spawnfile 0.1.14 → 0.1.18

package/dist/compiler/containerArtifactsPlans.js

@@ -1,8 +1,11 @@
 import { createRuntimeInstallRecipe, getRuntimeAdapter } from "../runtime/index.js";
+import { resolveNoopolisRunId } from "../runtime/index.js";
 import { listAgentSurfaceSecretNames } from "./agentSurfaces.js";
 import { resolveTargetResources } from "./containerTargetResources.js";
 import { assertTargetHasConfig, createDefaultTargets, resolveInstancePaths, resolveTargetConfigEnvBindings, resolveTargetEnvFiles, resolveTargetExposure, resolveTargetModelAuthMethods, resolveTargetModelSecrets, resolveTargetPackages } from "./containerTargetPlanResolution.js";
 import { listExecutionModelSecretNames } from "./modelEnv.js";
+import { createPersistentVolumeName } from "./moltnetArtifactPaths.js";
+import { createExclusiveReattachVolumeName } from "../shared/index.js";
 import { findWorldBindingForNode } from "./worldBindings.js";
 export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
     const variables = new Map();
@@ -32,8 +35,10 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
         if (node.value.kind === "agent") {
             for (const secret of node.value.secrets)
                 registerSecret(secret);
-            for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
-                register(secretName, true, `Model provider auth for ${secretName}`, "model");
+            if (node.runtimeName !== "daimon") {
+                for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
+                    register(secretName, true, `Model provider auth for ${secretName}`, "model");
+                }
             }
             for (const secretName of listAgentSurfaceSecretNames(node.value.surfaces)) {
                 register(secretName, true, "Bot token for declared agent surfaces", "surface");
@@ -58,14 +63,15 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
     }
     return variables;
 };
-export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBindings) => {
+export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBindings, deploymentLineage = "compile") => {
     const runtimeNames = Object.keys(plan.runtimes).sort();
+    const runId = resolveNoopolisRunId(process.env);
     const runtimePlans = [];
     for (const runtimeName of runtimeNames) {
         const adapter = getRuntimeAdapter(runtimeName);
         const recipe = await createRuntimeInstallRecipe(runtimeName);
         const targetInputs = compiledNodes
-            .filter((node) => node.runtimeName === runtimeName && node.emittedFiles.length > 0)
+            .filter((node) => node.runtimeName === runtimeName && (node.emittedFiles.length > 0 || runtimeName === "daimon"))
             .map((node) => {
             const id = node.id ?? `${node.kind}:${node.slug}`;
             const worldBinding = node.kind === "agent"
@@ -87,21 +93,39 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBinding
             const instancePaths = resolveInstancePaths(runtimeName, target.id, adapter.container);
             const portStride = adapter.container.portStride ?? 1;
             runtimePlans.push({
+                ...(target.agentPathsByNodeId ? { agentPathsByNodeId: Object.fromEntries(Object.entries(target.agentPathsByNodeId).map(([id, paths]) => {
+                        const expand = (value) => value.replaceAll("<instance-root>", instancePaths.instanceRoot)
+                            .replaceAll("<workspace-path>", instancePaths.workspacePath);
+                        return [id, { workspacePath: expand(paths.workspacePath),
+                                homePath: paths.homePath === null ? null : expand(paths.homePath), skillRoots: paths.skillRoots.map(expand) }];
+                    })) } : {}),
                 configEnvBindings: resolveTargetConfigEnvBindings(adapter.container, target) ?? [],
                 ...(target.engineByNodeId ? { engineByNodeId: target.engineByNodeId } : {}),
+                ...(target.grokModelByNodeId ? { grokModelByNodeId: target.grokModelByNodeId } : {}),
+                ...(target.grokTurnLimitsByNodeId ? { grokTurnLimitsByNodeId: target.grokTurnLimitsByNodeId } : {}),
                 envFiles: resolveTargetEnvFiles(instancePaths.configPath, target),
                 packages: resolveTargetPackages(target, targetInputs),
                 id: target.id,
                 instancePaths,
                 meta: adapter.container,
-                modelAuthMethods: resolveTargetModelAuthMethods(target, targetInputs),
-                modelSecretsRequired: resolveTargetModelSecrets(target, targetInputs),
+                modelAuthMethods: runtimeName === "daimon" ? {} : resolveTargetModelAuthMethods(target, targetInputs),
