spawnfile 0.1.14 → 0.1.18

package/dist/runtime/common.d.ts

@@ -37,7 +37,34 @@ export declare const ensureNoopolisRunId: (env?: NodeJS.ProcessEnv) => string;
 export declare const createCapability: (key: string, outcome: CapabilityReport["outcome"], message?: string) => CapabilityReport;
 export declare const createDiagnostic: (level: DiagnosticReport["level"], message: string) => DiagnosticReport;
 export declare const createDocumentFiles: (baseDirectory: string, documents: ResolvedDocument[]) => EmittedFile[];
-export declare const createSkillFiles: (baseDirectory: string, skills: ResolvedSkill[]) => EmittedFile[];
+/**
+ * Skill roots for the runtimes whose declared skills are read by an external
+ * coding-agent CLI engine (`daimon` and `pi`). `.codex/skills` is Codex's own
+ * workspace discovery root; `.agents/skills` is the generic cross-engine root
+ * that grok, agy, and every other file-reading CLI engine use. Both entries
+ * are required and the two emitted files are byte-identical on purpose — this
+ * mirrors the Moltnet skill install, which is the working reference: Spawnfile
+ * runs `moltnet skill install --runtime codex` for these runtimes and Moltnet
+ * writes the same skill to both roots (`resolveMoltnetWorkspaceLayout` in
+ * `src/compiler/moltnetClientConfig.ts`, `installMoltnetSkill` in
+ * `moltnet/cmd/moltnet/skill.go`). A plain `workspace/skills/` root is read by
+ * no engine these two runtimes can host, so anything emitted there is invisible.
+ */
+export declare const CLI_ENGINE_SKILL_BASE_DIRECTORIES: readonly string[];
+/**
+ * Skill root for the runtimes that own their own skill loader and read the
+ * workspace `skills/` directory directly (`openclaw`, `picoclaw`). Moltnet
+ * installs its skill to the same place for those runtimes.
+ */
+export declare const WORKSPACE_SKILL_BASE_DIRECTORY = "workspace/skills";
+/**
+ * Lowers declared skills into emitted `SKILL.md` files. `baseDirectory`
+ * accepts a list because a runtime can need the same skill under more than
+ * one discovery root (see `CLI_ENGINE_SKILL_BASE_DIRECTORIES`); the emission
+ * order is root-major so a generated workspace lists each root's skills
+ * together and stays deterministic.
+ */
+export declare const createSkillFiles: (baseDirectory: string | readonly string[], skills: ResolvedSkill[]) => EmittedFile[];
 export declare const createAgentCapabilities: (node: ResolvedAgentNode, options?: {
     mcpOutcome?: CapabilityReport["outcome"];
     memoryMessage?: string;

package/dist/runtime/common.js

@@ -62,10 +62,40 @@ export const createDocumentFiles = (baseDirectory, documents) => documents.map((
         ? `${baseDirectory}/${ROLE_FILE_NAMES[document.role]}`
         : `${baseDirectory}/extras/${document.role.replace(/^extras\./, "")}.md`
 }));
-export const createSkillFiles = (baseDirectory, skills) => skills.map((skill) => ({
+/**
+ * Skill roots for the runtimes whose declared skills are read by an external
+ * coding-agent CLI engine (`daimon` and `pi`). `.codex/skills` is Codex's own
+ * workspace discovery root; `.agents/skills` is the generic cross-engine root
+ * that grok, agy, and every other file-reading CLI engine use. Both entries
+ * are required and the two emitted files are byte-identical on purpose — this
+ * mirrors the Moltnet skill install, which is the working reference: Spawnfile
+ * runs `moltnet skill install --runtime codex` for these runtimes and Moltnet
+ * writes the same skill to both roots (`resolveMoltnetWorkspaceLayout` in
+ * `src/compiler/moltnetClientConfig.ts`, `installMoltnetSkill` in
+ * `moltnet/cmd/moltnet/skill.go`). A plain `workspace/skills/` root is read by
+ * no engine these two runtimes can host, so anything emitted there is invisible.
+ */
+export const CLI_ENGINE_SKILL_BASE_DIRECTORIES = [
+    "workspace/.agents/skills",
+    "workspace/.codex/skills"
+];
+/**
+ * Skill root for the runtimes that own their own skill loader and read the
+ * workspace `skills/` directory directly (`openclaw`, `picoclaw`). Moltnet
+ * installs its skill to the same place for those runtimes.
+ */
+export const WORKSPACE_SKILL_BASE_DIRECTORY = "workspace/skills";
+/**
+ * Lowers declared skills into emitted `SKILL.md` files. `baseDirectory`
+ * accepts a list because a runtime can need the same skill under more than
+ * one discovery root (see `CLI_ENGINE_SKILL_BASE_DIRECTORIES`); the emission
+ * order is root-major so a generated workspace lists each root's skills
+ * together and stays deterministic.
+ */
+export const createSkillFiles = (baseDirectory, skills) => (typeof baseDirectory === "string" ? [baseDirectory] : baseDirectory).flatMap((directory) => skills.map((skill) => ({
     content: skill.content,
-    path: `${baseDirectory}/${skill.name}/SKILL.md`
-}));
+    path: `${directory}/${skill.name}/SKILL.md`
+})));
 export const createAgentCapabilities = (node, options = {}) => {
     const capabilities = [];
     for (const document of node.docs) {

