spawnfile 0.1.14 → 0.1.17

package/dist/runtime/daimon/adapter.js

@@ -0,0 +1,243 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { CLI_ENGINE_SKILL_BASE_DIRECTORIES, createAgentCapabilities, createDiagnostic, createDocumentFiles, createSkillFiles } from "../common.js";
+import { parseEveryScheduleMs } from "../scheduleUtils.js";
+import { createDaimonContainerTargets, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, DAIMON_CONFIG_FILE, DAIMON_CONTROL_PORT, DAIMON_ENGINES, resolveDaimonEngine } from "./config.js";
+import { resolveDaimonGrokModel } from "./grokModel.js";
+import { prepareDaimonRuntimeAuth } from "./runAuth.js";
+import { hasDaimonScheduleAuthority } from "./scheduleAuthority.js";
+import { resolveDaimonAttention } from "./attention.js";
+const assertDaimonSurfaces = (surfaces) => {
+    if (!surfaces)
+        return;
+    const enabled = Object.entries(surfaces)
+        .filter(([name]) => name !== "moltnet")
+        .filter(([, value]) => Array.isArray(value) ? value.length > 0 : value !== undefined)
+        .map(([name]) => name);
+    if (enabled.length > 0) {
+        throw new SpawnfileError("validation_error", `Daimon organization runtime v1 only lowers Moltnet agent surfaces; remove: ${enabled.sort().join(", ")}`);
+    }
+};
+const assertDaimonModel = (target) => {
+    if (target.provider === "openai" && target.auth.method === "codex" && !target.endpoint && !target.reasoningEffort)
+        return;
+    if (target.provider === "xai" && target.auth.method === "grok" && !target.endpoint)
+        return;
+    throw new SpawnfileError("validation_error", "Daimon organization runtime v1 accepts only the optional OpenAI Codex subscription intent or a brokered xAI Grok declaration; AGY engine auth stays Daimon-owned");
+};
+/**
+ * The compile-time warning for an agent that asked to be confined to its
+ * workspace on a runtime that does not confine anything.
+ *
+ * `restrict_to_workspace` is accepted by `validateRuntimeOptions` below (it is
+ * on the allowlist beside `engine`) and is then read by nothing under
+ * `src/runtime/daimon/`: the `noopolis.daimon.organization-runtime.v1` contract
+ * this adapter lowers into carries no workspace-confinement field, so the
+ * declaration reaches no runtime behavior at all. PicoClaw consumes an
+ * identically named option and really does lower it
+ * (`../picoclaw/adapter.ts`), which is exactly what makes the option look
+ * wired here.
+ *
+ * This warns rather than implementing confinement, because real workspace
+ * restriction for Daimon is a sandbox-profile change in daimon itself plus a
+ * widening of the digest-pinned organization runtime contract. It warns rather
+ * than rejecting, because an existing project that already declares the option
+ * must keep compiling. And it does not stay silent, because a security option
+ * that is accepted and ignored is a worse failure than one that is refused.
+ *
+ * Declaring `restrict_to_workspace: false` asks for nothing, so it says
+ * nothing.
+ */
+const daimonWorkspaceRestrictionWarning = (node) => {
+    const declared = node.runtime.options.restrict_to_workspace;
+    if (declared === undefined || declared === false)
+        return undefined;
+    return `Daimon organization runtime v1 does not enforce restrict_to_workspace: agent ${node.name} declares `
+        + "it, but no Daimon lowering reads the option and the organization runtime contract carries no workspace "
+        + "confinement field, so this agent's engine can reach the whole container filesystem. Move the agent to the "
+        + "picoclaw runtime, which lowers restrict_to_workspace into its agent defaults, or drop the option and treat "
+        + "the container boundary as this agent's only isolation.";
+};
+/**
+ * Workspace skill roots per Daimon engine.
+ *
+ * Codex and AGY keep both CLI-engine roots. A brokered Grok worker loads no
+ * workspace skill at all: Grok 1.0.34 discovers `.agents/skills` (never
+ * `.codex/skills`) only in a trusted folder, and Daimon keeps the workspace
+ * untrusted (root-owned empty `trusted_folders.toml`) and replaces the system
+ * prompt, whose fixed text references no skill. Emitting either root would ship
+ * files nothing reads, so none are emitted and the declaration is reported.
