spawnfile 0.1.14 → 0.1.18

package/dist/compiler/containerDaimonBrokerRender.js

@@ -0,0 +1,194 @@
+import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_TURN_USAGE_LEDGER } from "../runtime/daimon/contractManifest.js";
+import { resolveDaimonGrokRegistrations } from "./containerDaimonGrokWorkerRender.js";
+import { renderDaimonGrokWorkerProvisioning } from "./containerDaimonGrokWorkerProvisioning.js";
+import { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
+export { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID };
+export const DAIMON_BROKER_EXECUTABLE = "/opt/daimon/bin/daimon-engine-broker";
+export const DAIMON_BROKER_REGISTRATIONS = "/etc/daimon-engine-broker/registrations.bin";
+export const DAIMON_BROKER_SOCKET = "/run/daimon-engine-broker/control.sock";
+export const DAIMON_BROKER_BACKEND_SOCKET = "/run/daimon-engine-broker/backend.sock";
+export const DAIMON_BROKER_LAUNCHER_SOCKET = "/run/daimon-engine-broker/launcher.sock";
+export const DAIMON_BROKER_SERVICE_CONFIG = "/etc/daimon-engine-broker/service.json";
+export const DAIMON_BROKER_REALM = "/var/lib/spawnfile/daimon/grok-subscription-realm";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group): shared `/tmp` and `/var/tmp` are `root:2000 1774` in a Grok
+ * organization, so any non-root process outside group 2000 needs its own
+ * `TMPDIR`. It lives in the broker's `/run` directory, which every worker denies.
+ */
+export const DAIMON_BROKER_TMPDIR = "/run/daimon-engine-broker/tmp";
+export { DAIMON_ORGANIZATION_STATE_DIRECTORY, DAIMON_WORKER_ROOT, resolveDaimonGrokRegistrations } from "./containerDaimonGrokWorkerRender.js";
+export const renderDaimonWorkspaceResourceSecurity = (resources, owners = { linkUid: 2_000, linkGid: 2_000, readonlyUid: 2_000, readonlyGid: 2_000, privilegedUid: 0, privilegedGid: 0 }, resourceRoot = "/var/lib/spawnfile/resources/") => [
+    `const workspaceResources = ${JSON.stringify(resources)};`,
+    "const resourceByLink = new Map(workspaceResources.map((resource) => [resource.linkPath, resource])); if (resourceByLink.size !== workspaceResources.length) throw new Error('duplicate worker workspace resource link');",
+    `const validateResourceLink = (target, info) => { const resource = resourceByLink.get(target); if (!resource || info.uid !== ${owners.linkUid} || info.gid !== ${owners.linkGid} || info.nlink !== 1) throw new Error('unsafe worker workspace link'); const raw = fs.readlinkSync(target), normalized = require('node:path').posix.normalize(raw); if (!raw.startsWith('/') || normalized !== raw || raw !== resource.backingPath || !raw.startsWith(${JSON.stringify(resourceRoot)})) throw new Error('unsafe worker workspace link target'); const backing = fs.lstatSync(raw); if (!backing.isDirectory() || backing.isSymbolicLink()) throw new Error('unsafe worker workspace resource'); const mode = backing.mode & 0o777; if (resource.kind === 'volume') { const lifecycleOwner = (backing.uid === ${owners.privilegedUid} && backing.gid === ${owners.privilegedGid}) || (backing.uid === ${owners.linkUid} && backing.gid === ${owners.linkGid}); if (!lifecycleOwner || mode !== 0o755 || typeof resource.resolvedIdentity !== 'string') throw new Error('unsafe worker workspace volume'); const expected = Buffer.from(\`${"${resource.resolvedIdentity}"}\\n\`); if (expected.length !== 72) throw new Error('unsafe worker workspace volume identity'); const sentinel = \`${"${raw}"}/.spawnfile-resource-identity\`; let fd; try { fd = fs.openSync(sentinel, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK); const before = fs.fstatSync(fd); if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.uid !== ${owners.privilegedUid} || before.gid !== ${owners.privilegedGid} || (before.mode & 0o777) !== 0o644 || before.size !== expected.length) throw new Error('unsafe worker workspace volume identity'); const bytes = fs.readFileSync(fd), after = fs.fstatSync(fd); if (!bytes.equals(expected) || after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) throw new Error('unsafe worker workspace volume identity'); } finally { expected.fill(0); if (fd !== undefined) fs.closeSync(fd); } } else if (resource.mode === 'readonly') { if (backing.uid !== ${owners.readonlyUid} || backing.gid !== ${owners.readonlyGid} || mode !== 0o555) throw new Error('unsafe readonly worker workspace resource'); } else if (backing.uid !== ${owners.privilegedUid} || backing.gid !== ${owners.privilegedGid} || mode !== 0o755) throw new Error('unsafe mutable worker workspace resource'); };`,
+    "const secureWorkspace = (root, uid) => { const visit = (target) => { const info = fs.lstatSync(target); if (info.isSymbolicLink()) { validateResourceLink(target, info); return; } if (info.isDirectory()) { fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o750); for (const name of fs.readdirSync(target)) visit(`${target}/${name}`); fs.chownSync(target, 2000, uid); } else if (info.isFile()) { fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o640); fs.chownSync(target, 2000, uid); } else throw new Error('unsafe worker workspace node'); }; visit(root); };"
+];
+/**
+ * Fixes ownership and mode of the per-turn usage ledger directory for every
+ * Daimon organization, not just ones with a Grok agent. AGY and Codex both
+ * write here too (`onTurnUsage` in Daimon's `engineDispatcher.ts`), from the
+ * organization-uid runtime process (`uid`/`gid` below, set in
+ * `renderDaimonUidEntrypoint`) rather than the privileged broker — so this
+ * must run whether or not any Grok registration exists, and the directory
+ * must be group-writable (0770), not merely group-readable (0750): a mode
+ * that only lets the group list the directory silently defeated every
+ * AGY/Codex advisory usage write and, with it, Daimon's wake-fuse token
+ * ceiling, which now refuses to start at all if this ledger is missing or
+ * unreadable (`wakeFuse.ts`'s `ensureUsageLedgerReadable`).
