spawnfile 0.1.14 → 0.1.18

package/dist/compiler/training/container/outputCopy.d.ts

@@ -0,0 +1,2 @@
+/** Runs only in the verified Linux training image. No project code is imported. */
+export declare const trainingOutputCopyProgram: string;

package/dist/compiler/training/container/outputCopy.js

@@ -0,0 +1,72 @@
+/** Runs only in the verified Linux training image. No project code is imported. */
+export const trainingOutputCopyProgram = String.raw `
+const fs = require('node:fs');
+const path = require('node:path');
+const [source, destination, owner, group] = process.argv.slice(1);
+const uid = Number(owner), gid = Number(group);
+const limits = { entries: 1_000_000, bytes: 64 * 1024 ** 3, depth: 64 };
+let entries = 0, bytes = 0;
+const links = new Map();
+const buffer = Buffer.alloc(1024 * 1024);
+// Linux fd-relative traversal keeps renamed directories and symlink swaps from
+// redirecting reads/writes outside the two mounts. The fallback permits local QA.
+const fdPath = (fd, file) => process.platform === 'linux' ? '/proc/self/fd/' + fd : file;
+const directory = fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW;
+function copy(src, dst, depth) {
+  if (++entries > limits.entries || depth > limits.depth) throw Error('Output tree exceeds entry/depth limit');
+  const info = fs.lstatSync(src);
+  if (info.isSymbolicLink()) {
+    const target = fs.readlinkSync(src);
+    bytes += Buffer.byteLength(target);
+    if (bytes > limits.bytes) throw Error('Output exceeds 64 GiB');
+    fs.symlinkSync(target, dst); fs.lchownSync(dst, uid, gid);
+    fs.lutimesSync(dst, info.atime, info.mtime);
+    return;
+  }
+  if (info.isDirectory()) {
+    const input = fs.openSync(src, directory);
+    let output;
+    try {
+      if (depth !== 0) fs.mkdirSync(dst, { mode: 0o700 });
+      output = fs.openSync(dst, directory);
+      fs.fchownSync(output, uid, gid);
+      const from = fdPath(input, src), to = fdPath(output, dst);
+      if (depth === 0 && fs.readdirSync(to).length) throw Error('Output copy destination must be empty');
+      for (const name of fs.readdirSync(from)) copy(path.join(from, name), path.join(to, name), depth + 1);
+      fs.fchownSync(output, uid, gid); fs.fchmodSync(output, info.mode & 0o7777);
+      fs.futimesSync(output, info.atime, info.mtime); fs.fsyncSync(output);
+    } finally { if (output !== undefined) fs.closeSync(output); fs.closeSync(input); }
+    return;
+  }
+  if (!info.isFile()) throw Error('Output contains a special file');
+  const input = fs.openSync(src, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  let output;
+  try {
+    const opened = fs.fstatSync(input);
+    if (!opened.isFile() || opened.dev !== info.dev || opened.ino !== info.ino) throw Error('Output changed during copy');
+    const key = info.dev + ':' + info.ino;
+    // Store a path rooted at the destination mount, not an fd that closes after recursion.
+    const previous = links.get(key);
+    if (previous) { fs.linkSync(previous, dst); return; }
+    bytes += info.size;
+    if (bytes > limits.bytes) throw Error('Output exceeds 64 GiB');
+    output = fs.openSync(dst, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+    fs.fchownSync(output, uid, gid);
+    let position = 0;
+    while (position < info.size) {
+      const count = fs.readSync(input, buffer, 0, Math.min(buffer.length, info.size - position), position);
+      if (!count) throw Error('Output truncated during copy');
+      let written = 0;
+      while (written < count) written += fs.writeSync(output, buffer, written, count - written);
+      position += count;
+    }
+    const after = fs.fstatSync(input);
+    if (after.size !== info.size || after.mtimeMs !== info.mtimeMs) throw Error('Output changed during copy');
+    fs.fchownSync(output, uid, gid); fs.fchmodSync(output, info.mode & 0o7777);
+    fs.futimesSync(output, info.atime, info.mtime); fs.fsyncSync(output);
+    links.set(key, fs.realpathSync(dst));
+  } finally { if (output !== undefined) fs.closeSync(output); fs.closeSync(input); }
+}
+copy(source, destination, 0);
+console.log('spawnfile-output-copy-complete');
+`;

