spawnfile 0.1.14 → 0.1.18

package/dist/compiler/training/preparation/broker.d.ts

@@ -0,0 +1,21 @@
+import type { TrainingPreparationConfig } from "./contract.js";
+export interface PreparedTrainingBroker {
+    declarationPath: string;
+    launch: {
+        engine: "grok";
+        realmVolume: string;
+        bootstrap: string;
+        declaration: string;
+    };
+}
+/**
+ * Lowers `spawnfile.training-container.v4`'s broker block into the read-only
+ * `spawnfile.training-broker.v2` declaration the container's own root
+ * entrypoint reads, plus the launch bindings that carry the realm volume and
+ * bootstrap leaf.
+ *
+ * The bootstrap is checked here as well as at launch: a run that never reaches
+ * `docker create` — a dry run, a failed build — must still refuse the
+ * developer's desktop Grok login rather than report it later.
+ */
+export declare const prepareTrainingBroker: (broker: NonNullable<TrainingPreparationConfig["broker"]>, root: string, staging: string, write: boolean, slots?: number) => Promise<PreparedTrainingBroker>;

package/dist/compiler/training/preparation/broker.js

@@ -0,0 +1,45 @@
+import { lstat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "../../../shared/daimonGrokSeccompProfile.js";
+import { assertNotDesktopGrokAuth } from "../broker/entrypoint.js";
+import { parseTrainingBrokerDeclaration } from "../broker/declaration.js";
+import { TRAINING_BOOTSTRAP_MOUNT } from "../broker/paths.js";
+import { DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+/**
+ * Lowers `spawnfile.training-container.v4`'s broker block into the read-only
+ * `spawnfile.training-broker.v2` declaration the container's own root
+ * entrypoint reads, plus the launch bindings that carry the realm volume and
+ * bootstrap leaf.
+ *
+ * The bootstrap is checked here as well as at launch: a run that never reaches
+ * `docker create` — a dry run, a failed build — must still refuse the
+ * developer's desktop Grok login rather than report it later.
+ */
+export const prepareTrainingBroker = async (broker, root, staging, write, slots = 4) => {
+    const bootstrap = path.resolve(root, broker.bootstrap);
+    assertNotDesktopGrokAuth(bootstrap);
+    const info = await lstat(bootstrap).catch(() => undefined);
+    if (!info?.isFile() || info.isSymbolicLink())
+        throw Error("The training Grok bootstrap must be an existing regular credential leaf");
+    if ((info.mode & 0o077) !== 0)
+        throw Error("The training Grok bootstrap must not be group- or world-accessible");
+    const declaration = parseTrainingBrokerDeclaration({
+        version: "spawnfile.training-broker.v2",
+        slots,
+        maxRunRequests: broker.maxRunRequests,
+        engine: broker.engine,
+        agentId: broker.agentId,
+        model: broker.model,
+        reasoningEffort: broker.reasoningEffort,
+        architecture: broker.architecture,
+        limits: broker.limits,
+        bootstrap: TRAINING_BOOTSTRAP_MOUNT,
+        organizationUid: DAIMON_ORGANIZATION_UID,
+        seccompProfileSha256: DAIMON_GROK_SECCOMP_PROFILE_SHA256,
+        ...(broker.unenforcedBindPolicy === undefined ? {} : { unenforcedBindPolicy: broker.unenforcedBindPolicy })
+    });
+    const declarationPath = path.join(staging, "training-broker.json");
+    if (write)
+        await writeFile(declarationPath, `${JSON.stringify(declaration)}\n`, { mode: 0o444, flag: "wx" });
+    return { declarationPath, launch: { engine: "grok", realmVolume: broker.realmVolume, bootstrap, declaration: declarationPath } };
+};

package/dist/compiler/training/preparation/contextModes.d.ts

@@ -0,0 +1,12 @@
+/** Fixed staged timestamp: deterministic context bytes, and still valid in ZIP-based Python builds. */
+export declare const TRAINING_CONTEXT_MTIME: Date;
+/**
+ * `chmod a+rX` closure: every directory gains 0555; every other entry gains 0444,
+ * plus 0111 when any execute bit is already present. Symlinks are never staged.
+ */
+export declare const readableClosure: (mode: number, directory: boolean) => number;
+/**
+ * Fix staged build-context modes and times so COPY produces exactly the modes the
+ * former in-image `chmod 0555 grok train && chmod -R a+rX /opt/training` produced.
+ */
+export declare function normalizeTrainingContext(staging: string): Promise<void>;

