spawnfile 0.1.13 → 0.1.17

package/dist/runtime/daimon/memory.d.ts

@@ -0,0 +1,57 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+import type { CapabilityReport } from "../../report/index.js";
+/**
+ * The instance root every Daimon agent's `workspacePath` and `runtimeHomePath`
+ * resolve under (`resolveInstancePaths` in
+ * `src/compiler/containerTargetPlanResolution.ts`). Daimon's own parser rejects
+ * a `memory.runtimeHomePath` that overlaps either of those, so a declared store
+ * inside this subtree must fail at compile time with a Spawnfile message rather
+ * than as an opaque container-side config parse error.
+ *
+ * Restating the literal here is deliberate — importing the compiler's path
+ * builder into a runtime adapter would invert the dependency direction — so it
+ * is pinned to that authority by `config.test.ts`'s "pins the instance-root
+ * guard to resolveInstancePaths" case, which derives the expected value from
+ * `resolveInstancePaths` and fails if either side drifts.
+ */
+export declare const DAIMON_INSTANCE_STATE_ROOT = "/var/lib/spawnfile/instances";
+export declare const resolveDaimonAgentMemory: (node: ResolvedAgentNode) => {
+    runtimeHomePath: string;
+    source: string;
+} | undefined;
+/**
+ * The compile-time warning for an agent that declared several memory banks.
+ *
+ * `selectDaimonMemoryAccess` is deterministic (lexicographically first key),
+ * and the capability row already reports the outcome as `degraded` — but a
+ * capability row does not say *which* bank won. Declaring a new bank whose key
+ * sorts earlier silently re-points this agent's memory home and orphans the
+ * previously wired bank's data, so the wired and ignored ids are named here,
+ * in the diagnostics an operator reads on every compile. The selection rule
+ * itself is unchanged.
+ */
+export declare const daimonMemorySelectionWarning: (node: ResolvedAgentNode) => string | undefined;
+/**
+ * The compile-time warning for a wired memory bank that asked for vector
+ * recall the Daimon organization runtime cannot provide.
+ *
+ * The memory block Spawnfile lowers into the organization runtime config is
+ * `{runtimeHomePath, source?, tokenBudget?}` and nothing more (see
+ * `resolveDaimonAgentMemory` above and the `memory` schema in daimon's
+ * `organizationRuntimeContract.ts`). Daimon's CLI harness path forwards exactly
+ * those three fields and never sets `memory.embeddingProvider`, so Mneme builds
+ * a lexical-only recall path. Embeddings are optional in Mneme and it falls back
+ * safely, so a fixture declaring `index.vector.enabled: true` still compiles and
+ * still recalls — just not the way it asked to. That silence is the defect: the
+ * declaration is accepted verbatim and quietly means something else.
+ *
+ * This says so at compile time rather than forwarding the configuration,
+ * because forwarding it would mean widening the daimon organization runtime
+ * config contract (and its digest-pinned manifest) plus building an embedding
+ * provider on the daimon side — a much larger change than telling the truth.
+ */
+export declare const daimonMemoryVectorRecallWarning: (node: ResolvedAgentNode) => string | undefined;
+export declare const daimonMemoryCapabilityFor: (node: ResolvedAgentNode) => {
+    memoryMessage?: string;
+    memoryOutcome?: CapabilityReport["outcome"];
+};

