spawnfile 0.1.14 → 0.1.18

package/dist/compiler/training/compiledAgent.js

@@ -0,0 +1,62 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { WORKSPACE_SKILL_BASE_DIRECTORY } from "../../runtime/common.js";
+const text = z.string().min(1);
+const absolute = text.refine((value) => value.startsWith("/") && value !== "/"
+    && path.posix.normalize(value) === value && !/[\\\0]/u.test(value), "Expected a normalized container absolute path");
+const agentPaths = z.object({ workspace_path: absolute, home_path: absolute.nullable(), skill_roots: z.array(absolute) });
+// Validate the consumed projection, allowing unrelated report fields to evolve.
+const reportSchema = z.object({
+    spawnfile_version: z.literal("0.1"),
+    nodes: z.array(z.object({ id: text, kind: z.enum(["agent", "team"]) })),
+    container: z.object({
+        runtime_instances: z.array(z.object({ id: text, runtime: text, node_ids: z.array(text), config_path: absolute,
+            workspace_path: absolute, home_path: absolute.nullable(), agent_paths: z.record(text, agentPaths).optional() })),
+        moltnet: z.object({
+            node_plans: z.array(z.object({ node_id: text, member_id: text, network_id: text, config_path: absolute })),
+            server_plans: z.array(z.object({ network_id: text, mode: z.enum(["managed", "external"]), config_path: absolute.optional() }))
+        }).optional()
+    })
+});
+/** Read compiler facts only. Does not load runtime state, credentials, or authored manifests. */
+export const resolveCompiledAgent = async (compileOut, agentName) => {
+    const file = path.resolve(compileOut, "spawnfile-report.json");
+    const report = reportSchema.parse(JSON.parse(await readFile(file, "utf8")));
+    const agents = report.nodes.filter((node) => node.kind === "agent");
+    const exact = agents.filter((node) => node.id === agentName);
+    const candidates = exact.length ? exact : agents.filter((node) => node.id === `agent:${agentName}`);
+    if (candidates.length !== 1)
+        throw new Error(`Unknown or ambiguous compiled agent: ${agentName}`);
+    const agentId = candidates[0].id;
+    const instances = report.container.runtime_instances.filter((instance) => instance.node_ids.includes(agentId));
+    if (instances.length !== 1)
+        throw new Error(`Expected one compiled runtime instance for ${agentId}`);
+    const instance = instances[0];
+    let paths = instance.agent_paths?.[agentId];
+    if (!paths) {
+        // Single-agent runtime adapters already report their exact workspace and home.
+        if (!["openclaw", "picoclaw"].includes(instance.runtime) || instance.node_ids.length !== 1) {
+            throw new Error(`Compile report lacks per-agent paths for ${agentId}; recompile with a current compiler`);
+        }
+        paths = { workspace_path: instance.workspace_path, home_path: instance.home_path,
+            skill_roots: [path.posix.join(instance.workspace_path, path.posix.relative("workspace", WORKSPACE_SKILL_BASE_DIRECTORY))] };
+    }
+    const moltnet = report.container.moltnet;
+    const attachments = (moltnet?.node_plans ?? []).filter((node) => node.node_id === agentId).map((node) => {
+        const servers = moltnet.server_plans.filter((server) => server.network_id === node.network_id);
+        if (servers.length !== 1 || (servers[0].mode === "managed" && !servers[0].config_path)) {
+            throw new Error(`Missing or ambiguous Moltnet server plan for ${node.network_id}`);
+        }
+        return { networkId: node.network_id, memberId: node.member_id, nodeConfig: node.config_path,
+            serverConfig: servers[0].config_path ?? null };
+    });
+    const containerPaths = { workspace: paths.workspace_path, runtimeConfig: instance.config_path,
+        home: paths.home_path, skillRoots: paths.skill_roots, moltnet: attachments };
+    const host = (value) => path.resolve(compileOut, "container/rootfs", `.${value}`);
+    return { agentId, runtime: instance.runtime, instanceId: instance.id, containerPaths,
+        workspace: host(containerPaths.workspace), runtimeConfig: host(containerPaths.runtimeConfig),
+        home: containerPaths.home === null ? null : host(containerPaths.home), skillRoots: containerPaths.skillRoots.map(host),
+        moltnet: attachments.map((entry) => ({ ...entry, nodeConfig: host(entry.nodeConfig),
+            serverConfig: entry.serverConfig === null ? null : host(entry.serverConfig) })) };
+};

