spawnfile 0.1.14 → 0.1.18

package/dist/compiler/containerDaimonGrokWorkerRender.d.ts

@@ -0,0 +1,197 @@
+import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../runtime/daimon/contractManifest.js";
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+export declare const DAIMON_WORKER_ROOT = "/var/lib/daimon-workers";
+export declare const DAIMON_GROK_WORKER_READ_ONLY_FILES: readonly ["config.toml", "managed_config.toml", "requirements.toml", "sandbox.toml", "trusted_folders.toml"];
+/** Container paths no Grok worker may read that nothing else guarantees to exist; provisioning creates them root-owned 0700 when absent. */
+export declare const DAIMON_GROK_OPTIONAL_DENY_PATHS: readonly ["/run/secrets", "/run/spawnfile", "/run/spawnfile-secrets", "/run/world"];
+/**
+ * The organization runtime state directory — the parent of the durable wake
+ * acceptance store. The ownership guard secures it to `0700 2000:2000` for
+ * every Daimon organization; the acceptance store beneath it is also on every
+ * Grok worker's sandbox deny list.
+ */
+export declare const DAIMON_ORGANIZATION_STATE_DIRECTORY: string;
+/**
+ * The deny entry that protects the durable wake-acceptance store: the
+ * organization state directory the store lives in, not the store itself.
+ *
+ * Grok 1.0.34 materializes every `deny` target inside bubblewrap **as the
+ * worker uid** (it bind-mounts `$GROK_HOME/sandbox-blocked-{file,dir}` over
+ * the target), so an entry is placeable only when the worker can search every
+ * ancestor directory and the target already exists. The ownership guard secures
+ * this state directory to `0700 2000:2000`, so the store beneath it can never
+ * be a deny entry — and a single unplaceable entry makes Grok refuse the whole
+ * profile, failing *every* turn with `bwrap: Can't create file at …:
+ * Permission denied`, not just that path (matrix:
+ * `.runtime/grok-deny-placement/EVIDENCE.md`).
+ *
+ * Lifting the mask to the directory is strictly stronger than masking the store
+ * — nothing else lives there — and it adds no traversal right to the worker,
+ * which opening the directory with `o+x` would have done.
+ */
+export declare const daimonGrokAcceptanceStoreDenyPath: (instanceRoot: string) => string;
+/**
+ * Paths Grok 1.0.34's strict base profile grants (read or read-write). Grok
+ * refuses to start when a deny entry equals or contains one of them (verified
+ * for `/tmp`, `/var/tmp`, `/run`, `/etc` and `sessions`; `/tmp/sub` works), so a
+ * deny entry must always sit strictly below every grant it touches.
+ */
+export declare const DAIMON_GROK_BASE_PROFILE_GRANTS: readonly ["/bin", "/dev", "/etc", "/lib", "/proc", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var", "/var/tmp"];
+export declare const DAIMON_GROK_MAX_REGISTERED_PATH_BYTES = 255;
+/**
+ * The canonical path rule Daimon's service parser and native launcher enforce:
+ * absolute, no empty, `.` or `..` component, no trailing slash, and at most 255
+ * bytes (the registration record's NUL-terminated 256-byte fields).
+ */
+export declare const assertCanonicalRegisteredPath: (label: string, value: string) => string;
+export interface DaimonGrokRegistration {
+    agentId: string;
+    config: string;
+    configSha256: string;
+    /** Selects trusted config bytes; production retains the unclocked default. */
+    configVariant?: "unclocked" | "clocked";
+    denyPaths: string[];
+    /** Deny entries the main entrypoint materializes after root provisioning (workspace resource backings); absent is allowed there, a symlink never. */
+    deferredDenyPaths: string[];
+    eventsPath: string;
+    grokHome: string;
+    home: string;
+    /**
+     * The per-turn limits this registration declares. A wake may only lower them
+     * (Daimon refuses a raise as `invalid_request`), so a deployment that admits
+     * wakes above the manifest defaults must declare them here.
