spawnfile 0.1.13 → 0.1.17

package/dist/deployment/candidateDiagnostics.js

@@ -0,0 +1,90 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { resolveSpawnfileHome } from "../auth/index.js";
+import { redactDockerLogText } from "./dockerLogs.js";
+import { resolveHomeDeploymentDirectory } from "./homeStore.js";
+const outputLimit = 64 * 1024;
+const commandOptions = { captureStderr: true, maxOutputBytes: outputLimit, timeoutMs: 5_000 };
+const containerIdPattern = /^[a-f0-9]{64}$/u;
+/** Redaction is best effort; diagnostic artifacts remain private operator data. */
+export const sanitizeCandidateDiagnostic = (text, secrets) => redactDockerLogText(text, secrets)
+    .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/gu, "[REDACTED PRIVATE KEY]")
+    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED JWT]")
+    .replace(/https?:\/\/[^\s<>"']+/giu, "[REDACTED URL]")
+    .replace(/\b([a-z0-9_-]*(?:authorization|cookie|password|secret|token|api[_-]?key)[a-z0-9_-]*)["']?\s*[:=]\s*[^\r\n]+/giu, "$1: [REDACTED]");
+const collect = async (runDocker, args) => {
+    try {
+        const bytes = await runDocker(args, commandOptions);
+        // Injectable runners must obey the same limit as the default Docker runner.
+        if (bytes.length > outputLimit)
+            throw new Error("limit");
+        return { available: true, text: bytes.toString("utf8") };
+    }
+    catch {
+        // Docker transport errors can contain command/env details; never persist them.
+        return { available: false, text: "Diagnostic command failed, timed out, or exceeded its byte limit" };
+    }
+};
+const summarizeState = (raw, secrets) => {
+    try {
+        const state = JSON.parse(raw);
+        const health = state.Health?.Status;
+        const status = ["created", "running", "paused", "restarting", "removing", "exited", "dead"].includes(String(state.Status))
+            ? state.Status : "unknown";
+        const parts = [`state=${status}`];
+        if (["starting", "healthy", "unhealthy"].includes(String(health)))
+            parts.push(`health=${health}`);
+        if (Number.isSafeInteger(state.ExitCode))
+            parts.push(`exit=${state.ExitCode}`);
+        if (state.OOMKilled === true)
+            parts.push("oom-killed");
+        const healthState = state.Health;
+        const text = (value) => typeof value === "string"
+            ? sanitizeCandidateDiagnostic(value, secrets).slice(0, 4_096) : "";
+        return { available: true, summary: parts.join(", "), error: text(state.Error),
+            healthOutput: Array.isArray(healthState?.Log) ? healthState.Log.slice(-3).map((entry) => text(entry && typeof entry === "object" ? entry.Output : null)) : [] };
+    }
+    catch {
+        return { available: false, summary: "state unavailable", error: "", healthOutput: [] };
+    }
+};
+/** Collect before rollback deletes the only container-local startup evidence. */
+export const captureCandidateDiagnostics = async (input) => {
+    if (!containerIdPattern.test(input.candidateId))
+        return { path: null, summary: "invalid candidate identity" };
+    const [state, logs] = await Promise.all([
+        collect(input.runDocker, ["container", "inspect", "--format", "{{json .State}}", input.candidateId]),
+        collect(input.runDocker, ["logs", "--tail", "100", input.candidateId])
+    ]);
+    const health = summarizeState(state.available ? state.text : "", input.secretValues);
+    const summary = health.summary;
+    try {
+        const deploymentDirectory = resolveHomeDeploymentDirectory(input.deploymentName);
+        for (const parent of [resolveSpawnfileHome(), path.dirname(deploymentDirectory), deploymentDirectory]) {
+            const info = await lstat(parent);
+            if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o022) !== 0
+                || (process.getuid && info.uid !== process.getuid()))
+                throw new Error("unsafe diagnostics parent");
+        }
+        const directory = path.join(deploymentDirectory, "diagnostics");
+        await mkdir(directory, { mode: 0o700 }).catch((error) => {
+            if (error.code !== "EEXIST")
+                throw error;
+        });
+        const info = await lstat(directory);
+        if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o777) !== 0o700
+            || (process.getuid && info.uid !== process.getuid()))
+            throw new Error("unsafe diagnostics directory");
+        const destination = path.join(directory, `candidate-${Date.now()}-${randomUUID()}.json`);
+        await writeFile(destination, `${JSON.stringify({
+            version: "spawnfile.candidate-diagnostics.v1", capturedAt: new Date().toISOString(),
+            candidateId: input.candidateId, deployment: input.deploymentName, summary, health,
+            logs: { available: logs.available, text: sanitizeCandidateDiagnostic(logs.text, input.secretValues) }
+        }, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+        return { path: destination, summary };
+    }
+    catch {
+        return { path: null, summary };
+    }
+};

