@noopolis/daimon 0.2.1 → 0.2.3

package/dist/runtime/grokBrokerProxyRequest.js

@@ -2,6 +2,15 @@ import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
 import { GROK_WORKER_VISIBLE_TOOLS } from "../contracts/grokWorkerContract.js";
 import { DEFAULT_GROK_BROKER_MODEL_POLICY, parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
 const MAX_BODY = 2 * 1024 * 1024;
+/** A body-gate refusal. The message is the historic one; `check` names the failed check. */
+export class GrokBrokerProxyRequestRejection extends Error {
+    check;
+    constructor(check) {
+        super("broker proxy request rejected");
+        this.check = check;
+    }
+}
+function reject(check) { throw new GrokBrokerProxyRequestRejection(check); }
 /**
  * Authorizes one worker request and rebuilds it for the provider.
  *
@@ -13,23 +22,28 @@ const MAX_BODY = 2 * 1024 * 1024;
  * - the offered tool names are exactly the lean visible set. Grok 1.0.34 turns
  *   an unmappable `--tools` entry into its full 19-tool set, and its per-turn
  *   `session_title` request carries a single forced tool; both are refused.
+ *
+ * One other shape is admitted, and only by normalizing it into the lean one:
+ * Grok 1.0.34's auto-compaction summary request ({@link normalizeGrokCompactionRequest}).
  */
 export function authorizeGrokBrokerProxyRequest(input, capabilities, bearer, policy = DEFAULT_GROK_BROKER_MODEL_POLICY) {
     const declared = parseGrokBrokerModelPolicy(policy);
-    if (input.method !== "POST" || input.pathname !== "/v1/chat/completions" || input.body.byteLength < 2 || input.body.byteLength > MAX_BODY)
-        throw new Error("broker proxy request rejected");
+    if (input.method !== "POST" || input.pathname !== "/v1/chat/completions")
+        reject("route");
+    if (input.body.byteLength < 2 || input.body.byteLength > MAX_BODY)
+        reject("body_size");
     const authorization = input.headers.authorization;
     const match = authorization?.match(/^Bearer ([A-Za-z0-9_-]{40,})$/u);
     if (match === null || match === undefined)
-        throw new Error("broker proxy request rejected");
+        return reject("bearer");
     const scope = capabilities.authorizeToken(match[1]);
     if (scope === undefined || (input.agentId !== undefined && scope.agentId !== input.agentId) || (input.turnId !== undefined && scope.turnId !== input.turnId))
-        throw new Error("broker proxy request rejected");
+        reject("scope");
     if (!bearer || /[\r\n]/u.test(bearer))
         throw new Error("broker credential authority unavailable");
     const clientVersion = input.headers["x-grok-client-version"];
     if (clientVersion !== GROK_ENGINE_BROKER.grokCliVersion)
-        throw new Error("broker proxy request rejected");
+        reject("client_version");
     let parsed;
     // `__proto__` is refused at any depth: JSON.parse makes it an ordinary own
     // member, but an upstream JavaScript parser may treat it as a prototype.
@@ -41,16 +55,21 @@ export function authorizeGrokBrokerProxyRequest(input, capabilities, bearer, pol
         });
     }
     catch {
-        throw new Error("broker proxy request rejected");
+        return reject("json");
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || parsed.stream !== true || !Array.isArray(parsed.messages))
-        throw new Error("broker proxy request rejected");
-    if (parsed.model !== declared.model || parsed.reasoning_effort !== declared.reasoningEffort)
-        throw new Error("broker proxy request rejected");
+        reject("envelope");
+    const compaction = normalizeGrokCompactionRequest(parsed, declared.reasoningEffort);
+    if (parsed.model !== declared.model)