package/dist/compiler/training/preparation/contextModes.js

@@ -0,0 +1,38 @@
+import { chmod, lstat, readdir, utimes } from "node:fs/promises";
+import path from "node:path";
+/** Fixed staged timestamp: deterministic context bytes, and still valid in ZIP-based Python builds. */
+export const TRAINING_CONTEXT_MTIME = new Date("2000-01-01T00:00:00Z");
+/**
+ * Executables the recipe previously forced to 0555 before its recursive closure.
+ * `spawnfile.training-container.v3` stages no Grok binary — judges use the native
+ * parent's pinned `/usr/local/bin/grok` — and adds the root broker entrypoint.
+ */
+const EXACT_MODES = { train: 0o555, "train-broker": 0o555 };
+/**
+ * `chmod a+rX` closure: every directory gains 0555; every other entry gains 0444,
+ * plus 0111 when any execute bit is already present. Symlinks are never staged.
+ */
+export const readableClosure = (mode, directory) => directory ? (mode & 0o7777) | 0o555 : (mode & 0o7777) | 0o444 | ((mode & 0o111) !== 0 ? 0o111 : 0);
+/**
+ * Fix staged build-context modes and times so COPY produces exactly the modes the
+ * former in-image `chmod 0555 grok train && chmod -R a+rX /opt/training` produced.
+ */
+export async function normalizeTrainingContext(staging) {
+    const visit = async (entry, relative) => {
+        const stat = await lstat(entry);
+        if (stat.isSymbolicLink())
+            throw Error("Training build context must not contain symlinks");
+        if (stat.isDirectory()) {
+            for (const name of (await readdir(entry)).sort())
+                await visit(path.join(entry, name), path.posix.join(relative, name));
+            if (relative)
+                await chmod(entry, readableClosure(stat.mode, true));
+        }
+        else {
+            await chmod(entry, EXACT_MODES[relative] ?? readableClosure(stat.mode, false));
+        }
+        if (relative)
+            await utimes(entry, TRAINING_CONTEXT_MTIME, TRAINING_CONTEXT_MTIME);
+    };
+    await visit(staging, "");
+}

