spawnfile 0.1.14 → 0.1.17

package/dist/compiler/organizationIdentityGraph.js

@@ -0,0 +1,115 @@
+import { SpawnfileError } from "../shared/index.js";
+export const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
+export const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
+export const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
+export const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
+export const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
+export const MAX_EXTERNAL_PARTICIPANTS = 32;
+const segment = new RegExp(ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, "u");
+export const organizationIdentityFail = (message) => {
+    throw new SpawnfileError("validation_error", message);
+};
+export const requiredOrganizationIdentity = (value, message) => value == null ? organizationIdentityFail(message) : value;
+export const assertOrganizationSegment = (value, label) => {
+    if (!segment.test(value)) {
+        organizationIdentityFail(`${label} must match ${ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE}`);
+    }
+};
+export const freezeOrganizationIdentity = (value) => {
+    if (value && typeof value === "object") {
+        Object.freeze(value);
+        for (const child of Object.values(value)) {
+            freezeOrganizationIdentity(child);
+        }
+    }
+    return value;
+};
+export const compareOrganizationIds = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+export const exactOrganizationStrings = (actual, expected) => actual?.length === expected.length
+    && actual.every((value, index) => value === expected[index]);
+const teamNodes = (plan) => new Map(plan.nodes.filter((node) => node.kind === "team")
+    .map((node) => [node.value.source, node.value]));
+export const rootOrganizationTeam = (plan) => {
+    const node = plan.nodes.find((entry) => entry.id === plan.root || entry.value.source === plan.root);
+    return node?.value.kind === "team" ? node.value : undefined;
+};
+export const organizationAgentPaths = (plan) => {
+    const teams = teamNodes(plan);
+    const edges = plan.edges.filter((edge) => edge.kind === "team_member");
+    const paths = new Map();
+    const teamPaths = new Map();
+    const visitedNodeIds = new Set();
+    // External-participant authority needs one unambiguous path per principal.
+    // Ordinary organizations still have a canonical identity, but retain the
+    // compiler's long-standing ability to reuse an identical agent/team ref.
+    const requireUniquePaths = (rootOrganizationTeam(plan)?.externalParticipants?.length ?? 0) > 0;
+    const walk = (source, prefix, seen) => {
+        if (seen.has(source))
+            organizationIdentityFail(`organization member graph cycle at ${source}`);
+        const team = teams.get(source);
+        if (!team)
+            return;
+        if (teamPaths.has(source)) {
+            if (requireUniquePaths) {
+                organizationIdentityFail(`team is reached through multiple organization paths: ${source}`);
+            }
+            return;
+        }
+        teamPaths.set(source, prefix);
+        const node = plan.nodes.find((entry) => entry.value.source === source);
+        if (!node || node.kind !== "team") {
+            throw new SpawnfileError("validation_error", `organization graph references missing team ${source}`);
+        }
+        visitedNodeIds.add(node.id);
+        const outgoing = edges.filter((entry) => entry.from === node.id)
+            .sort((left, right) => compareOrganizationIds(left.label, right.label));
+        const memberSlots = new Set(team.members.map((member) => member.id));
+        if (memberSlots.size !== team.members.length || outgoing.length !== team.members.length) {
+            organizationIdentityFail(`organization graph cardinality mismatch for team ${team.name}`);
+        }
+        const localSlots = new Set();
+        for (const edge of outgoing) {
+            if (localSlots.has(edge.label)) {
+                organizationIdentityFail(`duplicate organization member slot: ${edge.label}`);
+            }
+            localSlots.add(edge.label);
+            assertOrganizationSegment(edge.label, "organization member slot");
+            const next = [...prefix, edge.label];
+            if (next.length > MAX_ORGANIZATION_MEMBER_DEPTH) {
+                organizationIdentityFail("organization member depth exceeds 8");
+            }
+            const child = plan.nodes.find((candidate) => candidate.id === edge.to);
+            if (!child) {
+                throw new SpawnfileError("validation_error", `organization graph references missing node ${edge.to}`);
+            }
+            const member = team.members.find((entry) => entry.id === edge.label);
+            if (!member || member.kind !== child.kind || member.nodeSource !== child.value.source) {
+                organizationIdentityFail(`organization graph member edge mismatch: ${edge.label}`);
+            }
+            if (child.kind === "agent") {
+                if (paths.has(child.value.source) && requireUniquePaths) {
+                    organizationIdentityFail(`agent source is reached through multiple organization paths: ${child.value.source}`);
+                }
+                const prior = paths.get(child.value.source);
+                if (!prior || compareOrganizationIds(next.join("."), prior.join(".")) < 0) {
+                    paths.set(child.value.source, next);
+                }
+                visitedNodeIds.add(child.id);
+            }
+            else {
+                walk(child.value.source, next, new Set([...seen, source]));
+            }
+        }
+    };
+    walk(plan.root, [], new Set());
+    const rootNode = plan.nodes.find((node) => node.value.source === plan.root);
+    const organizationNodeIds = new Set(rootNode ? [rootNode.id] : []);
+    for (const edge of edges) {
+        organizationNodeIds.add(edge.from);
+        organizationNodeIds.add(edge.to);
+    }
+    const extra = plan.nodes.find((node) => organizationNodeIds.has(node.id) && !visitedNodeIds.has(node.id));
+    if (extra)
+        organizationIdentityFail(`unreachable organization graph node: ${extra.id}`);
+    return paths;
+};