package/dist/compiler/training/container/outputVolume.d.ts

@@ -0,0 +1,27 @@
+type DockerCall = (args: string[], cleanup?: boolean) => Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+export declare const trainingOutputVolumeEnabled: () => boolean;
+/** One launch owns this volume; budgets and auth volumes are never touched. */
+export declare const createTrainingOutputVolume: (options: {
+    name: string;
+    image: string;
+    host: string;
+    scratch: string;
+    uid: number;
+    gid: number;
+    runtimeUid: number;
+    runtimeGid: number;
+    context: string;
+    call: DockerCall;
+    stderr(line: string): void;
+}) => {
+    safeToCleanup: () => boolean;
+    mount: string;
+    seed(): Promise<void>;
+    export(): Promise<void>;
+    dispose(closureVerified: boolean): Promise<void>;
+};
+export {};

package/dist/compiler/training/container/outputVolume.js

@@ -0,0 +1,161 @@
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath, rename } from "node:fs/promises";
+import path from "node:path";
+import { parseDetachedContainerInspect } from "../../runProjectDocker.js";
+import { trainingOutputCopyProgram } from "./outputCopy.js";
+const ownerLabel = "com.spawnfile.training.owner";
+const inspectFormat = "{{json .Id}}\n{{json .Name}}\n{{json .Image}}\n{{json .Config.Labels}}";
+const target = "/run/training/output";
+export const trainingOutputVolumeEnabled = () => {
+    const setting = process.env.SPAWNFILE_TRAINING_OUTPUT_STORAGE;
+    if (setting !== undefined && setting !== "volume" && setting !== "bind")
+        throw Error("SPAWNFILE_TRAINING_OUTPUT_STORAGE must be volume or bind");
+    return setting !== "bind";
+};
+/** One launch owns this volume; budgets and auth volumes are never touched. */
+export const createTrainingOutputVolume = (options) => {
+    const { call } = options;
+    const volume = `${options.name}-output`;
+    let attempted = false, seeded = false, exported = false, exportAttempted = false, helperClosed = true;
+    const recovery = () => `Training output retained in Docker volume ${volume}. Recover with: docker --context ${options.context} run --rm --network none --read-only --mount type=volume,src=${volume},dst=/output,readonly --entrypoint /bin/tar ${options.image} -C /output -cpf - . > training-output-recovery.tar`;
+    const owned = async () => {
+        const result = await call(["volume", "inspect", volume, "--format", "{{json .}}"], true);
+        if (result.code !== 0) {
+            const listed = await call(["volume", "ls", "--filter", `name=^${volume}$`, "--format", "{{.Name}}"], true);
+            if (listed.code === 0 && !listed.stdout.trim())
+                return false;
+            throw Error("Training output volume closure is unknown");
+        }
+        const info = JSON.parse(result.stdout);
+        if (info.Name !== volume || info.Driver !== "local" || (info.Options && Object.keys(info.Options).length) || info.Labels?.[ownerLabel] !== options.name)
+            throw Error("Refusing unverified training output volume");
+        return true;
+    };
+    const transfer = async (direction) => {
+        if (!await owned())
+            throw Error("Training output volume is missing");
+        const name = `${volume}-${direction}`;
+        const labels = { [ownerLabel]: name };
+        const hostStage = path.join(options.scratch, "output-export");
+        if (direction === "export")
+            await mkdir(hostStage, { mode: 0o700 });
+        const mounts = direction === "seed"
+            ? [`type=bind,src=${options.host},dst=/source,readonly`, `type=volume,src=${volume},dst=/destination,volume-nocopy`]
+            : [`type=volume,src=${volume},dst=/source,readonly,volume-nocopy`, `type=bind,src=${hostStage},dst=/destination`];
+        let creationAttempted = false, containerId;
+        try {
+            creationAttempted = true;
+            helperClosed = false;
+            const created = await call(["container", "create", "--name", name, "--label", `${ownerLabel}=${name}`,
+                "--network", "none", "--read-only", "--user", "0:0", "--security-opt", "no-new-privileges",
+                // Retain only Docker's default CHOWN, DAC_OVERRIDE, FOWNER and FSETID for copying
+                // private runtime files and assigning the native/broker uid. No cap-add.
+                ...["AUDIT_WRITE", "KILL", "MKNOD", "NET_BIND_SERVICE", "NET_RAW", "SETFCAP", "SETGID", "SETPCAP", "SETUID", "SYS_CHROOT"].flatMap(cap => ["--cap-drop", cap]),
+                "--pids-limit", "32", "--memory", "256m", "--cpus", "1", "--workdir", "/",
+                ...mounts.flatMap(mount => ["--mount", mount]), "--entrypoint", "node", options.image,
+                "-e", trainingOutputCopyProgram, "/source", "/destination",
+                String(direction === "seed" ? options.runtimeUid : options.uid), String(direction === "seed" ? options.runtimeGid : options.gid)], direction === "export");
+            const id = created.stdout.trim();
+            containerId = id;
+            if (created.code !== 0 || !/^[a-f0-9]{64}$/u.test(id))
+                throw Error(`Cannot create training output ${direction} helper`);