package/dist/deployment/deploymentLifecycleCorrelation.d.ts

@@ -0,0 +1,11 @@
+import type { DeploymentRecord } from "./record.js";
+export interface DeploymentLifecycleCorrelation {
+    compile_fingerprint: string;
+    deployment_instance_digest: string;
+    deployment: string;
+    run_id: string | null;
+    target: string;
+}
+export declare const createDeploymentInstanceDigest: (record: DeploymentRecord) => string;
+export declare const createDeploymentLifecycleCorrelation: (record: DeploymentRecord) => DeploymentLifecycleCorrelation;
+export declare const assertDeploymentLifecycleCorrelation: (record: DeploymentRecord, expected: DeploymentLifecycleCorrelation | undefined) => void;

package/dist/deployment/deploymentLifecycleCorrelation.js

@@ -0,0 +1,33 @@
+import { createHash } from "node:crypto";
+import { SpawnfileError } from "../shared/index.js";
+const canonical = (value) => {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+};
+export const createDeploymentInstanceDigest = (record) => {
+    const { export_index: _mutableExport, ...immutable } = record;
+    return `sha256:${createHash("sha256")
+        .update(canonical(immutable))
+        .digest("hex")}`;
+};
+export const createDeploymentLifecycleCorrelation = (record) => ({
+    compile_fingerprint: record.compile_fingerprint,
+    deployment: record.name,
+    deployment_instance_digest: createDeploymentInstanceDigest(record),
+    run_id: record.run_id ?? null,
+    target: JSON.stringify(record.target),
+});
+export const assertDeploymentLifecycleCorrelation = (record, expected) => {
+    if (expected &&
+        JSON.stringify(createDeploymentLifecycleCorrelation(record)) !==
+            JSON.stringify(expected))
+        throw new SpawnfileError("runtime_error", "Deployment changed after lifecycle admission; refusing effect");
+};

package/dist/deployment/dockerInspect.d.ts

@@ -11,6 +11,7 @@ export interface DockerUnitInspection {
     exists: boolean | null;
     exitCode: number | null;
     finishedAt: string | null;
+    identity: DockerDeploymentIdentity | null;
     imageId: string | null;
     message: string;
     restartCount: number | null;
@@ -20,6 +21,14 @@ export interface DockerUnitInspection {
     status: string | null;
     unitId: string;
 }
+export interface DockerDeploymentIdentity {
+    readonly compileFingerprint: string;
+    readonly deployment: string;
+    readonly project: string;
+    readonly runId: string;
+    readonly unit: string;
+    readonly version: string;
+}
 export type DockerInspectionResult = Map<string, DockerUnitInspection>;
 export interface DockerInspectOptions {
     dockerCommand?: string;

