spawnfile 0.1.14 → 0.1.18

package/dist/compiler/buildCompilePlanAgent.js

@@ -9,13 +9,14 @@ import { assertRuntimeSupportsExecutionModelAuth } from "./modelAuth.js";
 import { loadResolvedSkills, mergeResolvedSkills } from "./surfaces.js";
 import { assertRuntimeSupportsAgentSurfaces } from "./surfaceSupport.js";
 import { mergeWorkspaceResources } from "./workspaceResources.js";
+import { mergeTrainingDeclarations, resolveTrainingDeclaration } from "./training/resolution.js";
 export const resolveAgentNode = async ({ context, manifest, manifestPath, source }) => {
     const runtime = await resolveRuntime(manifest, context);
     const execution = applyExecutionDefaults(context.isSubagent
         ? mergeExecution(context.inheritedExecution, manifest.execution)
         : manifest.execution);
     assertRuntimeSupportsExecutionModelAuth(runtime.name, execution, manifest.name);
-    const environment = resolveEffectiveEnvironment(context.inheritedShared?.surface?.environment, manifest.environment);
+    const environment = resolveEffectiveEnvironment(manifest.name, context.inheritedShared?.surface?.environment, manifest.environment);
     const inheritedSkills = context.inheritedShared
         ? await loadResolvedSkills(context.inheritedShared.manifestPath, context.inheritedShared.surface?.workspace?.skills)
         : [];
@@ -49,6 +50,7 @@ export const resolveAgentNode = async ({ context, manifest, manifestPath, source
         ...(source === manifestPath ? {} : { sourcePath: manifestPath }),
         surfaces: resolveAgentSurfaces(manifest.surfaces),
         subagents: [],
+        training: mergeTrainingDeclarations(resolveTrainingDeclaration(context.inheritedShared?.surface?.training, context.inheritedShared?.manifestPath ?? manifestPath, context.inheritedShared?.manifestPath ?? source), resolveTrainingDeclaration(manifest.training, manifestPath, source)),
         workspaceResources
     };
     assertRuntimeSupportsAgentSurfaces(runtime.name, candidate.surfaces, manifest.name);

package/dist/compiler/buildCompilePlanTeams.d.ts

@@ -1,4 +1,4 @@
-import type { TeamManifest } from "../manifest/index.js";
+import { type TeamManifest } from "../manifest/index.js";
 import type { ResolvedTeamNetwork, ResolvedTeamNode } from "./types.js";
 export declare const resolveTeamExternalIds: (manifest: TeamManifest) => string[];
 export declare const resolveTeamNetworks: (manifest: TeamManifest) => ResolvedTeamNetwork[];

package/dist/compiler/buildCompilePlanTeams.js

@@ -1,3 +1,4 @@
+import { isDeclaredPairedRemoteRoomMember } from "../manifest/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export const resolveTeamExternalIds = (manifest) => {
     const memberIds = manifest.members.map((member) => member.id);
@@ -20,6 +21,9 @@ export const resolveTeamNetworks = (manifest) => (manifest.networks ?? []).map((
         name: network.name ?? network.id,
         provider: network.provider,
         rooms: network.rooms.map((room) => ({
+            ...(room.federation
+                ? { federation: Array.isArray(room.federation) ? [...room.federation].sort() : room.federation }
+                : {}),
             id: room.id,
             members: [...room.members],
             ...(room.name ? { name: room.name } : {}),
@@ -40,7 +44,8 @@ export const validateTeamNetworkRooms = (teamNode) => {
             for (const roomMemberId of room.members) {
                 const resolvedMember = teamNode.members.find((member) => member.id === roomMemberId);
                 if (!resolvedMember
-                    && !isAttachedExternalRoomMember(teamNode, network.id, roomMemberId)) {
+                    && !isAttachedExternalRoomMember(teamNode, network.id, roomMemberId)
+                    && !isDeclaredPairedRemoteRoomMember(network, room, roomMemberId)) {
                     throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${roomMemberId}`);
                 }
             }