+        reject("model");
+    if (parsed.reasoning_effort !== declared.reasoningEffort)
+        reject("reasoning_effort");
     if (!exactLeanTools(parsed.tools))
-        throw new Error("broker proxy request rejected");
-    if (Object.keys(parsed).some((key) => !LEAN_BODY_MEMBERS.has(key)) || !validStreamOptions(parsed.stream_options))
-        throw new Error("broker proxy request rejected");
+        reject("tools");
+    if (Object.keys(parsed).some((key) => !LEAN_BODY_MEMBERS.has(key)))
+        reject("members");
+    if (!validStreamOptions(parsed.stream_options))
+        reject("stream_options");
     // Keep origin/main's production handling: UTF-8 replacement decoding, then
     // serialize the validated object (including last-member-wins duplicates).
     // Only a clocked turn takes the stricter date rewrite before this gate.
@@ -61,9 +80,45 @@ export function authorizeGrokBrokerProxyRequest(input, capabilities, bearer, pol
             "x-xai-token-auth": "xai-grok-cli", "x-grok-model-override": declared.model,
             "x-grok-client-version": clientVersion, "x-grok-client-identifier": "grok-shell"
         },
-        body: Buffer.from(JSON.stringify(parsed))
+        body: Buffer.from(JSON.stringify(parsed)),
+        ...(compaction ? { compaction: true } : {})
     };
 }
+/**
+ * Top-level members of Grok 1.0.34's auto-compaction summary request (live stub
+ * capture against the pinned binary in the training image, 2026-10-21). When a
+ * session nears the model's `context_window`, Grok asks the same model for a
+ * summary — single-pass, or a second "two-pass" request — and sends it with
+ * the lean tool set, `tool_choice: "auto"` and `temperature: 1`, and *without*
+ * `reasoning_effort`. Refusing it does not stop the session: Grok gives up on
+ * compaction and carries the whole history forward, so every refusal was a
+ * wasted round trip and the context kept growing.
+ */
+const COMPACTION_BODY_MEMBERS = new Set(["messages", "model", "stream", "stream_options", "temperature", "tool_choice", "tools"]);
+/**
+ * Rewrites, in place, exactly the captured compaction shape into the lean
+ * worker shape, and reports whether it did. The two extra members are each
+ * the provider's default value (`tool_choice: "auto"` with tools offered,
+ * `temperature: 1`), so removing them changes nothing the model is asked; the
+ * missing effort is set to the declared one, so the request cannot fall back
+ * to a provider default effort. Every other check — model, tools, stream
+ * options — then runs on the result exactly as for any worker request, and
+ * the forwarded body is indistinguishable from an ordinary lean request: the
+ * spend envelope is unchanged. Any other value of either member (a forced
+ * `tool_choice`, another temperature) or any other member set is left as is,
+ * and refused by the ordinary checks.
+ */
+export function normalizeGrokCompactionRequest(parsed, reasoningEffort) {
+    const keys = Object.keys(parsed);
+    if (keys.length !== COMPACTION_BODY_MEMBERS.size || keys.some((key) => !COMPACTION_BODY_MEMBERS.has(key)))
+        return false;
+    if (parsed.temperature !== 1 || parsed.tool_choice !== "auto")
+        return false;
+    delete parsed.temperature;
+    delete parsed.tool_choice;
+    parsed.reasoning_effort = reasoningEffort;
+    return true;
+}
 /** Top-level members of a Grok 1.0.34 lean worker chat-completions body (live stub capture). */
 const LEAN_BODY_MEMBERS = new Set(["messages", "model", "reasoning_effort", "stream", "stream_options", "tools"]);
 /** Members of each lean tool `function` entry (live stub capture). */