+            const checked = await call(["container", "inspect", "--format", inspectFormat, name], true);
+            if (checked.code !== 0 || parseDetachedContainerInspect(checked.stdout, id, labels, name).imageId !== options.image)
+                throw Error("Training output helper identity mismatch");
+            const result = await call(["container", "start", "--attach", id], direction === "export");
+            const terminal = await call(["container", "inspect", "--format", "{{json .State}}", id], true);
+            const state = JSON.parse(terminal.stdout);
+            if (result.code !== 0 || result.stdout.trim() !== "spawnfile-output-copy-complete" || terminal.code !== 0 || state.Running !== false || state.ExitCode !== 0)
+                throw Error(`Training output ${direction} failed (copy incomplete or exceeds limits): ${result.stderr.replace(/\p{Cc}/gu, " ").slice(0, 2048)}`);
+        }
+        finally {
+            if (creationAttempted) {
+                const found = await call(["container", "inspect", "--format", inspectFormat, name], true);
+                if (found.code === 0) {
+                    const id = JSON.parse(found.stdout.split("\n")[0]);
+                    if (typeof id !== "string" || parseDetachedContainerInspect(found.stdout, id, labels, name).imageId !== options.image || (containerId && /^[a-f0-9]{64}$/u.test(containerId) && id !== containerId))
+                        throw Error("Refusing cleanup of unverified training output helper");
+                    const removed = await call(["container", "rm", "--force", id], true);
+                    if (removed.code !== 0)
+                        throw Error("Cannot remove training output helper");
+                }
+                const remaining = await call(["container", "ls", "--all", "--filter", `name=^/${name}$`, "--format", "{{.ID}}"], true);
+                if (remaining.code !== 0 || remaining.stdout.trim())
+                    throw Error("Training output helper closure is unknown");
+                helperClosed = true;
+            }
+        }
+        if (direction === "export") {
+            if (await realpath(options.host) !== options.host || !(await lstat(options.host)).isDirectory())
+                throw Error("Training host output changed before export");
+            const backup = path.join(options.scratch, "output-before-export");
+            await rename(options.host, backup);
+            try {
+                await rename(hostStage, options.host);
+            }
+            catch (error) {
+                await rename(backup, options.host);
+                throw error;
+            }
+            for (const directory of [options.scratch, path.dirname(options.host)]) {
+                const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+        }
+    };
+    return {
+        safeToCleanup: () => helperClosed && (!exportAttempted || exported),
+        mount: `type=volume,src=${volume},dst=${target},volume-nocopy`,
+        async seed() {
+            attempted = true;
+            const created = await call(["volume", "create", "--driver", "local", "--label", `${ownerLabel}=${options.name}`, volume]);
+            if (created.code !== 0 || created.stdout.trim() !== volume || !await owned())
+                throw Error("Cannot create owned training output volume");
+            await transfer("seed");
+            seeded = true;
+            options.stderr(`Training output uses VM-local volume ${volume}; host checkpoints update at exit.`);
+        },
+        async export() {
+            if (!seeded || exportAttempted)
+                return;
+            exportAttempted = true;
+            try {
+                await transfer("export");
+                exported = true;
+            }
+            catch (error) {
+                options.stderr(`Training output export failed: ${error instanceof Error ? error.message : "unknown failure"}. Scratch retained at ${options.scratch}. ${recovery()}`);
+                throw Error(`Training output export failed. ${recovery()}`, { cause: error });
+            }
+        },
+        async dispose(closureVerified) {
+            if (!attempted)
+                return;
+            try {
+                if (!await owned())
+                    return;
+                if (!helperClosed)
+                    throw Error("Training output helper closure is unverified");
+                if (!closureVerified) {
+                    options.stderr(recovery());
+                    return;
+                }
+                if (seeded && !exported)
+                    throw Error("Training output has not been exported");
+                const removed = await call(["volume", "rm", volume], true);
+                const remaining = await call(["volume", "ls", "--filter", `name=^${volume}$`, "--format", "{{.Name}}"], true);
+                if (removed.code !== 0 || remaining.code !== 0 || remaining.stdout.trim())
+                    throw Error("Training output volume removal is unverified");
+            }
+            catch (error) {
+                options.stderr(recovery());
+                throw Error(recovery(), { cause: error });
+            }
+        }
+    };
+};