package/dist/compiler/buildCompilePlanTraversal.js

@@ -11,6 +11,7 @@ import { mergeWorkspaceResources } from "./workspaceResources.js";
 import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, } from "./buildCompilePlanTraversalHelpers.js";
 import { resolveAgentNode } from "./buildCompilePlanAgent.js";
 import { createInlineAgentSource } from "./projectManifestGraph.js";
+import { resolveTrainingDeclaration } from "./training/resolution.js";
 export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, fingerprintCache, edges, memberships }) => {
     const visitStack = [];
     const recordAgentMembership = (teamSource, teamName, memberId, agent) => {
@@ -128,6 +129,7 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
                 skills: sharedSkills
             },
             source: canonicalPath,
+            training: resolveTrainingDeclaration(manifest.shared?.training, canonicalPath, canonicalPath)
         };
         const fingerprint = getTeamFingerprint(candidate);
         const existingFingerprint = fingerprintCache.get(canonicalPath);

package/dist/compiler/buildCompilePlanTraversalHelpers.d.ts

@@ -1,4 +1,4 @@
-import { type Environment, type McpServer, type Secret, type TeamWorkspace } from "../manifest/index.js";
+import { type Environment, type McpServer, type Secret, type SharedEnvironment, type TeamWorkspace } from "../manifest/index.js";
 import { ResolvedDocument, ResolvedPackage, ResolvedAgentNode, ResolvedTeamNode } from "./types.js";
 export declare const DEFAULT_POLICY_MODE = "warn";
 export declare const DEFAULT_POLICY_ON_DEGRADE = "warn";
@@ -9,7 +9,7 @@ export type InternalNode = {
 };
 type ResolvedPackageArray = ResolvedPackage[] | undefined;
 export declare const mergeResolvedDocuments: (primaryPath: string, primaryDocs: TeamWorkspace["docs"] | undefined, fallbackPath: string | undefined, fallbackDocs: TeamWorkspace["docs"] | undefined) => Promise<ResolvedDocument[]>;
-export declare const resolveEffectiveEnvironment: (sharedEnvironment: Environment | undefined, localEnvironment: Environment | undefined) => {
+export declare const resolveEffectiveEnvironment: (agentName: string, sharedEnvironment: SharedEnvironment | undefined, localEnvironment: Environment | undefined) => {
     env: Record<string, string>;
     mcpServers: McpServer[];
     packages: ResolvedPackageArray;

package/dist/compiler/buildCompilePlanTraversalHelpers.js

@@ -1,4 +1,5 @@
-import { loadResolvedDocuments, mergeEnv, mergeMcpServers, mergePackages, mergeSecrets } from "./surfaces.js";
+import { loadResolvedDocuments, mergeEnv, mergePackages, mergeSecrets } from "./surfaces.js";
+import { resolveInheritedMcpServers } from "./mcpServerInheritance.js";
 export const DEFAULT_POLICY_MODE = "warn";
 export const DEFAULT_POLICY_ON_DEGRADE = "warn";
 export const mergeResolvedDocuments = async (primaryPath, primaryDocs, fallbackPath, fallbackDocs) => {
@@ -14,9 +15,9 @@ export const mergeResolvedDocuments = async (primaryPath, primaryDocs, fallbackP
     }
     return [...merged.values()];
 };
-export const resolveEffectiveEnvironment = (sharedEnvironment, localEnvironment) => ({
+export const resolveEffectiveEnvironment = (agentName, sharedEnvironment, localEnvironment) => ({
     env: mergeEnv(sharedEnvironment?.env, localEnvironment?.env),
-    mcpServers: mergeMcpServers(sharedEnvironment?.mcp_servers, localEnvironment?.mcp_servers),
+    mcpServers: resolveInheritedMcpServers(agentName, sharedEnvironment?.mcp_servers, localEnvironment?.mcp_servers),
     packages: mergePackages(sharedEnvironment?.packages, localEnvironment?.packages),
     secrets: mergeSecrets(sharedEnvironment?.secrets, localEnvironment?.secrets)
 });

package/dist/compiler/buildProject.d.ts

@@ -29,6 +29,7 @@ export interface BuildProjectResult extends CompileProjectResult {
     imageTag: string;
 }
 export declare const createDefaultImageTag: (projectRoot: string) => string;
+export declare const resolveImageTagRoot: (inputPath: string) => string;
 export declare const createDockerBuildInvocation: (outputDirectory: string, imageTag: string, options?: string | {
     dockerCommand?: string;
     dockerContext?: string;
@@ -37,3 +38,12 @@ export declare const normalizeDockerArchitecture: (architecture: string) => Molt
 export declare const resolveDockerBuildArchitecture: (options: Pick<BuildProjectOptions, "dockerCommand" | "dockerContext">) => Promise<MoltnetTargetArchitecture | undefined>;
 export declare const runDockerBuild: DockerBuildRunner;
 export declare const buildProject: (inputPath: string, options?: BuildProjectOptions) => Promise<BuildProjectResult>;
+/**
+ * The image half of `buildProject`, for callers that compiled first and need
+ * the build-context identity before deciding whether to build at all (a
+ * release no-ops on an unchanged identity without touching Docker).
+ * `contextDigest` may be passed when the caller already computed it.
+ */
+export declare const buildCompiledProject: (inputPath: string, compileResult: CompileProjectResult, options?: Omit<BuildProjectOptions, keyof CompileProjectOptions> & {
+    contextDigest?: string;
+}) => Promise<BuildProjectResult>;