+     */
+    limits?: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+    model: DaimonGrokBrokerModel;
+    profile: string;
+    profilePath: string;
+    profileSha256: string;
+    /** `<home>/tmp`: the launcher's compiled `TMPDIR` for this worker. */
+    privateTmp: string;
+    reasoningEffort: DaimonGrokBrokerReasoningEffort;
+    /** The organization runtime home whose `tool-output/` this worker reads. */
+    runtimeHome: string;
+    /** Persistent mounts inside this agent's runtime home; Spawnfile keeps each `0700` under the traversable home. */
+    runtimeHomeMounts: string[];
+    /** `<runtimeHome>/tool-output`: setgid spill directory in the worker's group. */
+    spillDirectory: string;
+    slot: number;
+    uid: number;
+    usageLedgerPath: string;
+    workspace: string;
+}
+/**
+ * Spawnfile-managed state roots no Grok worker needs: the shared Moltnet store
+ * (server data, node/bridge configs, receipt stores, network state), per-agent
+ * Moltnet open-mode token directories, and declared Mneme memory banks. A
+ * worker reaches Moltnet and memory only through Daimon's MCP tools, which run
+ * in the organization process, never by reading these files. Provisioning
+ * creates each root-owned `0700` when absent so the mask always has a target.
+ */
+export declare const DAIMON_GROK_DENIED_STATE_ROOTS: readonly ["/var/lib/spawnfile/agents", "/var/lib/spawnfile/memory", "/var/lib/spawnfile/moltnet"];
+/**
+ * One brokered worker's sandbox deny list.
+ *
+ * Daimon's own protected set for the agent (`grokSandboxProtectedPaths`: the
+ * Grok bootstrap and realm, the AGY realm and unlock secret when any agent is
+ * AGY, the organization state directory that holds the wake-acceptance store,
+ * and every peer's runtime home and workspace) is always kept verbatim, so a Daimon projection over the same inputs renders
+ * the same profile. This deployment adds everything else the container
+ * provisions that the worker does not need: the organization config directory
+ * (all agents' instructions and any env files), every persistent mount of
+ * every runtime plan (the worker's own tool state, credential home and memory
+ * included — it reaches them only through Daimon), every other runtime
+ * instance root, the shared Moltnet/agent/memory state roots, every workspace
+ * resource backing path not linked from this agent's own workspace, the broker's
+ * `/etc` and `/run` directories, the usage ledger and wake fuse, every other
+ * worker's home, and the container secret roots.
+ *
+ * Allowed on purpose: the agent's own workspace (the worker's cwd), its own
+ * runtime home directory itself (Daimon's tool-result spill contract names paths
+ * under it; its contents are persistent mounts and denied), its own worker home,
+ * and backing paths of resources linked into its own workspace (a mask over the
+ * backing inode would also hide the agent's own resource through its link).
+ *
+ * Grok 1.0.34's strict base reads all of `/run`, `/var`, `/tmp` and `/etc`, and
+ * macOS bind mounts ignore unix modes, so this list — not file modes — is the
+ * boundary. Masks cannot nest: an added entry already covered by another entry
+ * is dropped, and an added entry that would cover a Daimon entry is refused.
+ *
+ * Every entry must also be *placeable*: Grok materializes each deny target
+ * inside bubblewrap as the worker uid, so the target must exist and the worker
+ * must be able to search every ancestor. That depends on modes, not paths, so
+ * the root provisioning program asserts it once every mode is final and refuses
+ * to start the container otherwise (`containerDaimonGrokWorkerProvisioning.ts`);
+ * here a protected path whose parent is private is lifted to that parent
+ * instead (`daimonGrokAcceptanceStoreDenyPath`).
+ */
+export declare const resolveDaimonGrokWorkerDenyPaths: (plans: readonly RuntimeTargetPlan[], plan: RuntimeTargetPlan, agentId: string, workerHomes: readonly string[], ownHome: string) => string[];
+export declare const resolveDaimonGrokRegistrations: (plans: RuntimeTargetPlan[]) => DaimonGrokRegistration[];
+export interface DaimonGrokServiceConfigOptions {
+    /** Repeated agent IDs use v3 slot policies; production retains v2 by default. */
+    version?: "v3";
+    maxRunRequests?: number;
+    runRequestStore?: string;
+    /**
+     * Where the broker keeps its durable turn registry. Production keeps it on
+     * the realm volume beside the credential; training overrides it to per-slot
+     * tmpfs so a recycled slot can never replay trial N's sealed turn in trial
+     * N+1 (R2), and refuses any path on the realm volume for that reason.