package/dist/compiler/training/container/prepare.d.ts

@@ -0,0 +1,10 @@
+import { type TrainingContext } from "../contract.js";
+import { type TrainingContainerConfig } from "./contract.js";
+export declare const prepareTrainingContainer: (raw: unknown, context: TrainingContext, args: readonly string[], options?: {
+    createOutput?: boolean;
+}) => Promise<{
+    config: TrainingContainerConfig;
+    context: TrainingContext;
+    args: string[];
+    viewerPort?: number;
+}>;

package/dist/compiler/training/container/prepare.js

@@ -0,0 +1,125 @@
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { trainingContextSchema } from "../contract.js";
+import { trainingContainerConfigSchema } from "./contract.js";
+import { allocateTrainingOutputParent } from "../execution.js";
+import { assertTrainingSubjectIsolation } from "./subjectIsolation.js";
+const inside = (root, value) => value === root || value.startsWith(`${root}/`);
+export const prepareTrainingContainer = async (raw, context, args, options = {}) => {
+    const config = trainingContainerConfigSchema.parse(raw);
+    await assertTrainingSubjectIsolation(config, context);
+    const entries = [...config.inputs, config.output];
+    const protectedLeaves = [...config.auth, ...config.evaluatorSecrets ?? []];
+    const home = path.resolve(os.homedir());
+    const globalConfigRoots = [".codex", ".claude", ".grok", ".ssh", ".config"].map((name) => path.join(home, name));
+    let missingOutput = false;
+    for (const entry of [...entries, ...protectedLeaves]) {
+        let canonical;
+        try {
+            canonical = await realpath(entry.source);
+        }
+        catch (error) {
+            if (entry !== config.output || !options.createOutput || error.code !== "ENOENT")
+                throw error;
+            canonical = path.resolve(entry.source);
+            missingOutput = true;
+        }
+        if (canonical !== entry.source)
+            throw Error("Training bind sources must be canonical, without symlink aliases");
+        if (entry !== config.output || !missingOutput) {
+            const stat = await lstat(canonical);
+            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory()))
+                throw Error("Training binds require regular files or directories");
+            if (config.evaluatorSecrets?.includes(entry) && stat.nlink !== 1)
+                throw Error("Evaluator secrets must not have hardlink aliases");
+            if (protectedLeaves.includes(entry) && !stat.isFile())
+                throw Error("Auth must be a single regular leaf file");
+        }
+        if (entries.includes(entry)) {
+            if (["/", "/etc", "/var", "/run", "/tmp", "/opt", "/usr", "/Users", "/home", home].includes(canonical) || globalConfigRoots.some((root) => inside(root, canonical)))
+                throw Error("Host homes, configuration and system roots cannot be training inputs");
+            if (protectedLeaves.some((auth) => inside(canonical, auth.source)))
+                throw Error("Auth must not be exposed through input or output mounts");
+        }
+    }
+    if (config.inputs.some((entry, index) => config.inputs.some((other, otherIndex) => index !== otherIndex && inside(entry.source, other.source))))
+        throw Error("Training input source roots must not overlap");
+    if (!missingOutput && !(await lstat(config.output.source)).isDirectory())
+        throw Error("Training output must be an existing directory");
+    if (config.inputs.some((entry) => inside(entry.source, config.output.source) || inside(config.output.source, entry.source)))
+        throw Error("Training output and inputs must not overlap");
+    const map = (value) => {
+        const absolute = path.resolve(value);