package/dist/compiler/buildProject.js

@@ -13,7 +13,7 @@ export const createDefaultImageTag = (projectRoot) => {
     const baseName = slugify(path.basename(projectRoot));
     return `spawnfile-${baseName || "project"}`;
 };
-const resolveImageTagRoot = (inputPath) => {
+export const resolveImageTagRoot = (inputPath) => {
     const resolvedPath = path.resolve(inputPath);
     return path.basename(resolvedPath).toLowerCase() === "spawnfile"
         ? path.dirname(resolvedPath)
@@ -78,6 +78,9 @@ export const runDockerBuild = async (invocation) => new Promise((resolve, reject
 export const buildProject = async (inputPath, options = {}) => {
     const targetArchitecture = options.containerArchitecture ?? await resolveDockerBuildArchitecture(options);
     const compileResult = await compileProject(inputPath, {
+        ...(options.bundleCacheDirectory !== undefined ? { bundleCacheDirectory: options.bundleCacheDirectory } : {}),
+        ...(options.bundleIdentity !== undefined ? { bundleIdentity: options.bundleIdentity } : {}),
+        ...(options.bundleDockerCommand ?? options.dockerCommand ? { bundleDockerCommand: options.bundleDockerCommand ?? options.dockerCommand } : {}),
         clean: options.clean,
         containerArchitecture: targetArchitecture,
         outputDirectory: options.outputDirectory,
@@ -86,6 +89,15 @@ export const buildProject = async (inputPath, options = {}) => {
             ? { worldBindingsPath: options.worldBindingsPath }
             : {})
     });
+    return buildCompiledProject(inputPath, compileResult, options);
+};
+/**
+ * The image half of `buildProject`, for callers that compiled first and need
+ * the build-context identity before deciding whether to build at all (a
+ * release no-ops on an unchanged identity without touching Docker).
+ * `contextDigest` may be passed when the caller already computed it.
+ */
+export const buildCompiledProject = async (inputPath, compileResult, options = {}) => {
     const imageTag = options.imageTag ?? createDefaultImageTag(resolveImageTagRoot(inputPath));
     const invocation = createDockerBuildInvocation(compileResult.outputDirectory, imageTag, {
         dockerCommand: options.dockerCommand,
@@ -96,7 +108,7 @@ export const buildProject = async (inputPath, options = {}) => {
     const contextDigestStartedAt = performance.now();
     const [contextFiles, contextDigest] = await Promise.all([
         listDockerBuildContextFiles(compileResult.outputDirectory),
-        createDockerBuildContextDigest(compileResult.outputDirectory)
+        options.contextDigest ?? createDockerBuildContextDigest(compileResult.outputDirectory)
     ]);
     const contextDigestMs = performance.now() - contextDigestStartedAt;
     let probeMs = 0;

package/dist/compiler/cleanCompileOutput.d.ts

@@ -0,0 +1,2 @@
+/** Deployment records and histories are host state, not replaceable compile output. */
+export declare const cleanCompileOutput: (directory: string) => Promise<void>;

package/dist/compiler/cleanCompileOutput.js

@@ -0,0 +1,14 @@
+import path from "node:path";
+import { readdir, rm } from "node:fs/promises";
+/** Deployment records and histories are host state, not replaceable compile output. */
+export const cleanCompileOutput = async (directory) => {
+    const entries = await readdir(directory).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    for (const entry of entries)
+        if (entry !== "deployments") {
+            await rm(path.join(directory, entry), { recursive: true, force: true });
+        }
+};