package/dist/runtime/container.js

@@ -1,15 +1,19 @@
+import { createDaimonInstallCommands } from "./daimonInstall.js";
 import { SpawnfileError } from "../shared/index.js";
 import { NOOPOLIS_RUN_ID_ENV, resolveNoopolisRunId } from "./common.js";
 import { createVendorCopyCommand, needsVendorCopyCommand, resolveInstallPackageSpec } from "./containerPackageOverrides.js";
 import { resolveRuntimeInstallSelection } from "./install.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "./localDaimonAuthority.js";
+import { DAIMON_CONTRACT_MANIFEST_SHA256 } from "./daimon/contractManifest.js";
+import { DAIMON_WAKE_FUSE_DIRECTORY, DAIMON_WAKE_FUSE_DIRECTORY_ENV } from "./daimon/config.js";
 export const RUNTIME_INSTALL_ROOT = "/opt/spawnfile/runtime-installs";
 const PI_RUNTIME_BASE_IMAGE_ENV = "SPAWNFILE_PI_RUNTIME_BASE_IMAGE";
-const DAIMON_RUNTIME_IMAGE_ENV = "SPAWNFILE_DAIMON_RUNTIME_IMAGE";
-const DAIMON_RUNTIME_BASE_IMAGE_ENV = "SPAWNFILE_DAIMON_RUNTIME_BASE_IMAGE";
+const LEGACY_DAIMON_RUNTIME_IMAGE_ENV = "SPAWNFILE_DAIMON_RUNTIME_IMAGE";
+const LEGACY_DAIMON_RUNTIME_CAPABILITY_RECEIPT_ENV = "SPAWNFILE_DAIMON_RUNTIME_CAPABILITY_RECEIPT";
 const OPENCLAW_RUNTIME_IMAGE_ENV = "SPAWNFILE_OPENCLAW_RUNTIME_IMAGE";
 const PICOCLAW_RUNTIME_IMAGE_ENV = "SPAWNFILE_PICOCLAW_RUNTIME_IMAGE";
 const DAIMON_PACKAGE_NAME = "@noopolis/daimon";
-const DAIMON_PACKAGE_VERSION = "0.1.2";
+const PI_DAIMON_PACKAGE_VERSION = "0.1.2";
 const MNEME_PACKAGE_NAME = "@noopolis/mneme";
 const MNEME_PACKAGE_VERSION = "0.1.1";
 const PI_AI_PACKAGE_NAME = "@earendil-works/pi-ai";
@@ -40,6 +44,37 @@ const resolveRuntimeImageRef = (envName, selection) => process.env[envName]?.tri
     (selection.kind === "container_image"
         ? `${selection.image}:${selection.tag}`
         : undefined);
+/**
+ * Daimon is distributed only as a generic, source-free runtime image. A
+ * local-development authority is deliberately narrow: it must be an explicit
+ * generated identity file naming the approved loopback registry repository by
+ * manifest digest plus the exact embedded receipt digest. Raw image/receipt
+ * overrides, mutable tags, checkouts, and host-installed CLIs are rejected.
+ */
+const resolveDaimonRuntimeImageRef = async (selection) => {
+    if (selection.kind !== "container_image" ||
+        !selection.digest ||
+        !(selection.capabilityReceipt || selection.capabilityReceipts)) {
+        throw new SpawnfileError("runtime_error", "Daimon organization runtime v1 requires a pinned generic Daimon runtime image");
+    }
+    const pinnedImage = `${selection.image}@${selection.digest}`;
+    if (process.env[LEGACY_DAIMON_RUNTIME_IMAGE_ENV]?.trim() ||
+        process.env[LEGACY_DAIMON_RUNTIME_CAPABILITY_RECEIPT_ENV]?.trim()) {
+        throw new SpawnfileError("runtime_error", `Raw Daimon runtime image overrides are disabled; use ${DAIMON_LOCAL_RUNTIME_IDENTITY_ENV}`);
+    }
+    const identityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    if (identityPath) {
+        const identity = await loadLocalDaimonRuntimeIdentity(identityPath);
+        return { capabilityReceipt: identity.capabilityReceipt, image: identity.imageReference };
+    }
+    if (selection.contractManifestSha256 !== DAIMON_CONTRACT_MANIFEST_SHA256) {
+        throw new SpawnfileError("runtime_error", "Selected Daimon runtime image does not attest the compiler's exact contract manifest; build and select a matching local artifact or pin a published compatible release");
