spawnfile 0.1.14 → 0.1.18

package/dist/compiler/moltnetBinaries.d.ts

@@ -1,22 +1,34 @@
-import { type MoltnetTargetArchitecture } from "./moltnetReleaseAuthority.js";
+import { type MoltnetBridgeCapabilities, type MoltnetTargetArchitecture } from "./moltnetReleaseAuthority.js";
+import { type MoltnetExecutionHost, type LocalMoltnetReleaseIdentity } from "./localMoltnetAuthority.js";
 /** Explicit operator override for a locally staged, authority-bound release. */
 export declare const MOLTNET_RELEASE_DIR_ENV = "SPAWNFILE_MOLTNET_RELEASE_DIR";
+/** Explicit development-only local archive authority; never consulted by production compiles. */
+export declare const MOLTNET_LOCAL_RELEASE_DIR_ENV = "SPAWNFILE_LOCAL_MOLTNET_RELEASE_DIR";
+export declare const MOLTNET_ALLOW_LOCAL_E2E_ENV = "SPAWNFILE_ALLOW_LOCAL_E2E";
 export declare const MOLTNET_BIN_DIRECTORY = "moltnet-bin";
 export declare const MOLTNET_BINARY_NAMES: readonly ["moltnet"];
 export declare const MOLTNET_RELEASE_IDENTITY_VERSION: "spawnfile.moltnet-release-identity.v1";
 export declare const MOLTNET_RELEASE_STAMP_VERSION: "spawnfile.moltnet-release-stamp.v1";
 export type { MoltnetTargetArchitecture } from "./moltnetReleaseAuthority.js";
-export interface MoltnetReleaseIdentity {
+/** Re-exported so existing importers keep one shape; defined in the lowest layer. */
+export type { MoltnetBridgeCapabilities } from "./moltnetReleaseAuthority.js";
+interface MoltnetIdentityBase {
     readonly architecture: MoltnetTargetArchitecture;
     readonly asset: string;
     readonly asset_sha256: `sha256:${string}`;
-    readonly capabilities: readonly ["pi-bridge"];
+    readonly capabilities: MoltnetBridgeCapabilities;
+    readonly version: typeof MOLTNET_RELEASE_IDENTITY_VERSION;
+}
+export interface PublishedMoltnetReleaseIdentity extends MoltnetIdentityBase {
+    readonly capabilities: MoltnetBridgeCapabilities;
     readonly release_version: string;
     readonly source_revision: string;
-    readonly version: typeof MOLTNET_RELEASE_IDENTITY_VERSION;
 }
+export type MoltnetReleaseIdentity = PublishedMoltnetReleaseIdentity | LocalMoltnetReleaseIdentity;
 export interface MoltnetBinaryStageOptions {
     readonly architecture?: MoltnetTargetArchitecture;
+    /** Overrides the detected execution host for the local-build capability probe. Tests only. */
+    readonly executionHost?: MoltnetExecutionHost;
     /** Explicit local source directory; bytes remain bound to trusted authority. */
     readonly releaseDirectory?: string;
 }

package/dist/compiler/moltnetBinaries.js

@@ -5,12 +5,16 @@ import { chmod, readFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import { ensureDirectory, fileExists } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
-import { parseTrustedMoltnetReleaseAuthority, readTrustedMoltnetReleaseAuthority, trustedMoltnetReleaseAsset } from "./moltnetReleaseAuthority.js";
+import { parseMoltnetBridgeCapabilities, parseTrustedMoltnetReleaseAuthority, readTrustedMoltnetReleaseAuthority, trustedMoltnetReleaseAsset } from "./moltnetReleaseAuthority.js";
 import { downloadTrustedMoltnetReleaseAsset } from "./moltnetReleaseDownload.js";
+import { readLocalMoltnetReleaseIdentity } from "./localMoltnetAuthority.js";
 const execFile = promisify(execFileCallback);
 const MOLTNET_CLI_ENV = "SPAWNFILE_MOLTNET_CLI";
 /** Explicit operator override for a locally staged, authority-bound release. */
 export const MOLTNET_RELEASE_DIR_ENV = "SPAWNFILE_MOLTNET_RELEASE_DIR";
+/** Explicit development-only local archive authority; never consulted by production compiles. */
+export const MOLTNET_LOCAL_RELEASE_DIR_ENV = "SPAWNFILE_LOCAL_MOLTNET_RELEASE_DIR";
+export const MOLTNET_ALLOW_LOCAL_E2E_ENV = "SPAWNFILE_ALLOW_LOCAL_E2E";
 const MOLTNET_TARGET_ARCH_ENV = "SPAWNFILE_MOLTNET_TARGET_ARCH";
 const MOLTNET_TARGET_OS = "linux";
 export const MOLTNET_BIN_DIRECTORY = "moltnet-bin";
@@ -50,6 +54,26 @@ const resolveTargetArchitecture = (architecture) => {
             throw new SpawnfileError("compile_error", `Moltnet container installs do not support host architecture ${process.arch}`);
     }
 };
+/**
+ * The platform executing this compile, for the local-build capability probe.
+ *
+ * Deliberately NOT `resolveTargetArchitecture()`: that helper honours the
+ * `SPAWNFILE_MOLTNET_TARGET_ARCH` build-target override and falls back to
+ * `process.arch`, so passing it as the host made the host and the target the
+ * same value by construction and pinned the probe to its direct-exec branch.
+ * This reads the real host only, and reports `architecture: undefined` for a
+ * CPU that is not a nameable Moltnet target rather than throwing -- an
+ * unsupported host is not a compile error, it just cannot exec the binary
+ * directly.
+ *
+ * Private: this module's export surface is pinned by test.
+ */
+const resolveMoltnetExecutionHost = () => ({
+    ...(process.arch === "arm64"
+        ? { architecture: "arm64" }
+        : process.arch === "x64" ? { architecture: "amd64" } : {}),
+    platform: process.platform
+});
 const createReleaseAssetName = (architecture) => `moltnet_${MOLTNET_TARGET_OS}_${architecture}.tar.gz`;
 const createReleaseStampName = (architecture) => `moltnet_release_stamp_${architecture}.json`;
 const exactKeys = (value, keys) => Object.keys(value).sort().join("\0") === [...keys].sort().join("\0");
@@ -76,9 +100,7 @@ const parseReleaseStamp = (raw, architecture) => {
         || value.asset !== createReleaseAssetName(architecture)
         || typeof value.built_at !== "string"
         || !Number.isFinite(Date.parse(value.built_at))
-        || !Array.isArray(capabilities)
-        || capabilities.length !== 1
-        || capabilities[0] !== "pi-bridge"
+        || parseMoltnetBridgeCapabilities(capabilities) === null
         || value.pi_bridge !== true
         || typeof value.sha256 !== "string"
         || !SHA256.test(value.sha256)
@@ -121,7 +143,7 @@ const verifyReleaseIdentity = async (releaseDirectory, architecture, authority)
         architecture,
         asset,
         asset_sha256: `sha256:${sha256}`,
-        capabilities: Object.freeze(["pi-bridge"]),
+        capabilities: stamp.capabilities,
         release_version: stamp.version,
         source_revision: stamp.source_revision,
         version: MOLTNET_RELEASE_IDENTITY_VERSION
@@ -170,6 +192,18 @@ const resolveConfiguredReleaseDirectory = async () => {
     }
     return configuredDirectory;
 };
+const resolveConfiguredLocalReleaseDirectory = async () => {
+    const configuredDirectory = process.env[MOLTNET_LOCAL_RELEASE_DIR_ENV]?.trim();
+    if (!configuredDirectory)
+        return null;
+    if (process.env[MOLTNET_ALLOW_LOCAL_E2E_ENV] !== "1") {
+        throw new SpawnfileError("compile_error", "Local Moltnet identity requires explicit SPAWNFILE_ALLOW_LOCAL_E2E=1 opt-in");
+    }
+    if (!path.isAbsolute(configuredDirectory) || !(await fileExists(configuredDirectory))) {
+        throw new SpawnfileError("compile_error", "Local Moltnet release directory is invalid");
+    }
+    return configuredDirectory;
+};
 const findPathMoltnetCli = async () => {
     try {
         await execFile("moltnet", ["version"]);
@@ -205,6 +239,12 @@ const stageMoltnetBinariesAtReleaseDirectory = async (outputDirectory, releaseDi
     return stageMoltnetReleaseAsset(outputDirectory, releaseAssetPath, identity);
 };
 export const stageMoltnetBinaries = async (outputDirectory, options = {}) => {
+    const localReleaseDirectory = await resolveConfiguredLocalReleaseDirectory();
+    if (localReleaseDirectory) {
+        const architecture = resolveTargetArchitecture(options.architecture);
+        const identity = await readLocalMoltnetReleaseIdentity(localReleaseDirectory, architecture, options.executionHost ?? resolveMoltnetExecutionHost());
+        return stageMoltnetReleaseAsset(outputDirectory, path.join(localReleaseDirectory, createReleaseAssetName(architecture)), identity);
+    }
     const releaseDirectory = options.releaseDirectory
         ?? await resolveConfiguredReleaseDirectory();
     if (releaseDirectory) {
@@ -219,7 +259,7 @@ export const stageMoltnetBinaries = async (outputDirectory, options = {}) => {
             architecture,
             asset: trustedAsset.asset,
             asset_sha256: trustedAsset.asset_sha256,
-            capabilities: Object.freeze(["pi-bridge"]),
+            capabilities: authority.capabilities,
             release_version: authority.release_version,
             source_revision: authority.source_revision,
             version: MOLTNET_RELEASE_IDENTITY_VERSION

package/dist/compiler/moltnetClientConfig.js

@@ -24,7 +24,7 @@ const createAttachmentConfig = (node, artifacts, attachment, agentSlug) => {
         throw new SpawnfileError("compile_error", `Moltnet client config requires a resolved member id for ${node.name}`);
     }
     const serverPlan = findServerPlan(artifacts, attachment);
-    const auth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId, agentSlug, attachment.auth?.tokenId);
+    const auth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId, agentSlug, attachment.auth?.tokenId, node.runtime.name);
     return {
         agent_name: node.name,
         auth: {

package/dist/compiler/moltnetConfigLowering.d.ts

@@ -13,6 +13,7 @@ export interface MoltnetClientAuthPlan {
     tokenPath?: string;
 }
 export interface MoltnetNativeRoomConfig {
+    federation?: "all" | "none" | string[];
     id: string;
     members: string[];
     name?: string;
@@ -33,6 +34,7 @@ type ManagedMoltnetStore = Extract<TeamNetworkServer, {
 export declare const createMoltnetOpenTokenDirectory: (agentSlug: string) => string;
 export declare const createMoltnetOpenTokenPath: (networkId: string, memberId: string, agentSlug?: string) => string;
 export declare const createMoltnetNetworkStateDirectory: (networkId: string) => string;
+export declare const createMoltnetDaimonReceiptStorePath: (networkId: string, memberId: string) => string;
 export declare const createDefaultMoltnetStorePath: (networkId: string, kind: "json" | "sqlite", mountPath?: string) => string;
 export declare const resolveMoltnetStorePath: (networkId: string, store: ManagedMoltnetStore) => string | null;
 export declare const resolveMoltnetStorePersistenceMountPath: (networkId: string, store: ManagedMoltnetStore) => string | null;
@@ -55,7 +57,7 @@ export declare const renderMoltnetListenAddr: (server: Extract<TeamNetworkServer
     mode: "managed";
 }>) => string;
 export declare const resolveMoltnetBaseUrl: (server: TeamNetworkServer) => string;
-export declare const resolveMoltnetClientAuth: (server: TeamNetworkServer, networkId: string, memberId: string, agentSlug?: string, attachmentTokenId?: string) => MoltnetClientAuthPlan;
+export declare const resolveMoltnetClientAuth: (server: TeamNetworkServer, networkId: string, memberId: string, agentSlug?: string, attachmentTokenId?: string, runtimeName?: string) => MoltnetClientAuthPlan;
 export declare const createMoltnetNativeServerConfig: ({ networkId, networkName, rooms, server }: MoltnetNativeServerConfigInput) => {
     config: Record<string, unknown>;
     secretPatches: MoltnetSecretPatch[];

