spawnfile 0.1.14 → 0.1.18

package/dist/runtime/daimon/contractManifest.d.ts

@@ -0,0 +1,346 @@
+import { DAIMON_WAKE_MOMENTS } from "./wakeMoments.js";
+export declare const DAIMON_CONTRACT_MANIFEST_VERSION: "noopolis.daimon.runtime-contract-manifest.v5";
+export declare const DAIMON_CONTRACT_MANIFEST_SHA256: "sha256:e39551277c6727c8807b1247e759f57addcee3f17f1405ebc927179647d64de6";
+export declare const DAIMON_CONTRACT_MANIFEST_FILE = "contract-manifest.json";
+export declare const DAIMON_CONTRACT_MANIFEST_DIGEST_FILE = "contract-manifest.sha256";
+export declare const DAIMON_RUNTIME_HOME_ROOT = "/var/lib/spawnfile/instances/daimon";
+export declare const DAIMON_ENGINE_KINDS: readonly ["agy", "codex", "grok"];
+export declare const DAIMON_ORGANIZATION_RUNTIME_CONFIG_VERSIONS: readonly ["noopolis.daimon.organization-runtime.v1", "noopolis.daimon.organization-runtime.v2"];
+export declare const DAIMON_ENGINE_CREDENTIALS: {
+    readonly codex: {
+        readonly destinationRelativePath: ".codex/auth.json";
+        readonly directoryMode: 448;
+        readonly fileMode: 384;
+        readonly sourceRelativePath: ".daimon-inbound/codex-auth";
+        readonly sourceSlot: "codex-auth";
+    };
+};
+export declare const DAIMON_GROK_SUBSCRIPTION_REALM: {
+    readonly agentCredentialRelativePath: ".grok/auth.json";
+    readonly bootstrapMountPath: "/var/lib/spawnfile/daimon/grok-bootstrap-auth";
+    readonly bootstrapSourceSlot: "grok-auth";
+    readonly directoryMode: 448;
+    readonly durableMountPath: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+    readonly fileMode: 384;
+    readonly maxCredentialBytes: number;
+};
+export declare const DAIMON_GROK_BROKER_MODELS: readonly ["grok-4.6", "grok-4.5", "grok-build"];
+export declare const DAIMON_GROK_BROKER_REASONING_EFFORTS: readonly ["low", "medium", "high"];
+export type DaimonGrokBrokerModel = typeof DAIMON_GROK_BROKER_MODELS[number];
+export type DaimonGrokBrokerReasoningEffort = typeof DAIMON_GROK_BROKER_REASONING_EFFORTS[number];
+/**
+ * Byte mirror of Daimon's `GROK_ENGINE_BROKER` (daimon
+ * `src/contracts/runtimeContractManifest.ts`), attested key-for-key against the
+ * vendored `contract-manifest.json` by `parseDaimonContractManifest`.
+ */
+export declare const DAIMON_GROK_ENGINE_BROKER: {
+    readonly nativeAbiVersion: 2;
+    readonly nativeExecutablePath: "/opt/daimon/bin/daimon-engine-broker";
+    readonly grokExecutablePath: "/usr/local/bin/grok";
+    readonly registrationPath: "/etc/daimon-engine-broker/registrations.bin";
+    readonly credentialHomePath: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+    readonly turnStorePath: "/var/lib/spawnfile/daimon/grok-subscription-realm/turns";
+    readonly controlSocketPath: "/run/daimon-engine-broker/control.sock";
+    readonly backendSocketPath: "/run/daimon-engine-broker/backend.sock";
+    readonly launcherSocketPath: "/run/daimon-engine-broker/launcher.sock";
+    readonly serviceConfigPath: "/etc/daimon-engine-broker/service.json";
+    readonly providerProxy: {
+        readonly host: "127.0.0.1";
+        readonly port: 43123;
+    };
+    readonly mcpFacade: {
+        readonly host: "127.0.0.1";
+        readonly port: 43124;
+        readonly path: "/mcp";
+    };
+    readonly identities: {
+        readonly organizationUid: 2000;
+        readonly brokerUid: 2100;
+        readonly firstWorkerUid: 2200;
+    };
+    readonly grokCliVersion: "1.0.34";
+    readonly grokCliBuild: "3736acbc8658";
+    readonly grokCliArtifacts: {
+        readonly arm64: {
+            readonly url: "https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-1.0.34-linux-aarch64";
+            readonly sha256: "39ab87666877d64ef3a40aa60fbe0c3b6a6acd7001b78fe60e2c76bb6cfc4a94";
+            readonly bytes: 136090504;
+        };
+        readonly x64: {