+    }
+    return {
+        capabilityReceipt: selection.capabilityReceipts ?? selection.capabilityReceipt,
+        image: pinnedImage
+    };
+};
 export const createRuntimeInstallRecipe = async (runtimeName, options = {}) => {
     const selection = await resolveRuntimeInstallSelection(runtimeName);
     assertArtifactInstallSelection(runtimeName, selection);
@@ -96,38 +131,14 @@ export const createRuntimeInstallRecipe = async (runtimeName, options = {}) => {
             };
         }
         case "daimon": {
-            const daimonRuntimeImage = process.env[DAIMON_RUNTIME_IMAGE_ENV]?.trim() ||
-                process.env[DAIMON_RUNTIME_BASE_IMAGE_ENV]?.trim() ||
-                (selection.kind === "container_image"
-                    ? `${selection.image}:${selection.tag}`
-                    : undefined);
-            if (daimonRuntimeImage) {
-                return {
-                    commands: [],
-                    copyCommands: [createRuntimeImageCopyCommand(daimonRuntimeImage, installRoot)],
-                    env: containerEnv,
-                    runtimeName,
-                    runtimeRoot: installRoot
-                };
-            }
-            if (selection.kind !== "npm") {
-                throw new SpawnfileError("runtime_error", `Runtime ${runtimeName} has no compiled artifact recipe for ${selection.kind}`);
-            }
-            const npmPackages = [
-                resolveInstallPackageSpec(selection.packageName, selection.version, packageOverrides),
-                resolveInstallPackageSpec(MNEME_PACKAGE_NAME, MNEME_PACKAGE_VERSION, packageOverrides),
-                `${PI_CODING_AGENT_PACKAGE_NAME}@${PI_PACKAGE_VERSION}`,
-                `${PI_AI_PACKAGE_NAME}@${PI_PACKAGE_VERSION}`
-            ];
+            const daimonRuntime = await resolveDaimonRuntimeImageRef(selection);
             return {
-                commands: [
-                    `mkdir -p ${installRoot}`,
-                    `cd ${installRoot} && npm install --omit=dev --no-fund --no-audit ${npmPackages.join(" ")}`
-                ],
-                copyCommands: needsVendorCopyCommand([selection.packageName, MNEME_PACKAGE_NAME], packageOverrides)
-                    ? [createVendorCopyCommand()]
-                    : [],
-                env: containerEnv,
+                commands: createDaimonInstallCommands(installRoot, daimonRuntime.capabilityReceipt),
+                copyCommands: [createRuntimeImageCopyCommand(daimonRuntime.image, installRoot)],
+                env: {
+                    ...containerEnv,
+                    [DAIMON_WAKE_FUSE_DIRECTORY_ENV]: DAIMON_WAKE_FUSE_DIRECTORY
+                },
                 runtimeName,
                 runtimeRoot: installRoot
             };
@@ -138,7 +149,7 @@ export const createRuntimeInstallRecipe = async (runtimeName, options = {}) => {
             }
             const prebuiltBaseImage = process.env[PI_RUNTIME_BASE_IMAGE_ENV]?.trim() || undefined;
             const npmPackages = [
-                resolveInstallPackageSpec(DAIMON_PACKAGE_NAME, DAIMON_PACKAGE_VERSION, packageOverrides),
+                resolveInstallPackageSpec(DAIMON_PACKAGE_NAME, PI_DAIMON_PACKAGE_VERSION, packageOverrides),
                 resolveInstallPackageSpec(MNEME_PACKAGE_NAME, MNEME_PACKAGE_VERSION, packageOverrides),
                 `${selection.packageName}@${selection.version}`,
                 `${PI_AI_PACKAGE_NAME}@${selection.version}`