+     */
+    turnStore?: string;
+    /** `service.json` v2's optional evaluator inference ledger. Without it the broker refuses every grant. */
+    inferenceLedgerPath?: string;
+}
+/** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
+export declare const renderDaimonGrokServiceConfig: (registrations: readonly DaimonGrokRegistration[], options?: DaimonGrokServiceConfigOptions) => {
+    slotPolicies?: {
+        slot: number;
+        usageLedgerPath: string;
+        limits: {
+            maxRequests: 32;
+            maxTokens: 300000;
+            timeoutMs: 240000;
+        } | {
+            maxRequests: number;
+            maxTokens: number;
+            timeoutMs: number;
+        };
+        model: {
+            id: "grok-4.6" | "grok-4.5" | "grok-build";
+            reasoningEffort: "high" | "medium" | "low";
+        };
+    }[] | undefined;
+    registrations: {
+        usageLedgerPath?: string | undefined;
+        limits?: {
+            maxRequests: 32;
+            maxTokens: 300000;
+            timeoutMs: 240000;
+        } | {
+            maxRequests: number;
+            maxTokens: number;
+            timeoutMs: number;
+        } | undefined;
+        model?: {
+            id: "grok-4.6" | "grok-4.5" | "grok-build";
+            reasoningEffort: "high" | "medium" | "low";
+        } | undefined;
+        agentId: string;
+        slot: number;
+        workerUid: number;
+        workspace: string;
+        profilePath: string;
+        eventsPath: string;
+        profileSha256: string;
+    }[];
+    inferenceLedgerPath?: string | undefined;
+    runRequestStore?: string | undefined;
+    maxRunRequests?: number | undefined;
+    version: "noopolis.daimon.engine-broker-service.v2" | "noopolis.daimon.engine-broker-service.v3";
+    credentialHome: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+    turnStore: string;
+};

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -0,0 +1,281 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { resolveDaimonGrokRegistrationLimits } from "../runtime/daimon/grokTurnLimits.js";
+import { DAIMON_ORGANIZATION_TARGET_ID, DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY, DAIMON_RUNTIME_HOMES_DIRECTORY, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER, DAIMON_RUNTIME_HOME_ROOT } from "../runtime/daimon/contractManifest.js";
+import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
+import { DAIMON_FIRST_WORKER_UID } from "../runtime/daimon/runtimeIdentity.js";
+export const DAIMON_WORKER_ROOT = "/var/lib/daimon-workers";
+export const DAIMON_GROK_WORKER_READ_ONLY_FILES = DAIMON_GROK_ENGINE_BROKER.worker.home.readOnlyFiles.names;
+/** Container paths no Grok worker may read that nothing else guarantees to exist; provisioning creates them root-owned 0700 when absent. */
+export const DAIMON_GROK_OPTIONAL_DENY_PATHS = ["/run/secrets", "/run/spawnfile", "/run/spawnfile-secrets", "/run/world"];
+/**
+ * The organization runtime state directory — the parent of the durable wake
+ * acceptance store. The ownership guard secures it to `0700 2000:2000` for
+ * every Daimon organization; the acceptance store beneath it is also on every
+ * Grok worker's sandbox deny list.
+ */
+export const DAIMON_ORGANIZATION_STATE_DIRECTORY = path.posix.join(DAIMON_RUNTIME_HOME_ROOT, DAIMON_ORGANIZATION_TARGET_ID, "state");
+/**
+ * The deny entry that protects the durable wake-acceptance store: the
+ * organization state directory the store lives in, not the store itself.
+ *
+ * Grok 1.0.34 materializes every `deny` target inside bubblewrap **as the
+ * worker uid** (it bind-mounts `$GROK_HOME/sandbox-blocked-{file,dir}` over
+ * the target), so an entry is placeable only when the worker can search every
+ * ancestor directory and the target already exists. The ownership guard secures
+ * this state directory to `0700 2000:2000`, so the store beneath it can never
+ * be a deny entry — and a single unplaceable entry makes Grok refuse the whole
+ * profile, failing *every* turn with `bwrap: Can't create file at …:
+ * Permission denied`, not just that path (matrix:
+ * `.runtime/grok-deny-placement/EVIDENCE.md`).
+ *
+ * Lifting the mask to the directory is strictly stronger than masking the store
+ * — nothing else lives there — and it adds no traversal right to the worker,
+ * which opening the directory with `o+x` would have done.