package/dist/compiler/training/preparation/contract.d.ts

@@ -0,0 +1,207 @@
+import { z } from "zod";
+export declare const trainingBuildSchema: z.ZodObject<{
+    recipe: z.ZodLiteral<"daimon-dspy.v1">;
+    nativeImage: z.ZodString;
+    pythonImage: z.ZodString;
+    platform: z.ZodEnum<{
+        "linux/amd64": "linux/amd64";
+        "linux/arm64": "linux/arm64";
+    }>;
+    paideia: z.ZodString;
+    bridge: z.ZodString;
+    claude: z.ZodString;
+    compiler: z.ZodOptional<z.ZodString>;
+    grok: z.ZodOptional<z.ZodObject<{
+        source: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    integration: z.ZodObject<{
+        source: z.ZodString;
+        entry: z.ZodString;
+        execution: z.ZodOptional<z.ZodLiteral<"spawnfile.training-execution.v1">>;
+    }, z.core.$strict>;
+    bootstrap: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * `spawnfile.training-container.v3`'s brokered Grok slot.
+ *
+ * It is the whole difference from v2: the container starts as root with the
+ * production capability set, runs one broker slot for the subject, holds the
+ * dedicated training Grok login in a named realm volume seeded from
+ * `bootstrap`, and serves judge inference grants out of the same credential.
+ * No Grok binary and no Grok auth staging enter the image.
+ */
+export declare const trainingBrokerSchema: z.ZodObject<{
+    maxRunRequests: z.ZodDefault<z.ZodNumber>;
+    engine: z.ZodLiteral<"grok">;
+    agentId: z.ZodString;
+    model: z.ZodEnum<{
+        "grok-4.6": "grok-4.6";
+        "grok-4.5": "grok-4.5";
+        "grok-build": "grok-build";
+    }>;
+    reasoningEffort: z.ZodEnum<{
+        high: "high";
+        medium: "medium";
+        low: "low";
+    }>;
+    architecture: z.ZodEnum<{
+        arm64: "arm64";
+        x64: "x64";
+    }>;
+    limits: z.ZodObject<{
+        maxRequests: z.ZodNumber;
+        maxTokens: z.ZodNumber;
+        timeoutMs: z.ZodNumber;
+    }, z.core.$strict>;
+    realmVolume: z.ZodString;
+    bootstrap: z.ZodString;
+    unenforcedBindPolicy: z.ZodOptional<z.ZodEnum<{
+        refuse: "refuse";
+        "profile-only": "profile-only";
+    }>>;
+}, z.core.$strict>;
+export declare const trainingPreparationSchema: z.ZodObject<{
+    version: z.ZodEnum<{
+        "spawnfile.training-container.v3": "spawnfile.training-container.v3";
+        "spawnfile.training-container.v4": "spawnfile.training-container.v4";
+        "spawnfile.training-container.v2": "spawnfile.training-container.v2";
+    }>;
+    slots: z.ZodDefault<z.ZodNumber>;
+    dockerContext: z.ZodString;
+    image: z.ZodUnion<readonly [z.ZodObject<{
+        ref: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        build: z.ZodObject<{
+            recipe: z.ZodLiteral<"daimon-dspy.v1">;
+            nativeImage: z.ZodString;
+            pythonImage: z.ZodString;
+            platform: z.ZodEnum<{
+                "linux/amd64": "linux/amd64";
+                "linux/arm64": "linux/arm64";
+            }>;
+            paideia: z.ZodString;
+            bridge: z.ZodString;
+            claude: z.ZodString;
+            compiler: z.ZodOptional<z.ZodString>;
+            grok: z.ZodOptional<z.ZodObject<{
+                source: z.ZodString;
+                sha256: z.ZodString;
+            }, z.core.$strict>>;
+            integration: z.ZodObject<{
+                source: z.ZodString;
+                entry: z.ZodString;
+                execution: z.ZodOptional<z.ZodLiteral<"spawnfile.training-execution.v1">>;
+            }, z.core.$strict>;
+            bootstrap: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>;
+    integration: z.ZodObject<{
+        settings: z.ZodObject<{
+            input: z.ZodString;
+            path: z.ZodUnion<readonly [z.ZodLiteral<".">, z.ZodString]>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    inputs: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        source: z.ZodString;
+        destination: z.ZodString;
+        include: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        git: z.ZodOptional<z.ZodObject<{
+            revision: z.ZodString;
+            overlays: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                source: z.ZodString;
+                path: z.ZodString;
+                sha256: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    output: z.ZodObject<{
+        source: z.ZodString;
+        destination: z.ZodLiteral<"/run/training/output">;
+    }, z.core.$strict>;
+    auth: z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        provider: z.ZodEnum<{
+            codex: "codex";
+            claude: "claude";
+        }>;
+    }, z.core.$strict>>;
+    evaluatorRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        purpose: z.ZodEnum<{
+            decisions: "decisions";
+            extraction: "extraction";
+            proposals: "proposals";
+        }>;
+        provider: z.ZodEnum<{
+            "codex-subscription": "codex-subscription";
+            typesafe: "typesafe";
+        }>;
+        model: z.ZodString;
+        maxRequests: z.ZodNumber;
+        maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    evaluatorSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        provider: z.ZodLiteral<"typesafe">;
+        source: z.ZodString;
+    }, z.core.$strict>>>;
+    subjectIsolation: z.ZodOptional<z.ZodLiteral<"codex-native-sandbox">>;
+    broker: z.ZodOptional<z.ZodObject<{
+        maxRunRequests: z.ZodDefault<z.ZodNumber>;
+        engine: z.ZodLiteral<"grok">;
+        agentId: z.ZodString;
+        model: z.ZodEnum<{
+            "grok-4.6": "grok-4.6";
+            "grok-4.5": "grok-4.5";
+            "grok-build": "grok-build";
+        }>;
+        reasoningEffort: z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>;
+        architecture: z.ZodEnum<{
+            arm64: "arm64";
+            x64: "x64";
+        }>;
+        limits: z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            maxTokens: z.ZodNumber;
+            timeoutMs: z.ZodNumber;
+        }, z.core.$strict>;
+        realmVolume: z.ZodString;
+        bootstrap: z.ZodString;
+        unenforcedBindPolicy: z.ZodOptional<z.ZodEnum<{
+            refuse: "refuse";
+            "profile-only": "profile-only";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type TrainingPreparationConfig = z.infer<typeof trainingPreparationSchema>;
+export type TrainingImageBuild = z.infer<typeof trainingBuildSchema>;
+/** Image integration reads this protected, container-addressed receipt, never host paths. */
+export interface TrainingMappedPreparation {
+    version: "spawnfile.training-preparation.v1";
+    preparationDigest: string;
+    imageId: string;
+    bindings: {
+        inputId: string;
+        destination: string;
+    }[];
+    outputRoot: "/run/training/output";
+    packagePaths: {
+        spawnfile: string;
+        paideia: string;
+        bridge: string;
+        nativeWorker: string;
+        integration: string;
+        bootstrap: string;
+    };
+    integration: {
+        settings: {
+            input: string;
+            path: string;
+        };
+    };
+}
+export declare const parseTrainingMappedPreparation: (value: unknown) => TrainingMappedPreparation;