+ */
+export const daimonSkillBaseDirectories = (node) => resolveDaimonEngine(node) === "grok" ? [] : CLI_ENGINE_SKILL_BASE_DIRECTORIES;
+const daimonGrokSkillWarning = (node) => {
+    if (resolveDaimonEngine(node) !== "grok" || node.skills.length === 0)
+        return undefined;
+    return `Daimon Grok agent ${node.name} declares workspace skills (${node.skills.map((skill) => skill.name).sort().join(", ")}) `
+        + "that its brokered worker never loads: Grok discovers project skills only in a trusted workspace, and Daimon keeps the "
+        + "workspace untrusted and supplies instructions through the prompt. No skill files are emitted; move the guidance into the agent's docs.";
+};
+const daimonCodexPolicyError = (node) => {
+    if (node.runtime.options.codex_policy === undefined)
+        return undefined;
+    if (node.runtime.options.codex_policy !== "workspace-no-network") {
+        return "Daimon runtime option codex_policy must be workspace-no-network";
+    }
+    if (resolveDaimonEngine(node) !== "codex") {
+        return "Daimon runtime option codex_policy=workspace-no-network is only supported for Codex agents";
+    }
+    if (node.execution?.sandbox?.mode !== "workspace") {
+        return "Daimon runtime option codex_policy=workspace-no-network requires execution.sandbox.mode: workspace";
+    }
+    return undefined;
+};
+/**
+ * AGY is no longer excluded here.
+ *
+ * It used to be: an AGY agent that declared an MCP server or a Moltnet surface
+ * was rejected outright, because Daimon pinned AGY to `toolAccess: "none"`.
+ * Daimon now mounts AGY on the same per-wake MCP endpoint Codex and Grok get
+ * (`daimon/src/pi/cliMcpRegistration.ts`), so an AGY agent can take part in an
+ * organization, and the declaration this compiler lowers is one the runtime
+ * actually honours. The remaining validations are engine-independent and stay.
+ */
+const unsupportedAgentFeatures = (node) => {
+    for (const server of node.mcpServers) {
+        if (!server.tools?.length)
+            throw new SpawnfileError("validation_error", `Daimon MCP server ${server.name} requires an explicit tools allowlist`);
+        if (server.transport === "stdio" && !server.command?.startsWith("/"))
+            throw new SpawnfileError("validation_error", `Daimon stdio MCP server ${server.name} requires an absolute command`);
+    }
+    const engine = resolveDaimonEngine(node);
+    if (engine === "agy" && node.execution?.model) {
+        throw new SpawnfileError("validation_error", "Daimon AGY agents must omit Spawnfile execution.model; their subscription auth and model selection are Daimon-owned");
+    }
+    if (engine === "codex" && node.execution?.model?.primary.auth?.method === "grok") {
+        throw new SpawnfileError("validation_error", `Daimon Codex agent ${node.name} cannot declare Grok model auth`);
+    }
+    if (engine === "grok")
+        resolveDaimonGrokModel(node);
+};
+const scheduleCapabilityFor = async (node) => {
+    if (!node.schedule)
+        return {};
+    let authoritative = false;
+    try {
+        authoritative = await hasDaimonScheduleAuthority();
+    }
+    catch { /* The lowering gate reports invalid receipt details. */ }
+    if (!authoritative) {
+        return {
+            message: "Daimon v2 schedule state: degraded; the selected image receipt does not attest v2, so no schedule lowering is emitted",
+            outcome: "degraded"
+        };
+    }
+    if (node.schedule.kind === "disabled") {
+        return {
+            message: "Daimon v2 schedule state: disabled; normalized=disabled; persistence=none; timer=stopped",
+            outcome: "supported"
+        };
+    }
+    const normalized = node.schedule.kind === "every"
+        ? `every/${parseEveryScheduleMs(node.schedule.every)}ms`
+        : `cron/${node.schedule.cron.trim().replace(/\s+/gu, " ")}; zone=${node.schedule.timezone ?? "UTC"}`;
+    return {
+        message: `Daimon v2 schedule state: supported; normalized=${normalized}; persistence=sha256(agent+schedule) in durable acceptance root; timer=runtime-managed`,
+        outcome: "supported"
+    };
+};
+export const daimonAdapter = {
+    assertSupportedModelTarget: assertDaimonModel,
+    assertSupportedSurfaces: assertDaimonSurfaces,
+    container: {
+        configFileName: DAIMON_CONFIG_FILE,
+        configPathEnv: "SPAWNFILE_DAIMON_CONFIG",
+        env: [{
+                description: "Bearer token for the Daimon organization control API",
+                generated: true,
+                name: "SPAWNFILE_DAIMON_CONTROL_TOKEN",
+                required: true