package/dist/compiler/moltnetConfigLowering.js

@@ -5,6 +5,14 @@ const normalizePosixPath = (value) => value.replace(/\/+/g, "/").replace(/\/+$/u
 export const createMoltnetOpenTokenDirectory = (agentSlug) => `/var/lib/spawnfile/agents/${pathSafeSegment(agentSlug)}/state/moltnet`;
 export const createMoltnetOpenTokenPath = (networkId, memberId, agentSlug = memberId) => `${createMoltnetOpenTokenDirectory(agentSlug)}/${pathSafeSegment(networkId)}-${pathSafeSegment(memberId)}.token`;
 export const createMoltnetNetworkStateDirectory = (networkId) => `/var/lib/spawnfile/moltnet/networks/${pathSafeSegment(networkId)}`;
+export const createMoltnetDaimonReceiptStorePath = (networkId, memberId) => {
+    const network = pathSafeSegment(networkId);
+    const member = pathSafeSegment(memberId);
+    if (network !== networkId || member !== memberId || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,254}$/u.test(memberId)) {
+        throw new SpawnfileError("validation_error", "invalid Daimon receipt-store path segment");
+    }
+    return `${createMoltnetNetworkStateDirectory(networkId)}/daimon-receipts/${member}.json`;
+};
 export const createDefaultMoltnetStorePath = (networkId, kind, mountPath) => {
     const directory = mountPath
         ? normalizePosixPath(mountPath)
@@ -64,7 +72,7 @@ export const resolveMoltnetBaseUrl = (server) => {
             : bind;
     return `http://${host}:${server.listen.port}`;
 };
-export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug, attachmentTokenId) => {
+export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug, attachmentTokenId, runtimeName) => {
     if (server.auth.mode === "none") {
         if (attachmentTokenId !== undefined) {
             throw new SpawnfileError("validation_error", `Moltnet attachment ${networkId}/${memberId} cannot select token ${attachmentTokenId} when auth.mode is none`);
@@ -83,10 +91,12 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug,
         if (tokens.length !== 1) {
             throw new SpawnfileError("validation_error", `invalid Moltnet actor token ${attachmentTokenId} for ${memberId}: token id must exist exactly once`);
         }
-        if (token.scopes.length !== 2
-            || token.scopes[0] !== "attach"
-            || token.scopes[1] !== "write") {
-            throw new SpawnfileError("validation_error", `invalid Moltnet actor token ${attachmentTokenId} for ${memberId}: token must include attach and write scopes exactly`);
+        const requiredScopes = runtimeName === "daimon"
+            ? ["attach", "observe", "write"]
+            : ["attach", "write"];
+        if (token.scopes.length !== requiredScopes.length
+            || token.scopes.some((scope, index) => scope !== requiredScopes[index])) {
+            throw new SpawnfileError("validation_error", `invalid Moltnet actor token ${attachmentTokenId} for ${memberId}: token must include ${requiredScopes.join(", ")} scopes exactly`);
         }
         if (token.agents?.length !== 1 || token.agents[0] !== memberId) {
             throw new SpawnfileError("validation_error", `invalid Moltnet actor token ${attachmentTokenId} for ${memberId}: token must declare exactly agents: [${memberId}]`);
@@ -174,11 +184,20 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
             envName: pairing.token_secret,
             jsonPath: `pairings.${index}.token`
         });
+        if (pairing.relay) {
+            secretPatches.push({
+                envName: pairing.relay.token_secret,
+                jsonPath: `pairings.${index}.relay.token`
+            });
+        }
         return {
             id: pairing.id,
             remote_network_id: pairing.remote_network_id,
             remote_network_name: pairing.remote_network_name,
-            remote_base_url: pairing.remote_base_url,
+            ...(pairing.remote_base_url ? { remote_base_url: pairing.remote_base_url } : {}),
+            ...(pairing.relay
+                ? { relay: { room: pairing.relay.room, token: "", url: pairing.relay.url } }
+                : {}),
             token: ""
         };
     });
@@ -214,6 +233,11 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
             },
             storage: storageConfigFor(networkId, server.store),
             rooms: rooms.map((room) => ({
+                ...(room.federation !== undefined
+                    ? { federation: room.federation }
+                    : pairings.length > 0
+                        ? { federation: "none" }
+                        : {}),
                 id: room.id,
                 ...(room.name ? { name: room.name } : {}),
                 ...(room.visibility ? { visibility: room.visibility } : {}),

package/dist/compiler/moltnetNodeConfig.js

@@ -1,7 +1,7 @@
 import { resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
 import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
 export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkServer, nodeSlug, plan, serverPlan }) => {
-    const clientAuth = resolveMoltnetClientAuth(networkServer, attachment.network, attachment.memberId, nodeSlug, attachment.auth?.tokenId);
+    const clientAuth = resolveMoltnetClientAuth(networkServer, attachment.network, attachment.memberId, nodeSlug, attachment.auth?.tokenId, agentNode.runtime.name);
     const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
         clientAuth.staticToken !== true &&
         Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);

package/dist/compiler/moltnetReleaseAuthority.d.ts

@@ -1,5 +1,28 @@
 export declare const MOLTNET_RELEASE_AUTHORITY_VERSION: "spawnfile.moltnet-release-authority.v1";
 export type MoltnetTargetArchitecture = "amd64" | "arm64";
+/**
+ * The bridge capabilities a Moltnet build can advertise.
+ *
+ * CANONICAL ORDERING: `daimon-bridge` before `pi-bridge`. Several places
+ * compare this list by exact equality (`upReceipt.ts`, `localMoltnetAuthority.ts`)
+ * rather than as a set, so a differently ordered but equivalent list is
+ * rejected as a different release. The local builder
+ * (`scripts/build-local-moltnet.ts`) already writes this order; every producer
+ * must match it, and `moltnetReleaseAuthority.test.ts` asserts it.
+ *
+ * This is a UNION, never a replacement: an older pi-only release must keep
+ * pinning cleanly after a dual-capability one is published.
+ */
+export declare const MOLTNET_PI_ONLY_CAPABILITIES: readonly ["pi-bridge"];
+export declare const MOLTNET_DUAL_BRIDGE_CAPABILITIES: readonly ["daimon-bridge", "pi-bridge"];
+export type MoltnetBridgeCapabilities = typeof MOLTNET_PI_ONLY_CAPABILITIES | typeof MOLTNET_DUAL_BRIDGE_CAPABILITIES;
+/**
+ * The single runtime check for an advertised capability list. Every producer
+ * and parser funnels through this so the type and the runtime check can never
+ * drift apart — widening one without the other is precisely how a release
+ * becomes typecheck-green and runtime-rejected.
+ */
+export declare const parseMoltnetBridgeCapabilities: (value: unknown) => MoltnetBridgeCapabilities | null;
 export interface TrustedMoltnetReleaseAsset {
     readonly architecture: MoltnetTargetArchitecture;
     readonly asset: string;
@@ -9,7 +32,7 @@ export interface TrustedMoltnetReleaseAuthority {
     readonly version: typeof MOLTNET_RELEASE_AUTHORITY_VERSION;
     readonly release_version: string;
     readonly source_revision: string;
-    readonly capabilities: readonly ["pi-bridge"];
+    readonly capabilities: MoltnetBridgeCapabilities;
     readonly assets: readonly TrustedMoltnetReleaseAsset[];
 }
 export declare const parseTrustedMoltnetReleaseAuthority: (raw: unknown) => TrustedMoltnetReleaseAuthority;