package/dist/deployment/dockerInspect.js

@@ -1,10 +1,30 @@
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
+import { dockerDeploymentLabelKeys } from "./dockerLabels.js";
 import { dockerContextNameForTarget, verifyDockerDeploymentTarget } from "./target.js";
 const execFile = promisify(execFileCallback);
 const toStringOrNull = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const toNumberOrNull = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const identifierLabelValuePattern = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
+const identityFromInspection = (inspected) => {
+    const config = isRecord(inspected.Config) ? inspected.Config : null;
+    const labels = config && isRecord(config.Labels) ? config.Labels : null;
+    if (!labels)
+        return null;
+    const values = {
+        compileFingerprint: labels[dockerDeploymentLabelKeys.compileFingerprint],
+        deployment: labels[dockerDeploymentLabelKeys.deployment],
+        project: labels[dockerDeploymentLabelKeys.project],
+        runId: labels[dockerDeploymentLabelKeys.runId],
+        unit: labels[dockerDeploymentLabelKeys.unit],
+        version: labels[dockerDeploymentLabelKeys.version]
+    };
+    if (Object.values(values).some((value) => typeof value !== "string" || !identifierLabelValuePattern.test(value))) {
+        return null;
+    }
+    return values;
+};
 const targetRefForUnit = (unit) => unit.container_id ?? unit.container_name;
 const argsForInspect = (record, targetRef) => {
     const context = dockerContextNameForTarget(record.target);
@@ -46,9 +66,10 @@ const inspectionFromState = (unitId, unit, inspected, state) => {
         exists: true,
         exitCode: toNumberOrNull(state.ExitCode),
         finishedAt: toStringOrNull(state.FinishedAt),
+        identity: running === true ? identityFromInspection(inspected) : null,
         imageId,
         message: drift.length > 0 ? `${baseMessage}; ${drift.join("; ")}` : baseMessage,
-        restartCount: toNumberOrNull(state.RestartCount),
+        restartCount: toNumberOrNull(inspected.RestartCount),
         running,
         severity: drift.length > 0 ? "warn" : running === false ? "error" : "ok",
         startedAt: toStringOrNull(state.StartedAt),
@@ -62,6 +83,7 @@ const missingInspection = (unitId, message) => ({
     exists: false,
     exitCode: null,
     finishedAt: null,
+    identity: null,
     imageId: null,
     message,
     restartCount: null,
@@ -77,6 +99,7 @@ const unknownInspection = (unitId, message, severity = "unknown") => ({
     exists: null,
     exitCode: null,
     finishedAt: null,
+    identity: null,
     imageId: null,
     message,
     restartCount: null,

package/dist/deployment/dockerLabels.d.ts

@@ -2,6 +2,7 @@ export declare const dockerDeploymentLabelKeys: {
     readonly compileFingerprint: "com.spawnfile.compile_fingerprint";
     readonly deployment: "com.spawnfile.deployment";
     readonly project: "com.spawnfile.project";
+    readonly runId: "com.spawnfile.run_id";
     readonly unit: "com.spawnfile.unit";
     readonly version: "com.spawnfile.version";
 };
@@ -9,6 +10,7 @@ export interface DockerDeploymentLabelInput {
     compileFingerprint: string;
     deployment: string;
     project: string;
+    runId?: string;
     unit: string;
     version: string;
 }

package/dist/deployment/dockerLabels.js

@@ -3,6 +3,7 @@ export const dockerDeploymentLabelKeys = {
     compileFingerprint: "com.spawnfile.compile_fingerprint",
     deployment: "com.spawnfile.deployment",
     project: "com.spawnfile.project",
+    runId: "com.spawnfile.run_id",
     unit: "com.spawnfile.unit",
     version: "com.spawnfile.version"
 };
@@ -17,6 +18,7 @@ export const createDockerDeploymentLabels = (input) => {
         [dockerDeploymentLabelKeys.compileFingerprint]: input.compileFingerprint,
         [dockerDeploymentLabelKeys.deployment]: input.deployment,
         [dockerDeploymentLabelKeys.project]: input.project,
+        ...(input.runId ? { [dockerDeploymentLabelKeys.runId]: input.runId } : {}),
         [dockerDeploymentLabelKeys.unit]: input.unit,
         [dockerDeploymentLabelKeys.version]: input.version
     };