+            }],
+        instancePaths: {
+            configPathTemplate: "<instance-root>/daimon/<config-file>",
+            sourceWorkspacePathTemplate: "<instance-root>/workspace/agents/<source-slug>",
+            workspacePathTemplate: "<instance-root>/workspace"
+        },
+        port: DAIMON_CONTROL_PORT,
+        portEnv: "SPAWNFILE_DAIMON_CONTROL_PORT",
+        standaloneBaseImage: "node:24-bookworm-slim",
+        startCommand: ["bash", "<runtime-root>/daimon-start.sh"],
+        systemDeps: [
+            "bash",
+            "bubblewrap",
+            "ca-certificates",
+            "curl",
+            "dbus-daemon",
+            "gnome-keyring",
+            "util-linux"
+        ]
+    },
+    async compileAgent(node) {
+        unsupportedAgentFeatures(node);
+        const scheduleCapability = await scheduleCapabilityFor(node);
+        const memorySelectionWarning = daimonMemorySelectionWarning(node);
+        const memoryVectorWarning = daimonMemoryVectorRecallWarning(node);
+        const workspaceRestrictionWarning = daimonWorkspaceRestrictionWarning(node);
+        const codexPolicyError = daimonCodexPolicyError(node);
+        const grokSkillWarning = daimonGrokSkillWarning(node);
+        return {
+            capabilities: createAgentCapabilities(node, {
+                mcpOutcome: "supported",
+                moltnetMessage: "Daimon exposes one scoped authenticated send tool during real cognition turns",
+                moltnetOutcome: "supported",
+                ...daimonMemoryCapabilityFor(node),
+                scheduleMessage: scheduleCapability.message,
+                scheduleOutcome: scheduleCapability.outcome
+            }),
+            diagnostics: [
+                ...(node.execution?.sandbox
+                    ? [createDiagnostic("warn", "Daimon runtime isolation is enforced by the selected runtime image")]
+                    : []),
+                ...(memorySelectionWarning ? [createDiagnostic("warn", memorySelectionWarning)] : []),
+                ...(memoryVectorWarning ? [createDiagnostic("warn", memoryVectorWarning)] : []),
+                ...(workspaceRestrictionWarning ? [createDiagnostic("warn", workspaceRestrictionWarning)] : []),
+                ...(grokSkillWarning ? [createDiagnostic("warn", grokSkillWarning)] : []),
+                ...(codexPolicyError ? [createDiagnostic("error", codexPolicyError)] : [])
+            ],
+            files: [
+                ...createDocumentFiles("workspace", node.docs),
+                ...createSkillFiles(daimonSkillBaseDirectories(node), node.skills)
+            ]
+        };
+    },
+    createContainerTargets: createDaimonContainerTargets,
+    name: "daimon",
+    prepareRuntimeAuth: prepareDaimonRuntimeAuth,
+    systemInstructionSurface: {
+        placement: "append_pointer",
+        resolvePath() {
+            return "workspace/AGENTS.md";
+        }
+    },
+    validateRuntimeOptions(options) {
+        const diagnostics = [];
+        if (options.engine !== undefined &&
+            (typeof options.engine !== "string" || !DAIMON_ENGINES.includes(options.engine))) {
+            diagnostics.push(createDiagnostic("error", `Daimon runtime option engine must be one of ${DAIMON_ENGINES.join(", ")}`));
+        }
+        for (const key of Object.keys(options).filter((key) => !["engine", "restrict_to_workspace", "codex_policy", "attention"].includes(key))) {
+            diagnostics.push(createDiagnostic("error", `Daimon runtime option ${key} is not part of organization runtime v1`));
+        }
+        if (options.codex_policy !== undefined && options.codex_policy !== "workspace-no-network") {
+            diagnostics.push(createDiagnostic("error", "Daimon runtime option codex_policy must be workspace-no-network"));
+        }
+        if (options.codex_policy === "workspace-no-network" && options.engine !== undefined && options.engine !== "codex") {
+            diagnostics.push(createDiagnostic("error", "Daimon runtime option codex_policy=workspace-no-network is only supported for Codex agents"));
+        }
+        try {
+            resolveDaimonAttention(options.attention);
+        }
+        catch (error) {
+            diagnostics.push(createDiagnostic("error", error instanceof Error ? error.message : "Daimon attention is invalid"));
+        }
+        return diagnostics;
+    }
+};

package/dist/runtime/daimon/attention.d.ts

@@ -0,0 +1,8 @@
+export type DaimonAttention = Readonly<{
+    maxBatchMessages: number;
+    maxBatchBytes: number;
+    maxExecutions?: number;
+    maxTokens?: number;
+}>;
