spawnfile 0.1.14 → 0.1.18

package/dist/compiler/training/broker/entrypoint.js

@@ -0,0 +1,126 @@
+import { execFile, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import os from "node:os";
+import { promisify } from "node:util";
+import { renderTrainingBrokerProvisioning } from "./provisioning.js";
+import { stageTrainingEvaluatorSecret } from "./evaluatorSecrets.js";
+import { startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+import { resetTrainingBrokerSlotAsOrganization } from "./reset.js";
+import path from "node:path";
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { parseTrainingBrokerDeclaration } from "./declaration.js";
+import { loadDaimonProjectionModule, resolveTrainingGrokProjection } from "./projection.js";
+import { resolveTrainingGrokRegistration } from "./registration.js";
+import { createTrainingSlotRuntime } from "./runtime.js";
+import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
+import { trainingSlotDescriptors, assertTrainingSlotsDocument, TRAINING_SLOTS_FILE, DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
+export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "PAIDEIA_GROK_BROKER_CONTROL_SOCKET";
+export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "PAIDEIA_GROK_GRANT_HOME_ROOT";
+export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
+/**
+ * The desktop Grok login, in every spelling a caller might reach it by.
+ *
+ * D2 is explicit: training uses one dedicated Grok login and never the
+ * developer's own. An in-container refresh rotates the credential, so mounting
+ * the desktop leaf would invalidate the developer's desktop session as a side
+ * effect of a training run — and the refreshed token would live on tmpfs, so
+ * the desktop login would be gone rather than moved.
+ */
+export const desktopGrokAuthPaths = (home = os.homedir()) => [path.resolve(home, ".grok/auth.json"), path.resolve(home, ".grok", "auth.json")];
+export const assertNotDesktopGrokAuth = (source, home = os.homedir()) => {
+    if (desktopGrokAuthPaths(home).includes(path.resolve(source))) {
+        throw new SpawnfileError("validation_error", "Training refuses the desktop ~/.grok/auth.json as its Grok bootstrap; import a dedicated login with `spawnfile auth import grok --profile paideia-training --from <dir>`");
+    }
+    return source;
+};
+/** The bootstrap leaf inside the container: the fixed read-only mount, a bounded regular file, never a symlink. */
+const assertBootstrap = async (declaration) => {
+    if (declaration.bootstrap !== TRAINING_BOOTSTRAP_MOUNT) {
+        throw new SpawnfileError("validation_error", `The training Grok bootstrap must be mounted at ${TRAINING_BOOTSTRAP_MOUNT}`);
+    }
+    const info = await lstat(declaration.bootstrap);
+    if (!info.isFile() || info.isSymbolicLink() || info.size < 2 || info.size > DAIMON_GROK_SUBSCRIPTION_MAX_BYTES) {
+        throw new SpawnfileError("validation_error", "The training Grok bootstrap must be a bounded regular credential leaf");
+    }
+};
+const DAIMON_GROK_SUBSCRIPTION_MAX_BYTES = 64 * 1024;
+/**
+ * The broker-capable training container's root entrypoint.
+ *
+ * Order matters and is the whole privilege model: provision as root with the
+ * production capability set, start the launcher (root) and the broker and
+ * relay (2100) and prove each one's post-drop identity, publish the slot
+ * supervisor socket, and only then drop to uid 2000 with an empty capability
+ * bounding set to run `train`. Paideia, DSPy and the judges are that uid; the
+ * model's own tools are the worker uid the launcher alone can reach.
+ */
+export const runTrainingBrokerEntrypoint = async (options) => {
+    const log = options.log ?? ((line) => process.stderr.write(`[training-entrypoint] ${line}\n`));
+    if (process.getuid?.() !== 0)