package/dist/deployment/dockerLogs.js

@@ -1,6 +1,7 @@
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
 import { dockerContextNameForTarget } from "./target.js";
+import { redactSensitiveText } from "../shared/index.js";
 const execFile = promisify(execFileCallback);
 const targetRefForUnit = (unit) => unit.container_id ?? unit.container_name;
 const withDockerTarget = (record, args) => {
@@ -14,19 +15,13 @@ const withDockerTarget = (record, args) => {
     return args;
 };
 const normalizeTail = (tail) => typeof tail === "number" && Number.isInteger(tail) && tail > 0 ? tail : 100;
+const stripTerminalControls = (value) => value.replace(/\x1b\[[0-?]*[ -/]*[@-~]|[\x00-\x08\x0b-\x1f\x7f]/gu, "");
 const redactKnownSecrets = (text, secretValues) => secretValues
+    .map(stripTerminalControls)
     .filter((secret) => secret.length > 0)
+    .sort((left, right) => right.length - left.length)
     .reduce((redacted, secret) => redacted.replaceAll(secret, "[REDACTED]"), text);
-const redactTokenLikeText = (text) => {
-    let redacted = text;
-    redacted = redacted.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi, "Bearer [REDACTED]");
-    redacted = redacted.replace(/\bmagt_v1_[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]");
-    redacted = redacted.replace(/\b(?:sk|sk-proj)-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]");
-    redacted = redacted.replace(/\b([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*=)([^\s"'`]+)/gi, "$1[REDACTED]");
-    redacted = redacted.replace(/("([^"]*(?:api[_-]?key|token|secret|password)[^"]*)"\s*:\s*")([^"]+)(")/gi, "$1[REDACTED]$4");
-    return redacted;
-};
-export const redactDockerLogText = (text, secretValues = []) => redactTokenLikeText(redactKnownSecrets(text, secretValues));
+export const redactDockerLogText = (text, secretValues = []) => redactSensitiveText(redactKnownSecrets(stripTerminalControls(text), secretValues));
 const combineLogStreams = (stdout, stderr) => {
     if (!stdout) {
         return stderr;

