spawnfile 0.1.14 → 0.1.17

package/dist/compiler/training/broker/projection.js

@@ -0,0 +1,76 @@
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { TRAINING_SLOT_RUNTIME_HOME, TRAINING_SLOT_STATE_ROOT, TRAINING_SLOT_WORKSPACE, TRAINING_WORKER_HOME } from "./paths.js";
+/** Indirect specifier: Daimon is an in-image runtime peer of the training container, never a Spawnfile source dependency. */
+const loadRuntime = async () => {
+    const packageName = "@noopolis/daimon/runtime";
+    return import(packageName);
+};
+export const loadDaimonProjectionModule = async (load = loadRuntime) => {
+    let daimon;
+    try {
+        daimon = await load();
+    }
+    catch {
+        throw new SpawnfileError("runtime_error", "The training image must install @noopolis/daimon with its public /runtime export");
+    }
+    if (typeof daimon.resolveOrganizationGrokBrokerProjection !== "function" || typeof daimon.grokBrokerProjectionSha256 !== "function"
+        || daimon.GROK_ENGINE_BROKER?.projectionVersion !== DAIMON_GROK_ENGINE_BROKER.projectionVersion
+        || daimon.GROK_ENGINE_BROKER.slotPreflightVersion !== DAIMON_GROK_ENGINE_BROKER.slotPreflightVersion
+        || daimon.GROK_ENGINE_BROKER.nativeAbiVersion !== DAIMON_GROK_ENGINE_BROKER.nativeAbiVersion) {
+        throw new SpawnfileError("runtime_error", "The installed Daimon Grok broker contract differs from this compiler's vendored manifest");
+    }
+    return daimon;
+};
+/**
+ * The one-agent organization runtime config the training slot's projection is
+ * resolved from.
+ *
+ * It is a projection *input*, never a runtime config Daimon hosts: the trial's
+ * real config is Paideia's. Only `agents[].id`, `workspacePath`,
+ * `runtimeHomePath`, the engine's declared model and effort, and the *absence*
+ * of peers reach `resolveOrganizationGrokBrokerProjection`, so this minimal
+ * config and Paideia's fuller one compute the same projection digest. A peer
+ * agent would change Daimon's protected set and the digest with it, which is
+ * exactly why training runs one slot.
+ */
+export const trainingOrganizationRuntimeConfig = (declaration) => ({
+    version: "noopolis.daimon.organization-runtime.v1",
+    host: { bindHost: "127.0.0.1", port: 19_700, controlTokenEnv: "SPAWNFILE_DAIMON_CONTROL_TOKEN" },
+    agents: [{
+            id: declaration.agentId,
+            name: declaration.agentId,
+            instructions: "training subject",
+            workspacePath: TRAINING_SLOT_WORKSPACE,
+            runtimeHomePath: TRAINING_SLOT_RUNTIME_HOME,
+            engine: { kind: "grok", model: declaration.model, reasoningEffort: declaration.reasoningEffort }
+        }]
+});
+/**
+ * Resolve the slot's public Grok broker projection through Daimon, over exactly
+ * the provisioned registration. A profile digest that differs from Daimon's own
+ * render is refused there, so the receipt can never certify a slot whose deny
+ * list drifted from the bytes provisioning wrote.
+ */
+export const resolveTrainingGrokProjection = async (declaration, registration, daimon) => {
+    const projection = daimon.resolveOrganizationGrokBrokerProjection(trainingOrganizationRuntimeConfig(declaration), declaration.agentId, {
+        slot: registration.slot,
+        workerUid: registration.uid,
+        workerHomePath: TRAINING_WORKER_HOME,
+        architecture: declaration.architecture,
+        usageLedgerPath: registration.usageLedgerPath,
+        limits: declaration.limits,
+        // The mask that protects the wake-acceptance store is the slot state root it lives in: the store's
+        // own parent is `2000:2000 0700`, so bubblewrap could not materialize a deny target inside it as
+        // the worker uid. Every party that recomputes this projection must pass the same value.
+        acceptanceStorePath: TRAINING_SLOT_STATE_ROOT,
+        denyPaths: registration.denyPaths,
+        seccompProfileSha256: declaration.seccompProfileSha256,
+        profileSha256: registration.profileSha256
+    });
+    const denied = [...projection.denyPaths];
+    if (denied.length !== registration.denyPaths.length || denied.some((entry, index) => entry !== registration.denyPaths[index])) {
+        throw new SpawnfileError("runtime_error", "Daimon's Grok broker projection deny list differs from the provisioned sandbox profile");
+    }
+    return { projection, projectionSha256: daimon.grokBrokerProjectionSha256(projection) };
+};

package/dist/compiler/training/broker/provisioning.d.ts

@@ -0,0 +1,87 @@
+import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
+/**
+ * Every directory the training slot owns, with the identity that must hold it.