package/dist/runtime/grokBrokerTurnMeter.d.ts

@@ -83,8 +83,13 @@ export declare class GrokBrokerTurnMeter {
     private final;
     private activityAt;
     constructor(limits: EngineBrokerTurnLimits, onLimit?: (reason: Exclude<EngineBrokerLimitReason, "none">) => void, now?: () => number);
-    /** Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight. */
-    admit(): Readonly<{
+    /**
+     * Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight.
+     * `keepFinal` admits a request that cannot replace the answer (a compaction summary), so a final reply already recorded survives it.
+     */
+    admit(options?: Readonly<{
+        keepFinal?: boolean;
+    }>): Readonly<{
         index: number;
         signal: AbortSignal;
     } | {

package/dist/runtime/grokBrokerTurnMeter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerTurnMeter.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerTurnMeter.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAElK;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACxK,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAAE,CAAC,CAAC;AAC5O,wHAAwH;AACxH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEzF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,OAAO,CAAC;AACnD,yGAAyG;AACzG,eAAO,MAAM,iBAAiB,GAAI,OAAO,qBAAqB,KAAG,MAC4B,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,mBAAmB;IAQlB,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgF,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPjL,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiI;IACzJ,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,QAAQ,CAA6D;IAC7E,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,UAAU,CAAS;gBACN,MAAM,EAAE,sBAAsB,EAAmB,OAAO,GAAE,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,IAAsB,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAK1M,sJAAsJ;IACtJ,KAAK,IAAI,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC;IAgBlI;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAa/I,wEAAwE;IACxE,UAAU,IAAI,oBAAoB,GAAG,SAAS;IAC9C,sDAAsD;IACtD,IAAI,IAAI,OAAO;IACf,0FAA0F;IAC1F,cAAc,IAAI,MAAM;IAExB,mFAAmF;IACnF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,IAAI;IAO5D,8FAA8F;IAC9F,aAAa,IAAI,IAAI;IAErB,QAAQ,IAAI,2BAA2B;CAIxC;AAID,+GAA+G;AAC/G,eAAO,MAAM,wBAAwB,GAAI,cAAc,MAAM,KAAG,qBAG/D,CAAC;AAMF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,qBAAqB,GAAG,SAAS,CAU3H;AA0BD,uGAAuG;AACvG,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAClD,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAGtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CA2B3H;AAED,oGAAoG;AACpG,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAkBzG;AAED,sIAAsI;AACtI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAA6B,GAAG,MAAM,CAQ/F"}
+{"version":3,"file":"grokBrokerTurnMeter.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerTurnMeter.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAElK;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACxK,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAAE,CAAC,CAAC;AAC5O,wHAAwH;AACxH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEzF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,OAAO,CAAC;AACnD,yGAAyG;AACzG,eAAO,MAAM,iBAAiB,GAAI,OAAO,qBAAqB,KAAG,MAC4B,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,mBAAmB;IAQlB,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgF,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPjL,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiI;IACzJ,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,QAAQ,CAA6D;IAC7E,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,UAAU,CAAS;gBACN,MAAM,EAAE,sBAAsB,EAAmB,OAAO,GAAE,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,IAAsB,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAK1M;;;OAGG;IACH,KAAK,CAAC,OAAO,GAAE,QAAQ,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAM,GAAG,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC;IAiBjL;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAa/I,wEAAwE;IACxE,UAAU,IAAI,oBAAoB,GAAG,SAAS;IAC9C,sDAAsD;IACtD,IAAI,IAAI,OAAO;IACf,0FAA0F;IAC1F,cAAc,IAAI,MAAM;IAExB,mFAAmF;IACnF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,IAAI;IAO5D,8FAA8F;IAC9F,aAAa,IAAI,IAAI;IAErB,QAAQ,IAAI,2BAA2B;CAIxC;AAID,+GAA+G;AAC/G,eAAO,MAAM,wBAAwB,GAAI,cAAc,MAAM,KAAG,qBAG/D,CAAC;AAMF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,qBAAqB,GAAG,SAAS,CAU3H;AA0BD,uGAAuG;AACvG,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAClD,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAGtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CA2B3H;AAED,oGAAoG;AACpG,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAkBzG;AAED,sIAAsI;AACtI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAA6B,GAAG,MAAM,CAQ/F"}

package/dist/runtime/grokBrokerTurnMeter.js

@@ -63,8 +63,11 @@ export class GrokBrokerTurnMeter {
         this.startedAt = now();
         this.activityAt = this.startedAt;
     }
-    /** Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight. */
-    admit() {
+    /**
+     * Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight.
+     * `keepFinal` admits a request that cannot replace the answer (a compaction summary), so a final reply already recorded survives it.
+     */
+    admit(options = {}) {
         if (this.reason === "none") {
             if (this.now() - this.startedAt >= this.limits.timeoutMs)
                 this.trip("timeout");
@@ -78,8 +81,9 @@ export class GrokBrokerTurnMeter {
         if (this.inFlight !== undefined)
             return { busy: true };
         this.timings.push({ startedAt: new Date(this.now()).toISOString() });
-        // A new request means the previous answer was not the last one.
-        this.final = undefined;
+        // A new sampling request means the previous answer was not the last one.
+        if (options.keepFinal !== true)
+            this.final = undefined;
         this.activityAt = this.now();
         const controller = new AbortController();
         this.inFlight = { index: this.timings.length - 1, controller };

package/dist/runtime/grokWorkerAttestation.d.ts

@@ -53,7 +53,8 @@ export declare function parseGrokWorkerSandboxProfile(bytes: Uint8Array, profile
  * the events watermark it requires the 1.0.34 layout: events under
  * `$GROK_HOME/sessions/` (the root `sandbox-events.jsonl` stays empty on
  * 1.0.34), and a root-owned read-only worker home whose `config.toml` hashes to
- * the declared renderer output (`grokWorkerHomeAttestation.ts`).
+ * the declared renderer output and whose `skills/` is exactly the declared
+ * skills (`skillsSha256`; absent for none) (`grokWorkerHomeAttestation.ts`).
  *
  * It also refuses a deny list bubblewrap could not materialize
  * (`grokWorkerDenyPlacement.ts`), naming the entry and the ancestor that stops
@@ -73,6 +74,7 @@ export declare function prepareGrokWorkerAttestation(input: Readonly<{
     workerGid?: number;
     brokerGid: number;
     configSha256: GrokWorkerConfigPins;
+    skillsSha256?: string;
     registeredWorkers?: readonly Readonly<{
         profilePath: string;
         workerUid: number;