+                modelSecretsRequired: runtimeName === "daimon" ? [] : resolveTargetModelSecrets(target, targetInputs),
+                ...(target.opaqueMountTargets ? { opaqueMountTargets: [...target.opaqueMountTargets].sort() } : {}),
+                ...(target.persistentMounts ? { persistentMounts: target.persistentMounts.map((mount) => ({
+                        id: mount.id,
+                        ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
+                        mount_path: mount.mountPath.replaceAll("<instance-root>", instancePaths.instanceRoot),
+                        reason: mount.reason,
+                        volume_name: mount.lifecycle === "exclusive-reattach"
+                            ? createExclusiveReattachVolumeName(`${plan.root}\0${deploymentLineage}`, mount.id)
+                            : createPersistentVolumeName(plan.root, mount.id, runId)
+                    })).sort((left, right) => left.id.localeCompare(right.id)) } : {}),
                 port: adapter.container.port ? adapter.container.port + (index * portStride) : undefined,
                 publishedPort: resolveTargetExposure(target, targetInputs) && adapter.container.port
                     ? adapter.container.port + (index * portStride)
                     : undefined,
                 recipeEnv: recipe.env,
-                resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container),
+                resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container, plan.root, deploymentLineage),
                 runtimeName,
                 runtimeRoot: recipe.runtimeRoot,
                 sourceIds: [...(target.sourceIds ?? [])].sort(),

package/dist/compiler/containerArtifactsRender.d.ts

@@ -3,6 +3,7 @@ import type { ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifac
 import type { EntrypointOptions } from "./containerEntrypointRender.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
 export type { EntrypointOptions } from "./containerEntrypointRender.js";
+import type { BackedMountRequirement } from "./containerBackedMountRender.js";
 export declare const renderEnvExample: (variables: ContainerEnvVariable[]) => string;
 export interface DockerfileDistributionOptions {
     labels: Record<string, string>;
@@ -13,4 +14,4 @@ export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], optio
     distribution?: DockerfileDistributionOptions;
     runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }) => Promise<string>;
-export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[]) => EmittedFile[];
+export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[], persistentMountPaths?: string[], moltnet?: EntrypointOptions["moltnet"], persistentMounts?: readonly BackedMountRequirement[]) => EmittedFile[];

package/dist/compiler/containerArtifactsRender.js

@@ -3,30 +3,20 @@ import { DISTRIBUTION_REPORT_IMAGE_PATH, WORLD_BINDINGS_IMAGE_PATH } from "../di
 import { createRuntimeInstallRecipe } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
+import { DAIMON_RUNTIME_UID, DAIMON_UID_ENTRYPOINT_PATH, renderDaimonUidEntrypoint } from "./containerDaimonUidEntrypointRender.js";
+import { createStateOwnershipCommand } from "./containerStateOwnershipRender.js";
+import { RUNTIME_LINK_MATERIALIZER_PATH, renderRuntimeLinkMaterializer } from "./containerRuntimeLinkMaterializer.js";
 import { MOLTNET_BIN_DIRECTORY, MOLTNET_BINARY_NAMES } from "./moltnetBinaries.js";
 import { collectPackagesByManager, createAptPackageInstallItem, createNpmPackageInstallCommand, createNpmPackageInstallItem, createPackageInstallCommand, createPipxPackageInstallCommand, createPipxPackageInstallItem, getNpmInstallItemName } from "./containerPackageRender.js";
 const CONTAINER_ROOTFS_ROOT = "container/rootfs";
 const GATEWAY_PORT_PLACEHOLDER = "<gateway-port>";
 const WORKSPACE_PLACEHOLDER = "<workspace-path>";
 const RUNTIME_ROOT_PLACEHOLDER = "<runtime-root>";
+const PREBUILT_FINAL_SYSTEM_DEPS_BY_RUNTIME = {
+    daimon: new Set(["bubblewrap", "dbus-daemon", "gnome-keyring", "util-linux"])
+};
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
 const extractNodeMajorVersion = (image) => Number(image.match(/^node:(\d+)/)?.[1] ?? "0");
-const createStateOwnershipCommand = (persistentMountPaths = []) => {
-    const mountPaths = [...new Set(persistentMountPaths)].sort();
-    const mkdirPaths = [...new Set(["/var/lib/spawnfile", ...mountPaths])].sort();
-    const markerCommands = mountPaths.map((mountPath) => `touch ${shellQuote(path.posix.join(mountPath, ".spawnfile-volume-init"))}`);
-    const chownPaths = [
-        ...new Set([
-            "/var/lib/spawnfile",
-            ...mountPaths.filter((mountPath) => !mountPath.startsWith("/var/lib/spawnfile/"))
-        ])
-    ].sort();
-    return [
-        `mkdir -p ${mkdirPaths.map(shellQuote).join(" ")}`,