+ *
+ * The two ledger directories are setgid to the organization group on purpose:
+ * the broker writes its rows `0640` owned by the broker group, so without
+ * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
+ * single subject usage row or inference row it paid for.
+ */
+export declare const trainingSlotDirectories: () => readonly {
+    path: string;
+    mode: string;
+    uid: number;
+    gid: number;
+}[];
+/**
+ * The fixed identities the slot needs, checked rather than created.
+ *
+ * The broker-capable training container runs on a read-only root, so
+ * `/etc/passwd` and `/etc/group` cannot be written at start-up the way the
+ * production Daimon entrypoint writes them. The image bakes uid/gid 2000, 2100
+ * and the worker uid instead, and this refuses to provision a slot in an image
+ * that did not.
+ */
+export declare const renderTrainingIdentities: () => string[];
+/**
+ * Root provisioning for the training container's one broker slot, as bash
+ * lines run by the image's own root entrypoint and replayed verbatim by the
+ * slot supervisor on every recycle.
+ *
+ * Everything below the slot skeleton is Daimon's audited production
+ * provisioning: the same credential bootstrap and journal recovery, the same
+ * `registrations.bin`, the same attested worker `GROK_HOME` layout, the same
+ * P1b private worker temp, closed shared temp and setgid spill directory, and
+ * the same `service.json` — here v2 with the per-slot usage ledger, the
+ * per-slot tmpfs turn store and the evaluator `inferenceLedgerPath`.
+ */
+export declare const renderTrainingBrokerProvisioning: (registration: DaimonGrokRegistration) => string[];
+/**
+ * The sealed-inputs seal, asserted and then attacked before any slot is used.
+ *
+ * The declared datasets are bind-mounted at `/run/training/inputs/<id>`, so
+ * `/run/training/inputs` is their common ancestor and the only inode in the
+ * chain the container controls: it lives on the read-only image root, the image
+ * bakes it `0:<organization gid> 0750`, and nothing in the container can widen
+ * it afterwards. The worker uid is in neither its owner nor its group class, so
+ * it loses *search* permission on the directory every dataset read must
+ * traverse.
+ *
+ * Four attacker routes, not a cooperating tool's read: a direct
+ * read/search/list; a user + mount namespace of the worker's own with the
+ * bubblewrap mask and its parent lazily unmounted; a fresh `mount --bind` of
+ * `/run/training` made inside that namespace; and, per dataset, a `mount --bind`
+ * of the dataset's *own* mount, which carries no mask and — unlike its parent —
+ * is not refused for locked children. A live control container left at Docker's
+ * own `0755 root:root` hands the held-out answer key to uid 2200 through routes
+ * one, two and four (`.runtime/sealed-inputs-dac/EVIDENCE.md`).
+ *
+ * Every route reports one verdict, and the verdicts are deliberately not
+ * interchangeable:
+ *
+ *  - `reachable` — the bytes were read. Refuse.
+ *  - `denied at-read` — the route ran and the kernel's permission check refused
+ *    the open or the list. This is the DAC seal doing the work.
+ *  - `denied at-mount` — the mount the route needs was refused although the
+ *    syscall is available.
+ *  - `unavailable seccomp` / `unavailable kernel` — the worker uid cannot open
+ *    the namespace the route needs at all, so the route provably cannot happen.
+ *    That is a *stronger* denial than DAC, and naming which layer refused is
+ *    the point: `EPERM` from a seccomp filter and `EPERM` from a kernel or LSM
+ *    policy are indistinguishable by errno, so the mechanism is derived from
+ *    the pinned profile Spawnfile ships and the declaration's digest binds
+ *    (`seccompRoutes.ts`), never guessed.
+ *  - anything else — no verdict. Refuse. "Provably cannot happen" and "could
+ *    not tell" must never collapse into one pass.
+ *
+ * The probe's workspace is the worker's **private** tmp, never `/tmp`: the
+ * shared temps are provisioned `root:<organization gid> 1774` so a worker lists
+ * names only, and probing from there is what made the first live run refuse
+ * every trial on `namespace-rebind reached no verdict` — the `mkdir` failed, not
+ * the seal. The private tmp is also the workspace the subject itself has.