+export declare const resolveDaimonAttention: (value: unknown) => DaimonAttention | undefined;
+export declare const assertDaimonAttentionAuthority: () => Promise<void>;

package/dist/runtime/daimon/attention.js

@@ -0,0 +1,32 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { hasDaimonScheduleAuthority } from "./scheduleAuthority.js";
+const fields = {
+    max_batch_messages: { target: "maxBatchMessages", minimum: 1, maximum: 32 },
+    max_batch_bytes: { target: "maxBatchBytes", minimum: 1024, maximum: 12000 },
+    max_executions: { target: "maxExecutions", minimum: 1, maximum: Number.MAX_SAFE_INTEGER },
+    max_tokens: { target: "maxTokens", minimum: 1, maximum: Number.MAX_SAFE_INTEGER }
+};
+export const resolveDaimonAttention = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new SpawnfileError("validation_error", "Daimon runtime option attention must be an object");
+    }
+    const result = { maxBatchMessages: 8, maxBatchBytes: 12000 };
+    for (const [key, limit] of Object.entries(value)) {
+        if (!Object.hasOwn(fields, key)) {
+            throw new SpawnfileError("validation_error", `Daimon runtime option attention.${key} is unsupported`);
+        }
+        const field = fields[key];
+        if (typeof limit !== "number" || !Number.isSafeInteger(limit) || limit < field.minimum || limit > field.maximum) {
+            throw new SpawnfileError("validation_error", `Daimon runtime option attention.${key} must be an integer from ${field.minimum} to ${field.maximum}`);
+        }
+        result[field.target] = limit;
+    }
+    return result;
+};
+export const assertDaimonAttentionAuthority = async () => {
+    if (!await hasDaimonScheduleAuthority()) {
+        throw new SpawnfileError("runtime_error", "Daimon attention is disabled: the selected image capability receipt does not attest its runtime contract");
+    }
+};

package/dist/runtime/daimon/config.d.ts

@@ -0,0 +1,25 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+import type { ContainerTarget, ContainerTargetInput } from "../types.js";
+import { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory } from "./memory.js";
+export declare const DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY: {
+    readonly mode: "workspace-write";
+    readonly networkAccess: false;
+    readonly webSearch: "disabled";
+};
+export { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory };
+export declare const DAIMON_CONFIG_FILE = "daimon-organization-runtime.json";
+export declare const DAIMON_CONTROL_PORT = 19700;
+export declare const DAIMON_MAX_AGENTS = 32;
+export declare const DAIMON_ORGANIZATION_TARGET_ID = "daimon-organization";
+export declare const DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY = "state/wake-acceptance";
+export declare const DAIMON_RUNTIME_ACCEPTANCE_STORE_ENV = "DAIMON_RUNTIME_ACCEPTANCE_STORE";
+export declare const DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID = "daimon-organization-acceptance-store";
+export declare const DAIMON_RUNTIME_READINESS_RECEIPT_ENV = "DAIMON_RUNTIME_READINESS_RECEIPT";
+export declare const DAIMON_WAKE_FUSE_DIRECTORY = "/var/lib/spawnfile/daimon/wake-fuse";
+export declare const DAIMON_WAKE_FUSE_DIRECTORY_ENV = "DAIMON_WAKE_FUSE_DIRECTORY";
+export declare const DAIMON_WAKE_FUSE_MOUNT_ID = "daimon-wake-fuse";
+export declare const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
+export declare const DAIMON_ENGINES: readonly ["agy", "codex", "grok"];
+type DaimonEngine = typeof DAIMON_ENGINES[number];
+export declare const resolveDaimonEngine: (node: ResolvedAgentNode) => DaimonEngine;
+export declare const createDaimonContainerTargets: (inputs: ContainerTargetInput[]) => Promise<ContainerTarget[]>;

package/dist/runtime/daimon/config.js

@@ -0,0 +1,272 @@
+import path from "node:path";
+import { parseEveryScheduleMs } from "../scheduleUtils.js";
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_ENGINE_CREDENTIALS, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "./contractManifest.js";
+import { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory } from "./memory.js";
+import { assertDaimonScheduleAuthority } from "./scheduleAuthority.js";
+import { assertDaimonAttentionAuthority, resolveDaimonAttention } from "./attention.js";
+import { resolveDaimonGrokModel } from "./grokModel.js";
+export const DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY = { mode: "workspace-write", networkAccess: false, webSearch: "disabled" };
+// Re-exported so every existing importer of these names keeps working; the
+// definitions themselves now live in `./memory.js`.