+        throw new SpawnfileError("runtime_error", "The broker-capable training container must start as root");
+    const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(options.declarationPath ?? TRAINING_BROKER_DECLARATION_FILE, "utf8")));
+    await assertBootstrap(declaration);
+    const descriptors = trainingSlotDescriptors(declaration.slots);
+    const document = JSON.parse(await readFile(TRAINING_SLOTS_FILE, "utf8"));
+    assertTrainingSlotsDocument(document, declaration.slots);
+    const registrations = descriptors.map(p => resolveTrainingGrokRegistration({ ...declaration, slot: p.slot }));
+    const daimon = await (options.loadDaimon ?? loadDaimonProjectionModule)();
+    const reset = resetTrainingBrokerSlotAsOrganization;
+    const runtimes = await Promise.all(registrations.map(async (registration) => {
+        const { projectionSha256 } = await resolveTrainingGrokProjection(declaration, registration, daimon);
+        return createTrainingSlotRuntime({ declaration, registration, projectionSha256, reset });
+    }));
+    await stageTrainingEvaluatorSecret();
+    await promisify(execFile)("/bin/bash", ["--noprofile", "--norc", "-ceu", renderTrainingBrokerProvisioning(registrations, declaration.maxRunRequests).join("\n")], { maxBuffer: 8 * 1024 * 1024 });
+    const children = await startBrokerProcesses({ log });
+    let server;
+    try {
+        for (const runtime of runtimes)
+            await startTrainingSlot(runtime, randomBytes(32).toString("hex"));
+        const supervisor = createTrainingSlotSupervisor({ runtimes, organizationUid: declaration.organizationUid });
+        server = serveTrainingSlotSupervisor(supervisor, TRAINING_SUPERVISOR_SOCKET, log, declaration.organizationUid);
+        log(`provisioned ${registrations.length} training slots with one broker process set`);
+        return await runTrainingChild(options.argv, declaration, log);
+    }
+    finally {
+        server?.close();
+        await stopBrokerProcesses(children, log);
+    }
+};
+/**
+ * `train` as uid 2000 with an empty bounding set, proven inside the child
+ * before it execs: `setpriv --bounding-set=-all` silently does nothing without
+ * `CAP_SETPCAP`, so the guard has to read `/proc/self/status` rather than
+ * trust the flag.
+ */
+export const trainingChildArgv = (argv, uid = DAIMON_ORGANIZATION_UID) => [
+    "setpriv", "--clear-groups", `--reuid=${uid}`, `--regid=${uid}`, "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all",
+    "--", "/bin/bash", "-ceu",
+    'if [ "$EUID" -eq 0 ]; then echo "training must not run as root" >&2; exit 1; fi\n'
+        + 'test "$(sed -n "s/^CapBnd:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
+        + 'test "$(sed -n "s/^CapEff:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
+        + 'exec "$@"',
+    "bash", TRAINING_ENTRYPOINT_COMMAND, ...argv
+];
+const runTrainingChild = (argv, declaration, log) => new Promise((resolve) => {
+    const command = trainingChildArgv(argv, declaration.organizationUid);
+    const child = spawn(command[0], command.slice(1), {
+        stdio: ["ignore", "inherit", "inherit"],
+        env: {
+            ...process.env,
+            [TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV]: DAIMON_GROK_ENGINE_BROKER.controlSocketPath,
+            [TRAINING_GROK_GRANT_HOME_ROOT_ENV]: TRAINING_GRANT_HOME_ROOT,
+            PAIDEIA_TRAINING_SLOTS_FILE: TRAINING_SLOTS_FILE,
+            HOME: "/home/training"
+        }
+    });
+    const forward = (signal) => () => child.kill(signal);
+    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"])
+        process.on(signal, forward(signal));
+    child.once("exit", (code, signal) => {
+        log(`training exited code=${code ?? "null"} signal=${signal ?? "none"}`);
+        resolve(signal ? (signal === "SIGINT" ? 130 : 143) : code ?? 1);
+    });
+});