package/dist/deployment/dockerManager.d.ts

@@ -1,6 +1,11 @@
 import type { DeploymentRecordSource } from "./record.js";
+import type { OrganizationReadinessEvidence } from "../compiler/organizationReadyEvidence.js";
+import { type DockerProbeExecFile } from "./dockerProbeGateway.js";
+import { type OrganizationReadiness } from "./organizationReady.js";
 import { type DockerDeploymentTarget, type DockerTargetExecFile } from "./target.js";
 import { type DeploymentRecord } from "./record.js";
+import { type OrganizationHandoff, type OrganizationHandoffInput } from "./organizationHandoffTypes.js";
+import type { OpaqueTargetHandle, SelectedTargetReceipt } from "../target/index.js";
 export interface DockerDeploymentNodeInput {
     id: string;
     kind: "agent" | "team";
@@ -20,6 +25,12 @@ export interface DockerDeploymentRunInvocationInput {
 export interface DockerDeploymentReportInput {
     compile_fingerprint?: string;
     container?: {
+        moltnet?: {
+            server_plans: Array<{
+                mode: "external" | "managed";
+                network_id: string;
+            }>;
+        };
         runtime_instances: Array<{
             id: string;
         }>;
@@ -34,14 +45,39 @@ export interface WriteDockerDeploymentRecordInput {
     deploymentName?: string;
     envFilePath?: string;
     imageTag: string;
+    networkIds?: string[];
     nodes: DockerDeploymentNodeInput[];
     outputDirectory: string;
+    organizationHandoff?: OrganizationHandoffInput;
+    organizationHandoffHandle?: OpaqueTargetHandle;
     projectRoot: string;
+    runId?: string;
     runMetadata?: DockerDeploymentRunMetadata;
     runtimeInstanceIds: string[];
     source?: DeploymentRecordSource;
     target: DockerDeploymentTarget;
 }
+export declare const createDockerOrganizationHandoffSession: (input: {
+    readonly bindingDigest: string;
+    readonly containerName: string;
+    readonly deploymentLabels: Readonly<Record<string, string>>;
+    readonly descriptorDigest: string;
+    readonly organizationHandoff: OrganizationHandoffInput;
+    readonly runId: string;
+    readonly selectedTarget: SelectedTargetReceipt;
+    readonly selectedTargetReceiptDigest: string;
+}) => {
+    readonly authorityInput: {
+        readonly bindingDigest: string;
+        readonly containerName: string;
+        readonly deploymentLabels: Readonly<Record<string, string>>;
+        readonly descriptorDigest: string;
+        readonly handoff: OrganizationHandoff;
+        readonly selectedTarget: SelectedTargetReceipt;
+        readonly selectedTargetReceiptDigest: string;
+    };
+    readonly organizationHandoff: OrganizationHandoff;
+};
 export declare const createDockerDeploymentUnitId: (deploymentName: string) => string;
 export declare const createDockerDeploymentRecord: (input: WriteDockerDeploymentRecordInput) => DeploymentRecord;
 export declare const createDockerProjectLabel: (projectRoot: string, projectName?: string) => string;
@@ -52,8 +88,23 @@ export declare const writeDockerDeploymentRecordForRun: (input: {
     imageTag: string;
     invocation: DockerDeploymentRunInvocationInput;
     outputDirectory: string;
+    organizationHandoff?: OrganizationHandoffInput;
+    organizationHandoffHandle?: OpaqueTargetHandle;
     report: DockerDeploymentReportInput;
     runMetadata?: DockerDeploymentRunMetadata;
     targetExecFile?: DockerTargetExecFile;
     targetTimeoutMs?: number;
 }) => Promise<string | null>;
+export interface ProbeDockerOrganizationReadinessInput {
+    dockerCommand?: string;
+    evidence: OrganizationReadinessEvidence;
+    execFile?: DockerProbeExecFile;
+    record: DeploymentRecord;
+    timeoutMs?: number;
+}
+/**
+ * Performs the single manager-owned inspection, public health checks, and
+ * bounded artifact reads needed to reconcile immutable compiler evidence.
+ * It deliberately returns a safe value only; upProject owns both persistence writes.
+ */
+export declare const probeDockerOrganizationReadiness: (input: ProbeDockerOrganizationReadinessInput) => Promise<OrganizationReadiness>;