+ *
+ * The directory itself is never created here: it is a persistent volume
+ * mount (`daimon-grok-usage-ledger` in `config.ts`, unconditional for every
+ * Daimon organization) that Docker always materializes before the entrypoint
+ * runs — exactly like `DAIMON_WAKE_FUSE_DIRECTORY`, whose own fix-up
+ * (`renderDaimonUidEntrypoint`) uses this same three-step order. `chown` to
+ * root first, `chmod` next, `chown` to the final owner last — never
+ * `install -d`'s create-then-chown-then-chmod order, and never a single
+ * `chown owner:group` followed by `chmod`: root only ever chmods a path it
+ * currently owns, so it never needs `CAP_FOWNER` (`runProject.ts`'s
+ * capability set grants `CAP_CHOWN` but not `CAP_FOWNER`) — chmod-ing
+ * *after* the final `chown` hands ownership to the broker uid fails with
+ * `EPERM` the moment root no longer owns the path.
+ */
+export const renderDaimonUsageLedgerProvisioning = () => {
+    const { directoryPath } = DAIMON_GROK_TURN_USAGE_LEDGER;
+    return [
+        `chown 0:0 ${directoryPath} && chmod 0770 ${directoryPath} && chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${directoryPath}`,
+        `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'probe=${directoryPath}/.daimon-usage-probe; umask 007; : > "$probe"; rm "$probe"'`
+    ];
+};
+/**
+ * Empties a directory without touching a mount point inside it.
+ *
+ * `rm -rf` and `find -delete` both fail `EBUSY` on a mount point — it is
+ * another filesystem's root, and its entry cannot be unlinked while it is
+ * mounted. A deployment that mounts a tmpfs below a directory it later clears
+ * would otherwise abort provisioning on a bare `find` failure, which is exactly
+ * how a live training launch died. Mount points are left in place and descended
+ * into; anything else that cannot be removed is reported by name.
+ *
+ * Mount points come from `/proc/self/mountinfo` field 5. The kernel
+ * octal-escapes space, tab, newline and backslash there; every path this
+ * compiler provisions is free of all four, and a path that is not would simply
+ * fail to match and be treated as an ordinary directory.
+ */
+export const MOUNT_AWARE_CLEAR_HELPER = [
+    "spawnfile_mount_points=$(awk '{print $5}' /proc/self/mountinfo)",
+    "spawnfile_is_mount() { printf '%s\\n' \"$spawnfile_mount_points\" | grep -qxF \"$1\"; }",
+    "spawnfile_holds_mount() { printf '%s\\n' \"$spawnfile_mount_points\" | grep -qE \"^$(printf '%s' \"$1\" | sed 's/[][\\.*^$/]/\\\\&/g')(/|$)\"; }",
+    "spawnfile_clear_tree() {",
+    "  spawnfile_root=$1",
+    "  [ -d \"$spawnfile_root\" ] || return 0",
+    "  for spawnfile_entry in \"$spawnfile_root\"/* \"$spawnfile_root\"/.[!.]* \"$spawnfile_root\"/..?*; do",
+    "    if [ ! -e \"$spawnfile_entry\" ] && [ ! -L \"$spawnfile_entry\" ]; then continue; fi",
+    "    if spawnfile_is_mount \"$spawnfile_entry\"; then continue; fi",
+    "    if spawnfile_holds_mount \"$spawnfile_entry\"; then spawnfile_clear_tree \"$spawnfile_entry\"; continue; fi",
+    "    rm -rf \"$spawnfile_entry\" || { echo \"cannot clear $spawnfile_entry: it is in use; a mount below a provisioned root must be declared outside it\" >&2; return 1; }",
+    "  done",
+    "}",
+    // Removes the target outright, unless it is or contains a mount point: then its contents go and the
+    // mount points and the directories holding them stay, because neither can be unlinked while mounted.
+    "spawnfile_remove_tree() {",
+    "  if [ ! -e \"$1\" ] && [ ! -L \"$1\" ]; then return 0; fi",
+    "  if spawnfile_holds_mount \"$1\"; then spawnfile_clear_tree \"$1\"; return $?; fi",
+    "  rm -rf \"$1\" || { echo \"cannot remove $1: it is in use\" >&2; return 1; }",
+    "}"
+];
+export const renderDaimonBrokerProvisioning = (plans) => {
+    const registrations = resolveDaimonGrokRegistrations(plans);
+    if (registrations.length === 0)
+        return [];
+    const workspaceResources = plans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .flatMap((plan) => plan.resources ?? [])
+        .map((resource) => ({
+        backingPath: resource.backingPath,
+        kind: resource.kind,
+        linkPath: resource.linkPath,
+        mode: resource.mode,
+        resolvedIdentity: "resolvedIdentity" in resource && typeof resource.resolvedIdentity === "string"
+            ? resource.resolvedIdentity
+            : null
+    }))
+        .sort((left, right) => left.linkPath.localeCompare(right.linkPath));
+    return renderDaimonBrokerProvisioningProgram(registrations, workspaceResources);
+};
+/**
+ * The root broker provisioning program itself, over already-resolved
+ * registrations and workspace resources.