package/dist/compiler/training/broker/evaluatorSecrets.d.ts

@@ -0,0 +1,2 @@
+/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
+export declare const stageTrainingEvaluatorSecret: (env?: NodeJS.ProcessEnv) => Promise<void>;

package/dist/compiler/training/broker/evaluatorSecrets.js

@@ -0,0 +1,60 @@
+import { constants } from "node:fs";
+import { chmod, chown, lstat, mkdir, open } from "node:fs/promises";
+import path from "node:path";
+import { TRAINING_TYPESAFE_SECRET_FILE, TRAINING_TYPESAFE_SECRET_INGRESS } from "../container/evaluators.js";
+import { DAIMON_ORGANIZATION_UID } from "./paths.js";
+/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
+export const stageTrainingEvaluatorSecret = async (env = process.env) => {
+    if (env.PAIDEIA_TYPESAFE_SECRET_FILE === undefined)
+        return;
+    if (process.getuid?.() !== 0 || env.PAIDEIA_TYPESAFE_SECRET_FILE !== TRAINING_TYPESAFE_SECRET_FILE) {
+        throw Error("Invalid evaluator secret staging declaration");
+    }
+    try {
+        const ingress = path.posix.dirname(TRAINING_TYPESAFE_SECRET_INGRESS);
+        const parent = await lstat(ingress);
+        if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== 0)
+            throw Error("Invalid ingress directory");
+        // This directory is tmpfs, never the mounted credential inode.
+        await chmod(ingress, 0o700);
+        const source = await open(TRAINING_TYPESAFE_SECRET_INGRESS, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let bytes;
+        try {
+            const info = await source.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size < 1 || info.size > 64 * 1024)
+                throw Error("Invalid ingress leaf");
+            const buffer = Buffer.alloc(64 * 1024 + 1);
+            const { bytesRead } = await source.read(buffer, 0, buffer.length, 0);
+            const after = await source.stat();
+            if (bytesRead !== info.size || after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs) {
+                throw Error("Secret changed while staging");
+            }
+            bytes = buffer.subarray(0, bytesRead);
+        }
+        finally {
+            await source.close();
+        }
+        const destination = path.posix.dirname(TRAINING_TYPESAFE_SECRET_FILE);
+        await mkdir(destination, { mode: 0o700 });
+        const target = await open(TRAINING_TYPESAFE_SECRET_FILE, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            await target.writeFile(bytes);
+            await target.sync();
+            await target.chown(DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
+        }
+        finally {
+            bytes.fill(0);
+            await target.close();
+        }
+        await chown(destination, DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
+        const info = await lstat(TRAINING_TYPESAFE_SECRET_FILE), directory = await lstat(destination);
+        if (info.uid !== DAIMON_ORGANIZATION_UID || info.gid !== DAIMON_ORGANIZATION_UID || (info.mode & 0o777) !== 0o600 ||
+            directory.uid !== DAIMON_ORGANIZATION_UID || directory.gid !== DAIMON_ORGANIZATION_UID || (directory.mode & 0o777) !== 0o700) {
+            throw Error("Invalid evaluator secret ownership");
+        }
+    }
+    catch {
+        // Filesystem errors may contain credential bytes supplied by a transport; emit only a fixed diagnostic.
+        throw Error("Evaluator secret staging failed");
+    }
+};

package/dist/compiler/training/broker/index.d.ts

@@ -0,0 +1,11 @@
+export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema, type TrainingBrokerDeclaration } from "./declaration.js";
+export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
+export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
+export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
+export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
+export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
+export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
+export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL, type TrainingSlotRuntime } from "./supervisor.js";
+export * from "./paths.js";

package/dist/compiler/training/broker/index.js

@@ -0,0 +1,11 @@
+export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema } from "./declaration.js";
+export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
+export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
+export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
+export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
+export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
+export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
+export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
+export * from "./paths.js";

package/dist/compiler/training/broker/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/compiler/training/broker/main.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { runTrainingBrokerEntrypoint } from "./entrypoint.js";
+/**
+ * The broker-capable training image's root entrypoint process. The image ships
+ * it; the host supplies only the read-only `spawnfile.training-broker.v2`
+ * declaration and never a script, so no host executable enters the container.
+ */
+const main = async () => {
+    process.exitCode = await runTrainingBrokerEntrypoint({ argv: process.argv.slice(2) });
+};
+main().catch((error) => {
+    process.stderr.write(`[training-entrypoint] ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/dist/compiler/training/broker/paths.d.ts