-        ...markerCommands,
-        `chown -R spawnfile:spawnfile ${chownPaths.map(shellQuote).join(" ")}`
-    ].join(" && ");
-};
 const selectBaseImage = (runtimePlans, runtimeRecipes) => {
     const recipeBaseImages = [
         ...new Set(runtimeRecipes.flatMap((recipe) => recipe.baseImage ? [recipe.baseImage] : []))
@@ -74,6 +64,7 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         throw new SpawnfileError("compile_error", "Moltnet must be supplied as a pinned, digest-verified, pi-bridge-stamped release; unpinned latest installation is disabled");
     }
     const runtimeNames = [...new Set(runtimePlans.map((plan) => plan.runtimeName))];
+    const hasDaimon = runtimeNames.includes("daimon");
     const runtimeRecipes = await Promise.all(runtimeNames.map((runtimeName) => createRuntimeInstallRecipe(runtimeName, { packageOverrides: options.runtimePackageOverrides })));
     const recipeByRuntimeName = new Map(runtimeRecipes.map((recipe) => [recipe.runtimeName, recipe]));
     const baseImage = selectBaseImage(runtimePlans, runtimeRecipes);
@@ -82,10 +73,14 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
             && plan.configPath !== null
             && plan.secretPatches.length > 0);
     const needsGit = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "git"));
+    const needsBundle = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "bundle"));
     const systemDeps = [
         ...new Set([
-            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage ? [] : plan.meta.systemDeps),
+            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage
+                ? plan.meta.systemDeps.filter((dependency) => PREBUILT_FINAL_SYSTEM_DEPS_BY_RUNTIME[plan.runtimeName]?.has(dependency))
+                : plan.meta.systemDeps),
             ...(needsGit ? ["git"] : []),
+            ...(needsBundle ? ["tar"] : []),
             ...(needsJsonEnvWriter ? ["python3"] : [])
         ])
     ].sort();
@@ -124,6 +119,8 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
     if (options.hasMoltnet && options.hasStagedMoltnetBinaries) {
         lines.push(`COPY ${MOLTNET_BIN_DIRECTORY}/ /usr/local/bin/`, `RUN chmod +x ${MOLTNET_BINARY_NAMES.map((binaryName) => `/usr/local/bin/${binaryName}`).join(" ")}`, "");
     }
+    if (options.hasWorkspaceBundles)
+        lines.push("COPY container/workspace-bundles/ /opt/spawnfile/workspace-bundles/", "");
     for (const recipe of runtimeRecipes) {
         for (const copyCommand of recipe.copyCommands) {
             lines.push(copyCommand);
@@ -133,8 +130,19 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         }
         lines.push("");
     }
-    lines.push('RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
-    lines.push("COPY container/rootfs/ /", "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', "RUN chmod +x /opt/spawnfile/entrypoint.sh");
+    lines.push(hasDaimon
+        ? `RUN if ! getent group spawnfile >/dev/null 2>&1; then groupadd --gid ${DAIMON_RUNTIME_UID} spawnfile; fi && if ! id -u spawnfile >/dev/null 2>&1; then useradd --uid ${DAIMON_RUNTIME_UID} --gid spawnfile --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi`
+        : 'RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
+    lines.push("COPY container/rootfs/ /", ...(hasDaimon
+        ? ["RUN chown root:root /var /var/lib /var/lib/spawnfile && chmod 755 /var /var/lib && chmod 711 /var/lib/spawnfile"]
+        : []), "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', `RUN chmod +x /opt/spawnfile/entrypoint.sh${hasDaimon ? ` ${DAIMON_UID_ENTRYPOINT_PATH}` : ""}${hasDaimon ? " && chmod 711 /opt /opt/spawnfile" : ""}`);
+    if (hasDaimon) {
+        for (const runtimeRoot of [...new Set(runtimePlans
+                .filter((plan) => plan.runtimeName === "daimon")
+                .map((plan) => plan.runtimeRoot))].sort()) {
+            lines.push(`RUN node ${shellQuote(RUNTIME_LINK_MATERIALIZER_PATH)} ${shellQuote(runtimeRoot)} && rm ${shellQuote(RUNTIME_LINK_MATERIALIZER_PATH)} && test -d ${shellQuote(runtimeRoot)} && test ! -L ${shellQuote(runtimeRoot)} && test -z "$(find -P ${shellQuote(runtimeRoot)} \\( -type l -o ! -user root -o ! -group root \\) -print -quit)" && chmod 711 /opt/spawnfile/runtime-installs ${shellQuote(runtimeRoot)} && find -P ${shellQuote(runtimeRoot)} -type d -exec chmod 711 {} + && find -P ${shellQuote(runtimeRoot)} -type f -perm /111 -exec chmod 555 {} + && find -P ${shellQuote(runtimeRoot)} -type f ! -perm /111 -exec chmod 444 {} + && chmod 555 ${shellQuote(path.posix.join(runtimeRoot, "daimon-start.sh"))}`);
+        }
+    }
     const postRootfsCommands = [
         ...new Set(runtimePlans.flatMap((plan) => plan.meta.postRootfsCommands ?? []))
     ];
@@ -151,48 +159,73 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