package/dist/compiler/training/container/contract.d.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+/** Fixed libfaketime symlink installed and mode-verified by the training image. */
+export declare const TRAINING_FAKETIME_LIBRARY_PATH: "/usr/local/lib/daimon/libfaketime.so.1";
+export declare const trainingImageSchema: z.ZodString;
+export declare const trainingContainerConfigSchema: z.ZodObject<{
+    version: z.ZodEnum<{
+        "spawnfile.training-container.v1": "spawnfile.training-container.v1";
+        "spawnfile.training-container.v3": "spawnfile.training-container.v3";
+        "spawnfile.training-container.v4": "spawnfile.training-container.v4";
+    }>;
+    slots: z.ZodDefault<z.ZodNumber>;
+    dockerContext: z.ZodString;
+    inputs: z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        destination: z.ZodString;
+    }, z.core.$strict>>;
+    output: z.ZodObject<{
+        source: z.ZodString;
+        destination: z.ZodLiteral<"/run/training/output">;
+    }, z.core.$strict>;
+    auth: z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        provider: z.ZodEnum<{
+            codex: "codex";
+            claude: "claude";
+        }>;
+    }, z.core.$strict>>;
+    evaluatorRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        purpose: z.ZodEnum<{
+            decisions: "decisions";
+            extraction: "extraction";
+            proposals: "proposals";
+        }>;
+        provider: z.ZodEnum<{
+            "codex-subscription": "codex-subscription";
+            typesafe: "typesafe";
+        }>;
+        model: z.ZodString;
+        maxRequests: z.ZodNumber;
+        maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    evaluatorSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        provider: z.ZodLiteral<"typesafe">;
+        source: z.ZodString;
+    }, z.core.$strict>>>;
+    subjectIsolation: z.ZodOptional<z.ZodLiteral<"codex-native-sandbox">>;
+    broker: z.ZodOptional<z.ZodObject<{
+        engine: z.ZodLiteral<"grok">;
+        realmVolume: z.ZodString;
+        bootstrap: z.ZodString;
+        declaration: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type TrainingContainerConfig = z.infer<typeof trainingContainerConfigSchema>;

package/dist/compiler/training/container/contract.js

@@ -0,0 +1,51 @@
+import path from "node:path";
+import { z } from "zod";
+import { trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema } from "./evaluators.js";
+/** Fixed libfaketime symlink installed and mode-verified by the training image. */
+export const TRAINING_FAKETIME_LIBRARY_PATH = "/usr/local/lib/daimon/libfaketime.so.1";
+const hostPath = z.string().min(1).refine((value) => path.isAbsolute(value) && !/[,\r\n\0]/u.test(value), "Expected an absolute bind path");
+const inputPath = z.string().regex(/^\/run\/training\/inputs\/[A-Za-z0-9._/-]+$/u).refine((value) => path.posix.normalize(value) === value && !value.endsWith("/"));
+export const trainingImageSchema = z.string().regex(/^(?:sha256:[a-f0-9]{64}|[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[a-f0-9]{64})$/u);
+const brokerLaunchSchema = z.object({
+    engine: z.literal("grok"),
+    /** The named Docker volume holding the training Grok realm: `auth.json` and the broker credential journal, nothing else. */
+    realmVolume: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
+    /** Host leaf of the dedicated training Grok login. Never the desktop `~/.grok/auth.json`. */
+    bootstrap: hostPath,
+    /** `spawnfile.training-broker.v2`, written beside the launch config and bound read-only into the container. */
+    declaration: hostPath
+}).strict();
+export const trainingContainerConfigSchema = z.object({
+    version: z.enum(["spawnfile.training-container.v1", "spawnfile.training-container.v3", "spawnfile.training-container.v4"]),
+    slots: z.number().int().min(1).max(8).default(4),
+    dockerContext: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
+    inputs: z.array(z.object({ source: hostPath, destination: inputPath }).strict()).min(1).max(64),
+    output: z.object({ source: hostPath, destination: z.literal("/run/training/output") }).strict(),
+    auth: z.array(z.object({ source: hostPath, provider: z.enum(["codex", "claude"]) }).strict()).max(2),
+    evaluatorRoutes: trainingEvaluatorRoutesSchema.optional(),
+    evaluatorSecrets: trainingEvaluatorSecretsSchema(hostPath).optional(),
+    subjectIsolation: z.literal("codex-native-sandbox").optional(),
+    /** Present only on `spawnfile.training-container.v4`: the brokered Grok slot this container runs as root. */
+    broker: brokerLaunchSchema.optional()
+}).strict().superRefine((value, context) => {
+    if (value.evaluatorSecrets && !value.broker && !value.subjectIsolation)
+        context.addIssue({ code: "custom", message: "Evaluator secrets require brokered v4 isolation or explicit codex-native-sandbox subject isolation" });
+    if (value.subjectIsolation && value.version !== "spawnfile.training-container.v1")
+        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a non-brokered v1 launch" });
+    if (value.subjectIsolation && !value.evaluatorRoutes?.some(route => route.provider === "typesafe"))
+        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a TypeSafe evaluator route" });
+    if (value.evaluatorSecrets && !value.evaluatorRoutes?.some(route => route.provider === "typesafe")) {
+        context.addIssue({ code: "custom", message: "TypeSafe secret requires a declared evaluator route" });
+    }
+    if (value.version === "spawnfile.training-container.v3")
+        context.addIssue({ code: "custom", message: "Training-container v3 is unsupported; migrate to v4 with slots: 1" });
+    const destinations = value.inputs.map((entry) => entry.destination);
+    if (destinations.some((entry, index) => destinations.some((other, otherIndex) => otherIndex !== index && (entry === other || entry.startsWith(`${other}/`))))) {
+        context.addIssue({ code: "custom", message: "Input destinations must not overlap" });
+    }
+    if (new Set(value.auth.map((entry) => entry.provider)).size !== value.auth.length)
+        context.addIssue({ code: "custom", message: "Duplicate auth provider" });
+    if ((value.version === "spawnfile.training-container.v4") !== (value.broker !== undefined)) {
+        context.addIssue({ code: "custom", message: "Only spawnfile.training-container.v4 declares broker slots; migrate v3 by setting version to v4 and slots to 1" });
+    }
+});