package/dist/compiler/moltnetReleaseAuthority.js

@@ -1,6 +1,37 @@
 import { readFile } from "node:fs/promises";
 import { SpawnfileError } from "../shared/index.js";
 export const MOLTNET_RELEASE_AUTHORITY_VERSION = "spawnfile.moltnet-release-authority.v1";
+/**
+ * The bridge capabilities a Moltnet build can advertise.
+ *
+ * CANONICAL ORDERING: `daimon-bridge` before `pi-bridge`. Several places
+ * compare this list by exact equality (`upReceipt.ts`, `localMoltnetAuthority.ts`)
+ * rather than as a set, so a differently ordered but equivalent list is
+ * rejected as a different release. The local builder
+ * (`scripts/build-local-moltnet.ts`) already writes this order; every producer
+ * must match it, and `moltnetReleaseAuthority.test.ts` asserts it.
+ *
+ * This is a UNION, never a replacement: an older pi-only release must keep
+ * pinning cleanly after a dual-capability one is published.
+ */
+export const MOLTNET_PI_ONLY_CAPABILITIES = ["pi-bridge"];
+export const MOLTNET_DUAL_BRIDGE_CAPABILITIES = ["daimon-bridge", "pi-bridge"];
+/**
+ * The single runtime check for an advertised capability list. Every producer
+ * and parser funnels through this so the type and the runtime check can never
+ * drift apart — widening one without the other is precisely how a release
+ * becomes typecheck-green and runtime-rejected.
+ */
+export const parseMoltnetBridgeCapabilities = (value) => {
+    if (!Array.isArray(value))
+        return null;
+    const joined = value.join("\0");
+    if (joined === MOLTNET_PI_ONLY_CAPABILITIES.join("\0"))
+        return MOLTNET_PI_ONLY_CAPABILITIES;
+    if (joined === MOLTNET_DUAL_BRIDGE_CAPABILITIES.join("\0"))
+        return MOLTNET_DUAL_BRIDGE_CAPABILITIES;
+    return null;
+};
 const SHA256 = /^sha256:[a-f0-9]{64}$/u;
 const REVISION = /^[a-f0-9]{40}$/u;
 const VERSION = /^v?\d+\.\d+\.\d+(?:-\d+-g[a-f0-9]{7,40})?$/u;
@@ -20,9 +51,7 @@ export const parseTrustedMoltnetReleaseAuthority = (raw) => {
         || !VERSION.test(value.release_version)
         || typeof value.source_revision !== "string"
         || !REVISION.test(value.source_revision)
-        || !Array.isArray(value.capabilities)
-        || value.capabilities.length !== 1
-        || value.capabilities[0] !== "pi-bridge"
+        || parseMoltnetBridgeCapabilities(value.capabilities) === null
         || !Array.isArray(value.assets)
         || value.assets.length !== 2)
         return fail();
@@ -52,7 +81,7 @@ export const parseTrustedMoltnetReleaseAuthority = (raw) => {
         version: MOLTNET_RELEASE_AUTHORITY_VERSION,
         release_version: value.release_version,
         source_revision: value.source_revision,
-        capabilities: Object.freeze(["pi-bridge"]),
+        capabilities: parseMoltnetBridgeCapabilities(value.capabilities),
         assets: Object.freeze(assets)
     });
 };

package/dist/compiler/moltnetRepresentativeResolution.d.ts

@@ -14,4 +14,4 @@ export interface TeamRepresentativeResolution {
     sourceTeamSource: string;
 }
 export declare const resolveTeamRepresentatives: (plan: CompilePlan, teamNode: ResolvedTeamNode, seen?: string[]) => TeamRepresentativeResolution[];
-export declare const resolveMoltnetAttachments: (attachments: ResolvedMoltnetAttachment[] | undefined, context: MoltnetTeamContext | undefined, nodeName: string) => ResolvedMoltnetAttachment[] | undefined;
+export declare const resolveMoltnetAttachments: (attachments: ResolvedMoltnetAttachment[] | undefined, context: MoltnetTeamContext | undefined, nodeName: string, runtimeName?: string) => ResolvedMoltnetAttachment[] | undefined;