+ */
+export declare const renderTrainingSealedInputsAssertions: (workerUid?: number, privateTmp?: string, mechanism?: "seccomp" | "kernel") => string[];
+/** Where the broker's own `service.json` lands, so the supervisor can prove the slot it restarted is the slot it provisioned. */
+export declare const TRAINING_SERVICE_CONFIG_PATH: "/etc/daimon-engine-broker/service.json";
+export declare const TRAINING_REGISTRATION_PATH: "/etc/daimon-engine-broker/registrations.bin";
+export declare const TRAINING_BROKER_CONTROL_ROOT: string;

package/dist/compiler/training/broker/provisioning.js

@@ -0,0 +1,213 @@
+import path from "node:path";
+import { DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "../../../shared/daimonGrokSeccompProfile.js";
+import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
+import { renderDaimonBrokerProvisioningProgram } from "../../containerDaimonBrokerRender.js";
+import { renderDaimonGrokHostPreflight } from "../../containerDaimonGrokWorkerProvisioning.js";
+import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_PAIDEIA_ROOT, TRAINING_SLOT_ACCEPTANCE_STORE, TRAINING_SEALED_INPUTS_ATTESTATION, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SLOT_ROOT, TRAINING_SLOT_STATE_ROOT, TRAINING_SLOT_TURN_STORE, TRAINING_SLOT_USAGE_DIRECTORY, TRAINING_SLOT_USAGE_LEDGER, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_SLOT_WORKSPACE, TRAINING_WORKER_ROOT, TRAINING_WORKER_UID } from "./paths.js";
+import { trainingNamespaceDenialMechanism } from "./seccompRoutes.js";
+const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+/**
+ * Root only ever chmods an inode it currently owns: the container's capability
+ * set grants `CAP_CHOWN` but not `CAP_FOWNER` (P0 §2), so `install -d -o u -g g
+ * -m m` — which chowns before it chmods — fails with `EPERM` for every
+ * non-root owner. Reclaim, set the mode, then hand over.
+ */
+const PROVISION_DIRECTORY_HELPER = [
+    "provision_dir() {",
+    "  target=$1; mode=$2; owner=$3; group=$4",
+    "  test -d \"$target\" && test ! -L \"$target\"",
+    "  chown 0:0 \"$target\"; chmod \"$mode\" \"$target\"; chown \"$owner:$group\" \"$target\"",
+    "}"
+];
+/**
+ * Every directory the training slot owns, with the identity that must hold it.
+ *
+ * The two ledger directories are setgid to the organization group on purpose:
+ * the broker writes its rows `0640` owned by the broker group, so without
+ * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
+ * single subject usage row or inference row it paid for.
+ */
+export const trainingSlotDirectories = () => [
+    // `/run/training` itself is deliberately absent: it is a mount-point parent on the read-only
+    // image root, and every writable child below it is its own tmpfs or bind.
+    { path: TRAINING_SLOT_ROOT, mode: "0755", uid: 0, gid: 0 },
+    { path: TRAINING_PAIDEIA_ROOT, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: "/home/training", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: "/work", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_SLOT_WORKSPACE, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: TRAINING_WORKER_UID },
+    // The agent runtime home is deliberately absent: the shared broker provisioning creates it root-owned,
+    // fills its setgid `tool-output/`, and only then narrows it to `2000:<worker> 0710`. Handing it over here
+    // would leave root — which holds no `CAP_DAC_OVERRIDE` — unable to create the spill directory inside it.
+    { path: TRAINING_SLOT_STATE_ROOT, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_SLOT_ACCEPTANCE_STORE, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_SLOT_TURN_STORE, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: TRAINING_SLOT_USAGE_DIRECTORY, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_INFERENCE_DIRECTORY, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_GRANT_HOME_ROOT, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    // Traverse only: the supervisor socket inside it is the uid gate, and a directory nobody but root may
+    // write is what keeps that socket from being replaced by a laxer one.
+    { path: TRAINING_SUPERVISOR_DIRECTORY, mode: "0711", uid: 0, gid: 0 },
+    // The broker and its relay run as uid 2100, outside the organization group, and shared `/tmp` is closed
+    // to them; this is their own temp, outside every wipe target (see `TRAINING_BROKER_TMPDIR`).
+    { path: TRAINING_BROKER_TMPDIR, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: TRAINING_WORKER_ROOT, mode: "0711", uid: 0, gid: 0 },
+    // Denied and unused by training, which meters per slot — but a world-readable directory would make its
+    // worker-uid canary meaningless, so both get the modes the production organization gives them.
+    { path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, mode: "0750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: DAIMON_WAKE_FUSE_DIRECTORY, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID }
+];
+/**
+ * The fixed identities the slot needs, checked rather than created.
+ *
+ * The broker-capable training container runs on a read-only root, so
+ * `/etc/passwd` and `/etc/group` cannot be written at start-up the way the
+ * production Daimon entrypoint writes them. The image bakes uid/gid 2000, 2100
+ * and the worker uid instead, and this refuses to provision a slot in an image
+ * that did not.
+ */
+export const renderTrainingIdentities = () => [
+    `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${TRAINING_WORKER_UID}; do`,
+    '  getent passwd "$fixed_uid" >/dev/null && getent group "$fixed_uid" >/dev/null || { echo "the training image must bake uid/gid $fixed_uid; the container root is read-only" >&2; exit 1; }',
+    "done"
+];
+/**
+ * Root provisioning for the training container's one broker slot, as bash
+ * lines run by the image's own root entrypoint and replayed verbatim by the
+ * slot supervisor on every recycle.
