spawnfile 0.1.14 → 0.1.17

package/dist/compiler/training/broker/paths.d.ts

@@ -0,0 +1,196 @@
+import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+/**
+ * Every container path the broker-capable training container fixes.
+ *
+ * They are fixed rather than derived because three parties must agree on them
+ * without talking to each other: the root entrypoint that provisions them, the
+ * root slot supervisor that wipes and re-provisions them on recycle, and
+ * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * and has no way to ask the container what it chose. Daimon's projection never
+ * resolves a path, so each one must also be canonical and never a symlink; the
+ * provisioning program asserts that before a slot is used.
+ *
+ * Everything under `/run/training/slot` is per-trial state on tmpfs — never the
+ * Grok realm volume (R2). The realm volume holds only `auth.json` and the
+ * broker credential journal, so a recycle can wipe the slot without touching
+ * the one durable rotating credential.
+ */
+export declare const TRAINING_RUN_ROOT = "/run/training/output";
+export declare const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
+export declare const TRAINING_PAIDEIA_ROOT = "/run/paideia";
+export declare const TRAINING_CONTEXT_FILE = "/run/paideia/context.json";
+/** Host-written, read-only `spawnfile.training-broker.v1` declaration the root entrypoint reads. */
+export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/paideia/training-broker.json";
+export declare const TRAINING_SLOT_ROOT = "/run/training/slot";
+export declare const TRAINING_SLOT_WORKSPACE = "/run/training/slot/workspace";
+export declare const TRAINING_SLOT_RUNTIME_HOME = "/run/training/slot/runtime-home";
+export declare const TRAINING_SLOT_STATE_ROOT = "/run/training/slot/state";
+export declare const TRAINING_SLOT_ACCEPTANCE_STORE = "/run/training/slot/state/wake-acceptance";
+/** Per-slot turn store. On tmpfs on purpose: a replayed turn from trial N must never satisfy trial N+1 (R2). */
+export declare const TRAINING_SLOT_TURN_STORE = "/run/training/slot/turns";
+export declare const TRAINING_SLOT_USAGE_DIRECTORY = "/run/training/slot/usage";
+export declare const TRAINING_SLOT_USAGE_LEDGER = "/run/training/slot/usage/usage.jsonl";
+export declare const TRAINING_SLOT_PREFLIGHT_RECEIPT = "/run/training/slot/preflight.json";
+/** Supervisor-owned monotonic generation counter; survives a recycle, never a container restart. */
+export declare const TRAINING_SLOT_GENERATION_FILE = "/run/training/slot/generation.json";
+export declare const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
+export declare const TRAINING_INFERENCE_LEDGER = "/run/training/inference/inference.jsonl";
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+export declare const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group), deliberately **outside** `/run/daimon-engine-broker`.
+ *
+ * Production puts it at `<control root>/tmp`, which is fine there: that root is
+ * removed and recreated exactly once, at container start. Training
+ * re-provisions the same root on every recycle, and the launch mounts this
+ * directory as its own tmpfs — so a `tmp/` inside the cleared root is a *mount
+ * point*, and clearing a mount point fails `EBUSY`. A live P8 launch died
+ * exactly there. Its own tmpfs under `/run/training` is never a wipe target and
+ * is denied to every worker uid.
+ */
+export declare const TRAINING_BROKER_TMPDIR = "/run/training/broker-tmp";
+export declare const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
+export declare const TRAINING_SUPERVISOR_SOCKET = "/run/training/supervisor/control.sock";
+export declare const TRAINING_SUPERVISOR_LOG = "/run/training/supervisor/supervisor.log";
+export declare const TRAINING_WORKER_ROOT = "/var/lib/daimon-workers";
+export declare const TRAINING_SLOT_INDEX = 0;
+export declare const TRAINING_WORKER_UID: number;
+export declare const TRAINING_WORKER_HOME: string;
+/**
+ * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
+ * every `deny` target inside bubblewrap as the worker uid, and it cannot
+ * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
+ * single `/run/paideia` mask below covers all of them, which is also stronger
+ * — a file Paideia adds later is covered without re-provisioning the slot.
+ */
+export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/paideia/config.json", "/run/paideia/control", "/run/paideia/launch.json", "/run/paideia/token", "/run/paideia/env", "/run/paideia/preparation.json", "/run/paideia/repair.json"];
+/**
+ * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ *
+ * This is not a summary of the five roles — it is the **whole** set of deny
+ * entries this container adds beyond Daimon's own protected paths, because
+ * Paideia's worker resolves the projection from exactly
+ * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
+ * that carried only the five roles made Daimon hash a different deny list than
+ * the one provisioning wrote, and a live run died on
+ * `Grok broker projection digest differs from the launch receipt`.