package/dist/runtime/daimon/adapter.d.ts

@@ -0,0 +1,14 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+import type { RuntimeAdapter } from "../types.js";
+/**
+ * Workspace skill roots per Daimon engine.
+ *
+ * Codex and AGY keep both CLI-engine roots. A brokered Grok worker loads no
+ * workspace skill at all: Grok 1.0.34 discovers `.agents/skills` (never
+ * `.codex/skills`) only in a trusted folder, and Daimon keeps the workspace
+ * untrusted (root-owned empty `trusted_folders.toml`) and replaces the system
+ * prompt, whose fixed text references no skill. Emitting either root would ship
+ * files nothing reads, so none are emitted and the declaration is reported.
+ */
+export declare const daimonSkillBaseDirectories: (node: ResolvedAgentNode) => readonly string[];
+export declare const daimonAdapter: RuntimeAdapter;

package/dist/runtime/daimon/adapter.js

@@ -0,0 +1,254 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { CLI_ENGINE_SKILL_BASE_DIRECTORIES, createAgentCapabilities, createDiagnostic, createDocumentFiles, createSkillFiles } from "../common.js";
+import { parseEveryScheduleMs } from "../scheduleUtils.js";
+import { assertDaimonAgentOptions, assertDaimonInstructionBounds, createDaimonContainerTargets, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, DAIMON_CONFIG_FILE, DAIMON_CONTROL_PORT, DAIMON_ENGINES, resolveDaimonEngine } from "./config.js";
+import { resolveDaimonGrokModel } from "./grokModel.js";
+import { prepareDaimonRuntimeAuth } from "./runAuth.js";
+import { hasDaimonScheduleAuthority } from "./scheduleAuthority.js";
+import { resolveDaimonAttention } from "./attention.js";
+const assertDaimonSurfaces = (surfaces) => {
+    if (!surfaces)
+        return;
+    const enabled = Object.entries(surfaces)
+        .filter(([name]) => name !== "moltnet")
+        .filter(([, value]) => Array.isArray(value) ? value.length > 0 : value !== undefined)
+        .map(([name]) => name);
+    if (enabled.length > 0) {
+        throw new SpawnfileError("validation_error", `Daimon organization runtime v1 only lowers Moltnet agent surfaces; remove: ${enabled.sort().join(", ")}`);
+    }
+};
+const assertDaimonModel = (target) => {
+    if (target.provider === "openai" && target.auth.method === "codex" && !target.endpoint)
+        return;
+    if (target.provider === "xai" && target.auth.method === "grok" && !target.endpoint)
+        return;
+    throw new SpawnfileError("validation_error", "Daimon organization runtime v1 accepts only the optional OpenAI Codex subscription intent or a brokered xAI Grok declaration; AGY engine auth stays Daimon-owned");
+};
+/**
+ * The compile-time warning for an agent that asked to be confined to its
+ * workspace on a runtime that does not confine anything.
+ *
+ * `restrict_to_workspace` is accepted by `validateRuntimeOptions` below (it is
+ * on the allowlist beside `engine`) and is then read by nothing under
+ * `src/runtime/daimon/`: the `noopolis.daimon.organization-runtime.v1` contract
+ * this adapter lowers into carries no workspace-confinement field, so the
+ * declaration reaches no runtime behavior at all. PicoClaw consumes an
+ * identically named option and really does lower it
+ * (`../picoclaw/adapter.ts`), which is exactly what makes the option look
+ * wired here.
+ *
+ * This warns rather than implementing confinement, because real workspace
+ * restriction for Daimon is a sandbox-profile change in daimon itself plus a
+ * widening of the digest-pinned organization runtime contract. It warns rather
+ * than rejecting, because an existing project that already declares the option
+ * must keep compiling. And it does not stay silent, because a security option
