spawnfile 0.1.13 → 0.1.17

package/dist/compiler/containerDaimonGrokWorkerProvisioning.js

@@ -0,0 +1,108 @@
+import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
+import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
+import { DAIMON_GROK_DENIED_STATE_ROOTS, DAIMON_GROK_OPTIONAL_DENY_PATHS, DAIMON_GROK_WORKER_READ_ONLY_FILES, DAIMON_WORKER_ROOT, renderDaimonGrokServiceConfig } from "./containerDaimonGrokWorkerRender.js";
+/** Only the bytes the program writes; everything else it needs is recomputed or checked in place. */
+const programRegistration = (entry) => ({
+    agentId: entry.agentId,
+    config: entry.config,
+    configSha256: entry.configSha256,
+    deferredDenyPaths: entry.deferredDenyPaths,
+    denyPaths: entry.denyPaths,
+    eventsPath: entry.eventsPath,
+    grokHome: entry.grokHome,
+    home: entry.home,
+    model: entry.model,
+    profile: entry.profile,
+    profilePath: entry.profilePath,
+    privateTmp: entry.privateTmp,
+    profileSha256: entry.profileSha256,
+    reasoningEffort: entry.reasoningEffort,
+    runtimeHome: entry.runtimeHome,
+    runtimeHomeMounts: entry.runtimeHomeMounts,
+    spillDirectory: entry.spillDirectory,
+    slot: entry.slot,
+    uid: entry.uid,
+    workspace: entry.workspace
+});
+/**
+ * Root provisioning for every brokered Grok worker, as lines of the broker's
+ * node provisioning program (which already defines `crypto`, `fs`, and
+ * `secureWorkspace`).
+ *
+ * Layout per Daimon's `GROK_ENGINE_BROKER.worker.home` (attested by the broker
+ * before every turn): `$GROK_HOME` (`<home>/.grok`) and `$GROK_HOME/sessions`
+ * are `root:<worker> 1771`; `config.toml` (Daimon's renderer bytes for the
+ * declared model x effort), `sandbox.toml`, and the empty `trusted_folders.toml`,
+ * `managed_config.toml` and `requirements.toml` are `root:root 0444`, so the
+ * worker can neither write, rename nor unlink any file that decides a turn —
+ * trust included; `sessions/sandbox-events.jsonl` is `<worker>:<broker> 0640`.
+ *
+ * Every path handed to Daimon (workspace, home, profile, events, and each deny
+ * entry) must be canonical: it exists, is not a symlink, and resolves to itself.
+ * Daimon never resolves these paths, so a symlinked entry would silently mask
+ * the wrong inode. Root chmods only paths it owns at that moment (no
+ * `CAP_FOWNER`): reclaim, mode, then hand over.
+ */
+export const renderDaimonGrokWorkerProvisioning = (registrations, serviceOptions = {}, 
+/**
+ * Deny targets this program creates root-owned `0700` when they are absent,
+ * so every mask always has an inode. The default is the production
+ * container's set; the training container passes its own, because its roots
+ * are tmpfs mounts and `/run/secrets` and the shared state roots do not
+ * exist there at all.
+ */
+optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS]) => [
+    `const grokWorkers = ${JSON.stringify(registrations.map(programRegistration))};`,
+    `const optionalDenyPaths = new Set(${JSON.stringify([...optionalDenyPaths])});`,
+    `const pinnedConfigSha256 = ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.configSha256)};`,
+    "const sha256Hex = (value) => crypto.createHash('sha256').update(value).digest('hex');",
+    "for (const entry of grokWorkers) { if (sha256Hex(entry.config) !== entry.configSha256 || !Object.hasOwn(pinnedConfigSha256, entry.model) || !Object.hasOwn(pinnedConfigSha256[entry.model], entry.reasoningEffort) || pinnedConfigSha256[entry.model][entry.reasoningEffort] !== entry.configSha256 || sha256Hex(entry.profile) !== entry.profileSha256 || entry.denyPaths.length === 0) throw new Error(`Grok worker contract bytes for ${entry.agentId} do not match their pins`); }",
+    // Root holds no CAP_FOWNER: every mode change reclaims the inode, sets the mode, then restores or hands over ownership.