+ *
+ * Everything below the slot skeleton is Daimon's audited production
+ * provisioning: the same credential bootstrap and journal recovery, the same
+ * `registrations.bin`, the same attested worker `GROK_HOME` layout, the same
+ * P1b private worker temp, closed shared temp and setgid spill directory, and
+ * the same `service.json` — here v2 with the per-slot usage ledger, the
+ * per-slot tmpfs turn store and the evaluator `inferenceLedgerPath`.
+ */
+export const renderTrainingBrokerProvisioning = (registration) => [
+    ...PROVISION_DIRECTORY_HELPER,
+    // Two passes, because root here holds neither `CAP_DAC_OVERRIDE` nor `CAP_FOWNER`: create every
+    // directory while they are all still root-owned and traversable, then set ownership and mode from the
+    // deepest path up, so tightening a parent to `0700` never strands a child that still has to be created.
+    ...trainingSlotDirectories().map((entry) => `mkdir -p ${quote(entry.path)}`),
+    // Every deny entry needs an inode to mask; a bind the host did not supply is created root-owned and unreadable.
+    ...TRAINING_OPTIONAL_DENY_DIRECTORIES.map((target) => `if [ ! -e ${quote(target)} ]; then mkdir -p ${quote(target)}; provision_dir ${quote(target)} 0700 0 0; fi`),
+    // Both ledgers exist before their directories are handed to the broker: the broker appends rows `0640` in
+    // its own group, and the setgid directory below is what lets uid 2000 read a row it paid for.
+    ...[TRAINING_SLOT_USAGE_LEDGER, TRAINING_INFERENCE_LEDGER].map((ledger) => `if [ ! -e ${quote(ledger)} ]; then : > ${quote(ledger)}; fi; chown 0:0 ${quote(ledger)}; chmod 0640 ${quote(ledger)}; chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${quote(ledger)}`),
+    ...[...trainingSlotDirectories()].sort((left, right) => right.path.split("/").length - left.path.split("/").length)
+        .map((entry) => `provision_dir ${quote(entry.path)} ${entry.mode} ${entry.uid} ${entry.gid}`),
+    ...renderDaimonGrokHostPreflight(),
+    ...renderDaimonBrokerProvisioningProgram([registration], [], {
+        turnStore: TRAINING_SLOT_TURN_STORE,
+        inferenceLedgerPath: TRAINING_INFERENCE_LEDGER
+    }, "clear", TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_BROKER_TMPDIR),
+    // The shared program leaves the broker's `/etc` root `0555 root:root`, which every uid can list. Training
+    // denies that directory to its worker, and a canary can only observe a denial the kernel actually enforces.
+    `chmod 0550 /etc/daimon-engine-broker; chown 0:${DAIMON_BROKER_UID} /etc/daimon-engine-broker`,
+    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_SLOT_USAGE_DIRECTORY)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
+    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_INFERENCE_DIRECTORY)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
+    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_GRANT_HOME_ROOT)})" = "${DAIMON_ORGANIZATION_UID}:${DAIMON_ORGANIZATION_UID} 700"`,
+    // The judge grant home root is the evaluator's alone: no worker uid may even traverse it.
+    `setpriv --clear-groups --reuid ${TRAINING_WORKER_UID} --regid ${TRAINING_WORKER_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${quote(TRAINING_GRANT_HOME_ROOT)}'`,
+    `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'test -r ${quote(TRAINING_SLOT_USAGE_LEDGER)} && test -r ${quote(TRAINING_INFERENCE_LEDGER)}'`,
+    // The sealed train and test datasets: the one boundary here that must hold against the subject's own
+    // namespace, not only against an honest tool. Last, so it runs with every mode already final.
+    ...renderTrainingSealedInputsAssertions(registration.uid, registration.privateTmp)
+];
+/**
+ * The sealed-inputs seal, asserted and then attacked before any slot is used.
+ *
+ * The declared datasets are bind-mounted at `/run/training/inputs/<id>`, so
+ * `/run/training/inputs` is their common ancestor and the only inode in the
+ * chain the container controls: it lives on the read-only image root, the image
+ * bakes it `0:<organization gid> 0750`, and nothing in the container can widen
+ * it afterwards. The worker uid is in neither its owner nor its group class, so
+ * it loses *search* permission on the directory every dataset read must
+ * traverse.
+ *
+ * Four attacker routes, not a cooperating tool's read: a direct
+ * read/search/list; a user + mount namespace of the worker's own with the
+ * bubblewrap mask and its parent lazily unmounted; a fresh `mount --bind` of
+ * `/run/training` made inside that namespace; and, per dataset, a `mount --bind`
+ * of the dataset's *own* mount, which carries no mask and — unlike its parent —
+ * is not refused for locked children. A live control container left at Docker's
+ * own `0755 root:root` hands the held-out answer key to uid 2200 through routes
+ * one, two and four (`.runtime/sealed-inputs-dac/EVIDENCE.md`).