package/dist/compiler/compilePlanHelpers.js

@@ -26,6 +26,7 @@ export const getAgentFingerprint = (node) => stableStringify({
         requiresMcp: skill.requiresMcp
     })),
     surfaces: node.surfaces,
+    training: node.training,
     workspaceResources: node.workspaceResources
 });
 export const getTeamFingerprint = (node) => stableStringify({
@@ -35,6 +36,7 @@ export const getTeamFingerprint = (node) => stableStringify({
     lead: node.lead,
     external: node.external,
     networks: node.networks ?? [],
+    training: node.training,
     workspaceResources: node.workspaceResources,
     shared: {
         env: node.shared.env,
@@ -55,6 +57,9 @@ const collectMoltnetSecretNames = (server, secretNames) => {
     if (server.mode === "managed") {
         for (const pairing of server.pairings ?? []) {
             secretNames.add(pairing.token_secret);
+            if (pairing.relay) {
+                secretNames.add(pairing.relay.token_secret);
+            }
         }
         if (server.store.kind === "postgres") {
             secretNames.add(server.store.dsn_secret);

package/dist/compiler/compileProject.d.ts

@@ -1,12 +1,24 @@
+import type { DaimonContractManifest } from "../runtime/daimon/contractManifest.js";
 import { CompileReport } from "../report/index.js";
 import { type RuntimePackageOverrideRequest } from "./containerPackageOverrides.js";
+import type { BundleIdentityMode } from "./workspaceBundleFiles.js";
 import { type MoltnetTargetArchitecture } from "./moltnetBinaries.js";
 import { type OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
 export { createOrganizationReadinessEvidence, ORGANIZATION_READINESS_EVIDENCE_VERSION } from "./organizationReadyEvidence.js";
 export type { CreateOrganizationReadinessEvidenceInput, OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
 export interface CompileProjectOptions {
+    /** Test seam for the receipt-bound manifest; normal compilation uses the verified vendored bytes. */
+    daimonContractManifest?: DaimonContractManifest;
+    /** Docker CLI for dependency installs and image-run generated bundle steps; defaults to `docker`. */
+    bundleDockerCommand?: string;
+    /** Cache for built workspace bundles; defaults to `$SPAWNFILE_HOME/cache/workspace-bundles`. */
+    bundleCacheDirectory?: string;
+    /** `release` builds bundles only from clean committed inputs; `dev` (default) includes uncommitted edits. */
+    bundleIdentity?: BundleIdentityMode;
     clean?: boolean;
     containerArchitecture?: MoltnetTargetArchitecture;
+    /** Stable deployment identity for exclusive credential-realm reattachment. */
+    deploymentLineage?: string;
     outputDirectory?: string;
     /** Compile-time-only local overrides for runtime install npm packages
      * (see src/compiler/containerPackageOverrides.ts). Only opt-in

