spawnfile 0.1.13 → 0.1.17

package/dist/compiler/training/broker/entrypoint.js

@@ -0,0 +1,111 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { parseTrainingBrokerDeclaration } from "./declaration.js";
+import { loadDaimonProjectionModule, resolveTrainingGrokProjection } from "./projection.js";
+import { resolveTrainingGrokRegistration } from "./registration.js";
+import { createTrainingSlotRuntime } from "./runtime.js";
+import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
+import { DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
+export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "PAIDEIA_GROK_BROKER_CONTROL_SOCKET";
+export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "PAIDEIA_GROK_GRANT_HOME_ROOT";
+export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
+/**
+ * The desktop Grok login, in every spelling a caller might reach it by.
+ *
+ * D2 is explicit: training uses one dedicated Grok login and never the
+ * developer's own. An in-container refresh rotates the credential, so mounting
+ * the desktop leaf would invalidate the developer's desktop session as a side
+ * effect of a training run — and the refreshed token would live on tmpfs, so
+ * the desktop login would be gone rather than moved.
+ */
+export const desktopGrokAuthPaths = (home = os.homedir()) => [path.resolve(home, ".grok/auth.json"), path.resolve(home, ".grok", "auth.json")];
+export const assertNotDesktopGrokAuth = (source, home = os.homedir()) => {
+    if (desktopGrokAuthPaths(home).includes(path.resolve(source))) {
+        throw new SpawnfileError("validation_error", "Training refuses the desktop ~/.grok/auth.json as its Grok bootstrap; import a dedicated login with `spawnfile auth import grok --profile paideia-training --from <dir>`");
+    }
+    return source;
+};
+/** The bootstrap leaf inside the container: the fixed read-only mount, a bounded regular file, never a symlink. */
+const assertBootstrap = async (declaration) => {
+    if (declaration.bootstrap !== TRAINING_BOOTSTRAP_MOUNT) {
+        throw new SpawnfileError("validation_error", `The training Grok bootstrap must be mounted at ${TRAINING_BOOTSTRAP_MOUNT}`);
+    }
+    const info = await lstat(declaration.bootstrap);
+    if (!info.isFile() || info.isSymbolicLink() || info.size < 2 || info.size > DAIMON_GROK_SUBSCRIPTION_MAX_BYTES) {
+        throw new SpawnfileError("validation_error", "The training Grok bootstrap must be a bounded regular credential leaf");
+    }
+};
+const DAIMON_GROK_SUBSCRIPTION_MAX_BYTES = 64 * 1024;
+/**
+ * The broker-capable training container's root entrypoint.
+ *
+ * Order matters and is the whole privilege model: provision as root with the
+ * production capability set, start the launcher (root) and the broker and
+ * relay (2100) and prove each one's post-drop identity, publish the slot
+ * supervisor socket, and only then drop to uid 2000 with an empty capability
+ * bounding set to run `train`. Paideia, DSPy and the judges are that uid; the
+ * model's own tools are the worker uid the launcher alone can reach.
+ */
+export const runTrainingBrokerEntrypoint = async (options) => {
+    const log = options.log ?? ((line) => process.stderr.write(`[training-entrypoint] ${line}\n`));
+    if (process.getuid?.() !== 0)
+        throw new SpawnfileError("runtime_error", "The broker-capable training container must start as root");
+    const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(options.declarationPath ?? TRAINING_BROKER_DECLARATION_FILE, "utf8")));
+    await assertBootstrap(declaration);
+    const registration = resolveTrainingGrokRegistration(declaration);
+    const daimon = await (options.loadDaimon ?? loadDaimonProjectionModule)();
+    // Daimon's projection is I/O-free, so the digest the receipt will bind is known before anything is provisioned.
+    const { projectionSha256 } = await resolveTrainingGrokProjection(declaration, registration, daimon);
+    const runtime = createTrainingSlotRuntime({ declaration, registration, projectionSha256 });
+    // Provision, start, canary and publish the slot preflight receipt before `train` exists at all: the
+    // first trial must not be the one trial that runs on no worker-uid denial evidence, and a refusal
+    // here costs nothing while the same refusal after the first wake costs that trial's spend.