+ * that is accepted and ignored is a worse failure than one that is refused.
+ *
+ * Declaring `restrict_to_workspace: false` asks for nothing, so it says
+ * nothing.
+ */
+const daimonWorkspaceRestrictionWarning = (node) => {
+    const declared = node.runtime.options.restrict_to_workspace;
+    if (declared === undefined || declared === false)
+        return undefined;
+    return `Daimon organization runtime v1 does not enforce restrict_to_workspace: agent ${node.name} declares `
+        + "it, but no Daimon lowering reads the option and the organization runtime contract carries no workspace "
+        + "confinement field, so this agent's engine can reach the whole container filesystem. Move the agent to the "
+        + "picoclaw runtime, which lowers restrict_to_workspace into its agent defaults, or drop the option and treat "
+        + "the container boundary as this agent's only isolation.";
+};
+/**
+ * Workspace skill roots per Daimon engine.
+ *
+ * Codex and AGY keep both CLI-engine roots. A brokered Grok worker loads no
+ * workspace skill at all: Grok 1.0.34 discovers `.agents/skills` (never
+ * `.codex/skills`) only in a trusted folder, and Daimon keeps the workspace
+ * untrusted (root-owned empty `trusted_folders.toml`) and replaces the system
+ * prompt, whose fixed text references no skill. Emitting either root would ship
+ * files nothing reads, so none are emitted and the declaration is reported.
+ */
+export const daimonSkillBaseDirectories = (node) => resolveDaimonEngine(node) === "grok" ? [] : CLI_ENGINE_SKILL_BASE_DIRECTORIES;
+const daimonGrokSkillWarning = (node) => {
+    if (resolveDaimonEngine(node) !== "grok" || node.skills.length === 0)
+        return undefined;
+    return `Daimon Grok agent ${node.name} declares workspace skills (${node.skills.map((skill) => skill.name).sort().join(", ")}) `
+        + "that its brokered worker never loads: Grok discovers project skills only in a trusted workspace, and Daimon keeps the "
+        + "workspace untrusted and supplies instructions through the prompt. No skill files are emitted; move the guidance into the agent's docs.";
+};
+const daimonCodexPolicyError = (node) => {
+    if (node.runtime.options.codex_policy === undefined)
+        return undefined;
+    if (node.runtime.options.codex_policy !== "workspace-no-network") {
+        return "Daimon runtime option codex_policy must be workspace-no-network";
+    }
+    if (resolveDaimonEngine(node) !== "codex") {
+        return "Daimon runtime option codex_policy=workspace-no-network is only supported for Codex agents";
+    }
+    if (node.execution?.sandbox?.mode !== "workspace") {
+        return "Daimon runtime option codex_policy=workspace-no-network requires execution.sandbox.mode: workspace";
+    }
+    return undefined;
+};
+/**
+ * AGY is no longer excluded here.
+ *
+ * It used to be: an AGY agent that declared an MCP server or a Moltnet surface
+ * was rejected outright, because Daimon pinned AGY to `toolAccess: "none"`.
+ * Daimon now mounts AGY on the same per-wake MCP endpoint Codex and Grok get
+ * (`daimon/src/pi/cliMcpRegistration.ts`), so an AGY agent can take part in an
+ * organization, and the declaration this compiler lowers is one the runtime
+ * actually honours. The remaining validations are engine-independent and stay.
+ */
+// `${workspace}` in an MCP command resolves to the agent workspace under
+// `<instance-root>`, which container rendering makes absolute.
+const isTargetAbsolutePath = (value) => value !== undefined && (value.startsWith("/") || value.startsWith("<instance-root>/"));
+const unsupportedAgentFeatures = (node) => {
+    for (const server of node.mcpServers) {