+export { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory };
+export const DAIMON_CONFIG_FILE = "daimon-organization-runtime.json";
+export const DAIMON_CONTROL_PORT = 19700;
+export const DAIMON_MAX_AGENTS = 32;
+export const DAIMON_ORGANIZATION_TARGET_ID = "daimon-organization";
+export const DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY = "state/wake-acceptance";
+export const DAIMON_RUNTIME_ACCEPTANCE_STORE_ENV = "DAIMON_RUNTIME_ACCEPTANCE_STORE";
+export const DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID = "daimon-organization-acceptance-store";
+export const DAIMON_RUNTIME_READINESS_RECEIPT_ENV = "DAIMON_RUNTIME_READINESS_RECEIPT";
+export const DAIMON_WAKE_FUSE_DIRECTORY = "/var/lib/spawnfile/daimon/wake-fuse";
+export const DAIMON_WAKE_FUSE_DIRECTORY_ENV = "DAIMON_WAKE_FUSE_DIRECTORY";
+export const DAIMON_WAKE_FUSE_MOUNT_ID = "daimon-wake-fuse";
+export const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
+const DAIMON_MAX_CONFIG_BYTES = 1_048_576;
+const DAIMON_MAX_INSTRUCTION_BYTES = 16_384;
+const DAIMON_MAX_INSTRUCTION_CODEPOINTS = 16_384;
+export const DAIMON_ENGINES = ["agy", "codex", "grok"];
+const normalizeSchedule = (node) => {
+    const schedule = node.schedule;
+    if (!schedule || schedule.kind === "disabled")
+        return schedule ? { kind: "disabled" } : undefined;
+    if (schedule.kind === "every") {
+        const interval_ms = parseEveryScheduleMs(schedule.every);
+        if (interval_ms === null)
+            throw new SpawnfileError("validation_error", `invalid every schedule for ${node.name}`);
+        return {
+            kind: "every", interval_ms, prompt: schedule.prompt ?? "Scheduled work",
+            ...(schedule.jitter_seconds === undefined ? {} : { jitter_seconds: schedule.jitter_seconds })
+        };
+    }
+    return {
+        cron: schedule.cron.trim().replace(/\s+/gu, " "),
+        kind: "cron",
+        prompt: schedule.prompt ?? "Scheduled work",
+        timezone: schedule.timezone ?? "UTC",
+        ...(schedule.jitter_seconds === undefined ? {} : { jitter_seconds: schedule.jitter_seconds })
+    };
+};
+const formatInstructions = (node) => node.docs.map((document) => `# ${document.role}\n\n${document.content}`).join("\n\n").trim() ||
+    `You are ${node.name}. Follow the workspace instructions.`;
+const assertPublicInstructionBounds = (agentId, instructions) => {
+    if (Buffer.byteLength(instructions, "utf8") > DAIMON_MAX_INSTRUCTION_BYTES ||
+        [...instructions].length > DAIMON_MAX_INSTRUCTION_CODEPOINTS) {
+        throw new SpawnfileError("validation_error", `Daimon organization runtime v1 instructions for ${agentId} exceed Daimon's public config limit`);
+    }
+};
+export const resolveDaimonEngine = (node) => {
+    const engine = node.runtime.options.engine ?? "codex";
+    if (typeof engine === "string" && DAIMON_ENGINES.includes(engine)) {
+        return engine;
+    }
+    throw new SpawnfileError("validation_error", `Daimon runtime option engine must be one of ${DAIMON_ENGINES.join(", ")}`);
+};
+const resolveDaimonEngineConfig = (node) => {
+    const kind = resolveDaimonEngine(node);
+    if (kind === "grok") {
+        const declared = resolveDaimonGrokModel(node);
+        return { kind, model: declared.model, reasoningEffort: declared.reasoningEffort };
+    }
+    const model = kind === "codex" ? node.execution?.model?.primary?.name : undefined;
+    const codexSandbox = kind === "codex" && node.runtime.options.codex_policy === "workspace-no-network"
+        ? DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY
+        : undefined;
+    return {
+        kind,
+        ...(model === undefined ? {} : { model }),
+        ...(codexSandbox === undefined ? {} : { codexSandbox })
+    };
+};
+const moveWorkspaceFile = (file, slug) => file.path.startsWith("workspace/")
+    ? { ...file, path: path.posix.join("workspace", "agents", slug, file.path.slice("workspace/".length)) }
+    : file;
+const renderStartScript = (agents) => {