package/dist/compiler/organizationReadyEvidence.d.ts

@@ -22,6 +22,13 @@ export interface OrganizationReadinessEvidence {
             readonly nodeId: string;
         }[];
     } | null;
+    readonly daimon?: {
+        readonly receiptPath: string;
+        readonly agents: readonly {
+            readonly agentId: string;
+            readonly engine: string;
+        }[];
+    } | null;
     readonly networks: readonly {
         readonly id: string;
         readonly mode: "external" | "managed";
@@ -34,6 +41,7 @@ export interface OrganizationReadinessEvidence {
             readonly nodeId: string;
             readonly memberId: string;
             readonly configPath: string;
+            readonly receiptPath: string;
             readonly sha256: string;
         }[];
     }[];

package/dist/compiler/organizationReadyEvidence.js

@@ -96,6 +96,17 @@ const assertMemberId = (value, label) => {
     if (!MEMBER_ID.test(value))
         fail(`${label} is unbounded or noncanonical`);
 };
+const assertMoltnetRoomMemberId = (value, label) => {
+    if (MEMBER_ID.test(value))
+        return;
+    const separator = value.indexOf(":");
+    const networkId = value.slice(0, separator);
+    const agentId = value.slice(separator + 1);
+    if (separator <= 0 || separator === value.length - 1 || value.length > 128
+        || !ID.test(networkId) || !ID.test(agentId)) {
+        fail(`${label} is unbounded or noncanonical`);
+    }
+};
 const assertConfigPath = (value) => {
     if (value.length > 255 || !CONFIG_PATH.test(value)) {
         fail(`Moltnet config path is noncanonical: ${value}`);
@@ -167,14 +178,15 @@ const validateMoltnet = (artifacts, plan) => {
         const rooms = sort(server.rooms.map((room) => {
             assertId(room.id, "Moltnet room id");
             assertUnique(room.members, (member) => member, `Moltnet room member on ${server.networkId}/${room.id}`);
-            for (const member of room.members)
-                assertMemberId(member, `Moltnet room member on ${server.networkId}/${room.id}`);
+            for (const member of room.members) {
+                assertMoltnetRoomMemberId(member, `Moltnet room member on ${server.networkId}/${room.id}`);
+            }
             return { id: room.id, members: sort(room.members, (member) => member) };
         }), (room) => room.id);
         assertUnique(rooms, (room) => room.id, `Moltnet room on ${server.networkId}`);
         const nodes = sort(nodePlans.filter((node) => node.networkId === server.networkId).map((node) => {
             const attachment = attachmentByKey.get(`${node.networkId}\u0000${node.memberId}`);
-            return { configPath: node.configPath, memberId: node.memberId, nodeId: attachment.nodeId,
+            return { configPath: node.configPath, receiptPath: `/run/spawnfile/moltnet-readiness/${node.networkId}-${node.memberId}.json`, memberId: node.memberId, nodeId: attachment.nodeId,
                 sha256: sha256(emittedConfigContent(artifacts, node.configPath)) };
         }), (node) => `${node.memberId}\u0000${node.nodeId}`);
         return { id: server.networkId, internalPort: server.mode === "managed" ? server.port : null,
@@ -248,9 +260,17 @@ export const createOrganizationReadinessEvidence = (input) => {
     const projectLabel = normalizeProjectLabelSlug(distribution.organization.project);
     if (projectLabel.length > 128 || !ID.test(projectLabel))
         fail("project label is unbounded or noncanonical");
+    const daimonInstance = input.containerArtifacts.report.runtime_instances.find((instance) => instance.runtime === "daimon");
+    const daimon = daimonInstance === undefined ? null : {
+        receiptPath: "/var/lib/spawnfile/instances/daimon/daimon-organization/state/wake-acceptance/runtime-readiness.json",
+        agents: Object.entries(daimonInstance.engine_by_node_id ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([agentId, engine]) => ({ agentId, engine }))
+    };
+    if (daimon !== null && daimon.agents.length === 0)
+        fail("Daimon readiness has no compiled agent engines");
     return freeze({
         compileFingerprint: fingerprint,
         compileVersion: input.compileVersion,
+        daimon,
         hasExternalMoltnet: networks.some((network) => network.mode === "external"),
         networks,
         organizationMembers,

