spawnfile 0.1.14 → 0.1.18

package/dist/compiler/training/broker/provisioning.js

@@ -0,0 +1,231 @@
+import path from "node:path";
+import { renderTrainingTaskClockReset } from "./taskClock.js";
+import { DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "../../../shared/daimonGrokSeccompProfile.js";
+import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
+import { renderDaimonBrokerProvisioningProgram, renderDaimonWorkspaceResourceSecurity } from "../../containerDaimonBrokerRender.js";
+import { renderDaimonGrokHostPreflight, renderDaimonGrokWorkerProvisioning } from "../../containerDaimonGrokWorkerProvisioning.js";
+import { trainingSlotPaths, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_PAIDEIA_ROOT, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_WORKER_ROOT, } from "./paths.js";
+import { trainingNamespaceDenialMechanism } from "./seccompRoutes.js";
+const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+/**
+ * Root only ever chmods an inode it currently owns: the container's capability
+ * set grants `CAP_CHOWN` but not `CAP_FOWNER` (P0 §2), so `install -d -o u -g g
+ * -m m` — which chowns before it chmods — fails with `EPERM` for every
+ * non-root owner. Reclaim, set the mode, then hand over.
+ */
+const PROVISION_DIRECTORY_HELPER = [
+    "provision_dir() {",
+    "  target=$1; mode=$2; owner=$3; group=$4",
+    "  test -d \"$target\" && test ! -L \"$target\"",
+    "  chown 0:0 \"$target\"; chmod \"$mode\" \"$target\"; chown \"$owner:$group\" \"$target\"",
+    "}"
+];
+/**
+ * Every directory the training slot owns, with the identity that must hold it.
+ *
+ * The two ledger directories are setgid to the organization group on purpose:
+ * the broker writes its rows `0640` owned by the broker group, so without
+ * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
+ * single subject usage row or inference row it paid for.
+ */
+export const trainingSlotDirectories = (slot = 0) => [
+    // `/run/training` itself is deliberately absent: it is a mount-point parent on the read-only
+    // image root, and every writable child below it is its own tmpfs or bind.
+    { path: trainingSlotPaths(slot).root, mode: "0711", uid: 0, gid: 0 },
+    { path: TRAINING_PAIDEIA_ROOT, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: "/home/training", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: "/work", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: trainingSlotPaths(slot).workspace, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: trainingSlotPaths(slot).workerUid },
+    // The agent runtime home is deliberately absent: the shared broker provisioning creates it root-owned,
+    // fills its setgid `tool-output/`, and only then narrows it to `2000:<worker> 0710`. Handing it over here
+    // would leave root — which holds no `CAP_DAC_OVERRIDE` — unable to create the spill directory inside it.
+    { path: trainingSlotPaths(slot).state, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: trainingSlotPaths(slot).acceptanceStore, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_TURN_STORE_ROOT, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: TRAINING_RUN_REQUEST_STORE, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: trainingSlotPaths(slot).usageDirectory, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_INFERENCE_DIRECTORY, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_GRANT_HOME_ROOT, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    // Traverse only: the supervisor socket inside it is the uid gate, and a directory nobody but root may
+    // write is what keeps that socket from being replaced by a laxer one.
+    { path: TRAINING_SUPERVISOR_DIRECTORY, mode: "0711", uid: 0, gid: 0 },
+    // The broker and its relay run as uid 2100, outside the organization group, and shared `/tmp` is closed
+    // to them; this is their own temp, outside every wipe target (see `TRAINING_BROKER_TMPDIR`).
+    { path: TRAINING_BROKER_TMPDIR, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: TRAINING_WORKER_ROOT, mode: "0711", uid: 0, gid: 0 },
+    // Denied and unused by training, which meters per slot — but a world-readable directory would make its
+    // worker-uid canary meaningless, so both get the modes the production organization gives them.
+    { path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, mode: "0750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: DAIMON_WAKE_FUSE_DIRECTORY, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID }
+];
+/**
+ * The fixed identities the slot needs, checked rather than created.
+ *
+ * The broker-capable training container runs on a read-only root, so
+ * `/etc/passwd` and `/etc/group` cannot be written at start-up the way the
+ * production Daimon entrypoint writes them. The image bakes uid/gid 2000, 2100
+ * and the worker uid instead, and this refuses to provision a slot in an image
+ * that did not.