package/dist/compiler/training/container/evaluators.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+export declare const TRAINING_EVALUATOR_ROUTES_FILE = "/run/paideia/evaluator-routes.json";
+export declare const TRAINING_TYPESAFE_SECRET_FILE = "/run/paideia/secrets/typesafe";
+export declare const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/paideia/secret-ingress/typesafe";
+export declare const trainingEvaluatorRouteSchema: z.ZodObject<{
+    purpose: z.ZodEnum<{
+        decisions: "decisions";
+        extraction: "extraction";
+        proposals: "proposals";
+    }>;
+    provider: z.ZodEnum<{
+        "codex-subscription": "codex-subscription";
+        typesafe: "typesafe";
+    }>;
+    model: z.ZodString;
+    maxRequests: z.ZodNumber;
+    maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const trainingEvaluatorRoutesSchema: z.ZodArray<z.ZodObject<{
+    purpose: z.ZodEnum<{
+        decisions: "decisions";
+        extraction: "extraction";
+        proposals: "proposals";
+    }>;
+    provider: z.ZodEnum<{
+        "codex-subscription": "codex-subscription";
+        typesafe: "typesafe";
+    }>;
+    model: z.ZodString;
+    maxRequests: z.ZodNumber;
+    maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>>;
+/** Only a reference is declared. Secret bytes are never read by the compiler or launcher. */
+export declare const trainingEvaluatorSecretsSchema: (source: z.ZodString) => z.ZodArray<z.ZodObject<{
+    provider: z.ZodLiteral<"typesafe">;
+    source: z.ZodString;
+}, z.core.$strict>>;
+export declare const prepareTrainingEvaluators: (root: string, config: {
+    evaluatorRoutes?: z.infer<typeof trainingEvaluatorRoutesSchema>;
+    evaluatorSecrets?: {
+        provider: "typesafe";
+        source: string;
+    }[];
+    subjectIsolation?: "codex-native-sandbox";
+}, mappedArgs: readonly string[]) => Promise<{
+    mounts: string[];
+    env: string[];
+}>;

package/dist/compiler/training/container/evaluators.js

@@ -0,0 +1,50 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+export const TRAINING_EVALUATOR_ROUTES_FILE = "/run/paideia/evaluator-routes.json";
+export const TRAINING_TYPESAFE_SECRET_FILE = "/run/paideia/secrets/typesafe";
+export const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/paideia/secret-ingress/typesafe";
+export const trainingEvaluatorRouteSchema = z.object({
+    purpose: z.enum(["extraction", "proposals", "decisions"]),
+    provider: z.enum(["codex-subscription", "typesafe"]),
+    model: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u),
+    maxRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    maxSpendUsd: z.number().finite().nonnegative().optional()
+}).strict().superRefine((route, context) => {
+    if (route.provider === "codex-subscription" ? route.purpose === "decisions" || route.maxSpendUsd !== undefined
+        : route.purpose !== "decisions" || route.maxSpendUsd === undefined) {
+        context.addIssue({ code: "custom", message: "Evaluator provider/purpose mismatch or missing TypeSafe spend budget" });
+    }
+});
+export const trainingEvaluatorRoutesSchema = z.array(trainingEvaluatorRouteSchema).min(1).max(64)
+    .refine(routes => new Set(routes.map(route => JSON.stringify([route.purpose, route.provider, route.model]))).size === routes.length, "Duplicate evaluator route");
+/** Only a reference is declared. Secret bytes are never read by the compiler or launcher. */
+export const trainingEvaluatorSecretsSchema = (source) => z.array(z.object({
+    provider: z.literal("typesafe"), source
+}).strict()).min(1).max(1);
+export const prepareTrainingEvaluators = async (root, config, mappedArgs) => {
+    const mounts = [], env = [];
+    if (config.evaluatorRoutes) {
+        const outputs = mappedArgs.flatMap((arg, index) => arg === "--out" ? [mappedArgs[index + 1]] : []);
+        const output = outputs[0];
+        if (outputs.length !== 1 || !output || path.posix.normalize(output) !== output ||
+            !(output === "/run/training/output" || output.startsWith("/run/training/output/"))) {
+            throw Error("Evaluator receipts require one mapped training --out directory");
+        }
+        const source = path.join(root, "evaluator-routes.json");
+        await writeFile(source, JSON.stringify({ version: "paideia.evaluator-routes.v1", routes: config.evaluatorRoutes,
+            receiptPath: path.posix.join(output, "evaluator-requests.jsonl") }), { mode: 0o444, flag: "wx" });
+        mounts.push(`type=bind,src=${source},dst=${TRAINING_EVALUATOR_ROUTES_FILE},readonly`);
+        env.push(`PAIDEIA_EVALUATOR_ROUTES_FILE=${TRAINING_EVALUATOR_ROUTES_FILE}`);
+    }
+    for (const secret of config.evaluatorSecrets ?? []) {
+        // The host-uid v1 launcher cannot stage a root-owned copy; bind the canonical leaf at the consumer path.
+        if (config.subjectIsolation === "codex-native-sandbox") {
+            mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_FILE},readonly`);
+        }
+        else
+            mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_INGRESS},readonly`);
+        env.push(`PAIDEIA_TYPESAFE_SECRET_FILE=${TRAINING_TYPESAFE_SECRET_FILE}`);
+    }
+    return { mounts, env };
+};