package/dist/compiler/runProject.d.ts

@@ -1,8 +1,8 @@
 import { type ResolvedAuthProfile } from "../auth/index.js";
 import { type DockerTargetExecFile } from "../deployment/index.js";
 import { type CompileProjectOptions, type CompileProjectResult } from "./compileProject.js";
-import { runDockerContainer, type DockerRunInvocation, type DockerRunResult, type DockerRunRunner } from "./runProjectDocker.js";
-export { runDockerContainer };
+import { inspectDetachedContainer as recoverDetachedDockerRun, runDockerContainer, type DockerRunInvocation, type DockerRunResult, type DockerRunRunner } from "./runProjectDocker.js";
+export { recoverDetachedDockerRun, runDockerContainer };
 export type { DockerRunInvocation, DockerRunResult, DockerRunRunner };
 export interface RunProjectOptions extends CompileProjectOptions {
     authProfile?: string;
@@ -29,6 +29,8 @@ export declare const createDockerRunInvocation: (compileResult: CompileProjectRe
         name: string;
         value: string;
     };
+    /** See `RuntimeAuthPreparationInput.containerCredentialUid`. */
+    containerCredentialUid?: number;
     containerName?: string;
     detach?: boolean;
     deploymentName?: string;

package/dist/compiler/runProject.js

@@ -4,15 +4,16 @@ import { mkdtemp } from "node:fs/promises";
 import { requireAuthProfile } from "../auth/index.js";
 import { ensureDirectory, fileExists, removeDirectory, writeUtf8File } from "../filesystem/index.js";
 import { appendDockerLabelArgs, createDockerDeploymentLabels, createDockerDeploymentUnitId, createDockerProjectLabel, dockerContextNameForTarget, dockerHostValueForTarget, normalizeDeploymentName, readDeploymentRecordFromOutput, resolveDeploymentRecordPath, verifyDockerDeploymentTarget, writeDockerDeploymentRecordForRun } from "../deployment/index.js";
-import { DEFAULT_OUTPUT_DIRECTORY, SpawnfileError } from "../shared/index.js";
+import { DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, DEFAULT_OUTPUT_DIRECTORY, SpawnfileError } from "../shared/index.js";
 import { ensureNoopolisRunId, resolveNoopolisRunId } from "../runtime/index.js";
 import { compileProject } from "./compileProject.js";
 import { createDefaultImageTag, resolveDockerBuildArchitecture } from "./buildProject.js";
 import { slugify } from "./helpers.js";
-import { runDockerContainer } from "./runProjectDocker.js";
+import { resolveDaimonCodexNativeSandboxDockerSecurityOptions } from "./runProjectDaimonCodexDocker.js";
+import { inspectDetachedContainer as recoverDetachedDockerRun, runDockerContainer } from "./runProjectDocker.js";
 import { executeDockerRunWithSupportCleanup } from "./runProjectLifecycle.js";
 import { assertDeclaredModelAuthSatisfied, assertMoltnetCredentialValuesDistinct, assertRunEnvironmentSatisfied, prepareRuntimeAuthMounts, readRunEnvFile, renderDockerEnvFile, resolveAuthMountArgs, resolveRunEnvironment } from "./runProjectAuth.js";
-export { runDockerContainer };
+export { recoverDetachedDockerRun, runDockerContainer };
 const resolveImageTagRoot = (inputPath) => {
     const resolvedPath = path.resolve(inputPath);
     return path.basename(resolvedPath).toLowerCase() === "spawnfile"
@@ -36,9 +37,11 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
             ...(await readRunEnvFile(options.envFilePath)),
             ...(options.cliCredential ? { [options.cliCredential.name]: options.cliCredential.value } : {})
         });
-        const preparedRuntimeAuth = await prepareRuntimeAuthMounts(compileResult.outputDirectory, containerReport, options.authProfile ?? null, env, supportDirectory);
+        const preparedRuntimeAuth = await prepareRuntimeAuthMounts(compileResult.outputDirectory, containerReport, options.authProfile ?? null, env, supportDirectory, options.containerCredentialUid);
         assertRunEnvironmentSatisfied(containerReport, env, preparedRuntimeAuth.coveredModelSecrets);