+ */
+export const renderTrainingIdentities = (slots = 4) => [
+    `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${trainingSlotDescriptors(slots).map(p => p.workerUid).join(" ")}; do`,
+    '  getent passwd "$fixed_uid" >/dev/null && getent group "$fixed_uid" >/dev/null || { echo "the training image must bake uid/gid $fixed_uid; the container root is read-only" >&2; exit 1; }',
+    "done"
+];
+/** Slot-local skeleton, shared by initial provisioning and recycle. */
+const slotDirectories = (slot) => trainingSlotDirectories(slot).filter(entry => entry.path === trainingSlotPaths(slot).root || entry.path.startsWith(`${trainingSlotPaths(slot).root}/`));
+const renderDirectories = (entries, ledgers) => [
+    ...PROVISION_DIRECTORY_HELPER,
+    ...entries.map(entry => `mkdir -p ${quote(entry.path)}`),
+    ...ledgers.map(ledger => `if [ ! -e ${quote(ledger)} ]; then : > ${quote(ledger)}; fi; chown 0:0 ${quote(ledger)}; chmod 0640 ${quote(ledger)}; chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${quote(ledger)}`),
+    ...[...entries].sort((a, b) => b.path.split("/").length - a.path.split("/").length)
+        .map(entry => `provision_dir ${quote(entry.path)} ${entry.mode} ${entry.uid} ${entry.gid}`)
+];
+const renderSlotAssertions = (r) => [
+    `test "$(stat -c '%u:%g %a' ${quote(trainingSlotPaths(r.slot).usageDirectory)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
+    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_INFERENCE_DIRECTORY)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
+    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_GRANT_HOME_ROOT)})" = "${DAIMON_ORGANIZATION_UID}:${DAIMON_ORGANIZATION_UID} 700"`,
+    `setpriv --clear-groups --reuid ${r.uid} --regid ${r.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${quote(TRAINING_GRANT_HOME_ROOT)}'`,
+    `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'test -r ${quote(r.usageLedgerPath)} && test -r ${quote(TRAINING_INFERENCE_LEDGER)}'`
+];
+/** Full container provisioning runs exactly once, before any broker process starts. */
+export const renderTrainingBrokerProvisioning = (input, maxRunRequests = 1000) => {
+    if (!Number.isSafeInteger(maxRunRequests) || maxRunRequests < 1)
+        throw new Error("Invalid run request cap");
+    const registrations = Array.isArray(input) ? input : [input];
+    const directories = [...new Map(registrations.flatMap(r => trainingSlotDirectories(r.slot)).map(d => [d.path, d])).values()];
+    return [
+        ...renderTrainingIdentities(registrations.length),
+        ...renderTrainingTaskClockReset(),
+        ...renderDirectories(directories, [...registrations.map(r => r.usageLedgerPath), TRAINING_INFERENCE_LEDGER]),
+        ...renderDaimonGrokHostPreflight(),
+        ...renderDaimonBrokerProvisioningProgram(registrations, [], {
+            version: "v3", maxRunRequests, runRequestStore: TRAINING_RUN_REQUEST_STORE,
+            turnStore: TRAINING_TURN_STORE_ROOT, inferenceLedgerPath: TRAINING_INFERENCE_LEDGER
+        }, "clear", TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_BROKER_TMPDIR, [
+            `mkdir -p ${quote(DAIMON_GROK_ENGINE_BROKER.worker.taskClock.rootDirectoryPath)}; chmod 0755 ${quote(DAIMON_GROK_ENGINE_BROKER.worker.taskClock.rootDirectoryPath)}`,
+            ...registrations.flatMap(r => {
+                const p = trainingSlotPaths(r.slot);
+                return [
+                    `mkdir -p ${quote(p.clockDirectory)}; chown 0:0 ${quote(p.clockDirectory)}; chmod 0755 ${quote(p.clockDirectory)}`,
+                    `printf '+0\\n' > ${quote(p.clockFile)}; chmod 0644 ${quote(p.clockFile)}; chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(p.clockFile)}`,
+                    `chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(p.clockDirectory)}`
+                ];
+            })
+        ]),
+        `chmod 0550 /etc/daimon-engine-broker; chown 0:${DAIMON_BROKER_UID} /etc/daimon-engine-broker`,
+        ...registrations.flatMap(r => [...renderSlotAssertions(r), ...renderTrainingSealedInputsAssertions(r.uid, r.privateTmp)])
+    ];
+};
+/** Reuse the audited worker renderer; never touch service config, credentials, shared temps or siblings. */
+export const renderTrainingSlotProvisioning = (registration) => [
+    ...renderDirectories(slotDirectories(registration.slot), [registration.usageLedgerPath]),
+    // Keep worker-home and private-tmp identities stable: sibling turns attest them concurrently.