+ *
+ * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * unique. The four roles with a dedicated path keep it, and everything else is
+ * tagged `context` — the caller-state role — since there is no other way to
+ * carry a path through that contract.
+ */
+export declare const TRAINING_EVALUATOR_PATHS: readonly {
+    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
+    path: string;
+}[];
+/**
+ * One entry per evaluator role, in declaration order: the launch receipt requires all five roles,
+ * and several `context` paths share that role, so the first of each role is the role's root.
+ */
+export declare const TRAINING_EVALUATOR_ROOTS: {
+    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
+    path: string;
+}[];
+/**
+ * What `paideia.daimon-native.launch.v2`'s `controlRoot` must be.
+ *
+ * Paideia's worker passes it to Daimon as `acceptanceStorePath`, and Daimon adds
+ * it to the projection's deny list, so it has to be the same path this
+ * container masks as its slot state root. Its own default
+ * (`/run/paideia/control`) would both change the digest and nest inside the
+ * `/run/paideia` mask, which Grok refuses — Daimon renders a nested mask
+ * without complaining, so the failure would only appear at the first turn.
+ */
+export declare const TRAINING_CALLER_CONTROL_ROOT = "/run/training/slot/state";
+/**
+ * Everything this container provisions that the one training worker must not
+ * read, beyond Daimon's own protected set (realm, bootstrap, acceptance store).
+ * Each entry sits strictly below a Grok 1.0.34 base-profile grant — Grok
+ * refuses a profile whose deny entry equals or contains `/run`, `/var`, `/etc`
+ * or `/tmp` — and no entry covers another, because masks cannot nest.
+ */
+/**
+ * The added deny set is exactly the launch's `evaluatorPaths`, so Spawnfile and
+ * Paideia hand Daimon's resolver the same list. `TRAINING_SLOT_STATE_ROOT` is
+ * deliberately absent: Daimon adds it itself, from the control root above.
+ */
+export declare const TRAINING_ADDED_DENY_PATHS: readonly string[];
+/** Paths the provisioning program creates root-owned `0700` when absent, so every deny entry always has a target inode. */
+export declare const TRAINING_OPTIONAL_DENY_DIRECTORIES: readonly string[];
+/**
+ * Deny entries a launch may legitimately not have mounted. Everything else must
+ * exist before a worker turn: Grok 1.0.34 creates an absent `deny` target as
+ * the worker uid inside bubblewrap and refuses the whole profile when it
+ * cannot, so provisioning materializes every other entry itself.
+ */
+export declare const TRAINING_DEFERRED_DENY_PATHS: readonly string[];
+/**
+ * Deny entries the launch binds from the host, named so a refusal can say why.
+ *
+ * Only the run root is one. The sealed inputs root is **not**: the launch binds
+ * each declared input at `/run/training/inputs/<id>`, so `/run/training/inputs`
+ * itself is the binds' *parent*, a directory on the read-only image root — and
+ * that is exactly what makes it sealable (see `TRAINING_SEALED_DENY_PATHS`).
+ *
+ * Being a host bind is no longer a waiver on its own. On Docker Desktop and
+ * Colima a bind lands on virtiofs/grpcfuse, which ignores `chown`, and there a
+ * worker-uid probe carries no information; on a Linux daemon over ext4, xfs,
+ * btrfs or overlay the same bind enforces ownership and the probe is real. The
+ * canary resolver asks the backing filesystem rather than this list, which is
+ * why the documented `refuse` default is reachable at all.
+ */
+export declare const TRAINING_HOST_BIND_DENY_PATHS: readonly string[];
+/**
+ * Deny entries whose denial must be proven by the kernel under **every**
+ * policy, because the experiment's central claim depends on them.
+ *
+ * `/run/training/inputs` holds the sealed train and test datasets. A bubblewrap
+ * `deny` mask is not a boundary the subject cannot lift: the pinned seccomp
+ * profile must allow `clone/unshare/mount/umount2/pivot_root/setns` for
+ * bubblewrap itself, and the container runs `apparmor=unconfined`, so a
+ * worker-uid process can open a user + mount namespace of its own and either
+ * detach the mask or bind the mask's parent somewhere fresh.
