spawnfile 0.1.13 → 0.1.17

package/dist/compiler/training/repair/prepare.d.ts

@@ -0,0 +1,230 @@
+import type { TrainingContext } from "../contract.js";
+import type { TrainingImagePlan } from "../preparation/image.js";
+import type { PlannedInput } from "../preparation/inputs.js";
+export declare function planMeasurementRepair(options: {
+    parent: string;
+    witness?: string;
+    output: string;
+    auth: string[];
+    image: TrainingImagePlan;
+    inputs: PlannedInput[];
+    context: TrainingContext;
+    resume: boolean;
+}): Promise<{
+    parent: string;
+    witness: {
+        path: string;
+        manifest: {
+            schema: "spawnfile.training-legacy-witness.v1" | "spawnfile.training-witness.v1";
+            parentImage: string;
+            parentPreparationDigest: string;
+            imagePlanDigest: string;
+            config: {
+                version: "spawnfile.training-container.v3" | "spawnfile.training-container.v2";
+                dockerContext: string;
+                image: {
+                    ref: string;
+                } | {
+                    build: {
+                        recipe: "daimon-dspy.v1";
+                        nativeImage: string;
+                        pythonImage: string;
+                        platform: "linux/arm64" | "linux/amd64";
+                        paideia: string;
+                        bridge: string;
+                        claude: string;
+                        integration: {
+                            source: string;
+                            entry: string;
+                        };
+                        compiler?: string | undefined;
+                        grok?: {
+                            source: string;
+                            sha256: string;
+                        } | undefined;
+                        bootstrap?: string | undefined;
+                    };
+                };
+                integration: {
+                    settings: {
+                        input: string;
+                        path: string;
+                    };
+                };
+                inputs: {
+                    id: string;
+                    source: string;
+                    destination: string;
+                    include?: string[] | undefined;
+                    git?: {
+                        revision: string;
+                        overlays: {
+                            source: string;
+                            path: string;
+                            sha256: string;
+                        }[];
+                    } | undefined;
+                }[];
+                output: {
+                    source: string;
+                    destination: "/run/training/output";
+                };
+                auth: {
+                    source: string;
+                    provider: "codex" | "claude";
+                }[];
+                broker?: {
+                    engine: "grok";
+                    agentId: string;
+                    model: "grok-4.6" | "grok-4.5" | "grok-build";
+                    reasoningEffort: "high" | "medium" | "low";
+                    architecture: "arm64" | "x64";
+                    limits: {
+                        maxRequests: number;
+                        maxTokens: number;
+                        timeoutMs: number;
+                    };
+                    realmVolume: string;
+                    bootstrap: string;
+                    unenforcedBindPolicy?: "refuse" | "profile-only" | undefined;
+                } | undefined;
+            };
+            context: {
+                version: "spawnfile.training-context.v1";
+                producer: {
+                    package: "spawnfile";
+                    version: string;
+                };
+                project: {
+                    root: string;
+                    manifest: string;
+                    sourceDigest: string;
+                };
+                agent: {
+                    id: string;
+                    name: string;
+                    source: string;
+                    runtime: string;
+                    engine: string | null;
+                    model: {
+                        provider: string;
+                        name: string;
+                        authMethod: string;
+                    } | null;
+                };
+                sources: {
+                    sourcePath: string;
+                    destinationPath: string;
+                    sha256: string;
+                }[];
+                documents: {
+                    sourcePath: string;
+                    destinationPath: string;