+    `setpriv --clear-groups --reuid=${registration.uid} --regid=${registration.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- mkdir -p ${quote(registration.grokHome)}`,
+    `chown 0:0 ${quote(registration.grokHome)}; chmod 0700 ${quote(registration.grokHome)}`,
+    "node <<'SPAWNFILE_TRAINING_SLOT_PROVISION'",
+    "const crypto = require('node:crypto'); const fs = require('node:fs');",
+    ...renderDaimonWorkspaceResourceSecurity([]),
+    ...renderDaimonGrokWorkerProvisioning([registration], {}, [], "slot"),
+    "SPAWNFILE_TRAINING_SLOT_PROVISION",
+    ...renderSlotAssertions(registration),
+    ...renderTrainingSealedInputsAssertions(registration.uid, registration.privateTmp)
+];
+/**
+ * The sealed-inputs seal, asserted and then attacked before any slot is used.
+ *
+ * The declared datasets are bind-mounted at `/run/training/inputs/<id>`, so
+ * `/run/training/inputs` is their common ancestor and the only inode in the
+ * chain the container controls: it lives on the read-only image root, the image
+ * bakes it `0:<organization gid> 0750`, and nothing in the container can widen
+ * it afterwards. The worker uid is in neither its owner nor its group class, so
+ * it loses *search* permission on the directory every dataset read must
+ * traverse.
+ *
+ * Four attacker routes, not a cooperating tool's read: a direct
+ * read/search/list; a user + mount namespace of the worker's own with the
+ * bubblewrap mask and its parent lazily unmounted; a fresh `mount --bind` of
+ * `/run/training` made inside that namespace; and, per dataset, a `mount --bind`
+ * of the dataset's *own* mount, which carries no mask and — unlike its parent —
+ * is not refused for locked children. A live control container left at Docker's
+ * own `0755 root:root` hands the held-out answer key to uid 2200 through routes
+ * one, two and four (`.runtime/sealed-inputs-dac/EVIDENCE.md`).
+ *
+ * Every route reports one verdict, and the verdicts are deliberately not
+ * interchangeable:
+ *
+ *  - `reachable` — the bytes were read. Refuse.
+ *  - `denied at-read` — the route ran and the kernel's permission check refused
+ *    the open or the list. This is the DAC seal doing the work.
+ *  - `denied at-mount` — the mount the route needs was refused although the
+ *    syscall is available.
+ *  - `unavailable seccomp` / `unavailable kernel` — the worker uid cannot open
+ *    the namespace the route needs at all, so the route provably cannot happen.
+ *    That is a *stronger* denial than DAC, and naming which layer refused is
+ *    the point: `EPERM` from a seccomp filter and `EPERM` from a kernel or LSM
+ *    policy are indistinguishable by errno, so the mechanism is derived from
+ *    the pinned profile Spawnfile ships and the declaration's digest binds
+ *    (`seccompRoutes.ts`), never guessed.
+ *  - anything else — no verdict. Refuse. "Provably cannot happen" and "could
+ *    not tell" must never collapse into one pass.
+ *
+ * The probe's workspace is the worker's **private** tmp, never `/tmp`: the
+ * shared temps are provisioned `root:<organization gid> 1774` so a worker lists
+ * names only, and probing from there is what made the first live run refuse
+ * every trial on `namespace-rebind reached no verdict` — the `mkdir` failed, not
+ * the seal. The private tmp is also the workspace the subject itself has.
+ */
+export const renderTrainingSealedInputsAssertions = (workerUid = trainingSlotPaths(0).workerUid, privateTmp = trainingSlotPaths(0).privateTmp, mechanism = trainingNamespaceDenialMechanism()) => [
+    // Diagnostics go to a file rather than into the verdict: a route's stderr is util-linux prose that
+    // would turn every real verdict into "unknown", but a no-verdict refusal with no diagnostic is what
+    // made the first live failure unreadable, so the unknown branch prints it back.
+    `seal_diagnostic=${quote(`${trainingSlotPaths(workerUid - trainingSlotPaths(0).workerUid).root}/seal-probe.err`)}`,
+    `seal_worker() { setpriv --clear-groups --reuid ${workerUid} --regid ${workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -c "$1" 2>"$seal_diagnostic"; }`,
+    "seal_rows=''",
+    'seal_record() { if [ -n "$seal_rows" ]; then seal_rows="$seal_rows,"; fi; seal_rows="$seal_rows{\\"route\\":\\"$1\\",\\"verdict\\":\\"$2\\"}"; }',
+    "seal_route() {",
+    '  case "$2" in',
+    `    reachable) echo "the sealed inputs root ${TRAINING_SEALED_INPUTS_ROOT} is REACHABLE by uid ${workerUid} via $1" >&2; exit 1 ;;`,
+    '    "denied at-read"|"denied at-mount") echo "sealed inputs route $1: $2"; seal_record "$1" "$2" ;;',
+    '    "unavailable seccomp"|"unavailable kernel") echo "sealed inputs route $1: $2 — the worker uid cannot open the namespace this route needs, so it provably cannot happen"; seal_record "$1" "$2" ;;',
+    '    *) echo "sealed inputs route $1 reached no verdict, so the denial is unproven: ${2:-no stdout} [stderr: $(cat "$seal_diagnostic" 2>/dev/null | tr "\\n" " " | cut -c1-400)]" >&2; exit 1 ;;',
+    "  esac",
+    "}",
+    // One availability determination for every namespace route, so a filtered syscall is reported as the
+    // verdict it is instead of surfacing as a route that mysteriously produced nothing.