package/dist/runtime/grokWorkerAttestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokWorkerAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerAttestation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAiD,KAAK,oBAAoB,EAA4B,MAAM,+BAA+B,CAAC;AAGnJ;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,SAAS,MAAM,EAAE,CAAC;IAAA,aAAa,CAAC,EAAC,uBAAuB,CAAA;CAAC,CAAC,CAAC;AAC3J,KAAK,QAAQ,GAAC,6BAA6B,CAAC;AAC5C,qBAAa,4BAA6B,SAAQ,KAAK;IAAe,QAAQ,CAAC,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;gBAAhD,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;CAA4D;AAC3L;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,aAAa,EAAC,MAAM,GAAE,SAAS,MAAM,EAAE,CAUrG;AACD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,oBAAoB,CAAC;IAAA,iBAAiB,CAAC,EAAC,SAAS,QAAQ,CAAC;QAAC,WAAW,EAAC,MAAM,CAAC;QAAA,SAAS,EAAC,MAAM,CAAA;KAAC,CAAC,EAAE,CAAA;CAAC,CAAC,EAAC,YAAY,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,CAAC,EAAC,oBAAoB,CAAA;CAAC,CAAe,GAAE,OAAO,CAAC,QAAQ,GAAG;IAAE,aAAa,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAWxb;AACD,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,GAAE,CAAC,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,cAAa,CAAC,EAAC,eAAc,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,EAAC,cAAa,oBAAoB;;;;;;;CAA4J,CAAC;AACja;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAC;IAAC,QAAQ,CAAC,EAAC,QAAQ,CAAC;QAAC,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAA;KAAC,CAAC,CAAC;IAAA,OAAO,CAAC,EAAC,4BAA4B,CAAC,cAAc,CAAC,CAAA;CAAC,CAAC;AAE9J;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,GAAE,MAAI,OAAO,CAAC,IAAI,CAAC,CAOxI;AACD,wBAAsB,2BAA2B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,UAAU,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,IAAI,CAAC,EAAC,yBAAyB,GAAE,OAAO,CAAC,IAAI,CAAC,CAyBtM;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,IAAI,CAA4D;AAChL,uFAAuF;AACvF,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,QAAQ,CAAC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,MAAM,CAAA;CAAC,CAAC,CAavJ"}
+{"version":3,"file":"grokWorkerAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerAttestation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAiD,KAAK,oBAAoB,EAA4B,MAAM,+BAA+B,CAAC;AAGnJ;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,SAAS,MAAM,EAAE,CAAC;IAAA,aAAa,CAAC,EAAC,uBAAuB,CAAA;CAAC,CAAC,CAAC;AAC3J,KAAK,QAAQ,GAAC,6BAA6B,CAAC;AAC5C,qBAAa,4BAA6B,SAAQ,KAAK;IAAe,QAAQ,CAAC,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;gBAAhD,YAAY,EAAC,iBAAiB,GAAC,iBAAiB;CAA4D;AAC3L;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,aAAa,EAAC,MAAM,GAAE,SAAS,MAAM,EAAE,CAUrG;AACD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,oBAAoB,CAAC;IAAA,YAAY,CAAC,EAAC,MAAM,CAAC;IAAA,iBAAiB,CAAC,EAAC,SAAS,QAAQ,CAAC;QAAC,WAAW,EAAC,MAAM,CAAC;QAAA,SAAS,EAAC,MAAM,CAAA;KAAC,CAAC,EAAE,CAAA;CAAC,CAAC,EAAC,YAAY,GAAC,QAAQ,CAAC;IAAC,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,EAAC,MAAM,CAAC;IAAA,GAAG,CAAC,EAAC,oBAAoB,CAAA;CAAC,CAAe,GAAE,OAAO,CAAC,QAAQ,GAAG;IAAE,aAAa,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAY7c;AACD,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,GAAE,CAAC,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,cAAa,CAAC,EAAC,eAAc,SAAS,QAAQ,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAE,EAAC,cAAa,oBAAoB;;;;;;;CAA4J,CAAC;AACja;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAC;IAAC,QAAQ,CAAC,EAAC,QAAQ,CAAC;QAAC,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAC;QAAA,MAAM,EAAC,MAAM,CAAA;KAAC,CAAC,CAAC;IAAA,OAAO,CAAC,EAAC,4BAA4B,CAAC,cAAc,CAAC,CAAA;CAAC,CAAC;AAE9J;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,GAAE,MAAI,OAAO,CAAC,IAAI,CAAC,CAOxI;AACD,wBAAsB,2BAA2B,CAAC,KAAK,EAAC,QAAQ,CAAC;IAAC,UAAU,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;CAAC,CAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,IAAI,CAAC,EAAC,yBAAyB,GAAE,OAAO,CAAC,IAAI,CAAC,CAyBtM;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,IAAI,CAA4D;AAChL,uFAAuF;AACvF,wBAAgB,8BAA8B,CAAC,KAAK,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,GAAC,SAAS,MAAM,EAAK,GAAE,QAAQ,CAAC;IAAC,MAAM,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,MAAM,CAAA;CAAC,CAAC,CAavJ"}