         assertMoltnetCredentialValuesDistinct(containerReport, env);
+        const hasDaimon = containerReport.runtime_instances.some((instance) => instance.runtime === "daimon");
+        const opaqueDaimonCredentials = preparedRuntimeAuth.launchIdentity?.kind === "daimon";
         await ensureDirectory(supportDirectory);
         await writeUtf8File(envFilePath, renderDockerEnvFile(env));
         const deploymentName = options.deploymentName
@@ -53,17 +56,32 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
                 ? ["--host", options.dockerHost, "run"]
                 : ["run"];
         if (options.detach) {
-            args.push("-d");
+            args.push("-d", "--restart", "unless-stopped");
         }
         else {
             args.push("--rm");
         }
         args.push("--name", containerName);
+        if (hasDaimon) {
+            args.push(...DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, ...(await resolveDaimonCodexNativeSandboxDockerSecurityOptions(compileResult)));
+        }
         for (const port of containerReport.ports) {
             args.push("-p", `${port}:${port}`);
         }
+        // Compiler-owned persistent mounts are mounted WITHOUT `volume-nocopy`.
+        // The image is the authority for the bootstrap preimage at these paths:
+        // `createStateOwnershipCommand` writes a `.spawnfile-volume-init` marker
+        // into every one of them at build time, and the Daimon ownership guard
+        // (`secureVolumeIdentity`) and `prepare_volume_resource` both REQUIRE that
+        // marker as the fresh-volume preimage. `volume-nocopy` is exactly the flag
+        // that stops Docker copying image content into an empty volume, so it
+        // starved the guard and no Daimon organization with persistent volumes
+        // could bootstrap. Copy-up only ever populates an EMPTY volume, so a
+        // reattached volume that already holds state is untouched by dropping it.
+        // (Target/secrets volumes under src/target/* keep `volume-nocopy`: no
+        // image content backs those paths and they must stay opaque.)
         for (const mount of containerReport.persistent_mounts ?? []) {
-            args.push("-v", `${mount.volume_name}:${mount.mount_path}`);
+            args.push("--mount", `type=volume,source=${mount.volume_name},target=${mount.mount_path}`);
         }
         const deploymentLabels = options.detach && deploymentName ? (() => {
             const compileFingerprint = compileResult.report.compile_fingerprint ?? "sf1:unknown";
@@ -91,7 +109,14 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
             dockerContext: options.dockerContext ?? null,
             dockerHost: options.dockerHost ?? null,
             envFilePath,
+            ...((containerReport.persistent_mounts ?? []).some((mount) => mount.lifecycle === "exclusive-reattach") ? {
+                exclusiveReattachVolumes: (containerReport.persistent_mounts ?? [])
+                    .filter((mount) => mount.lifecycle === "exclusive-reattach")
+                    .map((mount) => mount.volume_name)
+                    .sort()
+            } : {}),
             imageTag,
+            ...(opaqueDaimonCredentials ? { opaqueDaimonCredentials } : {}),
             supportDirectory
         };
     }
@@ -164,6 +189,7 @@ export const runProject = async (inputPath, options = {}) => {
     const compileResult = await compileProject(inputPath, {
         clean: options.clean,
         containerArchitecture: targetArchitecture,
+        deploymentLineage: resolvedOptions.deploymentName ?? "ephemeral",
         outputDirectory: options.outputDirectory,
         ...(options.worldBindingsPath !== undefined
             ? { worldBindingsPath: options.worldBindingsPath }