package/dist/compiler/training/preparation/contract.js

@@ -0,0 +1,113 @@
+import path from "node:path";
+import { z } from "zod";
+import { trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema } from "../container/evaluators.js";
+import { trainingImageSchema } from "../container/contract.js";
+import { TRAINING_EXECUTION_VERSION } from "../contract.js";
+import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+const local = z.string().min(1).refine(value => !/[,\r\n\0]/u.test(value));
+const relative = local.refine(value => !path.isAbsolute(value) && !value.includes("\\") && value.split("/").every(part => part !== "" && part !== "." && part !== ".." && part !== ".git"));
+const reference = z.object({ input: z.string().min(1), path: z.union([z.literal("."), relative]) }).strict();
+const sha = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const destination = z.string().regex(/^\/run\/training\/inputs\/[A-Za-z0-9._/-]+$/u).refine(value => path.posix.normalize(value) === value && !value.endsWith("/"));
+export const trainingBuildSchema = z.object({
+    recipe: z.literal("daimon-dspy.v1"), nativeImage: trainingImageSchema, pythonImage: trainingImageSchema,
+    platform: z.enum(["linux/arm64", "linux/amd64"]),
+    paideia: local, bridge: local, claude: local, compiler: local.optional(),
+    /**
+     * Deprecated with `spawnfile.training-container.v3`: the image no longer
+     * copies a Grok binary at all. Judges run the native parent's pinned
+     * `/usr/local/bin/grok` through a broker inference grant, so a second copy
+     * could only ever be a different, unattested build.
+     */
+    grok: z.object({ source: local, sha256: sha }).strict().optional(),
+    integration: z.object({ source: local, entry: relative.refine(value => /^[A-Za-z0-9._/-]+$/u.test(value)),
+        execution: z.literal(TRAINING_EXECUTION_VERSION).optional() }).strict(), bootstrap: local.optional()
+}).strict();
+const bounds = DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds;
+/**
+ * `spawnfile.training-container.v3`'s brokered Grok slot.
+ *
+ * It is the whole difference from v2: the container starts as root with the
+ * production capability set, runs one broker slot for the subject, holds the
+ * dedicated training Grok login in a named realm volume seeded from
+ * `bootstrap`, and serves judge inference grants out of the same credential.
+ * No Grok binary and no Grok auth staging enter the image.
+ */
+export const trainingBrokerSchema = z.object({
+    maxRunRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(1000),
+    engine: z.literal("grok"),
+    agentId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u),
+    model: z.enum(DAIMON_GROK_BROKER_MODELS),
+    reasoningEffort: z.enum(DAIMON_GROK_BROKER_REASONING_EFFORTS),
+    architecture: z.enum(["arm64", "x64"]),
+    limits: z.object({
+        maxRequests: z.number().int().min(bounds.maxRequests[0]).max(bounds.maxRequests[1]),
+        maxTokens: z.number().int().min(bounds.maxTokens[0]).max(bounds.maxTokens[1]),
+        timeoutMs: z.number().int().min(bounds.timeoutMs[0]).max(bounds.timeoutMs[1])
+    }).strict(),
+    /** Named Docker volume for the rotating training credential and its journal; never a host bind. */
+    realmVolume: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
+    /** The dedicated training Grok login leaf, relative to the declaration. Never the desktop `~/.grok/auth.json`. */
+    bootstrap: local,
+    unenforcedBindPolicy: z.enum(["refuse", "profile-only"]).optional()
+}).strict();
+export const trainingPreparationSchema = z.object({
+    version: z.enum(["spawnfile.training-container.v2", "spawnfile.training-container.v3", "spawnfile.training-container.v4"]),
+    slots: z.number().int().min(1).max(8).default(4),
+    dockerContext: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
+    image: z.union([z.object({ ref: trainingImageSchema }).strict(), z.object({ build: trainingBuildSchema }).strict()]),
+    integration: z.object({ settings: reference }).strict(),
+    inputs: z.array(z.object({
+        id: z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/u), source: local, destination,