package/dist/compiler/compileProject.js

@@ -1,12 +1,17 @@
+import { cleanCompileOutput } from "./cleanCompileOutput.js";
+import { assertRecordingCapability } from "./recordingCapability.js";
 import path from "node:path";
 import { chmod } from "node:fs/promises";
-import { ensureDirectory, removeDirectory } from "../filesystem/index.js";
+import { ensureDirectory } from "../filesystem/index.js";
 import { createCompileReport, createDiagnostic, writeCompileReport } from "../report/index.js";
 import { DEFAULT_OUTPUT_DIRECTORY } from "../shared/index.js";
 import { assertRuntimeCanCompile, createRuntimeLifecycleDiagnostics, getRuntimeAdapter, resolveNoopolisRunId } from "../runtime/index.js";
 import { buildCompilePlan } from "./buildCompilePlan.js";
 import { createContainerArtifacts } from "./containerArtifacts.js";
 import { stageRuntimePackageOverrides } from "./containerPackageOverrides.js";
+import { stageWorkspaceBundles } from "./workspaceBundleArtifacts.js";
+import { resolveWorkspaceBundles } from "./workspaceBundleResolve.js";
+import { resolveWorkspaceGitPins } from "./workspaceGitPins.js";
 import { augmentNodeReports } from "./compileProjectReports.js";
 import { enforcePolicy } from "./compileProjectPolicy.js";
 import { injectMoltnetWorkspaceFiles, injectTeamCompileSupportFiles, prepareTeamCompileSupport, writeEmittedFiles } from "./compileProjectSupport.js";
@@ -140,6 +145,7 @@ const compileTeamNode = async (baseDirectory, node) => {
 };
 export const compileProject = async (inputPath, options = {}) => {
     const plan = await buildCompilePlan(inputPath);
+    await assertRecordingCapability(plan, options.daimonContractManifest);
     const worldBindings = options.worldBindingsPath === undefined
         ? undefined
         : await loadWorldBindingsForCompile(plan, options.worldBindingsPath, resolveNoopolisRunId(process.env));
@@ -149,9 +155,22 @@ export const compileProject = async (inputPath, options = {}) => {
         ? path.resolve(options.outputDirectory)
         : path.join(path.dirname(plan.root), DEFAULT_OUTPUT_DIRECTORY);
     if (options.clean ?? true) {
-        await removeDirectory(outputDirectory);
+        await cleanCompileOutput(outputDirectory);
     }
     await ensureDirectory(outputDirectory);
+    const workspaceBundles = await resolveWorkspaceBundles(plan, {
+        architecture: options.containerArchitecture,
+        cacheDirectory: options.bundleCacheDirectory,
+        ...(options.bundleDockerCommand !== undefined ? { dockerCommand: options.bundleDockerCommand } : {}),
+        identity: options.bundleIdentity,
+        outputDirectory
+    });
+    const workspaceGitPins = await resolveWorkspaceGitPins(plan, {
+        architecture: options.containerArchitecture,
+        bundleCacheDirectory: options.bundleCacheDirectory,
+        identity: options.bundleIdentity,
+        outputDirectory
+    });
     const teamCompileSupport = await prepareTeamCompileSupport(plan);
     const nodeReports = [];
     const compiledNodes = [];
@@ -171,7 +190,7 @@ export const compileProject = async (inputPath, options = {}) => {
     for (const compiled of compiledNodes) {
         enforcePolicy(compiled.report, compiled.value.policyMode, compiled.value.policyOnDegrade);
     }
-    const moltnetArtifacts = await generateMoltnetArtifacts(plan);
+    const moltnetArtifacts = await generateMoltnetArtifacts(plan, options.deploymentLineage);
     const moltnetRelease = moltnetArtifacts
         ? await stageMoltnetBinaries(outputDirectory, {
             architecture: options.containerArchitecture
@@ -179,13 +198,18 @@ export const compileProject = async (inputPath, options = {}) => {
         : undefined;
     await injectMoltnetWorkspaceFiles(outputDirectory, compiledNodes, moltnetArtifacts);
     const resolvedRuntimePackageOverrides = await stageRuntimePackageOverrides(outputDirectory, options.runtimePackageOverrides);
+    const hasWorkspaceBundles = await stageWorkspaceBundles(outputDirectory, plan, new Map([...workspaceBundles.built, ...workspaceGitPins.built]));
     const generatedAt = new Date().toISOString();
     const containerArtifacts = await createContainerArtifacts(plan, compiledNodes, {
+        deploymentLineage: options.deploymentLineage,
         generatedAt,
         hasStagedMoltnetBinaries: Boolean(moltnetRelease),
+        hasWorkspaceBundles,
         moltnet: moltnetArtifacts,
         moltnetRelease,
         runtimePackageOverrides: resolvedRuntimePackageOverrides,
+        workspaceGitResources: workspaceGitPins.report,
+        workspaceBundles: workspaceBundles.report,
         ...(worldBindings ? { worldBindings } : {})
     });
     await writeEmittedFiles(outputDirectory, containerArtifacts.files);
@@ -196,6 +220,12 @@ export const compileProject = async (inputPath, options = {}) => {
         outputDirectory,
         projectName: containerArtifacts.distribution.report.organization.project
     });
+    if (workspaceBundles.report.length > 0)
+        report.workspace_bundles = workspaceBundles.report;
+    if (workspaceGitPins.report.length > 0)
+        report.workspace_git_resources = workspaceGitPins.report;
+    if (containerArtifacts.distribution.report.recording)
+        report.recording = containerArtifacts.distribution.report.recording;
     const reportPath = await writeCompileReport(outputDirectory, report);
     const organizationReadinessEvidence = createOrganizationReadinessEvidence({
         compileVersion: report.spawnfile_version,

package/dist/compiler/compileProjectSupport.js

@@ -100,6 +100,15 @@ export const injectMoltnetWorkspaceFiles = async (outputDirectory, compiledNodes
             upsertEmittedFile(compiled.emittedFiles, file);
         }
         await writeEmittedFiles(runtimeOutputDirectory, moltnetClientConfigFiles);
+        // Daimon agents talk Moltnet through the native moltnet_send/moltnet_read
+        // tools, and the moltnet CLI is not authenticated inside a Daimon
+        // workspace. Installing its skill there only teaches the agent a shell
+        // path that fails before it falls back to the tools it already has, so
+        // Daimon skips the skill install entirely; .moltnet/config.json above is
+        // still emitted since the native tools read it.
+        if (compiled.value.runtime.name === "daimon") {
+            continue;
+        }
         if (!moltnetCliCommand) {
             moltnetCliCommand = await resolveMoltnetCliCommand();
         }

package/dist/compiler/containerArtifactSummaries.js

@@ -71,6 +71,7 @@ export const createMoltnetSummary = (moltnet, release) => {
     }
     return {
         node_plans: moltnet.nodePlans.map((plan) => ({
+            ...(plan.sourceNodeId ? { node_id: plan.sourceNodeId } : {}),
             config_path: plan.configPath,
             ...(plan.credentialAgentId ? { credential_agent_id: plan.credentialAgentId } : {}),
             ...(plan.credentialId ? { credential_id: plan.credentialId } : {}),

package/dist/compiler/containerArtifacts.d.ts

@@ -1,4 +1,5 @@
-import type { RuntimeContainerPackageOverrides } from "../runtime/index.js";
+import type { CompileReport } from "../report/index.js";
+import { type RuntimeContainerPackageOverrides } from "../runtime/index.js";
 import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
 import type { MoltnetReleaseIdentity } from "./moltnetBinaries.js";
 import type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
@@ -6,15 +7,16 @@ import type { CompilePlan } from "./types.js";
 import { type ResolvedWorldBindings } from "./worldBindings.js";
 export type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
 export interface ContainerArtifactOptions {
+    deploymentLineage?: string;
     generatedAt?: string;
     hasStagedMoltnetBinaries?: boolean;
+    hasWorkspaceBundles?: boolean;
     moltnet?: MoltnetArtifacts | null;
     moltnetRelease?: MoltnetReleaseIdentity;
     worldBindings?: ResolvedWorldBindings;
-    /** Resolved local overrides for runtime install npm packages, produced by
-     * stageRuntimePackageOverrides.ts from a compile-time-only
-     * RuntimePackageOverrideRequest (see compileProject.ts). Undefined for a
-     * standard compile. */
+    workspaceGitResources?: CompileReport["workspace_git_resources"];
+    workspaceBundles?: CompileReport["workspace_bundles"];
+    /** Opt-in install overrides resolved by stageRuntimePackageOverrides. */
     runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }
 export declare const createContainerArtifacts: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], options?: ContainerArtifactOptions) => Promise<GeneratedContainerArtifacts>;