package/dist/deployment/dockerManager.js

@@ -1,9 +1,29 @@
 import path from "node:path";
 import { normalizeProjectLabelSlug } from "../distribution/index.js";
+import { resolveNoopolisRunId } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
+import { inspectDockerDeployment } from "./dockerInspect.js";
 import { normalizeDeploymentName } from "./names.js";
+import { createDockerProbeGateway } from "./dockerProbeGateway.js";
+import { organizationReadinessFromProbeError, reconcileOrganizationReadiness } from "./organizationReady.js";
 import { resolveDockerDeploymentTarget } from "./target.js";
 import { writeDeploymentRecord } from "./record.js";
+import { createOrganizationHandoff } from "./organizationHandoffTypes.js";
+export const createDockerOrganizationHandoffSession = (input) => {
+    const organizationHandoff = createOrganizationHandoff(input.runId, input.organizationHandoff);
+    return Object.freeze({
+        authorityInput: Object.freeze({
+            bindingDigest: input.bindingDigest,
+            containerName: input.containerName,
+            deploymentLabels: input.deploymentLabels,
+            descriptorDigest: input.descriptorDigest,
+            handoff: organizationHandoff,
+            selectedTarget: input.selectedTarget,
+            selectedTargetReceiptDigest: input.selectedTargetReceiptDigest
+        }),
+        organizationHandoff
+    });
+};
 const resolveProjectSlug = (projectRoot) => {
     const base = path.basename(projectRoot).toLowerCase() === "spawnfile"
         ? path.basename(path.dirname(projectRoot))
@@ -24,13 +44,25 @@ export const createDockerDeploymentRecord = (input) => {
         manager: "docker",
         name,
         output_directory: path.resolve(input.outputDirectory),
+        ...(input.runId ? { run_id: input.runId } : {}),
+        ...(input.runId && input.organizationHandoff
+            ? { organization_handoff: createOrganizationHandoff(input.runId, input.organizationHandoff) }
+            : {}),
+        ...(input.runId && input.organizationHandoff && input.organizationHandoffHandle
+            ? { organization_handoff_handle: input.organizationHandoffHandle }
+            : {}),
         source: input.source ?? { kind: "project", root: path.resolve(input.projectRoot) },
         target: input.target,
         units: [
             {
                 container_id: input.runMetadata?.containerId ?? null,
                 container_name: input.containerName,
-                contains: input.nodes.map((node) => ({ id: node.id, kind: node.kind })),
+                contains: [
+                    ...input.nodes.map((node) => ({ id: node.id, kind: node.kind })),
+                    ...[...new Set(input.networkIds ?? [])]
+                        .sort()
+                        .map((id) => ({ id, kind: "network" }))
+                ],
                 id: createDockerDeploymentUnitId(name),
                 image_id: input.runMetadata?.imageId ?? null,
                 image_tag: input.imageTag,
@@ -60,9 +92,20 @@ export const writeDockerDeploymentRecordForRun = async (input) => {
         deploymentName: input.invocation.deploymentName,
         envFilePath: input.envFilePath,
         imageTag: input.imageTag,
+        networkIds: input.report.container?.moltnet?.server_plans
+            .filter((server) => server.mode === "managed")
+            .map((server) => server.network_id),
         nodes: input.report.nodes,
         outputDirectory: input.outputDirectory,
+        ...(input.organizationHandoff ? { organizationHandoff: input.organizationHandoff } : {}),
+        ...(input.organizationHandoffHandle ? { organizationHandoffHandle: input.organizationHandoffHandle } : {}),
         projectRoot: input.report.root,
+        // Sourced from the host process env at record-write time, not the
+        // compile report: `spawnfile run`/`up --detach` always call
+        // ensureNoopolisRunId() before compiling (src/compiler/CLAUDE.md), so by
+        // the time this record is written the run id — if any — is already on
+        // process.env. A bare host env with no run id yields no `run_id` field.
+        runId: resolveNoopolisRunId(process.env),
         runMetadata: input.runMetadata,
         runtimeInstanceIds: input.report.container?.runtime_instances.map((instance) => instance.id) ?? [],
         target: await resolveDockerDeploymentTarget({
@@ -74,3 +117,83 @@ export const writeDockerDeploymentRecordForRun = async (input) => {
         })
     });
 };
+const recordCorrelation = (record) => ({
+    compileFingerprint: record.compile_fingerprint,
+    deploymentName: record.name,
+    runId: record.run_id ?? null,
+    unitCount: record.units.length,
+    unitId: record.units[0]?.id ?? "invalid-unit"
+});
+/**
+ * Performs the single manager-owned inspection, public health checks, and
+ * bounded artifact reads needed to reconcile immutable compiler evidence.
+ * It deliberately returns a safe value only; upProject owns both persistence writes.
+ */
+export const probeDockerOrganizationReadiness = async (input) => {
+    const correlation = recordCorrelation(input.record);
+    try {
+        const inspections = await inspectDockerDeployment(input.record, {
+            dockerCommand: input.dockerCommand,
+            execFile: input.execFile,
+            timeoutMs: input.timeoutMs
+        });
+        const unit = input.record.units[0];
+        const inspected = unit ? inspections.get(unit.id) ?? null : null;
+        if (!unit || !inspected) {
+            return reconcileOrganizationReadiness({
+                evidence: input.evidence, inspection: null, probe: null, record: correlation
+            });
+        }
+        const gateway = createDockerProbeGateway(input.record, unit, {
+            dockerCommand: input.dockerCommand,
+            execFile: input.execFile,
+            inspection: inspected,
+            timeoutMs: input.timeoutMs
+        });
+        const inspection = await gateway.inspectUnit();
+        if (input.evidence.hasExternalMoltnet) {
+            return reconcileOrganizationReadiness({
+                evidence: input.evidence, inspection, probe: null, record: correlation
+            });
+        }
+        const networks = [];
+        for (const network of input.evidence.networks) {
+            if (network.mode !== "managed" || network.internalPort === null) {
+                return reconcileOrganizationReadiness({
+                    evidence: input.evidence, inspection, probe: null, record: correlation
+                });
+            }
+            const health = await gateway.httpGet(network.internalPort, "/healthz");
+            if (!health.ok) {
+                return organizationReadinessFromProbeError(input.evidence, correlation, new Error(health.error ?? "probe unavailable"));
+            }
+            networks.push({
+                healthOk: health.ok,
+                id: network.id
+            });
+        }
+        const configs = new Map();
+        const attachmentReceipts = new Map();
+        for (const network of input.evidence.networks) {
+            for (const node of network.nodes) {
+                const result = await gateway.exec(["cat", node.configPath]);
+                configs.set(node.configPath, result.stdout);
+                const receipt = await gateway.exec(["cat", node.receiptPath]);
+                attachmentReceipts.set(node.receiptPath, receipt.stdout);
+            }
+        }
+        const daimonReceipt = input.evidence.daimon == null ? null : (await gateway.exec(["cat", input.evidence.daimon.receiptPath])).stdout;
+        const bindings = input.evidence.worldBindings === null
+            ? null
+            : await gateway.exec(["cat", input.evidence.worldBindings.artifactPath]);
+        return reconcileOrganizationReadiness({
+            evidence: input.evidence,
+            inspection,
+            probe: { attachmentReceipts, configs, daimonReceipt, networks, worldBindings: bindings?.stdout ?? null },
+            record: correlation
+        });
+    }
+    catch (error) {
+        return organizationReadinessFromProbeError(input.evidence, correlation, error);
+    }
+};