package/dist/runtime/grokWorkerAttestation.js

@@ -64,7 +64,8 @@ export function parseGrokWorkerSandboxProfile(bytes, profileSha256) {
  * the events watermark it requires the 1.0.34 layout: events under
  * `$GROK_HOME/sessions/` (the root `sandbox-events.jsonl` stays empty on
  * 1.0.34), and a root-owned read-only worker home whose `config.toml` hashes to
- * the declared renderer output (`grokWorkerHomeAttestation.ts`).
+ * the declared renderer output and whose `skills/` is exactly the declared
+ * skills (`skillsSha256`; absent for none) (`grokWorkerHomeAttestation.ts`).
  *
  * It also refuses a deny list bubblewrap could not materialize
  * (`grokWorkerDenyPlacement.ts`), naming the entry and the ancestor that stops
@@ -100,7 +101,8 @@ export async function prepareGrokWorkerAttestation(input, profileOwner = { uid:
     if (workers.some((worker) => worker.home === undefined))
         throw new Error("Grok worker isolation attestation unavailable");
     await verifyGrokWorkerTmp(workers, profileOwner.tmp);
-    const configVariant = await verifyGrokWorkerHome(path.dirname(input.profilePath), input.configSha256);
+    // The home's read-only files share the profile's owner (root in production: `sandbox.toml` is one of them).
+    const configVariant = await verifyGrokWorkerHome(path.dirname(input.profilePath), input.configSha256, profileOwner.uid, input.skillsSha256);
     const events = await secureOpen(input.eventsPath, input.workerUid, input.brokerGid, 0o640, 16 * 1024 * 1024);
     try {
         const stat = await events.stat();

package/dist/runtime/grokWorkerHomeAttestation.d.ts

@@ -13,7 +13,7 @@ type Entry = Pick<Stats, "uid" | "mode" | "nlink"> & Partial<Pick<Stats, "dev" |
  * so the directory is worker-group writable — but root-owned and sticky, so a
  * worker can neither rename nor unlink a root-owned file in it. Every file
  * that decides a turn's behaviour is root-owned with no write bit: `config.toml`
- * (model, effort, MCP, skills), `sandbox.toml`, `trusted_folders.toml` (trust
+ * (model, effort, MCP, bundled-skill toggles), `sandbox.toml`, `trusted_folders.toml` (trust
  * would re-enable cwd `AGENTS.md` and project skills), and the managed and
  * requirements layers that can override user config. A missing file fails
  * too: the worker could create it.
@@ -24,9 +24,53 @@ export declare function assertGrokWorkerHomeEntries(entries: Readonly<Record<str
 /** The worker's `config.toml` must be exactly the renderer's bytes for the declared policy. */
 export declare function assertGrokWorkerConfigBytes(bytes: Uint8Array, pins: GrokWorkerConfigPins): GrokWorkerConfigVariant;
 /**
- * Attests the worker home layout and that `config.toml` is exactly the
- * renderer's bytes for the declared model policy (`configSha256`).
+ * The worker's `$GROK_HOME/skills` must be exactly the declared skills.
+ *
+ * Grok loads that directory as user-scoped skills even in an untrusted
+ * workspace, and `$GROK_HOME` is worker-group writable, so a worker could plant
+ * a skill there for its next turn. With no `skillsSha256` declared the
+ * directory must be absent (or an empty root-owned read-only directory); with
+ * one declared, every entry must be root-owned with no write bit and the tree
+ * must hash to it. A worker-created or worker-modified tree fails either way.
+ */
+export declare function verifyGrokWorkerSkills(grokHome: string, skillsSha256: string | undefined, rootUid?: number): Promise<void>;
+/**
+ * Every other skill root Grok discovers at user scope, which the worker could
+ * plant into: under `$GROK_HOME` (root-owned but worker-group writable and
+ * sticky, so the worker can create new entries) and under the worker's own
+ * `$HOME` (the launcher exports `HOME=<home>` and `GROK_HOME=<home>/.grok`;
+ * `<home>` is worker-owned). Only `$GROK_HOME/skills` may carry skills, and only
+ * the declared ones; each root here must be absent, or an empty root-owned
+ * directory with no write bit.
+ *
+ * Set from `grok inspect` with scratch `HOME`/`GROK_HOME` and no network
+ * (1.0.60: every root below listed a planted skill or command; `.codex/skills`,
+ * `.ai/skills`, `$HOME/.config/*` and `$HOME/.agents/plugins` did not) and from
+ * the pinned 1.0.34 binary's own skills table (`~/.grok/{skills,commands}`,
+ * `~/.claude/{skills,commands}`, `~/.cursor/skills`, `.agents/{skills,commands}`
+ * at each tier). `bundled/skills` is the bundled-skill cache: never created on
+ * 1.0.34 (P0 container evidence), but a skill planted there loads with a name
+ * `[skills] disabled` does not cover. `plugins/` folders load their skills and
+ * commands as trusted user plugins.
+ */
+export declare const GROK_WORKER_FOREIGN_SKILL_ROOTS: Readonly<{
+    grokHome: readonly ["commands", "bundled/skills", "plugins"];
+    home: readonly [".agents/skills", ".agents/commands", ".claude/skills", ".claude/commands", ".cursor/skills", ".cursor/commands"];
+}>;
+/**
+ * Refuses a foreign skill root (`GROK_WORKER_FOREIGN_SKILL_ROOTS`) that exists
+ * and is not an empty root-owned read-only directory. A deployment that never
+ * creates them passes unchanged. `grokHome` must be `<home>/.grok`, the
+ * launcher's layout, so `<home>` is its parent.
+ */
+export declare function verifyGrokWorkerForeignSkillRoots(grokHome: string, rootUid?: number): Promise<void>;
+/**
+ * Attests the worker home layout, that `config.toml` is exactly the
+ * renderer's bytes for the declared model policy (`configSha256`), that
+ * `skills/` is exactly the declared skills (`skillsSha256`, absent for none),
+ * and that no other user skill root holds anything
+ * (`verifyGrokWorkerForeignSkillRoots`).
  */
-export declare function verifyGrokWorkerHome(grokHome: string, configSha256: GrokWorkerConfigPins, rootUid?: number): Promise<GrokWorkerConfigVariant>;
+export declare function verifyGrokWorkerHome(grokHome: string, configSha256: GrokWorkerConfigPins, rootUid?: number, skillsSha256?: string): Promise<GrokWorkerConfigVariant>;
 export {};
 //# sourceMappingURL=grokWorkerHomeAttestation.d.ts.map