+ *
+ * What survives that is DAC on the datasets' ancestor. The image bakes this
+ * directory `0:<organization gid> 0750` on the read-only root, so:
+ *
+ *   - the worker uid is in neither the owner nor the group class and loses
+ *     search permission on the one directory every dataset read must traverse;
+ *   - the inode is owned by real uid 0, which a `unshare --map-root-user`
+ *     namespace does not map, so `CAP_DAC_OVERRIDE` there cannot override it;
+ *   - the root filesystem is read-only, so nothing in the container — root
+ *     included — can loosen the mode after the image is built.
+ *
+ * Provisioning asserts the mode and then attacks it as the worker uid, and the
+ * canary resolver refuses the slot rather than certifying one of these on the
+ * sandbox profile alone.
+ */
+export declare const TRAINING_SEALED_DENY_PATHS: readonly string[];
+/** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
+export declare const TRAINING_SEALED_INPUTS_ATTESTATION = "/run/training/slot/sealed-inputs.json";
+/** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
+export declare const TRAINING_SEALED_INPUTS_IDENTITY: {
+    readonly uid: 0;
+    readonly gid: 2000;
+    readonly mode: "750";
+};
+/**
+ * What a recycle removes outright, and what it only empties.
+ *
+ * Nothing the launch mounts may be at or below any of these. A mount point
+ * cannot be unlinked while it is mounted, so a wipe target holding one aborts
+ * the recycle — which is how the broker/relay `TMPDIR` took down a live launch
+ * when it still lived at `<control root>/tmp`. `paths.test.ts` enforces that
+ * against the launch's own mount list; the rendered shell skips mount points
+ * anyway, so an undeclared one degrades to "left in place and reported" rather
+ * than a failed provision.
+ */
+export declare const TRAINING_WIPE_TARGETS: readonly string[];
+/** Emptied but kept: their paths are registered with Daimon and must stay canonical across a recycle. */
+export declare const TRAINING_CLEAR_TARGETS: readonly string[];
+export declare const TRAINING_REALM_MOUNT: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+export declare const TRAINING_BOOTSTRAP_MOUNT: "/var/lib/spawnfile/daimon/grok-bootstrap-auth";
+export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };

package/dist/compiler/training/broker/paths.js

@@ -0,0 +1,241 @@
+import path from "node:path";
+import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
+import { DAIMON_WORKER_ROOT } from "../../containerDaimonGrokWorkerRender.js";
+/**
+ * Every container path the broker-capable training container fixes.
+ *
+ * They are fixed rather than derived because three parties must agree on them
+ * without talking to each other: the root entrypoint that provisions them, the
+ * root slot supervisor that wipes and re-provisions them on recycle, and
+ * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * and has no way to ask the container what it chose. Daimon's projection never
+ * resolves a path, so each one must also be canonical and never a symlink; the
+ * provisioning program asserts that before a slot is used.
+ *
+ * Everything under `/run/training/slot` is per-trial state on tmpfs — never the
+ * Grok realm volume (R2). The realm volume holds only `auth.json` and the
+ * broker credential journal, so a recycle can wipe the slot without touching
+ * the one durable rotating credential.
+ */
+export const TRAINING_RUN_ROOT = "/run/training/output";
+export const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
+export const TRAINING_PAIDEIA_ROOT = "/run/paideia";
+export const TRAINING_CONTEXT_FILE = `${TRAINING_PAIDEIA_ROOT}/context.json`;
+/** Host-written, read-only `spawnfile.training-broker.v1` declaration the root entrypoint reads. */
+export const TRAINING_BROKER_DECLARATION_FILE = `${TRAINING_PAIDEIA_ROOT}/training-broker.json`;
+export const TRAINING_SLOT_ROOT = "/run/training/slot";
+export const TRAINING_SLOT_WORKSPACE = `${TRAINING_SLOT_ROOT}/workspace`;
+export const TRAINING_SLOT_RUNTIME_HOME = `${TRAINING_SLOT_ROOT}/runtime-home`;
+export const TRAINING_SLOT_STATE_ROOT = `${TRAINING_SLOT_ROOT}/state`;
+export const TRAINING_SLOT_ACCEPTANCE_STORE = `${TRAINING_SLOT_STATE_ROOT}/wake-acceptance`;
+/** Per-slot turn store. On tmpfs on purpose: a replayed turn from trial N must never satisfy trial N+1 (R2). */
+export const TRAINING_SLOT_TURN_STORE = `${TRAINING_SLOT_ROOT}/turns`;
+export const TRAINING_SLOT_USAGE_DIRECTORY = `${TRAINING_SLOT_ROOT}/usage`;
+export const TRAINING_SLOT_USAGE_LEDGER = `${TRAINING_SLOT_USAGE_DIRECTORY}/usage.jsonl`;
+export const TRAINING_SLOT_PREFLIGHT_RECEIPT = `${TRAINING_SLOT_ROOT}/preflight.json`;
+/** Supervisor-owned monotonic generation counter; survives a recycle, never a container restart. */
+export const TRAINING_SLOT_GENERATION_FILE = `${TRAINING_SLOT_ROOT}/generation.json`;
+export const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
+export const TRAINING_INFERENCE_LEDGER = `${TRAINING_INFERENCE_DIRECTORY}/inference.jsonl`;
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+export const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group), deliberately **outside** `/run/daimon-engine-broker`.