+    "const withMode = (target, mode, uid, gid) => { const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`unsafe Grok worker directory: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
+    "const traversable = (target) => { for (let ancestor = require('node:path').dirname(target); ancestor.startsWith('/var/lib/spawnfile/') && ancestor.length > '/var/lib/spawnfile'.length; ancestor = require('node:path').dirname(ancestor)) { const info = fs.lstatSync(ancestor); if ((info.mode & 0o011) !== 0o011) withMode(ancestor, (info.mode & 0o7777) | 0o011, info.uid, info.gid); } };",
+    "const assertCanonical = (target, label) => { const info = fs.lstatSync(target); if (info.isSymbolicLink() || fs.realpathSync(target) !== target) throw new Error(`Grok worker ${label} is not a canonical non-symlink path: ${target}`); return info; };",
+    "const ensureDirectory = (target, uid, gid, mode) => { fs.mkdirSync(target, { recursive: true, mode: 0o700 }); const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('unsafe worker runtime directory'); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
+    "const ensureExactFile = (target, content, mode) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, content, { mode, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) throw new Error('unsafe worker runtime file'); if (fs.readFileSync(target, 'utf8') !== content) throw new Error(`worker runtime file identity mismatch: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); };",
+    `const ensureEventsFile = (target, uid) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, '', { mode: 0o640, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.uid !== uid && info.uid !== 0) || ![0, uid, ${DAIMON_BROKER_UID}].includes(info.gid) || ![0o600, 0o640, 0o644].includes(info.mode & 0o777)) throw new Error('unsafe worker attestation events'); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o640); fs.chownSync(target, uid, ${DAIMON_BROKER_UID}); };`,
+    `fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`,
+    // Pass 1: every workspace and home exists, root-held, before any deny list is checked.
+    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ensureDirectory(entry.home, 0, 0, 0o700); ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
+    "for (const denied of optionalDenyPaths) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.mkdirSync(denied, { mode: 0o700 }); fs.chownSync(denied, 0, 0); fs.chmodSync(denied, 0o700); } }",
+    "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { try { assertCanonical(denied, 'deny path'); } catch (error) { if (error.code === 'ENOENT' && entry.deferredDenyPaths.includes(denied)) continue; if (error.code === 'ENOENT') throw new Error(`Grok worker deny path is missing: ${denied}`); throw error; } }",
+    // Pass 2: exact root-owned read-only files, the events file, then the final sticky modes.
+    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710); for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
+    // Worker-private temp: the launcher compiles TMPDIR=<home>/tmp, the only temp the worker may write. It is
+    // created in the pass above, while the home is still root-owned: root here holds no CAP_DAC_OVERRIDE, so
+    // once the home is `<worker>:<broker> 0710` root can no longer create anything inside it.
+    "for (const entry of grokWorkers) { ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); assertCanonical(entry.privateTmp, 'private temp'); }",
+    // Spills: <runtimeHome>/tool-output 2000:<worker> 2750 (setgid) under a runtime home the worker's group can
+    // traverse. The spill directory is created before the runtime home is narrowed to 0710: without
+    // CAP_DAC_OVERRIDE root cannot create inside a directory it does not own once the mode excludes it.
+    `for (const entry of grokWorkers) { traversable(entry.runtimeHome); fs.mkdirSync(entry.runtimeHome, { recursive: true, mode: 0o700 }); assertCanonical(entry.runtimeHome, 'runtime home'); try { fs.mkdirSync(entry.spillDirectory, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; } assertCanonical(entry.spillDirectory, 'spill directory'); withMode(entry.spillDirectory, 0o2750, ${DAIMON_ORGANIZATION_UID}, entry.uid); for (const mounted of entry.runtimeHomeMounts) { assertCanonical(mounted, 'runtime home mount'); withMode(mounted, 0o700, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } withMode(entry.runtimeHome, 0o710, ${DAIMON_ORGANIZATION_UID}, entry.uid); }`,
+    // Shared temp: Grok refuses a profile denying /tmp or /var/tmp, so modes close them: root:<org group> 1774 lets workers list names only.
+    `for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`,
+    // Deny-path placement, asserted once every mode above is final. Grok 1.0.34 materializes each deny
+    // target inside bubblewrap AS THE WORKER UID, so the worker must be able to search every ancestor and
+    // the target must already exist; one unplaceable entry makes Grok refuse the whole profile and every
+    // turn of that worker fails with a bare `bwrap: Can't create file at ...: Permission denied`. Root here
+    // holds CAP_DAC_READ_SEARCH, so it can read every mode the worker cannot, and decides for it.
+    "const searches = (info, uid, gid) => info.uid === uid ? (info.mode & 0o100) !== 0 : info.gid === gid ? (info.mode & 0o010) !== 0 : (info.mode & 0o001) !== 0;",
+    "const assertPlaceable = (denied, uid, gid) => { const parts = denied.split('/').slice(1); let at = ''; for (const part of parts.slice(0, -1)) { at += `/${part}`; let info; try { info = fs.lstatSync(at); } catch (error) { throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} could not be read (${error.code})`); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} is not a directory`); if (!searches(info, uid, gid)) throw new Error(`Grok worker deny path ${denied} is not placeable: worker uid ${uid} cannot search ${at} (${(info.mode & 0o7777).toString(8)} ${info.uid}:${info.gid}); deny that directory itself instead`); } };",
+    "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { if (entry.deferredDenyPaths.includes(denied)) { try { fs.lstatSync(denied); } catch (error) { if (error.code === 'ENOENT') continue; throw error; } } assertPlaceable(denied, entry.uid, entry.uid); }",
+    `const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations, serviceOptions))};`,
+    "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.agentId === registration.agentId); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
+    `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`
+];
+const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+/**
+ * Grok 1.0.34 runs every sandbox profile inside bubblewrap, which needs
+ * unprivileged user namespaces. Ubuntu 24.04+ hosts (and Colima's default VM)
+ * ship `kernel.apparmor_restrict_unprivileged_userns=1`, under which bubblewrap
+ * cannot create them even with the pinned seccomp profile — every worker turn
+ * would then fail attestation long after startup. The container sees the host
+ * kernel's sysctls read-only, so this refuses to start with the fix named.