+    const preflight = await startTrainingSlot(runtime, randomBytes(32).toString("hex"));
+    const supervisor = createTrainingSlotSupervisor({ runtime, organizationUid: declaration.organizationUid });
+    const server = serveTrainingSlotSupervisor(supervisor, TRAINING_SUPERVISOR_SOCKET, log, declaration.organizationUid);
+    log(`slot ${registration.slot} provisioned for ${registration.agentId} (${registration.model}/${registration.reasoningEffort}), projection ${projectionSha256}, `
+        + `generation ${preflight.generation} with ${preflight.canaries} denied canaries at ${preflight.receipt}`);
+    const status = await runTrainingChild(options.argv, declaration, log);
+    server.close();
+    await runtime.stop();
+    return status;
+};
+/**
+ * `train` as uid 2000 with an empty bounding set, proven inside the child
+ * before it execs: `setpriv --bounding-set=-all` silently does nothing without
+ * `CAP_SETPCAP`, so the guard has to read `/proc/self/status` rather than
+ * trust the flag.
+ */
+export const trainingChildArgv = (argv, uid = DAIMON_ORGANIZATION_UID) => [
+    "setpriv", "--clear-groups", `--reuid=${uid}`, `--regid=${uid}`, "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all",
+    "--", "/bin/bash", "-ceu",
+    'if [ "$EUID" -eq 0 ]; then echo "training must not run as root" >&2; exit 1; fi\n'
+        + 'test "$(sed -n "s/^CapBnd:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
+        + 'test "$(sed -n "s/^CapEff:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
+        + 'exec "$@"',
+    "bash", TRAINING_ENTRYPOINT_COMMAND, ...argv
+];
+const runTrainingChild = (argv, declaration, log) => new Promise((resolve) => {
+    const command = trainingChildArgv(argv, declaration.organizationUid);
+    const child = spawn(command[0], command.slice(1), {
+        stdio: ["ignore", "inherit", "inherit"],
+        env: {
+            ...process.env,
+            [TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV]: DAIMON_GROK_ENGINE_BROKER.controlSocketPath,
+            [TRAINING_GROK_GRANT_HOME_ROOT_ENV]: TRAINING_GRANT_HOME_ROOT,
+            HOME: "/home/training"
+        }
+    });
+    const forward = (signal) => () => child.kill(signal);
+    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"])
+        process.on(signal, forward(signal));
+    child.once("exit", (code, signal) => {
+        log(`training exited code=${code ?? "null"} signal=${signal ?? "none"}`);
+        resolve(signal ? (signal === "SIGINT" ? 130 : 143) : code ?? 1);
+    });
+});

package/dist/compiler/training/broker/index.d.ts

@@ -0,0 +1,10 @@
+export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema, type TrainingBrokerDeclaration } from "./declaration.js";
+export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
+export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { renderTrainingBrokerProvisioning, renderTrainingIdentities, trainingSlotDirectories } from "./provisioning.js";
+export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
+export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
+export { createTrainingSlotRuntime } from "./runtime.js";
+export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL, type TrainingSlotRuntime } from "./supervisor.js";
+export * from "./paths.js";

package/dist/compiler/training/broker/index.js

@@ -0,0 +1,10 @@
+export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema } from "./declaration.js";
+export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
+export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { renderTrainingBrokerProvisioning, renderTrainingIdentities, trainingSlotDirectories } from "./provisioning.js";
+export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
+export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
+export { createTrainingSlotRuntime } from "./runtime.js";
+export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
+export * from "./paths.js";

package/dist/compiler/training/broker/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/compiler/training/broker/main.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { runTrainingBrokerEntrypoint } from "./entrypoint.js";
+/**
+ * The broker-capable training image's root entrypoint process. The image ships
+ * it; the host supplies only the read-only `spawnfile.training-broker.v1`
+ * declaration and never a script, so no host executable enters the container.
+ */
+const main = async () => {
+    process.exitCode = await runTrainingBrokerEntrypoint({ argv: process.argv.slice(2) });
+};
+main().catch((error) => {
+    process.stderr.write(`[training-entrypoint] ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/dist/compiler/training/broker/paths.d.ts

@@ -0,0 +1,196 @@
+import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+/**
+ * Every container path the broker-capable training container fixes.
+ *
+ * They are fixed rather than derived because three parties must agree on them
+ * without talking to each other: the root entrypoint that provisions them, the
+ * root slot supervisor that wipes and re-provisions them on recycle, and
+ * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * and has no way to ask the container what it chose. Daimon's projection never
+ * resolves a path, so each one must also be canonical and never a symlink; the
+ * provisioning program asserts that before a slot is used.
+ *
+ * Everything under `/run/training/slot` is per-trial state on tmpfs — never the
+ * Grok realm volume (R2). The realm volume holds only `auth.json` and the
+ * broker credential journal, so a recycle can wipe the slot without touching
+ * the one durable rotating credential.