+ *
+ * Production puts it at `<control root>/tmp`, which is fine there: that root is
+ * removed and recreated exactly once, at container start. Training
+ * re-provisions the same root on every recycle, and the launch mounts this
+ * directory as its own tmpfs — so a `tmp/` inside the cleared root is a *mount
+ * point*, and clearing a mount point fails `EBUSY`. A live P8 launch died
+ * exactly there. Its own tmpfs under `/run/training` is never a wipe target and
+ * is denied to every worker uid.
+ */
+export const TRAINING_BROKER_TMPDIR = "/run/training/broker-tmp";
+export const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
+export const TRAINING_SUPERVISOR_SOCKET = `${TRAINING_SUPERVISOR_DIRECTORY}/control.sock`;
+export const TRAINING_SUPERVISOR_LOG = `${TRAINING_SUPERVISOR_DIRECTORY}/supervisor.log`;
+export const TRAINING_WORKER_ROOT = DAIMON_WORKER_ROOT;
+export const TRAINING_SLOT_INDEX = 0;
+export const TRAINING_WORKER_UID = DAIMON_FIRST_WORKER_UID + TRAINING_SLOT_INDEX;
+export const TRAINING_WORKER_HOME = path.posix.join(TRAINING_WORKER_ROOT, String(TRAINING_WORKER_UID));
+/**
+ * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
+ * every `deny` target inside bubblewrap as the worker uid, and it cannot
+ * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
+ * single `/run/paideia` mask below covers all of them, which is also stronger
+ * — a file Paideia adds later is covered without re-provisioning the slot.
+ */
+export const TRAINING_CALLER_PROTECTED_PATHS = [
+    `${TRAINING_PAIDEIA_ROOT}/config.json`,
+    `${TRAINING_PAIDEIA_ROOT}/control`,
+    `${TRAINING_PAIDEIA_ROOT}/launch.json`,
+    `${TRAINING_PAIDEIA_ROOT}/token`,
+    `${TRAINING_PAIDEIA_ROOT}/env`,
+    `${TRAINING_PAIDEIA_ROOT}/preparation.json`,
+    `${TRAINING_PAIDEIA_ROOT}/repair.json`
+];
+/**
+ * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ *
+ * This is not a summary of the five roles — it is the **whole** set of deny
+ * entries this container adds beyond Daimon's own protected paths, because
+ * Paideia's worker resolves the projection from exactly
+ * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
+ * that carried only the five roles made Daimon hash a different deny list than
+ * the one provisioning wrote, and a live run died on
+ * `Grok broker projection digest differs from the launch receipt`.
+ *
+ * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * unique. The four roles with a dedicated path keep it, and everything else is
+ * tagged `context` — the caller-state role — since there is no other way to
+ * carry a path through that contract.
+ */
+export const TRAINING_EVALUATOR_PATHS = [
+    { role: "run-root", path: TRAINING_RUN_ROOT },
+    { role: "sealed-inputs", path: TRAINING_SEALED_INPUTS_ROOT },
+    { role: "judge-home", path: TRAINING_GRANT_HOME_ROOT },
+    { role: "slot-ledger", path: TRAINING_SLOT_USAGE_DIRECTORY },
+    { role: "context", path: TRAINING_PAIDEIA_ROOT },
+    { role: "context", path: TRAINING_BROKER_TMPDIR },
+    { role: "context", path: TRAINING_INFERENCE_DIRECTORY },
+    { role: "context", path: TRAINING_SLOT_TURN_STORE },
+    { role: "context", path: TRAINING_SUPERVISOR_DIRECTORY },
+    { role: "context", path: path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath) },
+    { role: "context", path: path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath) },
+    { role: "context", path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath },
+    { role: "context", path: DAIMON_WAKE_FUSE_DIRECTORY }
+];
+/**
+ * One entry per evaluator role, in declaration order: the launch receipt requires all five roles,
+ * and several `context` paths share that role, so the first of each role is the role's root.