+    const acceptanceStorePath = `<instance-root>/${DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY}`;
+    const readinessReceiptPath = `${acceptanceStorePath}/runtime-readiness.json`;
+    const setup = agents.flatMap((agent) => {
+        const credential = agent.engine.kind === "codex"
+            ? DAIMON_ENGINE_CREDENTIALS.codex
+            : undefined;
+        const inbound = path.posix.join(agent.runtimeHomePath, ".daimon-inbound");
+        return [
+            // The workspace mode is owned by the uid entrypoint, which grants a grok worker
+            // group access. Forcing 0700 here would lock that worker out of its own workspace,
+            // so create it only when absent and never restate the mode of an existing directory.
+            `[ -d ${JSON.stringify(agent.workspacePath)} ] || install -d -m 700 ${JSON.stringify(agent.workspacePath)}`,
+            // A Grok agent's runtime home is traversable by its worker's group (the
+            // broker provisioning grants `0710` so the worker can read its setgid
+            // `tool-output/` spills); restating 0700 here would revoke that.
+            agent.engine.kind === "grok"
+                ? `[ -d ${JSON.stringify(agent.runtimeHomePath)} ] || install -d -m 700 ${JSON.stringify(agent.runtimeHomePath)}`
+                : `install -d -m 700 ${[
+                    agent.runtimeHomePath,
+                    ...(credential === undefined ? [] : [inbound])
+                ].map((entry) => JSON.stringify(entry)).join(" ")}`,
+            ...(credential === undefined ? [] : [
+                `if [ -e ${JSON.stringify(path.posix.join(agent.runtimeHomePath, credential.sourceRelativePath))} ]; then test "$(stat -c %a ${JSON.stringify(path.posix.join(agent.runtimeHomePath, credential.sourceRelativePath))})" = 600; fi`
+            ])
+        ];
+    });
+    return [
+        "#!/usr/bin/env bash",
+        "set -euo pipefail",
+        `install -d -m 700 ${JSON.stringify(acceptanceStorePath)}`,
+        `export ${DAIMON_RUNTIME_ACCEPTANCE_STORE_ENV}=${JSON.stringify(acceptanceStorePath)}`,
+        `rm -f ${JSON.stringify(readinessReceiptPath)}`,
+        `export ${DAIMON_RUNTIME_READINESS_RECEIPT_ENV}=${JSON.stringify(readinessReceiptPath)}`,
+        ...setup,
+        'if [ "$#" -gt 0 ]; then exec daimon-runtime "$@"; fi',
+        "exec daimon-runtime run --config <config-path>"
+    ].join("\n") + "\n";
+};
+export const createDaimonContainerTargets = async (inputs) => {
+    const agents = inputs.filter((input) => input.kind === "agent" && input.value.kind === "agent");
+    if (agents.length === 0)
+        return [];
+    if (agents.length > DAIMON_MAX_AGENTS) {
+        throw new SpawnfileError("validation_error", `Daimon organization runtime v1 supports at most 32 agents; found ${agents.length}. Split the organization across explicit runtime boundaries.`);
+    }
+    const hasSchedules = agents.some((input) => input.value.schedule !== undefined);
+    const attentionById = new Map(agents.map((input) => [input.id, resolveDaimonAttention(input.value.runtime.options.attention)]));
+    const hasAttention = [...attentionById.values()].some((attention) => attention !== undefined);
+    if (hasAttention)
+        await assertDaimonAttentionAuthority();
+    if (hasSchedules)
+        await assertDaimonScheduleAuthority();
+    const configAgents = agents
+        .map((input) => {
+        const memory = resolveDaimonAgentMemory(input.value);
+        return {
+            engine: resolveDaimonEngineConfig(input.value),
+            id: input.id,
+            instructions: formatInstructions(input.value),
+            name: input.value.name,
+            ...(input.value.mcpServers.length === 0 ? {} : { mcp: input.value.mcpServers.map((server) => ({
+                    name: server.name, transport: server.transport, args: server.args ?? [], env: server.env ?? {}, tools: server.tools,
+                    ...(server.command ? { command: server.command } : {}), ...(server.url ? { url: server.url } : {}),