+        include: z.array(relative).min(1).max(256).optional(),
+        git: z.object({ revision: z.string().regex(/^[a-f0-9]{40}$/u),
+            overlays: z.array(z.object({ source: local, path: relative, sha256: sha }).strict()).max(256).default([])
+        }).strict().optional()
+    }).strict()).min(1).max(64),
+    output: z.object({ source: local, destination: z.literal("/run/training/output") }).strict(),
+    auth: z.array(z.object({ source: local, provider: z.enum(["codex", "claude"]) }).strict()).max(2),
+    evaluatorRoutes: trainingEvaluatorRoutesSchema.optional(),
+    evaluatorSecrets: trainingEvaluatorSecretsSchema(local).optional(),
+    subjectIsolation: z.literal("codex-native-sandbox").optional(),
+    broker: trainingBrokerSchema.optional()
+}).strict().superRefine((value, context) => {
+    if (value.evaluatorSecrets && !value.broker && !value.subjectIsolation)
+        context.addIssue({ code: "custom", message: "Evaluator secrets require brokered v4 isolation or explicit codex-native-sandbox subject isolation" });
+    if (value.subjectIsolation && value.version !== "spawnfile.training-container.v2")
+        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a non-brokered v2 preparation" });
+    if (value.subjectIsolation && !value.evaluatorRoutes?.some(route => route.provider === "typesafe"))
+        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a TypeSafe evaluator route" });
+    if (value.evaluatorSecrets && !value.evaluatorRoutes?.some(route => route.provider === "typesafe")) {
+        context.addIssue({ code: "custom", message: "TypeSafe secret requires a declared evaluator route" });
+    }
+    if (value.version === "spawnfile.training-container.v3")
+        context.addIssue({ code: "custom", message: "Training-container v3 is unsupported; migrate to v4 with slots: 1" });
+    if ((value.version === "spawnfile.training-container.v4") !== (value.broker !== undefined)) {
+        context.addIssue({ code: "custom", message: "Only spawnfile.training-container.v4 declares broker slots; migrate v3 by setting version to v4 and slots to 1" });
+    }
+    if (value.broker && "build" in value.image && value.image.build.grok) {
+        context.addIssue({ code: "custom", message: "A v3 training image never copies a Grok binary; judges use the native parent's pinned /usr/local/bin/grok" });
+    }
+    if (new Set(value.inputs.map(input => input.id)).size !== value.inputs.length)
+        context.addIssue({ code: "custom", message: "Input IDs must be unique" });
+    if (new Set(value.auth.map(auth => auth.provider)).size !== value.auth.length)
+        context.addIssue({ code: "custom", message: "Auth providers must be unique" });
+    if (!value.inputs.some(input => input.id === value.integration.settings.input))
+        context.addIssue({ code: "custom", message: "Integration settings require a declared input" });
+    if (value.inputs.some(input => input.git && input.include))
+        context.addIssue({ code: "custom", message: "Git snapshots and selective local inputs are separate modes" });
+});
+const containerPath = z.string().regex(/^\/(?:run|opt)\/[A-Za-z0-9._/-]+$/u).refine(value => path.posix.normalize(value) === value);
+const mappedSchema = z.object({
+    version: z.literal("spawnfile.training-preparation.v1"), preparationDigest: sha, imageId: trainingImageSchema,
+    bindings: z.array(z.object({ inputId: z.string().min(1), destination }).strict()).min(1).max(64),
+    outputRoot: z.literal("/run/training/output"),
+    packagePaths: z.object({ spawnfile: containerPath, paideia: containerPath, bridge: containerPath,
+        nativeWorker: containerPath, integration: containerPath, bootstrap: containerPath }).strict(),
+    integration: z.object({ settings: reference }).strict()
+}).strict().superRefine((value, context) => {
+    if (new Set(value.bindings.map(binding => binding.inputId)).size !== value.bindings.length ||
+        !value.bindings.some(binding => binding.inputId === value.integration.settings.input))
+        context.addIssue({ code: "custom", message: "Invalid preparation binding IDs" });
+});
+export const parseTrainingMappedPreparation = (value) => mappedSchema.parse(value);