+            readonly url: "https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-1.0.34-linux-x86_64";
+            readonly sha256: "be5905e107d2b8b5f3c142d21ecfe4c8fd32a913d2fd551b788707930c4dc80d";
+            readonly bytes: 163035648;
+        };
+    };
+    readonly worker: {
+        readonly modelId: "daimon-broker-grok";
+        readonly models: readonly ["grok-4.6", "grok-4.5", "grok-build"];
+        readonly reasoningEfforts: readonly ["low", "medium", "high"];
+        readonly defaultModel: "grok-4.6";
+        readonly defaultReasoningEffort: "low";
+        readonly toolIds: readonly ["run_terminal_cmd", "read_file", "grep", "list_dir", "search_tool", "use_tool"];
+        readonly visibleTools: readonly ["grep", "list_dir", "read_file", "run_terminal_command", "search_tool", "use_tool"];
+        readonly maxTurns: 48;
+        readonly systemPromptSha256: "2c31c0085a54a4efbf9c0cf0b8124c56e47f38691b7f0c7fa233a74abaa8ddf8";
+        readonly configSha256: {
+            readonly "grok-4.6": {
+                readonly low: "ab58499ac32678097c146479896f2b8a8e2b0e39aea22dc0a60b6227e370538e";
+                readonly medium: "df1a5cc84346e7f6bf6090492fbd19faaefb42953e3bb2e8c6cbc0572242403f";
+                readonly high: "65b0212564fb74042b1503d293fb8d3620276033264c0efade2a539ca09218e3";
+            };
+            readonly "grok-4.5": {
+                readonly low: "8247127c3625ff7c5d8d527a53596b89ec6557a821ac46cfd00bd122b90daff6";
+                readonly medium: "59288cee61297bb8c002097061a48f77b09d310754187a253ee089f7172a9155";
+                readonly high: "c63c3387ce92d94ec3f690abfe98942afcd7c9e17ff84816bbe751f340ab251f";
+            };
+            readonly "grok-build": {
+                readonly low: "fb343f2809903f26d21681470943235031f946e99085542fd89555eb7782cbb5";
+                readonly medium: "8a587ef75c90eab70d19b24583e60051d6fba9d90c558839fdbb15588b4cc656";
+                readonly high: "a23724e00d670caee185ba7690d2daa868173e53905cf446f5329666f01ab4e3";
+            };
+        };
+        readonly clockedConfigSha256: {
+            readonly "grok-4.5": {
+                readonly high: "907d8967960c342b442d6d256b2585f3c85bd846a78578f596f0b605403d6d34";
+                readonly low: "3c4f3515b21c1bffb3fb770e2ecb4b918b6c43d5e77c1fd47e1e6698d1fedee7";
+                readonly medium: "9117e12b2f3f6fa045799592969cbaae1c2f3b1ea79330badac8655b9b41dd7a";
+            };
+            readonly "grok-4.6": {
+                readonly high: "203744f6f0dfc0bc80cfb896880497edfd9b3de4dcf33060e8ef4d2ef5f220a7";
+                readonly low: "751f1dcd04983e5e5883df5a8fefa04f201e187e5ef1f344d3bf83f950830432";
+                readonly medium: "f1406f93a8091eb0c09e07321254a9c783a89b0bbf5548d9613d53a8d087a517";
+            };
+            readonly "grok-build": {
+                readonly high: "6efddadc82c38020d3351829e54bb09fa456cd6d76ea1247902794d82a4a3ffa";
+                readonly low: "a8c63ba910623a0686930c27db0733f4a2588c7fca9dd7da25c3f18027720ab5";
+                readonly medium: "6afcd2b90c0d19794f8c0d22147a0f011946a92e613f89dae98b0ca729313101";
+            };
+        };
+        readonly taskClock: {
+            readonly directoryMode: 493;
+            readonly directoryPath: "/run/daimon-engine-broker/task-clock/slot-0";
+            readonly fileMode: 420;
+            readonly ownerUid: 2100;
+            readonly preloadPath: "/usr/local/lib/daimon/libfaketime.so.1";
+            readonly rootDirectoryPath: "/run/daimon-engine-broker/task-clock";
+            readonly slotDirectoryPattern: "/run/daimon-engine-broker/task-clock/slot-{slot}";
+            readonly slotFilePattern: "/run/daimon-engine-broker/task-clock/slot-{slot}/faketime";
+            readonly timestampFilePath: "/run/daimon-engine-broker/task-clock/slot-0/faketime";