package/dist/compiler/training/container/grokWriteback.d.ts

@@ -0,0 +1,8 @@
+type DockerCall = (args: string[], cleanup: boolean) => Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** Called only for an ownership-verified container, before removal, including failure/cancellation. */
+export declare const persistTrainingGrokCredential: (id: string, profile: string, scratch: string, call: DockerCall) => Promise<void>;
+export {};

package/dist/compiler/training/container/grokWriteback.js

@@ -0,0 +1,26 @@
+import path from "node:path";
+import { writeBackTrainingGrokCredential } from "../../../auth/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+/** Called only for an ownership-verified container, before removal, including failure/cancellation. */
+export const persistTrainingGrokCredential = async (id, profile, scratch, call) => {
+    const state = await call(["inspect", "--format", "{{json .State}}", id], true);
+    if (state.code !== 0)
+        throw Error("Cannot verify training credential writer state");
+    if (JSON.parse(state.stdout).Running === true) {
+        const stopped = await call(["stop", "--time", "5", id], true);
+        if (stopped.code !== 0)
+            throw Error("Cannot stop training credential writer");
+    }
+    const terminal = await call(["inspect", "--format", "{{json .State}}", id], true);
+    if (terminal.code !== 0 || JSON.parse(terminal.stdout).Running !== false)
+        throw Error("Training credential writer is still active");
+    const realm = DAIMON_GROK_ENGINE_BROKER.credentialHomePath;
+    const candidate = path.join(scratch, "grok-auth.json"), journal = path.join(scratch, "grok-journal.json");
+    // Docker writes directly into a host-private directory: no credential bytes in stdout, logs or arguments.
+    const copied = await call(["cp", `${id}:${realm}/auth.json`, candidate], true);
+    if (copied.code !== 0)
+        throw Error("Cannot export training Grok credential");
+    const journalCopy = await call(["cp", `${id}:${realm}/.daimon-broker/credential-journal.json`, journal], true);
+    // A realm that never rotated has no journal. The auth owner accepts only unchanged bytes in that case.
+    await writeBackTrainingGrokCredential(profile, candidate, journalCopy.code === 0 ? journal : `${journal}.absent`);
+};

package/dist/compiler/training/container/index.d.ts

@@ -0,0 +1,5 @@
+export { TRAINING_FAKETIME_LIBRARY_PATH, trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
+export type { TrainingContainerConfig } from "./contract.js";
+export { launchTrainingContainer } from "./launch.js";
+export type { LaunchTrainingContainerOptions } from "./launch.js";
+export { trainingEvaluatorRouteSchema, trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema, TRAINING_EVALUATOR_ROUTES_FILE, TRAINING_TYPESAFE_SECRET_FILE } from "./evaluators.js";

package/dist/compiler/training/container/index.js

@@ -0,0 +1,3 @@
+export { TRAINING_FAKETIME_LIBRARY_PATH, trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
+export { launchTrainingContainer } from "./launch.js";
+export { trainingEvaluatorRouteSchema, trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema, TRAINING_EVALUATOR_ROUTES_FILE, TRAINING_TYPESAFE_SECRET_FILE } from "./evaluators.js";

package/dist/compiler/training/container/launch.d.ts

@@ -0,0 +1,21 @@
+import { type TrainingExecution } from "../execution.js";
+import type { TrainingContext } from "../contract.js";
+import { type TrainingDockerProcess } from "./process.js";
+export declare const TRAINING_INPUTS_GID = 2000;
+export interface LaunchTrainingContainerOptions {
+    image: string;
+    configPath: string;
+    context: TrainingContext;
+    args: readonly string[];
+    timeoutMs: number;
+    signal?: AbortSignal;
+    streams: {
+        stdout(line: string): void;
+        stderr(line: string): void;
+    };
+    process?: TrainingDockerProcess;
+    execution?: TrainingExecution;
+    preparationPath?: string;
+    repairPath?: string;
+}
+export declare const launchTrainingContainer: (options: LaunchTrainingContainerOptions) => Promise<number>;