package/dist/compiler/training/preparation/copyAssets.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/compiler/training/preparation/copyAssets.js

@@ -0,0 +1,8 @@
+import { cp, mkdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const root = fileURLToPath(new URL("../../../../", import.meta.url));
+const target = path.join(root, "dist/compiler/training/preparation/assets");
+await mkdir(target, { recursive: true });
+await cp(path.join(root, "runtime-images/training/Dockerfile"), path.join(target, "Dockerfile"));
+await cp(path.join(root, "package-lock.json"), path.join(target, "package-lock.json"));

package/dist/compiler/training/preparation/daimonParent.d.ts

@@ -0,0 +1,42 @@
+import { type LocalDaimonRuntimeIdentity } from "../../../runtime/index.js";
+import type { TrainingImageBuild } from "./contract.js";
+/**
+ * The declared native parent (`image.build.nativeImage`) and the attested local
+ * Daimon runtime identity (`SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY`) are two
+ * independent pointers at one composed run, and they are never the same digest:
+ * `runtime-images/daimon/Dockerfile` ends in `FROM scratch`, so the identity can
+ * only ever attest a *scratch* image that a runnable native parent copies
+ * `/opt/spawnfile/runtime-installs/daimon` out of. Nothing host-side can compare
+ * the two digests, so the binding is by content: the capability receipt and
+ * contract-manifest digest the identity attests must be the ones actually baked
+ * into the declared parent. `src/runtime/container.ts` verifies exactly this for
+ * a compiled organization image; this is the same check for a training image.
+ */
+export declare const DAIMON_RUNTIME_INSTALL_ROOT = "/opt/spawnfile/runtime-installs/daimon";
+export interface TrainingDaimonParent {
+    declarationPath: string;
+    identity: LocalDaimonRuntimeIdentity;
+    identityPath: string;
+    nativeImage: string;
+}
+/**
+ * Resolves the identity that must match the declared native parent. Runs before
+ * any Docker call, so an absent, stale-pinned or architecture-drifted identity
+ * refuses the run — including `--dry-run` — before a container or a token is spent.
+ */
+export declare const resolveTrainingDaimonParent: (build: TrainingImageBuild, declarationPath: string, env?: NodeJS.ProcessEnv) => Promise<TrainingDaimonParent | undefined>;
+/**
+ * One `sh` command, executed as the first instruction of the `${NATIVE_IMAGE}`
+ * stage, that refuses the build when the declared parent does not carry the exact
+ * Daimon install the identity attests. This is the only place both values exist
+ * in one process: the receipt lives inside the image, so no host-side read can
+ * reach it without starting something.
+ */
+export declare const daimonParentVerificationScript: (parent: TrainingDaimonParent) => string;
+/**
+ * Injects the verification as the first instruction of the native stage, so a
+ * mismatched pair fails in seconds instead of after the whole distribution copy.
+ * The recipe text is part of the image plan digest, so the identity is bound into
+ * the training image's identity too — a rotated identity can never be cached over.
+ */
+export declare const bindDaimonParentVerification: (dockerfile: string, parent: TrainingDaimonParent) => string;