+    "seal_namespace=available",
+    `if ! seal_worker 'unshare --user --map-root-user --mount true' >/dev/null 2>&1; then seal_namespace='unavailable ${mechanism}'; fi`,
+    'seal_ns_route() { if [ "$seal_namespace" != available ]; then seal_route "$1" "$seal_namespace"; else seal_route "$1" "$(seal_worker "$2")"; fi; }',
+    // Asserted, never set: the root filesystem is read-only, so an image that did not bake this mode
+    // cannot be corrected here — and that is the point. Refuse instead.
+    `test ! -L ${quote(TRAINING_SEALED_INPUTS_ROOT)} && test -d ${quote(TRAINING_SEALED_INPUTS_ROOT)}`,
+    `if [ "$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" != "${TRAINING_SEALED_INPUTS_IDENTITY.uid}:${TRAINING_SEALED_INPUTS_IDENTITY.gid} ${TRAINING_SEALED_INPUTS_IDENTITY.mode}" ]; then`,
+    `  echo "the training image must bake ${TRAINING_SEALED_INPUTS_ROOT} as ${TRAINING_SEALED_INPUTS_IDENTITY.uid}:${TRAINING_SEALED_INPUTS_IDENTITY.gid} ${TRAINING_SEALED_INPUTS_IDENTITY.mode} on its read-only root; the sealed datasets are unprotected otherwise" >&2; exit 1`,
+    "fi",
+    `seal_route direct-read "$(seal_worker 'if ls -1 ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1 || test -r ${TRAINING_SEALED_INPUTS_ROOT} || test -x ${TRAINING_SEALED_INPUTS_ROOT}; then echo reachable; else echo denied at-read; fi')"`,
+    `seal_ns_route namespace-unmount "unshare --user --map-root-user --mount -- /bin/sh -c 'umount -l ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1; umount -l /run/training >/dev/null 2>&1; if ls -1 ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1; then echo reachable; else echo denied at-read; fi; exit 0'"`,
+    `seal_ns_route namespace-rebind-parent "unshare --user --map-root-user --mount -- /bin/sh -c 'mkdir -p ${privateTmp}/seal-parent 2>/dev/null || { echo unknown private-tmp-unwritable; exit 0; }; if mount --bind /run/training ${privateTmp}/seal-parent 2>/dev/null; then ls -1 ${privateTmp}/seal-parent/inputs >/dev/null 2>&1 && echo reachable || echo denied at-read; else echo denied at-mount; fi; exit 0'"`,
+    // Per dataset, because the strongest route is specific. Root enumerates the children; the worker may not.
+    `for sealed_child in ${TRAINING_SEALED_INPUTS_ROOT}/*; do`,
+    '  test -e "$sealed_child" || continue',
+    `  seal_route "direct-read $sealed_child" "$(seal_worker "if ls -1 '$sealed_child' >/dev/null 2>&1 || cat '$sealed_child'/* >/dev/null 2>&1; then echo reachable; else echo denied at-read; fi")"`,
+    `  seal_ns_route "namespace-rebind $sealed_child" "unshare --user --map-root-user --mount -- /bin/sh -c 'mkdir -p ${privateTmp}/seal-child 2>/dev/null || { echo unknown private-tmp-unwritable; exit 0; }; if mount --bind \\"$sealed_child\\" ${privateTmp}/seal-child 2>/dev/null; then ls -1 ${privateTmp}/seal-child >/dev/null 2>&1 && echo reachable || echo denied at-read; else echo denied at-mount; fi; exit 0'"`,
+    "done",
+    // A Spawnfile-owned attestation beside the slot receipt, readable by the organization uid. The
+    // cross-repo `noopolis.daimon.grok-slot-preflight.v2` canary shape is deliberately untouched — its
+    // schema lives in Daimon and no consumer here can validate an added member — so the per-route
+    // mechanism is recorded here rather than implied by a bare `result: "denied"` there.