+                    ...(server.auth?.mode === "bearer" ? { authSecretEnv: server.auth.secret } : {})
+                })) }),
+            ...(memory ? { memory } : {}),
+            ...(attentionById.get(input.id) === undefined ? {} : { attention: attentionById.get(input.id) }),
+            ...(input.value.surfaces?.moltnet?.length ? { moltnet: {
+                    cliPath: "/usr/local/bin/moltnet",
+                    configPath: `<workspace-path>/agents/${input.slug}/.moltnet/config.json`,
+                    networks: input.value.surfaces.moltnet.map((attachment) => ({ id: attachment.network, rooms: Object.keys(attachment.rooms ?? {}).sort(), dms: attachment.dms?.enabled === true }))
+                } } : {}),
+            runtimeHomePath: `<instance-root>/${DAIMON_RUNTIME_HOMES_DIRECTORY}/${input.slug}`,
+            workspacePath: `<workspace-path>/agents/${input.slug}`,
+            ...(hasSchedules || hasAttention ? { schedule: normalizeSchedule(input.value) ?? { kind: "disabled" } } : {})
+        };
+    })
+        .sort((left, right) => left.id.localeCompare(right.id));
+    const engineByNodeId = Object.fromEntries(configAgents.map((agent) => [agent.id, agent.engine.kind]));
+    const grokModelByNodeId = Object.fromEntries(configAgents
+        .filter((agent) => agent.engine.kind === "grok" && agent.engine.model !== undefined && agent.engine.reasoningEffort !== undefined)
+        .map((agent) => [agent.id, { model: agent.engine.model, reasoningEffort: agent.engine.reasoningEffort }]));
+    const hasAgy = configAgents.some((agent) => agent.engine.kind === "agy");
+    const hasGrok = configAgents.some((agent) => agent.engine.kind === "grok");
+    const agyRuntimeHomeMounts = configAgents
+        .filter((agent) => agent.engine.kind === "agy")
+        .map((agent) => ({
+        id: `daimon-agy-runtime-home-${path.posix.basename(agent.runtimeHomePath)}`,
+        mountPath: agent.runtimeHomePath,
+        reason: `Daimon AGY subscription runtime home for ${agent.id}`
+    }));
+    const portableEngineHomeMounts = configAgents
+        .filter((agent) => agent.engine.kind !== "agy")
+        .map((agent) => {
+        const destinationRelativePath = agent.engine.kind === "grok"
+            ? DAIMON_GROK_SUBSCRIPTION_REALM.agentCredentialRelativePath
+            : DAIMON_ENGINE_CREDENTIALS.codex.destinationRelativePath;
+        return {
+            id: `daimon-engine-home-${agent.engine.kind}-${path.posix.basename(agent.runtimeHomePath)}`,
+            mountPath: path.posix.join(agent.runtimeHomePath, path.posix.dirname(destinationRelativePath)),
+            reason: `Daimon ${agent.engine.kind} subscription credential home for ${agent.id}`
+        };
+    });
+    const toolStateMounts = configAgents.map((agent) => ({ id: `daimon-tool-state-${path.posix.basename(agent.runtimeHomePath)}`, mountPath: path.posix.join(agent.runtimeHomePath, "tool-state"), reason: `Daimon durable cognition tool receipts for ${agent.id}` }));
+    for (const agent of configAgents)
+        assertPublicInstructionBounds(agent.id, agent.instructions);
+    const config = {
+        agents: configAgents,
+        host: {
+            bindHost: "127.0.0.1",
+            controlTokenEnv: "SPAWNFILE_DAIMON_CONTROL_TOKEN",
+            port: DAIMON_CONTROL_PORT
+        },
+        version: hasSchedules || hasAttention
+            ? "noopolis.daimon.organization-runtime.v2"
+            : "noopolis.daimon.organization-runtime.v1"
+    };
+    const serializedConfig = `${JSON.stringify(config, null, 2)}\n`;
+    if (Buffer.byteLength(serializedConfig, "utf8") > DAIMON_MAX_CONFIG_BYTES) {
+        throw new SpawnfileError("validation_error", "Daimon organization runtime v1 config exceeds Daimon's public config limit");
+    }
+    return [{
+            engineByNodeId,
+            ...(hasGrok ? { grokModelByNodeId } : {}),
+            files: [
+                ...agents.flatMap((input) => input.emittedFiles.map((file) => moveWorkspaceFile(file, input.slug))),