+        const entry = entries.find((item) => inside(item.source, absolute));
+        if (!entry)
+            throw Error(`Training path is not covered by a declared mount: ${value}`);
+        return path.posix.join(entry.destination, path.relative(entry.source, absolute).split(path.sep).join("/"));
+    };
+    const source = (entry) => ({ ...entry, sourcePath: map(entry.sourcePath) });
+    const mapped = trainingContextSchema.parse({ ...context,
+        project: { ...context.project, root: map(context.project.root), manifest: map(context.project.manifest) },
+        agent: { ...context.agent, source: map(context.agent.source) },
+        sources: context.sources.map(source), documents: context.documents.map(source), skills: context.skills.map(source)
+    });
+    const mappedArgs = [...args];
+    let viewerPort;
+    for (let index = 0; index < mappedArgs.length; index++) {
+        const flag = mappedArgs[index];
+        if (["--train", "--validation", "--test", "--out", "--cost-config"].includes(flag)) {
+            const value = mappedArgs[++index];
+            if (!value)
+                throw Error(`Missing ${flag} path`);
+            mappedArgs[index] = map(value);
+            if (flag === "--out" && !inside("/run/training/output", mappedArgs[index]))
+                throw Error("Training --out must use the writable output mount");
+        }
+        else if (flag === "--resource") {
+            const value = mappedArgs[++index] ?? "", equals = value.indexOf("=");
+            if (equals < 1)
+                throw Error("Expected resource=id path mapping");
+            mappedArgs[index] = `${value.slice(0, equals)}=${map(value.slice(equals + 1))}`;
+        }
+        else if (flag === "--bridge-command") {
+            const value = mappedArgs[++index] ?? "";
+            if (!/^\/opt\/training\/[A-Za-z0-9._/-]+$/u.test(value) || path.posix.normalize(value) !== value)
+                throw Error("Bridge must be an installed executable under /opt/training");
+        }
+        else if (flag === "--view") {
+            const value = mappedArgs[++index] ?? "";
+            const port = Number(value);
+            if (viewerPort !== undefined || !/^\d+$/u.test(value) || !Number.isSafeInteger(port) || port < 1 || port > 65535)
+                throw Error("Container --view requires one explicit port from 1 to 65535");
+            viewerPort = port;
+            mappedArgs[index] = String(port);
+        }
+    }
+    {
+        const flags = mappedArgs.filter(arg => arg === "--concurrency" || arg.startsWith("--concurrency="));
+        if (flags.length > 1)
+            throw Error("Training accepts one --concurrency value");
+        const flag = flags[0];
+        if (flag !== undefined) {
+            const value = flag === "--concurrency" ? mappedArgs[mappedArgs.indexOf(flag) + 1] : flag.slice("--concurrency=".length);
+            if (!value || !/^[1-8]$/u.test(value) || Number(value) > config.slots) {
+                throw Error("Training concurrency must fit the provisioned slots");
+            }
+            if (flag !== "--concurrency")
+                mappedArgs.splice(mappedArgs.indexOf(flag), 1, "--concurrency", value);
+        }
+    }
+    if (missingOutput) {
+        await allocateTrainingOutputParent(config.output.source);
+        try {
+            await mkdir(config.output.source, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        if (await realpath(config.output.source) !== config.output.source || !(await lstat(config.output.source)).isDirectory()) {
+            throw Error("Training output must be a canonical directory");
+        }
+    }
+    return { config, context: mapped, args: mappedArgs, ...(viewerPort === undefined ? {} : { viewerPort }) };
+};