+                    sha256: string;
+                    role: string;
+                }[];
+                skills: {
+                    sourcePath: string;
+                    destinationPath: string;
+                    sha256: string;
+                    name: string;
+                    ref: string;
+                    requiresMcp: string[];
+                }[];
+                resources: {
+                    id: string;
+                    kind: "volume" | "git" | "bundle";
+                    mount: string;
+                    mode: "readonly" | "mutable";
+                    sharing: "per_agent" | "team";
+                    definitionDigest: string;
+                    pin: string | null;
+                }[];
+                requirements: {
+                    nativeCompilation: true;
+                    isolatedPreparation: true;
+                };
+            };
+            command: {
+                args: string[];
+                env?: Record<string, string> | undefined;
+            };
+            inputs: {
+                id: string;
+                source: string;
+                destination: string;
+                digest: string;
+                staged: string;
+                snapshotDigest: string | null;
+            }[];
+            image: {
+                build: {
+                    recipe: "daimon-dspy.v1";
+                    nativeImage: string;
+                    pythonImage: string;
+                    platform: "linux/arm64" | "linux/amd64";
+                    paideia: string;
+                    bridge: string;
+                    claude: string;
+                    integration: {
+                        source: string;
+                        entry: string;
+                    };
+                    compiler?: string | undefined;
+                    grok?: {
+                        source: string;
+                        sha256: string;
+                    } | undefined;
+                    bootstrap?: string | undefined;
+                };
+                dockerfile: string;
+                entry: string;
+                brokerEntry: string;
+                files: {
+                    destination: string;
+                    sha256: string;
+                    mode: number;
+                    size: number;
+                }[];
+            };
+            repair?: {
+                witness: string;
+                parent: string;
+            } | undefined;
+        };
+        digest: string;
+    };
+    compatibility: {
+        components: Record<string, string>;
+        inputs: {
+            [k: string]: string;
+        };
+    };
+    files: import("../preparation/files.js").SealedFile[];
+    command: {
+        schema: "paideia.command-checkpoint.v1";
+        id: string;
+        identity: string;
+        lineage?: {
+            parentId: string;
+            parentIdentity: string;
+            receiptDigest: string;
+        } | undefined;
+    };
+    trainingIdentity: string;
+    checkpoints: Record<string, string>;
+    manifest: {
+        version: string;
+        files: {
+            path: string;
+            sha256: string;
+            size: number;
+        }[];
+    };
+    manifestDigest: string;
+}>;
+export type MeasurementRepairPlan = Awaited<ReturnType<typeof planMeasurementRepair>>;
+export declare function stageMeasurementRepair(plan: MeasurementRepairPlan, staging: string, image: string, canonicalSourceDigest: string, resume: boolean): Promise<{
+    repairPath: string;
+    root: string;
+}>;

package/dist/compiler/training/repair/prepare.js

@@ -0,0 +1,74 @@
+import { lstat, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { assertInputRoot, copySealed, exactPath, hashJson, sealFile, sealTree, within } from "../preparation/files.js";
+import { readTrainingWitness } from "./witness.js";
+import { verifyTrainingCompatibility } from "./compatibility.js";
+import { repairEnvelopeSchema } from "./contract.js";
+const commandSchema = z.object({ schema: z.literal("paideia.command-checkpoint.v1"), id: z.string().uuid(),
+    identity: z.string().regex(/^[a-f0-9]{64}$/u),
+    lineage: z.object({ parentId: z.string().uuid(), parentIdentity: z.string().regex(/^[a-f0-9]{64}$/u),
+        receiptDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/u) }).strict().optional() }).strict();
+export async function planMeasurementRepair(options) {
+    const parent = await exactPath(options.parent);
+    assertInputRoot(parent, options.auth);
+    if (within(parent, options.output) || within(options.output, parent))
+        throw Error("Repair output must be disjoint from parent");