             .sort(([left], [right]) => left.localeCompare(right))
             .map(([name, value]) => `LABEL ${name}=${shellQuote(value)}`));
     }
-    lines.push(`RUN ${createStateOwnershipCommand(options.persistentMountPaths)}`);
+    lines.push(`RUN ${createStateOwnershipCommand(runtimePlans, options.persistentMountPaths, options.moltnet)}`);
     if (exposedPorts.length > 0) {
         lines.push(`EXPOSE ${exposedPorts.join(" ")}`);
     }
-    lines.push("USER spawnfile");
-    lines.push('ENTRYPOINT ["/opt/spawnfile/entrypoint.sh"]');
+    if (hasDaimon) {
+        const daimonConfig = runtimePlans.find((plan) => plan.runtimeName === "daimon")?.instancePaths.configPath;
+        if (!daimonConfig)
+            throw new Error("Daimon container plan is missing its runtime config path");
+        const healthProgram = "const fs=require('node:fs');const c=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));fetch(`http://127.0.0.1:${c.host.port}/healthz`).then(async r=>{if(!r.ok||JSON.stringify(await r.json())!==JSON.stringify({status:'ok'}))process.exit(1)}).catch(()=>process.exit(1))";
+        lines.push(`HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=12 CMD ["node","-e",${JSON.stringify(healthProgram)},${JSON.stringify(daimonConfig)}]`);
+    }
+    lines.push(hasDaimon ? "USER root" : "USER spawnfile");
+    lines.push(hasDaimon
+        ? `ENTRYPOINT ["${DAIMON_UID_ENTRYPOINT_PATH}"]`
+        : 'ENTRYPOINT ["/opt/spawnfile/entrypoint.sh"]');
     return `${lines.join("\n").trimEnd()}\n`;
 };
-export const createRootfsFiles = (runtimePlans) => runtimePlans.flatMap((plan) => plan.targetFiles.map((file) => {
-    if (file.path === plan.meta.configFileName) {
-        return {
-            content: file.content
-                .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
-                .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
-                .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
-                .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : ""),
-            path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
-        };
-    }
-    if (file.path.startsWith("runtime/")) {
-        const relativeRuntimePath = file.path.slice("runtime/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
-        };
-    }
-    if (file.path.startsWith("workspace/")) {
-        const relativeWorkspacePath = file.path.slice("workspace/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.workspacePath, relativeWorkspacePath)}`
-        };
-    }
-    if (file.path.startsWith("home/")) {
-        if (!plan.instancePaths.homePath) {
-            throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted home-scoped files without a home path`);
+export const createRootfsFiles = (runtimePlans, persistentMountPaths = [], moltnet, persistentMounts = []) => {
+    const files = runtimePlans.flatMap((plan) => plan.targetFiles.map((file) => {
+        const renderedContent = file.content
+            .replaceAll("<config-path>", plan.instancePaths.configPath)
+            .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
+            .replaceAll("<instance-root>", plan.instancePaths.instanceRoot ?? "")
+            .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
+            .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
+            .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : "");
+        if (file.path === plan.meta.configFileName) {
+            return {
+                content: renderedContent,
+                path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
+            };
+        }
+        if (file.path.startsWith("runtime/")) {
+            const relativeRuntimePath = file.path.slice("runtime/".length);
+            return {
+                content: renderedContent,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
+            };
+        }
+        if (file.path.startsWith("workspace/")) {
+            const relativeWorkspacePath = file.path.slice("workspace/".length);
+            return {
+                content: file.content,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.workspacePath, relativeWorkspacePath)}`
+            };
         }
-        const relativeHomePath = file.path.slice("home/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.homePath, relativeHomePath)}`
-        };
-    }
-    throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted unsupported path ${file.path}`);
-}));
+        if (file.path.startsWith("home/")) {
+            if (!plan.instancePaths.homePath) {
+                throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted home-scoped files without a home path`);
+            }
+            const relativeHomePath = file.path.slice("home/".length);