+ *
+ * Production reaches it through {@link renderDaimonBrokerProvisioning}; the
+ * broker-capable training container reaches it directly for its single fixed
+ * slot, with `serviceOptions` pointing the turn store at per-slot tmpfs and
+ * declaring the evaluator inference ledger. Both callers get byte-identical
+ * credential, registration, worker-home, temp and spill provisioning — the
+ * whole point of sharing it rather than writing a second root program.
+ *
+ * It is re-runnable: the shell wrapper removes `/etc/daimon-engine-broker` and
+ * `/run/daimon-engine-broker` first, so a slot recycle replays exactly the
+ * audited start-up path, credential-journal recovery included.
+ */
+export const renderDaimonBrokerProvisioningProgram = (registrations, workspaceResources, serviceOptions = {}, 
+/**
+ * How the broker's `/etc` and `/run` roots are reset before provisioning.
+ * A production organization owns both as ordinary image directories and
+ * removes them outright. The training container mounts each as its own
+ * tmpfs, which cannot be unlinked, so it empties them instead — the same
+ * end state, reached the only way a mount point allows.
+ */
+rootReset = "remove", 
+/** Deny targets the worker provisioning creates when absent; see `renderDaimonGrokWorkerProvisioning`. */
+optionalDenyPaths, 
+/**
+ * Where the broker and relay get their private `TMPDIR`. Production keeps it
+ * inside the control root, which it removes and recreates exactly once. A
+ * deployment that re-provisions that root — the training slot recycle — must
+ * pass a path outside it: a `tmp/` inside a cleared root is a mount point in
+ * the training launch, and clearing a mount point fails `EBUSY`.
+ */
+brokerTmpdir = DAIMON_BROKER_TMPDIR, 
+/** Root-owned training deny targets, created after root reset and before worker attestation. */
+beforeWorkerProvisioning = []) => {
+    const program = [
+        "const crypto = require('node:crypto'); const fs = require('node:fs');",
+        `const registrations = ${JSON.stringify(registrations.map(({ agentId, home, slot, uid, workspace }) => ({ agentId, home, slot, uid, workspace })))};`,
+        `const executable = '${DAIMON_GROK_ENGINE_BROKER.grokExecutablePath}';`,
+        "const digest = crypto.createHash('sha256').update(fs.readFileSync(executable)).digest();",
+        `if (!${JSON.stringify([DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.arm64.sha256, DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.x64.sha256])}.includes(digest.toString('hex'))) throw new Error('Grok executable is not the manifest-pinned ${DAIMON_GROK_ENGINE_BROKER.grokCliVersion} build');`,
+        "const cString = (buffer, offset, length, value) => { const bytes = Buffer.from(value); if (bytes.length < 1 || bytes.length >= length || bytes.includes(0)) throw new Error('invalid broker registration'); bytes.copy(buffer, offset); };",
+        `const records = registrations.map((entry) => { const record = Buffer.alloc(692); record.writeUInt32LE(${DAIMON_GROK_ENGINE_BROKER.nativeAbiVersion}, 0); record.writeUInt32LE(entry.slot, 4); record.writeUInt32LE(entry.uid, 8); record.writeUInt32LE(entry.uid, 12); cString(record, 16, 129, entry.agentId); cString(record, 145, 256, entry.workspace); cString(record, 401, 256, entry.home); digest.copy(record, 657); return record; });`,
+        "fs.mkdirSync('/etc/daimon-engine-broker', { recursive: true, mode: 0o700 }); fs.chownSync('/etc/daimon-engine-broker', 0, 0); fs.chmodSync('/etc/daimon-engine-broker', 0o700);",
+        "fs.writeFileSync('/etc/daimon-engine-broker/registrations.bin', Buffer.concat(records), { mode: 0o400, flag: 'wx' });",
+        "fs.chownSync('/etc/daimon-engine-broker/registrations.bin', 0, 0); fs.chmodSync('/etc/daimon-engine-broker/registrations.bin', 0o400);",
+        `fs.mkdirSync('${DAIMON_BROKER_REALM}', { recursive: true, mode: 0o700 }); fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700);`,
+        // The usage ledger directory itself is provisioned unconditionally by
+        // `renderDaimonUsageLedgerProvisioning` (every Daimon organization writes
+        // here, not just Grok ones) before this script's caller reaches the
+        // broker startup this function guards; this script only ever reads the
+        // path below, for the sandbox denylist.