package/dist/compiler/containerArtifacts.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug, WORLD_BINDINGS_IMAGE_PATH } from "../distribution/index.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { createMoltnetSummary, createOrganizationSummary } from "./containerArtifactSummaries.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
@@ -7,9 +8,37 @@ import { createDockerIgnoreContent } from "./dockerBuildContext.js";
 import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
 import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
+import { resolveRecordingReport } from "./recordingReport.js";
+import { resolveWorkspaceResourceVolumes } from "./containerTargetResources.js";
+import { mergePersistentMounts } from "./containerPersistentMounts.js";
 import { SIMFILE_WORLD_BINDINGS_VERSION, WORLD_BINDINGS_OUTPUT_FILE } from "./worldBindings.js";
+/**
+ * Refuse a Daimon attachment unless the pinned Moltnet release advertises
+ * daimon-bridge (specs/SURFACES.md). Older pi-only releases reject its config
+ * and tear down the container at boot. receiptStorePath identifies resolved
+ * Daimon attachments; unsupported configs are errors, never degradations.
+ */
+const assertMoltnetDaimonBridgeCapability = (moltnet, release) => {
+    const daimonNetworks = [...new Set((moltnet?.nodePlans ?? [])
+            .filter((nodePlan) => nodePlan.receiptStorePath !== undefined)
+            .map((nodePlan) => nodePlan.networkId))].sort();
+    if (daimonNetworks.length === 0)
+        return;
+    const capabilities = release?.capabilities ?? [];
+    if (capabilities.includes("daimon-bridge"))
+        return;
+    throw new SpawnfileError("compile_error", `Moltnet release ${release?.version ?? "(unstaged)"} does not advertise the daimon-bridge capability, but `
+        + `${daimonNetworks.length} network attachment(s) lower a daimon runtime bridge (${daimonNetworks.join(", ")}). `
+        + "The published release implements pi-bridge only and rejects a daimon node config at strict JSON decode, so "
+        + "the container would exit at boot. Build Moltnet locally (scripts/build-local-moltnet.ts, then "
+        + "SPAWNFILE_LOCAL_MOLTNET_RELEASE_DIR with SPAWNFILE_ALLOW_LOCAL_E2E=1) to stage a daimon-bridge release, or "
+        + "remove the Moltnet attachment from the daimon agent(s).");
+};
 export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
-    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings);
+    assertMoltnetDaimonBridgeCapability(options.moltnet, options.moltnetRelease);
+    const localDaimonIdentityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    const localDaimonIdentity = localDaimonIdentityPath ? await loadLocalDaimonRuntimeIdentity(localDaimonIdentityPath) : undefined;
+    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings, options.deploymentLineage);
     const daimonTelemetryArtifacts = createDaimonTelemetryArtifacts(plan, runtimePlans, compiledNodes);
     const envVariableMap = createEnvVariableMap(compiledNodes, runtimePlans, options.moltnet);
     const projectedWorldTokenEnvNames = [...new Set(runtimePlans.flatMap((runtimePlan) => runtimePlan.worldTokenEnvNames ?? []))].sort();
@@ -45,50 +74,24 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .filter((variable) => variable.required && variable.categories.includes("runtime"))
         .map((variable) => variable.name)
         .sort();
-    const memoryArtifacts = createMemoryArtifactBundle(plan);
-    const persistentMountsById = new Map();
-    for (const mount of memoryArtifacts.mounts) {
-        const existing = persistentMountsById.get(mount.id);
-        if (existing) {
-            if (existing.mount_path !== mount.mount_path || existing.volume_name !== mount.volume_name) {
-                throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
-            }
-            continue;
-        }
-        persistentMountsById.set(mount.id, {
-            mount_path: mount.mount_path,
-            reason: mount.reason,
-            volume_name: mount.volume_name
-        });
-    }
-    const persistentMounts = [
+    const memoryArtifacts = createMemoryArtifactBundle(plan, options.deploymentLineage);
+    const recording = resolveRecordingReport(plan, memoryArtifacts.memories, options.workspaceGitResources);
+    const { resources: resolvedWorkspaceResources, mounts: workspaceResourceMounts } = resolveWorkspaceResourceVolumes(runtimePlans);
+    const persistentMountCandidates = [
         ...memoryArtifacts.mounts,
+        ...workspaceResourceMounts,
         ...daimonTelemetryArtifacts.mounts,
+        ...runtimePlans.flatMap((runtimePlan) => runtimePlan.persistentMounts ?? []),
         ...((options.moltnet?.persistentMounts ?? []).map((mount) => ({
+            ...(mount.declaredVolumeName ? { declared_volume_name: mount.declaredVolumeName } : {}),
             id: mount.id,
+            ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
             mount_path: mount.mountPath,
             reason: mount.reason,
             volume_name: mount.volumeName
         })))
-    ]
-        .sort((left, right) => left.id.localeCompare(right.id))
-        .filter((mount) => {
-        const existing = persistentMountsById.get(mount.id);
-        if (existing) {
-            if (existing.mount_path === mount.mount_path &&
-                existing.volume_name === mount.volume_name &&
-                existing.reason === mount.reason) {
-                return true;
-            }
-            throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
-        }
-        persistentMountsById.set(mount.id, {
-            mount_path: mount.mount_path,
-            reason: mount.reason,
-            volume_name: mount.volume_name
-        });
-        return true;
-    });
+    ];
+    const persistentMounts = mergePersistentMounts(persistentMountCandidates);
     const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
     const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