+ */
+export declare const TRAINING_RUN_ROOT = "/run/training/output";
+export declare const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
+export declare const TRAINING_PAIDEIA_ROOT = "/run/paideia";
+export declare const TRAINING_CONTEXT_FILE = "/run/paideia/context.json";
+/** Host-written, read-only `spawnfile.training-broker.v1` declaration the root entrypoint reads. */
+export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/paideia/training-broker.json";
+export declare const TRAINING_SLOT_ROOT = "/run/training/slot";
+export declare const TRAINING_SLOT_WORKSPACE = "/run/training/slot/workspace";
+export declare const TRAINING_SLOT_RUNTIME_HOME = "/run/training/slot/runtime-home";
+export declare const TRAINING_SLOT_STATE_ROOT = "/run/training/slot/state";
+export declare const TRAINING_SLOT_ACCEPTANCE_STORE = "/run/training/slot/state/wake-acceptance";
+/** Per-slot turn store. On tmpfs on purpose: a replayed turn from trial N must never satisfy trial N+1 (R2). */
+export declare const TRAINING_SLOT_TURN_STORE = "/run/training/slot/turns";
+export declare const TRAINING_SLOT_USAGE_DIRECTORY = "/run/training/slot/usage";
+export declare const TRAINING_SLOT_USAGE_LEDGER = "/run/training/slot/usage/usage.jsonl";
+export declare const TRAINING_SLOT_PREFLIGHT_RECEIPT = "/run/training/slot/preflight.json";
+/** Supervisor-owned monotonic generation counter; survives a recycle, never a container restart. */
+export declare const TRAINING_SLOT_GENERATION_FILE = "/run/training/slot/generation.json";
+export declare const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
+export declare const TRAINING_INFERENCE_LEDGER = "/run/training/inference/inference.jsonl";
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+export declare const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group), deliberately **outside** `/run/daimon-engine-broker`.
+ *
+ * Production puts it at `<control root>/tmp`, which is fine there: that root is
+ * removed and recreated exactly once, at container start. Training
+ * re-provisions the same root on every recycle, and the launch mounts this
+ * directory as its own tmpfs — so a `tmp/` inside the cleared root is a *mount
+ * point*, and clearing a mount point fails `EBUSY`. A live P8 launch died
+ * exactly there. Its own tmpfs under `/run/training` is never a wipe target and
+ * is denied to every worker uid.
+ */
+export declare const TRAINING_BROKER_TMPDIR = "/run/training/broker-tmp";
+export declare const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
+export declare const TRAINING_SUPERVISOR_SOCKET = "/run/training/supervisor/control.sock";
+export declare const TRAINING_SUPERVISOR_LOG = "/run/training/supervisor/supervisor.log";
+export declare const TRAINING_WORKER_ROOT = "/var/lib/daimon-workers";
+export declare const TRAINING_SLOT_INDEX = 0;
+export declare const TRAINING_WORKER_UID: number;
+export declare const TRAINING_WORKER_HOME: string;
+/**
+ * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
+ * every `deny` target inside bubblewrap as the worker uid, and it cannot
+ * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
+ * single `/run/paideia` mask below covers all of them, which is also stronger
+ * — a file Paideia adds later is covered without re-provisioning the slot.
+ */
+export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/paideia/config.json", "/run/paideia/control", "/run/paideia/launch.json", "/run/paideia/token", "/run/paideia/env", "/run/paideia/preparation.json", "/run/paideia/repair.json"];
+/**
+ * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ *
+ * This is not a summary of the five roles — it is the **whole** set of deny
+ * entries this container adds beyond Daimon's own protected paths, because
+ * Paideia's worker resolves the projection from exactly
+ * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
+ * that carried only the five roles made Daimon hash a different deny list than
+ * the one provisioning wrote, and a live run died on
+ * `Grok broker projection digest differs from the launch receipt`.
+ *
+ * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * unique. The four roles with a dedicated path keep it, and everything else is
+ * tagged `context` — the caller-state role — since there is no other way to
+ * carry a path through that contract.
+ */
+export declare const TRAINING_EVALUATOR_PATHS: readonly {
+    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
+    path: string;
+}[];
+/**
+ * One entry per evaluator role, in declaration order: the launch receipt requires all five roles,
+ * and several `context` paths share that role, so the first of each role is the role's root.
+ */
+export declare const TRAINING_EVALUATOR_ROOTS: {
+    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
+    path: string;
+}[];
+/**
+ * What `paideia.daimon-native.launch.v2`'s `controlRoot` must be.
+ *
+ * Paideia's worker passes it to Daimon as `acceptanceStorePath`, and Daimon adds
+ * it to the projection's deny list, so it has to be the same path this
+ * container masks as its slot state root. Its own default
+ * (`/run/paideia/control`) would both change the digest and nest inside the
+ * `/run/paideia` mask, which Grok refuses — Daimon renders a nested mask
+ * without complaining, so the failure would only appear at the first turn.
+ */
+export declare const TRAINING_CALLER_CONTROL_ROOT = "/run/training/slot/state";
+/**
+ * Everything this container provisions that the one training worker must not
+ * read, beyond Daimon's own protected set (realm, bootstrap, acceptance store).
+ * Each entry sits strictly below a Grok 1.0.34 base-profile grant — Grok
+ * refuses a profile whose deny entry equals or contains `/run`, `/var`, `/etc`
+ * or `/tmp` — and no entry covers another, because masks cannot nest.
+ */
+/**
+ * The added deny set is exactly the launch's `evaluatorPaths`, so Spawnfile and
+ * Paideia hand Daimon's resolver the same list. `TRAINING_SLOT_STATE_ROOT` is
+ * deliberately absent: Daimon adds it itself, from the control root above.
+ */
+export declare const TRAINING_ADDED_DENY_PATHS: readonly string[];
+/** Paths the provisioning program creates root-owned `0700` when absent, so every deny entry always has a target inode. */
+export declare const TRAINING_OPTIONAL_DENY_DIRECTORIES: readonly string[];
+/**
+ * Deny entries a launch may legitimately not have mounted. Everything else must
+ * exist before a worker turn: Grok 1.0.34 creates an absent `deny` target as
+ * the worker uid inside bubblewrap and refuses the whole profile when it
+ * cannot, so provisioning materializes every other entry itself.
+ */
+export declare const TRAINING_DEFERRED_DENY_PATHS: readonly string[];
+/**
+ * Deny entries the launch binds from the host, named so a refusal can say why.
+ *
+ * Only the run root is one. The sealed inputs root is **not**: the launch binds
+ * each declared input at `/run/training/inputs/<id>`, so `/run/training/inputs`
+ * itself is the binds' *parent*, a directory on the read-only image root — and
+ * that is exactly what makes it sealable (see `TRAINING_SEALED_DENY_PATHS`).
+ *
+ * Being a host bind is no longer a waiver on its own. On Docker Desktop and
+ * Colima a bind lands on virtiofs/grpcfuse, which ignores `chown`, and there a
+ * worker-uid probe carries no information; on a Linux daemon over ext4, xfs,
+ * btrfs or overlay the same bind enforces ownership and the probe is real. The
+ * canary resolver asks the backing filesystem rather than this list, which is
+ * why the documented `refuse` default is reachable at all.
+ */
+export declare const TRAINING_HOST_BIND_DENY_PATHS: readonly string[];
+/**
+ * Deny entries whose denial must be proven by the kernel under **every**
+ * policy, because the experiment's central claim depends on them.
+ *
+ * `/run/training/inputs` holds the sealed train and test datasets. A bubblewrap
+ * `deny` mask is not a boundary the subject cannot lift: the pinned seccomp
+ * profile must allow `clone/unshare/mount/umount2/pivot_root/setns` for
+ * bubblewrap itself, and the container runs `apparmor=unconfined`, so a
+ * worker-uid process can open a user + mount namespace of its own and either
+ * detach the mask or bind the mask's parent somewhere fresh.
+ *
+ * What survives that is DAC on the datasets' ancestor. The image bakes this
+ * directory `0:<organization gid> 0750` on the read-only root, so:
+ *
+ *   - the worker uid is in neither the owner nor the group class and loses
+ *     search permission on the one directory every dataset read must traverse;
+ *   - the inode is owned by real uid 0, which a `unshare --map-root-user`
+ *     namespace does not map, so `CAP_DAC_OVERRIDE` there cannot override it;
+ *   - the root filesystem is read-only, so nothing in the container — root
+ *     included — can loosen the mode after the image is built.
+ *
+ * Provisioning asserts the mode and then attacks it as the worker uid, and the
+ * canary resolver refuses the slot rather than certifying one of these on the
+ * sandbox profile alone.
+ */
+export declare const TRAINING_SEALED_DENY_PATHS: readonly string[];
+/** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
+export declare const TRAINING_SEALED_INPUTS_ATTESTATION = "/run/training/slot/sealed-inputs.json";
+/** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
+export declare const TRAINING_SEALED_INPUTS_IDENTITY: {
+    readonly uid: 0;
+    readonly gid: 2000;
+    readonly mode: "750";
+};
+/**
+ * What a recycle removes outright, and what it only empties.
+ *
+ * Nothing the launch mounts may be at or below any of these. A mount point
+ * cannot be unlinked while it is mounted, so a wipe target holding one aborts
+ * the recycle — which is how the broker/relay `TMPDIR` took down a live launch
+ * when it still lived at `<control root>/tmp`. `paths.test.ts` enforces that
+ * against the launch's own mount list; the rendered shell skips mount points
+ * anyway, so an undeclared one degrades to "left in place and reported" rather
+ * than a failed provision.
+ */
+export declare const TRAINING_WIPE_TARGETS: readonly string[];
+/** Emptied but kept: their paths are registered with Daimon and must stay canonical across a recycle. */
+export declare const TRAINING_CLEAR_TARGETS: readonly string[];
+export declare const TRAINING_REALM_MOUNT: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+export declare const TRAINING_BOOTSTRAP_MOUNT: "/var/lib/spawnfile/daimon/grok-bootstrap-auth";
+export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };

package/dist/compiler/training/broker/paths.js

@@ -0,0 +1,241 @@
+import path from "node:path";
+import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
+import { DAIMON_WORKER_ROOT } from "../../containerDaimonGrokWorkerRender.js";
+/**
+ * Every container path the broker-capable training container fixes.
+ *
+ * They are fixed rather than derived because three parties must agree on them
+ * without talking to each other: the root entrypoint that provisions them, the
+ * root slot supervisor that wipes and re-provisions them on recycle, and
+ * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * and has no way to ask the container what it chose. Daimon's projection never
+ * resolves a path, so each one must also be canonical and never a symlink; the
+ * provisioning program asserts that before a slot is used.
+ *
+ * Everything under `/run/training/slot` is per-trial state on tmpfs — never the
+ * Grok realm volume (R2). The realm volume holds only `auth.json` and the
+ * broker credential journal, so a recycle can wipe the slot without touching
+ * the one durable rotating credential.
+ */
+export const TRAINING_RUN_ROOT = "/run/training/output";
+export const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
+export const TRAINING_PAIDEIA_ROOT = "/run/paideia";
+export const TRAINING_CONTEXT_FILE = `${TRAINING_PAIDEIA_ROOT}/context.json`;
+/** Host-written, read-only `spawnfile.training-broker.v1` declaration the root entrypoint reads. */
+export const TRAINING_BROKER_DECLARATION_FILE = `${TRAINING_PAIDEIA_ROOT}/training-broker.json`;
+export const TRAINING_SLOT_ROOT = "/run/training/slot";
+export const TRAINING_SLOT_WORKSPACE = `${TRAINING_SLOT_ROOT}/workspace`;
+export const TRAINING_SLOT_RUNTIME_HOME = `${TRAINING_SLOT_ROOT}/runtime-home`;
+export const TRAINING_SLOT_STATE_ROOT = `${TRAINING_SLOT_ROOT}/state`;
+export const TRAINING_SLOT_ACCEPTANCE_STORE = `${TRAINING_SLOT_STATE_ROOT}/wake-acceptance`;
+/** Per-slot turn store. On tmpfs on purpose: a replayed turn from trial N must never satisfy trial N+1 (R2). */
+export const TRAINING_SLOT_TURN_STORE = `${TRAINING_SLOT_ROOT}/turns`;
+export const TRAINING_SLOT_USAGE_DIRECTORY = `${TRAINING_SLOT_ROOT}/usage`;
+export const TRAINING_SLOT_USAGE_LEDGER = `${TRAINING_SLOT_USAGE_DIRECTORY}/usage.jsonl`;
+export const TRAINING_SLOT_PREFLIGHT_RECEIPT = `${TRAINING_SLOT_ROOT}/preflight.json`;
+/** Supervisor-owned monotonic generation counter; survives a recycle, never a container restart. */
+export const TRAINING_SLOT_GENERATION_FILE = `${TRAINING_SLOT_ROOT}/generation.json`;
+export const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
+export const TRAINING_INFERENCE_LEDGER = `${TRAINING_INFERENCE_DIRECTORY}/inference.jsonl`;
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+export const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group), deliberately **outside** `/run/daimon-engine-broker`.