+ *
+ * Every route reports one verdict, and the verdicts are deliberately not
+ * interchangeable:
+ *
+ *  - `reachable` — the bytes were read. Refuse.
+ *  - `denied at-read` — the route ran and the kernel's permission check refused
+ *    the open or the list. This is the DAC seal doing the work.
+ *  - `denied at-mount` — the mount the route needs was refused although the
+ *    syscall is available.
+ *  - `unavailable seccomp` / `unavailable kernel` — the worker uid cannot open
+ *    the namespace the route needs at all, so the route provably cannot happen.
+ *    That is a *stronger* denial than DAC, and naming which layer refused is
+ *    the point: `EPERM` from a seccomp filter and `EPERM` from a kernel or LSM
+ *    policy are indistinguishable by errno, so the mechanism is derived from
+ *    the pinned profile Spawnfile ships and the declaration's digest binds
+ *    (`seccompRoutes.ts`), never guessed.
+ *  - anything else — no verdict. Refuse. "Provably cannot happen" and "could
+ *    not tell" must never collapse into one pass.
+ *
+ * The probe's workspace is the worker's **private** tmp, never `/tmp`: the
+ * shared temps are provisioned `root:<organization gid> 1774` so a worker lists
+ * names only, and probing from there is what made the first live run refuse
+ * every trial on `namespace-rebind reached no verdict` — the `mkdir` failed, not
+ * the seal. The private tmp is also the workspace the subject itself has.
+ */
+export const renderTrainingSealedInputsAssertions = (workerUid = TRAINING_WORKER_UID, privateTmp = path.posix.join(TRAINING_WORKER_ROOT, String(TRAINING_WORKER_UID), "tmp"), mechanism = trainingNamespaceDenialMechanism()) => [
+    // Diagnostics go to a file rather than into the verdict: a route's stderr is util-linux prose that
+    // would turn every real verdict into "unknown", but a no-verdict refusal with no diagnostic is what
+    // made the first live failure unreadable, so the unknown branch prints it back.
+    `seal_diagnostic=${quote(`${TRAINING_SLOT_ROOT}/seal-probe.err`)}`,
+    `seal_worker() { setpriv --clear-groups --reuid ${workerUid} --regid ${workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -c "$1" 2>"$seal_diagnostic"; }`,
+    "seal_rows=''",
+    'seal_record() { if [ -n "$seal_rows" ]; then seal_rows="$seal_rows,"; fi; seal_rows="$seal_rows{\\"route\\":\\"$1\\",\\"verdict\\":\\"$2\\"}"; }',
+    "seal_route() {",
+    '  case "$2" in',
+    `    reachable) echo "the sealed inputs root ${TRAINING_SEALED_INPUTS_ROOT} is REACHABLE by uid ${workerUid} via $1" >&2; exit 1 ;;`,
+    '    "denied at-read"|"denied at-mount") echo "sealed inputs route $1: $2"; seal_record "$1" "$2" ;;',
+    '    "unavailable seccomp"|"unavailable kernel") echo "sealed inputs route $1: $2 — the worker uid cannot open the namespace this route needs, so it provably cannot happen"; seal_record "$1" "$2" ;;',
+    '    *) echo "sealed inputs route $1 reached no verdict, so the denial is unproven: ${2:-no stdout} [stderr: $(cat "$seal_diagnostic" 2>/dev/null | tr "\\n" " " | cut -c1-400)]" >&2; exit 1 ;;',
+    "  esac",
+    "}",
+    // One availability determination for every namespace route, so a filtered syscall is reported as the
+    // verdict it is instead of surfacing as a route that mysteriously produced nothing.
+    "seal_namespace=available",
+    `if ! seal_worker 'unshare --user --map-root-user --mount true' >/dev/null 2>&1; then seal_namespace='unavailable ${mechanism}'; fi`,
+    'seal_ns_route() { if [ "$seal_namespace" != available ]; then seal_route "$1" "$seal_namespace"; else seal_route "$1" "$(seal_worker "$2")"; fi; }',
+    // Asserted, never set: the root filesystem is read-only, so an image that did not bake this mode
+    // cannot be corrected here — and that is the point. Refuse instead.