package/dist/compiler/training/container/launch.js

@@ -0,0 +1,264 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdtemp, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS } from "../../../shared/index.js";
+import { parseTrainingBrokerDeclaration } from "../broker/declaration.js";
+import { trainingSlotsDocument, TRAINING_SLOTS_FILE } from "../broker/paths.js";
+import { assertNotDesktopGrokAuth } from "../broker/entrypoint.js";
+import { TRAINING_BROKER_ENTRYPOINT, trainingBrokerMounts, trainingBrokerSecurityArgs, trainingBrokerTmpfsTargets, trainingRunRequestMount } from "./security.js";
+import { parseDetachedContainerInspect } from "../../runProjectDocker.js";
+import { mapTrainingExecution, trainingExecutionSchema, TRAINING_EXECUTION_FILE, TRAINING_EXECUTION_CAPABILITY_LABEL, TRAINING_EXECUTION_VERSION } from "../execution.js";
+import { verifyCanonicalPins } from "../preparation/inputs.js";
+import { removeTrainingPreparationScratch } from "../preparation/scratch.js";
+import { trainingImageSchema } from "./contract.js";
+import { prepareTrainingEvaluators } from "./evaluators.js";
+import { prepareTrainingContainer } from "./prepare.js";
+import { runTrainingDocker } from "./process.js";
+import { repairEnvelopeSchema } from "../repair/contract.js";
+import { hashJson } from "../preparation/files.js";
+import { parseTrainingMappedPreparation } from "../preparation/contract.js";
+import { persistTrainingGrokCredential } from "./grokWriteback.js";
+import { nativeTrainingSlotsDocument } from "./nativeSlots.js";
+import { createTrainingOutputVolume, trainingOutputVolumeEnabled } from "./outputVolume.js";
+// The image bakes /run/training/inputs as 0:2000 0750 for brokered worker isolation; the
+// non-brokered host-uid evaluator joins that group so it can still traverse its own inputs.
+export const TRAINING_INPUTS_GID = 2_000;
+const inspectFormat = "{{json .Id}}\n{{json .Name}}\n{{json .Image}}\n{{json .Config.Labels}}";
+export const launchTrainingContainer = async (options) => {
+    if (options.signal?.aborted)
+        return 130;
+    const image = trainingImageSchema.parse(options.image);
+    const volumeEnabled = trainingOutputVolumeEnabled();
+    const uid = process.getuid?.(), gid = process.getgid?.();
+    if (uid === undefined || gid === undefined || uid === 0)
+        throw Error("Training requires an explicit non-root local user");
+    const configBytes = await readFile(options.configPath, "utf8");
+    if (Buffer.byteLength(configBytes) > 1024 * 1024)
+        throw Error("Training launch config exceeds 1 MiB");
+    const raw = JSON.parse(configBytes);
+    const prepared = await prepareTrainingContainer(options.execution
+        ? { ...raw, output: { ...raw.output, source: options.execution.output } } : raw, options.context, options.args, { createOutput: options.execution !== undefined && !options.args.includes("--resume") });
+    const execution = options.execution ? mapTrainingExecution(options.execution, file => {
+        const absolute = path.resolve(file);
+        const binding = [...prepared.config.inputs, prepared.config.output].find(entry => absolute === entry.source || absolute.startsWith(entry.source + path.sep));
+        if (!binding)
+            throw Error(`Training execution path is not covered by a declared mount: ${file}`);
+        return path.posix.join(binding.destination, path.relative(binding.source, absolute).split(path.sep).join("/"));
+    }) : undefined;
+    if (options.execution)
+        await verifyCanonicalPins(prepared.config.inputs.map((input, index) => ({ ...input, id: String(index), digest: "" })), options.execution.datasetPins, prepared.config.inputs.map(input => input.source));
+    // D2: the training Grok login is a dedicated one. Refuse the developer's desktop leaf before Docker ever sees it.
+    if (prepared.config.broker) {
+        assertNotDesktopGrokAuth(prepared.config.broker.bootstrap);
+        const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(prepared.config.broker.declaration, "utf8")));
+        if (declaration.slots !== prepared.config.slots)
+            throw Error("Training launch and broker declaration slots differ");
+    }
+    if (options.preparationPath) {
+        if (await realpath(options.preparationPath) !== options.preparationPath)
+            throw Error("Preparation receipt path must be canonical");
+        parseTrainingMappedPreparation(JSON.parse(await readFile(options.preparationPath, "utf8")));
+    }
+    if (options.repairPath) {
+        if (await realpath(options.repairPath) !== options.repairPath)
+            throw Error("Repair receipt path must be canonical");
+        const raw = JSON.parse(await readFile(options.repairPath, "utf8"));
+        const envelope = repairEnvelopeSchema.parse(raw);
+        if (hashJson(raw.receipt) !== envelope.digest || envelope.receipt.current.imageId !== image ||
+            !prepared.config.inputs.some(input => input.destination === envelope.receipt.parent.root))
+            throw Error("Repair receipt launch identity mismatch");
+    }
+    const execute = options.process ?? runTrainingDocker;
+    const controller = new AbortController(), deadline = Date.now() + options.timeoutMs;
+    let interrupted = false, timedOut = false;
+    const interrupt = () => { interrupted = true; controller.abort(); };
+    const timer = setTimeout(() => { timedOut = true; controller.abort(); }, options.timeoutMs);
+    options.signal?.addEventListener("abort", interrupt, { once: true });
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", interrupt);
+    if (options.signal?.aborted)
+        interrupt();
+    const prefix = ["--context", prepared.config.dockerContext];
+    const call = async (args, cleanup = false, stream = false, cleanupTimeoutMs = 10_000) => {
+        if (!cleanup && controller.signal.aborted)
+            throw Error("Container operation cancelled");
+        return execute([...prefix, ...args], {
+            timeoutMs: cleanup ? cleanupTimeoutMs : Math.max(1, deadline - Date.now()),
+            ...(cleanup ? {} : { signal: controller.signal }), ...(stream ? options.streams : {})
+        });
+    };
+    const name = `spawnfile-training-${randomUUID()}`;
+    const labels = { "com.spawnfile.training.owner": name };