package/dist/runtime/daimon/memory.js

@@ -0,0 +1,125 @@
+import { resolveMnemeDurableMemoryMountPath } from "../mnemeMcp.js";
+import { SpawnfileError } from "../../shared/index.js";
+/**
+ * Daimon's organization runtime accepts exactly one `memory` block per agent
+ * (`OrganizationRuntimeMemory` = `{ runtimeHomePath, source?, tokenBudget? }`),
+ * so lowering picks one declared bank deterministically, the same way the
+ * legacy generated-Pi emitter does in `../pi/appAgentConfig.ts`.
+ */
+const memoryAccessKey = (access) => `${access.source}:${access.bank.id}`;
+const selectDaimonMemoryAccess = (node) => [...(node.memoryAccess ?? [])].sort((left, right) => memoryAccessKey(left).localeCompare(memoryAccessKey(right)))[0];
+/**
+ * The instance root every Daimon agent's `workspacePath` and `runtimeHomePath`
+ * resolve under (`resolveInstancePaths` in
+ * `src/compiler/containerTargetPlanResolution.ts`). Daimon's own parser rejects
+ * a `memory.runtimeHomePath` that overlaps either of those, so a declared store
+ * inside this subtree must fail at compile time with a Spawnfile message rather
+ * than as an opaque container-side config parse error.
+ *
+ * Restating the literal here is deliberate — importing the compiler's path
+ * builder into a runtime adapter would invert the dependency direction — so it
+ * is pinned to that authority by `config.test.ts`'s "pins the instance-root
+ * guard to resolveInstancePaths" case, which derives the expected value from
+ * `resolveInstancePaths` and fails if either side drifts.
+ */
+export const DAIMON_INSTANCE_STATE_ROOT = "/var/lib/spawnfile/instances";
+export const resolveDaimonAgentMemory = (node) => {
+    const access = selectDaimonMemoryAccess(node);
+    if (!access)
+        return undefined;
+    const runtimeHomePath = resolveMnemeDurableMemoryMountPath(access.bank);
+    if (runtimeHomePath === null)
+        return undefined;
+    if (runtimeHomePath === DAIMON_INSTANCE_STATE_ROOT ||
+        runtimeHomePath.startsWith(`${DAIMON_INSTANCE_STATE_ROOT}/`) ||
+        DAIMON_INSTANCE_STATE_ROOT.startsWith(`${runtimeHomePath}/`)) {
+        throw new SpawnfileError("validation_error", `Daimon memory bank ${access.bank.id} resolves to ${runtimeHomePath}, which overlaps the Daimon instance state root ${DAIMON_INSTANCE_STATE_ROOT}; declare the store outside it`);
+    }
+    return {
+        runtimeHomePath,
+        source: `spawnfile:${access.declaringKind}:${access.bank.id}`
+    };
+};
+/**
+ * The compile-time warning for an agent that declared several memory banks.
+ *
+ * `selectDaimonMemoryAccess` is deterministic (lexicographically first key),
+ * and the capability row already reports the outcome as `degraded` — but a
+ * capability row does not say *which* bank won. Declaring a new bank whose key
+ * sorts earlier silently re-points this agent's memory home and orphans the
+ * previously wired bank's data, so the wired and ignored ids are named here,
+ * in the diagnostics an operator reads on every compile. The selection rule
+ * itself is unchanged.
+ */
+export const daimonMemorySelectionWarning = (node) => {
+    const accesses = node.memoryAccess ?? [];
+    const selected = selectDaimonMemoryAccess(node);
+    if (!selected)
+        return undefined;
+    const selectedKey = memoryAccessKey(selected);
+    const ignored = [...new Set(accesses
+            .filter((access) => memoryAccessKey(access) !== selectedKey)
+            .map((access) => access.bank.id))].sort();
+    if (ignored.length === 0)
+        return undefined;
+    return `Daimon organization runtime v1 lowers one memory bank per agent: ${node.name} wires memory bank ${selected.bank.id} and ignores ${ignored.join(", ")}. The wired bank is the lexicographically first declared one, so adding a bank that sorts earlier re-points this agent's memory home and orphans ${selected.bank.id}'s data.`;
+};
+/**
+ * The compile-time warning for a wired memory bank that asked for vector
+ * recall the Daimon organization runtime cannot provide.
+ *
+ * The memory block Spawnfile lowers into the organization runtime config is
+ * `{runtimeHomePath, source?, tokenBudget?}` and nothing more (see
+ * `resolveDaimonAgentMemory` above and the `memory` schema in daimon's
+ * `organizationRuntimeContract.ts`). Daimon's CLI harness path forwards exactly
+ * those three fields and never sets `memory.embeddingProvider`, so Mneme builds
+ * a lexical-only recall path. Embeddings are optional in Mneme and it falls back
+ * safely, so a fixture declaring `index.vector.enabled: true` still compiles and
+ * still recalls — just not the way it asked to. That silence is the defect: the
+ * declaration is accepted verbatim and quietly means something else.
+ *
+ * This says so at compile time rather than forwarding the configuration,
+ * because forwarding it would mean widening the daimon organization runtime
+ * config contract (and its digest-pinned manifest) plus building an embedding
+ * provider on the daimon side — a much larger change than telling the truth.
+ */
+export const daimonMemoryVectorRecallWarning = (node) => {
+    const access = selectDaimonMemoryAccess(node);
+    if (!access || !resolveDaimonAgentMemory(node))
+        return undefined;
+    const vector = access.bank.index?.vector;
+    if (!vector?.enabled)
+        return undefined;
+    return `Daimon organization runtime v1 has no vector recall: memory bank ${access.bank.id} declares `
+        + `index.vector.enabled with model ${vector.model ?? "(unset)"}, but the runtime memory contract carries `
+        + "no embedding configuration, so recall for this agent is lexical only. Declare index.vector on a "
+        + "runtime that lowers it, or drop it from this bank so the declaration matches the behavior.";
+};
+export const daimonMemoryCapabilityFor = (node) => {
+    const access = selectDaimonMemoryAccess(node);
+    if (!access)
+        return {};
+    const memory = resolveDaimonAgentMemory(node);
+    if (!memory) {
+        return {
+            memoryMessage: `Daimon organization runtime v1 lowers only durably mounted file-backed Mneme banks; memory bank ${access.bank.id} (store ${access.bank.store.kind}) has no durable container volume, so no memory block is emitted`,
+            memoryOutcome: "degraded"
+        };
+    }
+    const declaredKeys = new Set((node.memoryAccess ?? []).map(memoryAccessKey));
+    declaredKeys.delete(memoryAccessKey(access));
+    if (declaredKeys.size > 0) {
+        return {
+            memoryMessage: `Daimon organization runtime v1 lowers one memory bank per agent; ${access.bank.id} is wired at ${memory.runtimeHomePath} and ${declaredKeys.size} further declared bank(s) are not lowered`,
+            memoryOutcome: "degraded"
+        };
+    }
+    const vectorWarning = daimonMemoryVectorRecallWarning(node);
+    if (vectorWarning) {
+        return { memoryMessage: vectorWarning, memoryOutcome: "degraded" };
+    }
+    return {
+        memoryMessage: `Daimon lowers Mneme memory bank ${access.bank.id} into the organization runtime agent config at ${memory.runtimeHomePath}`,
+        memoryOutcome: "supported"
+    };
+};