package/dist/compiler/runProjectAuth.d.ts

@@ -1,7 +1,9 @@
 import type { ResolvedAuthProfile } from "../auth/index.js";
 import type { ContainerReport } from "../report/index.js";
+import type { RuntimeAuthPreparationResult } from "../runtime/types.js";
 interface PreparedRunAuth {
     coveredModelSecrets: Set<string>;
+    launchIdentity?: RuntimeAuthPreparationResult["launchIdentity"];
     mountArgs: string[];
 }
 export declare const resolveHostCliCredential: (containerReport: ContainerReport) => Promise<{
@@ -9,7 +11,7 @@ export declare const resolveHostCliCredential: (containerReport: ContainerReport
     sourcePath: string;
     value: string;
 } | null>;
-export declare const prepareRuntimeAuthMounts: (outputDirectory: string, containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, env: Record<string, string>, tempRoot: string) => Promise<PreparedRunAuth>;
+export declare const prepareRuntimeAuthMounts: (outputDirectory: string, containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, env: Record<string, string>, tempRoot: string, containerCredentialUid?: number) => Promise<PreparedRunAuth>;
 export declare const assertDeclaredModelAuthSatisfied: (containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, cliCredentialProvided?: boolean) => void;
 export declare const resolveRunEnvironment: (containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, envFileEnv?: Record<string, string>) => Record<string, string>;
 export declare const assertRunEnvironmentSatisfied: (containerReport: ContainerReport, env: Record<string, string>, coveredModelSecrets: Set<string>) => void;

package/dist/compiler/runProjectAuth.js

@@ -10,6 +10,7 @@ const MODEL_AUTH_IMPORT_KINDS = {
     api_key: null,
     "claude-code": "claude-code",
     codex: "codex",
+    grok: null,
     none: null
 };
 export const resolveHostCliCredential = async (containerReport) => {
@@ -44,7 +45,7 @@ const addCoveredModelSecrets = (coveredModelSecrets, instanceId, secretNames) =>
         coveredModelSecrets.add(`${instanceId}:${secretName}`);
     }
 };
-export const prepareRuntimeAuthMounts = async (outputDirectory, containerReport, authProfile, env, tempRoot) => {
+export const prepareRuntimeAuthMounts = async (outputDirectory, containerReport, authProfile, env, tempRoot, containerCredentialUid) => {
     // No early return when `authProfile` is null: an adapter's
     // `prepareRuntimeAuth` may still have host-credential staging to do that
     // does not depend on an imported Spawnfile auth profile (e.g. the Pi
@@ -53,6 +54,7 @@ export const prepareRuntimeAuthMounts = async (outputDirectory, containerReport,
     // responsible for treating a `null` `authProfile` as "no profile-derived
     // imports available" rather than failing.
     const coveredModelSecrets = new Set();
+    let launchIdentity;
     const mountArgs = [];
     for (const instance of containerReport.runtime_instances) {
         const adapter = getRuntimeAdapter(instance.runtime);
@@ -61,15 +63,26 @@ export const prepareRuntimeAuthMounts = async (outputDirectory, containerReport,
         }
         const prepared = await adapter.prepareRuntimeAuth({
             authProfile,
+            ...(containerCredentialUid === undefined ? {} : { containerCredentialUid }),
             env,
             instance,
             outputDirectory,
             tempRoot
         });
         addCoveredModelSecrets(coveredModelSecrets, instance.id, prepared.coveredModelSecrets);
+        if (prepared.launchIdentity) {
+            if (launchIdentity && launchIdentity.uid !== prepared.launchIdentity.uid) {
+                throw new SpawnfileError("validation_error", "Opaque runtime credentials resolve conflicting launch UIDs");
+            }
+            launchIdentity = prepared.launchIdentity;
+        }
         mountArgs.push(...prepared.mountArgs);
     }
-    return { coveredModelSecrets, mountArgs };
+    return {
+        coveredModelSecrets,
+        ...(launchIdentity ? { launchIdentity } : {}),
+        mountArgs
+    };
 };
 export const assertDeclaredModelAuthSatisfied = (containerReport, authProfile, cliCredentialProvided = false) => {
     const requiredImportKinds = new Set();
@@ -108,6 +121,9 @@ const createGeneratedRuntimeSecret = (secretName, generatedMoltnetSecrets) => {
     if (generatedMoltnetSecrets.has(secretName)) {
         return randomBytes(32).toString("base64url");
     }
+    if (secretName === "SPAWNFILE_DAIMON_CONTROL_TOKEN") {
+        return randomBytes(32).toString("base64url");
+    }
     return null;
 };
 const hasEnvValue = (env, name) => typeof env[name] === "string" && env[name].length > 0;
@@ -215,7 +231,7 @@ export const resolveAuthMountArgs = async (containerReport, authProfile) => {
     // Mounting the generic imported home onto the same destination would create
     // duplicate Docker mount points and bypass the adapter's minimal-file staging.
     const piRuntimeHomes = new Set(containerReport.runtime_instances
-        .filter((instance) => instance.runtime === "pi" || instance.runtime === "daimon")
+        .filter((instance) => instance.runtime === "pi")
         .map((instance) => instance.home_path)
         .filter((homePath) => homePath !== null));
     const genericRuntimeHomes = containerReport.runtime_homes

package/dist/compiler/runProjectDaimonCodexDocker.d.ts

@@ -0,0 +1,3 @@
+import type { CompileProjectResult } from "./compileProject.js";
+export { DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS } from "../shared/index.js";
+export declare const resolveDaimonCodexNativeSandboxDockerSecurityOptions: (compileResult: CompileProjectResult) => Promise<string[]>;

package/dist/compiler/runProjectDaimonCodexDocker.js

@@ -0,0 +1,36 @@
+import path from "node:path";
+import { readUtf8File } from "../filesystem/index.js";
+import { daimonEngineDockerSecurityArgsForConfigs, materializeDaimonGrokSeccompProfile, SpawnfileError } from "../shared/index.js";
+export { DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS } from "../shared/index.js";
+const assertContainedPath = (root, candidate) => {
+    const normalizedRoot = path.resolve(root);
+    const normalizedCandidate = path.resolve(candidate);
+    const relative = path.relative(normalizedRoot, normalizedCandidate);
+    if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new SpawnfileError("validation_error", "Daimon generated config path escapes the compiled container rootfs");
+    }
+    return normalizedCandidate;
+};
+const configPathInOutput = (outputDirectory, instance) => {
+    if (!instance.config_path.startsWith("/")) {
+        throw new SpawnfileError("validation_error", "Daimon runtime instance has a non-absolute generated config path");
+    }
+    const rootfs = path.join(outputDirectory, "container", "rootfs");
+    return assertContainedPath(rootfs, path.join(rootfs, `.${instance.config_path}`));
+};
+export const resolveDaimonCodexNativeSandboxDockerSecurityOptions = async (compileResult) => {
+    const instances = compileResult.report.container?.runtime_instances
+        .filter((instance) => instance.runtime === "daimon") ?? [];
+    const sources = [];
+    for (const instance of instances) {
+        try {
+            sources.push(await readUtf8File(configPathInOutput(compileResult.outputDirectory, instance)));
+        }
+        catch (error) {
+            if (error instanceof SpawnfileError)
+                throw error;
+            throw new SpawnfileError("validation_error", "Could not read Daimon's generated organization config before Docker launch");
+        }
+    }
+    return daimonEngineDockerSecurityArgsForConfigs(sources, () => materializeDaimonGrokSeccompProfile(path.join(compileResult.outputDirectory, "container", "security")));
+};