+        `const bootstrap = '/var/lib/spawnfile/daimon/grok-bootstrap-auth', authority = '${DAIMON_BROKER_REALM}/auth.json';`,
+        "const readSecure = (file, owner, label) => { const before = fs.lstatSync(file); if (!before.isFile() || before.isSymbolicLink() || (owner !== undefined && (before.uid !== owner || before.gid !== owner)) || (before.mode & 0o777) !== 0o600 || before.nlink !== 1 || before.size < 2 || before.size > 65536) throw new Error(`unsafe broker credential ${label}`); const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK); try { const opened = fs.fstatSync(fd); if (opened.dev !== before.dev || opened.ino !== before.ino) throw new Error(`unsafe broker credential ${label}`); const bytes = Buffer.alloc(opened.size); let offset = 0; while (offset < bytes.length) { const count = fs.readSync(fd, bytes, offset, bytes.length - offset, offset); if (count < 1) throw new Error(`unsafe broker credential ${label}`); offset += count; } return bytes; } finally { fs.closeSync(fd); } };",
+        `const atomicOwned = (target, bytes) => { const temporary = \`${"${target}"}.\${process.pid}.\${crypto.randomUUID()}.tmp\`; try { const output = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600); try { let written = 0; while (written < bytes.length) written += fs.writeSync(output, bytes, written, bytes.length - written, written); fs.fchmodSync(output, 0o600); fs.fchownSync(output, 2100, 2100); fs.fsyncSync(output); } finally { fs.closeSync(output); } fs.renameSync(temporary, target); const directory = fs.openSync(require('node:path').dirname(target), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY); try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); } } catch (error) { try { fs.unlinkSync(temporary); } catch {} throw error; } };`,
+        "let existing; try { existing = fs.lstatSync(authority); } catch (error) { if (error.code !== 'ENOENT') throw error; } const bootstrapBytes = readSecure(bootstrap, undefined, 'bootstrap'); let bootstrapRecord; try { const root = JSON.parse(bootstrapBytes.toString('utf8')), rows = root && typeof root === 'object' && !Array.isArray(root) ? Object.entries(root).filter(([key, value]) => /^https:\\/\\/auth\\.x\\.ai::/.test(key) && value && typeof value === 'object' && !Array.isArray(value)).map(([, value]) => value) : []; if (rows.length !== 1 || typeof rows[0].key !== 'string' || !rows[0].key.trim() || typeof rows[0].refresh_token !== 'string' || !rows[0].refresh_token.trim() || typeof rows[0].expires_at !== 'string' || !Number.isFinite(Date.parse(rows[0].expires_at))) throw new Error(); bootstrapRecord = true; } catch { bootstrapBytes.fill(0); throw new Error('invalid broker credential bootstrap'); } if (!bootstrapRecord) throw new Error('invalid broker credential bootstrap'); const bootstrapDigest = crypto.createHash('sha256').update(bootstrapBytes).digest('hex');",
+        `const journalRoot = '${DAIMON_BROKER_REALM}/.daimon-broker'; let journalRootExists = false; try { const info = fs.lstatSync(journalRoot); if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== 2100 || info.gid !== 2100 || (info.mode & 0o777) !== 0o700) throw new Error('unsafe broker credential journal directory'); fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); journalRootExists = true; } catch (error) { if (error.code !== 'ENOENT') throw error; }`,
+        "const credentialExpiry = (bytes) => { try { const rows = Object.entries(JSON.parse(bytes.toString('utf8'))).filter(([key]) => /^https:\\/\\/auth\\.x\\.ai::/.test(key)).map(([, value]) => value); const expiry = rows.length === 1 && typeof rows[0]?.expires_at === 'string' ? Date.parse(rows[0].expires_at) : NaN; if (!Number.isFinite(expiry)) throw new Error(); return expiry; } catch { throw new Error('invalid broker credential expiry'); } };",
+        `try { const journalPath = '${DAIMON_BROKER_REALM}/.daimon-broker/credential-journal.json'; let journal; try { const raw = readSecure(journalPath, 2100, 'recovery journal'); journal = JSON.parse(raw.toString('utf8')); raw.fill(0); } catch (error) { if (error.code !== 'ENOENT') throw error; } const stale = journal?.version === 'noopolis.daimon.broker-credential-journal.v1' && journal.state === 'stale'; const recover = () => { if (!stale || !Number.isSafeInteger(journal.generation) || journal.generation < 0 || !/^[a-f0-9]{64}$/.test(journal.sourceDigest) || journal.sourceDigest !== journal.promotedDigest || bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); atomicOwned(authority, bootstrapBytes); const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } }; if (!existing) { if (journal) throw new Error('broker credential authority missing; refusing bootstrap rollback'); else atomicOwned(authority, bootstrapBytes); } else { const authorityBytes = readSecure(authority, 2100, 'authority'); try { const authorityDigest = crypto.createHash('sha256').update(authorityBytes).digest('hex'); if (stale) { if (authorityDigest !== journal.sourceDigest && authorityDigest !== bootstrapDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest === bootstrapDigest && bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest !== bootstrapDigest && credentialExpiry(bootstrapBytes) <= credentialExpiry(authorityBytes)) throw new Error('older broker bootstrap cannot recover newer realm'); if (authorityDigest === bootstrapDigest) { const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } } else recover(); } } finally { authorityBytes.fill(0); } } } finally { bootstrapBytes.fill(0); if (journalRootExists) { fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); fs.chownSync(journalRoot, 2100, 2100); } fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700); fs.chownSync('${DAIMON_BROKER_REALM}', 2100, 2100); }`,