+ *
+ * Production puts it at `<control root>/tmp`, which is fine there: that root is
+ * removed and recreated exactly once, at container start. Training
+ * re-provisions the same root on every recycle, and the launch mounts this
+ * directory as its own tmpfs — so a `tmp/` inside the cleared root is a *mount
+ * point*, and clearing a mount point fails `EBUSY`. A live P8 launch died
+ * exactly there. Its own tmpfs under `/run/training` is never a wipe target and
+ * is denied to every worker uid.
+ */
+export const TRAINING_BROKER_TMPDIR = "/run/training/broker-tmp";
+export const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
+export const TRAINING_SUPERVISOR_SOCKET = `${TRAINING_SUPERVISOR_DIRECTORY}/control.sock`;
+export const TRAINING_SUPERVISOR_LOG = `${TRAINING_SUPERVISOR_DIRECTORY}/supervisor.log`;
+export const TRAINING_WORKER_ROOT = DAIMON_WORKER_ROOT;
+export const TRAINING_SLOT_INDEX = 0;
+export const TRAINING_WORKER_UID = DAIMON_FIRST_WORKER_UID + TRAINING_SLOT_INDEX;
+export const TRAINING_WORKER_HOME = path.posix.join(TRAINING_WORKER_ROOT, String(TRAINING_WORKER_UID));
+/**
+ * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
+ * every `deny` target inside bubblewrap as the worker uid, and it cannot
+ * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
+ * single `/run/paideia` mask below covers all of them, which is also stronger
+ * — a file Paideia adds later is covered without re-provisioning the slot.
+ */
+export const TRAINING_CALLER_PROTECTED_PATHS = [
+    `${TRAINING_PAIDEIA_ROOT}/config.json`,
+    `${TRAINING_PAIDEIA_ROOT}/control`,
+    `${TRAINING_PAIDEIA_ROOT}/launch.json`,
+    `${TRAINING_PAIDEIA_ROOT}/token`,
+    `${TRAINING_PAIDEIA_ROOT}/env`,
+    `${TRAINING_PAIDEIA_ROOT}/preparation.json`,
+    `${TRAINING_PAIDEIA_ROOT}/repair.json`
+];
+/**
+ * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ *
+ * This is not a summary of the five roles — it is the **whole** set of deny
+ * entries this container adds beyond Daimon's own protected paths, because
+ * Paideia's worker resolves the projection from exactly
+ * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
+ * that carried only the five roles made Daimon hash a different deny list than
+ * the one provisioning wrote, and a live run died on
+ * `Grok broker projection digest differs from the launch receipt`.
+ *
+ * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * unique. The four roles with a dedicated path keep it, and everything else is
+ * tagged `context` — the caller-state role — since there is no other way to
+ * carry a path through that contract.
+ */
+export const TRAINING_EVALUATOR_PATHS = [
+    { role: "run-root", path: TRAINING_RUN_ROOT },
+    { role: "sealed-inputs", path: TRAINING_SEALED_INPUTS_ROOT },
+    { role: "judge-home", path: TRAINING_GRANT_HOME_ROOT },
+    { role: "slot-ledger", path: TRAINING_SLOT_USAGE_DIRECTORY },
+    { role: "context", path: TRAINING_PAIDEIA_ROOT },
+    { role: "context", path: TRAINING_BROKER_TMPDIR },
+    { role: "context", path: TRAINING_INFERENCE_DIRECTORY },
+    { role: "context", path: TRAINING_SLOT_TURN_STORE },
+    { role: "context", path: TRAINING_SUPERVISOR_DIRECTORY },
+    { role: "context", path: path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath) },
+    { role: "context", path: path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath) },
+    { role: "context", path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath },
+    { role: "context", path: DAIMON_WAKE_FUSE_DIRECTORY }
+];
+/**
+ * One entry per evaluator role, in declaration order: the launch receipt requires all five roles,
+ * and several `context` paths share that role, so the first of each role is the role's root.
+ */
+export const TRAINING_EVALUATOR_ROOTS = TRAINING_EVALUATOR_PATHS
+    .filter((entry, index) => TRAINING_EVALUATOR_PATHS.findIndex((first) => first.role === entry.role) === index);
+/**
+ * What `paideia.daimon-native.launch.v2`'s `controlRoot` must be.
+ *
+ * Paideia's worker passes it to Daimon as `acceptanceStorePath`, and Daimon adds
+ * it to the projection's deny list, so it has to be the same path this
+ * container masks as its slot state root. Its own default
+ * (`/run/paideia/control`) would both change the digest and nest inside the
+ * `/run/paideia` mask, which Grok refuses — Daimon renders a nested mask
+ * without complaining, so the failure would only appear at the first turn.