+ */
+export const daimonGrokAcceptanceStoreDenyPath = (instanceRoot) => path.posix.dirname(path.posix.join(instanceRoot, DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY));
+/**
+ * Paths Grok 1.0.34's strict base profile grants (read or read-write). Grok
+ * refuses to start when a deny entry equals or contains one of them (verified
+ * for `/tmp`, `/var/tmp`, `/run`, `/etc` and `sessions`; `/tmp/sub` works), so a
+ * deny entry must always sit strictly below every grant it touches.
+ */
+export const DAIMON_GROK_BASE_PROFILE_GRANTS = ["/bin", "/dev", "/etc", "/lib", "/proc", "/run", "/sbin", "/sys", "/tmp", "/usr", "/var", "/var/tmp"];
+export const DAIMON_GROK_MAX_REGISTERED_PATH_BYTES = 255;
+/**
+ * The canonical path rule Daimon's service parser and native launcher enforce:
+ * absolute, no empty, `.` or `..` component, no trailing slash, and at most 255
+ * bytes (the registration record's NUL-terminated 256-byte fields).
+ */
+export const assertCanonicalRegisteredPath = (label, value) => {
+    const components = value.split("/").slice(1);
+    if (!value.startsWith("/") || value.length < 2 || value.endsWith("/") || components.some((part) => part === "" || part === "." || part === "..")
+        || path.posix.normalize(value) !== value || value.includes("\0") || Buffer.byteLength(value) > DAIMON_GROK_MAX_REGISTERED_PATH_BYTES) {
+        fail(`Grok worker ${label} is not a canonical registered path: ${JSON.stringify(value)}`);
+    }
+    return value;
+};
+const nodeSlug = (nodeId) => nodeId.replace(/^agent:/u, "")
+    .toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "");
+const fail = (message) => {
+    throw new SpawnfileError("compile_error", message);
+};
+const declaredModel = (plan, agentId) => {
+    const declared = plan.grokModelByNodeId?.[agentId];
+    if (!declared || !DAIMON_GROK_BROKER_MODELS.includes(declared.model)
+        || !DAIMON_GROK_BROKER_REASONING_EFFORTS.includes(declared.reasoningEffort)) {
+        return fail(`Daimon Grok agent ${agentId} has no declared broker model and reasoning effort`);
+    }
+    return declared;
+};
+/**
+ * Spawnfile-managed state roots no Grok worker needs: the shared Moltnet store
+ * (server data, node/bridge configs, receipt stores, network state), per-agent
+ * Moltnet open-mode token directories, and declared Mneme memory banks. A
+ * worker reaches Moltnet and memory only through Daimon's MCP tools, which run
+ * in the organization process, never by reading these files. Provisioning
+ * creates each root-owned `0700` when absent so the mask always has a target.
+ */
+export const DAIMON_GROK_DENIED_STATE_ROOTS = ["/var/lib/spawnfile/agents", "/var/lib/spawnfile/memory", "/var/lib/spawnfile/moltnet"];
+const within = (candidate, root) => candidate === root || candidate.startsWith(`${root}/`);
+/**
+ * One brokered worker's sandbox deny list.
+ *
+ * Daimon's own protected set for the agent (`grokSandboxProtectedPaths`: the
+ * Grok bootstrap and realm, the AGY realm and unlock secret when any agent is
+ * AGY, the organization state directory that holds the wake-acceptance store,
+ * and every peer's runtime home and workspace) is always kept verbatim, so a Daimon projection over the same inputs renders
+ * the same profile. This deployment adds everything else the container
+ * provisions that the worker does not need: the organization config directory
+ * (all agents' instructions and any env files), every persistent mount of
+ * every runtime plan (the worker's own tool state, credential home and memory
+ * included — it reaches them only through Daimon), every other runtime
+ * instance root, the shared Moltnet/agent/memory state roots, every workspace
+ * resource backing path not linked from this agent's own workspace, the broker's
+ * `/etc` and `/run` directories, the usage ledger and wake fuse, every other
+ * worker's home, and the container secret roots.
+ *
+ * Allowed on purpose: the agent's own workspace (the worker's cwd), its own
+ * runtime home directory itself (Daimon's tool-result spill contract names paths
+ * under it; its contents are persistent mounts and denied), its own worker home,
+ * and backing paths of resources linked into its own workspace (a mask over the
+ * backing inode would also hide the agent's own resource through its link).