+        if (!server.tools?.length)
+            throw new SpawnfileError("validation_error", `Daimon MCP server ${server.name} requires an explicit tools allowlist`);
+        if (server.transport === "stdio" && !isTargetAbsolutePath(server.command))
+            throw new SpawnfileError("validation_error", `Daimon stdio MCP server ${server.name} requires an absolute command`);
+    }
+    const engine = resolveDaimonEngine(node);
+    if (engine === "agy" && node.execution?.model) {
+        throw new SpawnfileError("validation_error", "Daimon AGY agents must omit Spawnfile execution.model; their subscription auth and model selection are Daimon-owned");
+    }
+    if (engine === "codex" && node.execution?.model?.primary.auth?.method === "grok") {
+        throw new SpawnfileError("validation_error", `Daimon Codex agent ${node.name} cannot declare Grok model auth`);
+    }
+    if (engine === "grok")
+        resolveDaimonGrokModel(node);
+};
+const scheduleCapabilityFor = async (node) => {
+    if (!node.schedule)
+        return {};
+    let authoritative = false;
+    try {
+        authoritative = await hasDaimonScheduleAuthority();
+    }
+    catch { /* The lowering gate reports invalid receipt details. */ }
+    if (!authoritative) {
+        return {
+            message: "Daimon v2 schedule state: degraded; the selected image receipt does not attest v2, so no schedule lowering is emitted",
+            outcome: "degraded"
+        };
+    }
+    if (node.schedule.kind === "disabled") {
+        return {
+            message: "Daimon v2 schedule state: disabled; normalized=disabled; persistence=none; timer=stopped",
+            outcome: "supported"
+        };
+    }
+    const normalized = node.schedule.kind === "every"
+        ? `every/${parseEveryScheduleMs(node.schedule.every)}ms`
+        : `cron/${node.schedule.cron.trim().replace(/\s+/gu, " ")}; zone=${node.schedule.timezone ?? "UTC"}`;
+    return {
+        message: `Daimon v2 schedule state: supported; normalized=${normalized}; persistence=sha256(agent+schedule) in durable acceptance root; timer=runtime-managed`,
+        outcome: "supported"
+    };
+};
+export const daimonAdapter = {
+    assertSupportedModelTarget: assertDaimonModel,
+    assertSupportedSurfaces: assertDaimonSurfaces,
+    container: {
+        configFileName: DAIMON_CONFIG_FILE,
+        configPathEnv: "SPAWNFILE_DAIMON_CONFIG",
+        env: [{
+                description: "Bearer token for the Daimon organization control API",
+                generated: true,
+                name: "SPAWNFILE_DAIMON_CONTROL_TOKEN",
+                required: true
+            }],
+        instancePaths: {
+            configPathTemplate: "<instance-root>/daimon/<config-file>",
+            sourceWorkspacePathTemplate: "<instance-root>/workspace/agents/<source-slug>",
+            workspacePathTemplate: "<instance-root>/workspace"
+        },
+        port: DAIMON_CONTROL_PORT,
+        portEnv: "SPAWNFILE_DAIMON_CONTROL_PORT",
+        standaloneBaseImage: "node:24-bookworm-slim",
+        startCommand: ["bash", "<runtime-root>/daimon-start.sh"],
+        systemDeps: [
+            "bash",
+            "bubblewrap",
+            "ca-certificates",
+            "curl",
+            "dbus-daemon",
+            "gnome-keyring",
+            "util-linux"
+        ]
+    },
+    async compileAgent(node) {
+        unsupportedAgentFeatures(node);
+        const scheduleCapability = await scheduleCapabilityFor(node);
+        const memorySelectionWarning = daimonMemorySelectionWarning(node);
+        const memoryVectorWarning = daimonMemoryVectorRecallWarning(node);
+        const workspaceRestrictionWarning = daimonWorkspaceRestrictionWarning(node);