+    let privateRoot, containerId, creationAttempted = false, startAttempted = false;
+    let expectedImage, lastLine = "", closureVerified = false;
+    let outputVolume;
+    try {
+        const endpoint = await execute(["context", "inspect", prepared.config.dockerContext, "--format", "{{json .Endpoints.docker.Host}}"], { timeoutMs: 10_000, signal: controller.signal });
+        if (endpoint.code !== 0 || !/^unix:\/\//u.test(JSON.parse(endpoint.stdout)))
+            throw Error("Training requires an explicitly selected local Unix Docker context");
+        const inspected = await call(["image", "inspect", image, "--format", "{{.Id}}"]);
+        expectedImage = inspected.stdout.trim();
+        if (inspected.code !== 0 || !/^sha256:[a-f0-9]{64}$/u.test(expectedImage) || (image.startsWith("sha256:") && image !== expectedImage))
+            throw Error("Training image must be locally available with an immutable identity");
+        if (execution) {
+            const capability = await call(["image", "inspect", expectedImage, "--format", `{{json (index .Config.Labels "${TRAINING_EXECUTION_CAPABILITY_LABEL}")}}`]);
+            if (capability.code !== 0 || capability.stdout.trim() !== JSON.stringify(TRAINING_EXECUTION_VERSION)) {
+                throw Error(`Authored training requires an image implementing --spawnfile-execution ${TRAINING_EXECUTION_FILE} and labelled ${TRAINING_EXECUTION_CAPABILITY_LABEL}=${TRAINING_EXECUTION_VERSION}; legacy Paideia datasets are incompatible`);
+            }
+        }
+        privateRoot = await realpath(await mkdtemp(path.join(path.dirname(prepared.config.output.source), ".spawnfile-training-container-")));
+        await chmod(privateRoot, 0o700);
+        const contextFile = path.join(privateRoot, "context.json");
+        await writeFile(contextFile, JSON.stringify(prepared.context), { mode: 0o444, flag: "wx" });
+        const executionFile = path.join(privateRoot, "execution.json");
+        if (execution)
+            await writeFile(executionFile, JSON.stringify(trainingExecutionSchema.parse(execution)), { mode: 0o444, flag: "wx" });
+        const evaluators = await prepareTrainingEvaluators(privateRoot, prepared.config, prepared.args);
+        if (volumeEnabled) {
+            outputVolume = createTrainingOutputVolume({ name, image: expectedImage, host: prepared.config.output.source, scratch: privateRoot,
+                uid, gid, runtimeUid: prepared.config.broker ? 2000 : uid, runtimeGid: prepared.config.broker ? 2000 : gid,
+                context: prepared.config.dockerContext, call: (args, cleanup) => call(args, cleanup, false, 120_000), stderr: options.streams.stderr });
+            await outputVolume.seed();
+        }
+        const mounts = [...evaluators.mounts, ...prepared.config.inputs.map((entry) => `type=bind,src=${entry.source},dst=${entry.destination},readonly`),
+            outputVolume?.mount ?? `type=bind,src=${prepared.config.output.source},dst=/run/training/output`,
+            `type=bind,src=${contextFile},dst=/run/paideia/context.json,readonly`,
+            ...execution ? [`type=bind,src=${executionFile},dst=${TRAINING_EXECUTION_FILE},readonly`] : [],
+            ...options.preparationPath ? [`type=bind,src=${options.preparationPath},dst=/run/paideia/preparation.json,readonly`] : [],
+            ...options.repairPath ? [`type=bind,src=${options.repairPath},dst=/run/paideia/repair.json,readonly`] : [],
+            ...prepared.config.auth.map((entry) => `type=bind,src=${entry.source},dst=/run/paideia-auth/${entry.provider},readonly`)];
+        const broker = prepared.config.broker;
+        if (broker) {
+            mounts.push(trainingRunRequestMount(prepared.config.output.source, prepared.args));
+            const slotsFile = path.join(privateRoot, "slots.json");
+            await writeFile(slotsFile, `${JSON.stringify(trainingSlotsDocument(prepared.config.slots))}\n`, { mode: 0o444, flag: "wx" });
+            mounts.push(`type=bind,src=${slotsFile},dst=${TRAINING_SLOTS_FILE},readonly`);
+        }
+        else {
+            const slotsFile = path.join(privateRoot, "slots.json");
+            await writeFile(slotsFile, `${JSON.stringify(nativeTrainingSlotsDocument(prepared.config.slots, uid))}\n`, { mode: 0o444, flag: "wx" });
+            mounts.push(`type=bind,src=${slotsFile},dst=${TRAINING_SLOTS_FILE},readonly`);
+        }
+        // A brokered Grok slot runs the launcher, the broker and the model's own worker uid inside this container, so it
+        // starts as root with the production Daimon capability set instead of the host user with no capabilities at all.
+        const privilege = broker
+            ? [...await trainingBrokerSecurityArgs(privateRoot), "--pids-limit", "2048",
+                ...trainingBrokerTmpfsTargets(prepared.config.slots).flatMap((entry) => ["--tmpfs", `${entry.path}:rw,nosuid,nodev,size=${entry.size},mode=${entry.mode}`])]
+            : ["--user", `${uid}:${gid}`, "--group-add", String(TRAINING_INPUTS_GID), "--cap-drop", "ALL", "--security-opt", "no-new-privileges",
+                ...DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS, "--pids-limit", String(512 * prepared.config.slots),
+                "--tmpfs", `/tmp:rw,nosuid,nodev,size=${prepared.config.slots}g,uid=${uid},gid=${gid},mode=1777`, "--tmpfs", `/work:rw,nosuid,nodev,size=${4 * prepared.config.slots}g,uid=${uid},gid=${gid},mode=700`,
+                "--tmpfs", `/home/training:rw,nosuid,nodev,size=${prepared.config.slots}g,uid=${uid},gid=${gid},mode=700`];
+        const args = ["create", "--name", name, "--label", `com.spawnfile.training.owner=${name}`,
+            "--init", "--read-only", ...privilege,
+            "--env", "HOME=/home/training", "--workdir", "/work", "--entrypoint", broker ? TRAINING_BROKER_ENTRYPOINT : "/opt/training/bin/train",
+            ...(broker ? ["--env", "PAIDEIA_MODEL_REQUEST_CAP=broker"] : []),
+            ...evaluators.env.flatMap(value => ["--env", value]),
+            ...[...mounts, ...(broker ? trainingBrokerMounts(broker) : [])].flatMap((mount) => ["--mount", mount]),
+            ...(prepared.viewerPort === undefined ? [] : ["--publish", `127.0.0.1:${prepared.viewerPort}:${prepared.viewerPort}`]), expectedImage,