+    `seal_attestation=${quote(trainingSlotPaths(workerUid - trainingSlotPaths(0).workerUid).sealedInputsAttestation)}`,
+    `printf '{"version":"spawnfile.training-sealed-inputs.v1","root":"%s","worker_uid":%s,"identity":"%s","pinned_seccomp_profile_sha256":"%s","namespace_routes":"%s","routes":[%s]}\\n' `
+        + `${quote(TRAINING_SEALED_INPUTS_ROOT)} ${workerUid} `
+        + `"$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" ${quote(DAIMON_GROK_SECCOMP_PROFILE_SHA256)} `
+        + '"$seal_namespace" "$seal_rows" > "$seal_attestation.tmp"',
+    'chown 0:0 "$seal_attestation.tmp"; chmod 0640 "$seal_attestation.tmp"; chown 0:' + String(DAIMON_ORGANIZATION_UID) + ' "$seal_attestation.tmp"',
+    'mv "$seal_attestation.tmp" "$seal_attestation"',
+    'echo "sealed inputs attestation written to $seal_attestation"'
+];
+/** Where the broker's own `service.json` lands, so the supervisor can prove the slot it restarted is the slot it provisioned. */
+export const TRAINING_SERVICE_CONFIG_PATH = DAIMON_GROK_ENGINE_BROKER.serviceConfigPath;
+export const TRAINING_REGISTRATION_PATH = DAIMON_GROK_ENGINE_BROKER.registrationPath;
+export const TRAINING_BROKER_CONTROL_ROOT = path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath);

package/dist/compiler/training/broker/receipt.d.ts

@@ -0,0 +1,77 @@
+/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
+export declare const UNENFORCED_OWNERSHIP_FILESYSTEMS: readonly ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
+/**
+ * The filesystem type backing `target`, from the longest mount point that is a
+ * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
+ * backslash in the mount point field, exactly as the durable-mount guard
+ * already handles elsewhere in this compiler.
+ */
+export declare const resolveBackingFilesystem: (target: string, mountinfo: string) => string;
+export interface TrainingCanaryProbe {
+    /**
+     * Runs one worker-uid attempt and resolves true when it was denied.
+     *
+     * `read` is an `open()` for reading. `enter` additionally requires that the
+     * worker uid cannot *search* the directory, which is the property a sealed
+     * root actually needs: its protection is that every dataset read has to
+     * traverse it, not that the directory listing itself is unreadable.
+     */
+    (target: string, depth: "read" | "enter"): Promise<boolean>;
+}
+export interface TrainingCanaryOptions {
+    denyPaths: readonly string[];
+    probe: TrainingCanaryProbe;
+    mountinfo: string;
+    /** Deny entries the launch bound from the host. Diagnostics only: the backing filesystem decides, not this list. */
+    hostBindPaths: readonly string[];
+    /** Deny entries no policy may waive; each one must be observed unenterable by the worker uid. */
+    sealedPaths: readonly string[];
+    unenforcedBindPolicy: "refuse" | "profile-only";
+    log(line: string): void;
+}
+/**
+ * One denied canary per deny path, or a refusal naming the first path whose
+ * denial this container cannot prove.
+ *
+ * Three cases, in decreasing strength:
+ *
+ *  - A **sealed** path (the datasets' root) must sit on a filesystem that
+ *    enforces unix ownership and must be observed *unenterable* by the worker
+ *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
+ *    is a boundary the worker can lift from inside a namespace of its own, and
+ *    the held-out test set is the one thing that cannot rest on it.
+ *  - Any other path on an ownership-enforcing filesystem — a host bind over
+ *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
+ *    is what makes the documented `refuse` default reachable: a host bind is
+ *    only unprovable where the filesystem says so.
+ *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
+ *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
+ *    `refuse` — the default — fails the recycle and writes no receipt;
+ *    `profile-only` accepts the attested deny entry as that path's only
+ *    boundary and names every such path in the supervisor log.
+ */
+export declare const resolveTrainingCanaries: (options: TrainingCanaryOptions) => Promise<{
+    path: string;
+    method: "sandboxed-read";
+    result: "denied";
+}[]>;
+export interface TrainingSlotReceiptInput {
+    slot: number;
+    workerUid: number;
+    generation: number;
+    nonce: string;
+    projectionSha256: string;
+    sandboxProfileSha256: string;
+    seccompProfileSha256: string;
+    grokExecutableSha256: string;
+    canaries: readonly {
+        path: string;
+        method: "sandboxed-read";
+        result: "denied";
+    }[];
+    createdAt: Date;
+}
+/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
+export declare const buildTrainingSlotReceipt: (input: TrainingSlotReceiptInput) => Record<string, unknown>;
+/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
+export declare const readGrokExecutableSha256: (executable?: "/usr/local/bin/grok") => string;

package/dist/compiler/training/broker/receipt.js

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
+export const UNENFORCED_OWNERSHIP_FILESYSTEMS = ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
+const isUnenforced = (fstype) => UNENFORCED_OWNERSHIP_FILESYSTEMS.includes(fstype) || fstype.startsWith("fuse");
+/**
+ * The filesystem type backing `target`, from the longest mount point that is a
+ * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
+ * backslash in the mount point field, exactly as the durable-mount guard
+ * already handles elsewhere in this compiler.