package/dist/deployment/dockerProbeGateway.d.ts

@@ -1,7 +1,21 @@
 import type { RuntimeProbeGateway } from "../runtime/index.js";
 import type { DeploymentRecord } from "./record.js";
 import type { DockerUnitInspection } from "./dockerInspect.js";
+/**
+ * The ledger this gateway reads (`spawnfile usage`) rotates once a generation
+ * reaches `DAIMON_GROK_TURN_USAGE_LEDGER.rotateBytes`, and rotation happens on
+ * the append *after* that threshold is crossed — so a rotated generation is
+ * always at least the bound and the crossing line pushes it over. A maxBuffer
+ * merely equal to the bound therefore rejects the exact read this feature
+ * exists to perform (Node's `execFile` accepts a payload of exactly
+ * `maxBuffer` bytes and fails the next one with
+ * `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`). Doubling the bound leaves a full
+ * generation of headroom, and is derived from the ledger constant rather than
+ * restated so the two cannot drift apart.
+ */
+export declare const DEFAULT_DOCKER_PROBE_MAX_BUFFER_BYTES: number;
 export type DockerProbeExecFile = (file: string, args: string[], options: {
+    maxBuffer?: number;
     timeout: number;
 }) => Promise<{
     stderr: string;
@@ -11,6 +25,9 @@ export interface DockerProbeGatewayOptions {
     dockerCommand?: string;
     execFile?: DockerProbeExecFile;
     inspection: DockerUnitInspection;
+    /** Overrides Node's 1 MiB `execFile` default `maxBuffer`. Defaults to
+     * {@link DEFAULT_DOCKER_PROBE_MAX_BUFFER_BYTES}. */
+    maxBufferBytes?: number;
     timeoutMs?: number;
 }
 export declare const createDockerProbeGateway: (record: DeploymentRecord, unit: DeploymentRecord["units"][number], options: DockerProbeGatewayOptions) => RuntimeProbeGateway;