+ */
+export const TRAINING_CALLER_CONTROL_ROOT = TRAINING_SLOT_STATE_ROOT;
+/**
+ * Everything this container provisions that the one training worker must not
+ * read, beyond Daimon's own protected set (realm, bootstrap, acceptance store).
+ * Each entry sits strictly below a Grok 1.0.34 base-profile grant — Grok
+ * refuses a profile whose deny entry equals or contains `/run`, `/var`, `/etc`
+ * or `/tmp` — and no entry covers another, because masks cannot nest.
+ */
+/**
+ * The added deny set is exactly the launch's `evaluatorPaths`, so Spawnfile and
+ * Paideia hand Daimon's resolver the same list. `TRAINING_SLOT_STATE_ROOT` is
+ * deliberately absent: Daimon adds it itself, from the control root above.
+ */
+export const TRAINING_ADDED_DENY_PATHS = [...new Set(TRAINING_EVALUATOR_PATHS.map((entry) => entry.path))].sort();
+/** Paths the provisioning program creates root-owned `0700` when absent, so every deny entry always has a target inode. */
+export const TRAINING_OPTIONAL_DENY_DIRECTORIES = [
+    TRAINING_BROKER_TMPDIR,
+    TRAINING_INFERENCE_DIRECTORY,
+    TRAINING_SLOT_STATE_ROOT,
+    TRAINING_SLOT_TURN_STORE,
+    TRAINING_SUPERVISOR_DIRECTORY,
+    TRAINING_GRANT_HOME_ROOT,
+    // Denied and unused here — training meters per slot — but the mask still needs an inode. The launch
+    // mounts each as tmpfs, so this only creates them when a caller ran the entrypoint without them.
+    DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath,
+    DAIMON_WAKE_FUSE_DIRECTORY
+];
+/**
+ * Deny entries a launch may legitimately not have mounted. Everything else must
+ * exist before a worker turn: Grok 1.0.34 creates an absent `deny` target as
+ * the worker uid inside bubblewrap and refuses the whole profile when it
+ * cannot, so provisioning materializes every other entry itself.
+ */
+export const TRAINING_DEFERRED_DENY_PATHS = [
+    // Docker materializes both host binds before the entrypoint runs. They sit on the read-only image
+    // root, which root cannot create into, so provisioning must tolerate a launch that declared neither.
+    TRAINING_RUN_ROOT,
+    TRAINING_SEALED_INPUTS_ROOT
+];
+/**
+ * Deny entries the launch binds from the host, named so a refusal can say why.
+ *
+ * Only the run root is one. The sealed inputs root is **not**: the launch binds
+ * each declared input at `/run/training/inputs/<id>`, so `/run/training/inputs`
+ * itself is the binds' *parent*, a directory on the read-only image root — and
+ * that is exactly what makes it sealable (see `TRAINING_SEALED_DENY_PATHS`).
+ *
+ * Being a host bind is no longer a waiver on its own. On Docker Desktop and
+ * Colima a bind lands on virtiofs/grpcfuse, which ignores `chown`, and there a
+ * worker-uid probe carries no information; on a Linux daemon over ext4, xfs,
+ * btrfs or overlay the same bind enforces ownership and the probe is real. The
+ * canary resolver asks the backing filesystem rather than this list, which is
+ * why the documented `refuse` default is reachable at all.
+ */
+export const TRAINING_HOST_BIND_DENY_PATHS = [TRAINING_RUN_ROOT, DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath];
+/**
+ * Deny entries whose denial must be proven by the kernel under **every**
+ * policy, because the experiment's central claim depends on them.
+ *
+ * `/run/training/inputs` holds the sealed train and test datasets. A bubblewrap
+ * `deny` mask is not a boundary the subject cannot lift: the pinned seccomp
+ * profile must allow `clone/unshare/mount/umount2/pivot_root/setns` for
+ * bubblewrap itself, and the container runs `apparmor=unconfined`, so a
+ * worker-uid process can open a user + mount namespace of its own and either
+ * detach the mask or bind the mask's parent somewhere fresh.