package/dist/runtime/grokWorkerHomeAttestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokWorkerHomeAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerHomeAttestation.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAKhD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9F,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC;IAAE,MAAM,IAAI,OAAO,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC;IAAC,cAAc,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAG9K;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,GAAE,MAA2B,GAAG,IAAI,CAS5I;AAED,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,GAAG,uBAAuB,CAQlH;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAevK"}
+{"version":3,"file":"grokWorkerHomeAttestation.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerHomeAttestation.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAKhD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAInF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9F,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC;IAAE,MAAM,IAAI,OAAO,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC;IAAC,cAAc,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAG9K;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,GAAE,MAA2B,GAAG,IAAI,CAS5I;AAED,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,GAAG,uBAAuB,CAQlH;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpJ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,+BAA+B;;;EAG1C,CAAC;AAEH;;;;;GAKG;AACH,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB7H;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,OAAO,GAAE,MAA2B,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkB9L"}

package/dist/runtime/grokWorkerHomeAttestation.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, open } from "node:fs/promises";
+import { lstat, open, readdir } from "node:fs/promises";
 import path from "node:path";
 import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { readAgentSkillsDirectory } from "./agentSkillsDirectory.js";
+import { GROK_WORKER_SKILLS_LAYOUT, grokWorkerSkillsSha256 } from "./grokWorkerSkills.js";
 const HOME = GROK_ENGINE_BROKER.worker.home;
 /**
  * The worker must not be able to change what Grok reads before its next turn.
@@ -11,7 +13,7 @@ const HOME = GROK_ENGINE_BROKER.worker.home;
  * so the directory is worker-group writable — but root-owned and sticky, so a
  * worker can neither rename nor unlink a root-owned file in it. Every file
  * that decides a turn's behaviour is root-owned with no write bit: `config.toml`
- * (model, effort, MCP, skills), `sandbox.toml`, `trusted_folders.toml` (trust
+ * (model, effort, MCP, bundled-skill toggles), `sandbox.toml`, `trusted_folders.toml` (trust
  * would re-enable cwd `AGENTS.md` and project skills), and the managed and
  * requirements layers that can override user config. A missing file fails
  * too: the worker could create it.
@@ -41,10 +43,94 @@ export function assertGrokWorkerConfigBytes(bytes, pins) {
     throw unavailable();
 }
 /**
- * Attests the worker home layout and that `config.toml` is exactly the
- * renderer's bytes for the declared model policy (`configSha256`).
+ * The worker's `$GROK_HOME/skills` must be exactly the declared skills.
+ *
+ * Grok loads that directory as user-scoped skills even in an untrusted
+ * workspace, and `$GROK_HOME` is worker-group writable, so a worker could plant
+ * a skill there for its next turn. With no `skillsSha256` declared the
+ * directory must be absent (or an empty root-owned read-only directory); with
+ * one declared, every entry must be root-owned with no write bit and the tree
+ * must hash to it. A worker-created or worker-modified tree fails either way.
+ */
+export async function verifyGrokWorkerSkills(grokHome, skillsSha256, rootUid = HOME.directory.uid) {
+    if (skillsSha256 !== undefined && !/^[0-9a-f]{64}$/u.test(skillsSha256))
+        throw unavailable();
+    let skills;
+    try {
+        skills = await readAgentSkillsDirectory(path.join(grokHome, GROK_WORKER_SKILLS_LAYOUT.relativePath), { ownerUid: rootUid, readOnly: true });
+    }
+    catch {
+        throw unavailable();
+    }
+    if (grokWorkerSkillsSha256(skills ?? []) !== (skillsSha256 ?? grokWorkerSkillsSha256([])))
+        throw unavailable();
+}
+/**
+ * Every other skill root Grok discovers at user scope, which the worker could