+    if (!options.resume) {
+        try {
+            await lstat(options.output);
+            throw Error("Measurement repair requires a fresh output directory");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    const staging = path.join(path.dirname(parent), `.spawnfile-training-preparation-${hashJson(parent).slice(7, 23)}`);
+    const witness = await readTrainingWitness(options.witness ?? path.join(staging, "witness/manifest.json"));
+    const state = JSON.parse(await readFile(path.join(staging, "state.json"), "utf8"));
+    if (state.digest !== witness.manifest.parentPreparationDigest || state.image !== witness.manifest.parentImage)
+        throw Error("Repair parent preparation does not match witness");
+    const compatibility = verifyTrainingCompatibility(witness.manifest, options.image, options.inputs, options.context);
+    compatibility.components["parent-witness"] = witness.digest;
+    const files = [...await sealTree(path.join(parent, "runs"), "runs"), ...await sealTree(path.join(parent, "blobs"), "blobs")];
+    const checkpoints = {};
+    for (const name of ["command", "training", "host", "optimizer"]) {
+        const file = await sealFile(path.join(parent, "checkpoint", `${name}.json`), `checkpoint/${name}.json`);
+        files.push(file);
+        checkpoints[name] = file.sha256;
+    }
+    const command = commandSchema.parse(JSON.parse(await readFile(path.join(parent, "checkpoint/command.json"), "utf8")));
+    const training = JSON.parse(await readFile(path.join(parent, "checkpoint/training.json"), "utf8"));
+    const trainingIdentity = z.string().regex(/^[a-f0-9]{64}$/u).parse(training.state?.identity);
+    const manifest = { version: "paideia.repair-parent.v1", files: files.map(file => ({ path: file.destination, sha256: file.sha256, size: file.size })) };
+    return { parent, witness, compatibility, files, command, trainingIdentity, checkpoints,
+        manifest, manifestDigest: hashJson(manifest) };
+}
+export async function stageMeasurementRepair(plan, staging, image, canonicalSourceDigest, resume) {
+    const root = path.join(staging, "repair-parent"), repairPath = path.join(staging, "repair.json");
+    const compatibility = { version: "spawnfile.daimon-dspy-compatibility.v1", ...plan.compatibility,
+        digest: hashJson(plan.compatibility) };
+    const receipt = repairEnvelopeSchema.shape.receipt.parse({ version: "paideia.measurement-repair.v1",
+        parent: { root: "/run/training/inputs/repair-parent", imageId: plan.witness.manifest.parentImage,
+            experimentId: plan.command.id, executionIdentity: plan.command.identity, manifestDigest: plan.manifestDigest,
+            checkpoints: plan.checkpoints, trainingIdentity: plan.trainingIdentity },
+        current: { imageId: image, canonicalSourceDigest, adapterId: "daimon-native" }, compatibility });
+    const envelope = { receipt, digest: hashJson(receipt) };
+    if (resume) {
+        if (await exactPath(repairPath) !== repairPath || hashJson(JSON.parse(await readFile(repairPath, "utf8"))) !== hashJson(envelope))
+            throw Error("Saved measurement repair receipt changed");
+        if ((await sealFile(path.join(root, "projection-manifest.json"), "manifest")).sha256 !== plan.manifestDigest)
+            throw Error("Saved repair projection changed");
+        for (const file of plan.files)
+            if ((await sealFile(path.join(root, file.destination), file.destination)).sha256 !== file.sha256)
+                throw Error("Saved repair capture changed");
+    }
+    else {
+        await mkdir(root, { mode: 0o700 });
+        await copySealed(plan.files, root);
+        await writeFile(path.join(root, "projection-manifest.json"), JSON.stringify(plan.manifest), { mode: 0o400, flag: "wx" });
+        await writeFile(repairPath, JSON.stringify(envelope), { mode: 0o400, flag: "wx" });
+    }
+    return { repairPath, root };
+}

package/dist/compiler/training/repair/witness.d.ts

@@ -0,0 +1,203 @@
+import type { TrainingContext } from "../contract.js";
+import type { TrainingPreparationConfig } from "../preparation/contract.js";
+import type { TrainingImagePlan } from "../preparation/image.js";
+import type { PlannedInput } from "../preparation/inputs.js";
+export declare function readTrainingWitness(file: string): Promise<{
+    path: string;
+    manifest: {
+        schema: "spawnfile.training-legacy-witness.v1" | "spawnfile.training-witness.v1";
+        parentImage: string;
+        parentPreparationDigest: string;
+        imagePlanDigest: string;
+        config: {
+            version: "spawnfile.training-container.v3" | "spawnfile.training-container.v2";