+    `test ! -L ${quote(TRAINING_SEALED_INPUTS_ROOT)} && test -d ${quote(TRAINING_SEALED_INPUTS_ROOT)}`,
+    `if [ "$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" != "${TRAINING_SEALED_INPUTS_IDENTITY.uid}:${TRAINING_SEALED_INPUTS_IDENTITY.gid} ${TRAINING_SEALED_INPUTS_IDENTITY.mode}" ]; then`,
+    `  echo "the training image must bake ${TRAINING_SEALED_INPUTS_ROOT} as ${TRAINING_SEALED_INPUTS_IDENTITY.uid}:${TRAINING_SEALED_INPUTS_IDENTITY.gid} ${TRAINING_SEALED_INPUTS_IDENTITY.mode} on its read-only root; the sealed datasets are unprotected otherwise" >&2; exit 1`,
+    "fi",
+    `seal_route direct-read "$(seal_worker 'if ls -1 ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1 || test -r ${TRAINING_SEALED_INPUTS_ROOT} || test -x ${TRAINING_SEALED_INPUTS_ROOT}; then echo reachable; else echo denied at-read; fi')"`,
+    `seal_ns_route namespace-unmount "unshare --user --map-root-user --mount -- /bin/sh -c 'umount -l ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1; umount -l /run/training >/dev/null 2>&1; if ls -1 ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1; then echo reachable; else echo denied at-read; fi; exit 0'"`,
+    `seal_ns_route namespace-rebind-parent "unshare --user --map-root-user --mount -- /bin/sh -c 'mkdir -p ${privateTmp}/seal-parent 2>/dev/null || { echo unknown private-tmp-unwritable; exit 0; }; if mount --bind /run/training ${privateTmp}/seal-parent 2>/dev/null; then ls -1 ${privateTmp}/seal-parent/inputs >/dev/null 2>&1 && echo reachable || echo denied at-read; else echo denied at-mount; fi; exit 0'"`,
+    // Per dataset, because the strongest route is specific. Root enumerates the children; the worker may not.
+    `for sealed_child in ${TRAINING_SEALED_INPUTS_ROOT}/*; do`,
+    '  test -e "$sealed_child" || continue',
+    `  seal_route "direct-read $sealed_child" "$(seal_worker "if ls -1 '$sealed_child' >/dev/null 2>&1 || cat '$sealed_child'/* >/dev/null 2>&1; then echo reachable; else echo denied at-read; fi")"`,
+    `  seal_ns_route "namespace-rebind $sealed_child" "unshare --user --map-root-user --mount -- /bin/sh -c 'mkdir -p ${privateTmp}/seal-child 2>/dev/null || { echo unknown private-tmp-unwritable; exit 0; }; if mount --bind \\"$sealed_child\\" ${privateTmp}/seal-child 2>/dev/null; then ls -1 ${privateTmp}/seal-child >/dev/null 2>&1 && echo reachable || echo denied at-read; else echo denied at-mount; fi; exit 0'"`,
+    "done",
+    // A Spawnfile-owned attestation beside the slot receipt, readable by the organization uid. The
+    // cross-repo `noopolis.daimon.grok-slot-preflight.v2` canary shape is deliberately untouched — its
+    // schema lives in Daimon and no consumer here can validate an added member — so the per-route
+    // mechanism is recorded here rather than implied by a bare `result: "denied"` there.
+    `seal_attestation=${quote(TRAINING_SEALED_INPUTS_ATTESTATION)}`,
+    `printf '{"version":"spawnfile.training-sealed-inputs.v1","root":"%s","worker_uid":%s,"identity":"%s","pinned_seccomp_profile_sha256":"%s","namespace_routes":"%s","routes":[%s]}\\n' `
+        + `${quote(TRAINING_SEALED_INPUTS_ROOT)} ${workerUid} `
+        + `"$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" ${quote(DAIMON_GROK_SECCOMP_PROFILE_SHA256)} `
+        + '"$seal_namespace" "$seal_rows" > "$seal_attestation.tmp"',
+    'chown 0:0 "$seal_attestation.tmp"; chmod 0640 "$seal_attestation.tmp"; chown 0:' + String(DAIMON_ORGANIZATION_UID) + ' "$seal_attestation.tmp"',
+    'mv "$seal_attestation.tmp" "$seal_attestation"',
+    'echo "sealed inputs attestation written to $seal_attestation"'
+];
+/** Where the broker's own `service.json` lands, so the supervisor can prove the slot it restarted is the slot it provisioned. */
+export const TRAINING_SERVICE_CONFIG_PATH = DAIMON_GROK_ENGINE_BROKER.serviceConfigPath;
+export const TRAINING_REGISTRATION_PATH = DAIMON_GROK_ENGINE_BROKER.registrationPath;
+export const TRAINING_BROKER_CONTROL_ROOT = path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath);

package/dist/compiler/training/broker/receipt.d.ts

@@ -0,0 +1,77 @@
+/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
+export declare const UNENFORCED_OWNERSHIP_FILESYSTEMS: readonly ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
+/**
+ * The filesystem type backing `target`, from the longest mount point that is a
+ * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
+ * backslash in the mount point field, exactly as the durable-mount guard
+ * already handles elsewhere in this compiler.
+ */
+export declare const resolveBackingFilesystem: (target: string, mountinfo: string) => string;
+export interface TrainingCanaryProbe {
+    /**
+     * Runs one worker-uid attempt and resolves true when it was denied.
+     *
+     * `read` is an `open()` for reading. `enter` additionally requires that the
+     * worker uid cannot *search* the directory, which is the property a sealed
+     * root actually needs: its protection is that every dataset read has to
+     * traverse it, not that the directory listing itself is unreadable.