package/dist/compiler/training/container/process.d.ts

@@ -0,0 +1,14 @@
+export interface TrainingDockerProcess {
+    (args: readonly string[], options: {
+        timeoutMs: number;
+        signal?: AbortSignal;
+        stdout?: (line: string) => void;
+        stderr?: (line: string) => void;
+    }): Promise<{
+        code: number;
+        stdout: string;
+        stderr: string;
+    }>;
+}
+/** Docker client only; no model executable runs on the host. */
+export declare const runTrainingDocker: TrainingDockerProcess;

package/dist/compiler/training/container/process.js

@@ -0,0 +1,70 @@
+import { spawn } from "node:child_process";
+/** Docker client only; no model executable runs on the host. */
+export const runTrainingDocker = (args, options) => new Promise((resolve, reject) => {
+    if (options.signal?.aborted) {
+        reject(Error("Training Docker operation cancelled"));
+        return;
+    }
+    const child = spawn("docker", [...args], { shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", failure;
+    let forceClose;
+    let settled = false;
+    const pending = { stdout: "", stderr: "" };
+    const stop = (message) => {
+        failure ??= Error(message);
+        child.kill("SIGKILL");
+        forceClose ??= setTimeout(() => {
+            // Releasing a stuck client lets the owner independently stop/verify the container.
+            child.stdout.destroy();
+            child.stderr.destroy();
+            finish(null);
+        }, 1000);
+    };
+    const abort = () => stop("Training Docker operation cancelled");
+    const timer = setTimeout(() => stop("Training Docker operation exceeded deadline"), options.timeoutMs);
+    options.signal?.addEventListener("abort", abort, { once: true });
+    if (options.signal?.aborted)
+        abort();
+    const consume = (channel, chunk) => {
+        pending[channel] += chunk;
+        if (Buffer.byteLength(pending[channel]) > 1024 * 1024) {
+            stop("Docker output exceeded bounded line size");
+            return;
+        }
+        const lines = pending[channel].split("\n");
+        pending[channel] = lines.pop();
+        for (const line of lines) {
+            options[channel]?.(line);
+            if (channel === "stdout")
+                stdout = options.stdout ? line : stdout + line + "\n";
+            else
+                stderr = options.stderr ? line : stderr + line + "\n";
+            if (stdout.length + stderr.length > 2 * 1024 * 1024)
+                stop("Docker output exceeded bounded capture size");
+        }
+    };
+    child.stdout.setEncoding("utf8").on("data", (chunk) => consume("stdout", chunk));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => consume("stderr", chunk));
+    child.once("error", (error) => { failure = error; });
+    const finish = (code) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(forceClose);
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", abort);
+        for (const channel of ["stdout", "stderr"])
+            if (pending[channel]) {
+                options[channel]?.(pending[channel]);
+                if (channel === "stdout")
+                    stdout = options.stdout ? pending[channel] : stdout + pending[channel];
+                else
+                    stderr = options.stderr ? pending[channel] : stderr + pending[channel];
+            }
+        if (failure)
+            reject(failure);
+        else
+            resolve({ code: code ?? 1, stdout, stderr });
+    };
+    child.once("close", finish);
+});