+            "train", "--spawnfile-context", "/run/paideia/context.json",
+            ...(execution ? ["--spawnfile-execution", TRAINING_EXECUTION_FILE] : []), ...prepared.args];
+        creationAttempted = true;
+        const created = await call(args);
+        containerId = created.stdout.trim();
+        if (created.code !== 0 || !/^[a-f0-9]{64}$/u.test(containerId)) {
+            let diagnostic = created.stderr;
+            for (const auth of [...prepared.config.auth, ...prepared.config.evaluatorSecrets ?? []])
+                diagnostic = diagnostic.replaceAll(auth.source, "[auth source]");
+            diagnostic = diagnostic.replace(/\p{Cc}/gu, " ").trim().slice(0, 2048);
+            throw Error(`Docker did not return a valid training container identity${diagnostic ? `: ${diagnostic}` : ""}`);
+        }
+        const identity = await call(["inspect", "--format", inspectFormat, containerId]);
+        if (identity.code !== 0 || parseDetachedContainerInspect(identity.stdout, containerId, labels, name).imageId !== expectedImage)
+            throw Error("Training container identity mismatch");
+        if (controller.signal.aborted)
+            throw Error("Container operation cancelled");
+        startAttempted = true;
+        const result = await execute([...prefix, "start", "--attach", containerId], {
+            timeoutMs: Math.max(1, deadline - Date.now()), signal: controller.signal,
+            stdout: (line) => { if (line.trim())
+                lastLine = line; options.streams.stdout(line); }, stderr: options.streams.stderr
+        });
+        const terminal = await call(["inspect", "--format", "{{json .State}}", containerId]);
+        const state = JSON.parse(terminal.stdout);
+        if (terminal.code !== 0 || state.Running !== false || !Number.isInteger(state.ExitCode) || result.code !== state.ExitCode)
+            throw Error("Training container final state is unverified");
+        await outputVolume?.export();
+        if (state.ExitCode !== 0 && state.ExitCode !== 1)
+            return state.ExitCode;
+        const receipt = JSON.parse(lastLine);
+        if (receipt.status !== "completed" || typeof receipt.index !== "string" || !receipt.index.startsWith("/run/training/output/") || path.posix.normalize(receipt.index) !== receipt.index)
+            throw Error("Training exited without a valid final receipt");
+        const artifact = path.join(prepared.config.output.source, receipt.index.slice("/run/training/output/".length));
+        if (await realpath(artifact) !== artifact || !(await stat(artifact)).isFile())
+            throw Error("Training completion artifact is missing or escapes output");
+        return state.ExitCode;
+    }
+    catch (error) {
+        if (interrupted)
+            return 130;
+        if (timedOut)
+            throw Error("Container training exceeded command deadline");
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        try {
+            if (creationAttempted) {
+                // A timed-out create may still have created our uniquely labelled container.
+                const found = await call(["inspect", "--format", inspectFormat, name], true);
+                if (found.code === 0) {
+                    const id = JSON.parse(found.stdout.split("\n")[0]);
+                    if (typeof id !== "string" || parseDetachedContainerInspect(found.stdout, id, labels, name).imageId !== expectedImage || (containerId && /^[a-f0-9]{64}$/u.test(containerId) && id !== containerId))
+                        throw Error("Refusing cleanup of unverified training container");
+                    try {
+                        if (startAttempted) {
+                            const current = await call(["inspect", "--format", "{{json .State}}", id], true);
+                            if (current.code !== 0)
+                                throw Error("Cannot verify training writer state");
+                            if (JSON.parse(current.stdout).Running === true) {
+                                const stopped = await call(["stop", "--time", "5", id], true);
+                                if (stopped.code !== 0)
+                                    throw Error("Cannot stop training output writer");
+                            }
+                        }
+                        if (startAttempted && prepared.config.broker && privateRoot) {
+                            await persistTrainingGrokCredential(id, prepared.config.broker.bootstrap, privateRoot, call);
+                        }
+                    }
+                    finally {
+                        const removed = await call(["rm", "--force", id], true);
+                        const remaining = await call(["container", "ls", "--all", "--no-trunc", "--filter", `id=${id}`, "--format", "{{.ID}}"], true);
+                        if (removed.code !== 0 || remaining.code !== 0 || remaining.stdout.trim())
+                            throw Error("Training container cleanup is unverified");
+                        closureVerified = true;
+                    }
+                }
+                else {
+                    const remaining = await call(["container", "ls", "--all", "--filter", `name=^/${name}$`, "--format", "{{.ID}}"], true);
+                    if (remaining.code !== 0 || remaining.stdout.trim())
+                        throw Error("Training container closure is unknown");
+                    closureVerified = true;
+                }
+            }
+        }
+        finally {
+            try {
+                const closed = !creationAttempted || closureVerified;
+                try {
+                    if (closed)
+                        await outputVolume?.export();
+                }
+                finally {
+                    await outputVolume?.dispose(closed);
+                }
+            }
+            finally {
+                options.signal?.removeEventListener("abort", interrupt);
+                process.removeListener("SIGINT", interrupt);
+                process.removeListener("SIGTERM", interrupt);
+                if (privateRoot && (!creationAttempted || closureVerified) && (!outputVolume || outputVolume.safeToCleanup()))
+                    await removeTrainingPreparationScratch(privateRoot);
+            }
+        }
+    }
+};