+ *
+ * Grok 1.0.34's strict base reads all of `/run`, `/var`, `/tmp` and `/etc`, and
+ * macOS bind mounts ignore unix modes, so this list — not file modes — is the
+ * boundary. Masks cannot nest: an added entry already covered by another entry
+ * is dropped, and an added entry that would cover a Daimon entry is refused.
+ *
+ * Every entry must also be *placeable*: Grok materializes each deny target
+ * inside bubblewrap as the worker uid, so the target must exist and the worker
+ * must be able to search every ancestor. That depends on modes, not paths, so
+ * the root provisioning program asserts it once every mode is final and refuses
+ * to start the container otherwise (`containerDaimonGrokWorkerProvisioning.ts`);
+ * here a protected path whose parent is private is lifted to that parent
+ * instead (`daimonGrokAcceptanceStoreDenyPath`).
+ */
+export const resolveDaimonGrokWorkerDenyPaths = (plans, plan, agentId, workerHomes, ownHome) => {
+    const instanceRoot = plan.instancePaths.instanceRoot ?? fail("Daimon Grok registrations require an instance root");
+    const agents = Object.entries(plan.engineByNodeId ?? {});
+    const ownWorkspace = path.posix.join(plan.instancePaths.workspacePath, "agents", nodeSlug(agentId));
+    const ownRuntimeHome = path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(agentId));
+    const peers = agents.filter(([id]) => id !== agentId).map(([id]) => nodeSlug(id));
+    const daimonOwn = [
+        DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
+        DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
+        ...(agents.some(([, engine]) => engine === "agy") ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath, DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath] : []),
+        daimonGrokAcceptanceStoreDenyPath(instanceRoot),
+        ...peers.flatMap((slug) => [
+            path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, slug),
+            path.posix.join(plan.instancePaths.workspacePath, "agents", slug)
+        ])
+    ];
+    const ownResourceBackings = new Set((plan.resources ?? [])
+        .filter((resource) => within(resource.linkPath, ownWorkspace))
+        .map((resource) => resource.backingPath));
+    const added = [
+        path.posix.dirname(plan.instancePaths.configPath),
+        ...plans.flatMap((candidate) => (candidate.persistentMounts ?? []).map((mount) => mount.mount_path)),
+        ...plans.filter((candidate) => candidate !== plan).flatMap((candidate) => [
+            candidate.instancePaths.instanceRoot ?? path.posix.dirname(candidate.instancePaths.configPath),
+            ...(candidate.envFiles ?? []).map((binding) => binding.filePath)
+        ]),
+        ...(plan.envFiles ?? []).map((binding) => binding.filePath),
+        ...plans.flatMap((candidate) => candidate.resources ?? []).map((resource) => resource.backingPath)
+            .filter((backing) => !ownResourceBackings.has(backing)),
+        ...DAIMON_GROK_DENIED_STATE_ROOTS,
+        path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath),
+        path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath),
+        DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath,
+        DAIMON_WAKE_FUSE_DIRECTORY,
+        ...workerHomes.filter((home) => home !== ownHome),
+        ...DAIMON_GROK_OPTIONAL_DENY_PATHS
+    ].filter((entry) => entry.startsWith("/"));
+    const grokHome = path.posix.join(ownHome, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+    const grants = [...DAIMON_GROK_BASE_PROFILE_GRANTS, ownWorkspace, grokHome, path.posix.join(grokHome, "sessions"), path.posix.join(ownHome, "tmp")];
+    for (const entry of [...daimonOwn, ...added]) {
+        const grant = grants.find((candidate) => within(candidate, entry));
+        if (grant)
+            fail(`Grok worker deny path ${entry} equals or contains the base profile grant ${grant}; Grok refuses such a profile`);
+    }
+    for (const entry of added) {
+        if (within(ownWorkspace, entry) || within(ownHome, entry) || entry === ownRuntimeHome || within(ownRuntimeHome, entry)
+            || [...ownResourceBackings].some((backing) => within(backing, entry))) {
+            fail(`Grok worker deny path ${entry} would hide ${agentId}'s own workspace, home, or resources`);
+        }
+    }
+    const candidates = [...new Set([...daimonOwn, ...added])];