+ */
+export const renderDaimonGrokHostPreflight = (procSys = "/proc/sys") => [
+    `if [ -r ${shellQuote(`${procSys}/kernel/apparmor_restrict_unprivileged_userns`)} ] && [ "$(cat ${shellQuote(`${procSys}/kernel/apparmor_restrict_unprivileged_userns`)})" != 0 ]; then echo "Daimon Grok workers need unprivileged user namespaces for bubblewrap: set kernel.apparmor_restrict_unprivileged_userns=0 on the Docker host (sysctl -w kernel.apparmor_restrict_unprivileged_userns=0; persist it in /etc/sysctl.d)" >&2; exit 1; fi`,
+    `if [ -r ${shellQuote(`${procSys}/user/max_user_namespaces`)} ] && [ "$(cat ${shellQuote(`${procSys}/user/max_user_namespaces`)})" = 0 ]; then echo "Daimon Grok workers need unprivileged user namespaces for bubblewrap: user.max_user_namespaces is 0 on the Docker host" >&2; exit 1; fi`
+];

package/dist/compiler/containerDaimonGrokWorkerRender.d.ts

@@ -0,0 +1,172 @@
+import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../runtime/daimon/contractManifest.js";
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+export declare const DAIMON_WORKER_ROOT = "/var/lib/daimon-workers";
+export declare const DAIMON_GROK_WORKER_READ_ONLY_FILES: readonly ["config.toml", "managed_config.toml", "requirements.toml", "sandbox.toml", "trusted_folders.toml"];
+/** Container paths no Grok worker may read that nothing else guarantees to exist; provisioning creates them root-owned 0700 when absent. */
+export declare const DAIMON_GROK_OPTIONAL_DENY_PATHS: readonly ["/run/secrets", "/run/spawnfile", "/run/spawnfile-secrets", "/run/world"];
+/**
+ * The organization runtime state directory — the parent of the durable wake
+ * acceptance store. The ownership guard secures it to `0700 2000:2000` for
+ * every Daimon organization; the acceptance store beneath it is also on every
+ * Grok worker's sandbox deny list.
+ */
+export declare const DAIMON_ORGANIZATION_STATE_DIRECTORY: string;
+/**
+ * The deny entry that protects the durable wake-acceptance store: the
+ * organization state directory the store lives in, not the store itself.
+ *
+ * Grok 1.0.34 materializes every `deny` target inside bubblewrap **as the
+ * worker uid** (it bind-mounts `$GROK_HOME/sandbox-blocked-{file,dir}` over
+ * the target), so an entry is placeable only when the worker can search every
+ * ancestor directory and the target already exists. The ownership guard secures
+ * this state directory to `0700 2000:2000`, so the store beneath it can never
+ * be a deny entry — and a single unplaceable entry makes Grok refuse the whole
+ * profile, failing *every* turn with `bwrap: Can't create file at …:
+ * Permission denied`, not just that path (matrix:
+ * `.runtime/grok-deny-placement/EVIDENCE.md`).
+ *
+ * Lifting the mask to the directory is strictly stronger than masking the store
+ * — nothing else lives there — and it adds no traversal right to the worker,
+ * which opening the directory with `o+x` would have done.
+ */
+export declare const daimonGrokAcceptanceStoreDenyPath: (instanceRoot: string) => string;
+/**
+ * Paths Grok 1.0.34's strict base profile grants (read or read-write). Grok
+ * refuses to start when a deny entry equals or contains one of them (verified
+ * for `/tmp`, `/var/tmp`, `/run`, `/etc` and `sessions`; `/tmp/sub` works), so a
+ * deny entry must always sit strictly below every grant it touches.
+ */
+export declare const DAIMON_GROK_BASE_PROFILE_GRANTS: readonly ["/bin", "/dev", "/etc", "/lib", "/proc", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var", "/var/tmp"];
+export declare const DAIMON_GROK_MAX_REGISTERED_PATH_BYTES = 255;
+/**
+ * The canonical path rule Daimon's service parser and native launcher enforce:
+ * absolute, no empty, `.` or `..` component, no trailing slash, and at most 255
+ * bytes (the registration record's NUL-terminated 256-byte fields).