+ */
+export const TRAINING_EVALUATOR_ROOTS = TRAINING_EVALUATOR_PATHS
+    .filter((entry, index) => TRAINING_EVALUATOR_PATHS.findIndex((first) => first.role === entry.role) === index);
+/**
+ * What `paideia.daimon-native.launch.v2`'s `controlRoot` must be.
+ *
+ * Paideia's worker passes it to Daimon as `acceptanceStorePath`, and Daimon adds
+ * it to the projection's deny list, so it has to be the same path this
+ * container masks as its slot state root. Its own default
+ * (`/run/paideia/control`) would both change the digest and nest inside the
+ * `/run/paideia` mask, which Grok refuses — Daimon renders a nested mask
+ * without complaining, so the failure would only appear at the first turn.
+ */
+export const TRAINING_CALLER_CONTROL_ROOT = TRAINING_SLOT_STATE_ROOT;
+/**
+ * Everything this container provisions that the one training worker must not
+ * read, beyond Daimon's own protected set (realm, bootstrap, acceptance store).
+ * Each entry sits strictly below a Grok 1.0.34 base-profile grant — Grok
+ * refuses a profile whose deny entry equals or contains `/run`, `/var`, `/etc`
+ * or `/tmp` — and no entry covers another, because masks cannot nest.
+ */
+/**
+ * The added deny set is exactly the launch's `evaluatorPaths`, so Spawnfile and
+ * Paideia hand Daimon's resolver the same list. `TRAINING_SLOT_STATE_ROOT` is
+ * deliberately absent: Daimon adds it itself, from the control root above.
+ */
+export const TRAINING_ADDED_DENY_PATHS = [...new Set(TRAINING_EVALUATOR_PATHS.map((entry) => entry.path))].sort();
+/** Paths the provisioning program creates root-owned `0700` when absent, so every deny entry always has a target inode. */
+export const TRAINING_OPTIONAL_DENY_DIRECTORIES = [
+    TRAINING_BROKER_TMPDIR,
+    TRAINING_INFERENCE_DIRECTORY,
+    TRAINING_SLOT_STATE_ROOT,
+    TRAINING_SLOT_TURN_STORE,
+    TRAINING_SUPERVISOR_DIRECTORY,
+    TRAINING_GRANT_HOME_ROOT,
+    // Denied and unused here — training meters per slot — but the mask still needs an inode. The launch
+    // mounts each as tmpfs, so this only creates them when a caller ran the entrypoint without them.
+    DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath,
+    DAIMON_WAKE_FUSE_DIRECTORY
+];
+/**
+ * Deny entries a launch may legitimately not have mounted. Everything else must
+ * exist before a worker turn: Grok 1.0.34 creates an absent `deny` target as
+ * the worker uid inside bubblewrap and refuses the whole profile when it
+ * cannot, so provisioning materializes every other entry itself.
+ */
+export const TRAINING_DEFERRED_DENY_PATHS = [
+    // Docker materializes both host binds before the entrypoint runs. They sit on the read-only image
+    // root, which root cannot create into, so provisioning must tolerate a launch that declared neither.
+    TRAINING_RUN_ROOT,
+    TRAINING_SEALED_INPUTS_ROOT
+];
+/**
+ * Deny entries the launch binds from the host, named so a refusal can say why.
+ *
+ * Only the run root is one. The sealed inputs root is **not**: the launch binds
+ * each declared input at `/run/training/inputs/<id>`, so `/run/training/inputs`
+ * itself is the binds' *parent*, a directory on the read-only image root — and
+ * that is exactly what makes it sealable (see `TRAINING_SEALED_DENY_PATHS`).
+ *
+ * Being a host bind is no longer a waiver on its own. On Docker Desktop and
+ * Colima a bind lands on virtiofs/grpcfuse, which ignores `chown`, and there a
+ * worker-uid probe carries no information; on a Linux daemon over ext4, xfs,
+ * btrfs or overlay the same bind enforces ownership and the probe is real. The
+ * canary resolver asks the backing filesystem rather than this list, which is
+ * why the documented `refuse` default is reachable at all.
+ */
+export const TRAINING_HOST_BIND_DENY_PATHS = [TRAINING_RUN_ROOT, DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath];
+/**
+ * Deny entries whose denial must be proven by the kernel under **every**
+ * policy, because the experiment's central claim depends on them.