@@ -0,0 +1,236 @@
+import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+/**
+ * Every container path the broker-capable training container fixes.
+ *
+ * They are deterministic because three parties must agree on them
+ * without talking to each other: the root entrypoint that provisions them, the
+ * root slot supervisor that wipes and re-provisions them on recycle, and
+ * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * and has no way to ask the container what it chose. Daimon's projection never
+ * resolves a path, so each one must also be canonical and never a symlink; the
+ * provisioning program asserts that before a slot is used.
+ *
+ * Everything under `/run/training/slots/<i>` is per-trial state on tmpfs — never the
+ * Grok realm volume (R2). The realm volume holds only `auth.json` and the
+ * broker credential journal, so a recycle can wipe the slot without touching
+ * the one durable rotating credential.
+ */
+export declare const TRAINING_RUN_ROOT = "/run/training/output";
+export declare const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
+export declare const TRAINING_PAIDEIA_ROOT = "/run/paideia";
+export declare const TRAINING_CONTEXT_FILE = "/run/paideia/context.json";
+/** Host-written, read-only `spawnfile.training-broker.v2` declaration the root entrypoint reads. */
+export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/paideia/training-broker.json";
+export declare const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
+export declare const TRAINING_INFERENCE_LEDGER = "/run/training/inference/inference.jsonl";
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+export declare const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
+/**
+ * Private temp for the broker and its relay (uid 2100, outside the organization
+ * group), deliberately **outside** `/run/daimon-engine-broker`.
+ *
+ * Production puts it at `<control root>/tmp`, which is fine there: that root is
+ * removed and recreated exactly once, at container start. Training
+ * re-provisions the same root on every recycle, and the launch mounts this
+ * directory as its own tmpfs — so a `tmp/` inside the cleared root is a *mount
+ * point*, and clearing a mount point fails `EBUSY`. A live P8 launch died
+ * exactly there. Its own tmpfs under `/run/training` is never a wipe target and
+ * is denied to every worker uid.
+ */
+export declare const TRAINING_BROKER_TMPDIR = "/run/training/broker-tmp";
+export declare const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
+export declare const TRAINING_SUPERVISOR_SOCKET = "/run/training/supervisor/control.sock";
+export declare const TRAINING_SUPERVISOR_LOG = "/run/training/supervisor/supervisor.log";
+export declare const TRAINING_WORKER_ROOT = "/var/lib/daimon-workers";
+/**
+ * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
+ * every `deny` target inside bubblewrap as the worker uid, and it cannot
+ * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
+ * single `/run/paideia` mask below covers all of them, which is also stronger
+ * — a file Paideia adds later is covered without re-provisioning the slot.
+ */
+export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/paideia/config.json", "/run/paideia/control", "/run/paideia/launch.json", "/run/paideia/token", "/run/paideia/env", "/run/paideia/preparation.json", "/run/paideia/repair.json"];
+/**
+ * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ *
+ * This is not a summary of the five roles — it is the **whole** set of deny
+ * entries this container adds beyond Daimon's own protected paths, because
+ * Paideia's worker resolves the projection from exactly
+ * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
+ * that carried only the five roles made Daimon hash a different deny list than
+ * the one provisioning wrote, and a live run died on
+ * `Grok broker projection digest differs from the launch receipt`.
+ *
+ * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * unique. The four roles with a dedicated path keep it, and everything else is