+ */
+export declare const assertCanonicalRegisteredPath: (label: string, value: string) => string;
+export interface DaimonGrokRegistration {
+    agentId: string;
+    config: string;
+    configSha256: string;
+    denyPaths: string[];
+    /** Deny entries the main entrypoint materializes after root provisioning (workspace resource backings); absent is allowed there, a symlink never. */
+    deferredDenyPaths: string[];
+    eventsPath: string;
+    grokHome: string;
+    home: string;
+    /**
+     * The per-turn limits this registration declares. A wake may only lower them
+     * (Daimon refuses a raise as `invalid_request`), so a deployment that admits
+     * wakes above the manifest defaults must declare them here.
+     */
+    limits?: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+    model: DaimonGrokBrokerModel;
+    profile: string;
+    profilePath: string;
+    profileSha256: string;
+    /** `<home>/tmp`: the launcher's compiled `TMPDIR` for this worker. */
+    privateTmp: string;
+    reasoningEffort: DaimonGrokBrokerReasoningEffort;
+    /** The organization runtime home whose `tool-output/` this worker reads. */
+    runtimeHome: string;
+    /** Persistent mounts inside this agent's runtime home; Spawnfile keeps each `0700` under the traversable home. */
+    runtimeHomeMounts: string[];
+    /** `<runtimeHome>/tool-output`: setgid spill directory in the worker's group. */
+    spillDirectory: string;
+    slot: number;
+    uid: number;
+    usageLedgerPath: string;
+    workspace: string;
+}
+/**
+ * Spawnfile-managed state roots no Grok worker needs: the shared Moltnet store
+ * (server data, node/bridge configs, receipt stores, network state), per-agent
+ * Moltnet open-mode token directories, and declared Mneme memory banks. A
+ * worker reaches Moltnet and memory only through Daimon's MCP tools, which run
+ * in the organization process, never by reading these files. Provisioning
+ * creates each root-owned `0700` when absent so the mask always has a target.
+ */
+export declare const DAIMON_GROK_DENIED_STATE_ROOTS: readonly ["/var/lib/spawnfile/agents", "/var/lib/spawnfile/memory", "/var/lib/spawnfile/moltnet"];
+/**
+ * One brokered worker's sandbox deny list.
+ *
+ * Daimon's own protected set for the agent (`grokSandboxProtectedPaths`: the
+ * Grok bootstrap and realm, the AGY realm and unlock secret when any agent is
+ * AGY, the organization state directory that holds the wake-acceptance store,
+ * and every peer's runtime home and workspace) is always kept verbatim, so a Daimon projection over the same inputs renders
+ * the same profile. This deployment adds everything else the container
+ * provisions that the worker does not need: the organization config directory
+ * (all agents' instructions and any env files), every persistent mount of
+ * every runtime plan (the worker's own tool state, credential home and memory
+ * included — it reaches them only through Daimon), every other runtime
+ * instance root, the shared Moltnet/agent/memory state roots, every workspace
+ * resource backing path not linked from this agent's own workspace, the broker's
+ * `/etc` and `/run` directories, the usage ledger and wake fuse, every other
+ * worker's home, and the container secret roots.
+ *
+ * Allowed on purpose: the agent's own workspace (the worker's cwd), its own
+ * runtime home directory itself (Daimon's tool-result spill contract names paths
+ * under it; its contents are persistent mounts and denied), its own worker home,
+ * and backing paths of resources linked into its own workspace (a mask over the
+ * backing inode would also hide the agent's own resource through its link).
+ *
+ * Grok 1.0.34's strict base reads all of `/run`, `/var`, `/tmp` and `/etc`, and
+ * macOS bind mounts ignore unix modes, so this list — not file modes — is the
+ * boundary. Masks cannot nest: an added entry already covered by another entry
+ * is dropped, and an added entry that would cover a Daimon entry is refused.
+ *
+ * Every entry must also be *placeable*: Grok materializes each deny target
+ * inside bubblewrap as the worker uid, so the target must exist and the worker
+ * must be able to search every ancestor. That depends on modes, not paths, so
+ * the root provisioning program asserts it once every mode is final and refuses
+ * to start the container otherwise (`containerDaimonGrokWorkerProvisioning.ts`);
+ * here a protected path whose parent is private is lifted to that parent
+ * instead (`daimonGrokAcceptanceStoreDenyPath`).
+ */
+export declare const resolveDaimonGrokWorkerDenyPaths: (plans: readonly RuntimeTargetPlan[], plan: RuntimeTargetPlan, agentId: string, workerHomes: readonly string[], ownHome: string) => string[];
+export declare const resolveDaimonGrokRegistrations: (plans: RuntimeTargetPlan[]) => DaimonGrokRegistration[];
+export interface DaimonGrokServiceConfigOptions {
+    /**
+     * Where the broker keeps its durable turn registry. Production keeps it on
+     * the realm volume beside the credential; training overrides it to per-slot
+     * tmpfs so a recycled slot can never replay trial N's sealed turn in trial
+     * N+1 (R2), and refuses any path on the realm volume for that reason.