+            dockerContext: string;
+            image: {
+                ref: string;
+            } | {
+                build: {
+                    recipe: "daimon-dspy.v1";
+                    nativeImage: string;
+                    pythonImage: string;
+                    platform: "linux/arm64" | "linux/amd64";
+                    paideia: string;
+                    bridge: string;
+                    claude: string;
+                    integration: {
+                        source: string;
+                        entry: string;
+                    };
+                    compiler?: string | undefined;
+                    grok?: {
+                        source: string;
+                        sha256: string;
+                    } | undefined;
+                    bootstrap?: string | undefined;
+                };
+            };
+            integration: {
+                settings: {
+                    input: string;
+                    path: string;
+                };
+            };
+            inputs: {
+                id: string;
+                source: string;
+                destination: string;
+                include?: string[] | undefined;
+                git?: {
+                    revision: string;
+                    overlays: {
+                        source: string;
+                        path: string;
+                        sha256: string;
+                    }[];
+                } | undefined;
+            }[];
+            output: {
+                source: string;
+                destination: "/run/training/output";
+            };
+            auth: {
+                source: string;
+                provider: "codex" | "claude";
+            }[];
+            broker?: {
+                engine: "grok";
+                agentId: string;
+                model: "grok-4.6" | "grok-4.5" | "grok-build";
+                reasoningEffort: "high" | "medium" | "low";
+                architecture: "arm64" | "x64";
+                limits: {
+                    maxRequests: number;
+                    maxTokens: number;
+                    timeoutMs: number;
+                };
+                realmVolume: string;
+                bootstrap: string;
+                unenforcedBindPolicy?: "refuse" | "profile-only" | undefined;
+            } | undefined;
+        };
+        context: {
+            version: "spawnfile.training-context.v1";
+            producer: {
+                package: "spawnfile";
+                version: string;
+            };
+            project: {
+                root: string;
+                manifest: string;
+                sourceDigest: string;
+            };
+            agent: {
+                id: string;
+                name: string;
+                source: string;
+                runtime: string;
+                engine: string | null;
+                model: {
+                    provider: string;
+                    name: string;
+                    authMethod: string;
+                } | null;
+            };
+            sources: {
+                sourcePath: string;
+                destinationPath: string;
+                sha256: string;
+            }[];
+            documents: {
+                sourcePath: string;
+                destinationPath: string;
+                sha256: string;
+                role: string;
+            }[];
+            skills: {
+                sourcePath: string;
+                destinationPath: string;
+                sha256: string;
+                name: string;
+                ref: string;
+                requiresMcp: string[];
+            }[];
+            resources: {
+                id: string;
+                kind: "volume" | "git" | "bundle";
+                mount: string;
+                mode: "readonly" | "mutable";
+                sharing: "per_agent" | "team";
+                definitionDigest: string;
+                pin: string | null;
+            }[];
+            requirements: {
+                nativeCompilation: true;
+                isolatedPreparation: true;
+            };
+        };
+        command: {
+            args: string[];
+            env?: Record<string, string> | undefined;
+        };
+        inputs: {
+            id: string;
+            source: string;
+            destination: string;
+            digest: string;
+            staged: string;
+            snapshotDigest: string | null;
+        }[];
+        image: {
+            build: {
+                recipe: "daimon-dspy.v1";
+                nativeImage: string;
+                pythonImage: string;