+    const daimonSet = new Set(daimonOwn);
+    const denied = candidates.filter((entry) => daimonSet.has(entry)
+        || !candidates.some((other) => other !== entry && within(entry, other))).sort();
+    for (const entry of denied) {
+        const ancestor = denied.find((other) => other !== entry && within(entry, other));
+        if (ancestor)
+            fail(`Grok worker deny path ${ancestor} would cover ${entry}; masks cannot nest`);
+    }
+    return denied;
+};
+export const resolveDaimonGrokRegistrations = (plans) => {
+    const entries = plans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .flatMap((plan) => Object.entries(plan.engineByNodeId ?? {})
+        .filter(([, engine]) => engine === "grok")
+        .map(([agentId]) => ({ agentId, plan })))
+        .sort((left, right) => left.agentId.localeCompare(right.agentId));
+    const homes = entries.map((_, slot) => path.posix.join(DAIMON_WORKER_ROOT, String(DAIMON_FIRST_WORKER_UID + slot)));
+    return entries.map(({ agentId, plan }, slot) => {
+        if (nodeSlug(agentId) === "")
+            fail(`Daimon Grok agent ${agentId} has no path-safe slug`);
+        const home = assertCanonicalRegisteredPath("home", homes[slot]);
+        const grokHome = path.posix.join(home, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+        const instanceRoot = plan.instancePaths.instanceRoot ?? fail("Daimon Grok registrations require an instance root");
+        const runtimeHome = assertCanonicalRegisteredPath("runtime home", path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(agentId)));
+        const { model, reasoningEffort } = declaredModel(plan, agentId);
+        const config = resolveDaimonGrokWorkerConfig(model, reasoningEffort);
+        const denyPaths = resolveDaimonGrokWorkerDenyPaths(plans, plan, agentId, homes, home);
+        // The registration's per-turn budget: the contract defaults unless the agent declared its own.
+        // A wake may only lower this, so an organization that needs more than four minutes a turn has
+        // to declare it here rather than at wake time, where the broker refuses any raise.
+        const limits = resolveDaimonGrokRegistrationLimits(plan.grokTurnLimitsByNodeId?.[agentId]);
+        const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
+        for (const [label, value] of [["GROK_HOME", grokHome], ["profile", path.posix.join(grokHome, "sandbox.toml")], ["events", path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath)], ["private temp", path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome)]])
+            assertCanonicalRegisteredPath(label, value);
+        // The launcher derives HOME, GROK_HOME=<home>/.grok and TMPDIR=<home>/tmp from the registered home, and the broker reads the profile from GROK_HOME.
+        if (path.posix.dirname(path.posix.dirname(path.posix.join(grokHome, "sandbox.toml"))) !== home)
+            fail(`Grok worker ${agentId} profile is not under its registered home`);
+        const backings = new Set(plans.flatMap((candidate) => candidate.resources ?? []).map((resource) => resource.backingPath));
+        return {
+            deferredDenyPaths: denyPaths.filter((entry) => backings.has(entry)),
+            limits,
+            agentId,
+            config: config.bytes,
+            configSha256: config.sha256,
+            denyPaths,
+            eventsPath: path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath),
+            grokHome,
+            home,
+            model,
+            profile,
+            profilePath: path.posix.join(grokHome, "sandbox.toml"),
+            profileSha256: daimonGrokWorkerSandboxProfileSha256(denyPaths),
+            privateTmp: path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome),
+            reasoningEffort,
+            runtimeHome,
+            runtimeHomeMounts: [...new Set(plans.flatMap((candidate) => (candidate.persistentMounts ?? []).map((mount) => mount.mount_path))
+                    .filter((mountPath) => mountPath.startsWith(`${runtimeHome}/`)))].sort(),
+            spillDirectory: path.posix.join(runtimeHome, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
+            slot,
+            uid: DAIMON_FIRST_WORKER_UID + slot,
+            // Production keeps one container ledger: `spawnfile usage` and Daimon's
+            // wake fuse both read it, so a per-slot file would hide Grok spend from both.