+        ...renderDaimonWorkspaceResourceSecurity(workspaceResources),
+        ...renderDaimonGrokWorkerProvisioning(registrations, serviceOptions, ...(optionalDenyPaths ? [optionalDenyPaths] : [])),
+        `fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700); fs.chownSync('${DAIMON_BROKER_REALM}', 2100, 2100);`,
+        "fs.chmodSync('/etc/daimon-engine-broker', 0o555);"
+    ].join("\n");
+    return [
+        "if [ -d /etc/daimon-engine-broker ]; then chmod u+rwx /etc/daimon-engine-broker; fi",
+        "if [ -d /run/daimon-engine-broker ]; then chmod u+rwx /run/daimon-engine-broker; fi",
+        ...(rootReset === "remove"
+            ? ["rm -rf /etc/daimon-engine-broker /run/daimon-engine-broker"]
+            : [...MOUNT_AWARE_CLEAR_HELPER, "for broker_root in /etc/daimon-engine-broker /run/daimon-engine-broker; do spawnfile_clear_tree \"$broker_root\"; done"]),
+        `install -d -o root -g ${DAIMON_BROKER_UID} -m 0731 /run/daimon-engine-broker`,
+        `install -d -o ${DAIMON_BROKER_UID} -g ${DAIMON_BROKER_UID} -m 0700 ${brokerTmpdir}`,
+        ...beforeWorkerProvisioning,
+        "node <<'SPAWNFILE_DAIMON_BROKER_PROVISION'",
+        program,
+        "SPAWNFILE_DAIMON_BROKER_PROVISION"
+    ];
+};

package/dist/compiler/containerDaimonGrokTaskClock.d.ts

@@ -0,0 +1,5 @@
+import type { DaimonGrokRegistration } from "./containerDaimonGrokWorkerRender.js";
+/** Exit without closing/unlinking the listener: the next process needs a socket inode, not a live peer. */
+export declare const GROK_SOCKET_PLACEHOLDER_PROGRAM: string;
+/** Lines inside the shared root program, after its canonical-path and ownership helpers. */
+export declare const renderDaimonGrokTaskClockProvisioning: (registrations: readonly DaimonGrokRegistration[]) => string[];

package/dist/compiler/containerDaimonGrokTaskClock.js

@@ -0,0 +1,29 @@
+import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
+const broker = DAIMON_GROK_ENGINE_BROKER;
+const clock = broker.worker.taskClock;
+/** Exit without closing/unlinking the listener: the next process needs a socket inode, not a live peer. */
+export const GROK_SOCKET_PLACEHOLDER_PROGRAM = [
+    "const fs = require('node:fs'), net = require('node:net');",
+    "const [file, uid, gid] = process.argv.slice(1);",
+    "const server = net.createServer(); server.on('error', (error) => { console.error(error.message); process.exit(1); });",
+    "server.listen(file, () => { fs.chmodSync(file, 0o600); fs.chownSync(file, Number(uid), Number(gid)); process.exit(0); });"
+].join("\n");
+/** Lines inside the shared root program, after its canonical-path and ownership helpers. */
+export const renderDaimonGrokTaskClockProvisioning = (registrations) => {
+    if (!registrations.some((entry) => entry.configVariant === "clocked"))
+        return [];
+    return [
+        `const taskClock = ${JSON.stringify(clock)};`,
+        `const clocks = ${JSON.stringify(registrations.filter(entry => entry.configVariant === "clocked").map(entry => ({ directoryPath: clock.slotDirectoryPattern.replace("{slot}", String(entry.slot)), timestampFilePath: clock.slotFilePattern.replace("{slot}", String(entry.slot)) })))};`,
+        // All ancestors must stay searchable and non-writable by the worker, including the control root.
+        "for (const entry of grokWorkers) { for (let at = require('node:path').dirname(taskClock.rootDirectoryPath);; at = require('node:path').dirname(at)) { const info = assertCanonical(at, 'task clock ancestor'); const access = info.uid === entry.uid ? (info.mode >> 6) & 7 : info.gid === entry.uid ? (info.mode >> 3) & 7 : info.mode & 7; if (!info.isDirectory() || !(access & 1) || (access & 2)) throw new Error(`unsafe task clock ancestor: ${at}`); if (at === '/') break; } }",
+        "ensureDirectory(taskClock.rootDirectoryPath, 0, 0, taskClock.directoryMode); assertCanonical(taskClock.rootDirectoryPath, 'task clock root');",
+        "for (const current of clocks) { ensureDirectory(current.directoryPath, 0, 0, taskClock.directoryMode); assertCanonical(current.directoryPath, 'task clock');",
+        "ensureExactFile(current.timestampFilePath, '+0\\n', taskClock.fileMode); fs.chownSync(current.timestampFilePath, taskClock.ownerUid, taskClock.ownerUid);",
+        "withMode(current.directoryPath, taskClock.directoryMode, taskClock.ownerUid, taskClock.ownerUid); }",
+        // Startup attestation runs BEFORE the backend listens. All deny targets must already exist,
+        // and the backend only replaces a socket owned by its uid. Listeners unlink these real socket
+        // nodes in turn; readiness must prove replacement, never certify a placeholder as a listener.
+        `for (const socket of ${JSON.stringify([broker.controlSocketPath, broker.backendSocketPath, broker.launcherSocketPath])}) { require('node:child_process').execFileSync(process.execPath, ['-e', ${JSON.stringify(GROK_SOCKET_PLACEHOLDER_PROGRAM)}, socket, '${clock.ownerUid}', '${clock.ownerUid}'], { timeout: 5000, stdio: 'pipe' }); const info = fs.lstatSync(socket); if (!info.isSocket() || info.uid !== ${clock.ownerUid} || info.gid !== ${clock.ownerUid} || (info.mode & 0o7777) !== 0o600) throw new Error('unsafe broker socket placeholder'); }`
+    ];
+};

package/dist/compiler/containerDaimonGrokWorkerProvisioning.d.ts

@@ -0,0 +1,38 @@
+import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from "./containerDaimonGrokWorkerRender.js";
+/**
+ * Root provisioning for every brokered Grok worker, as lines of the broker's
+ * node provisioning program (which already defines `crypto`, `fs`, and
+ * `secureWorkspace`).