package/dist/compiler/moltnetRepresentativeResolution.js

@@ -71,7 +71,7 @@ export const resolveTeamRepresentatives = (plan, teamNode, seen = []) => {
     }
     return representatives;
 };
-export const resolveMoltnetAttachments = (attachments, context, nodeName) => {
+export const resolveMoltnetAttachments = (attachments, context, nodeName, runtimeName) => {
     if (!attachments || attachments.length === 0) {
         return undefined;
     }
@@ -84,7 +84,7 @@ export const resolveMoltnetAttachments = (attachments, context, nodeName) => {
             throw new SpawnfileError("validation_error", `Agent ${nodeName} references unknown Moltnet network ${attachment.network} on team ${context.teamName}`);
         }
         if (network.server) {
-            resolveMoltnetClientAuth(network.server, network.id, context.memberId, undefined, attachment.auth?.tokenId);
+            resolveMoltnetClientAuth(network.server, network.id, context.memberId, undefined, attachment.auth?.tokenId, runtimeName);
         }
         for (const roomId of Object.keys(attachment.rooms ?? {})) {
             const room = network.rooms.find((entry) => entry.id === roomId);

package/dist/compiler/moltnetResolution.js

@@ -26,15 +26,9 @@ const validateGlobalMemberIds = (plan) => {
         context
     ]));
     for (const context of uniqueContexts.values()) {
-        let memberId = context.memberId;
-        if (plan.organizationIdentity) {
-            const canonicalMemberId = resolveCanonicalAgentMemberId(plan, context.agentSource);
-            const matches = plan.organizationIdentity.agentMembers.filter((member) => member.memberId === canonicalMemberId);
-            if (!canonicalMemberId || matches.length !== 1) {
-                throw new SpawnfileError("validation_error", `Unable to resolve exactly one canonical Moltnet member id for ${context.agentSource}`);
-            }
-            memberId = canonicalMemberId;
-        }
+        const memberId = (plan.organizationIdentity?.externalParticipants.length ?? 0) > 0
+            ? resolveCanonicalAgentMemberId(plan, context.agentSource) ?? context.memberId
+            : context.memberId;
         const previous = seen.get(memberId);
         const label = `${context.teamName} (${context.teamSource}) member ${context.memberId}`;
         if (previous &&
@@ -181,9 +175,7 @@ export const resolvePlanMoltnetAttachments = (plan) => {
     for (const synthesized of synthesizedAttachments) {
         const { agentSource, attachment, directTeamSource } = synthesized;
         const representativeContext = (plan.memberships ?? []).find((context) => context.agentSource === agentSource &&
-            (plan.organizationIdentity
-                ? context.teamSource === directTeamSource
-                : context.memberId === attachment.memberId));
+            context.teamSource === directTeamSource);
         if (!representativeContext) {
             throw new SpawnfileError("validation_error", `Unable to find direct member context for synthesized Moltnet member ${attachment.memberId ?? "unknown"}`);
         }
@@ -207,14 +199,16 @@ export const resolvePlanMoltnetAttachments = (plan) => {
                 continue;
             }
             const teamNode = findTeamBySource(plan, context.teamSource);
-            const canonicalMemberId = resolveCanonicalAgentMemberId(plan, context.agentSource) ?? context.memberId;
+            const resolvedMemberId = (plan.organizationIdentity?.externalParticipants.length ?? 0) > 0
+                ? resolveCanonicalAgentMemberId(plan, context.agentSource) ?? context.memberId
+                : context.memberId;
             const resolved = resolveMoltnetAttachments(declaredAttachments, {
                 memberId: context.memberId,
                 networks: teamNode.networks ?? [],
-                resolvedMemberId: canonicalMemberId,
+                resolvedMemberId,
                 teamName: context.teamName,
                 teamSource: context.teamSource
-            }, agentNode.name);
+            }, agentNode.name, agentNode.runtime.name);
             resolvedAttachments.push(...(resolved ?? []));
         }
         resolvedAttachments.push(...(synthesizedByAgent.get(agentNode.source) ?? []));