+ */
+export const resolveBackingFilesystem = (target, mountinfo) => {
+    let best = "", fstype = "";
+    for (const line of mountinfo.split("\n")) {
+        const fields = line.split(" ");
+        const separator = fields.indexOf("-");
+        if (separator < 0 || fields.length < separator + 2)
+            continue;
+        const mountPoint = (fields[4] ?? "").replace(/\\(04[0011]|134)/gu, (match) => ({ "\\040": " ", "\\011": "\t", "\\012": "\n", "\\134": "\\" }[match] ?? match));
+        if (mountPoint !== "/" && target !== mountPoint && !target.startsWith(`${mountPoint}/`))
+            continue;
+        if (mountPoint.length >= best.length) {
+            best = mountPoint;
+            fstype = fields[separator + 1] ?? "";
+        }
+    }
+    return fstype;
+};
+/**
+ * One denied canary per deny path, or a refusal naming the first path whose
+ * denial this container cannot prove.
+ *
+ * Three cases, in decreasing strength:
+ *
+ *  - A **sealed** path (the datasets' root) must sit on a filesystem that
+ *    enforces unix ownership and must be observed *unenterable* by the worker
+ *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
+ *    is a boundary the worker can lift from inside a namespace of its own, and
+ *    the held-out test set is the one thing that cannot rest on it.
+ *  - Any other path on an ownership-enforcing filesystem — a host bind over
+ *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
+ *    is what makes the documented `refuse` default reachable: a host bind is
+ *    only unprovable where the filesystem says so.
+ *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
+ *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
+ *    `refuse` — the default — fails the recycle and writes no receipt;
+ *    `profile-only` accepts the attested deny entry as that path's only
+ *    boundary and names every such path in the supervisor log.
+ */
+export const resolveTrainingCanaries = async (options) => {
+    const canaries = [];
+    for (const target of options.denyPaths) {
+        const fstype = resolveBackingFilesystem(target, options.mountinfo);
+        const origin = `${options.hostBindPaths.includes(target) ? "a host bind mount on " : ""}${fstype || "an unknown filesystem"}`;
+        if (options.sealedPaths.includes(target)) {
+            if (isUnenforced(fstype)) {
+                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is backed by ${origin}, which ignores unix ownership, so the worker uid's denial cannot be proven; the sealed datasets must sit under a directory on an ownership-enforcing filesystem and no unenforcedBindPolicy waives this`);
+            }
+            if (!await options.probe(target, "enter")) {
+                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is still reachable by the worker uid`);
+            }
+        }
+        else if (isUnenforced(fstype)) {
+            if (options.unenforcedBindPolicy === "refuse") {
+                throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is backed by ${origin}, which ignores unix ownership; declare unenforcedBindPolicy "profile-only" to accept the bubblewrap deny list as its only boundary`);
+            }
+            options.log(`canary ${target} certified by the enforced sandbox profile only (${origin} ignores unix ownership)`);
+        }
+        else if (!await options.probe(target, "read")) {
+            throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is still readable by the worker uid`);
+        }
+        canaries.push({ path: target, method: "sandboxed-read", result: "denied" });
+    }
+    return canaries;
+};
+/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
+export const buildTrainingSlotReceipt = (input) => {
+    if (!/^[a-f0-9]{64}$/u.test(input.nonce))
+        throw new SpawnfileError("runtime_error", "Grok slot recycle nonce must be 32 random bytes in lowercase hex");
+    if (!Number.isSafeInteger(input.generation) || input.generation < 1)
+        throw new SpawnfileError("runtime_error", "Grok slot generation must be a positive integer");
+    if (input.canaries.length === 0)
+        throw new SpawnfileError("runtime_error", "Grok slot receipt requires at least one denied canary");
+    return {
+        version: DAIMON_GROK_ENGINE_BROKER.slotPreflightVersion,
+        slot: input.slot,
+        worker_uid: input.workerUid,
+        generation: input.generation,
+        nonce: input.nonce,
+        projection_sha256: input.projectionSha256,
+        sandbox_profile_sha256: input.sandboxProfileSha256,
+        seccomp_profile_sha256: input.seccompProfileSha256,
+        sandbox_runtime: "bubblewrap",
+        grok_executable_sha256: input.grokExecutableSha256,
+        canaries: [...input.canaries],
+        created_at: `${input.createdAt.toISOString().slice(0, 23)}Z`
+    };
+};
+/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
+export const readGrokExecutableSha256 = (executable = DAIMON_GROK_ENGINE_BROKER.grokExecutablePath) => {
+    const digest = createHash("sha256").update(readFileSync(executable)).digest("hex");
+    const pinned = [DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.arm64.sha256, DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.x64.sha256];
+    if (!pinned.includes(digest)) {
+        throw new SpawnfileError("runtime_error", `${path.basename(executable)} is not the manifest-pinned Grok ${DAIMON_GROK_ENGINE_BROKER.grokCliVersion} build`);
+    }
+    return digest;
+};

package/dist/compiler/training/broker/registration.d.ts

@@ -0,0 +1,43 @@
+import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../../runtime/daimon/contractManifest.js";
+import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
+/**
+ * The one training slot's deny list: Daimon's own protected set for a
+ * single-agent organization (Grok bootstrap, realm, and the slot state root that
+ * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
+ * the evaluator roots, the caller's protected `/run/paideia` paths, the broker
+ * control and registration roots, the grant home root, the inference ledger,
+ * the per-slot ledger, turn store and supervisor socket directory.