+ *
+ * Layout per Daimon's `GROK_ENGINE_BROKER.worker.home` (attested by the broker
+ * before every turn): `$GROK_HOME` (`<home>/.grok`) and `$GROK_HOME/sessions`
+ * are `root:<worker> 1771`; `config.toml` (Daimon's renderer bytes for the
+ * declared model x effort), `sandbox.toml`, and the empty `trusted_folders.toml`,
+ * `managed_config.toml` and `requirements.toml` are `root:root 0444`, so the
+ * worker can neither write, rename nor unlink any file that decides a turn —
+ * trust included; `sessions/sandbox-events.jsonl` is `<worker>:<broker> 0640`.
+ *
+ * Every path handed to Daimon (workspace, home, profile, events, and each deny
+ * entry) must be canonical: it exists, is not a symlink, and resolves to itself.
+ * Daimon never resolves these paths, so a symlinked entry would silently mask
+ * the wrong inode. Root chmods only paths it owns at that moment (no
+ * `CAP_FOWNER`): reclaim, mode, then hand over.
+ */
+export declare const renderDaimonGrokWorkerProvisioning: (registrations: readonly DaimonGrokRegistration[], serviceOptions?: DaimonGrokServiceConfigOptions, 
+/**
+ * Deny targets this program creates root-owned `0700` when they are absent,
+ * so every mask always has an inode. The default is the production
+ * container's set; the training container passes its own, because its roots
+ * are tmpfs mounts and `/run/secrets` and the shared state roots do not
+ * exist there at all.
+ */
+optionalDenyPaths?: readonly string[], scope?: "container" | "slot") => string[];
+/**
+ * Grok 1.0.34 runs every sandbox profile inside bubblewrap, which needs
+ * unprivileged user namespaces. Ubuntu 24.04+ hosts (and Colima's default VM)
+ * ship `kernel.apparmor_restrict_unprivileged_userns=1`, under which bubblewrap
+ * cannot create them even with the pinned seccomp profile — every worker turn
+ * would then fail attestation long after startup. The container sees the host
+ * kernel's sysctls read-only, so this refuses to start with the fix named.
+ */
+export declare const renderDaimonGrokHostPreflight: (procSys?: string) => string[];

package/dist/compiler/containerDaimonGrokWorkerProvisioning.js

@@ -0,0 +1,130 @@
+import { renderDaimonGrokTaskClockProvisioning } from "./containerDaimonGrokTaskClock.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
+import { resolveDaimonGrokClockedWorkerConfig, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
+import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
+import { DAIMON_GROK_DENIED_STATE_ROOTS, DAIMON_GROK_OPTIONAL_DENY_PATHS, DAIMON_GROK_WORKER_READ_ONLY_FILES, DAIMON_WORKER_ROOT, renderDaimonGrokServiceConfig } from "./containerDaimonGrokWorkerRender.js";
+/** Only the bytes the program writes; everything else it needs is recomputed or checked in place. */
+const programRegistration = (entry) => ({
+    agentId: entry.agentId,
+    config: entry.config,
+    configSha256: entry.configSha256,
+    deferredDenyPaths: entry.deferredDenyPaths,
+    denyPaths: entry.denyPaths,
+    eventsPath: entry.eventsPath,
+    grokHome: entry.grokHome,
+    home: entry.home,
+    model: entry.model,
+    profile: entry.profile,
+    profilePath: entry.profilePath,
+    privateTmp: entry.privateTmp,
+    profileSha256: entry.profileSha256,
+    reasoningEffort: entry.reasoningEffort,
+    runtimeHome: entry.runtimeHome,
+    runtimeHomeMounts: entry.runtimeHomeMounts,
+    spillDirectory: entry.spillDirectory,
+    slot: entry.slot,
+    uid: entry.uid,
+    workspace: entry.workspace
+});
+/**
+ * Root provisioning for every brokered Grok worker, as lines of the broker's
+ * node provisioning program (which already defines `crypto`, `fs`, and
+ * `secureWorkspace`).
+ *
+ * Layout per Daimon's `GROK_ENGINE_BROKER.worker.home` (attested by the broker
+ * before every turn): `$GROK_HOME` (`<home>/.grok`) and `$GROK_HOME/sessions`
+ * are `root:<worker> 1771`; `config.toml` (Daimon's renderer bytes for the
+ * declared model x effort), `sandbox.toml`, and the empty `trusted_folders.toml`,
+ * `managed_config.toml` and `requirements.toml` are `root:root 0444`, so the
+ * worker can neither write, rename nor unlink any file that decides a turn —
+ * trust included; `sessions/sandbox-events.jsonl` is `<worker>:<broker> 0640`.
+ *
+ * Every path handed to Daimon (workspace, home, profile, events, and each deny
+ * entry) must be canonical: it exists, is not a symlink, and resolves to itself.
+ * Daimon never resolves these paths, so a symlinked entry would silently mask
+ * the wrong inode. Root chmods only paths it owns at that moment (no
+ * `CAP_FOWNER`): reclaim, mode, then hand over.
+ */
+export const renderDaimonGrokWorkerProvisioning = (registrations, serviceOptions = {}, 
+/**
+ * Deny targets this program creates root-owned `0700` when they are absent,
+ * so every mask always has an inode. The default is the production
+ * container's set; the training container passes its own, because its roots
+ * are tmpfs mounts and `/run/secrets` and the shared state roots do not
+ * exist there at all.