+                { content: serializedConfig, path: DAIMON_CONFIG_FILE },
+                {
+                    content: renderStartScript(configAgents),
+                    mode: 0o755,
+                    path: "runtime/daimon-start.sh"
+                }
+            ],
+            id: DAIMON_ORGANIZATION_TARGET_ID,
+            ...(hasAgy || hasGrok ? {
+                opaqueMountTargets: [
+                    ...(hasAgy ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath] : []),
+                    ...(hasGrok ? [DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath] : [])
+                ],
+            } : {}),
+            persistentMounts: [...portableEngineHomeMounts, ...toolStateMounts, {
+                    id: DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID,
+                    mountPath: `<instance-root>/${DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY}`,
+                    reason: "Daimon organization durable wake acceptance store"
+                }, {
+                    id: DAIMON_WAKE_FUSE_MOUNT_ID,
+                    lifecycle: "exclusive-reattach",
+                    mountPath: DAIMON_WAKE_FUSE_DIRECTORY,
+                    reason: "Daimon durable wake-fuse admission ledger"
+                }, ...(hasGrok ? [{
+                        id: "daimon-grok-subscription-realm",
+                        lifecycle: "exclusive-reattach",
+                        mountPath: DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
+                        reason: "Daimon host Grok subscription credential realm"
+                    }] : []), {
+                    // Non-run-scoped for the same reason as the durable memory mounts (see
+                    // durableMemoryVolumeName in src/compiler/memoryArtifacts.ts): a
+                    // run-scoped volume means every `spawnfile up` starts a new empty
+                    // ledger and cross-deployment usage accounting is impossible. The
+                    // exclusive reservation this lifecycle carries is a requirement, not a
+                    // cost.
+                    // The mount id is deliberately unchanged now that AGY and Codex write
+                    // here too, not just the broker: it is the volume's identity, and
+                    // renaming it would orphan every existing deployment's accumulated
+                    // ledger. Unconditional (not gated on hasGrok/hasAgy) because Daimon's
+                    // wake fuse now refuses to arm at all if this directory or the ledger
+                    // file inside it is missing or unreadable (`wakeFuse.ts`,
+                    // `ensureUsageLedgerReadable`), and Codex also writes here
+                    // (`engineDispatcher.ts`'s `onTurnUsage`) even in a codex-only
+                    // organization with no Grok or AGY agent at all.
+                    id: "daimon-grok-usage-ledger",
+                    lifecycle: "exclusive-reattach",
+                    mountPath: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath,
+                    reason: "Daimon per-turn engine usage ledger"
+                }, ...(hasAgy ? [{
+                        id: "daimon-agy-subscription-realm",
+                        // The AGY subscription credential is an OS-keyring entry created by an
+                        // interactive browser OAuth that has no headless equivalent; it lives
+                        // in this volume. Without this lifecycle the volume name folds in the
+                        // run id, so every `spawnfile up` would hand the container an empty
+                        // keyring and the operator would have to re-enrol by hand.
+                        lifecycle: "exclusive-reattach",
+                        mountPath: DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath,
+                        reason: "Daimon host AGY subscription realm"
+                    }, ...agyRuntimeHomeMounts] : [])],
+            sourceIds: agents.map((agent) => agent.id).sort()
+        }];
+};