+            return {
+                content: file.content,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.homePath, relativeHomePath)}`
+            };
+        }
+        throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted unsupported path ${file.path}`);
+    }));
+    return runtimePlans.some((plan) => plan.runtimeName === "daimon")
+        ? [{
+                content: renderRuntimeLinkMaterializer(),
+                mode: 0o600,
+                path: `${CONTAINER_ROOTFS_ROOT}${RUNTIME_LINK_MATERIALIZER_PATH}`
+            }, {
+                content: renderDaimonUidEntrypoint(runtimePlans, persistentMountPaths, moltnet, persistentMounts),
+                mode: 0o755,
+                path: `${CONTAINER_ROOTFS_ROOT}${DAIMON_UID_ENTRYPOINT_PATH}`
+            }, ...files]
+        : files;
+};

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -1,5 +1,6 @@
 import type { DistributionReport } from "../distribution/index.js";
 import type { ContainerReport } from "../report/index.js";
+import type { ContainerPersistentMountReport } from "../report/index.js";
 import type { EmittedFile, RuntimeContainerConfigEnvBinding, RuntimeContainerMeta } from "../runtime/index.js";
 import type { ModelAuthMethod } from "../shared/index.js";
 import type { ResolvedAgentNode, ResolvedPackage, ResolvedTeamNode } from "./types.js";
@@ -13,10 +14,22 @@ export interface ContainerEnvVariable {
     required: boolean;
 }
 export interface RuntimeTargetPlan {
+    agentPathsByNodeId?: import("../runtime/types.js").ContainerTarget["agentPathsByNodeId"];
     configEnvBindings?: RuntimeContainerConfigEnvBinding[];
     /** Passthrough of `ContainerTarget.engineByNodeId` (see `runtime/types.ts`), for
      * `containerArtifacts.ts` to stamp onto `ContainerRuntimeInstanceReport.engine_by_node_id`. */
     engineByNodeId?: Record<string, string>;
+    /** Passthrough of `ContainerTarget.grokModelByNodeId` for the Daimon broker worker render. */
+    grokModelByNodeId?: Record<string, {
+        model: string;
+        reasoningEffort: string;
+    }>;
+    /** Passthrough of `ContainerTarget.grokTurnLimitsByNodeId` for the Daimon broker worker render. */
+    grokTurnLimitsByNodeId?: Record<string, {
+        maxRequests?: number;
+        maxTokens?: number;
+        timeoutMs?: number;
+    }>;
     packages?: ResolvedPackage[];
     envFiles: Array<{
         envName: string;
@@ -32,6 +45,8 @@ export interface RuntimeTargetPlan {
     meta: RuntimeContainerMeta;
     modelAuthMethods: Record<string, ModelAuthMethod>;
     modelSecretsRequired: string[];
+    opaqueMountTargets?: string[];
+    persistentMounts?: ContainerPersistentMountReport[];
     port?: number;
     publishedPort?: number;
     /**

package/dist/compiler/containerBackedMountRender.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Fail-closed guard for durable container state.
+ *
+ * Every path in `container.persistent_mounts[]` is state the compiler expects
+ * a host-backed named volume to hold. `spawnfile run`/`spawnfile up` and
+ * `spawnfile deploy` mount them; a hand-rolled `docker run` of the same image
+ * does not, and nothing in the image declares `VOLUME`, so the container would
+ * silently write its whole durable record onto the container's own writable
+ * layer and lose it on `docker rm`. That is exactly how a newsroom's message
+ * history was destroyed by a routine recreate.
+ *
+ * These checks make that case loud instead of silent: the entrypoint refuses
+ * to start unless each durable path is a real mount point, naming the mount
+ * id, the path, and the volume name to attach. `SPAWNFILE_ALLOW_EPHEMERAL_STATE=1`
+ * is the deliberate opt-out for throwaway containers.
+ *
+ * Detection reads `/proc/self/mountinfo` and looks for an EXACT mount point,
+ * rather than comparing `stat -c %d` against the parent directory: two nested
+ * durable volumes live on the same host filesystem and therefore share a
+ * device number, which would make a device comparison report a genuinely
+ * backed inner mount as unbacked.
+ *
+ * The kernel octal-escapes four characters in the mountinfo mount-point field
+ * (`show_mountinfo` passes `" \t\n\\"` to `seq_path_root`), so a declared
+ * `mount: "/var/lib/my store"` appears there as `/var/lib/my\040store`. The
+ * comparison is therefore made against the compiler-escaped form — computed
+ * here, where it is exactly testable — while the operator-facing message keeps
+ * the real path. Escaping at compile time rather than decoding in shell keeps
+ * the check a deterministic string compare with no dependence on how a
+ * particular `printf %b` implementation treats `\nnn` vs `\0nnn`. For a path
+ * containing none of those four characters both forms are identical.