package/dist/compiler/moltnetRoomMemberships.js

@@ -1,6 +1,7 @@
 import { SpawnfileError } from "../shared/index.js";
 import { resolveTeamRepresentatives } from "./moltnetRepresentativeResolution.js";
 import { resolveCanonicalAgentMemberId } from "./organizationIdentity.js";
+import { isDeclaredPairedRemoteRoomMember } from "../manifest/index.js";
 import { isAttachedExternalRoomMember } from "./buildCompilePlanTeams.js";
 const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 const findAgentBySource = (plan, source) => {
@@ -23,13 +24,15 @@ const clonePolicy = (policy) => ({
 const defaultNestedRepresentativePolicy = () => ({
     wake: "mentions"
 });
+// Ordinary Moltnet uses direct member slots. B31's externally authorized
+// organization uses its canonical nested principal identifiers instead.
 const resolveConcreteMemberId = (plan, agentSource, authoredMemberId) => {
-    if (!plan.organizationIdentity)
+    if ((plan.organizationIdentity?.externalParticipants.length ?? 0) === 0) {
         return authoredMemberId;
+    }
     const canonicalMemberId = resolveCanonicalAgentMemberId(plan, agentSource);
-    if (!canonicalMemberId ||
-        plan.organizationIdentity.agentMembers.filter((member) => member.memberId === canonicalMemberId).length !== 1) {
-        throw new SpawnfileError("validation_error", `Unable to resolve exactly one canonical Moltnet member id for ${agentSource}`);
+    if (!canonicalMemberId) {
+        throw new SpawnfileError("validation_error", `Unable to resolve canonical Moltnet member id for ${agentSource}`);
     }
     return canonicalMemberId;
 };
@@ -62,7 +65,11 @@ const compareRoomMemberships = (left, right) => [
     left.agentSource.localeCompare(right.agentSource)
 ].find((result) => result !== 0) ?? 0;
 export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room, memberships = plan.moltnetRoomMemberships) => {
+    const network = teamNode.networks?.find((candidate) => candidate.id === networkId);
     const externalMembers = room.members.filter((memberId) => isAttachedExternalRoomMember(teamNode, networkId, memberId));
+    const remoteMembers = network
+        ? room.members.filter((memberId) => isDeclaredPairedRemoteRoomMember(network, room, memberId))
+        : [];
     if (memberships) {
         return [
             ...new Set([
@@ -71,7 +78,8 @@ export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room
                     && membership.networkId === networkId
                     && membership.roomId === room.id)
                     .map((membership) => membership.concreteMemberId),
-                ...externalMembers
+                ...externalMembers,
+                ...remoteMembers
             ])
         ].sort();
     }
@@ -83,6 +91,10 @@ export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room
                 concreteMembers.push(declaredSlot);
                 continue;
             }
+            if (network && isDeclaredPairedRemoteRoomMember(network, room, declaredSlot)) {
+                concreteMembers.push(declaredSlot);
+                continue;
+            }
             throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${declaredSlot}`);
         }
         if (member.kind === "agent") {
@@ -113,6 +125,9 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                         if (isAttachedExternalRoomMember(teamNode, network.id, declaredSlot)) {
                             continue;
                         }
+                        if (isDeclaredPairedRemoteRoomMember(network, room, declaredSlot)) {
+                            continue;
+                        }
                         throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${declaredSlot}`);
                     }
                     if (declaredMember.kind === "agent") {

package/dist/compiler/moltnetRoomPolicyCompatibility.d.ts

@@ -1,4 +1,4 @@
 import type { TeamNetworkServer } from "../manifest/index.js";
 export declare const assertCompatibleMoltnetNetworkName: (networkId: string, existing: string | undefined, next: string | undefined) => void;
 export declare const assertCompatibleMoltnetServer: (networkId: string, existing: TeamNetworkServer, next: TeamNetworkServer) => void;
-export declare const assertCompatibleMoltnetRoomPolicy: (networkId: string, roomId: string, field: "visibility" | "write_policy", existing: string | undefined, next: string | undefined) => void;
+export declare const assertCompatibleMoltnetRoomPolicy: (networkId: string, roomId: string, field: "federation" | "visibility" | "write_policy", existing: string | string[] | undefined, next: string | string[] | undefined) => void;

package/dist/compiler/moltnetRoomPolicyCompatibility.js

@@ -22,7 +22,9 @@ export const assertCompatibleMoltnetServer = (networkId, existing, next) => {
     }
 };
 export const assertCompatibleMoltnetRoomPolicy = (networkId, roomId, field, existing, next) => {
-    if (existing !== undefined && next !== undefined && existing !== next) {
+    if (existing !== undefined
+        && next !== undefined
+        && stableStringify(existing) !== stableStringify(next)) {
         throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} room ${roomId} declares conflicting ${field}: ${existing} vs ${next}`);
     }
 };

package/dist/compiler/moltnetRuntimeConfig.d.ts

@@ -1,2 +1,2 @@
 import type { CompilePlan, ResolvedAgentNode } from "./types.js";
-export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, _networkId: string, _agentId: string) => Record<string, string>;
+export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, networkId: string, moltnetAgentId: string) => Record<string, string>;