+ *
+ * `/run/training/inputs` holds the sealed train and test datasets. A bubblewrap
+ * `deny` mask is not a boundary the subject cannot lift: the pinned seccomp
+ * profile must allow `clone/unshare/mount/umount2/pivot_root/setns` for
+ * bubblewrap itself, and the container runs `apparmor=unconfined`, so a
+ * worker-uid process can open a user + mount namespace of its own and either
+ * detach the mask or bind the mask's parent somewhere fresh.
+ *
+ * What survives that is DAC on the datasets' ancestor. The image bakes this
+ * directory `0:<organization gid> 0750` on the read-only root, so:
+ *
+ *   - the worker uid is in neither the owner nor the group class and loses
+ *     search permission on the one directory every dataset read must traverse;
+ *   - the inode is owned by real uid 0, which a `unshare --map-root-user`
+ *     namespace does not map, so `CAP_DAC_OVERRIDE` there cannot override it;
+ *   - the root filesystem is read-only, so nothing in the container — root
+ *     included — can loosen the mode after the image is built.
+ *
+ * Provisioning asserts the mode and then attacks it as the worker uid, and the
+ * canary resolver refuses the slot rather than certifying one of these on the
+ * sandbox profile alone.
+ */
+export const TRAINING_SEALED_DENY_PATHS = [TRAINING_SEALED_INPUTS_ROOT];
+/** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
+export const TRAINING_SEALED_INPUTS_ATTESTATION = `${TRAINING_SLOT_ROOT}/sealed-inputs.json`;
+/** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
+export const TRAINING_SEALED_INPUTS_IDENTITY = { uid: 0, gid: DAIMON_ORGANIZATION_UID, mode: "750" };
+/**
+ * What a recycle removes outright, and what it only empties.
+ *
+ * Nothing the launch mounts may be at or below any of these. A mount point
+ * cannot be unlinked while it is mounted, so a wipe target holding one aborts
+ * the recycle — which is how the broker/relay `TMPDIR` took down a live launch
+ * when it still lived at `<control root>/tmp`. `paths.test.ts` enforces that
+ * against the launch's own mount list; the rendered shell skips mount points
+ * anyway, so an undeclared one degrades to "left in place and reported" rather
+ * than a failed provision.
+ */
+export const TRAINING_WIPE_TARGETS = [
+    TRAINING_WORKER_HOME,
+    TRAINING_SLOT_RUNTIME_HOME,
+    TRAINING_SLOT_TURN_STORE,
+    TRAINING_SLOT_ACCEPTANCE_STORE,
+    DAIMON_GROK_ENGINE_BROKER.serviceConfigPath,
+    DAIMON_GROK_ENGINE_BROKER.registrationPath
+];
+/** Emptied but kept: their paths are registered with Daimon and must stay canonical across a recycle. */
+export const TRAINING_CLEAR_TARGETS = [
+    TRAINING_SLOT_WORKSPACE,
+    TRAINING_SLOT_USAGE_DIRECTORY,
+    path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath),
+    path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath)
+];
+export const TRAINING_REALM_MOUNT = DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath;
+export const TRAINING_BOOTSTRAP_MOUNT = DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath;
+export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };

package/dist/compiler/training/broker/processes.d.ts

@@ -0,0 +1,42 @@
+import { type ChildProcess } from "node:child_process";
+export declare const DAIMON_RUNTIME_ROOT = "/opt/spawnfile/runtime-installs/daimon";
+/** `00000000000000c1` = CHOWN|SETGID|SETUID, the launcher's bounding set after `setpriv`. */
+export declare const LAUNCHER_CAPABILITY_BOUND = "00000000000000c1";
+export declare const DROPPED_CAPABILITY_BOUND = "0000000000000000";
+export interface BrokerChild {
+    name: string;
+    pid: number;
+    child: ChildProcess;
+    uid: number;
+    capBnd: string;
+}
+/**
+ * The three broker processes, in the order and with the identities production
+ * starts them: the root launcher (which alone may `setuid` to a worker uid),
+ * the broker backend as uid 2100, and the native control relay as uid 2100.
+ * Each one runs with the same bounding set the production entrypoint verifies,
+ * and the broker and relay carry their own `TMPDIR` because shared `/tmp` is
+ * closed to every process outside the organization group.
+ */
+export declare const brokerProcessPlan: () => {
+    name: string;
+    argv: string[];
+    socket: string;
+    uid: number;
+    capBnd: string;
+}[];
+export interface StartBrokerOptions {
+    timeoutMs?: number;
+    pollMs?: number;
+    procRoot?: string;
+    log(line: string): void;
+}
+/**
+ * Starts all three, then proves each one reached its socket *and* its expected
+ * post-drop identity before the next starts. A broker that is alive but still
+ * root, or a relay whose socket never appeared, fails the slot here rather
+ * than at the first trial wake.