+ * tagged `context` — the caller-state role — since there is no other way to
+ * carry a path through that contract.
+ */
+export declare const TRAINING_SLOTS_FILE = "/run/paideia/slots.json";
+export declare const TRAINING_SLOTS_VERSION: "spawnfile.training-slots.v1";
+export declare const TRAINING_DEFAULT_SLOTS = 4;
+export declare const TRAINING_MAX_SLOTS = 8;
+/** 100 ports per slot: offsets 0=Moltnet, 1=worker control, 2=bridge; 3..99 reserved. */
+export declare const TRAINING_PORT_BASE = 20000;
+export declare const TRAINING_PORT_STRIDE = 100;
+export declare const TRAINING_BROKER_SOCKET_PATHS: readonly ["/run/daimon-engine-broker/control.sock", "/run/daimon-engine-broker/backend.sock", "/run/daimon-engine-broker/launcher.sock"];
+export declare const TRAINING_TURN_STORE_ROOT = "/run/training/turns";
+/** Persistent, broker-only run counter; never part of a slot recycle. */
+export declare const TRAINING_RUN_REQUEST_STORE = "/run/training/request-budget";
+export declare const assertTrainingSlotCount: (slots: number) => number;
+export declare const trainingSlotPaths: (slot: number) => {
+    slot: number;
+    workerUid: number;
+    root: string;
+    workerHome: string;
+    workspace: string;
+    runtimeHome: string;
+    state: string;
+    acceptanceStore: string;
+    turns: string;
+    usageDirectory: string;
+    usageLedger: string;
+    preflightReceipt: string;
+    generationFile: string;
+    sealedInputsAttestation: string;
+    privateTmp: string;
+    clockDirectory: string;
+    clockFile: string;
+    ports: {
+        base: number;
+        stride: number;
+        moltnet: number;
+        workerControl: number;
+        bridge: number;
+    };
+};
+export type TrainingSlotPaths = ReturnType<typeof trainingSlotPaths>;
+export type TrainingEvaluatorPath = {
+    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
+    path: string;
+};
+/** The complete additional projection deny set. Sibling roots and homes never nest with own masks. */
+export declare const trainingEvaluatorPaths: (slot: number, slots: number) => TrainingEvaluatorPath[];
+export declare const trainingSlotDescriptors: (slots?: number) => {
+    evaluatorPaths: TrainingEvaluatorPath[];
+    containerPaths: {
+        path: "/run/paideia/config.json" | "/run/paideia/control" | "/run/paideia/launch.json" | "/run/paideia/token" | "/run/paideia/env" | "/run/paideia/preparation.json" | "/run/paideia/repair.json";
+    }[];
+    controlRoot: string;
+    slot: number;
+    workerUid: number;
+    root: string;
+    workerHome: string;
+    workspace: string;
+    runtimeHome: string;
+    state: string;
+    acceptanceStore: string;
+    turns: string;
+    usageDirectory: string;
+    usageLedger: string;
+    preflightReceipt: string;
+    generationFile: string;
+    sealedInputsAttestation: string;
+    privateTmp: string;
+    clockDirectory: string;
+    clockFile: string;
+    ports: {
+        base: number;
+        stride: number;
+        moltnet: number;
+        workerControl: number;
+        bridge: number;
+    };
+}[];
+export type TrainingSlotDescriptor = ReturnType<typeof trainingSlotDescriptors>[number];
+export interface TrainingSlotsDocument {
+    schema: typeof TRAINING_SLOTS_VERSION;
+    slots: {
+        index: number;
+        workerUid: number;
+        roots: Record<string, string>;
+        ports: {
+            base: number;
+            count: number;
+        };
+    }[];
+}
+export declare const trainingSlotsDocument: (slots?: number) => TrainingSlotsDocument;
+/** Both sides derive the descriptor bytes; a stale or edited bind must never certify a different pool. */
+export declare const assertTrainingSlotsDocument: (value: unknown, slots: number) => void;
+/** Shared deny targets exist before worker attestation; no per-slot subtree is touched here. */
+export declare const TRAINING_OPTIONAL_DENY_DIRECTORIES: readonly string[];
+/**
+ * Deny entries a launch may legitimately not have mounted. Everything else must