+ *
+ * The same two refusals the production render enforces apply here: an entry
+ * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
+ * the profile outright, and masks cannot nest, so an entry covered by another
+ * entry is a provisioning bug rather than something to silently drop.
+ */
+export declare const resolveTrainingGrokDenyPaths: (added?: readonly string[] | undefined, slot?: number, slots?: number) => string[];
+export interface TrainingGrokSlotInput {
+    slot?: number;
+    slots?: number;
+    agentId: string;
+    model: DaimonGrokBrokerModel;
+    reasoningEffort: DaimonGrokBrokerReasoningEffort;
+    /** Deny entries this container adds beyond Daimon's own protected set; defaults to the fixed training set. */
+    denyPaths?: readonly string[];
+    /**
+     * The declaration's per-turn limits. The broker registration must declare
+     * them, because a wake may only LOWER a declared limit: a trial whose wake
+     * ceiling exceeds the manifest defaults is refused as `invalid_request`.
+     */
+    limits?: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+}
+/**
+ * The single brokered Grok registration a training container runs, at the
+ * fixed container paths in `paths.ts`. Unlike production it points
+ * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
+ * separable and a recycle wipes it; the container-wide ledger and wake fuse do
+ * not exist here.
+ */
+export declare const resolveTrainingGrokRegistration: (input: TrainingGrokSlotInput) => DaimonGrokRegistration;

package/dist/compiler/training/broker/registration.js

@@ -0,0 +1,110 @@
+import path from "node:path";
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
+import { DAIMON_GROK_BASE_PROFILE_GRANTS, assertCanonicalRegisteredPath } from "../../containerDaimonGrokWorkerRender.js";
+import { trainingSlotPaths, trainingEvaluatorPaths, TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, TRAINING_DEFERRED_DENY_PATHS } from "./paths.js";
+const fail = (message) => {
+    throw new SpawnfileError("compile_error", message);
+};
+const within = (candidate, root) => candidate === root || candidate.startsWith(`${root}/`);
+/**
+ * The one training slot's deny list: Daimon's own protected set for a
+ * single-agent organization (Grok bootstrap, realm, and the slot state root that
+ * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
+ * the evaluator roots, the caller's protected `/run/paideia` paths, the broker
+ * control and registration roots, the grant home root, the inference ledger,
+ * the per-slot ledger, turn store and supervisor socket directory.
+ *
+ * The same two refusals the production render enforces apply here: an entry
+ * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
+ * the profile outright, and masks cannot nest, so an entry covered by another
+ * entry is a provisioning bug rather than something to silently drop.
+ */
+export const resolveTrainingGrokDenyPaths = (added = undefined, slot = 0, slots = 1) => {
+    const p = trainingSlotPaths(slot);
+    const required = trainingEvaluatorPaths(slot, slots).map(entry => entry.path);
+    // The wake-acceptance store is masked through `p.state`, never directly: Grok 1.0.34
+    // materializes every deny target inside bubblewrap AS THE WORKER UID, and the store's parent is
+    // `2000:2000 0700`, so the store itself is unplaceable and would make Grok refuse the whole profile
+    // (`.runtime/grok-deny-placement/EVIDENCE.md`). The state root covers it and nothing else lives there.