+ * plant into: under `$GROK_HOME` (root-owned but worker-group writable and
+ * sticky, so the worker can create new entries) and under the worker's own
+ * `$HOME` (the launcher exports `HOME=<home>` and `GROK_HOME=<home>/.grok`;
+ * `<home>` is worker-owned). Only `$GROK_HOME/skills` may carry skills, and only
+ * the declared ones; each root here must be absent, or an empty root-owned
+ * directory with no write bit.
+ *
+ * Set from `grok inspect` with scratch `HOME`/`GROK_HOME` and no network
+ * (1.0.60: every root below listed a planted skill or command; `.codex/skills`,
+ * `.ai/skills`, `$HOME/.config/*` and `$HOME/.agents/plugins` did not) and from
+ * the pinned 1.0.34 binary's own skills table (`~/.grok/{skills,commands}`,
+ * `~/.claude/{skills,commands}`, `~/.cursor/skills`, `.agents/{skills,commands}`
+ * at each tier). `bundled/skills` is the bundled-skill cache: never created on
+ * 1.0.34 (P0 container evidence), but a skill planted there loads with a name
+ * `[skills] disabled` does not cover. `plugins/` folders load their skills and
+ * commands as trusted user plugins.
+ */
+export const GROK_WORKER_FOREIGN_SKILL_ROOTS = Object.freeze({
+    grokHome: Object.freeze(["commands", "bundled/skills", "plugins"]),
+    home: Object.freeze([".agents/skills", ".agents/commands", ".claude/skills", ".claude/commands", ".cursor/skills", ".cursor/commands"])
+});
+/**
+ * Refuses a foreign skill root (`GROK_WORKER_FOREIGN_SKILL_ROOTS`) that exists
+ * and is not an empty root-owned read-only directory. A deployment that never
+ * creates them passes unchanged. `grokHome` must be `<home>/.grok`, the
+ * launcher's layout, so `<home>` is its parent.
+ */
+export async function verifyGrokWorkerForeignSkillRoots(grokHome, rootUid = HOME.directory.uid) {
+    if (path.basename(grokHome) !== ".grok")
+        throw unavailable();
+    const home = path.dirname(grokHome);
+    const roots = [...GROK_WORKER_FOREIGN_SKILL_ROOTS.grokHome.map((root) => path.join(grokHome, root)), ...GROK_WORKER_FOREIGN_SKILL_ROOTS.home.map((root) => path.join(home, root))];
+    for (const root of roots) {
+        let entry;
+        try {
+            entry = await lstat(root);
+        }
+        catch (error) {
+            // Absent, or a parent that is not a directory: Grok finds nothing there either.
+            if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                continue;
+            throw unavailable();
+        }
+        if (entry.isSymbolicLink() || !entry.isDirectory() || entry.uid !== rootUid || (Number(entry.mode) & 0o7222) !== 0)
+            throw unavailable();
+        let children;
+        try {
+            children = await readdir(root);
+        }
+        catch {
+            throw unavailable();
+        }
+        if (children.length !== 0)
+            throw unavailable();
+    }
+}
+/**
+ * Attests the worker home layout, that `config.toml` is exactly the
+ * renderer's bytes for the declared model policy (`configSha256`), that
+ * `skills/` is exactly the declared skills (`skillsSha256`, absent for none),
+ * and that no other user skill root holds anything
+ * (`verifyGrokWorkerForeignSkillRoots`).
  */
-export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOME.directory.uid) {
+export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOME.directory.uid, skillsSha256) {
     const entries = {};
     for (const name of [".", HOME.sessionsDirectory.relativePath, ...HOME.readOnlyFiles.names]) {
         try {
@@ -63,7 +149,10 @@ export async function verifyGrokWorkerHome(grokHome, configSha256, rootUid = HOM
         // Same inode as the lstat above, as in `secureOpen`: a rename between the two cannot swap in other bytes.
         if (!opened.isFile() || opened.size > 65_536 || opened.dev !== before.dev || opened.ino !== before.ino || opened.uid !== before.uid || opened.mode !== before.mode || opened.nlink !== 1)
             throw unavailable();
-        return assertGrokWorkerConfigBytes(await handle.readFile(), configSha256);
+        const variant = assertGrokWorkerConfigBytes(await handle.readFile(), configSha256);
+        await verifyGrokWorkerSkills(grokHome, skillsSha256, rootUid);
+        await verifyGrokWorkerForeignSkillRoots(grokHome, rootUid);
+        return variant;
     }
     catch {
         throw unavailable();