+            readonly version: "noopolis.daimon.grok-broker-task-clock.v2";
+            readonly workerView: "own-directory-visible-sibling-directories-denied";
+        };
+        readonly home: {
+            readonly directory: {
+                readonly uid: 0;
+                readonly group: "worker";
+                readonly mode: 1017;
+            };
+            readonly sessionsDirectory: {
+                readonly relativePath: "sessions";
+                readonly uid: 0;
+                readonly group: "worker";
+                readonly mode: 1017;
+            };
+            readonly readOnlyFiles: {
+                readonly names: readonly ["config.toml", "managed_config.toml", "requirements.toml", "sandbox.toml", "trusted_folders.toml"];
+                readonly uid: 0;
+                readonly gid: 0;
+                readonly mode: 292;
+            };
+            readonly sandboxEvents: {
+                readonly relativePath: "sessions/sandbox-events.jsonl";
+                readonly owner: "worker";
+                readonly group: "broker";
+                readonly mode: 416;
+            };
+            readonly privateTmp: {
+                readonly relativeToWorkerHome: "tmp";
+                readonly owner: "worker";
+                readonly mode: 448;
+            };
+            readonly sharedTmp: {
+                readonly paths: readonly ["/tmp", "/var/tmp"];
+                readonly uid: 0;
+                readonly maxGroupExclusive: 2200;
+                readonly otherMode: 4;
+                readonly mode: 1020;
+            };
+            readonly organizationRuntimeHome: {
+                readonly owner: "organization";
+                readonly group: "worker";
+                readonly mode: 456;
+            };
+            readonly spillDirectory: {
+                readonly relativeToRuntimeHome: "tool-output";
+                readonly owner: "organization";
+                readonly group: "worker";
+                readonly mode: 1512;
+                readonly fileMode: 416;
+            };
+        };
+    };
+    readonly bounds: {
+        readonly promptBytes: 65536;
+        readonly capabilityBytes: 4096;
+        readonly capabilityBundleBytes: 8196;
+        readonly outputBytes: 262144;
+    };
+    readonly controlProtocolVersion: "noopolis.daimon.engine-broker.v4";
+    readonly turnRecordVersions: readonly ["noopolis.daimon.engine-broker-turn.v1", "noopolis.daimon.engine-broker-turn.v2"];
+    readonly serviceConfigVersions: readonly ["noopolis.daimon.engine-broker-service.v1", "noopolis.daimon.engine-broker-service.v2", "noopolis.daimon.engine-broker-service.v3"];
+    readonly slotRouting: {
+        readonly controlCaller: "organization";
+        readonly key: "slot";
+        readonly repeatedAgentIds: true;
+        readonly resetRequest: "reset_slot";
+        readonly resetResponse: "slot_reset";
+        readonly slotEnvironment: "DAIMON_ENGINE_BROKER_SLOT";
+        readonly turnStoreDirectory: "slot-{slot}";
+        readonly workersMayControl: false;
+    };
+    readonly runRequestBudget: {
+        readonly countsCredentialRetries: true;
+        readonly fileName: "run-requests.json";
+        readonly includesInferenceGrants: true;
+        readonly maximumField: "maxRunRequests";
+        readonly storeField: "runRequestStore";
+    };
+    readonly turnLimits: {
+        readonly keys: readonly ["maxRequests", "maxTokens", "timeoutMs"];
+        readonly v1Defaults: {
+            readonly maxRequests: 32;
+            readonly maxTokens: 300000;
+            readonly timeoutMs: 240000;
+        };
+        readonly bounds: {
+            readonly maxRequests: readonly [1, 48];
+            readonly maxTokens: readonly [1, 10000000];