package/dist/compiler/training/preparation/daimonParent.js

@@ -0,0 +1,114 @@
+import { SpawnfileError } from "../../../shared/index.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "../../../runtime/index.js";
+/**
+ * The declared native parent (`image.build.nativeImage`) and the attested local
+ * Daimon runtime identity (`SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY`) are two
+ * independent pointers at one composed run, and they are never the same digest:
+ * `runtime-images/daimon/Dockerfile` ends in `FROM scratch`, so the identity can
+ * only ever attest a *scratch* image that a runnable native parent copies
+ * `/opt/spawnfile/runtime-installs/daimon` out of. Nothing host-side can compare
+ * the two digests, so the binding is by content: the capability receipt and
+ * contract-manifest digest the identity attests must be the ones actually baked
+ * into the declared parent. `src/runtime/container.ts` verifies exactly this for
+ * a compiled organization image; this is the same check for a training image.
+ */
+export const DAIMON_RUNTIME_INSTALL_ROOT = "/opt/spawnfile/runtime-installs/daimon";
+/** A native parent served by the attested loopback development registry is always a local build. */
+const LOOPBACK_NATIVE_PARENT = /^127\.0\.0\.1:(?:[1-9]\d{0,4})\//u;
+const FROM_NATIVE_IMAGE = /^FROM \$\{NATIVE_IMAGE\}.*$/mu;
+/** Everything embedded in the single-quoted shell literals below must be inert. */
+const SHELL_SAFE = /^[A-Za-z0-9 ._:@/=+,()~-]+$/u;
+const refuse = (lines) => {
+    throw new SpawnfileError("validation_error", lines.join("\n"));
+};
+const safe = (label, value) => {
+    if (!SHELL_SAFE.test(value)) {
+        refuse([
+            `Training cannot bind its native parent to a local Daimon runtime identity: ${label} contains characters that cannot be embedded in the image recipe.`,
+            `  ${label} = ${JSON.stringify(value)}`
+        ]);
+    }
+    return value;
+};
+/**
+ * Resolves the identity that must match the declared native parent. Runs before
+ * any Docker call, so an absent, stale-pinned or architecture-drifted identity
+ * refuses the run — including `--dry-run` — before a container or a token is spent.
+ */
+export const resolveTrainingDaimonParent = async (build, declarationPath, env = process.env) => {
+    const identityPath = env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    if (!identityPath) {
+        if (LOOPBACK_NATIVE_PARENT.test(build.nativeImage)) {
+            refuse([
+                "Training refuses a locally built native parent with no attested Daimon runtime identity.",
+                `  ${declarationPath}  image.build.nativeImage = ${build.nativeImage}`,
+                `  ${DAIMON_LOCAL_RUNTIME_IDENTITY_ENV} = (unset)`,
+                `Point ${DAIMON_LOCAL_RUNTIME_IDENTITY_ENV} at the runtime identity written by the same rebuild that baked ${DAIMON_RUNTIME_INSTALL_ROOT} into that image.`
+            ]);
+        }
+        return undefined;
+    }
+    // Keeps the existing contract-pin refusal: this is the first time a training
+    // run applies it at all, and it stays exactly as strict as it already was.
+    const identity = await loadLocalDaimonRuntimeIdentity(identityPath);
+    const expected = build.platform === "linux/amd64" ? "amd64" : "arm64";
+    if (identity.imageArchitecture !== expected) {
+        refuse([
+            "Training native parent and local Daimon runtime identity disagree on architecture.",
+            `  ${declarationPath}  image.build.platform = ${build.platform}`,
+            `  ${identityPath}  image_architecture = ${identity.imageArchitecture}`,
+            "Rebuild both from one architecture, or repoint both at one rebuild."
+        ]);
+    }
+    return {
+        declarationPath: safe("the training declaration path", declarationPath),
+        identity,
+        identityPath: safe(DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, identityPath),
+        nativeImage: safe("image.build.nativeImage", build.nativeImage)
+    };
+};
+/**