+ */
+export declare const EPHEMERAL_STATE_OPT_OUT_ENV = "SPAWNFILE_ALLOW_EPHEMERAL_STATE";
+export interface BackedMountRequirement {
+    id: string;
+    mount_path: string;
+    volume_name: string;
+}
+/** The mount-point field exactly as `/proc/self/mountinfo` renders this path. */
+export declare const escapeMountInfoPath: (value: string) => string;
+export declare const createBackedMountShellFunction: () => string[];
+/**
+ * One check per durable mount, deduplicated by path and ordered by path so the
+ * rendered entrypoint is a deterministic function of the compile plan.
+ */
+export declare const createBackedMountChecks: (mounts: readonly BackedMountRequirement[]) => string[];
+/**
+ * The full guard — function plus checks — or nothing at all when the compile
+ * declares no durable mounts.
+ */
+export declare const createBackedMountGuard: (mounts: readonly BackedMountRequirement[]) => string[];
+/**
+ * Compile-time operator surface: how many durable mounts this organization
+ * requires a launcher to attach.
+ */
+export declare const describeBackedMountRequirement: (mounts: readonly BackedMountRequirement[]) => string | null;

package/dist/compiler/containerBackedMountRender.js

@@ -0,0 +1,101 @@
+/**
+ * Fail-closed guard for durable container state.
+ *
+ * Every path in `container.persistent_mounts[]` is state the compiler expects
+ * a host-backed named volume to hold. `spawnfile run`/`spawnfile up` and
+ * `spawnfile deploy` mount them; a hand-rolled `docker run` of the same image
+ * does not, and nothing in the image declares `VOLUME`, so the container would
+ * silently write its whole durable record onto the container's own writable
+ * layer and lose it on `docker rm`. That is exactly how a newsroom's message
+ * history was destroyed by a routine recreate.
+ *
+ * These checks make that case loud instead of silent: the entrypoint refuses
+ * to start unless each durable path is a real mount point, naming the mount
+ * id, the path, and the volume name to attach. `SPAWNFILE_ALLOW_EPHEMERAL_STATE=1`
+ * is the deliberate opt-out for throwaway containers.
+ *
+ * Detection reads `/proc/self/mountinfo` and looks for an EXACT mount point,
+ * rather than comparing `stat -c %d` against the parent directory: two nested
+ * durable volumes live on the same host filesystem and therefore share a
+ * device number, which would make a device comparison report a genuinely
+ * backed inner mount as unbacked.
+ *
+ * The kernel octal-escapes four characters in the mountinfo mount-point field
+ * (`show_mountinfo` passes `" \t\n\\"` to `seq_path_root`), so a declared
+ * `mount: "/var/lib/my store"` appears there as `/var/lib/my\040store`. The
+ * comparison is therefore made against the compiler-escaped form — computed
+ * here, where it is exactly testable — while the operator-facing message keeps
+ * the real path. Escaping at compile time rather than decoding in shell keeps
+ * the check a deterministic string compare with no dependence on how a
+ * particular `printf %b` implementation treats `\nnn` vs `\0nnn`. For a path
+ * containing none of those four characters both forms are identical.
+ */
+export const EPHEMERAL_STATE_OPT_OUT_ENV = "SPAWNFILE_ALLOW_EPHEMERAL_STATE";
+const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+const MOUNTINFO_ESCAPES = {
+    "\\": "\\134",
+    " ": "\\040",
+    "\t": "\\011",
+    "\n": "\\012"
+};
+/** The mount-point field exactly as `/proc/self/mountinfo` renders this path. */
+export const escapeMountInfoPath = (value) => value.replace(/[\\ \t\n]/gu, (character) => MOUNTINFO_ESCAPES[character]);
+export const createBackedMountShellFunction = () => [
+    "require_backed_mount() {",
+    '  local mount_id="$1"',
+    // As mountinfo renders it (octal-escaped), for the comparison only.
+    '  local mount_field="$2"',
+    // The real path, for every operator-facing message.
+    '  local mount_target="$3"',
+    '  local mount_volume="$4"',
+    "  local mount_point",
+    `  if [ "\${${EPHEMERAL_STATE_OPT_OUT_ENV}:-}" = "1" ]; then`,
+    "    return 0",
+    "  fi",
+    "  if [ ! -r /proc/self/mountinfo ]; then",
+    '    echo "Durable mount $mount_id at $mount_target cannot be verified: /proc/self/mountinfo is unreadable" >&2',
+    "    exit 1",
+    "  fi",
+    "  while read -r _ _ _ _ mount_point _; do",
+    '    if [ "$mount_point" = "$mount_field" ]; then',
+    "      return 0",
+    "    fi",
+    "  done < /proc/self/mountinfo",
+    '  echo "Durable mount $mount_id is not backed by a volume at $mount_target; this container would lose that state when it is removed." >&2',
+    `  echo "Start this image with 'spawnfile run' or 'spawnfile up', or pass: --mount type=volume,source=\$mount_volume,target=\$mount_target" >&2`,
+    `  echo "Set ${EPHEMERAL_STATE_OPT_OUT_ENV}=1 to run this container without durable state." >&2`,
+    "  exit 1",
+    "}"
+];
+/**
+ * One check per durable mount, deduplicated by path and ordered by path so the
+ * rendered entrypoint is a deterministic function of the compile plan.