package/dist/compiler/training/container/security.d.ts

@@ -0,0 +1,38 @@
+export declare const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
+/** Same output directory is the same resumable run; different outputs never share a counter. */
+export declare const trainingRunRequestMount: (outputSource: string, args: readonly string[]) => string;
+/**
+ * Disposable state of a broker-capable training container, all on tmpfs.
+ *
+ * The image root stays read-only and nothing here is a host bind, so a trial's
+ * worker home, workspace, turn store, wake-acceptance store and ledgers are
+ * on a filesystem that enforces unix ownership — which is what lets the slot
+ * supervisor's worker-uid canaries mean anything (P0 §5: a host bind under
+ * Docker Desktop or Colima silently ignores `chown`). The Grok realm is the
+ * credential mount. The run request counter has its own persistent named volume.
+ */
+export declare const trainingBrokerTmpfsTargets: (slots?: number) => readonly {
+    path: string;
+    size: string;
+    mode: string;
+}[];
+/**
+ * `docker create` arguments for the broker-capable training container.
+ *
+ * It starts as root with the *production* Daimon capability set rather than
+ * the v1 path's `--cap-drop ALL` as the host user: the root entrypoint has to
+ * provision uid-owned directories (`CAP_CHOWN`), let the native launcher
+ * `setuid` to a worker (`CAP_SETUID`/`SETGID`), drop bounding sets
+ * (`CAP_SETPCAP`), supervise dropped children (`CAP_KILL`) and read the
+ * attested layout it does not own (`CAP_DAC_READ_SEARCH`). `CAP_FOWNER` is
+ * deliberately absent, which is why every provisioning chmod reclaims the
+ * inode first. Grok 1.0.34 runs every sandbox profile inside bubblewrap, so
+ * the container also needs the pinned default-plus-userns seccomp profile and
+ * AppArmor unconfined — the narrowest combination P0 found.
+ */
+export declare const trainingBrokerSecurityArgs: (seccompProfileDirectory: string) => Promise<string[]>;
+export declare const trainingBrokerMounts: (broker: {
+    realmVolume: string;
+    bootstrap: string;
+    declaration: string;
+}) => string[];

package/dist/compiler/training/container/security.js

@@ -0,0 +1,68 @@
+import { createHash } from "node:crypto";
+import { DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, materializeDaimonGrokSeccompProfile } from "../../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
+import { TRAINING_BROKER_TMPDIR, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_PAIDEIA_ROOT, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_WORKER_ROOT } from "../broker/paths.js";
+export const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
+/** Same output directory is the same resumable run; different outputs never share a counter. */
+export const trainingRunRequestMount = (outputSource, args) => {
+    const index = args.indexOf("--out"), output = args[index + 1];
+    if (index < 0 || !output || args.lastIndexOf("--out") !== index)
+        throw Error("Brokered training requires one --out directory");
+    const identity = createHash("sha256").update(JSON.stringify([outputSource, output])).digest("hex");
+    return `type=volume,src=spawnfile-training-budget-${identity},dst=${TRAINING_RUN_REQUEST_STORE}`;
+};
+/**
+ * Disposable state of a broker-capable training container, all on tmpfs.
+ *
+ * The image root stays read-only and nothing here is a host bind, so a trial's
+ * worker home, workspace, turn store, wake-acceptance store and ledgers are
+ * on a filesystem that enforces unix ownership — which is what lets the slot
+ * supervisor's worker-uid canaries mean anything (P0 §5: a host bind under
+ * Docker Desktop or Colima silently ignores `chown`). The Grok realm is the
+ * credential mount. The run request counter has its own persistent named volume.
+ */
+export const trainingBrokerTmpfsTargets = (slots = 4) => [
+    { path: "/tmp", size: "1g", mode: "1777" },
+    { path: "/var/tmp", size: "256m", mode: "1777" },
+    { path: "/work", size: "4g", mode: "0755" },
+    { path: "/home/training", size: "1g", mode: "0755" },
+    { path: TRAINING_PAIDEIA_ROOT, size: "64m", mode: "0755" },
+    ...trainingSlotDescriptors(slots).map(p => ({ path: p.root, size: "4g", mode: "0711" })),
+    { path: TRAINING_TURN_STORE_ROOT, size: "256m", mode: "0700" },
+    { path: TRAINING_GRANT_HOME_ROOT, size: "64m", mode: "0755" },
+    { path: TRAINING_INFERENCE_DIRECTORY, size: "64m", mode: "0755" },
+    { path: TRAINING_SUPERVISOR_DIRECTORY, size: "16m", mode: "0755" },
+    { path: TRAINING_WORKER_ROOT, size: "1g", mode: "0755" },
+    { path: "/etc/daimon-engine-broker", size: "16m", mode: "0755" },
+    { path: "/run/daimon-engine-broker", size: "64m", mode: "0755" },
+    { path: TRAINING_BROKER_TMPDIR, size: "64m", mode: "0755" },
+    { path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, size: "64m", mode: "0755" },
+    { path: DAIMON_WAKE_FUSE_DIRECTORY, size: "16m", mode: "0755" }
+];
+/**
+ * `docker create` arguments for the broker-capable training container.
+ *
+ * It starts as root with the *production* Daimon capability set rather than
+ * the v1 path's `--cap-drop ALL` as the host user: the root entrypoint has to
+ * provision uid-owned directories (`CAP_CHOWN`), let the native launcher
+ * `setuid` to a worker (`CAP_SETUID`/`SETGID`), drop bounding sets
+ * (`CAP_SETPCAP`), supervise dropped children (`CAP_KILL`) and read the
+ * attested layout it does not own (`CAP_DAC_READ_SEARCH`). `CAP_FOWNER` is
+ * deliberately absent, which is why every provisioning chmod reclaims the
+ * inode first. Grok 1.0.34 runs every sandbox profile inside bubblewrap, so
+ * the container also needs the pinned default-plus-userns seccomp profile and
+ * AppArmor unconfined — the narrowest combination P0 found.
+ */
+export const trainingBrokerSecurityArgs = async (seccompProfileDirectory) => [
+    "--user", "0:0",
+    ...DAIMON_DOCKER_RUNTIME_SECURITY_ARGS,
+    `--security-opt=seccomp=${await materializeDaimonGrokSeccompProfile(seccompProfileDirectory)}`,
+    "--security-opt=apparmor=unconfined"
+];
+export const trainingBrokerMounts = (broker) => [
+    `type=volume,src=${broker.realmVolume},dst=${DAIMON_GROK_ENGINE_BROKER.credentialHomePath}`,
+    `type=bind,src=${broker.bootstrap},dst=/var/lib/spawnfile/daimon/grok-bootstrap-auth,readonly`,
+    `type=bind,src=${broker.declaration},dst=${TRAINING_PAIDEIA_ROOT}/training-broker.json,readonly`
+];