+        const codexPolicyError = daimonCodexPolicyError(node);
+        const grokSkillWarning = daimonGrokSkillWarning(node);
+        return {
+            capabilities: createAgentCapabilities(node, {
+                mcpOutcome: "supported",
+                moltnetMessage: "Daimon exposes one scoped authenticated send tool during real cognition turns",
+                moltnetOutcome: "supported",
+                ...daimonMemoryCapabilityFor(node),
+                scheduleMessage: scheduleCapability.message,
+                scheduleOutcome: scheduleCapability.outcome
+            }),
+            diagnostics: [
+                ...(node.execution?.sandbox
+                    ? [createDiagnostic("warn", "Daimon runtime isolation is enforced by the selected runtime image")]
+                    : []),
+                ...(memorySelectionWarning ? [createDiagnostic("warn", memorySelectionWarning)] : []),
+                ...(memoryVectorWarning ? [createDiagnostic("warn", memoryVectorWarning)] : []),
+                ...(workspaceRestrictionWarning ? [createDiagnostic("warn", workspaceRestrictionWarning)] : []),
+                ...(grokSkillWarning ? [createDiagnostic("warn", grokSkillWarning)] : []),
+                ...(codexPolicyError ? [createDiagnostic("error", codexPolicyError)] : [])
+            ],
+            files: [
+                ...createDocumentFiles("workspace", node.docs),
+                ...createSkillFiles(daimonSkillBaseDirectories(node), node.skills)
+            ]
+        };
+    },
+    createContainerTargets: createDaimonContainerTargets,
+    name: "daimon",
+    preflightAgent(node, nodeId) {
+        unsupportedAgentFeatures(node);
+        const codexPolicyError = daimonCodexPolicyError(node);
+        if (codexPolicyError)
+            throw new SpawnfileError("validation_error", codexPolicyError);
+        assertDaimonAgentOptions(nodeId, node);
+        assertDaimonInstructionBounds(nodeId, node);
+    },
+    prepareRuntimeAuth: prepareDaimonRuntimeAuth,
+    systemInstructionSurface: {
+        placement: "append_pointer",
+        resolvePath() {
+            return "workspace/AGENTS.md";
+        }
+    },
+    validateRuntimeOptions(options) {
+        const diagnostics = [];
+        if (options.engine !== undefined &&
+            (typeof options.engine !== "string" || !DAIMON_ENGINES.includes(options.engine))) {
+            diagnostics.push(createDiagnostic("error", `Daimon runtime option engine must be one of ${DAIMON_ENGINES.join(", ")}`));
+        }
+        for (const key of Object.keys(options).filter((key) => !["engine", "restrict_to_workspace", "codex_policy", "attention", "turn_limits"].includes(key))) {
+            diagnostics.push(createDiagnostic("error", `Daimon runtime option ${key} is not part of organization runtime v1`));
+        }
+        if (options.codex_policy !== undefined && options.codex_policy !== "workspace-no-network") {
+            diagnostics.push(createDiagnostic("error", "Daimon runtime option codex_policy must be workspace-no-network"));
+        }
+        if (options.codex_policy === "workspace-no-network" && options.engine !== undefined && options.engine !== "codex") {
+            diagnostics.push(createDiagnostic("error", "Daimon runtime option codex_policy=workspace-no-network is only supported for Codex agents"));
+        }
+        try {
+            resolveDaimonAttention(options.attention);
+        }
+        catch (error) {
+            diagnostics.push(createDiagnostic("error", error instanceof Error ? error.message : "Daimon attention is invalid"));
+        }
+        return diagnostics;
+    }
+};