+ */
+export const createBackedMountChecks = (mounts) => {
+    const byPath = new Map();
+    for (const mount of mounts) {
+        if (!byPath.has(mount.mount_path))
+            byPath.set(mount.mount_path, mount);
+    }
+    return [...byPath.values()]
+        .sort((left, right) => left.mount_path.localeCompare(right.mount_path))
+        .map((mount) => `require_backed_mount ${shellQuote(mount.id)} ${shellQuote(escapeMountInfoPath(mount.mount_path))} ${shellQuote(mount.mount_path)} ${shellQuote(mount.volume_name)}`);
+};
+/**
+ * The full guard — function plus checks — or nothing at all when the compile
+ * declares no durable mounts.
+ */
+export const createBackedMountGuard = (mounts) => {
+    const checks = createBackedMountChecks(mounts);
+    return checks.length === 0 ? [] : [...createBackedMountShellFunction(), "", ...checks, ""];
+};
+/**
+ * Compile-time operator surface: how many durable mounts this organization
+ * requires a launcher to attach.
+ */
+export const describeBackedMountRequirement = (mounts) => {
+    const count = new Set(mounts.map((mount) => mount.mount_path)).size;
+    if (count === 0)
+        return null;
+    return `${count} durable mount${count === 1 ? "" : "s"} must be attached at start: use 'spawnfile run'/'spawnfile up', or pass matching --mount type=volume args. The entrypoint refuses to start otherwise (set ${EPHEMERAL_STATE_OPT_OUT_ENV}=1 to accept state loss).`;
+};

package/dist/compiler/containerDaimonBrokerRender.d.ts

@@ -0,0 +1,114 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from "./containerDaimonGrokWorkerRender.js";
+import { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
+export { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID };
+export declare const DAIMON_BROKER_EXECUTABLE = "/opt/daimon/bin/daimon-engine-broker";
+export declare const DAIMON_BROKER_REGISTRATIONS = "/etc/daimon-engine-broker/registrations.bin";
+export declare const DAIMON_BROKER_SOCKET = "/run/daimon-engine-broker/control.sock";
+export declare const DAIMON_BROKER_BACKEND_SOCKET = "/run/daimon-engine-broker/backend.sock";
+export declare const DAIMON_BROKER_LAUNCHER_SOCKET = "/run/daimon-engine-broker/launcher.sock";
+export declare const DAIMON_BROKER_SERVICE_CONFIG = "/etc/daimon-engine-broker/service.json";
+export declare const DAIMON_BROKER_REALM = "/var/lib/spawnfile/daimon/grok-subscription-realm";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group): shared `/tmp` and `/var/tmp` are `root:2000 1774` in a Grok
+ * organization, so any non-root process outside group 2000 needs its own
+ * `TMPDIR`. It lives in the broker's `/run` directory, which every worker denies.
+ */
+export declare const DAIMON_BROKER_TMPDIR = "/run/daimon-engine-broker/tmp";
+export { DAIMON_ORGANIZATION_STATE_DIRECTORY, DAIMON_WORKER_ROOT, resolveDaimonGrokRegistrations } from "./containerDaimonGrokWorkerRender.js";
+interface WorkspaceSecurityResource {
+    backingPath: string;
+    kind: "bundle" | "git" | "volume";
+    linkPath: string;
+    mode: "mutable" | "readonly";
+    resolvedIdentity: string | null;
+}
+export declare const renderDaimonWorkspaceResourceSecurity: (resources: WorkspaceSecurityResource[], owners?: {
+    linkUid: number;
+    linkGid: number;
+    readonlyUid: number;
+    readonlyGid: number;
+    privilegedUid: number;
+    privilegedGid: number;
+}, resourceRoot?: string) => string[];
+/**
+ * Fixes ownership and mode of the per-turn usage ledger directory for every
+ * Daimon organization, not just ones with a Grok agent. AGY and Codex both
+ * write here too (`onTurnUsage` in Daimon's `engineDispatcher.ts`), from the
+ * organization-uid runtime process (`uid`/`gid` below, set in
+ * `renderDaimonUidEntrypoint`) rather than the privileged broker — so this
+ * must run whether or not any Grok registration exists, and the directory
+ * must be group-writable (0770), not merely group-readable (0750): a mode
+ * that only lets the group list the directory silently defeated every
+ * AGY/Codex advisory usage write and, with it, Daimon's wake-fuse token
+ * ceiling, which now refuses to start at all if this ledger is missing or
+ * unreadable (`wakeFuse.ts`'s `ensureUsageLedgerReadable`).