+            readonly timeoutMs: readonly [1000, 3600000];
+        };
+        readonly limitReasons: readonly ["tokens", "requests", "timeout", "none"];
+        readonly wakeMayOnlyLower: true;
+        readonly tokenCeilingOvershoot: "at-most-one-request";
+        readonly maxInFlightRequests: 1;
+        readonly requestUsageMaxTokens: 500000;
+        readonly missingUsageEstimate: {
+            readonly inputBytesPerToken: 2;
+            readonly outputTokens: 4096;
+        };
+    };
+    readonly wakeLimitEnvironment: {
+        readonly timeoutMs: "DAIMON_ENGINE_WAKE_TIMEOUT_MS";
+        readonly maxTokens: "DAIMON_ENGINE_WAKE_TOKEN_CEILING";
+    };
+    readonly projectionVersion: "noopolis.daimon.grok-broker-projection.v3";
+    readonly slotPreflightVersion: "noopolis.daimon.grok-slot-preflight.v2";
+    readonly inferenceGrants: {
+        readonly requestKinds: readonly ["request_inference_grant", "release_inference_grant"];
+        readonly purposes: readonly ["judge", "optimizer"];
+        readonly tokenPrefix: "inference_";
+        readonly ttlMs: 600000;
+        readonly limits: {
+            readonly maxRequests: 64;
+            readonly maxTokens: 2000000;
+        };
+        readonly maxLiveGrants: 8;
+        readonly maxInFlightRequestsPerGrant: 1;
+        readonly bodyMembers: readonly ["messages", "model", "reasoning_effort", "response_format", "stream", "stream_options"];
+        readonly messageRoles: readonly ["system", "user", "assistant"];
+        readonly failureCodes: readonly ["auth_stale", "grant_limit", "invalid_request", "unavailable"];
+        readonly ledgerVersion: "noopolis.daimon.inference-usage.v1";
+        readonly ledgerDedupeKey: readonly ["grant", "request"];
+        readonly client: {
+            readonly modelId: "daimon-inference-grok";
+            readonly envKey: "DAIMON_INFERENCE_GRANT";
+            readonly configSha256: {
+                readonly "grok-4.6": {
+                    readonly low: "79314d039f787e4ebfec7dacf57adc969086b948f564dec008f0ed6367e6062f";
+                    readonly medium: "6f538de0547c0c4e6a3f04ae08595ceadadabb06b75f6b6ee4c428744bb95cd8";
+                    readonly high: "5652656effa82f0c4f09cf8226b16e6140332a5a358b571194bb5563312367ac";
+                };
+                readonly "grok-4.5": {
+                    readonly low: "a07f7436f1268bb399ec233c65d3b3d8fb99a11a1f175f8da1ca133c9367bc74";
+                    readonly medium: "1f4c0d4dad1f3b09419b5739db6423a09e0049abc091594c64123a75dd53dfb9";
+                    readonly high: "ffbc33728b821e9854fbc7c93601e599225da421ecfd6ebf10d314afcc28d6f2";
+                };
+                readonly "grok-build": {
+                    readonly low: "ca15c6a562a008227d39c51d3a3a83715663089b3784e8b46debb1fb67b3c4a1";
+                    readonly medium: "01783fb6beadcf6f8486fff0836820ad43fab5662b812a907fe9cfdb83e9804d";
+                    readonly high: "98d16f2b7d12f4eb540d625c853e51d227933e204923e43e8b9b4176f10aca2c";
+                };
+            };
+        };
+    };
+    readonly artifacts: {
+        readonly sourceSha256: "15836d7ad69f12ef581a6e5b8635c9db43b2177dac609160c0749d3d1fefbaa8";
+        readonly x64Sha256: "95aa9c272225e74ff9f45f54dde4bc30aee324e9ba24d8a876db9151c81b454d";
+        readonly arm64Sha256: "d0dc1c03197c3e90f09b66ad7c89b4f7b448d06dc84c03b247dce976d6018d6e";
+    };
+};
+/**
+ * Where the Daimon broker writes its per-turn usage ledger, and what this
+ * compiler provisions. Deliberately kept out of `DAIMON_GROK_ENGINE_BROKER`:
+ * that object's canonical bytes are digest-pinned and attested against the
+ * runtime image at compile time, so a new key there would make every pinned
+ * image fail to attest. Mirrors `TURN_USAGE_LEDGER` in
+ * `daimon/src/runtime/turnUsageLedger.ts`.