+ */
+optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS], scope = "container") => [
+    `const grokWorkers = ${JSON.stringify(registrations.map(programRegistration))};`,
+    `const optionalDenyPaths = new Set(${JSON.stringify([...optionalDenyPaths])});`,
+    // Derive each expected hash from manifest-validated bytes, never from the registration's digest.
+    // Clocked templates are pinned at slot zero, then specialized by the contract resolver.
+    `const pinnedConfigSha256 = ${JSON.stringify(registrations.map(entry => (entry.configVariant === "clocked"
+        ? resolveDaimonGrokClockedWorkerConfig(entry.model, entry.reasoningEffort, entry.slot)
+        : resolveDaimonGrokWorkerConfig(entry.model, entry.reasoningEffort)).sha256))};`,
+    "const sha256Hex = (value) => crypto.createHash('sha256').update(value).digest('hex');",
+    "for (const [index, entry] of grokWorkers.entries()) { if (sha256Hex(entry.config) !== entry.configSha256 || pinnedConfigSha256[index] !== entry.configSha256 || sha256Hex(entry.profile) !== entry.profileSha256 || entry.denyPaths.length === 0) throw new Error(`Grok worker contract bytes for ${entry.agentId} do not match their pins`); }",
+    // Root holds no CAP_FOWNER: every mode change reclaims the inode, sets the mode, then restores or hands over ownership.
+    "const withMode = (target, mode, uid, gid) => { const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`unsafe Grok worker directory: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
+    // Root holds no CAP_DAC_OVERRIDE either: before it may create inside a directory the ownership pass
+    // already handed to another uid, it takes the inode back. The caller sets the final owner and mode.
+    "const reclaimForRoot = (target) => { const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`unsafe Grok worker directory: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o700); };",
+    "const traversable = (target) => { for (let ancestor = require('node:path').dirname(target); ancestor.startsWith('/var/lib/spawnfile/') && ancestor.length > '/var/lib/spawnfile'.length; ancestor = require('node:path').dirname(ancestor)) { const info = fs.lstatSync(ancestor); if ((info.mode & 0o011) !== 0o011) withMode(ancestor, (info.mode & 0o7777) | 0o011, info.uid, info.gid); } };",
+    "const assertCanonical = (target, label) => { const info = fs.lstatSync(target); if (info.isSymbolicLink() || fs.realpathSync(target) !== target) throw new Error(`Grok worker ${label} is not a canonical non-symlink path: ${target}`); return info; };",
+    "const ensureDirectory = (target, uid, gid, mode) => { fs.mkdirSync(target, { recursive: true, mode: 0o700 }); const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('unsafe worker runtime directory'); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
+    "const ensureExactFile = (target, content, mode) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, content, { mode, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) throw new Error('unsafe worker runtime file'); if (fs.readFileSync(target, 'utf8') !== content) throw new Error(`worker runtime file identity mismatch: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); };",
+    `const ensureEventsFile = (target, uid) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, '', { mode: 0o640, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.uid !== uid && info.uid !== 0) || ![0, uid, ${DAIMON_BROKER_UID}].includes(info.gid) || ![0o600, 0o640, 0o644].includes(info.mode & 0o777)) throw new Error('unsafe worker attestation events'); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o640); fs.chownSync(target, uid, ${DAIMON_BROKER_UID}); };`,
+    ...(scope === "slot" ? [] : renderDaimonGrokTaskClockProvisioning(registrations)),
+    ...(scope === "slot" ? [] : [`fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`]),
+    // Pass 1: every workspace and home exists, root-held, before any deny list is checked.
+    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ${scope === "container" ? "ensureDirectory(entry.home, 0, 0, 0o700);" : ""} ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
+    "for (const denied of optionalDenyPaths) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.mkdirSync(denied, { mode: 0o700 }); fs.chownSync(denied, 0, 0); fs.chmodSync(denied, 0o700); } }",
+    "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { try { assertCanonical(denied, 'deny path'); } catch (error) { if (error.code === 'ENOENT' && entry.deferredDenyPaths.includes(denied)) continue; if (error.code === 'ENOENT') throw new Error(`Grok worker deny path is missing: ${denied}`); throw error; } }",
+    // Pass 2: exact root-owned read-only files, the events file, then the final sticky modes.
+    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ${scope === "container" ? `ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710);` : ""} for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
+    // Worker-private temp: the launcher compiles TMPDIR=<home>/tmp, the only temp the worker may write. It is
+    // created in the pass above, while the home is still root-owned: root here holds no CAP_DAC_OVERRIDE, so
+    // once the home is `<worker>:<broker> 0710` root can no longer create anything inside it.
+    `for (const entry of grokWorkers) { ${scope === "container" ? "ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700);" : ""} assertCanonical(entry.privateTmp, 'private temp'); }`,
+    // Spills: <runtimeHome>/tool-output 2000:<worker> 2750 (setgid) under a runtime home the worker's group can
+    // traverse. Root reclaims the runtime home before creating the spill directory: the compiler lists every
+    // organization runtime home as a private directory, so the container's ownership pass has already handed
+    // it to the organization uid by the time this runs, and root here holds no CAP_DAC_OVERRIDE — a bare
+    // `mkdir` inside a home root no longer owns fails EACCES and the container exits 1 at start. The trailing
+    // `withMode` still narrows the home to its final `2000:<worker> 0710`, so the end state is unchanged.