+     */
+    turnStore?: string;
+    /** `service.json` v2's optional evaluator inference ledger. Without it the broker refuses every grant. */
+    inferenceLedgerPath?: string;
+}
+/** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
+export declare const renderDaimonGrokServiceConfig: (registrations: readonly DaimonGrokRegistration[], options?: DaimonGrokServiceConfigOptions) => {
+    registrations: {
+        agentId: string;
+        slot: number;
+        workerUid: number;
+        workspace: string;
+        profilePath: string;
+        eventsPath: string;
+        profileSha256: string;
+        usageLedgerPath: string;
+        limits: {
+            maxRequests: 32;
+            maxTokens: 300000;
+            timeoutMs: 240000;
+        } | {
+            maxRequests: number;
+            maxTokens: number;
+            timeoutMs: number;
+        };
+        model: {
+            id: "grok-4.6" | "grok-4.5" | "grok-build";
+            reasoningEffort: "high" | "medium" | "low";
+        };
+    }[];
+    inferenceLedgerPath?: string | undefined;
+    version: "noopolis.daimon.engine-broker-service.v2";
+    credentialHome: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+    turnStore: string;
+};

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -0,0 +1,268 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { DAIMON_ORGANIZATION_TARGET_ID, DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY, DAIMON_RUNTIME_HOMES_DIRECTORY, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER, DAIMON_RUNTIME_HOME_ROOT } from "../runtime/daimon/contractManifest.js";
+import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
+import { DAIMON_FIRST_WORKER_UID } from "../runtime/daimon/runtimeIdentity.js";
+export const DAIMON_WORKER_ROOT = "/var/lib/daimon-workers";
+export const DAIMON_GROK_WORKER_READ_ONLY_FILES = DAIMON_GROK_ENGINE_BROKER.worker.home.readOnlyFiles.names;
+/** Container paths no Grok worker may read that nothing else guarantees to exist; provisioning creates them root-owned 0700 when absent. */
+export const DAIMON_GROK_OPTIONAL_DENY_PATHS = ["/run/secrets", "/run/spawnfile", "/run/spawnfile-secrets", "/run/world"];
+/**
+ * The organization runtime state directory — the parent of the durable wake
+ * acceptance store. The ownership guard secures it to `0700 2000:2000` for
+ * every Daimon organization; the acceptance store beneath it is also on every
+ * Grok worker's sandbox deny list.
+ */
+export const DAIMON_ORGANIZATION_STATE_DIRECTORY = path.posix.join(DAIMON_RUNTIME_HOME_ROOT, DAIMON_ORGANIZATION_TARGET_ID, "state");
+/**
+ * The deny entry that protects the durable wake-acceptance store: the
+ * organization state directory the store lives in, not the store itself.
+ *
+ * Grok 1.0.34 materializes every `deny` target inside bubblewrap **as the
+ * worker uid** (it bind-mounts `$GROK_HOME/sandbox-blocked-{file,dir}` over
+ * the target), so an entry is placeable only when the worker can search every
+ * ancestor directory and the target already exists. The ownership guard secures
+ * this state directory to `0700 2000:2000`, so the store beneath it can never
+ * be a deny entry — and a single unplaceable entry makes Grok refuse the whole
+ * profile, failing *every* turn with `bwrap: Can't create file at …:
+ * Permission denied`, not just that path (matrix:
+ * `.runtime/grok-deny-placement/EVIDENCE.md`).
+ *
+ * Lifting the mask to the directory is strictly stronger than masking the store
+ * — nothing else lives there — and it adds no traversal right to the worker,
+ * which opening the directory with `o+x` would have done.
+ */
+export const daimonGrokAcceptanceStoreDenyPath = (instanceRoot) => path.posix.dirname(path.posix.join(instanceRoot, DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY));
+/**
+ * Paths Grok 1.0.34's strict base profile grants (read or read-write). Grok
+ * refuses to start when a deny entry equals or contains one of them (verified
+ * for `/tmp`, `/var/tmp`, `/run`, `/etc` and `sessions`; `/tmp/sub` works), so a
+ * deny entry must always sit strictly below every grant it touches.
+ */
+export const DAIMON_GROK_BASE_PROFILE_GRANTS = ["/bin", "/dev", "/etc", "/lib", "/proc", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var", "/var/tmp"];
+export const DAIMON_GROK_MAX_REGISTERED_PATH_BYTES = 255;
+/**
+ * The canonical path rule Daimon's service parser and native launcher enforce:
+ * absolute, no empty, `.` or `..` component, no trailing slash, and at most 255
+ * bytes (the registration record's NUL-terminated 256-byte fields).
+ */
+export const assertCanonicalRegisteredPath = (label, value) => {
+    const components = value.split("/").slice(1);
+    if (!value.startsWith("/") || value.length < 2 || value.endsWith("/") || components.some((part) => part === "" || part === "." || part === "..")
+        || path.posix.normalize(value) !== value || value.includes("\0") || Buffer.byteLength(value) > DAIMON_GROK_MAX_REGISTERED_PATH_BYTES) {
+        fail(`Grok worker ${label} is not a canonical registered path: ${JSON.stringify(value)}`);
+    }
+    return value;
+};
+const nodeSlug = (nodeId) => nodeId.replace(/^agent:/u, "")
+    .toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "");
+const fail = (message) => {
+    throw new SpawnfileError("compile_error", message);
+};
+const declaredModel = (plan, agentId) => {
+    const declared = plan.grokModelByNodeId?.[agentId];
+    if (!declared || !DAIMON_GROK_BROKER_MODELS.includes(declared.model)
+        || !DAIMON_GROK_BROKER_REASONING_EFFORTS.includes(declared.reasoningEffort)) {
+        return fail(`Daimon Grok agent ${agentId} has no declared broker model and reasoning effort`);
+    }
+    return declared;
+};
+/**
+ * Spawnfile-managed state roots no Grok worker needs: the shared Moltnet store
+ * (server data, node/bridge configs, receipt stores, network state), per-agent
+ * Moltnet open-mode token directories, and declared Mneme memory banks. A
+ * worker reaches Moltnet and memory only through Daimon's MCP tools, which run
+ * in the organization process, never by reading these files. Provisioning
+ * creates each root-owned `0700` when absent so the mask always has a target.
+ */
+export const DAIMON_GROK_DENIED_STATE_ROOTS = ["/var/lib/spawnfile/agents", "/var/lib/spawnfile/memory", "/var/lib/spawnfile/moltnet"];
+const within = (candidate, root) => candidate === root || candidate.startsWith(`${root}/`);
+/**
+ * One brokered worker's sandbox deny list.
+ *
+ * Daimon's own protected set for the agent (`grokSandboxProtectedPaths`: the
+ * Grok bootstrap and realm, the AGY realm and unlock secret when any agent is
+ * AGY, the organization state directory that holds the wake-acceptance store,
+ * and every peer's runtime home and workspace) is always kept verbatim, so a Daimon projection over the same inputs renders
+ * the same profile. This deployment adds everything else the container
+ * provisions that the worker does not need: the organization config directory
+ * (all agents' instructions and any env files), every persistent mount of
+ * every runtime plan (the worker's own tool state, credential home and memory
+ * included — it reaches them only through Daimon), every other runtime
+ * instance root, the shared Moltnet/agent/memory state roots, every workspace
+ * resource backing path not linked from this agent's own workspace, the broker's
+ * `/etc` and `/run` directories, the usage ledger and wake fuse, every other
+ * worker's home, and the container secret roots.
+ *
+ * Allowed on purpose: the agent's own workspace (the worker's cwd), its own
+ * runtime home directory itself (Daimon's tool-result spill contract names paths
+ * under it; its contents are persistent mounts and denied), its own worker home,
+ * and backing paths of resources linked into its own workspace (a mask over the
+ * backing inode would also hide the agent's own resource through its link).
+ *
+ * Grok 1.0.34's strict base reads all of `/run`, `/var`, `/tmp` and `/etc`, and
+ * macOS bind mounts ignore unix modes, so this list — not file modes — is the
+ * boundary. Masks cannot nest: an added entry already covered by another entry
+ * is dropped, and an added entry that would cover a Daimon entry is refused.
+ *
+ * Every entry must also be *placeable*: Grok materializes each deny target
+ * inside bubblewrap as the worker uid, so the target must exist and the worker
+ * must be able to search every ancestor. That depends on modes, not paths, so
+ * the root provisioning program asserts it once every mode is final and refuses
+ * to start the container otherwise (`containerDaimonGrokWorkerProvisioning.ts`);
+ * here a protected path whose parent is private is lifted to that parent
+ * instead (`daimonGrokAcceptanceStoreDenyPath`).
+ */
+export const resolveDaimonGrokWorkerDenyPaths = (plans, plan, agentId, workerHomes, ownHome) => {
+    const instanceRoot = plan.instancePaths.instanceRoot ?? fail("Daimon Grok registrations require an instance root");
+    const agents = Object.entries(plan.engineByNodeId ?? {});
+    const ownWorkspace = path.posix.join(plan.instancePaths.workspacePath, "agents", nodeSlug(agentId));
+    const ownRuntimeHome = path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(agentId));
+    const peers = agents.filter(([id]) => id !== agentId).map(([id]) => nodeSlug(id));
+    const daimonOwn = [
+        DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
+        DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
+        ...(agents.some(([, engine]) => engine === "agy") ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath, DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath] : []),
+        daimonGrokAcceptanceStoreDenyPath(instanceRoot),
+        ...peers.flatMap((slug) => [
+            path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, slug),
+            path.posix.join(plan.instancePaths.workspacePath, "agents", slug)
+        ])
+    ];
+    const ownResourceBackings = new Set((plan.resources ?? [])
+        .filter((resource) => within(resource.linkPath, ownWorkspace))
+        .map((resource) => resource.backingPath));
+    const added = [
+        path.posix.dirname(plan.instancePaths.configPath),
+        ...plans.flatMap((candidate) => (candidate.persistentMounts ?? []).map((mount) => mount.mount_path)),
+        ...plans.filter((candidate) => candidate !== plan).flatMap((candidate) => [
+            candidate.instancePaths.instanceRoot ?? path.posix.dirname(candidate.instancePaths.configPath),
+            ...(candidate.envFiles ?? []).map((binding) => binding.filePath)
+        ]),
+        ...(plan.envFiles ?? []).map((binding) => binding.filePath),
+        ...plans.flatMap((candidate) => candidate.resources ?? []).map((resource) => resource.backingPath)
+            .filter((backing) => !ownResourceBackings.has(backing)),
+        ...DAIMON_GROK_DENIED_STATE_ROOTS,
+        path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath),
+        path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath),
+        DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath,
+        DAIMON_WAKE_FUSE_DIRECTORY,
+        ...workerHomes.filter((home) => home !== ownHome),
+        ...DAIMON_GROK_OPTIONAL_DENY_PATHS
+    ].filter((entry) => entry.startsWith("/"));
+    const grokHome = path.posix.join(ownHome, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+    const grants = [...DAIMON_GROK_BASE_PROFILE_GRANTS, ownWorkspace, grokHome, path.posix.join(grokHome, "sessions"), path.posix.join(ownHome, "tmp")];
+    for (const entry of [...daimonOwn, ...added]) {
+        const grant = grants.find((candidate) => within(candidate, entry));
+        if (grant)
+            fail(`Grok worker deny path ${entry} equals or contains the base profile grant ${grant}; Grok refuses such a profile`);
+    }
+    for (const entry of added) {
+        if (within(ownWorkspace, entry) || within(ownHome, entry) || entry === ownRuntimeHome || within(ownRuntimeHome, entry)
+            || [...ownResourceBackings].some((backing) => within(backing, entry))) {
+            fail(`Grok worker deny path ${entry} would hide ${agentId}'s own workspace, home, or resources`);
+        }
+    }
+    const candidates = [...new Set([...daimonOwn, ...added])];
+    const daimonSet = new Set(daimonOwn);
+    const denied = candidates.filter((entry) => daimonSet.has(entry)
+        || !candidates.some((other) => other !== entry && within(entry, other))).sort();
+    for (const entry of denied) {
+        const ancestor = denied.find((other) => other !== entry && within(entry, other));
+        if (ancestor)
+            fail(`Grok worker deny path ${ancestor} would cover ${entry}; masks cannot nest`);
+    }
+    return denied;
+};
+export const resolveDaimonGrokRegistrations = (plans) => {
+    const entries = plans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .flatMap((plan) => Object.entries(plan.engineByNodeId ?? {})
+        .filter(([, engine]) => engine === "grok")
+        .map(([agentId]) => ({ agentId, plan })))
+        .sort((left, right) => left.agentId.localeCompare(right.agentId));
+    const homes = entries.map((_, slot) => path.posix.join(DAIMON_WORKER_ROOT, String(DAIMON_FIRST_WORKER_UID + slot)));
+    return entries.map(({ agentId, plan }, slot) => {
+        if (nodeSlug(agentId) === "")
+            fail(`Daimon Grok agent ${agentId} has no path-safe slug`);
+        const home = assertCanonicalRegisteredPath("home", homes[slot]);
+        const grokHome = path.posix.join(home, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+        const instanceRoot = plan.instancePaths.instanceRoot ?? fail("Daimon Grok registrations require an instance root");
+        const runtimeHome = assertCanonicalRegisteredPath("runtime home", path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(agentId)));
+        const { model, reasoningEffort } = declaredModel(plan, agentId);
+        const config = resolveDaimonGrokWorkerConfig(model, reasoningEffort);
+        const denyPaths = resolveDaimonGrokWorkerDenyPaths(plans, plan, agentId, homes, home);
+        const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
+        for (const [label, value] of [["GROK_HOME", grokHome], ["profile", path.posix.join(grokHome, "sandbox.toml")], ["events", path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath)], ["private temp", path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome)]])
+            assertCanonicalRegisteredPath(label, value);
+        // The launcher derives HOME, GROK_HOME=<home>/.grok and TMPDIR=<home>/tmp from the registered home, and the broker reads the profile from GROK_HOME.