package/dist/runtime/daimon/attention.d.ts

@@ -0,0 +1,8 @@
+export type DaimonAttention = Readonly<{
+    maxBatchMessages: number;
+    maxBatchBytes: number;
+    maxExecutions?: number;
+    maxTokens?: number;
+}>;
+export declare const resolveDaimonAttention: (value: unknown) => DaimonAttention | undefined;
+export declare const assertDaimonAttentionAuthority: () => Promise<void>;

package/dist/runtime/daimon/attention.js

@@ -0,0 +1,32 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { hasDaimonScheduleAuthority } from "./scheduleAuthority.js";
+const fields = {
+    max_batch_messages: { target: "maxBatchMessages", minimum: 1, maximum: 32 },
+    max_batch_bytes: { target: "maxBatchBytes", minimum: 1024, maximum: 12000 },
+    max_executions: { target: "maxExecutions", minimum: 1, maximum: Number.MAX_SAFE_INTEGER },
+    max_tokens: { target: "maxTokens", minimum: 1, maximum: Number.MAX_SAFE_INTEGER }
+};
+export const resolveDaimonAttention = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new SpawnfileError("validation_error", "Daimon runtime option attention must be an object");
+    }
+    const result = { maxBatchMessages: 8, maxBatchBytes: 12000 };
+    for (const [key, limit] of Object.entries(value)) {
+        if (!Object.hasOwn(fields, key)) {
+            throw new SpawnfileError("validation_error", `Daimon runtime option attention.${key} is unsupported`);
+        }
+        const field = fields[key];
+        if (typeof limit !== "number" || !Number.isSafeInteger(limit) || limit < field.minimum || limit > field.maximum) {
+            throw new SpawnfileError("validation_error", `Daimon runtime option attention.${key} must be an integer from ${field.minimum} to ${field.maximum}`);
+        }
+        result[field.target] = limit;
+    }
+    return result;
+};
+export const assertDaimonAttentionAuthority = async () => {
+    if (!await hasDaimonScheduleAuthority()) {
+        throw new SpawnfileError("runtime_error", "Daimon attention is disabled: the selected image capability receipt does not attest its runtime contract");
+    }
+};

package/dist/runtime/daimon/config.d.ts

@@ -0,0 +1,29 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+import type { ContainerTarget, ContainerTargetInput } from "../types.js";
+import { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory } from "./memory.js";
+export declare const DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY: {
+    readonly mode: "workspace-write";
+    readonly networkAccess: false;
+    readonly webSearch: "disabled";
+};
+export { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory };
+export declare const DAIMON_CONFIG_FILE = "daimon-organization-runtime.json";
+export declare const DAIMON_CONTROL_PORT = 19700;
+export declare const DAIMON_MAX_AGENTS = 32;
+export declare const DAIMON_ORGANIZATION_TARGET_ID = "daimon-organization";
+export declare const DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY = "state/wake-acceptance";
+export declare const DAIMON_RUNTIME_ACCEPTANCE_STORE_ENV = "DAIMON_RUNTIME_ACCEPTANCE_STORE";
+export declare const DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID = "daimon-organization-acceptance-store";
+export declare const DAIMON_RUNTIME_READINESS_RECEIPT_ENV = "DAIMON_RUNTIME_READINESS_RECEIPT";
+export declare const DAIMON_WAKE_FUSE_DIRECTORY = "/var/lib/spawnfile/daimon/wake-fuse";
+export declare const DAIMON_WAKE_FUSE_DIRECTORY_ENV = "DAIMON_WAKE_FUSE_DIRECTORY";
+export declare const DAIMON_WAKE_FUSE_MOUNT_ID = "daimon-wake-fuse";
+export declare const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
+export declare const DAIMON_ENGINES: readonly ["agy", "codex", "grok"];
+type DaimonEngine = typeof DAIMON_ENGINES[number];
+/** The per-agent option checks `createDaimonContainerTargets` applies, for preflight. */
+export declare const assertDaimonAgentOptions: (agentId: string, node: ResolvedAgentNode) => void;
+/** The instruction-size check compile applies in `createDaimonContainerTargets`, for preflight. */
+export declare const assertDaimonInstructionBounds: (agentId: string, node: ResolvedAgentNode) => void;
+export declare const resolveDaimonEngine: (node: ResolvedAgentNode) => DaimonEngine;
+export declare const createDaimonContainerTargets: (inputs: ContainerTargetInput[]) => Promise<ContainerTarget[]>;