+ * exist before a worker turn: Grok 1.0.34 creates an absent `deny` target as
+ * the worker uid inside bubblewrap and refuses the whole profile when it
+ * cannot, so provisioning materializes every other entry itself.
+ */
+export declare const TRAINING_DEFERRED_DENY_PATHS: readonly string[];
+/**
+ * Deny entries the launch binds from the host, named so a refusal can say why.
+ *
+ * Only the run root is one. The sealed inputs root is **not**: the launch binds
+ * each declared input at `/run/training/inputs/<id>`, so `/run/training/inputs`
+ * itself is the binds' *parent*, a directory on the read-only image root — and
+ * that is exactly what makes it sealable (see `TRAINING_SEALED_DENY_PATHS`).
+ *
+ * Being a host bind is no longer a waiver on its own. On Docker Desktop and
+ * Colima a bind lands on virtiofs/grpcfuse, which ignores `chown`, and there a
+ * worker-uid probe carries no information; on a Linux daemon over ext4, xfs,
+ * btrfs or overlay the same bind enforces ownership and the probe is real. The
+ * canary resolver asks the backing filesystem rather than this list, which is
+ * why the documented `refuse` default is reachable at all.
+ */
+export declare const TRAINING_HOST_BIND_DENY_PATHS: readonly string[];
+/**
+ * Deny entries whose denial must be proven by the kernel under **every**
+ * policy, because the experiment's central claim depends on them.
+ *
+ * `/run/training/inputs` holds the sealed train and test datasets. A bubblewrap
+ * `deny` mask is not a boundary the subject cannot lift: the pinned seccomp
+ * profile must allow `clone/unshare/mount/umount2/pivot_root/setns` for
+ * bubblewrap itself, and the container runs `apparmor=unconfined`, so a
+ * worker-uid process can open a user + mount namespace of its own and either
+ * detach the mask or bind the mask's parent somewhere fresh.
+ *
+ * What survives that is DAC on the datasets' ancestor. The image bakes this
+ * directory `0:<organization gid> 0750` on the read-only root, so:
+ *
+ *   - the worker uid is in neither the owner nor the group class and loses
+ *     search permission on the one directory every dataset read must traverse;
+ *   - the inode is owned by real uid 0, which a `unshare --map-root-user`
+ *     namespace does not map, so `CAP_DAC_OVERRIDE` there cannot override it;
+ *   - the root filesystem is read-only, so nothing in the container — root
+ *     included — can loosen the mode after the image is built.
+ *
+ * Provisioning asserts the mode and then attacks it as the worker uid, and the
+ * canary resolver refuses the slot rather than certifying one of these on the
+ * sandbox profile alone.
+ */
+export declare const TRAINING_SEALED_DENY_PATHS: readonly string[];
+/** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
+/** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
+export declare const TRAINING_SEALED_INPUTS_IDENTITY: {
+    readonly uid: 0;
+    readonly gid: 2000;
+    readonly mode: "750";
+};
+/**
+ * What a recycle removes outright, and what it only empties.
+ *
+ * Nothing the launch mounts may be at or below any of these. A mount point
+ * cannot be unlinked while it is mounted, so a wipe target holding one aborts
+ * the recycle — which is how the broker/relay `TMPDIR` took down a live launch
+ * when it still lived at `<control root>/tmp`. `paths.test.ts` enforces that
+ * against the launch's own mount list; the rendered shell skips mount points
+ * anyway, so an undeclared one degrades to "left in place and reported" rather
+ * than a failed provision.
+ */
+export declare const trainingWipeTargets: (slot: number) => readonly string[];
+/** Broker-owned turns and clocks are reset through its control seam, never by filesystem deletion. */
+export declare const trainingClearTargets: (slot: number) => readonly string[];
+export declare const TRAINING_REALM_MOUNT: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+export declare const TRAINING_BOOTSTRAP_MOUNT: "/var/lib/spawnfile/daimon/grok-bootstrap-auth";
+export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };