.
@@ -11,7 +13,7 @@ const HOME = GROK_ENGINE_BROKER.worker.home;
  * so the directory is worker-group writable — but root-owned and sticky, so a
  * worker can neither rename nor unlink a root-owned file in it. Every file
  * that decides a turn's behaviour is root-owned with no write bit: `config.toml`
- * (model, effort, MCP, skills), `sandbox.toml`, `trusted_folders.toml` (trust
+ * (model, effort, MCP, bundled-skill toggles), `sandbox.toml`, `trusted_folders.toml` (trust
  * would re-enable cwd `AGENTS.md` and project skills), and the managed and
  * requirements layers that can override user config. A missing file fails
  * too: the worker could create it.
@@ -41,10 +43,94 @@ export function assertGrokWorkerConfigBytes(bytes, pins) {
     throw unavailable();
 }
 /**
- * Attests the worker home layout and that `config.toml` is exactly the
- * renderer's bytes for the declared model policy (`configSha256`).
+ * The worker's `$GROK_HOME/skills` must be exactly the declared skills.
+ *
+ * Grok loads that directory as user-scoped skills even in an untrusted
+ * workspace, and `$GROK_HOME` is worker-group writable, so a worker could plant
+ * a skill there for its next turn. With no `skillsSha256` declared the
+ * directory must be absent (or an empty root-owned read-only directory); with
+ * one declared, every entry must be root-owned with no write bit and the tree
+ * must hash to it. A worker-created or worker-modified tree fails either way.
+ */
+export async function verifyGrokWorkerSkills(grokHome, skillsSha256, rootUid = HOME.directory.uid) {
+    if (skillsSha256 !== undefined && !/^[0-9a-f]{64}$/u.test(skillsSha256))
+        throw unavailable();
+    let skills;
+    try {
+        skills = await readAgentSkillsDirectory(path.join(grokHome, GROK_WORKER_SKILLS_LAYOUT.relativePath), { ownerUid: rootUid, readOnly: true });
+    }
+    catch {
+        throw unavailable();
+    }
+    if (grokWorkerSkillsSha256(skills ?? []) !== (skillsSha256 ?? grokWorkerSkillsSha256([])))
+        throw unavailable();
+}
+/**
+ * Every other skill root Grok discovers at user scope, which the worker could
+ * plant into: under `$GROK_HOME` (root-owned but worker-group writable and
+ * sticky, so the worker can create new entries) and under the worker's own
+ * `$HOME` (the launcher exports `HOME=<home>` and `GROK_HOME=<home>/.grok`;
+ * `<home>` is worker-owned). Only `$GROK_HOME/skills` may carry skills, and only
+ * the declared ones; each root here must be absent, or an empty root-owned
+ * directory with no write bit.
+ *
+ * Set from `grok inspect` with scratch `HOME`/`GROK_HOME` and no network
+ * (1.0.60: every root below listed a planted skill or command; `.codex/skills`,
+ * `.ai/skills`, `$HOME/.config/*` and `$HOME/.agents/plugins` did not) and from
+ * the pinned 1.0.34 binary's own skills table (`~/.grok/{skills,commands}`,
+ * `~/.claude/{skills,commands}`, `~/.cursor/skills`, `.agents/{skills,commands}`
+ * at each tier). `bundled/skills` is the bundled-skill cache: never created on
+ * 1.0.34 (P0 container evidence), but a skill planted there loads with a name
+ * `[skills] disabled` does not cover. `plugins/` folders load their skills and
+ * commands as trusted user plugins.
+ */
+export const GROK_WORKER_FOREIGN_SKILL_ROOTS = Object.freeze({
+    grokHome: Object.freeze(["commands", "bundled/skills", "plugins"]),
+    home: Object.freeze([".agents/skills", ".agents/commands", ".claude/skills", ".claude/commands", ".cursor/skills", ".cursor/commands"])
+});
+/**
+ * Refuses a foreign skill root (`GROK_WORKER_FOREIGN_SKILL_ROOTS`) that exists
+ * and is not an empty root-owned read-only directory. A deployment that never
+ * creates them passes unchanged. `grokHome` must be `<home>/.grok`, the
+ * launcher's layout, so `<home>` is its parent.
+ */
+export async function verifyGrokWorkerForeignSkillRoots(grokHome, rootUid = HOME.directory.uid) {
+    if (path.basename(grokHome) !== ".grok")
+        throw unavailable();
+    const home = path.dirname(grokHome);
+    const roots = [...GROK_WORKER_FOREIGN_SKILL_ROOTS.grokHome.map((root) => path.join(grokHome, root)), ...GROK_WORKER_FOREIGN_SKILL_ROOTS.home.map((root) => path.join(home, root))];
+    for (const root of roots) {
+        let entry;
+        try {
+            entry = await lstat(root);
+        }
+        catch (error) {
+            // Absent, or a parent that is not a directory: Grok finds nothing there either.
+            if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                continue;
+            throw unavailable();
+        }
+        if (entry.isSymbolicLink() || !entry.isDirectory() || entry.uid !== rootUid || (Number(entry.mode) & 0o7222) !== 0)
+            throw unavailable();
+        let children;
+        try {
+            children = await readdir(root);
+        }
+        catch {
+            throw unavailable();
+        }
+        if (children.length !== 0)
+            throw unavailable();
+    }
+}
+/**
+ * Attests the worker home layout, that `config.toml` is exactly the
+ * renderer's bytes for the declared model policy (`configSha256`), that
+ * `skills/` is exactly the declared skills (`skillsSha256`, absent for none),
+ * and that no other user skill root holds anything
+ * (`verifyGrokWorkerForeignSkillRoots`).
  */
-export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOME.directory.uid) {
+export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOME.directory.uid, skillsSha256) {
     const entries = {};
     for (const name of [".", HOME.sessionsDirectory.relativePath, ...HOME.readOnlyFiles.names]) {
         try {
@@ -63,7 +149,10 @@ export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOM
         // Same inode as the lstat above, as in `secureOpen`: a rename between the two cannot swap in other bytes.
         if (!opened.isFile() || opened.size > 65_536 || opened.dev !== before.dev || opened.ino !== before.ino || opened.uid !== before.uid || opened.mode !== before.mode || opened.nlink !== 1)
             throw unavailable();
-        return assertGrokWorkerConfigBytes(await handle.readFile(), configSha256);
+        const variant = assertGrokWorkerConfigBytes(await handle.readFile(), configSha256);
+        await verifyGrokWorkerSkills(grokHome, skillsSha256, rootUid);
+        await verifyGrokWorkerForeignSkillRoots(grokHome, rootUid);
+        return variant;
     }
     catch {
         throw unavailable();

package/dist/runtime/grokWorkerSkills.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Where root provisioning renders the agent's declared skills inside the worker
+ * home (`$GROK_HOME/skills`), and what every entry must be: root-owned, no
+ * write bit. Grok discovers that directory as user-scoped skills even in an
+ * untrusted workspace. Absent when the registration declares no `skillsSha256`.
+ *
+ * Deliberately *not* folded into `RUNTIME_CONTRACT_MANIFEST`, as with
+ * `TURN_USAGE_LEDGER`: the manifest's canonical bytes are digest-pinned by
+ * Spawnfile and attested against the selected runtime image, so a new key
+ * there makes every pinned image fail to attest. Only Daimon reads this layout
+ * (the renderer below and the broker's pre-turn attestation); Spawnfile
+ * consumes it through `renderGrokWorkerSkillsTree`.
+ */
+export declare const GROK_WORKER_SKILLS_LAYOUT: Readonly<{
+    readonly relativePath: "skills";
+    readonly uid: 0;
+    readonly gid: 0;
+    readonly directoryMode: 365;
+    readonly fileMode: 292;
+    readonly digestVersion: "noopolis.daimon.grok-worker-skills.v1";
+}>;
+/**
+ * One file of a declared agent skill, relative to the skill's own directory.
+ * `SKILL.md` is required; supporting files (references, scripts) are optional.
+ */
+export type AgentSkillFile = Readonly<{
+    path: string;
+    content: string;
+}>;
+/** One declared agent skill: its directory name and every file under it. */
+export type AgentSkill = Readonly<{
+    name: string;
+    files: readonly AgentSkillFile[];
+}>;
+/**
+ * The engine-neutral skills input. It is the compiled workspace tree every
+ * engine is given — Spawnfile lowers declared skills (and Moltnet installs its
+ * own) into `<workspace>/.agents/skills/<name>/SKILL.md`, which Codex reads in
+ * place. A brokered Grok worker cannot read it there: its workspace stays
+ * untrusted, so root provisioning renders the same skills into
+ * `$GROK_HOME/skills` instead.
+ */
+export declare const AGENT_SKILLS_WORKSPACE_DIRECTORY: ".agents/skills";
+export declare const GROK_WORKER_SKILLS_VERSION: "noopolis.daimon.grok-worker-skills.v1";
+export declare const AGENT_SKILLS_BOUNDS: Readonly<{
+    skills: 64;
+    filesPerSkill: 64;
+    fileBytes: 262144;
+    totalBytes: 4194304;
+    depth: 8;
+}>;
+/**
+ * Strict, canonicalizing parser: names and path components are plain
+ * identifiers (no `.`/`..`, no hidden entries, no separators other than `/`),
+ * every skill carries `SKILL.md`, nothing collides, and the sizes are bounded.
+ * Output is sorted by name and path so equal sets digest equally.
+ */
+export declare function parseAgentSkills(value: unknown): readonly AgentSkill[];
+/**
+ * sha256 over the canonical description of the rendered tree: every skill's
+ * name and, per file, its path, byte length and content digest. The broker
+ * attests `$GROK_HOME/skills` against it before every turn, and the Grok broker
+ * projection carries it, so the slot preflight receipt and every recomputed
+ * projection bind the exact skills a subject was given.
+ */
+export declare function grokWorkerSkillsSha256(skills: readonly AgentSkill[]): string;
+/** One entry root provisioning creates, relative to `$GROK_HOME`, owned `uid:gid`. */
+export type GrokWorkerSkillsEntry = Readonly<{
+    path: string;
+    kind: "directory" | "file";
+    uid: number;
+    gid: number;
+    mode: number;
+    content?: string;
+}>;
+/**
+ * Every directory and file root provisioning writes for these skills, parents
+ * before children: `skills/` itself, each `skills/<name>/`, any intermediate
+ * directory, and each file. Directories are `root:root 0555` and files
+ * `root:root 0444` (single link), so a worker-uid process can read them but
+ * neither change nor replace them; `$GROK_HOME` is root-owned and sticky, so the
+ * worker cannot rename `skills/` away either. No skills renders nothing: the
+ * directory must then be absent, exactly as before this layout existed.
+ */
+export declare function renderGrokWorkerSkillsTree(skills: readonly AgentSkill[]): readonly GrokWorkerSkillsEntry[];
+//# sourceMappingURL=grokWorkerSkills.d.ts.map

package/dist/runtime/grokWorkerSkills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerSkills.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerSkills.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB;;;;;;;EAE3B,CAAC;AAGZ;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACzE,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,CAAC,CAAC;AAEtF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAG,gBAAyB,CAAC;AAC1E,eAAO,MAAM,0BAA0B,yCAAuB,CAAC;AAC/D,eAAO,MAAM,mBAAmB;;;;;;EAAwG,CAAC;AASzI;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,UAAU,EAAE,CA6BtE;AAID;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAO5E;AAED,sFAAsF;AACtF,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAErJ;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,qBAAqB,EAAE,CAiB1G"}

package/dist/runtime/grokWorkerSkills.js

@@ -0,0 +1,135 @@
+import { createHash } from "node:crypto";
+import { canonicalJson } from "../contracts/canonicalJson.js";
+/**
+ * Where root provisioning renders the agent's declared skills inside the worker
+ * home (`$GROK_HOME/skills`), and what every entry must be: root-owned, no
+ * write bit. Grok discovers that directory as user-scoped skills even in an
+ * untrusted workspace. Absent when the registration declares no `skillsSha256`.
+ *
+ * Deliberately *not* folded into `RUNTIME_CONTRACT_MANIFEST`, as with
+ * `TURN_USAGE_LEDGER`: the manifest's canonical bytes are digest-pinned by
+ * Spawnfile and attested against the selected runtime image, so a new key
+ * there makes every pinned image fail to attest. Only Daimon reads this layout
+ * (the renderer below and the broker's pre-turn attestation); Spawnfile
+ * consumes it through `renderGrokWorkerSkillsTree`.
+ */
+export const GROK_WORKER_SKILLS_LAYOUT = Object.freeze({
+    relativePath: "skills", uid: 0, gid: 0, directoryMode: 0o555, fileMode: 0o444, digestVersion: "noopolis.daimon.grok-worker-skills.v1"
+});
+const LAYOUT = GROK_WORKER_SKILLS_LAYOUT;
+/**
+ * The engine-neutral skills input. It is the compiled workspace tree every
+ * engine is given — Spawnfile lowers declared skills (and Moltnet installs its
+ * own) into `<workspace>/.agents/skills/<name>/SKILL.md`, which Codex reads in
+ * place. A brokered Grok worker cannot read it there: its workspace stays
+ * untrusted, so root provisioning renders the same skills into
+ * `$GROK_HOME/skills` instead.
+ */
+export const AGENT_SKILLS_WORKSPACE_DIRECTORY = ".agents/skills";
+export const GROK_WORKER_SKILLS_VERSION = LAYOUT.digestVersion;
+export const AGENT_SKILLS_BOUNDS = Object.freeze({ skills: 64, filesPerSkill: 64, fileBytes: 262_144, totalBytes: 4_194_304, depth: 8 });
+const COMPONENT = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/u;
+const invalid = (detail) => new TypeError(`invalid agent skills: ${detail}`);
+const plain = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const exact = (value, keys) => Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+const byteLength = (content) => Buffer.byteLength(content, "utf8");
+/**
+ * Strict, canonicalizing parser: names and path components are plain
+ * identifiers (no `.`/`..`, no hidden entries, no separators other than `/`),
+ * every skill carries `SKILL.md`, nothing collides, and the sizes are bounded.
+ * Output is sorted by name and path so equal sets digest equally.
+ */
+export function parseAgentSkills(value) {
+    if (!Array.isArray(value) || value.length > AGENT_SKILLS_BOUNDS.skills)
+        throw invalid("expected a bounded array");
+    let total = 0;
+    const names = new Set();
+    const skills = value.map((entry) => {
+        if (!plain(entry) || !exact(entry, ["name", "files"]) || typeof entry.name !== "string" || !COMPONENT.test(entry.name))
+            throw invalid(`skill name ${plain(entry) && typeof entry.name === "string" ? JSON.stringify(entry.name) : "(missing)"}`);
+        if (names.has(entry.name))
+            throw invalid(`duplicate skill ${entry.name}`);
+        names.add(entry.name);
+        if (!Array.isArray(entry.files) || entry.files.length === 0 || entry.files.length > AGENT_SKILLS_BOUNDS.filesPerSkill)
+            throw invalid(`files of ${entry.name}`);
+        const paths = new Set();
+        const files = entry.files.map((file) => {
+            if (!plain(file) || !exact(file, ["path", "content"]) || typeof file.path !== "string" || typeof file.content !== "string")
+                throw invalid(`file ${plain(file) && typeof file.path === "string" ? JSON.stringify(`${entry.name}/${file.path}`) : `of ${entry.name}`}`);
+            const parts = file.path.split("/");
+            if (parts.length > AGENT_SKILLS_BOUNDS.depth || parts.some((part) => !COMPONENT.test(part)))
+                throw invalid(`path ${JSON.stringify(`${entry.name}/${file.path}`)}`);
+            const bytes = byteLength(file.content);
+            if (bytes > AGENT_SKILLS_BOUNDS.fileBytes)
+                throw invalid(`size of ${entry.name}/${file.path}`);
+            total += bytes;
+            if (paths.has(file.path))
+                throw invalid(`duplicate path ${entry.name}/${file.path}`);
+            paths.add(file.path);
+            try {
+                canonicalJson(file.content);
+            }
+            catch {
+                throw invalid(`content of ${entry.name}/${file.path} is not Unicode text`);
+            }
+            return Object.freeze({ path: file.path, content: file.content });
+        });
+        // A file may not also be the directory of another file.
+        for (const candidate of paths)
+            if ([...paths].some((other) => other.startsWith(`${candidate}/`)))
+                throw invalid(`path collision ${entry.name}/${candidate}`);
+        if (!paths.has("SKILL.md"))
+            throw invalid(`${entry.name} has no SKILL.md`);
+        return Object.freeze({ name: entry.name, files: Object.freeze(files.sort((a, b) => compare(a.path, b.path))) });
+    });
+    if (total > AGENT_SKILLS_BOUNDS.totalBytes)
+        throw invalid("total size");
+    return Object.freeze(skills.sort((a, b) => compare(a.name, b.name)));
+}
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/**
+ * sha256 over the canonical description of the rendered tree: every skill's
+ * name and, per file, its path, byte length and content digest. The broker
+ * attests `$GROK_HOME/skills` against it before every turn, and the Grok broker
+ * projection carries it, so the slot preflight receipt and every recomputed
+ * projection bind the exact skills a subject was given.
+ */
+export function grokWorkerSkillsSha256(skills) {
+    const parsed = parseAgentSkills(skills);
+    const description = { version: GROK_WORKER_SKILLS_VERSION, skills: parsed.map((skill) => ({
+            name: skill.name,
+            files: skill.files.map((file) => ({ path: file.path, bytes: byteLength(file.content), sha256: createHash("sha256").update(file.content, "utf8").digest("hex") }))
+        })) };
+    return createHash("sha256").update(canonicalJson(description)).digest("hex");
+}
+/**
+ * Every directory and file root provisioning writes for these skills, parents
+ * before children: `skills/` itself, each `skills/<name>/`, any intermediate
+ * directory, and each file. Directories are `root:root 0555` and files
+ * `root:root 0444` (single link), so a worker-uid process can read them but
+ * neither change nor replace them; `$GROK_HOME` is root-owned and sticky, so the
+ * worker cannot rename `skills/` away either. No skills renders nothing: the
+ * directory must then be absent, exactly as before this layout existed.
+ */
+export function renderGrokWorkerSkillsTree(skills) {
+    const parsed = parseAgentSkills(skills);
+    if (parsed.length === 0)
+        return Object.freeze([]);
+    const directory = (relative) => Object.freeze({ path: relative, kind: "directory", uid: LAYOUT.uid, gid: LAYOUT.gid, mode: LAYOUT.directoryMode });
+    const entries = [directory(LAYOUT.relativePath)];
+    const seen = new Set([LAYOUT.relativePath]);
+    for (const skill of parsed) {
+        for (const file of skill.files) {
+            const parts = [LAYOUT.relativePath, skill.name, ...file.path.split("/")];
+            for (let depth = 2; depth < parts.length; depth += 1) {
+                const relative = parts.slice(0, depth).join("/");
+                if (!seen.has(relative)) {
+                    seen.add(relative);
+                    entries.push(directory(relative));
+                }
+            }
+            entries.push(Object.freeze({ path: parts.join("/"), kind: "file", uid: LAYOUT.uid, gid: LAYOUT.gid, mode: LAYOUT.fileMode, content: file.content }));
+        }
+    }
+    return Object.freeze(entries);
+}

package/dist/runtime/index.d.ts

@@ -18,6 +18,9 @@ export { GROK_INFERENCE_AUTH_STALE_BODY } from "./grokInferenceProxy.js";
 export { assertGrokWorkerDenyPathPlacement, assertGrokWorkerDenyPathShape, assertGrokWorkerDenyPathsPlaceable, GROK_WORKER_BASE_PROFILE_GRANTS, grokWorkerCanSearch, grokWorkerDenyPathChain, GrokWorkerDenyPlacementError, readGrokWorkerDenyPathChain } from "./grokWorkerDenyPlacement.js";
 export type { GrokWorkerDenyPathEntry, GrokWorkerDenyPathStep, GrokWorkerDenyPathWorker } from "./grokWorkerDenyPlacement.js";
 export { grokWorkerSandboxProfileSha256, renderGrokWorkerSandboxProfile } from "./grokWorkerSandboxProfile.js";
+export { AGENT_SKILLS_BOUNDS, AGENT_SKILLS_WORKSPACE_DIRECTORY, GROK_WORKER_SKILLS_LAYOUT, GROK_WORKER_SKILLS_VERSION, grokWorkerSkillsSha256, parseAgentSkills, renderGrokWorkerSkillsTree, type AgentSkill, type AgentSkillFile, type GrokWorkerSkillsEntry } from "./grokWorkerSkills.js";
+export { readAgentSkillsDirectory, type AgentSkillsTreePolicy } from "./agentSkillsDirectory.js";
+export { GROK_WORKER_FOREIGN_SKILL_ROOTS, verifyGrokWorkerForeignSkillRoots, verifyGrokWorkerSkills } from "./grokWorkerHomeAttestation.js";
 export { ENGINE_BROKER_SERVICE_V3, engineBrokerRequestLedgerPathFor, engineBrokerSealLedgerPathFor, parseEngineBrokerServiceConfig, type EngineBrokerServiceConfig, type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
 export { TURN_SEAL_LEDGER, TURN_SEAL_LEDGER_VERSION } from "./engineBrokerSealLedger.js";
 export { DEFAULT_GROK_BROKER_TURN_LIMITS, ENGINE_BROKER_LIMIT_REASONS, type EngineBrokerLimitReason, type EngineBrokerTurnAccounting, type EngineBrokerTurnLimits, type EngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAClL,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpE,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,yCAAyC,EAClF,KAAK,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,uCAAuC,EAC5I,6CAA6C,EAAE,KAAK,gCAAgC,EAAE,KAAK,uCAAuC,EAAE,MAAM,2BAA2B,CAAC;AACxK,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EACjK,8BAA8B,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,yCAAyC,EAAE,KAAK,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAC5P,OAAO,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,KAAK,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACjK,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACzJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,iCAAiC,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC9R,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC9H,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjP,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,EAClI,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,8BAA8B,EAC9B,yCAAyC,EACzC,2CAA2C,EAC3C,2CAA2C,EAC3C,8BAA8B,EAC9B,KAAK,4BAA4B,EACjC,KAAK,mDAAmD,EACxD,KAAK,sCAAsC,EAC3C,KAAK,2CAA2C,EAChD,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,uCAAuC,EAC5C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,KAAK,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC7K,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAClL,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpE,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,yCAAyC,EAClF,KAAK,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,uCAAuC,EAC5I,6CAA6C,EAAE,KAAK,gCAAgC,EAAE,KAAK,uCAAuC,EAAE,MAAM,2BAA2B,CAAC;AACxK,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EACjK,8BAA8B,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,yCAAyC,EAAE,KAAK,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAC5P,OAAO,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,KAAK,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACjK,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACzJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,iCAAiC,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC9R,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC9H,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC7R,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC5I,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjP,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,EAClI,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,8BAA8B,EAC9B,yCAAyC,EACzC,2CAA2C,EAC3C,2CAA2C,EAC3C,8BAA8B,EAC9B,KAAK,4BAA4B,EACjC,KAAK,mDAAmD,EACxD,KAAK,sCAAsC,EAC3C,KAAK,2CAA2C,EAChD,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,uCAAuC,EAC5C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,KAAK,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC7K,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/runtime/index.js

@@ -17,6 +17,9 @@ export { dedupeInferenceUsageRows, INFERENCE_USAGE_LEDGER_VERSION, GROK_INFERENC
 export { GROK_INFERENCE_AUTH_STALE_BODY } from "./grokInferenceProxy.js";
 export { assertGrokWorkerDenyPathPlacement, assertGrokWorkerDenyPathShape, assertGrokWorkerDenyPathsPlaceable, GROK_WORKER_BASE_PROFILE_GRANTS, grokWorkerCanSearch, grokWorkerDenyPathChain, GrokWorkerDenyPlacementError, readGrokWorkerDenyPathChain } from "./grokWorkerDenyPlacement.js";
 export { grokWorkerSandboxProfileSha256, renderGrokWorkerSandboxProfile } from "./grokWorkerSandboxProfile.js";
+export { AGENT_SKILLS_BOUNDS, AGENT_SKILLS_WORKSPACE_DIRECTORY, GROK_WORKER_SKILLS_LAYOUT, GROK_WORKER_SKILLS_VERSION, grokWorkerSkillsSha256, parseAgentSkills, renderGrokWorkerSkillsTree } from "./grokWorkerSkills.js";
+export { readAgentSkillsDirectory } from "./agentSkillsDirectory.js";
+export { GROK_WORKER_FOREIGN_SKILL_ROOTS, verifyGrokWorkerForeignSkillRoots, verifyGrokWorkerSkills } from "./grokWorkerHomeAttestation.js";
 export { ENGINE_BROKER_SERVICE_V3, engineBrokerRequestLedgerPathFor, engineBrokerSealLedgerPathFor, parseEngineBrokerServiceConfig } from "./engineBrokerServiceConfig.js";
 export { TURN_SEAL_LEDGER, TURN_SEAL_LEDGER_VERSION } from "./engineBrokerSealLedger.js";
 export { DEFAULT_GROK_BROKER_TURN_LIMITS, ENGINE_BROKER_LIMIT_REASONS } from "./engineBrokerTurnAccounting.js";

package/dist/runtime/productionAgentTools.js

@@ -226,7 +226,7 @@ function moltnetTool(agent, wakeContext) {
 }
 async function connect(agent, server) {
     taskClockChildEnvironment(server.env);
-    const client = new Client({ name: "daimon-production", version: "0.2.1" });
+    const client = new Client({ name: "daimon-production", version: "0.2.2" });
     const headers = server.authSecretEnv === undefined ? {} : { authorization: `Bearer ${requiredSecret(server.authSecretEnv)}` };
     const transport = server.transport === "stdio"
         ? new StdioClientTransport({ command: server.command, args: [...server.args], env: stringEnvironment(readyTaskClockEnvironment({ ...server.env, ...cliChildEnvironment([], agent.runtimeHomePath, { executablePath: server.command }) })) })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noopolis/daimon",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Noopolis native per-agent runtime harness built on Pi.",
   "license": "MIT",
   "type": "module",