package/dist/runtime/grokWorkerSkills.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Where root provisioning renders the agent's declared skills inside the worker
+ * home (`$GROK_HOME/skills`), and what every entry must be: root-owned, no
+ * write bit. Grok discovers that directory as user-scoped skills even in an
+ * untrusted workspace. Absent when the registration declares no `skillsSha256`.
+ *
+ * Deliberately *not* folded into `RUNTIME_CONTRACT_MANIFEST`, as with
+ * `TURN_USAGE_LEDGER`: the manifest's canonical bytes are digest-pinned by
+ * Spawnfile and attested against the selected runtime image, so a new key
+ * there makes every pinned image fail to attest. Only Daimon reads this layout
+ * (the renderer below and the broker's pre-turn attestation); Spawnfile
+ * consumes it through `renderGrokWorkerSkillsTree`.
+ */
+export declare const GROK_WORKER_SKILLS_LAYOUT: Readonly<{
+    readonly relativePath: "skills";
+    readonly uid: 0;
+    readonly gid: 0;
+    readonly directoryMode: 365;
+    readonly fileMode: 292;
+    readonly digestVersion: "noopolis.daimon.grok-worker-skills.v1";
+}>;
+/**
+ * One file of a declared agent skill, relative to the skill's own directory.
+ * `SKILL.md` is required; supporting files (references, scripts) are optional.
+ */
+export type AgentSkillFile = Readonly<{
+    path: string;
+    content: string;
+}>;
+/** One declared agent skill: its directory name and every file under it. */
+export type AgentSkill = Readonly<{
+    name: string;
+    files: readonly AgentSkillFile[];
+}>;
+/**
+ * The engine-neutral skills input. It is the compiled workspace tree every
+ * engine is given — Spawnfile lowers declared skills (and Moltnet installs its
+ * own) into `<workspace>/.agents/skills/<name>/SKILL.md`, which Codex reads in
+ * place. A brokered Grok worker cannot read it there: its workspace stays
+ * untrusted, so root provisioning renders the same skills into
+ * `$GROK_HOME/skills` instead.
+ */
+export declare const AGENT_SKILLS_WORKSPACE_DIRECTORY: ".agents/skills";
+export declare const GROK_WORKER_SKILLS_VERSION: "noopolis.daimon.grok-worker-skills.v1";
+export declare const AGENT_SKILLS_BOUNDS: Readonly<{
+    skills: 64;
+    filesPerSkill: 64;
+    fileBytes: 262144;
+    totalBytes: 4194304;
+    depth: 8;
+}>;
+/**
+ * Strict, canonicalizing parser: names and path components are plain
+ * identifiers (no `.`/`..`, no hidden entries, no separators other than `/`),
+ * every skill carries `SKILL.md`, nothing collides, and the sizes are bounded.
+ * Output is sorted by name and path so equal sets digest equally.
+ */
+export declare function parseAgentSkills(value: unknown): readonly AgentSkill[];
+/**
+ * sha256 over the canonical description of the rendered tree: every skill's
+ * name and, per file, its path, byte length and content digest. The broker
+ * attests `$GROK_HOME/skills` against it before every turn, and the Grok broker
+ * projection carries it, so the slot preflight receipt and every recomputed
+ * projection bind the exact skills a subject was given.
+ */
+export declare function grokWorkerSkillsSha256(skills: readonly AgentSkill[]): string;
+/** One entry root provisioning creates, relative to `$GROK_HOME`, owned `uid:gid`. */
+export type GrokWorkerSkillsEntry = Readonly<{
+    path: string;
+    kind: "directory" | "file";
+    uid: number;
+    gid: number;
+    mode: number;
+    content?: string;
+}>;
+/**
+ * Every directory and file root provisioning writes for these skills, parents
+ * before children: `skills/` itself, each `skills/<name>/`, any intermediate
+ * directory, and each file. Directories are `root:root 0555` and files
+ * `root:root 0444` (single link), so a worker-uid process can read them but
+ * neither change nor replace them; `$GROK_HOME` is root-owned and sticky, so the
+ * worker cannot rename `skills/` away either. No skills renders nothing: the
+ * directory must then be absent, exactly as before this layout existed.
+ */
+export declare function renderGrokWorkerSkillsTree(skills: readonly AgentSkill[]): readonly GrokWorkerSkillsEntry[];
+//# sourceMappingURL=grokWorkerSkills.d.ts.map

package/dist/runtime/grokWorkerSkills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokWorkerSkills.d.ts","sourceRoot":"","sources":["../../src/runtime/grokWorkerSkills.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB;;;;;;;EAE3B,CAAC;AAGZ;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACzE,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,CAAC,CAAC;AAEtF;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAG,gBAAyB,CAAC;AAC1E,eAAO,MAAM,0BAA0B,yCAAuB,CAAC;AAC/D,eAAO,MAAM,mBAAmB;;;;;;EAAwG,CAAC;AASzI;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,UAAU,EAAE,CA6BtE;AAID;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAO5E;AAED,sFAAsF;AACtF,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAErJ;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,qBAAqB,EAAE,CAiB1G"}