package/dist/runtime/daimon/runAuth.d.ts

@@ -0,0 +1,51 @@
+import type { ResolvedAuthProfile } from "../../auth/index.js";
+import type { RuntimeAuthPreparationInput, RuntimeAuthPreparationResult } from "../types.js";
+export declare const DAIMON_GROK_ACCESS_TOKEN_MIN_BYTES = 32;
+export declare const DAIMON_GROK_REFRESH_TOKEN_MIN_BYTES = 16;
+export declare const DAIMON_AGY_UNLOCK_SOURCE_ENV = "SPAWNFILE_DAIMON_SOURCE_AGY_UNLOCK_SECRET";
+export declare const daimonSourceEnvironmentName: (slot: string) => string;
+export declare const daimonSourcePathForEngine: (engine: "codex" | "grok", environment?: Record<string, string | undefined>, authProfile?: ResolvedAuthProfile | null) => string;
+/**
+ * The uid a bind-mounted Daimon credential must be owned by on the host.
+ *
+ * Daimon compares the file's owner against its own `process.getuid()` inside
+ * the container, the container runs as {@link DAIMON_ORGANIZATION_UID}, and a
+ * read-only bind mount carries the host uid through unchanged, so the two are
+ * the same number. See `runtimeIdentity.ts` for the full chain.
+ */
+export declare const DAIMON_CREDENTIAL_CONTAINER_UID = 2000;
+export interface DaimonSourceFileFacts {
+    isFile: boolean;
+    isSymbolicLink: boolean;
+    mode: number;
+    nlink: number;
+    size: number;
+    uid: number;
+}
+/**
+ * The host-side safety gate, isolated from `lstat` so every branch is directly
+ * exercisable. A credential the deploying process does not own is material it
+ * cannot vouch for, and a root deploy (`callerUid <= 0`) is refused outright
+ * so a privileged process never launders someone else's credential into a
+ * container.
+ */
+export declare const isUnsafeDaimonSourceFile: (entry: DaimonSourceFileFacts, callerUid: number | undefined, maxBytes: number) => boolean;
+/**
+ * Refuses, at deploy time, a credential whose owner is not the uid the
+ * container will demand.
+ *
+ * Without this the host gate above and Daimon's in-container gate impose two
+ * uncoordinated uid requirements on the same file: the host one passes for any
+ * non-root deploying account, and the container one then fails at readiness
+ * with an opaque "credential materialization failed" inside a candidate that
+ * lives ~15 seconds. Naming both numbers here turns that into a refusal the
+ * operator can act on.
+ */
+export declare const assertDaimonCredentialContainerOwner: (observedUid: number, label: string, requiredUid?: number) => void;
+export declare const assertSafeDaimonSourceFile: (sourcePath: string, label: string, maxBytes?: number, portableKind?: "codex" | "grok") => Promise<number>;
+/**
+ * Binds Codex leaves per agent and one Grok bootstrap leaf per organization.
+ * Every leaf is validated from a stable descriptor and mounted read-only;
+ * Daimon alone owns writable credential state and refresh reconciliation.
+ */
+export declare const prepareDaimonRuntimeAuth: (input: RuntimeAuthPreparationInput) => Promise<RuntimeAuthPreparationResult>;

package/dist/runtime/daimon/runAuth.js

@@ -0,0 +1,279 @@
+import os from "node:os";
+import path from "node:path";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, readFile } from "node:fs/promises";
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, assertDaimonRuntimeHome, DAIMON_ENGINE_CREDENTIALS, DAIMON_ENGINE_KINDS, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_ORGANIZATION_RUNTIME_CONFIG_VERSIONS } from "./contractManifest.js";
+import { DAIMON_ORGANIZATION_UID } from "./runtimeIdentity.js";
+const MAX_OPAQUE_CREDENTIAL_BYTES = 64 * 1024;
+export const DAIMON_GROK_ACCESS_TOKEN_MIN_BYTES = 32;
+export const DAIMON_GROK_REFRESH_TOKEN_MIN_BYTES = 16;
+export const DAIMON_AGY_UNLOCK_SOURCE_ENV = "SPAWNFILE_DAIMON_SOURCE_AGY_UNLOCK_SECRET";
+const fail = (message) => {
+    throw new SpawnfileError("validation_error", `Daimon runtime auth ${message}`);
+};
+export const daimonSourceEnvironmentName = (slot) => `SPAWNFILE_DAIMON_SOURCE_${slot.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase()}`;
+export const daimonSourcePathForEngine = (engine, environment = process.env, authProfile = null) => {
+    const declaredSource = environment[daimonSourceEnvironmentName(engine === "grok"
+        ? DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapSourceSlot
+        : DAIMON_ENGINE_CREDENTIALS.codex.sourceSlot)]?.trim();
+    if (declaredSource)
+        return declaredSource;
+    if (engine === "codex" && authProfile) {
+        const imported = authProfile.imports.codex;
+        return path.join(imported?.path ?? fail("selected auth profile has no imported codex credential"), "auth.json");
+    }
+    const home = os.homedir();
+    switch (engine) {
+        case "codex":
+            return path.join(process.env.CODEX_HOME || path.join(home, ".codex"), "auth.json");
+        case "grok":
+            return path.join(process.env.GROK_HOME || path.join(home, ".grok"), "auth.json");
+    }
+};
+const sourceFileIdentity = (entry) => [entry.dev, entry.ino, entry.size, entry.mtimeMs, entry.uid, entry.mode, entry.nlink].join(":");
+/**
+ * The uid a bind-mounted Daimon credential must be owned by on the host.
+ *
+ * Daimon compares the file's owner against its own `process.getuid()` inside
+ * the container, the container runs as {@link DAIMON_ORGANIZATION_UID}, and a
+ * read-only bind mount carries the host uid through unchanged, so the two are
+ * the same number. See `runtimeIdentity.ts` for the full chain.
+ */
+export const DAIMON_CREDENTIAL_CONTAINER_UID = DAIMON_ORGANIZATION_UID;
+/**
+ * The host-side safety gate, isolated from `lstat` so every branch is directly
+ * exercisable. A credential the deploying process does not own is material it
+ * cannot vouch for, and a root deploy (`callerUid <= 0`) is refused outright
+ * so a privileged process never launders someone else's credential into a
+ * container.
+ */
+export const isUnsafeDaimonSourceFile = (entry, callerUid, maxBytes) => !entry.isFile ||
+    entry.isSymbolicLink ||
+    entry.size === 0 ||
+    entry.size > maxBytes ||
+    entry.nlink !== 1 ||
+    (entry.mode & 0o777) !== 0o600 ||
+    typeof callerUid !== "number" ||
+    callerUid <= 0 ||
+    entry.uid !== callerUid;
+/**
+ * Refuses, at deploy time, a credential whose owner is not the uid the
+ * container will demand.
+ *
+ * Without this the host gate above and Daimon's in-container gate impose two
+ * uncoordinated uid requirements on the same file: the host one passes for any
+ * non-root deploying account, and the container one then fails at readiness
+ * with an opaque "credential materialization failed" inside a candidate that
+ * lives ~15 seconds. Naming both numbers here turns that into a refusal the
+ * operator can act on.
+ */
+export const assertDaimonCredentialContainerOwner = (observedUid, label, requiredUid = DAIMON_CREDENTIAL_CONTAINER_UID) => {
+    if (observedUid === requiredUid)
+        return;
+    fail(`selected ${label} artifact is owned by uid ${observedUid} but the Daimon container reads it as uid ` +
+        `${requiredUid}; the credential is bind-mounted read-only and keeps its host owner, so deploy from an ` +
+        `account whose uid is exactly ${requiredUid} (for example \`usermod -u ${requiredUid} <deploy-user>\` ` +
+        `followed by \`chown -R ${requiredUid} <deploy-home>\`) instead of uid ${observedUid}`);
+};
+export const assertSafeDaimonSourceFile = async (sourcePath, label, maxBytes = MAX_OPAQUE_CREDENTIAL_BYTES, portableKind) => {
+    let entry;
+    try {
+        entry = await lstat(sourcePath);
+    }
+    catch {
+        return fail(`is missing the selected ${label} artifact`);
+    }
+    const callerUid = process.getuid?.();
+    if (isUnsafeDaimonSourceFile({
+        isFile: entry.isFile(),
+        isSymbolicLink: entry.isSymbolicLink(),
+        mode: entry.mode,
+        nlink: entry.nlink,
+        size: entry.size,
+        uid: entry.uid
+    }, callerUid, maxBytes) || typeof callerUid !== "number") {
+        return fail(`selected ${label} artifact must be one bounded caller-owned 0600 regular file`);
+    }
+    if (portableKind !== undefined) {
+        let handle;
+        let bytes;
+        try {
+            handle = await open(sourcePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = await handle.stat();
+            if (sourceFileIdentity(opened) !== sourceFileIdentity(entry)) {
+                return fail(`selected ${label} artifact changed during validation`);
+            }
+            bytes = await handle.readFile();
+            const after = await handle.stat();
+            if (sourceFileIdentity(after) !== sourceFileIdentity(opened)) {
+                return fail(`selected ${label} artifact changed during validation`);
+            }
+            if (!hasRefreshableCredential(portableKind, bytes)) {
+                return fail(`selected ${label} artifact is not a refreshable subscription credential`);
+            }
+        }
+        catch (error) {
+            if (error instanceof SpawnfileError)
+                throw error;
+            return fail(`selected ${label} artifact could not be validated`);
+        }
+        finally {
+            bytes?.fill(0);
+            await handle?.close().catch(() => undefined);
+        }
+    }
+    return callerUid;
+};
+const hasRefreshableCredential = (kind, bytes) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const root = parsed;
+    const source = kind === "codex"
+        ? ((root.tokens && typeof root.tokens === "object" && !Array.isArray(root.tokens)) ? root.tokens : root)
+        : Object.entries(root).find(([key, value]) => /^https:\/\/auth\.x\.ai::/u.test(key) && value && typeof value === "object" && !Array.isArray(value))?.[1];
+    if (!source)
+        return false;
+    const access = kind === "grok" ? source.key : source.access_token ?? source.accessToken ?? source.token;
+    const refresh = kind === "grok" ? source.refresh_token : source.refresh_token ?? source.refreshToken;
+    if (typeof access !== "string" || !access.trim() || typeof refresh !== "string" || !refresh.trim())
+        return false;
+    if (kind === "grok" && (access.length < DAIMON_GROK_ACCESS_TOKEN_MIN_BYTES
+        || refresh.length < DAIMON_GROK_REFRESH_TOKEN_MIN_BYTES))
+        return false;
+    return kind !== "grok" || (typeof source.expires_at === "string" && Number.isFinite(Date.parse(source.expires_at)));
+};
+const assertContainedPath = (root, candidate) => {
+    const normalizedRoot = path.resolve(root);
+    const normalizedCandidate = path.resolve(candidate);
+    const relative = path.relative(normalizedRoot, normalizedCandidate);
+    if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return fail("attempted to stage outside its ephemeral support root");
+    }
+    return normalizedCandidate;
+};
+const configPathInOutput = (input) => {
+    if (!input.instance.config_path.startsWith("/"))
+        fail("has a non-absolute generated config path");
+    return assertContainedPath(path.join(input.outputDirectory, "container", "rootfs"), path.join(input.outputDirectory, "container", "rootfs", `.${input.instance.config_path}`));
+};
+const parseConfigAgents = (source) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        return fail("generated organization config is not JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        fail("generated organization config has an invalid shape");
+    const root = parsed;
+    if (!DAIMON_ORGANIZATION_RUNTIME_CONFIG_VERSIONS.includes(root.version) || !Array.isArray(root.agents))
+        fail("generated organization config is not a supported v1/v2 contract");
+    const rawAgents = root.agents;
+    const seenHomes = new Set();
+    const agents = [];
+    for (const value of rawAgents) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            fail("generated organization config has an invalid agent");
+        const agent = value;
+        const engine = agent.engine;
+        const engineKind = engine && typeof engine === "object" && !Array.isArray(engine)
+            ? engine.kind
+            : undefined;
+        if (typeof agent.id !== "string" || !agent.id || typeof agent.runtimeHomePath !== "string"
+            || typeof engineKind !== "string"
+            || !DAIMON_ENGINE_KINDS.includes(engineKind)) {
+            fail("generated organization config has an invalid agent credential target");
+        }
+        const agentId = agent.id;
+        const runtimeHomePath = assertDaimonRuntimeHome(agent.runtimeHomePath);
+        if (seenHomes.has(runtimeHomePath))
+            fail("generated organization config has overlapping runtime homes");
+        seenHomes.add(runtimeHomePath);
+        agents.push({
+            engine: { kind: engineKind },
+            id: agentId,
+            runtimeHomePath
+        });
+    }
+    return agents.sort((left, right) => left.id.localeCompare(right.id));
+};
+const resolveCredentialSource = (agent, authProfile) => daimonSourcePathForEngine(agent.engine.kind, process.env, authProfile);
+const prepareNeutralIngress = async (outputDirectory, agent) => {
+    const rootfs = path.join(outputDirectory, "container", "rootfs");
+    const runtimeHome = assertContainedPath(rootfs, path.join(rootfs, `.${agent.runtimeHomePath}`));
+    const inbound = assertContainedPath(runtimeHome, path.join(runtimeHome, path.posix.dirname(DAIMON_ENGINE_CREDENTIALS[agent.engine.kind].sourceRelativePath)));
+    await mkdir(runtimeHome, { mode: 0o700, recursive: true });
+    await chmod(runtimeHome, 0o700);
+    await mkdir(inbound, { mode: 0o700, recursive: true });
+    await chmod(inbound, 0o700);
+    return path.posix.join(agent.runtimeHomePath, DAIMON_ENGINE_CREDENTIALS[agent.engine.kind].sourceRelativePath);
+};
+/**
+ * Binds Codex leaves per agent and one Grok bootstrap leaf per organization.
+ * Every leaf is validated from a stable descriptor and mounted read-only;
+ * Daimon alone owns writable credential state and refresh reconciliation.
+ */
+export const prepareDaimonRuntimeAuth = async (input) => {
+    const containerCredentialUid = input.containerCredentialUid ?? DAIMON_CREDENTIAL_CONTAINER_UID;
+    const allowedSourceEnvironments = new Set([
+        ...Object.values(DAIMON_ENGINE_CREDENTIALS).map((credential) => daimonSourceEnvironmentName(credential.sourceSlot)),
+        daimonSourceEnvironmentName(DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapSourceSlot),
+        DAIMON_AGY_UNLOCK_SOURCE_ENV
+    ]);
+    for (const name of Object.keys(process.env)) {
+        if (name.startsWith("SPAWNFILE_DAIMON_SOURCE_") && !allowedSourceEnvironments.has(name)) {
+            return fail(`source slot environment ${name} is not declared by the consumed manifest`);
+        }
+    }
+    const configPath = configPathInOutput(input);
+    let configSource;
+    try {
+        configSource = await readFile(configPath, "utf8");
+    }
+    catch {
+        return fail("could not read its generated organization config");
+    }
+    const agents = parseConfigAgents(configSource);
+    const mountArgs = [];
+    for (const agent of agents) {
+        if (agent.engine.kind !== "codex")
+            continue;
+        const portableAgent = agent;
+        const sourcePath = resolveCredentialSource(portableAgent, input.authProfile);
+        const ingressPath = await prepareNeutralIngress(input.outputDirectory, portableAgent);
+        const ownerUid = await assertSafeDaimonSourceFile(sourcePath, agent.engine.kind, MAX_OPAQUE_CREDENTIAL_BYTES, "codex");
+        assertDaimonCredentialContainerOwner(ownerUid, agent.engine.kind, containerCredentialUid);
+        mountArgs.push("-v", `${sourcePath}:${ingressPath}:ro`);
+    }
+    // No container-owner assertion for the Grok bootstrap leaf: unlike the Codex
+    // credential and the AGY unlock secret, nothing in the organization runtime
+    // process reads it. The live Grok path goes through the engine broker, which
+    // runs under its own uid and reads only its durable realm, so pinning this
+    // leaf to the organization uid would refuse deployments that work today.
+    if (agents.some((agent) => agent.engine.kind === "grok")) {
+        const sourcePath = daimonSourcePathForEngine("grok");
+        await assertSafeDaimonSourceFile(sourcePath, "grok", DAIMON_GROK_SUBSCRIPTION_REALM.maxCredentialBytes, "grok");
+        mountArgs.push("-v", `${sourcePath}:${DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath}:ro`);
+    }
+    if (agents.some((agent) => agent.engine.kind === "agy")) {
+        const source = process.env[DAIMON_AGY_UNLOCK_SOURCE_ENV]?.trim();
+        if (!source)
+            return fail("is missing the operator-authorized AGY realm unlock artifact");
+        const ownerUid = await assertSafeDaimonSourceFile(source, "AGY realm unlock", DAIMON_AGY_SUBSCRIPTION_REALM.maxUnlockBytes);
+        assertDaimonCredentialContainerOwner(ownerUid, "AGY realm unlock", containerCredentialUid);
+        mountArgs.push("-v", `${source}:${DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath}:ro`);
+    }
+    return {
+        coveredModelSecrets: [],
+        mountArgs
+    };
+};

package/dist/runtime/daimon/runtimeIdentity.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The fixed container-side uids a compiled Daimon image runs under.
+ *
+ * These are compiler-wide constants, not per-organization values: the rendered
+ * Daimon entrypoint pins `uid=DAIMON_ORGANIZATION_UID` and drops to it through
+ * `setpriv --reuid`, so every organization's Daimon runtime process shares the
+ * same uid. The engine broker and its Grok workers run under their own fixed
+ * uids alongside it.
+ *
+ * Why the deploy path cares: Daimon's own credential guards compare a
+ * credential file's owner against `process.getuid()` *inside* the container
+ * (`portableCredentialMaterial.ts` for Codex, `agySubscriptionRealm.ts` for the
+ * AGY unlock secret). Spawnfile bind-mounts those files read-only from the
+ * host, the daemon applies no user-namespace remapping, and the credential
+ * leaves are declared opaque so the entrypoint ownership guard never chowns
+ * them. A host file therefore keeps its host uid inside the container, which
+ * makes "owned by DAIMON_ORGANIZATION_UID" a host-side deployment requirement
+ * rather than something the container can repair.
+ */
+export declare const DAIMON_ORGANIZATION_UID = 2000;
+export declare const DAIMON_BROKER_UID = 2100;
+export declare const DAIMON_FIRST_WORKER_UID = 2200;

package/dist/runtime/daimon/runtimeIdentity.js

@@ -0,0 +1,22 @@
+/**
+ * The fixed container-side uids a compiled Daimon image runs under.
+ *
+ * These are compiler-wide constants, not per-organization values: the rendered
+ * Daimon entrypoint pins `uid=DAIMON_ORGANIZATION_UID` and drops to it through
+ * `setpriv --reuid`, so every organization's Daimon runtime process shares the
+ * same uid. The engine broker and its Grok workers run under their own fixed
+ * uids alongside it.
+ *
+ * Why the deploy path cares: Daimon's own credential guards compare a
+ * credential file's owner against `process.getuid()` *inside* the container
+ * (`portableCredentialMaterial.ts` for Codex, `agySubscriptionRealm.ts` for the
+ * AGY unlock secret). Spawnfile bind-mounts those files read-only from the
+ * host, the daemon applies no user-namespace remapping, and the credential
+ * leaves are declared opaque so the entrypoint ownership guard never chowns
+ * them. A host file therefore keeps its host uid inside the container, which
+ * makes "owned by DAIMON_ORGANIZATION_UID" a host-side deployment requirement
+ * rather than something the container can repair.
+ */
+export const DAIMON_ORGANIZATION_UID = 2_000;
+export const DAIMON_BROKER_UID = 2_100;
+export const DAIMON_FIRST_WORKER_UID = 2_200;

package/dist/runtime/daimon/scheduleAuthority.d.ts

@@ -0,0 +1,3 @@
+export declare const hasDaimonScheduleAuthority: () => Promise<boolean>;
+/** Schedule lowering is allowed only when the selected image receipt binds v2. */
+export declare const assertDaimonScheduleAuthority: () => Promise<void>;

package/dist/runtime/daimon/scheduleAuthority.js

@@ -0,0 +1,17 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "../localDaimonAuthority.js";
+import { DAIMON_CONTRACT_MANIFEST_SHA256 } from "./contractManifest.js";
+export const hasDaimonScheduleAuthority = async () => {
+    const identityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    if (!identityPath)
+        return false;
+    return (await loadLocalDaimonRuntimeIdentity(identityPath)).manifestSha256 ===
+        DAIMON_CONTRACT_MANIFEST_SHA256;
+};
+/** Schedule lowering is allowed only when the selected image receipt binds v2. */
+export const assertDaimonScheduleAuthority = async () => {
+    // The checked-in v0.2.0 production pin attests v1 only.
+    if (!await hasDaimonScheduleAuthority()) {
+        throw new SpawnfileError("runtime_error", "Daimon schedules are disabled: the selected image capability receipt does not attest organization runtime v2");
+    }
+};

package/dist/runtime/index.d.ts

@@ -1,5 +1,11 @@
+export * from "./common.js";
 export * from "./container.js";
+export * from "./containerPackageOverrides.js";
 export * from "./install.js";
+export * from "./localDaimonAuthority.js";
 export * from "./registry.js";
 export * from "./statusProbes.js";
 export * from "./types.js";
+export * from "./usageLedger.js";
+export * from "./usageLedgerRead.js";
+export * from "./usageRequestLedger.js";

package/dist/runtime/index.js

@@ -1,5 +1,11 @@
+export * from "./common.js";
 export * from "./container.js";
+export * from "./containerPackageOverrides.js";
 export * from "./install.js";
+export * from "./localDaimonAuthority.js";
 export * from "./registry.js";
 export * from "./statusProbes.js";
 export * from "./types.js";
+export * from "./usageLedger.js";
+export * from "./usageLedgerRead.js";
+export * from "./usageRequestLedger.js";

package/dist/runtime/install.d.ts

@@ -1,5 +1,8 @@
 export type RuntimeInstallSelection = {
     ecosystem: "go" | "node";
+    capabilityReceipt?: string;
+    contractManifestSha256?: string;
+    digest?: string;
     image: string;
     installHint: string;
     kind: "container_image";

package/dist/runtime/install.js

@@ -104,6 +104,9 @@ export const resolveRuntimeInstallSelection = async (runtimeName) => {
         case "container_image":
             return {
                 ecosystem: installProfile.container_image.ecosystem,
+                capabilityReceipt: runtime.install.capabilityReceipt,
+                contractManifestSha256: runtime.install.contractManifestSha256,
+                digest: runtime.install.digest,
                 image: runtime.install.image,
                 installHint: installProfile.container_image.installHint,
                 kind: "container_image",

package/dist/runtime/localDaimonAuthority.d.ts

@@ -0,0 +1,11 @@
+export declare const DAIMON_LOCAL_RUNTIME_IDENTITY_ENV = "SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY";
+export interface LocalDaimonRuntimeIdentity {
+    capabilityReceipt: string;
+    imageArchitecture: "amd64" | "arm64";
+    imageConfigDigest: string;
+    imageManifestDigest: string;
+    imageReference: string;
+    manifestSha256: string;
+    registryAuthority: string;
+}
+export declare const loadLocalDaimonRuntimeIdentity: (identityPath: string) => Promise<LocalDaimonRuntimeIdentity>;