+    const daimonOwn = [TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, p.state];
+    const grokHome = path.posix.join(p.workerHome, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+    const grants = [
+        ...DAIMON_GROK_BASE_PROFILE_GRANTS, p.workspace, grokHome,
+        path.posix.join(grokHome, "sessions"), path.posix.join(p.workerHome, "tmp")
+    ];
+    const candidates = [...new Set([...daimonOwn, ...required, ...(added ?? [])])].sort();
+    for (const entry of candidates) {
+        assertCanonicalRegisteredPath("deny path", entry);
+        const grant = grants.find((candidate) => within(candidate, entry));
+        if (grant)
+            fail(`Training Grok deny path ${entry} equals or contains the base profile grant ${grant}; Grok refuses such a profile`);
+        if (within(p.workspace, entry) || within(p.workerHome, entry) || within(p.runtimeHome, entry)) {
+            fail(`Training Grok deny path ${entry} would hide the subject's own workspace, home, or runtime home`);
+        }
+        if ([p.clockFile, DAIMON_GROK_ENGINE_BROKER.worker.taskClock.preloadPath,
+            "/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1", "/usr/lib/aarch64-linux-gnu/faketime/libfaketime.so.1"].some(file => within(file, entry))) {
+            fail(`Training Grok deny path ${entry} would hide the subject's task clock`);
+        }
+        const ancestor = candidates.find((other) => other !== entry && within(entry, other));
+        if (ancestor)
+            fail(`Training Grok deny path ${ancestor} would cover ${entry}; masks cannot nest`);
+    }
+    return candidates;
+};
+/**
+ * The single brokered Grok registration a training container runs, at the
+ * fixed container paths in `paths.ts`. Unlike production it points
+ * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
+ * separable and a recycle wipes it; the container-wide ledger and wake fuse do
+ * not exist here.
+ */
+export const resolveTrainingGrokRegistration = (input) => {
+    const p = trainingSlotPaths(input.slot ?? 0);
+    if (!input.agentId.trim())
+        fail("Training Grok slot requires an agent id");
+    if (!DAIMON_GROK_BROKER_MODELS.includes(input.model)
+        || !DAIMON_GROK_BROKER_REASONING_EFFORTS.includes(input.reasoningEffort)) {
+        fail(`Training Grok slot has no declared broker model and reasoning effort: ${input.agentId}`);
+    }
+    const home = assertCanonicalRegisteredPath("home", p.workerHome);
+    const grokHome = path.posix.join(home, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+    const config = resolveDaimonGrokClockedWorkerConfig(input.model, input.reasoningEffort, p.slot);
+    const denyPaths = resolveTrainingGrokDenyPaths(input.denyPaths, p.slot, input.slots ?? 1);
+    const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
+    const eventsPath = path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath);
+    const profilePath = path.posix.join(grokHome, "sandbox.toml");
+    for (const [label, value] of [["GROK_HOME", grokHome], ["profile", profilePath], ["events", eventsPath],
+        ["workspace", p.workspace], ["runtime home", p.runtimeHome],
+        ["usage ledger", p.usageLedger]])
+        assertCanonicalRegisteredPath(label, value);
+    return {
+        agentId: input.agentId,
+        config: config.bytes,
+        configVariant: "clocked",
+        ...(input.limits === undefined ? {} : { limits: { ...input.limits } }),
+        configSha256: config.sha256,
+        deferredDenyPaths: denyPaths.filter((entry) => TRAINING_DEFERRED_DENY_PATHS.includes(entry)),
+        denyPaths,
+        eventsPath,
+        grokHome,
+        home,
+        model: input.model,
+        profile,
+        profilePath,
+        profileSha256: daimonGrokWorkerSandboxProfileSha256(denyPaths),
+        privateTmp: path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome),
+        reasoningEffort: input.reasoningEffort,
+        runtimeHome: p.runtimeHome,
+        // Empty on purpose: training has no persistent mounts at all. Everything a trial writes under the slot
+        // runtime home is per-slot tmpfs the recycle wipes, and the only thing provisioned inside it is the
+        // setgid `tool-output/` spill directory, so the traversable `0710` home exposes nothing else.
+        runtimeHomeMounts: [],
+        slot: p.slot,
+        spillDirectory: path.posix.join(p.runtimeHome, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
+        uid: p.workerUid,
+        usageLedgerPath: p.usageLedger,
+        workspace: p.workspace
+    };
+};

package/dist/compiler/training/broker/reset.d.ts

@@ -0,0 +1,9 @@
+/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
+export declare const resetTrainingBrokerSlot: (slot: number, signal: AbortSignal, socketPath?: "/run/daimon-engine-broker/control.sock") => Promise<void>;
+/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
+export declare const resetTrainingBrokerSlotAsOrganization: (slot: number, signal: AbortSignal, execute?: (file: string, args: string[], options: {
+    signal: AbortSignal;
+    timeout: number;
+}) => Promise<{
+    stdout: string;
+}>) => Promise<void>;