+ *
+ * What survives that is DAC on the datasets' ancestor. The image bakes this
+ * directory `0:<organization gid> 0750` on the read-only root, so:
+ *
+ *   - the worker uid is in neither the owner nor the group class and loses
+ *     search permission on the one directory every dataset read must traverse;
+ *   - the inode is owned by real uid 0, which a `unshare --map-root-user`
+ *     namespace does not map, so `CAP_DAC_OVERRIDE` there cannot override it;
+ *   - the root filesystem is read-only, so nothing in the container — root
+ *     included — can loosen the mode after the image is built.
+ *
+ * Provisioning asserts the mode and then attacks it as the worker uid, and the
+ * canary resolver refuses the slot rather than certifying one of these on the
+ * sandbox profile alone.
+ */
+export const TRAINING_SEALED_DENY_PATHS = [TRAINING_SEALED_INPUTS_ROOT];
+/** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
+export const TRAINING_SEALED_INPUTS_ATTESTATION = `${TRAINING_SLOT_ROOT}/sealed-inputs.json`;
+/** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
+export const TRAINING_SEALED_INPUTS_IDENTITY = { uid: 0, gid: DAIMON_ORGANIZATION_UID, mode: "750" };
+/**
+ * What a recycle removes outright, and what it only empties.
+ *
+ * Nothing the launch mounts may be at or below any of these. A mount point
+ * cannot be unlinked while it is mounted, so a wipe target holding one aborts
+ * the recycle — which is how the broker/relay `TMPDIR` took down a live launch
+ * when it still lived at `<control root>/tmp`. `paths.test.ts` enforces that
+ * against the launch's own mount list; the rendered shell skips mount points
+ * anyway, so an undeclared one degrades to "left in place and reported" rather
+ * than a failed provision.
+ */
+export const TRAINING_WIPE_TARGETS = [
+    TRAINING_WORKER_HOME,
+    TRAINING_SLOT_RUNTIME_HOME,
+    TRAINING_SLOT_TURN_STORE,
+    TRAINING_SLOT_ACCEPTANCE_STORE,
+    DAIMON_GROK_ENGINE_BROKER.serviceConfigPath,
+    DAIMON_GROK_ENGINE_BROKER.registrationPath
+];
+/** Emptied but kept: their paths are registered with Daimon and must stay canonical across a recycle. */
+export const TRAINING_CLEAR_TARGETS = [
+    TRAINING_SLOT_WORKSPACE,
+    TRAINING_SLOT_USAGE_DIRECTORY,
+    path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath),
+    path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath)
+];
+export const TRAINING_REALM_MOUNT = DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath;
+export const TRAINING_BOOTSTRAP_MOUNT = DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath;
+export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };

package/dist/compiler/training/broker/processes.d.ts

@@ -0,0 +1,42 @@
+import { type ChildProcess } from "node:child_process";
+export declare const DAIMON_RUNTIME_ROOT = "/opt/spawnfile/runtime-installs/daimon";
+/** `00000000000000c1` = CHOWN|SETGID|SETUID, the launcher's bounding set after `setpriv`. */
+export declare const LAUNCHER_CAPABILITY_BOUND = "00000000000000c1";
+export declare const DROPPED_CAPABILITY_BOUND = "0000000000000000";
+export interface BrokerChild {
+    name: string;
+    pid: number;
+    child: ChildProcess;
+    uid: number;
+    capBnd: string;
+}
+/**
+ * The three broker processes, in the order and with the identities production
+ * starts them: the root launcher (which alone may `setuid` to a worker uid),
+ * the broker backend as uid 2100, and the native control relay as uid 2100.
+ * Each one runs with the same bounding set the production entrypoint verifies,
+ * and the broker and relay carry their own `TMPDIR` because shared `/tmp` is
+ * closed to every process outside the organization group.
+ */
+export declare const brokerProcessPlan: () => {
+    name: string;
+    argv: string[];
+    socket: string;
+    uid: number;
+    capBnd: string;
+}[];
+export interface StartBrokerOptions {
+    timeoutMs?: number;
+    pollMs?: number;
+    procRoot?: string;
+    log(line: string): void;
+}
+/**
+ * Starts all three, then proves each one reached its socket *and* its expected
+ * post-drop identity before the next starts. A broker that is alive but still
+ * root, or a relay whose socket never appeared, fails the slot here rather
+ * than at the first trial wake.
+ */
+export declare const startBrokerProcesses: (options: StartBrokerOptions) => Promise<BrokerChild[]>;
+/** Graceful stop in reverse start order: relay, backend, launcher. `SIGKILL` only after the grace window. */
+export declare const stopBrokerProcesses: (children: readonly BrokerChild[], log: (line: string) => void, graceMs?: number) => Promise<void>;