+        if (path.posix.dirname(path.posix.dirname(path.posix.join(grokHome, "sandbox.toml"))) !== home)
+            fail(`Grok worker ${agentId} profile is not under its registered home`);
+        const backings = new Set(plans.flatMap((candidate) => candidate.resources ?? []).map((resource) => resource.backingPath));
+        return {
+            deferredDenyPaths: denyPaths.filter((entry) => backings.has(entry)),
+            agentId,
+            config: config.bytes,
+            configSha256: config.sha256,
+            denyPaths,
+            eventsPath: path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath),
+            grokHome,
+            home,
+            model,
+            profile,
+            profilePath: path.posix.join(grokHome, "sandbox.toml"),
+            profileSha256: daimonGrokWorkerSandboxProfileSha256(denyPaths),
+            privateTmp: path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome),
+            reasoningEffort,
+            runtimeHome,
+            runtimeHomeMounts: [...new Set(plans.flatMap((candidate) => (candidate.persistentMounts ?? []).map((mount) => mount.mount_path))
+                    .filter((mountPath) => mountPath.startsWith(`${runtimeHome}/`)))].sort(),
+            spillDirectory: path.posix.join(runtimeHome, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
+            slot,
+            uid: DAIMON_FIRST_WORKER_UID + slot,
+            // Production keeps one container ledger: `spawnfile usage` and Daimon's
+            // wake fuse both read it, so a per-slot file would hide Grok spend from both.
+            usageLedgerPath: DAIMON_GROK_TURN_USAGE_LEDGER.filePath,
+            workspace: assertCanonicalRegisteredPath("workspace", path.posix.join(plan.instancePaths.workspacePath, "agents", nodeSlug(agentId)))
+        };
+    });
+};
+const resolveDaimonGrokTurnStore = (turnStore) => {
+    if (turnStore === undefined)
+        return DAIMON_GROK_ENGINE_BROKER.turnStorePath;
+    assertCanonicalRegisteredPath("turn store", turnStore);
+    if (turnStore === DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath || turnStore.startsWith(`${DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath}/`)) {
+        fail(`Grok broker turn store ${turnStore} is on the durable credential realm; a recycled slot would replay the previous trial's sealed turns`);
+    }
+    return turnStore;
+};
+const resolveDaimonGrokInferenceLedger = (inferenceLedgerPath, registrations) => {
+    assertCanonicalRegisteredPath("inference ledger", inferenceLedgerPath);
+    if (!inferenceLedgerPath.endsWith(".jsonl"))
+        fail(`Grok inference ledger must be a .jsonl path: ${inferenceLedgerPath}`);
+    const subject = new Set([DAIMON_GROK_TURN_USAGE_LEDGER.filePath, path.posix.join(DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, "requests.jsonl"),
+        ...registrations.flatMap((entry) => [entry.usageLedgerPath, path.posix.join(path.posix.dirname(entry.usageLedgerPath), "requests.jsonl")])]);
+    if (subject.has(inferenceLedgerPath))
+        fail(`Grok inference ledger ${inferenceLedgerPath} is a subject usage ledger; judge spend must never reach the wake fuse`);
+    return inferenceLedgerPath;
+};
+/** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
+export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
+    version: DAIMON_GROK_ENGINE_BROKER.serviceConfigVersions[1],
+    credentialHome: DAIMON_GROK_ENGINE_BROKER.credentialHomePath,
+    turnStore: resolveDaimonGrokTurnStore(options.turnStore),
+    ...(options.inferenceLedgerPath === undefined ? {} : { inferenceLedgerPath: resolveDaimonGrokInferenceLedger(options.inferenceLedgerPath, registrations) }),
+    registrations: registrations.map((entry) => ({
+        agentId: entry.agentId,
+        slot: entry.slot,
+        workerUid: entry.uid,
+        workspace: entry.workspace,
+        profilePath: entry.profilePath,
+        eventsPath: entry.eventsPath,
+        profileSha256: entry.profileSha256,
+        usageLedgerPath: entry.usageLedgerPath,
+        limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
+        model: { id: entry.model, reasoningEffort: entry.reasoningEffort }
+    }))
+});

package/dist/compiler/containerDaimonOwnershipGuardRender.d.ts

@@ -0,0 +1,12 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+export declare const renderDaimonOwnershipProgram: (opaqueTargets: string[], opaqueDescendantRoots: string[], immutableRuntimeRoots: string[], volumeIdentityFiles: Array<{
+    path: string;
+    identity: string;
+}>, privateDirectories: string[], privateFiles: string[], privateModeDirectories: string[], creatablePrivateDirectories: Array<{
+    anchor: string;
+    target: string;
+}>) => string;
+export declare const resolveDaimonVolumeIdentityFiles: (runtimePlans: RuntimeTargetPlan[]) => Array<{
+    path: string;
+    identity: string;
+}>;