+ * One `sh` command, executed as the first instruction of the `${NATIVE_IMAGE}`
+ * stage, that refuses the build when the declared parent does not carry the exact
+ * Daimon install the identity attests. This is the only place both values exist
+ * in one process: the receipt lives inside the image, so no host-side read can
+ * reach it without starting something.
+ */
+export const daimonParentVerificationScript = (parent) => {
+    const receipt = `${DAIMON_RUNTIME_INSTALL_ROOT}/capability-receipt.json`;
+    const manifest = `${DAIMON_RUNTIME_INSTALL_ROOT}/contract-manifest.sha256`;
+    const report = [
+        `printf '%s\\n'`,
+        `'REFUSED: the declared training native parent does not carry the Daimon install its runtime identity attests.'`,
+        `"  ${parent.declarationPath}  image.build.nativeImage = ${parent.nativeImage}"`,
+        `"  ${parent.identityPath}  capability_receipt_sha256 = ${parent.identity.capabilityReceipt}"`,
+        `"  ${parent.identityPath}  manifest_sha256 = ${parent.identity.manifestSha256}"`,
+        `"  native parent ${receipt} = $found_receipt"`,
+        `"  native parent ${manifest} = $found_manifest"`,
+        `'Repoint image.build.nativeImage and ${DAIMON_LOCAL_RUNTIME_IDENTITY_ENV} at the same rebuild.'`,
+        `>&2`
+    ].join(" ");
+    return [
+        "set -u",
+        `test -f '${receipt}' || { echo "REFUSED: ${parent.nativeImage} has no ${receipt}; it is not a Daimon native parent." >&2; exit 1; }`,
+        `test -f '${manifest}' || { echo "REFUSED: ${parent.nativeImage} has no ${manifest}; it is not a Daimon native parent." >&2; exit 1; }`,
+        `found_receipt="sha256:$(sha256sum '${receipt}' | cut -d' ' -f1)"`,
+        `found_manifest="$(cat '${manifest}')"`,
+        `if [ "$found_receipt" != '${parent.identity.capabilityReceipt}' ] || [ "$found_manifest" != '${parent.identity.manifestSha256}' ]; then ${report}; exit 1; fi`
+    ].join("; ");
+};
+/**
+ * Injects the verification as the first instruction of the native stage, so a
+ * mismatched pair fails in seconds instead of after the whole distribution copy.
+ * The recipe text is part of the image plan digest, so the identity is bound into
+ * the training image's identity too — a rotated identity can never be cached over.
+ */
+export const bindDaimonParentVerification = (dockerfile, parent) => {
+    if (!FROM_NATIVE_IMAGE.test(dockerfile)) {
+        refuse([
+            "Training recipe declares no ${NATIVE_IMAGE} stage, so its native parent cannot be bound to the Daimon runtime identity.",
+            `  ${parent.identityPath}  image_reference = ${parent.identity.imageReference}`
+        ]);
+    }
+    return dockerfile.replace(FROM_NATIVE_IMAGE, (line) => `${line}\nRUN ${daimonParentVerificationScript(parent)}`);
+};

package/dist/compiler/training/preparation/files.d.ts

@@ -0,0 +1,29 @@
+export declare const within: (root: string, file: string) => boolean;
+export declare const hashJson: (value: unknown) => string;
+export interface SealedFile {
+    source: string;
+    destination: string;
+    sha256: string;
+    mode: number;
+    size: number;
+    target?: string;
+    directory?: true;
+}
+export declare function assertInputRoot(source: string, auth: readonly string[]): void;
+export declare function exactPath(source: string): Promise<string>;
+export declare function sealFile(source: string, destination: string): Promise<SealedFile>;
+/** Only physical entries are walked; confined input links retain their own identity. */
+export declare function sealTree(source: string, destination: string, options?: {
+    ignoreDevelopment?: boolean;
+    ignoreGit?: boolean;
+    internalSymlinks?: boolean;
+}): Promise<SealedFile[]>;
+export declare function copySealed(files: readonly SealedFile[], root: string): Promise<void>;
+export declare const fileIdentity: (files: readonly SealedFile[]) => {
+    type?: "directory" | "symlink" | undefined;
+    target?: string | undefined;
+    destination: string;
+    sha256: string;
+    mode: number;
+    size: number;
+}[];