+            usageLedgerPath: DAIMON_GROK_TURN_USAGE_LEDGER.filePath,
+            workspace: assertCanonicalRegisteredPath("workspace", path.posix.join(plan.instancePaths.workspacePath, "agents", nodeSlug(agentId)))
+        };
+    });
+};
+const resolveDaimonGrokTurnStore = (turnStore) => {
+    if (turnStore === undefined)
+        return DAIMON_GROK_ENGINE_BROKER.turnStorePath;
+    assertCanonicalRegisteredPath("turn store", turnStore);
+    if (turnStore === DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath || turnStore.startsWith(`${DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath}/`)) {
+        fail(`Grok broker turn store ${turnStore} is on the durable credential realm; a recycled slot would replay the previous trial's sealed turns`);
+    }
+    return turnStore;
+};
+const resolveDaimonGrokInferenceLedger = (inferenceLedgerPath, registrations) => {
+    assertCanonicalRegisteredPath("inference ledger", inferenceLedgerPath);
+    if (!inferenceLedgerPath.endsWith(".jsonl"))
+        fail(`Grok inference ledger must be a .jsonl path: ${inferenceLedgerPath}`);
+    const subject = new Set([DAIMON_GROK_TURN_USAGE_LEDGER.filePath, path.posix.join(DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, "requests.jsonl"),
+        ...registrations.flatMap((entry) => [entry.usageLedgerPath, path.posix.join(path.posix.dirname(entry.usageLedgerPath), "requests.jsonl")])]);
+    if (subject.has(inferenceLedgerPath))
+        fail(`Grok inference ledger ${inferenceLedgerPath} is a subject usage ledger; judge spend must never reach the wake fuse`);
+    return inferenceLedgerPath;
+};
+/** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
+export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
+    version: DAIMON_GROK_ENGINE_BROKER.serviceConfigVersions[options.version === "v3" ? 2 : 1],
+    credentialHome: DAIMON_GROK_ENGINE_BROKER.credentialHomePath,
+    turnStore: resolveDaimonGrokTurnStore(options.turnStore),
+    ...(options.maxRunRequests === undefined ? {} : { maxRunRequests: options.maxRunRequests }),
+    ...(options.runRequestStore === undefined ? {} : { runRequestStore: assertCanonicalRegisteredPath("run request store", options.runRequestStore) }),
+    ...(options.inferenceLedgerPath === undefined ? {} : { inferenceLedgerPath: resolveDaimonGrokInferenceLedger(options.inferenceLedgerPath, registrations) }),
+    registrations: registrations.map((entry) => ({
+        agentId: entry.agentId,
+        slot: entry.slot,
+        workerUid: entry.uid,
+        workspace: entry.workspace,
+        profilePath: entry.profilePath,
+        eventsPath: entry.eventsPath,
+        profileSha256: entry.profileSha256,
+        ...(options.version === "v3" ? {} : { usageLedgerPath: entry.usageLedgerPath,
+            limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
+            model: { id: entry.model, reasoningEffort: entry.reasoningEffort } })
+    })),
+    ...(options.version === "v3" ? { slotPolicies: registrations.map(entry => ({
+            slot: entry.slot, usageLedgerPath: entry.usageLedgerPath,
+            limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
+            model: { id: entry.model, reasoningEffort: entry.reasoningEffort }
+        })) } : {})
+});

package/dist/compiler/containerDaimonOwnershipGuardRender.d.ts

@@ -0,0 +1,25 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+export declare const renderDaimonOwnershipProgram: (opaqueTargets: string[], opaqueDescendantRoots: string[], immutableRuntimeRoots: string[], volumeIdentityFiles: Array<{
+    path: string;
+    identity: string;
+}>, privateDirectories: string[], privateFiles: string[], privateModeDirectories: string[], creatablePrivateDirectories: Array<{
+    anchor: string;
+    target: string;
+}>, 
+/**
+ * A brokered Grok worker's sandbox cannot be applied when `/var` is traverse-only.
+ * Grok 1.0.34 builds every profile inside bubblewrap and then verifies it from the
+ * worker uid; with `/var` at 0711 that verification fails and the worker refuses to
+ * start ("could not apply the 'daimon-strict' sandbox profile"), which is every turn
+ * of every Grok agent. Bisected on the production host: with `/var` at 0755 the
+ * sandbox applies and the turn runs, at 0711 it never does, and the deeper ancestors
+ * (`/var/lib`, the worker root) make no difference either way — so only this one
+ * level is widened, only for an organization that actually runs a Grok worker, and
+ * only to the mode the proven-working training container has always had. Codex- and
+ * AGY-only organizations keep the traverse-only `/var` unchanged.
+ */
+grokWorkersPresent?: boolean) => string;
+export declare const resolveDaimonVolumeIdentityFiles: (runtimePlans: RuntimeTargetPlan[]) => Array<{
+    path: string;
+    identity: string;
+}>;