package/dist/compiler/training/container/nativeSlots.d.ts

@@ -0,0 +1,14 @@
+/** Native trials keep fresh per-trial roots; only their port blocks are provisioned. */
+export declare const nativeTrainingSlotsDocument: (slots: number, workerUid: number) => {
+    schema: "spawnfile.training-slots.v2";
+    slots: {
+        index: number;
+        workerUid: number;
+        isolation: "shared-uid";
+        roots: {};
+        ports: {
+            base: number;
+            count: number;
+        };
+    }[];
+};

package/dist/compiler/training/container/nativeSlots.js

@@ -0,0 +1,13 @@
+import { assertTrainingSlotCount, TRAINING_PORT_BASE, TRAINING_PORT_STRIDE } from "../broker/paths.js";
+/** Native trials keep fresh per-trial roots; only their port blocks are provisioned. */
+export const nativeTrainingSlotsDocument = (slots, workerUid) => {
+    if (!Number.isInteger(workerUid) || workerUid <= 0 || workerUid > 4_294_967_294)
+        throw Error("Native slots require a non-root worker uid");
+    return {
+        schema: "spawnfile.training-slots.v2",
+        slots: Array.from({ length: assertTrainingSlotCount(slots) }, (_, index) => ({
+            index, workerUid, isolation: "shared-uid", roots: {},
+            ports: { base: TRAINING_PORT_BASE + index * TRAINING_PORT_STRIDE, count: TRAINING_PORT_STRIDE }
+        }))
+    };
+};