+ */
+export declare const startBrokerProcesses: (options: StartBrokerOptions) => Promise<BrokerChild[]>;
+/** Graceful stop in reverse start order: relay, backend, launcher. `SIGKILL` only after the grace window. */
+export declare const stopBrokerProcesses: (children: readonly BrokerChild[], log: (line: string) => void, graceMs?: number) => Promise<void>;

package/dist/compiler/training/broker/processes.js

@@ -0,0 +1,99 @@
+import { spawn } from "node:child_process";
+import { readFile, stat } from "node:fs/promises";
+import { setTimeout as pause } from "node:timers/promises";
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_BROKER_UID, TRAINING_BROKER_TMPDIR } from "./paths.js";
+export const DAIMON_RUNTIME_ROOT = "/opt/spawnfile/runtime-installs/daimon";
+/** `00000000000000c1` = CHOWN|SETGID|SETUID, the launcher's bounding set after `setpriv`. */
+export const LAUNCHER_CAPABILITY_BOUND = "00000000000000c1";
+export const DROPPED_CAPABILITY_BOUND = "0000000000000000";
+const setpriv = (args) => ["setpriv", ...args];
+/**
+ * The three broker processes, in the order and with the identities production
+ * starts them: the root launcher (which alone may `setuid` to a worker uid),
+ * the broker backend as uid 2100, and the native control relay as uid 2100.
+ * Each one runs with the same bounding set the production entrypoint verifies,
+ * and the broker and relay carry their own `TMPDIR` because shared `/tmp` is
+ * closed to every process outside the organization group.
+ */
+export const brokerProcessPlan = () => [
+    {
+        name: "engine broker launcher", socket: DAIMON_GROK_ENGINE_BROKER.launcherSocketPath, uid: 0, capBnd: LAUNCHER_CAPABILITY_BOUND,
+        argv: setpriv(["--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all,+chown,+setuid,+setgid", "--", DAIMON_GROK_ENGINE_BROKER.nativeExecutablePath])
+    },
+    {
+        name: "engine broker backend", socket: DAIMON_GROK_ENGINE_BROKER.backendSocketPath, uid: DAIMON_BROKER_UID, capBnd: DROPPED_CAPABILITY_BOUND,
+        argv: setpriv(["--clear-groups", `--reuid=${DAIMON_BROKER_UID}`, `--regid=${DAIMON_BROKER_UID}`, "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all",
+            "--", "env", `TMPDIR=${TRAINING_BROKER_TMPDIR}`, `${DAIMON_RUNTIME_ROOT}/bin/daimon-runtime`, "engine-broker", "serve"])
+    },
+    {
+        name: "engine broker control relay", socket: DAIMON_GROK_ENGINE_BROKER.controlSocketPath, uid: DAIMON_BROKER_UID, capBnd: DROPPED_CAPABILITY_BOUND,
+        argv: setpriv(["--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all,+chown,+setuid,+setgid,+setpcap", "--", "env", `TMPDIR=${TRAINING_BROKER_TMPDIR}`,
+            DAIMON_GROK_ENGINE_BROKER.nativeExecutablePath, "--relay"])
+    }
+];
+const processIdentity = async (pid, procRoot) => {
+    const status = await readFile(`${procRoot}/${pid}/status`, "utf8");
+    return {
+        uid: /^Uid:\s+(\d+)/mu.exec(status)?.[1] ?? "",
+        capBnd: /^CapBnd:\s+([0-9a-f]+)/mu.exec(status)?.[1] ?? ""
+    };
+};
+/**
+ * Starts all three, then proves each one reached its socket *and* its expected
+ * post-drop identity before the next starts. A broker that is alive but still
+ * root, or a relay whose socket never appeared, fails the slot here rather
+ * than at the first trial wake.