+     */
+    (target: string, depth: "read" | "enter"): Promise<boolean>;
+}
+export interface TrainingCanaryOptions {
+    denyPaths: readonly string[];
+    probe: TrainingCanaryProbe;
+    mountinfo: string;
+    /** Deny entries the launch bound from the host. Diagnostics only: the backing filesystem decides, not this list. */
+    hostBindPaths: readonly string[];
+    /** Deny entries no policy may waive; each one must be observed unenterable by the worker uid. */
+    sealedPaths: readonly string[];
+    unenforcedBindPolicy: "refuse" | "profile-only";
+    log(line: string): void;
+}
+/**
+ * One denied canary per deny path, or a refusal naming the first path whose
+ * denial this container cannot prove.
+ *
+ * Three cases, in decreasing strength:
+ *
+ *  - A **sealed** path (the datasets' root) must sit on a filesystem that
+ *    enforces unix ownership and must be observed *unenterable* by the worker
+ *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
+ *    is a boundary the worker can lift from inside a namespace of its own, and
+ *    the held-out test set is the one thing that cannot rest on it.
+ *  - Any other path on an ownership-enforcing filesystem — a host bind over
+ *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
+ *    is what makes the documented `refuse` default reachable: a host bind is
+ *    only unprovable where the filesystem says so.
+ *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
+ *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
+ *    `refuse` — the default — fails the recycle and writes no receipt;
+ *    `profile-only` accepts the attested deny entry as that path's only
+ *    boundary and names every such path in the supervisor log.
+ */
+export declare const resolveTrainingCanaries: (options: TrainingCanaryOptions) => Promise<{
+    path: string;
+    method: "sandboxed-read";
+    result: "denied";
+}[]>;
+export interface TrainingSlotReceiptInput {
+    slot: number;
+    workerUid: number;
+    generation: number;
+    nonce: string;
+    projectionSha256: string;
+    sandboxProfileSha256: string;
+    seccompProfileSha256: string;
+    grokExecutableSha256: string;
+    canaries: readonly {
+        path: string;
+        method: "sandboxed-read";
+        result: "denied";
+    }[];
+    createdAt: Date;
+}
+/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
+export declare const buildTrainingSlotReceipt: (input: TrainingSlotReceiptInput) => Record<string, unknown>;
+/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
+export declare const readGrokExecutableSha256: (executable?: "/usr/local/bin/grok") => string;

package/dist/compiler/training/broker/receipt.js

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
+export const UNENFORCED_OWNERSHIP_FILESYSTEMS = ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
+const isUnenforced = (fstype) => UNENFORCED_OWNERSHIP_FILESYSTEMS.includes(fstype) || fstype.startsWith("fuse");
+/**
+ * The filesystem type backing `target`, from the longest mount point that is a
+ * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
+ * backslash in the mount point field, exactly as the durable-mount guard
+ * already handles elsewhere in this compiler.
+ */
+export const resolveBackingFilesystem = (target, mountinfo) => {
+    let best = "", fstype = "";
+    for (const line of mountinfo.split("\n")) {
+        const fields = line.split(" ");
+        const separator = fields.indexOf("-");
+        if (separator < 0 || fields.length < separator + 2)
+            continue;
+        const mountPoint = (fields[4] ?? "").replace(/\\(04[0011]|134)/gu, (match) => ({ "\\040": " ", "\\011": "\t", "\\012": "\n", "\\134": "\\" }[match] ?? match));
+        if (mountPoint !== "/" && target !== mountPoint && !target.startsWith(`${mountPoint}/`))
+            continue;
+        if (mountPoint.length >= best.length) {
+            best = mountPoint;
+            fstype = fields[separator + 1] ?? "";
+        }
+    }
+    return fstype;
+};
+/**
+ * One denied canary per deny path, or a refusal naming the first path whose
+ * denial this container cannot prove.
+ *
+ * Three cases, in decreasing strength:
+ *
+ *  - A **sealed** path (the datasets' root) must sit on a filesystem that
+ *    enforces unix ownership and must be observed *unenterable* by the worker
+ *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
+ *    is a boundary the worker can lift from inside a namespace of its own, and
+ *    the held-out test set is the one thing that cannot rest on it.
+ *  - Any other path on an ownership-enforcing filesystem — a host bind over
+ *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
+ *    is what makes the documented `refuse` default reachable: a host bind is
+ *    only unprovable where the filesystem says so.
+ *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
+ *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
+ *    `refuse` — the default — fails the recycle and writes no receipt;
+ *    `profile-only` accepts the attested deny entry as that path's only
+ *    boundary and names every such path in the supervisor log.