+    `for (const entry of grokWorkers) { traversable(entry.runtimeHome); fs.mkdirSync(entry.runtimeHome, { recursive: true, mode: 0o700 }); assertCanonical(entry.runtimeHome, 'runtime home'); reclaimForRoot(entry.runtimeHome); try { fs.mkdirSync(entry.spillDirectory, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; } assertCanonical(entry.spillDirectory, 'spill directory'); withMode(entry.spillDirectory, 0o2750, ${DAIMON_ORGANIZATION_UID}, entry.uid); for (const mounted of entry.runtimeHomeMounts) { assertCanonical(mounted, 'runtime home mount'); withMode(mounted, 0o700, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } withMode(entry.runtimeHome, 0o710, ${DAIMON_ORGANIZATION_UID}, entry.uid); }`,
+    // Shared temp: Grok refuses a profile denying /tmp or /var/tmp, so modes close them: root:<org group> 1774 lets workers list names only.
+    ...(scope === "slot" ? [] : [`for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`]),
+    // Deny-path placement, asserted once every mode above is final. A resource backing the organization
+    // entrypoint only materializes later is created here, empty and root-owned, rather than skipped: the
+    // engine broker starts before that entrypoint runs and its own placement preflight refuses a deny target
+    // that does not exist, which exits the container 1 before any agent attaches. `prepare_bundle_resource`
+    // and `prepare_git_resource` both treat an empty backing as unmaterialized, so the content still lands.
+    // Grok 1.0.34 materializes each deny
+    // target inside bubblewrap AS THE WORKER UID, so the worker must be able to search every ancestor and
+    // the target must already exist; one unplaceable entry makes Grok refuse the whole profile and every
+    // turn of that worker fails with a bare `bwrap: Can't create file at ...: Permission denied`. Root here
+    // holds CAP_DAC_READ_SEARCH, so it can read every mode the worker cannot, and decides for it.
+    // A deferred backing usually sits under a resource instance directory the ownership pass has already
+    // handed to the organization uid, so root has to borrow each missing ancestor to create inside it and
+    // hand it straight back: the entrypoint that materializes the resource depends on those modes.
+    `const createDeferredDenyTarget = (target) => { const parent = require('node:path').dirname(target); let info; try { info = fs.lstatSync(parent); } catch (error) { if (error.code !== 'ENOENT') throw error; createDeferredDenyTarget(parent); info = fs.lstatSync(parent); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(\`unsafe deferred deny parent: \${parent}\`); const mode = info.mode & 0o7777, borrowed = info.uid !== 0 || (mode & 0o300) !== 0o300; if (borrowed) { fs.chownSync(parent, 0, 0); fs.chmodSync(parent, 0o700); } try { fs.mkdirSync(target, { mode: 0o755 }); fs.chmodSync(target, 0o755); fs.chownSync(target, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } finally { if (borrowed) { fs.chmodSync(parent, mode); fs.chownSync(parent, info.uid, info.gid); } } };`,
+    "const searches = (info, uid, gid) => info.uid === uid ? (info.mode & 0o100) !== 0 : info.gid === gid ? (info.mode & 0o010) !== 0 : (info.mode & 0o001) !== 0;",
+    "const assertPlaceable = (denied, uid, gid) => { const parts = denied.split('/').slice(1); let at = ''; for (const part of parts.slice(0, -1)) { at += `/${part}`; let info; try { info = fs.lstatSync(at); } catch (error) { throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} could not be read (${error.code})`); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} is not a directory`); if (!searches(info, uid, gid)) throw new Error(`Grok worker deny path ${denied} is not placeable: worker uid ${uid} cannot search ${at} (${(info.mode & 0o7777).toString(8)} ${info.uid}:${info.gid}); deny that directory itself instead`); } };",
+    "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { if (entry.deferredDenyPaths.includes(denied)) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; createDeferredDenyTarget(denied); } } assertPlaceable(denied, entry.uid, entry.uid); }",
+    ...(scope === "slot" ? [] : [`const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations, serviceOptions))};`,
+        "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.slot === registration.slot); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
+        `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`])
+];
+const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+/**
+ * Grok 1.0.34 runs every sandbox profile inside bubblewrap, which needs
+ * unprivileged user namespaces. Ubuntu 24.04+ hosts (and Colima's default VM)
+ * ship `kernel.apparmor_restrict_unprivileged_userns=1`, under which bubblewrap
+ * cannot create them even with the pinned seccomp profile — every worker turn
+ * would then fail attestation long after startup. The container sees the host
+ * kernel's sysctls read-only, so this refuses to start with the fix named.
+ */
+export const renderDaimonGrokHostPreflight = (procSys = "/proc/sys") => [
+    `if [ -r ${shellQuote(`${procSys}/kernel/apparmor_restrict_unprivileged_userns`)} ] && [ "$(cat ${shellQuote(`${procSys}/kernel/apparmor_restrict_unprivileged_userns`)})" != 0 ]; then echo "Daimon Grok workers need unprivileged user namespaces for bubblewrap: set kernel.apparmor_restrict_unprivileged_userns=0 on the Docker host (sysctl -w kernel.apparmor_restrict_unprivileged_userns=0; persist it in /etc/sysctl.d)" >&2; exit 1; fi`,
+    `if [ -r ${shellQuote(`${procSys}/user/max_user_namespaces`)} ] && [ "$(cat ${shellQuote(`${procSys}/user/max_user_namespaces`)})" = 0 ]; then echo "Daimon Grok workers need unprivileged user namespaces for bubblewrap: user.max_user_namespaces is 0 on the Docker host" >&2; exit 1; fi`
+];