package/dist/compiler/runProjectDocker.d.ts

@@ -9,18 +9,22 @@ export interface DockerRunInvocation {
     dockerContext?: string | null;
     dockerHost?: string | null;
     envFilePath: string;
+    /** Host-stable credential realms that must have at most one live deployment. */
+    exclusiveReattachVolumes?: readonly string[];
     imageTag: string;
-    onDetachedStarted?: (result: {
-        containerId: string;
-    }) => Promise<void>;
+    onDetachedStarted?: (result: DockerRunResult) => Promise<void>;
+    /** Ephemeral guard; never serialized into reports, records, or labels. */
+    opaqueDaimonCredentials?: boolean;
     supportDirectory: string;
 }
 export interface DockerRunResult {
     containerId?: string;
+    containerName?: string;
     deploymentLabels?: Readonly<Record<string, string>>;
     imageId?: string;
 }
 export type DockerRunRunner = (invocation: DockerRunInvocation) => Promise<DockerRunResult | void>;
 export declare const createDetachedContainerInspectArgs: (invocation: DockerRunInvocation, containerId: string) => string[];
-export declare const parseDetachedContainerInspect: (stdout: string, expectedContainerId: string, expectedLabels?: Readonly<Record<string, string>>) => DockerRunResult;
+export declare const parseDetachedContainerInspect: (stdout: string, expectedContainerId: string, expectedLabels?: Readonly<Record<string, string>>, expectedContainerName?: string | null) => DockerRunResult;
+export declare const inspectDetachedContainer: (invocation: DockerRunInvocation, containerId: string) => Promise<DockerRunResult>;
 export declare const runDockerContainer: DockerRunRunner;