package/dist/compiler/moltnetRuntimeConfig.js

@@ -1,5 +1,6 @@
 import { getRuntimeAdapter } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetDaimonReceiptStorePath } from "./moltnetConfigLowering.js";
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const resolveSequentialRuntimePort = (plan, runtimeName, slug) => {
@@ -28,7 +29,14 @@ const resolveRuntimeInstancePaths = (runtimeName, slug) => {
             : undefined
     };
 };
-export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, _networkId, _agentId) => {
+const resolveDaimonAgentId = (plan, agentNode) => {
+    const compiled = plan.nodes.find((node) => node.kind === "agent" && node.value.source === agentNode.source);
+    if (!compiled) {
+        throw new SpawnfileError("compile_error", `Unable to resolve Daimon runtime agent identity for ${agentNode.name}`);
+    }
+    return compiled.id;
+};
+export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, networkId, moltnetAgentId) => {
     switch (agentNode.runtime.name) {
         case "openclaw": {
             const port = resolveSequentialRuntimePort(plan, "openclaw", nodeSlug);
@@ -51,7 +59,19 @@ export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, _networkId, _age
                 kind: "picoclaw"
             };
         }
-        case "daimon":
+        case "daimon": {
+            const port = getRuntimeAdapter("daimon").container.port;
+            if (!port) {
+                throw new SpawnfileError("compile_error", `Unable to resolve Daimon control port for Moltnet agent ${agentNode.name}`);
+            }
+            return {
+                agent_id: resolveDaimonAgentId(plan, agentNode),
+                control_url: `http://127.0.0.1:${port}`,
+                kind: "daimon",
+                receipt_store_path: createMoltnetDaimonReceiptStorePath(networkId, moltnetAgentId),
+                token_env: "SPAWNFILE_DAIMON_CONTROL_TOKEN"
+            };
+        }
         case "pi": {
             const port = getRuntimeAdapter(agentNode.runtime.name).container.port;
             if (!port) {

package/dist/compiler/moltnetServerPlans.js

@@ -71,6 +71,7 @@ const mergeRooms = (plan, serverPlan, declaration) => {
         const existingRoom = serverPlan.rooms.find((entry) => entry.id === room.id);
         if (!existingRoom) {
             serverPlan.rooms.push({
+                ...(room.federation ? { federation: room.federation } : {}),
                 id: room.id,
                 members: concreteMembers,
                 ...(room.name ? { name: room.name } : {}),
@@ -82,8 +83,10 @@ const mergeRooms = (plan, serverPlan, declaration) => {
         existingRoom.members = [
             ...new Set([...existingRoom.members, ...concreteMembers])
         ].sort();
+        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "federation", existingRoom.federation, room.federation);
         assertCompatibleMoltnetRoomPolicy(network.id, room.id, "visibility", existingRoom.visibility, room.visibility);
         assertCompatibleMoltnetRoomPolicy(network.id, room.id, "write_policy", existingRoom.write_policy, room.write_policy);
+        existingRoom.federation ??= room.federation;
         existingRoom.visibility ??= room.visibility;
         existingRoom.write_policy ??= room.write_policy;
     }
@@ -128,5 +131,21 @@ export const resolveMoltnetServerPlans = (plan, teamNodes) => {
         if (count > 1)
             serverPlans.get(networkId)?.rooms.sort((left, right) => left.id.localeCompare(right.id));
     }
+    for (const serverPlan of serverPlans.values()) {
+        const pairingIds = new Set(serverPlan.server.mode === "managed"
+            ? (serverPlan.server.pairings ?? []).map((pairing) => pairing.id)
+            : []);
+        for (const room of serverPlan.rooms) {
+            if (serverPlan.server.mode === "external" && room.federation !== undefined) {
+                throw new SpawnfileError("validation_error", `External Moltnet network ${serverPlan.networkId} room ${room.id} cannot declare federation`);
+            }
+            if (!Array.isArray(room.federation))
+                continue;
+            const unknownPairing = room.federation.find((pairingId) => !pairingIds.has(pairingId));
+            if (unknownPairing) {
+                throw new SpawnfileError("validation_error", `Moltnet network ${serverPlan.networkId} room ${room.id} federation references unknown pairing ${unknownPairing}`);
+            }
+        }
+    }
     return serverPlans;
 };

package/dist/compiler/organizationExternalParticipants.d.ts

@@ -0,0 +1,3 @@
+import type { CompilePlan, MoltnetExternalParticipantIntent } from "./types.js";
+export declare const validateB31MoltnetAuth: (plan: CompilePlan) => void;
+export declare const resolveMoltnetExternalParticipantIntents: (plan: CompilePlan) => MoltnetExternalParticipantIntent[];