+ */
+export declare const DAIMON_GROK_TURN_USAGE_LEDGER: {
+    readonly version: "noopolis.daimon.turn-usage.v1";
+    readonly directoryPath: "/var/lib/spawnfile/daimon/usage";
+    readonly filePath: "/var/lib/spawnfile/daimon/usage/usage.jsonl";
+    readonly rotatedFilePath: "/var/lib/spawnfile/daimon/usage/usage.jsonl.1";
+    readonly directoryMode: 488;
+    readonly fileMode: 416;
+    /**
+     * Mirrors `TURN_USAGE_ROTATE_BYTES` in `daimon/src/runtime/turnUsageLedger.ts`
+     * (Spawnfile must not import from `daimon/`, so this is the Spawnfile-side
+     * copy of the same agreed number). It is a LOWER bound on the size of a
+     * rotated generation, not an upper one: the broker rotates on the append
+     * *after* the file reaches this size, so `usage.jsonl.1` is always at least
+     * this large and the line that crossed the bound overshoots it. Anything
+     * sizing a read of one generation must therefore leave headroom above this
+     * number rather than matching it (see
+     * `DEFAULT_DOCKER_PROBE_MAX_BUFFER_BYTES`).
+     */
+    readonly rotateBytes: number;
+};
+export declare const DAIMON_AGY_SUBSCRIPTION_REALM: {
+    readonly directoryMode: 448;
+    readonly durableMountPath: "/var/lib/spawnfile/daimon/agy-subscription-realm";
+    readonly fileMode: 384;
+    readonly maxUnlockBytes: 4096;
+    readonly unlockMountPath: "/var/lib/spawnfile/daimon/agy-unlock-secret";
+    readonly unlockSourceSlot: "agy-unlock-secret";
+};
+export type DaimonEngine = typeof DAIMON_ENGINE_KINDS[number];
+export type DaimonPortableEngine = keyof typeof DAIMON_ENGINE_CREDENTIALS;
+type DaimonCredentialMaterial = (typeof DAIMON_ENGINE_CREDENTIALS)[DaimonPortableEngine];
+export interface DaimonContractManifest {
+    readonly wakeMoments?: typeof DAIMON_WAKE_MOMENTS;
+    readonly agySubscriptionRealm: typeof DAIMON_AGY_SUBSCRIPTION_REALM;
+    readonly consumedConfigFields: readonly string[];
+    readonly engineCredentialMaterial: Readonly<Record<DaimonPortableEngine, DaimonCredentialMaterial>>;
+    readonly grokSubscriptionRealm: typeof DAIMON_GROK_SUBSCRIPTION_REALM;
+    readonly grokEngineBroker: typeof DAIMON_GROK_ENGINE_BROKER;
+    readonly supportedEngineKinds: readonly DaimonEngine[];
+    readonly wakeAcceptanceTypes: readonly ["manual", "message", "schedule", "external"];
+    readonly deliverySemantics: Readonly<{
+        activeDeliveryIdempotency: "unbounded-until-terminal";
+        terminalReceiptHorizon: 2_048;
+        recovery: "at-least-once-with-stable-wake-id";
+        concurrentSameAgentTurns: false;
+        externalEffectsExactlyOnce: false;
+    }>;
+    readonly version: typeof DAIMON_CONTRACT_MANIFEST_VERSION;
+}
+export interface VerifiedDaimonContractManifest {
+    readonly digest: `sha256:${string}`;
+    readonly manifest: DaimonContractManifest;
+}
+export declare const parseDaimonContractManifest: (raw: unknown) => DaimonContractManifest;
+/** Capability comes from receipt-bound manifest content, never a runtime version. */
+export declare const daimonSupportsWakeMoments: (manifest: DaimonContractManifest) => boolean;
+export declare const assertDaimonRuntimeHome: (candidate: string) => string;
+export declare const readVerifiedDaimonContractManifest: (runtimeRoot: string) => Promise<VerifiedDaimonContractManifest>;
+export {};