+ */
+export const resolveTrainingCanaries = async (options) => {
+    const canaries = [];
+    for (const target of options.denyPaths) {
+        const fstype = resolveBackingFilesystem(target, options.mountinfo);
+        const origin = `${options.hostBindPaths.includes(target) ? "a host bind mount on " : ""}${fstype || "an unknown filesystem"}`;
+        if (options.sealedPaths.includes(target)) {
+            if (isUnenforced(fstype)) {
+                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is backed by ${origin}, which ignores unix ownership, so the worker uid's denial cannot be proven; the sealed datasets must sit under a directory on an ownership-enforcing filesystem and no unenforcedBindPolicy waives this`);
+            }
+            if (!await options.probe(target, "enter")) {
+                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is still reachable by the worker uid`);
+            }
+        }
+        else if (isUnenforced(fstype)) {
+            if (options.unenforcedBindPolicy === "refuse") {
+                throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is backed by ${origin}, which ignores unix ownership; declare unenforcedBindPolicy "profile-only" to accept the bubblewrap deny list as its only boundary`);
+            }
+            options.log(`canary ${target} certified by the enforced sandbox profile only (${origin} ignores unix ownership)`);
+        }
+        else if (!await options.probe(target, "read")) {
+            throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is still readable by the worker uid`);
+        }
+        canaries.push({ path: target, method: "sandboxed-read", result: "denied" });
+    }
+    return canaries;
+};
+/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
+export const buildTrainingSlotReceipt = (input) => {
+    if (!/^[a-f0-9]{64}$/u.test(input.nonce))
+        throw new SpawnfileError("runtime_error", "Grok slot recycle nonce must be 32 random bytes in lowercase hex");
+    if (!Number.isSafeInteger(input.generation) || input.generation < 1)
+        throw new SpawnfileError("runtime_error", "Grok slot generation must be a positive integer");
+    if (input.canaries.length === 0)
+        throw new SpawnfileError("runtime_error", "Grok slot receipt requires at least one denied canary");
+    return {
+        version: DAIMON_GROK_ENGINE_BROKER.slotPreflightVersion,
+        slot: input.slot,
+        worker_uid: input.workerUid,
+        generation: input.generation,
+        nonce: input.nonce,
+        projection_sha256: input.projectionSha256,
+        sandbox_profile_sha256: input.sandboxProfileSha256,
+        seccomp_profile_sha256: input.seccompProfileSha256,
+        sandbox_runtime: "bubblewrap",
+        grok_executable_sha256: input.grokExecutableSha256,
+        canaries: [...input.canaries],
+        created_at: `${input.createdAt.toISOString().slice(0, 23)}Z`
+    };
+};
+/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
+export const readGrokExecutableSha256 = (executable = DAIMON_GROK_ENGINE_BROKER.grokExecutablePath) => {
+    const digest = createHash("sha256").update(readFileSync(executable)).digest("hex");
+    const pinned = [DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.arm64.sha256, DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.x64.sha256];
+    if (!pinned.includes(digest)) {
+        throw new SpawnfileError("runtime_error", `${path.basename(executable)} is not the manifest-pinned Grok ${DAIMON_GROK_ENGINE_BROKER.grokCliVersion} build`);
+    }
+    return digest;
+};

package/dist/compiler/training/broker/registration.d.ts

@@ -0,0 +1,41 @@
+import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../../runtime/daimon/contractManifest.js";
+import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
+/**
+ * The one training slot's deny list: Daimon's own protected set for a
+ * single-agent organization (Grok bootstrap, realm, and the slot state root that
+ * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
+ * the evaluator roots, the caller's protected `/run/paideia` paths, the broker
+ * control and registration roots, the grant home root, the inference ledger,
+ * the per-slot ledger, turn store and supervisor socket directory.
+ *
+ * The same two refusals the production render enforces apply here: an entry
+ * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
+ * the profile outright, and masks cannot nest, so an entry covered by another
+ * entry is a provisioning bug rather than something to silently drop.
+ */
+export declare const resolveTrainingGrokDenyPaths: (added?: readonly string[]) => string[];
+export interface TrainingGrokSlotInput {
+    agentId: string;
+    model: DaimonGrokBrokerModel;
+    reasoningEffort: DaimonGrokBrokerReasoningEffort;
+    /** Deny entries this container adds beyond Daimon's own protected set; defaults to the fixed training set. */
+    denyPaths?: readonly string[];
+    /**
+     * The declaration's per-turn limits. The broker registration must declare
+     * them, because a wake may only LOWER a declared limit: a trial whose wake
+     * ceiling exceeds the manifest defaults is refused as `invalid_request`.
+     */
+    limits?: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+}
+/**
+ * The single brokered Grok registration a training container runs, at the
+ * fixed container paths in `paths.ts`. Unlike production it points
+ * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
+ * separable and a recycle wipes it; the container-wide ledger and wake fuse do
+ * not exist here.
+ */
+export declare const resolveTrainingGrokRegistration: (input: TrainingGrokSlotInput) => DaimonGrokRegistration;