package/dist/compiler/training/container/subjectIsolation.d.ts

@@ -0,0 +1,5 @@
+import { type TrainingContext } from "../contract.js";
+/** Resolve host-side subject policy; the public v1 context carries no sandbox authority. */
+export declare const assertTrainingSubjectIsolation: (config: {
+    subjectIsolation?: "codex-native-sandbox";
+}, context: TrainingContext) => Promise<void>;

package/dist/compiler/training/container/subjectIsolation.js

@@ -0,0 +1,15 @@
+import { resolveDaimonEngine } from "../../../runtime/daimon/config.js";
+import { resolveTrainingContextGraph } from "../context.js";
+import { trainingContextSchema } from "../contract.js";
+/** Resolve host-side subject policy; the public v1 context carries no sandbox authority. */
+export const assertTrainingSubjectIsolation = async (config, context) => {
+    if (config.subjectIsolation !== "codex-native-sandbox")
+        return;
+    const parsed = trainingContextSchema.parse(context);
+    const { selected } = await resolveTrainingContextGraph(parsed.project.manifest, parsed.agent.id);
+    const agent = selected.value;
+    if (agent.runtime.name !== "daimon" || resolveDaimonEngine(agent) !== "codex" ||
+        agent.runtime.options.codex_policy !== "workspace-no-network" || agent.execution?.sandbox?.mode !== "workspace") {
+        throw Error("codex-native-sandbox subject isolation requires the selected training agent to use runtime daimon, engine codex, and strict codex_policy: workspace-no-network (execution.sandbox.mode: workspace)");
+    }
+};

package/dist/compiler/training/context.d.ts

@@ -0,0 +1,15 @@
+import type { CompilePlanNode, ResolvedAgentNode } from "../types.js";
+import { type TrainingContext } from "./contract.js";
+export interface CreateTrainingContextOptions {
+    agent?: string;
+    packageVersion: string;
+}
+/** Internal host-side resolution shared by context capture and subject admission. */
+export declare const resolveTrainingContextGraph: (inputPath: string, selector?: string) => Promise<{
+    plan: import("../types.js").CompilePlan;
+    selected: CompilePlanNode & {
+        value: ResolvedAgentNode;
+    };
+}>;
+/** Resolves the complete project, preserving inherited selection and source provenance. */
+export declare const createTrainingContext: (inputPath: string, options: CreateTrainingContextOptions) => Promise<TrainingContext>;