+                platform: "linux/arm64" | "linux/amd64";
+                paideia: string;
+                bridge: string;
+                claude: string;
+                integration: {
+                    source: string;
+                    entry: string;
+                };
+                compiler?: string | undefined;
+                grok?: {
+                    source: string;
+                    sha256: string;
+                } | undefined;
+                bootstrap?: string | undefined;
+            };
+            dockerfile: string;
+            entry: string;
+            brokerEntry: string;
+            files: {
+                destination: string;
+                sha256: string;
+                mode: number;
+                size: number;
+            }[];
+        };
+        repair?: {
+            witness: string;
+            parent: string;
+        } | undefined;
+    };
+    digest: string;
+}>;
+/** Future repairs need sealed original bytes, not a mutable checkout or caller assertion. */
+export declare function writeTrainingWitness(options: {
+    directory: string;
+    digest: string;
+    image: string;
+    config: TrainingPreparationConfig;
+    context: TrainingContext;
+    args: readonly string[];
+    inputs: PlannedInput[];
+    staged: string[];
+    snapshots: (string | null)[];
+    plan: TrainingImagePlan;
+    repair?: {
+        witness: string;
+        parent: string;
+    };
+}): Promise<void>;

package/dist/compiler/training/repair/witness.js

@@ -0,0 +1,42 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { copySealed, exactPath, fileIdentity, hashJson, sealTree } from "../preparation/files.js";
+import { witnessEnvelopeSchema } from "./contract.js";
+export async function readTrainingWitness(file) {
+    const canonical = await exactPath(file), bytes = await readFile(canonical, "utf8");
+    if (Buffer.byteLength(bytes) > 8 * 1024 * 1024)
+        throw Error("Training witness exceeds 8 MiB");
+    const raw = JSON.parse(bytes);
+    if (hashJson(raw.manifest) !== raw.digest)
+        throw Error("Training witness digest mismatch");
+    const parsed = witnessEnvelopeSchema.parse(raw), witness = parsed.manifest;
+    const files = await sealTree(path.join(path.dirname(canonical), "image-files"), "");
+    const sorted = (value) => [...value].sort((a, b) => a.destination.localeCompare(b.destination));
+    if (hashJson(sorted(fileIdentity(files))) !== hashJson(sorted(witness.image.files)))
+        throw Error("Training witness image bytes changed");
+    const { recipe, nativeImage, pythonImage, platform } = witness.image.build;
+    if (hashJson({ recipe, nativeImage, pythonImage, platform, files: witness.image.files,
+        dockerfile: witness.image.dockerfile, entry: witness.image.entry, brokerEntry: witness.image.brokerEntry }) !== witness.imagePlanDigest)
+        throw Error("Training witness recipe identity mismatch");
+    const expected = hashJson({ config: raw.manifest && raw.manifest.config,
+        sources: witness.inputs.map(input => ({ id: input.id, digest: input.digest })),
+        image: witness.imagePlanDigest, canonical: witness.context.project.sourceDigest, ...(witness.repair ? { repair: witness.repair } : {}) });
+    if (expected !== witness.parentPreparationDigest)
+        throw Error("Training witness preparation identity mismatch");
+    return { ...parsed, path: canonical };
+}
+/** Future repairs need sealed original bytes, not a mutable checkout or caller assertion. */
+export async function writeTrainingWitness(options) {
+    const directory = path.join(options.directory, "witness");
+    await mkdir(directory, { mode: 0o700 });
+    await copySealed(options.plan.files, path.join(directory, "image-files"));
+    const manifest = { schema: "spawnfile.training-witness.v1", parentImage: options.image,
+        parentPreparationDigest: options.digest, imagePlanDigest: options.plan.digest, config: options.config,
+        ...(options.repair ? { repair: options.repair } : {}),
+        context: options.context, command: { args: [...options.args] },
+        inputs: options.inputs.map((input, index) => ({ id: input.id, source: input.source, destination: input.destination,
+            digest: input.digest, staged: options.staged[index], snapshotDigest: options.snapshots[index] })),
+        image: { build: options.plan.build, files: fileIdentity(options.plan.files), dockerfile: options.plan.dockerfile,
+            entry: options.plan.entry, brokerEntry: options.plan.brokerEntry } };
+    await writeFile(path.join(directory, "manifest.json"), JSON.stringify({ manifest, digest: hashJson(manifest) }), { flag: "wx", mode: 0o400 });
+}