     const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
@@ -108,6 +111,9 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .map((plan) => {
         const telemetryMountIds = daimonTelemetryArtifacts.telemetryMountIdsByInstance.get(plan.id);
         return {
+            ...(plan.agentPathsByNodeId ? { agent_paths: Object.fromEntries(Object.entries(plan.agentPathsByNodeId).map(([id, paths]) => [id, {
+                        workspace_path: paths.workspacePath, home_path: paths.homePath, skill_roots: paths.skillRoots
+                    }])) } : {}),
             config_path: plan.instancePaths.configPath,
             home_path: plan.instancePaths.homePath ?? null,
             id: plan.id,
@@ -136,7 +142,14 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                 link_path: resource.linkPath,
                 mode: resource.mode,
                 mount: resource.mount,
-                sharing: resource.sharing
+                mount_path: resource.linkPath,
+                replacement_sentinel: resource.replacementSentinel ? {
+                    path: resource.replacementSentinel,
+                    result: "verified_on_startup"
+                } : undefined,
+                resolved_identity: resource.resolvedIdentity,
+                sharing: resource.sharing,
+                volume_name: resource.volumeName ?? null
             }
         ]))).values()
     ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
@@ -173,14 +186,23 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         modelAuthMethods: mergedModelAuthMethods,
         moltnetNetworks,
         organization,
+        // Derived volume names encode private host paths. Only author-declared
+        // names are portable; image consumers must honor them verbatim.
         persistentMounts: persistentMounts.map((mount) => ({
+            ...(mount.declared_volume_name ? { declared_volume_name: mount.declared_volume_name } : {}),
             durability: "persistent",
             id: mount.id,
             kind: "volume",
+            ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
             target: mount.mount_path
         })),
         portMappings,
         publishedPorts,
+        ...(recording ? {
+            recording,
+            workspaceGitResources: options.workspaceGitResources?.map(({ id, commit, sha256, agent_node_ids, declared_by }) => ({ id, commit, sha256, agent_node_ids: agent_node_ids, ...(declared_by ? { declared_by } : {}) })),
+            workspaceBundles: options.workspaceBundles?.map(({ id, sha256, origin, agent_node_ids, declared_by }) => ({ id, sha256, origin, agent_node_ids: agent_node_ids, ...(declared_by ? { declared_by } : {}) }))
+        } : {}),
         resources: workspaceResources.map((resource) => ({
             id: resource.id,
             kind: resource.kind,
@@ -189,12 +211,18 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             mount: resource.mount,
             sharing: resource.sharing
         })),
-        runtimeInstances,
+        runtimeInstances: runtimeInstances.map(({ agent_paths: _paths, ...instance }) => instance),
         ...(worldBindingsEvidence ? { worldBindings: worldBindingsEvidence } : {})
     });
     const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
-        ...createRootfsFiles(runtimePlans),
+        ...createRootfsFiles(runtimePlans, persistentMounts.map((mount) => mount.mount_path), options.moltnet
+            ? {
+                externalParticipantArtifacts: options.moltnet.externalParticipantArtifacts,
+                nodePlans: options.moltnet.nodePlans,
+                serverPlans: options.moltnet.serverPlans
+            }
+            : undefined, persistentMounts),
         ...(options.moltnet?.files ?? []),
         ...(options.worldBindings
             ? [{ content: options.worldBindings.canonicalBytes, mode: 0o600, path: WORLD_BINDINGS_OUTPUT_FILE }]
@@ -214,6 +242,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                 },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
+                hasWorkspaceBundles: options.hasWorkspaceBundles,
                 ...(options.moltnet
                     ? {
                         moltnet: {
@@ -236,7 +265,9 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                         nodePlans: options.moltnet.nodePlans,
                         serverPlans: options.moltnet.serverPlans
                     }
-                    : undefined
+                    : undefined,
+                persistentMounts,
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
             }),
             path: "entrypoint.sh"
         },
@@ -270,6 +301,11 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             entrypoint: "entrypoint.sh",
             env_example: ".env.example",
             internal_ports: internalPorts,
+            ...(localDaimonIdentity ? { local_daimon_runtime: {
+                    capability_receipt_sha256: localDaimonIdentity.capabilityReceipt,
+                    image_reference: localDaimonIdentity.imageReference,
+                    registry_authority: localDaimonIdentity.registryAuthority
+                } } : {}),
             model_secrets_required: modelSecretsRequired,
             ...(moltnetSummary ? { moltnet: moltnetSummary } : {}),
             port_mappings: portMappings,

package/dist/compiler/containerArtifactsPlans.d.ts

@@ -3,4 +3,4 @@ import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
 import type { CompilePlan } from "./types.js";
 import { type ResolvedWorldBindings } from "./worldBindings.js";
 export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[], moltnet?: MoltnetArtifacts | null) => Map<string, ContainerEnvVariable>;
-export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings) => Promise<RuntimeTargetPlan[]>;
+export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings, deploymentLineage?: string) => Promise<RuntimeTargetPlan[]>;