+ *
+ * The directory itself is never created here: it is a persistent volume
+ * mount (`daimon-grok-usage-ledger` in `config.ts`, unconditional for every
+ * Daimon organization) that Docker always materializes before the entrypoint
+ * runs — exactly like `DAIMON_WAKE_FUSE_DIRECTORY`, whose own fix-up
+ * (`renderDaimonUidEntrypoint`) uses this same three-step order. `chown` to
+ * root first, `chmod` next, `chown` to the final owner last — never
+ * `install -d`'s create-then-chown-then-chmod order, and never a single
+ * `chown owner:group` followed by `chmod`: root only ever chmods a path it
+ * currently owns, so it never needs `CAP_FOWNER` (`runProject.ts`'s
+ * capability set grants `CAP_CHOWN` but not `CAP_FOWNER`) — chmod-ing
+ * *after* the final `chown` hands ownership to the broker uid fails with
+ * `EPERM` the moment root no longer owns the path.
+ */
+export declare const renderDaimonUsageLedgerProvisioning: () => string[];
+/**
+ * Empties a directory without touching a mount point inside it.
+ *
+ * `rm -rf` and `find -delete` both fail `EBUSY` on a mount point — it is
+ * another filesystem's root, and its entry cannot be unlinked while it is
+ * mounted. A deployment that mounts a tmpfs below a directory it later clears
+ * would otherwise abort provisioning on a bare `find` failure, which is exactly
+ * how a live training launch died. Mount points are left in place and descended
+ * into; anything else that cannot be removed is reported by name.
+ *
+ * Mount points come from `/proc/self/mountinfo` field 5. The kernel
+ * octal-escapes space, tab, newline and backslash there; every path this
+ * compiler provisions is free of all four, and a path that is not would simply
+ * fail to match and be treated as an ordinary directory.
+ */
+export declare const MOUNT_AWARE_CLEAR_HELPER: string[];
+export declare const renderDaimonBrokerProvisioning: (plans: RuntimeTargetPlan[]) => string[];
+/**
+ * The root broker provisioning program itself, over already-resolved
+ * registrations and workspace resources.
+ *
+ * Production reaches it through {@link renderDaimonBrokerProvisioning}; the
+ * broker-capable training container reaches it directly for its single fixed
+ * slot, with `serviceOptions` pointing the turn store at per-slot tmpfs and
+ * declaring the evaluator inference ledger. Both callers get byte-identical
+ * credential, registration, worker-home, temp and spill provisioning — the
+ * whole point of sharing it rather than writing a second root program.
+ *
+ * It is re-runnable: the shell wrapper removes `/etc/daimon-engine-broker` and
+ * `/run/daimon-engine-broker` first, so a slot recycle replays exactly the
+ * audited start-up path, credential-journal recovery included.
+ */
+export declare const renderDaimonBrokerProvisioningProgram: (registrations: readonly DaimonGrokRegistration[], workspaceResources: WorkspaceSecurityResource[], serviceOptions?: DaimonGrokServiceConfigOptions, 
+/**
+ * How the broker's `/etc` and `/run` roots are reset before provisioning.
+ * A production organization owns both as ordinary image directories and
+ * removes them outright. The training container mounts each as its own
+ * tmpfs, which cannot be unlinked, so it empties them instead — the same
+ * end state, reached the only way a mount point allows.
+ */
+rootReset?: "remove" | "clear", 
+/** Deny targets the worker provisioning creates when absent; see `renderDaimonGrokWorkerProvisioning`. */
+optionalDenyPaths?: readonly string[], 
+/**
+ * Where the broker and relay get their private `TMPDIR`. Production keeps it
+ * inside the control root, which it removes and recreates exactly once. A
+ * deployment that re-provisions that root — the training slot recycle — must
+ * pass a path outside it: a `tmp/` inside a cleared root is a mount point in
+ * the training launch, and clearing a mount point fails `EBUSY`.
+ */
+brokerTmpdir?: string, 
+/** Root-owned training deny targets, created after root reset and before worker attestation. */
+beforeWorkerProvisioning?: readonly string[]) => string[];