package/dist/compiler/runProjectDocker.js

@@ -2,6 +2,8 @@ import { execFile as execFileCallback, spawn } from "node:child_process";
 import path from "node:path";
 import { promisify } from "node:util";
 import { SpawnfileError } from "../shared/index.js";
+import { assertOpaqueDaimonCredentialsHaveNoUserNamespace, pinOpaqueDaimonDockerEndpoint } from "./runProjectDockerDaimonGuards.js";
+import { withExclusiveVolumeReservations } from "./runProjectDockerReservation.js";
 const execFile = promisify(execFileCallback);
 const parseDockerContextHost = (stdout) => {
     const trimmed = stdout.trim();
@@ -138,20 +140,22 @@ export const createDetachedContainerInspectArgs = (invocation, containerId) => {
         : invocation.dockerHost
             ? ["--host", invocation.dockerHost, "inspect"]
             : ["inspect"];
-    return [...base, "--format", "{{json .Id}}\n{{json .Image}}\n{{json .Config.Labels}}", containerId];
+    return [...base, "--format", "{{json .Id}}\n{{json .Name}}\n{{json .Image}}\n{{json .Config.Labels}}", containerId];
 };
-export const parseDetachedContainerInspect = (stdout, expectedContainerId, expectedLabels) => {
-    const [idRaw, imageRaw, labelsRaw, ...extra] = stdout.trim().split("\n");
-    if (!idRaw || !imageRaw || !labelsRaw || extra.length > 0)
+export const parseDetachedContainerInspect = (stdout, expectedContainerId, expectedLabels, expectedContainerName) => {
+    const [idRaw, nameRaw, imageRaw, labelsRaw, ...extra] = stdout.trim().split("\n");
+    if (!idRaw || !nameRaw || !imageRaw || !labelsRaw || extra.length > 0)
         throw new Error("unexpected inspect response");
     const actualId = JSON.parse(idRaw);
+    const actualName = JSON.parse(nameRaw);
     const imageId = JSON.parse(imageRaw);
     const labels = JSON.parse(labelsRaw);
     if (typeof actualId !== "string" || actualId !== expectedContainerId || !/^[a-f0-9]{64}$/u.test(actualId)
+        || typeof actualName !== "string" || actualName !== `/${expectedContainerName ?? ""}`
         || typeof imageId !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(imageId))
         throw new Error("malformed detached container metadata");
     if (!expectedLabels)
-        return { containerId: actualId, imageId };
+        return { containerId: actualId, containerName: actualName.slice(1), imageId };
     if (!labels || typeof labels !== "object" || Array.isArray(labels))
         throw new Error("missing detached deployment labels");
     const actual = Object.fromEntries(Object.keys(expectedLabels).sort().map((key) => {
@@ -160,15 +164,15 @@ export const parseDetachedContainerInspect = (stdout, expectedContainerId, expec
             throw new Error("detached deployment label drift");
         return [key, value];
     }));
-    return { containerId: actualId, imageId, deploymentLabels: actual };
+    return { containerId: actualId, containerName: actualName.slice(1), imageId, deploymentLabels: actual };
 };
-const inspectDetachedContainer = async (invocation, containerId) => {
+export const inspectDetachedContainer = async (invocation, containerId) => {
     try {
         const { stdout } = await execFile(invocation.command, createDetachedContainerInspectArgs(invocation, containerId), {
             cwd: invocation.cwd,
             timeout: 10_000
         });
-        return parseDetachedContainerInspect(stdout, containerId, invocation.deploymentLabels);
+        return parseDetachedContainerInspect(stdout, containerId, invocation.deploymentLabels, invocation.containerName);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -203,8 +207,11 @@ const runPreparedDockerContainer = (prepared) => new Promise((resolve, reject) =
                 settle(() => resolve(undefined));
                 return;
             }
-            Promise.resolve(prepared.invocation.onDetachedStarted?.({ containerId }))
-                .then(() => inspectDetachedContainer(prepared.invocation, containerId))
+            Promise.resolve(inspectDetachedContainer(prepared.invocation, containerId))
+                .then(async (result) => {
+                await prepared.invocation.onDetachedStarted?.(result);
+                return result;
+            })
                 .then(resolve)
                 .catch(reject);
             return;
@@ -214,12 +221,30 @@ const runPreparedDockerContainer = (prepared) => new Promise((resolve, reject) =
             : `Docker run for ${prepared.invocation.imageTag} failed with exit code ${code ?? "unknown"}`));
     });
 });
-export const runDockerContainer = (invocation) => {
-    if (!invocation.dockerContext || collectBindMountSources(invocation.args).length === 0) {
-        return runPreparedDockerContainer({
-            cleanup: async () => undefined,
-            invocation
-        });
-    }
-    return prepareRemoteBindMounts(invocation).then(runPreparedDockerContainer);
+const runDockerContainerPrepared = async (invocation) => {
+    const run = async () => {
+        if (!invocation.dockerContext || collectBindMountSources(invocation.args).length === 0) {
+            if (invocation.opaqueDaimonCredentials && !invocation.dockerEndpointPinned) {
+                await assertOpaqueDaimonCredentialsHaveNoUserNamespace(invocation);
+                return await runPreparedDockerContainer({
+                    cleanup: async () => undefined,
+                    invocation
+                });
+            }
+            return await runPreparedDockerContainer({
+                cleanup: async () => undefined,
+                invocation
+            });
+        }
+        return await runPreparedDockerContainer(await prepareRemoteBindMounts(invocation));
+    };
+    return withExclusiveVolumeReservations(invocation, run);
 };
+export const runDockerContainer = (invocation) => invocation.opaqueDaimonCredentials
+    ? pinOpaqueDaimonDockerEndpoint(invocation)
+        .then(async (pinned) => {
+        await assertOpaqueDaimonCredentialsHaveNoUserNamespace(pinned);
+        return pinned;
+    })
+        .then((pinned) => runDockerContainerPrepared({ ...pinned, dockerEndpointPinned: true }))
+    : runDockerContainerPrepared(invocation);

package/dist/compiler/runProjectDockerDaimonGuards.d.ts

@@ -0,0 +1,15 @@
+export interface DaimonDockerGuardInvocation {
+    args: string[];
+    command: string;
+    cwd: string;
+    dockerContext?: string | null;
+    dockerHost?: string | null;
+    opaqueDaimonCredentials?: boolean;
+}
+/**
+ * Resolves a possibly mutable Docker context once, validates that endpoint,
+ * then makes every remaining Docker operation use the immutable endpoint.
+ */
+export declare const pinOpaqueDaimonDockerEndpoint: <T extends DaimonDockerGuardInvocation>(invocation: T) => Promise<T>;
+export declare const assertOpaqueDaimonCredentialsUseLocalDaemon: (invocation: DaimonDockerGuardInvocation) => Promise<void>;
+export declare const assertOpaqueDaimonCredentialsHaveNoUserNamespace: (invocation: DaimonDockerGuardInvocation) => Promise<void>;