+ */
+export const startBrokerProcesses = async (options) => {
+    const timeoutMs = options.timeoutMs ?? 60_000, pollMs = options.pollMs ?? 100, procRoot = options.procRoot ?? "/proc";
+    const started = [];
+    const deadline = Date.now() + timeoutMs;
+    try {
+        for (const entry of brokerProcessPlan()) {
+            const child = spawn(entry.argv[0], entry.argv.slice(1), { stdio: ["ignore", "inherit", "inherit"] });
+            if (child.pid === undefined)
+                throw new SpawnfileError("runtime_error", `${entry.name} did not start`);
+            let exited = false;
+            child.once("exit", (code) => { exited = true; options.log(`${entry.name} exited with status ${code ?? "signal"}`); });
+            started.push({ name: entry.name, pid: child.pid, child, uid: entry.uid, capBnd: entry.capBnd });
+            for (;;) {
+                if (exited)
+                    throw new SpawnfileError("runtime_error", `${entry.name} exited before readiness`);
+                if (Date.now() > deadline)
+                    throw new SpawnfileError("runtime_error", `${entry.name} readiness timed out`);
+                const socket = await stat(entry.socket).catch(() => undefined);
+                if (socket?.isSocket()) {
+                    const identity = await processIdentity(child.pid, procRoot);
+                    if (identity.uid === String(entry.uid) && identity.capBnd === entry.capBnd)
+                        break;
+                }
+                await pause(pollMs);
+            }
+            options.log(`${entry.name} ready pid=${child.pid} uid=${entry.uid} capbnd=${entry.capBnd}`);
+        }
+        return started;
+    }
+    catch (error) {
+        await stopBrokerProcesses(started, options.log);
+        throw error;
+    }
+};
+/** Graceful stop in reverse start order: relay, backend, launcher. `SIGKILL` only after the grace window. */
+export const stopBrokerProcesses = async (children, log, graceMs = 5_000) => {
+    for (const entry of [...children].reverse()) {
+        if (entry.child.exitCode !== null || entry.child.signalCode !== null)
+            continue;
+        entry.child.kill("SIGTERM");
+        const deadline = Date.now() + graceMs;
+        while (entry.child.exitCode === null && entry.child.signalCode === null && Date.now() < deadline)
+            await pause(25);
+        if (entry.child.exitCode === null && entry.child.signalCode === null) {
+            log(`${entry.name} did not stop gracefully; killing`);
+            entry.child.kill("SIGKILL");
+        }
+        while (entry.child.exitCode === null && entry.child.signalCode === null)
+            await pause(25);
+    }
+};

package/dist/compiler/training/broker/projection.d.ts

@@ -0,0 +1,51 @@
+import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../../runtime/daimon/contractManifest.js";
+import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
+import type { TrainingBrokerDeclaration } from "./declaration.js";
+/**
+ * The slice of Daimon's public `@noopolis/daimon/runtime` export the slot
+ * supervisor needs. Daimon stays the resolver: the slot preflight receipt binds
+ * `projection_sha256`, and a second implementation of that digest would fork
+ * the contract the moment either side changed a member.
+ */
+export interface DaimonProjectionModule {
+    resolveOrganizationGrokBrokerProjection(config: unknown, agentId: string, options: Record<string, unknown>): {
+        version: string;
+        profileSha256: string;
+        denyPaths: readonly string[];
+    };
+    grokBrokerProjectionSha256(projection: unknown): string;
+    GROK_ENGINE_BROKER: {
+        projectionVersion: string;
+        slotPreflightVersion: string;
+        nativeAbiVersion: number;
+    };
+}
+export declare const loadDaimonProjectionModule: (load?: () => Promise<unknown>) => Promise<DaimonProjectionModule>;
+/**
+ * The one-agent organization runtime config the training slot's projection is
+ * resolved from.
+ *
+ * It is a projection *input*, never a runtime config Daimon hosts: the trial's
+ * real config is Paideia's. Only `agents[].id`, `workspacePath`,
+ * `runtimeHomePath`, the engine's declared model and effort, and the *absence*
+ * of peers reach `resolveOrganizationGrokBrokerProjection`, so this minimal
+ * config and Paideia's fuller one compute the same projection digest. A peer
+ * agent would change Daimon's protected set and the digest with it, which is
+ * exactly why training runs one slot.
+ */
+export declare const trainingOrganizationRuntimeConfig: (declaration: {
+    agentId: string;
+    model: DaimonGrokBrokerModel;
+    reasoningEffort: DaimonGrokBrokerReasoningEffort;
+}) => Record<string, unknown>;
+export interface TrainingGrokProjection {
+    projection: Record<string, unknown>;
+    projectionSha256: string;
+}
+/**
+ * Resolve the slot's public Grok broker projection through Daimon, over exactly
+ * the provisioned registration. A profile digest that differs from Daimon's own
+ * render is refused there, so the receipt can never certify a slot whose deny
+ * list drifted from the bytes provisioning wrote.
+ */
+export declare const resolveTrainingGrokProjection: (declaration: TrainingBrokerDeclaration, registration: DaimonGrokRegistration, daimon: DaimonProjectionModule) => Promise<TrainingGrokProjection>;